1966 questions total · 27pages · All types, answers revealed
Drag and drop the steps for troubleshooting MPLS operations adjacency or connectivity failures into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Start by verifying LDP neighbor state, then check interface MPLS enablement, inspect label bindings, test end-to-end LSP connectivity, and finally validate TTL propagation for troubleshooting.
A network engineer runs the following command on Router R1: R1# show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 10.1.1.0/24 0 Gi0/0 192.168.1.2 17 21 10.2.2.0/24 1500 Gi0/0 192.168.1.2 18 Untagged 10.3.3.0/24 0 Gi0/1 192.168.2.2 Based on this output, what is the problem with the label entry for 10.3.3.0/24?
'Untagged' indicates the next hop did not provide a label.
Why this answer
The entry for 10.3.3.0/24 shows 'Untagged' in the outgoing label column, meaning the router is forwarding IP packets without an MPLS label. This indicates that the next-hop router (192.168.2.2) did not assign a label for this prefix, possibly because LDP is not enabled on that interface or the neighbor is not an LDP peer.
A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- --- --- 192.0.2.12 10.0.0.12 --- --- R1# show ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 45 Misses: 0 CEF Translated packets: 45, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 3 map-id 1 overload [Id] ip nat inside source list ACL1 pool POOL1 overload refcount 3 Based on this output, which statement is correct?
The output shows dynamic mappings with overload, and translations are active. No errors or misses indicate proper operation.
Why this answer
The output shows three dynamic translations from the inside local addresses (10.0.0.10–12) to inside global addresses (192.0.2.10–12) using the pool POOL1 (192.0.2.10–20). The 'overload' keyword in the NAT configuration enables Port Address Translation (PAT), allowing multiple inside hosts to share a single global IP by using unique port numbers. The 'refcount 3' and the presence of three active translations confirm that PAT is working correctly.
How to eliminate wrong answers
Option B is wrong because the pool has 17 usable addresses (192.0.2.10–20 with netmask 255.255.255.240), and only three are in use, so the pool is far from exhausted. Option C is wrong because the statistics show 0 static translations and 3 dynamic translations, and the configuration uses 'ip nat inside source list ACL1 pool POOL1 overload', which is dynamic NAT with PAT, not static NAT. Option D is wrong because the 'show ip nat statistics' output explicitly lists 'Inside interfaces: GigabitEthernet0/0' and 'Outside interfaces: GigabitEthernet0/1', which is the correct orientation for translating inside local to inside global addresses.
Drag and drop the steps to verify and validate IPv6 First Hop Security operational state into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Start by checking global IPv6 snooping status. Then display the binding table for learned entries. Verify interface-specific FHS policies.
Check the RA Guard policy counters for drops. Finally, validate the neighbor cache for correct MAC-to-IPv6 mappings.
A network engineer notices that BGP sessions between two directly connected routers are flapping every few minutes. The routers are running IOS-XE 17.3 and have CoPP enabled. The engineer checks the CoPP policy and sees a class-map matching BGP packets with a police rate of 8000 bps. The BGP session uses MD5 authentication and the routers exchange a full BGP table with 500,000 prefixes. What is the most likely cause of the BGP session flapping?
BGP with 500,000 prefixes generates significant update traffic, and 8000 bps is insufficient, leading to dropped packets and session flapping.
Why this answer
The CoPP police rate of 8000 bps is insufficient for the BGP traffic generated by exchanging a full BGP table of 500,000 prefixes. BGP updates for such a large table can easily exceed 8000 bps, especially when combined with keepalive messages. When the police rate is exceeded, CoPP drops BGP packets, causing the session to flap as the hold timer expires due to missing keepalives or updates.
Exam trap
Cisco often tests the misconception that MD5 authentication causes CPU spikes leading to CoPP drops, but the real issue is that CoPP police rates must be sized to accommodate the actual BGP traffic volume, especially during full table exchanges.
How to eliminate wrong answers
Option A is wrong because BGP MD5 authentication adds a small amount of CPU overhead for HMAC computation, but it does not directly cause CoPP drops; CoPP drops are based on traffic rate, not CPU utilization. Option C is wrong because the question states that the class-map matches BGP packets, and there is no indication of a misconfigured access-list; the issue is the police rate, not the match criteria. Option D is wrong because the hold timer is not mentioned as being changed; the default hold timer (typically 180 seconds) is sufficient, and the flapping is due to CoPP dropping packets, not a low timer setting.
An engineer is troubleshooting an IPv6 connectivity issue where hosts on VLAN 10 cannot reach the internet. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The legitimate router is connected to port Gi1/0/1. The engineer notices that the router is sending RAs, but hosts are not receiving them. The switch shows that RA Guard is dropping packets on port Gi1/0/1. What is the most likely misconfiguration?
Correct because 'device-role host' tells the switch that only hosts are allowed on that port; RAs from a router will be dropped.
Why this answer
RA Guard drops Router Advertisements (RAs) on ports where the policy's 'device-role' is set to 'host'. On port Gi1/0/1, the legitimate router is connected, but if the RA Guard policy incorrectly assigns 'device-role host' to that port, the switch will treat the router as a host and drop all incoming RAs, preventing hosts on VLAN 10 from receiving them. This matches the symptom where the router sends RAs but hosts do not receive them, and the switch reports RA Guard dropping packets on that port.
Exam trap
Cisco often tests the specific behavior of RA Guard's 'device-role' setting, where candidates mistakenly think RA Guard only blocks RAs from unauthorized routers, but the trap is that setting 'device-role host' on a port will drop all RAs, including those from the legitimate router, because the switch treats that port as a host port.
How to eliminate wrong answers
Option B is wrong because DHCPv6 Guard blocks DHCPv6 server messages, not Router Advertisements (RAs), and the issue is specifically about RAs being dropped, not DHCPv6 traffic. Option C is wrong because IPv6 Source Guard filters traffic based on the IPv6 source address and binding table, but it does not drop RAs; RA Guard is the feature responsible for dropping RAs, and the symptom points to RA Guard, not Source Guard. Option D is wrong because if the switch had IPv6 unicast-routing enabled and sent its own RAs, it would not cause RA Guard to drop the router's RAs on port Gi1/0/1; instead, it might cause a conflict with the router's RAs, but the switch's RA Guard policy would still need to be misconfigured to drop the router's RAs, and the symptom explicitly shows RA Guard dropping packets on that port.
A network engineer runs the following command on Router R1: R1# show ipv6 mld interface tunnel 0 Tunnel0 is up, line protocol is up Internet address is FE80::1 MLD is enabled on interface Current MLD version is 2 MLD query interval is 125 seconds MLD querier timeout is 255 seconds MLD max query response time is 10 seconds Last member query response interval is 1 second MLD activity: 0 joins, 0 leaves MLD querying router is FE80::1 (this system) Based on this output, what can be concluded?
0 joins indicates no hosts have joined any multicast groups.
Why this answer
The output shows 'MLD activity: 0 joins, 0 leaves', indicating that no multicast listeners have joined any multicast group on this tunnel interface. Since MLD (Multicast Listener Discovery) is used to track group membership, zero joins means there are no active listeners. Therefore, option C is correct.
Exam trap
Cisco often tests the distinction between 'MLD enabled' and 'active listeners' — candidates may mistakenly think that MLD being enabled implies there are active group members, but the 'joins' counter directly reveals listener activity.
How to eliminate wrong answers
Option A is wrong because the output explicitly states 'MLD is enabled on interface', so MLD is not disabled. Option B is wrong because the output states 'MLD querying router is FE80::1 (this system)', confirming that this router is the MLD querier. Option D is wrong because the output shows 'Current MLD version is 2', not version 1.
A network engineer has configured BFD for OSPF as shown: interface GigabitEthernet0/0 bfd interval 300 min_rx 300 multiplier 3 ! router ospf 1 bfd all-interfaces ! However, BFD sessions are not coming up. What is the most likely missing configuration?
Correct. Without an IP address on the interface, OSPF cannot form a neighbor relationship, and BFD requires an established OSPF adjacency to operate.
Why this answer
BFD requires that the interface has an IP address and is up/up. The configuration shown lacks an IP address on the interface, which is necessary for BFD to establish a session.
Correct. ACLs are used to match the specific control plane traffic (SSH and SNMP) for classification.
Why this answer
CoPP uses an extended ACL to classify traffic for the control plane. SSH uses TCP port 22 and SNMP uses UDP port 161, so an extended ACL matching these protocols and ports is required to identify the DoS attack traffic. This ACL is then referenced by a class-map to define the traffic class for the CoPP policy.
Exam trap
Cisco often tests the distinction between applying CoPP under control-plane configuration versus interface configuration, and the correct direction (input vs output) for protecting the control plane from inbound attacks.
Which statement correctly describes the behavior of OSPF network type 'point-to-multipoint' regarding neighbor discovery?
Correct. Point-to-multipoint uses unicast hellos and no DR/BDR election.
Why this answer
In OSPF point-to-multipoint network type, neighbors are manually configured or discovered via unicast hello packets because the network does not support broadcast or multicast flooding. No Designated Router (DR) or Backup Designated Router (BDR) is elected because the network is treated as a collection of point-to-point links, avoiding the need for a central adjacency point.
Exam trap
Cisco often tests the misconception that point-to-multipoint uses multicast hellos (like broadcast or point-to-point) or that it still requires a DR/BDR (like NBMA), leading candidates to confuse it with other OSPF network types.
How to eliminate wrong answers
Option A is wrong because point-to-multipoint uses unicast hello packets, not multicast, and does not elect a DR/BDR. Option C is wrong because although it correctly states no DR/BDR is elected, it incorrectly claims neighbors are discovered via multicast hello packets. Option D is wrong because it incorrectly states that a DR/BDR is elected, which is not true for point-to-multipoint; this behavior is characteristic of broadcast or non-broadcast multi-access (NBMA) networks.
Which TWO configuration steps are required to enable VRF-Lite on a Cisco IOS-XE router for a customer with two separate routing domains? (Choose TWO.)
This defines the VRF and its route distinguisher, which is mandatory for VRF-Lite.
Why this answer
The two essential steps are: creating the VRF with a route distinguisher using 'vrf definition <name>' and 'rd <value>', and assigning interfaces to the VRF with 'vrf forwarding <name>' under the interface. The other options are incorrect: 'ip vrf <name>' is legacy syntax but still works; however, 'rd' is required. Route targets are for MPLS VPN, not VRF-Lite.
Import/export maps are optional. BGP is not mandatory.
Type 3 LSAs are Summary LSAs, used for inter-area routes.
Why this answer
Type 3 LSAs (Summary LSAs) are generated by Area Border Routers (ABRs) to advertise inter-area routes.
Which TWO commands can be used to verify the configured AAA authentication method lists on a Cisco IOS-XE device? (Choose TWO.)
This command displays all configured AAA method lists for authentication, authorization, and accounting.
Why this answer
'show aaa method-lists' directly displays all configured AAA authentication, authorization, and accounting method lists, including the default lists and any custom lists. Option C is correct because 'show running-config | include aaa authentication' filters the running configuration to show only lines containing 'aaa authentication', which explicitly lists the authentication method lists configured. Both commands provide a reliable way to verify the AAA authentication method lists on a Cisco IOS-XE device.
Exam trap
Cisco often tests the exact command syntax, and the trap here is that candidates confuse 'show aaa method-lists' with non-existent commands like 'show aaa authentication' or 'show authentication method-lists', or they forget that 'show running-config | include aaa authentication' is a valid verification method.
Which THREE symptoms indicate that Control Plane Policing (CoPP) might be misconfigured or causing connectivity issues? (Choose THREE.)
If CoPP drops routing protocol hello packets, neighbors may flap, indicating misclassification or overly restrictive policing.
Why this answer
CoPP is designed to protect the control plane by rate-limiting traffic. If CoPP is misconfigured with overly restrictive policies, it can drop OSPF or BGP hello packets, causing neighbor adjacencies to time out and flap. Log messages showing adjacency timeouts directly point to control plane packet loss, a classic symptom of CoPP misconfiguration.
What is the default BFD interval and multiplier on Cisco IOS-XE devices when BFD is enabled under an interface without explicit timer configuration?
Correct. The default BFD timers on Cisco IOS-XE are 150 ms interval, 150 ms min_rx, and multiplier 3.
Why this answer
If no BFD timers are configured under the interface, the default values are: interval = 150 ms, min_rx = 150 ms, multiplier = 3. These are the defaults used when 'bfd interval' is not specified.
A network engineer runs the following command on Router R1: R1# show ip eigrp neighbors IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:12:34 10 200 0 15 1 192.168.2.2 Gi0/1 10 00:10:22 12 200 0 22 2 10.10.10.2 Gi0/2 14 00:08:15 15 200 0 18 Based on this output, which statement is correct?
All neighbors show normal hold timers, uptimes, and zero queued packets.
Why this answer
All neighbors show a Hold time above 10 seconds, SRTT values well below the default 200 ms threshold, RTO at the default 200 ms, and a Q count of 0. These values indicate stable adjacencies with no retransmissions or packet loss, which is normal EIGRP operation.
Exam trap
Cisco often tests the misconception that a Q count of 0 means no routes are being exchanged, when in fact it simply indicates no packets are currently queued for transmission, which is normal for a stable EIGRP adjacency.
How to eliminate wrong answers
Option A is wrong because an SRTT of 10 ms is very low, indicating a fast link, not a slow one. Option C is wrong because an RTO of 200 ms is the default minimum and does not indicate packet loss; packet loss would be suggested by high RTO or non-zero Q count. Option D is wrong because a Q count of 0 means no packets are queued for transmission, which is normal and does not indicate that routes are not being exchanged; route exchange occurs via updates, not queued packets.
An engineer configures an IPsec site-to-site VPN using IKEv1 with aggressive mode. The VPN tunnel establishes, but after some time, the tunnel goes down and re-establishes repeatedly. The engineer notices that the ISAKMP SA lifetime is set to 86400 seconds on one router and 3600 seconds on the other. What is the most likely explanation for the instability?
In aggressive mode, the initiator sends its proposal, but the responder's lifetime is used for the SA. If the lifetimes differ, the SA will expire on one side first, causing the tunnel to drop and re-establish.
Why this answer
In IKEv1 aggressive mode, the ISAKMP SA lifetime is not negotiated; the responder's configured lifetime is used. With lifetimes of 86400 seconds (24 hours) on one router and 3600 seconds (1 hour) on the other, the responder will enforce its own 3600-second lifetime. When the SA expires after 3600 seconds, the re-key occurs, but the initiator still expects the longer lifetime, causing a mismatch in the re-key timing and leading to repeated tunnel drops and re-establishments.
Exam trap
Cisco often tests the subtle difference that aggressive mode does not negotiate ISAKMP SA lifetimes, so candidates mistakenly assume both sides must match or that the mismatch only affects phase 2, when in fact the responder's lifetime is used unilaterally, causing re-key timing issues.
How to eliminate wrong answers
Option B is wrong because ESP with null encryption is fully compatible with aggressive mode; aggressive mode affects IKE phase 1 negotiation, not the IPsec transform set encryption type. Option C is wrong because the ISAKMP SA lifetime mismatch does not cause the IPsec SA to be re-keyed with different parameters—the IPsec SA parameters (transform sets) are negotiated separately in phase 2 and remain consistent; the issue is the IKE SA re-key timing. Option D is wrong because aggressive mode does require pre-shared keys to be identical, but a mismatch would prevent the tunnel from establishing at all, not cause it to drop after the first re-key.
BGP route summarization is causing unexpected path selection for prefix 172.16.0.0/16. Router R1 (AS 65001) has: router bgp 65001 neighbor 10.0.0.2 remote-as 65002 network 172.16.0.0 mask 255.255.0.0 aggregate-address 172.16.0.0 255.255.0.0 summary-only ! Router R2 (AS 65002) receives the aggregate and shows: R2# show ip bgp 172.16.0.0/16 BGP routing table entry for 172.16.0.0/16, version 2 Paths: (1 available, best #1) 65001, (aggregated by 65001 10.0.0.1) 10.0.0.1 from 10.0.0.1 (10.0.0.1) Origin IGP, localpref 100, valid, external, best However, R2 has a more specific route for 172.16.1.0/24 via another path with higher local preference. What is the root cause?
summary-only prevents any more specific routes from being advertised.
Why this answer
The aggregate-address with summary-only suppresses all more specific routes, so R2 does not see the /24 route. Even if R2 had a better path for the /24, it is not advertised due to summary-only. This can cause suboptimal routing or blackholing if the aggregate points to a less preferred path.
The fix is to remove summary-only or use suppress-map to selectively suppress.
A network engineer runs the following command on Router R1: R1# show ip eigrp neighbors EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.1.2 Gi0/0 13 00:12:34 1 200 0 45 1 10.2.2.2 Gi0/1 12 00:11:20 2 200 0 67 2 10.3.3.2 Gi0/2 10 00:10:15 1 200 0 89 Based on this output, which statement is correct?
The output shows stable adjacencies with low SRTT, RTO, and Q count of 0, indicating normal operation.
Why this answer
The output shows all three EIGRP neighbors with hold timers above 0, low SRTT values (1-2 ms), RTO at 200 ms, and a Q count of 0, indicating no queued packets. These metrics confirm that the neighbors are fully operational and stable, with no packet loss, congestion, or routing issues.
Exam trap
Cisco often tests the misconception that a lower hold timer or a higher sequence number indicates a problem, when in fact these values are normal operational metrics that do not imply faults unless they deviate significantly from expected baselines.
How to eliminate wrong answers
Option B is wrong because a hold timer of 10 seconds is within the default EIGRP hold time range (15 seconds by default, but can be lower if configured), and it does not indicate packet loss; packet loss would be reflected by a high SRTT or RTO, or a non-zero Q count. Option C is wrong because the SRTT for Gi0/0 is 1 ms, which is very low, not high; a high SRTT would indicate congestion or delay. Option D is wrong because the sequence number (67) is simply the last packet received from that neighbor and does not indicate a routing loop; a routing loop would be detected via EIGRP's DUAL algorithm and would show in the topology table, not in the neighbor sequence number.
Which THREE symptoms indicate a problem with route redistribution causing suboptimal routing or routing loops? (Choose THREE.)
Correct: This is a classic symptom of mutual redistribution without proper filtering.
Why this answer
Route redistribution issues often manifest as routing loops, suboptimal paths, or missing routes. A routing loop (option A) occurs when redistributed routes are re-injected back into the source protocol. Suboptimal routing (option B) happens when a router prefers a redistributed route over a more direct one.
Missing routes (option D) can occur if redistribution is not configured or if filters block routes. Option C is incorrect because high CPU may indicate many things, not specifically redistribution. Option E is incorrect because a stable routing table does not indicate a problem.
An engineer configures mutual redistribution between OSPF and EIGRP. After the configuration, routing loops occur. The engineer checks the routing tables and sees that the same prefix is learned from both protocols with different administrative distances. Which is the most likely explanation?
Without route tagging, there is no way to prevent the redistributed route from being sent back to the original protocol, causing a routing loop.
Why this answer
Mutual redistribution without proper route tagging can cause routing loops. When a route redistributed from OSPF into EIGRP is then redistributed back into OSPF, it can be preferred if the administrative distance (AD) of the redistributed route is lower than the original. By default, OSPF external routes have AD 110, and EIGRP external routes have AD 170.
However, if the redistributed route is learned as an OSPF internal route (AD 110) vs EIGRP internal (AD 90), the loop can occur. A common edge case is when the route is redistributed with a metric that makes it appear as an internal route in the other protocol, causing a lower AD and thus a loop.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order follows the standard Cisco IOS-XE configuration sequence: first define an access list to match interesting traffic, then create a NAT pool (if needed), then configure dynamic source translation with overload, then apply the configuration to the inside interface, and finally apply it to the outside interface.
A network engineer is troubleshooting a BGP route reachability issue. R1 learns the prefix 10.1.1.0/24 via eBGP from R2 with an AD of 20, and via OSPF from R3 with an AD of 110. The engineer notices that R1 installs the OSPF route in the routing table instead of the eBGP route, even though the eBGP route is preferred by default. What is the most likely cause of this behavior?
This command sets the AD for eBGP routes to 200, making OSPF (AD 110) preferred.
Why this answer
The default administrative distance for eBGP is 20, and for OSPF is 110, so eBGP should be preferred. However, if the distance command is applied to the eBGP neighbor or the BGP process, it can increase the AD of eBGP routes, making them less preferred than OSPF.
A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?
Correct because ERSPAN encapsulates monitored traffic in GRE tunnels; a tunnel interface must be configured and referenced in the monitor session.
Why this answer
ERSPAN requires a tunnel interface to encapsulate the monitored traffic. Without configuring a tunnel interface, the ERSPAN session cannot encapsulate the packets for transport to the remote destination.
Which IP SLA operation type is used to monitor the availability of a TCP-based service by attempting a three-way handshake?
Correct. TCP Connect performs a TCP three-way handshake to test service availability.
Why this answer
The TCP Connect operation (type 5) attempts to establish a TCP connection to a specified port. Success indicates the service is reachable; failure indicates a problem.
Which OSPF network type defaults to a 30-second hello interval and requires a DR/BDR election?
NBMA uses 30-second hello interval and elects DR/BDR.
Why this answer
Non-broadcast (NBMA) network type uses a 30-second hello interval and elects a DR/BDR, as per RFC 2328.
Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Start by confirming the ACL is applied to the correct interface and direction; then check for implicit deny blocking traffic; verify sequence numbers and order; examine log entries for hits; finally, adjust ACL by inserting a permit statement before the deny.
An engineer configures RSPAN on a switch stack to monitor traffic from a VLAN. The RSPAN destination port is on a different stack member. The mirrored traffic works intermittently, with gaps during stack master re-election. What is the most likely explanation?
The stack ring is used for inter-member communication; a master change can cause temporary disruption.
Why this answer
In a switch stack, RSPAN traffic is forwarded across the stack ring. During master re-election, the stack ring may briefly go down or reconverge, causing loss of RSPAN traffic. Additionally, if the RSPAN VLAN is not configured consistently across all stack members, traffic may be dropped.
Router R1 and R2 are connected via a serial link running OSPF. R1 has 'ip ospf network point-to-point' configured on the interface, while R2 has default broadcast network type. R1's 'show ip ospf neighbor' shows R2 in FULL state, but R2's 'show ip ospf neighbor' shows R1 in FULL state. However, R1's routing table does not contain a route to a subnet 10.10.10.0/24 that is advertised by R2 via a type-3 LSA. R2's 'show ip route 10.10.10.0' shows it as connected. What is the root cause?
OSPF network type mismatch can lead to LSA filtering; point-to-point interfaces ignore LSAs with DR information.
Why this answer
Network type mismatch on a point-to-point link can cause OSPF adjacency to form but may affect LSA propagation. With point-to-point, R1 expects no DR/BDR election and uses a different LSA format. R2, with broadcast, expects DR/BDR.
The adjacency forms because both see each other as neighbors, but the type-3 LSA from R2 might be generated incorrectly or R1 may not accept it due to network type mismatch. The correct answer is that the network type mismatch causes R1 to ignore type-3 LSAs from R2 because R1 expects the link to be point-to-point and R2's LSA includes a DR field that R1 does not process.
A network engineer runs the following command to troubleshoot an IPv6 First Hop Security issue: R1# debug ipv6 nd raguard *Mar 1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::1, dst ff02::1 *Mar 1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::1 is allowed by policy TRUSTED *Mar 1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::2, dst ff02::1 *Mar 1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::2 is blocked by policy UNTRUSTED What does this output indicate?
The debug confirms that fe80::1 is allowed by policy TRUSTED and fe80::2 is blocked by policy UNTRUSTED, which is the expected behavior for RA Guard.
Why this answer
The debug output shows that RA Guard is actively filtering Router Advertisement (RA) messages on interface Fa0/0. The first RA from fe80::1 is explicitly allowed by a policy named TRUSTED, while the second RA from fe80::2 is blocked by a policy named UNTRUSTED. This confirms that RA Guard is correctly configured to permit only authorized routers (fe80::1) and block potential rogue RA sources (fe80::2), preventing RA-based attacks in an IPv6 First Hop Security deployment.
Exam trap
Cisco often tests the misconception that RA Guard blocks all RAs or only logs them, when in fact it uses policy-based filtering that can selectively permit or deny based on the source link-local address and the configured device role.
How to eliminate wrong answers
Option B is wrong because the debug output clearly shows selective behavior—fe80::1 is allowed and fe80::2 is blocked—indicating RA Guard is not blocking all RAs; it is applying per-source policy decisions. Option C is wrong because the debug explicitly states that the RA from fe80::2 is 'blocked,' not merely logged; RA Guard is enforcing a deny action, not just logging. Option D is wrong because the debug messages reference 'policy TRUSTED' and 'policy UNTRUSTED,' which are RA Guard policy names; default IPv6 ND behavior does not use named policies or perform source-based blocking.
A network engineer runs the following command on Router R1: R1# show crypto ipsec transform-set Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac } will negotiate = { Tunnel, }, Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac } will negotiate = { Tunnel, }, Based on this output, which statement is correct?
ESP-AES256-SHA uses 256-bit AES, which is stronger than 128-bit.
Why this answer
The output shows two transform sets configured. The first uses AES-256 with SHA256 HMAC, the second uses AES-128 with SHA256 HMAC. Both use tunnel mode.
A large enterprise network is experiencing intermittent connectivity between Site A (R1) and Site B (R2) over an MPLS L3VPN. R1 has the following relevant configuration: route-map RMAP-IN permit 10 match ip address prefix-list PL-ALLOW set extcommunity rt 100:1. Router R2 shows: 'show bgp vpnv4 unicast all neighbors 10.1.1.1 received-routes' lists only the default route, but 'show ip route vrf CUSTOMER' shows no default route. What is the root cause?
The route-map has only one permit sequence matching the default route, so all other VPNv4 routes are denied by the implicit deny at the end of the route-map. This prevents R1 from receiving routes for other prefixes.
Why this answer
The route-map RMAP-IN on R1 is configured to set the route-target extended community (RT) on incoming BGP VPNv4 routes. However, the route-map is applied inbound on the BGP session, which means it modifies routes received from R2. The match condition uses prefix-list PL-ALLOW, which likely permits only the default route.
The set extcommunity rt 100:1 command overwrites or adds the RT, but if the route-map does not explicitly permit other routes (e.g., via a subsequent permit statement), those routes are denied by the implicit deny at the end of the route-map. This causes R1 to reject all routes except the default, but the default route may not be installed in the VRF due to missing RT matching or other VRF configuration issues. The correct fix is to add a permit statement for all necessary prefixes or remove the route-map from the neighbor statement.
A network engineer runs the following command to verify IPv6 ND inspection policy: R1# show ipv6 nd inspection policy INSPECT Policy: INSPECT Status: Active Device role: node Trusted ports: none Untrusted ports: Fa0/0 ND inspection: enabled Validation: - Source MAC address: verify - Destination MAC address: verify - IPv6 source address: verify - IPv6 destination address: verify - Nonce: disabled - Timestamp: disabled What does this output indicate?
All four validation checks are enabled, and the port is untrusted.
Why this answer
The output shows that the policy INSPECT is active, with ND inspection enabled and validation configured for source MAC, destination MAC, IPv6 source, and IPv6 destination addresses. The 'Untrusted ports: Fa0/0' indicates that these validations are applied to that untrusted port, which is the standard behavior for IPv6 ND inspection to prevent spoofing attacks on untrusted interfaces.
Exam trap
Cisco often tests the distinction between trusted and untrusted ports in IPv6 ND inspection, where candidates may mistakenly think validation occurs on trusted ports or that the policy is inactive when it is actually active on untrusted ports.
How to eliminate wrong answers
Option B is wrong because the output shows 'Trusted ports: none', meaning no trusted ports are configured, and ND inspection validates addresses on untrusted ports, not trusted ports. Option C is wrong because the output explicitly states 'ND inspection: enabled', not disabled, and there is no indication of logging all ND messages; logging is a separate feature. Option D is wrong because the output clearly shows 'Status: Active', indicating the policy is active and applied to interface Fa0/0 as an untrusted port.
A network engineer configures an EEM applet to monitor uRPF (Unicast Reverse Path Forwarding) failures using the event syslog pattern 'IP-3-URPF'. The applet is designed to log when uRPF drops packets due to strict mode. The network has asymmetric routing, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?
Correct. uRPF drops are not logged by default; the 'log' keyword must be added to the verification command.
Why this answer
uRPF strict mode drops packets when the source IP address is not reachable via the incoming interface. However, the syslog message 'IP-3-URPF' is generated only when the 'ip verify unicast source reachable-via' command is configured with the 'allow-default' option or when the drop is logged explicitly. In strict mode without 'allow-default', the router may drop packets silently without generating a syslog message, especially if the drop is due to asymmetric routing.
The EEM applet will not trigger because no syslog is generated for the drop.
Examine the following configuration on a PE router: ip vrf CUSTOMER-C rd 200:1 ! interface GigabitEthernet0/3 ip vrf forwarding CUSTOMER-C ip address 10.2.2.1 255.255.255.252 ! router ospf 1 vrf CUSTOMER-C network 10.2.2.0 0.0.0.3 area 0 ! router bgp 65000 address-family ipv4 vrf CUSTOMER-C redistribute ospf 1 exit-address-family What is missing from this configuration?
Route-targets are required for MPLS L3VPN to control the distribution of VPNv4 routes between PEs. Without them, the routes are not properly tagged.
Why this answer
The VRF is missing route-target import and export commands. Without route-targets, the VPNv4 routes will not be tagged with an RT, and the remote PE will not know which VRF to import them into. Also, the OSPF process is configured under the VRF, and redistribution is done, but the RT is missing.
An engineer configures IPv6 uRPF loose mode on an interface that connects to a DMVPN spoke. The spoke router uses NHRP to register with the hub and establishes a tunnel. Traffic from the spoke to destinations behind the hub is dropped. Which is the most likely explanation?
Correct. uRPF loose mode requires that the source address be present in the routing table (any interface). If the address is only in NHRP cache, not in the routing table, packets are dropped.
Why this answer
In IPv6 uRPF loose mode, the router checks that the source address of an incoming packet is present in the routing table (any route, not necessarily via the incoming interface). On a DMVPN spoke, the tunnel IPv6 address is typically learned only via NHRP and is not installed in the global IPv6 routing table. Therefore, when the spoke sends traffic sourced from its tunnel address, uRPF loose mode drops the packet because the source address is not found in the routing table.
Exam trap
Cisco often tests the distinction between uRPF loose and strict modes, and the trap here is that candidates assume loose mode only checks the RIB for any route, but they forget that NHRP-learned addresses are not installed in the global routing table, causing the drop.
How to eliminate wrong answers
Option B is wrong because the scenario describes traffic being dropped on the spoke, not the hub, and uRPF strict mode on the hub would affect inbound traffic on the hub, not the spoke's outbound traffic; asymmetric routing is not the core issue here. Option C is wrong because NHRP registration packets use unicast or multicast depending on the phase, but uRPF checks the source address of the packet, not the destination; multicast destination does not inherently cause uRPF to filter NHRP registrations. Option D is wrong because the question states that uRPF is the configured feature, and there is no mention of an IPv6 ACL; an ACL overriding uRPF would be a separate configuration and is not the most likely explanation for the drop.
What is the default active flow timeout value in Cisco IOS Flexible NetFlow?
The default active flow timeout is 1800 seconds (30 minutes). This means active flows are exported every 30 minutes.
Why this answer
This question tests recall of default timer values in Flexible NetFlow.
Which TWO statements about the 'log' keyword in IPv4 ACL entries are correct? (Choose TWO.)
Correct. The log entry typically shows the source IP, destination IP, protocol (e.g., TCP), and the interface where the match occurred.
Why this answer
When the 'log' keyword is configured on an ACL entry, the router generates a syslog message that includes the source and destination IP addresses, the protocol (e.g., TCP, UDP, ICMP), and for TCP/UDP, the source and destination port numbers. This logging provides essential information for troubleshooting and security monitoring.
Exam trap
Cisco often tests the misconception that the 'log' keyword logs every packet, when in fact it uses rate-limiting to avoid overwhelming the router's CPU.
An engineer configures Flexible NetFlow with a user-defined flow record that includes 'match ipv4 source address' and 'collect counter bytes'. Which TWO additional statements about this configuration are true? (Choose TWO.)
Correct. Match fields are key fields; flows are differentiated based on their values. Here, only the source IP is used as a key.
Why this answer
In Flexible NetFlow, the 'match' fields define the flow key; flows are uniquely identified by the combination of all match fields. The 'collect' fields define non-key data that is aggregated per flow. The flow record must be referenced by a flow monitor, which is then applied to an interface.
The default flow record is 'netflow-original', which includes many default keys. The 'match' fields cannot be omitted; at least one match field is required. The 'collect' fields are optional and can include counters, timestamps, etc.
PAT translates the source port to create a unique session identifier, enabling many hosts to share one global address.
Why this answer
A is correct because PAT (Port Address Translation) allows multiple internal hosts to share a single public IP address by assigning unique source port numbers to each session. This multiplexing technique enables many concurrent connections from different inside hosts to appear as if they originate from the same public IP, with the NAT device tracking each session by the combination of source IP and source port.
Exam trap
Cisco often tests the misconception that PAT requires a single public IP address or that it cannot handle protocols with fixed port numbers, when in fact PAT can use a pool of addresses and translates the source port regardless of the destination port.
A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?
Correct because the applet's action to clear the BGP session directly causes the session failure when triggered.
A router has a CoPP policy that includes a class-map matching all TCP traffic with a police rate of 5000 bps. The engineer notices that Telnet sessions to the router are timing out, but SSH sessions work fine. The router is configured to accept both Telnet and SSH. What is the most likely cause?
If Telnet is in a different class with a lower rate or drop, it would explain why Telnet fails while SSH works.
Why this answer
The CoPP policy likely includes a separate class-map that matches Telnet traffic (TCP port 23) and applies a police rate lower than 5000 bps or a drop action, causing Telnet sessions to time out. Since the existing class-map matches all TCP traffic with a 5000 bps police rate, and SSH (TCP port 22) works fine, the issue is not with the general TCP rate limit but with a more specific Telnet class that overrides or preempts the general TCP class. This is a common CoPP misconfiguration where a more specific class with a restrictive action is placed before a broader class in the policy-map.
How to eliminate wrong answers
Option B is wrong because encryption does not reduce bandwidth usage; in fact, SSH adds overhead for encryption, so it typically uses slightly more bandwidth than Telnet for the same session. Option C is wrong because the router is configured to accept both Telnet and SSH, and SSH works fine, indicating the Telnet server is functional; a configuration error would affect all Telnet attempts, not just timing out. Option D is wrong because if the CoPP policy were rate-limiting all TCP traffic to 5000 bps, both Telnet and SSH would be equally affected, but SSH works fine, so the issue must be a separate, more restrictive rule for Telnet.
Which TWO commands can be used to verify DHCP IPv4 server operation and address pool utilization on a Cisco IOS router? (Choose TWO.)
Displays all active DHCP leases (IP address, MAC, lease time, etc.).
Why this answer
The 'show ip dhcp binding' command displays the list of active DHCP address bindings, including the IP address, MAC address, lease expiration, and type (automatic, manual, or dynamic). This directly verifies that the DHCP server is operating and has allocated addresses from its pool. Option B is correct because the 'show ip dhcp pool' command shows the pool name, utilization statistics (e.g., total addresses, leased addresses, and excluded addresses), and pool configuration, confirming address pool utilization.
Exam trap
Cisco often tests the distinction between verification commands (show) and troubleshooting/debugging commands (debug), leading candidates to mistakenly select 'debug ip dhcp server events' as a verification tool when it is actually a real-time diagnostic command that can impact router performance.
Router R1 is configured for VRF-Lite with MPLS. The interface Gig0/0 is in VRF-A and is running LDP. The LDP neighbor with R2 is not establishing. R1 configuration: mpls ip, mpls label protocol ldp, interface Gig0/0, ip vrf forwarding VRF-A, ip address 10.0.0.1 255.255.255.252. R2 has similar configuration without VRF. The LDP hello packets are sent but not received. What is the root cause?
Correct: LDP sessions require matching VRF context; mismatch prevents session establishment.
Why this answer
LDP uses UDP and TCP, and the transport address is typically the router ID. In a VRF, the LDP session must be established within the same VRF. If R1 has VRF-A and R2 does not, the LDP hellos are sent in the VRF context, but R2's LDP process is in the global table.
The hellos are not recognized because the VRF label space is different. LDP requires matching VRF or global configuration.
A network engineer runs the following command on Router R1: R1# show ip dhcp server statistics Memory usage 26140 Address conflicts 0 Pool statistics Pool IP addresses Requests Offers Acks Naks Declines Releases POOL1 10-20 50 45 40 5 2 3 Based on this output, which statement is correct?
Naks and Declines are signs of issues.
Why this answer
The output shows 5 NAKs and 2 Declines, indicating that the DHCP server is rejecting requests (NAKs) and clients are declining offers (Declines). NAKs typically occur when a client requests an IP address that is no longer valid or available, while Declines happen when a client detects an address conflict via ARP. This combination strongly suggests pool exhaustion or address conflicts, making option B correct.
Exam trap
Cisco often tests the distinction between server-tracked address conflicts (shown in the 'Address conflicts' counter) and client-detected conflicts (shown as Declines), leading candidates to incorrectly assume zero conflicts means no issues.
How to eliminate wrong answers
Option A is wrong because the presence of NAKs and Declines indicates issues, so the server is not operating without any issues. Option C is wrong because the memory usage of 26140 is not specified as problematic, and no memory-related errors or warnings are shown in the output. Option D is wrong because while the 'Address conflicts' counter is 0, the 2 Declines indicate that clients are detecting address conflicts on their own, which is a separate issue from server-tracked conflicts.
Consider the following partial configuration on router R2: flow exporter EXPORTER-1 destination 192.168.1.100 source Loopback0 transport udp 2055 ! flow monitor MONITOR-2 exporter EXPORTER-1 record netflow ipv4 original-input cache timeout active 30 ! interface GigabitEthernet0/2 ip flow monitor MONITOR-2 input ! What is the effect of this configuration?
The record 'netflow ipv4 original-input' is a predefined Flexible NetFlow record that matches traditional NetFlow fields (source/destination IP, protocol, etc.) and exports them in NetFlow v9 format.
Why this answer
This question tests knowledge of the 'record netflow ipv4 original-input' predefined record and its behavior.
An engineer configures an EEM applet to monitor OSPF neighbor state changes using the event syslog pattern 'OSPF-5-ADJCHG'. The applet triggers a custom syslog message. The OSPF adjacency between two routers fails due to an MTU mismatch, but the EEM applet does not trigger. Which is the most likely explanation?
Correct. MTU mismatch causes the adjacency to fail in EXSTART, and the syslog message is OSPF-4-ERRRCV instead of OSPF-5-ADJCHG.
Why this answer
When an OSPF adjacency fails due to MTU mismatch, the neighbor state transitions from EXSTART to DOWN without generating the standard OSPF-5-ADJCHG syslog message. The adjacency never reaches FULL, so the state change from EXSTART to DOWN is logged as a different syslog pattern (OSPF-4-ERRRCV or OSPF-5-ADJCHG may not fire). EEM applets that rely on the exact pattern 'OSPF-5-ADJCHG' will not trigger because that message is only generated when the neighbor state changes from FULL to DOWN or vice versa.
Which TWO statements about Embedded Event Manager (EEM) applet configuration are true? (Choose TWO.)
EEM supports multiple event triggers combined with the 'or' operator, allowing the applet to fire on any of the specified events.
Why this answer
EEM applets can use multiple event statements combined with a Boolean operator, and the 'action' command supports Cisco IOS CLI commands via the 'cli' keyword. The other statements are false: applets do not require a Tcl script, multiple actions are allowed, and the 'event none' option is valid for manual triggering.
A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down 2 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Flap Based on this output, which statement is correct?
The output shows two applet policies registered, meaning they are loaded and ready to trigger based on their defined events.
Why this answer
The 'show event manager policy registered' command lists all EEM policies registered on the device. The output shows two applet policies registered, but no trigger events are shown. The correct answer is that two EEM applet policies are registered, but the output does not indicate whether they are enabled or disabled; registration means they are loaded and ready to trigger.
An engineer is troubleshooting a network where IPv6 hosts cannot obtain IP addresses via DHCPv6. The switch is configured with DHCPv6 Guard to prevent rogue DHCP servers. The legitimate DHCPv6 server is connected to port GigabitEthernet1/0/1. The engineer sees that DHCPv6 Solicit messages from hosts reach the server, but the server's Advertise and Reply messages are not reaching the hosts. What is the most likely root cause?
Correct because DHCPv6 Guard by default blocks server messages on untrusted ports; the server port must be explicitly trusted.
Why this answer
DHCPv6 Guard is a First Hop Security feature that blocks DHCPv6 server messages (Advertise, Reply) on untrusted ports. When the policy is applied globally, all ports are untrusted by default unless explicitly configured as trusted. Since the legitimate DHCPv6 server is connected to GigabitEthernet1/0/1, that port must be configured as a trusted port using the `ipv6 dhcp guard trust` interface command.
Without this, the switch drops the server's Advertise and Reply messages, preventing hosts from receiving valid DHCPv6 responses.
Exam trap
Cisco often tests the distinction between DHCPv6 Guard (which blocks server messages) and other IPv6 First Hop Security features like RA Guard or IPv6 Source Guard, causing candidates to confuse the specific message types each feature filters.
How to eliminate wrong answers
Option B is wrong because RA Guard blocks Router Advertisements (RA), not DHCPv6 messages; the scenario states that DHCPv6 Solicit messages from hosts reach the server, so RA Guard is not the issue. Option C is wrong because IPv6 Source Guard filters traffic based on source IPv6 address bindings, but the problem is that the server's responses are being dropped, not that the server's address is missing from a binding table; DHCPv6 Guard is the feature that explicitly filters server messages. Option D is wrong because DHCP snooping for IPv4 operates independently of DHCPv6; IPv4 DHCP snooping does not interfere with DHCPv6 operation, and the issue is specifically caused by DHCPv6 Guard blocking server messages.
Which BGP attribute is used for loop prevention in eBGP?
AS_PATH is used to detect loops by checking if the local AS is already in the path.
Why this answer
The AS_PATH attribute contains the list of AS numbers a route has traversed. If a BGP router receives a route with its own AS number in the AS_PATH, it discards the route to prevent loops.
A network engineer runs the following command to troubleshoot IPv6 ND inspection: R1# debug ipv6 nd inspection *Mar 1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, options: SLLA 0011.2233.4455 *Mar 1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, SLLA 0011.2233.4455 is allowed by policy INSPECT *Mar 1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, options: TLLA 00aa.bbcc.ddee *Mar 1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, TLLA 00aa.bbcc.ddee is blocked by policy INSPECT What does this output indicate?
The NA is blocked, which could be due to the source MAC not matching the TLLA or policy rules.
Why this answer
The debug output shows that the Neighbor Solicitation (NS) from fe80::1 is allowed by policy INSPECT, while the Neighbor Advertisement (NA) from fe80::2 is blocked by the same policy. This indicates that IPv6 ND inspection is selectively permitting NS messages but denying NA messages from fe80::2, likely due to a MAC address mismatch (the TLLA in the NA does not match the expected binding) or a policy violation, making option A correct.
Exam trap
Cisco often tests the distinction between NS and NA handling in ND inspection, where candidates may assume both messages are treated identically, but the policy can allow one and block the other based on binding table validation.
How to eliminate wrong answers
Option B is wrong because the output clearly shows NS messages are allowed, not all messages blocked, so it is not a complete misconfiguration. Option C is wrong because the NA message is explicitly blocked, not just logged; the debug shows a blocking action, not mere logging. Option D is wrong because the debug output references 'policy INSPECT', which confirms ND inspection is configured and actively enforcing policies, not default ND behavior.
A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto map Crypto Map "CMAP" 10 ipsec-isakmp Peer = 192.168.2.2 Extended IP access list 101 access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 Current peer: 192.168.2.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={myset, } Interfaces using crypto map CMAP: Tunnel0 What does this output indicate?
The configuration matches typical site-to-site VPN requirements.
Why this answer
The output shows a properly configured IPsec site-to-site VPN crypto map. It includes a peer (192.168.2.2), an extended ACL (101) that correctly matches the local and remote subnets (192.168.1.0/24 and 192.168.2.0/24), a transform set (myset), and is applied to Tunnel0, which is typical for a site-to-site VPN. The security association lifetime and PFS settings are also present, confirming a valid configuration.
Exam trap
Cisco often tests the misconception that an extended ACL in a crypto map is a misconfiguration, when in fact it is required for site-to-site VPNs to define the traffic to be encrypted.
How to eliminate wrong answers
Option A is wrong because using an extended ACL with source and destination subnets is correct for a site-to-site VPN; it defines which traffic should be encrypted, not a misconfiguration. Option C is wrong because the output explicitly shows 'Transform sets={myset,}', indicating a transform set is configured. Option D is wrong because applying the crypto map to a tunnel interface (Tunnel0) is valid and common for site-to-site VPNs; it does not need to be on the physical interface.
A network engineer runs the following command on Router R1: R1# show ip ospf neighbor 10.1.1.2 Neighbor 10.1.1.2, interface address 192.168.12.2 In the area 0 via interface GigabitEthernet0/0 Neighbor priority is 1, State is FULL, 6 state changes DR is 10.1.1.2, BDR is 10.1.1.1 Options is 0x12 (L L S R) Dead timer due in 00:00:36 Neighbor is up for 00:15:42 Index 1/1/1, retransmission queue length 0, number of retransmission 0 First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0) Last retransmission scan length is 0, time is 0 msec Last retransmission scan time is 0 msec Based on this output, what is the role of Router R1 on this segment?
The BDR is 10.1.1.1, which is R1's router ID.
Why this answer
The output shows that the BDR is 10.1.1.1, which is Router R1's router ID. Therefore, R1 is the Backup Designated Router. The DR is 10.1.1.2.
Given the following partial configuration on router R5: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip pim sparse-mode ! interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.0 ip pim sparse-mode ! router ospf 1 router-id 5.5.5.5 network 10.0.0.0 0.255.255.255 area 0 What is the effect of this configuration?
Both protocols work together. OSPF handles unicast routing, PIM handles multicast. No issues.
Why this answer
The configuration is valid because OSPF and PIM sparse-mode operate independently on an interface. OSPF uses multicast address 224.0.0.5/6 for hello packets and forms adjacencies regardless of PIM sparse-mode being enabled. PIM sparse-mode requires an RP to function, but its presence does not affect OSPF adjacency formation.
The network statement 10.0.0.0 0.255.255.255 matches both interfaces (10.1.1.1 and 10.2.2.1), so OSPF will form adjacencies on both.
Exam trap
Cisco often tests the misconception that enabling PIM sparse-mode on an interface disrupts OSPF adjacency formation, when in fact they operate at different layers (OSPF at Layer 3 routing, PIM at multicast routing) and do not interfere with each other.
How to eliminate wrong answers
Option A is wrong because PIM sparse-mode does not interfere with OSPF adjacency formation; OSPF uses its own multicast addresses (224.0.0.5/6) and is unaffected by PIM configuration. Option C is wrong because the network statement 10.0.0.0 0.255.255.255 is a wildcard mask that matches all addresses starting with 10.x.x.x, which includes both 10.1.1.1 and 10.2.2.1, so OSPF will enable on both interfaces. Option D is wrong because PIM sparse-mode can be enabled on interfaces without an RP configured; the RP is required only for actual multicast forwarding, not for PIM to be enabled or for OSPF to operate.
A network engineer runs the following command on Router R1: R1# show snmp mib ifmib ifindex ifIndex: 1 Interface: GigabitEthernet0/0 Description: GigabitEthernet0/0 ifIndex: 2 Interface: GigabitEthernet0/1 Description: GigabitEthernet0/1 ifIndex: 3 Interface: Loopback0 Description: Loopback0 ifIndex: 10 Interface: Tunnel0 Description: Tunnel0 Based on this output, which statement is correct?
The output clearly shows Loopback0 with ifIndex 3.
Why this answer
The output of 'show snmp mib ifmib ifindex' displays the ifIndex values assigned to each interface by the SNMP agent. The table clearly shows Loopback0 with ifIndex 3, making option A correct. ifIndex values are not guaranteed to be sequential or start from 0; they are assigned dynamically and can have gaps, as seen with Tunnel0 having ifIndex 10.
Exam trap
Cisco often tests the misconception that ifIndex values are assigned sequentially starting from 0 or 1 without gaps, but the output shows non-sequential values (e.g., Tunnel0 with ifIndex 10) to trap candidates who assume a simple 1-to-1 order.
How to eliminate wrong answers
Option B is wrong because ifIndex values are not assigned sequentially starting from 0; they typically start from 1 and can have gaps (e.g., Tunnel0 has ifIndex 10, not 4). Option C is wrong because GigabitEthernet0/0 has ifIndex 1, not 2. Option D is wrong because Tunnel0 has ifIndex 10, not 3.
CoPP (Control Plane Policing) rate-limit impacts legitimate traffic. Router R1 has CoPP policy applied: 'class-map match-all BGP class-map match-all SSH match protocol bgp match protocol ssh policy-map COPP class BGP police 10000 conform-action transmit exceed-action drop'. Network engineers cannot SSH to R1, but BGP sessions are stable. 'show policy-map control-plane' output shows 'BGP class: 0 packets, 0 bytes' and 'SSH class: 0 packets, 0 bytes'. What is the root cause?
With match-all, a packet must be both BGP and SSH, which is impossible; SSH packets go to default class, likely drop.
Why this answer
The class-map uses 'match protocol bgp' and 'match protocol ssh' with match-all, meaning both conditions must be true for a packet to match. SSH packets do not match protocol bgp, so they fall through to the default class, which may have a drop policy. The class-map should be match-any or separate classes for each protocol.
Which TWO statements correctly describe the behavior of BGP route summarization using the 'aggregate-address' command? (Choose TWO.)
Correct. When an aggregate is created, BGP sets the ATOMIC_AGGREGATE attribute to indicate that the path information might be incomplete.
Why this answer
The BGP 'aggregate-address' command creates a summary route in the BGP table. By default, the summary is advertised with the ATOMIC_AGGREGATE attribute and the aggregator router ID, but the more specific routes are still advertised unless the 'summary-only' keyword is used. The summary inherits the AS_PATH from the component routes, but the 'as-set' keyword is required to include the AS_PATH information in the aggregate.
The summary does not automatically suppress the component routes.
What is the default DHCPv4 server lease time on a Cisco IOS-XE router configured as a DHCP server?
The default lease time for Cisco IOS-XE DHCP server is 86400 seconds.
Why this answer
The default DHCPv4 lease time on a Cisco IOS-XE router configured as a DHCP server is 86400 seconds (1 day). This is defined in the Cisco IOS DHCP server configuration and is the standard default value used when no lease duration is explicitly specified in the DHCP pool configuration.
Exam trap
Cisco often tests the default lease time to catch candidates who confuse common enterprise practices (like 12 hours or 7 days) with the actual IOS default of 1 day.
How to eliminate wrong answers
Option A is wrong because 3600 seconds (1 hour) is not the default; it is a common lease time for high-turnover environments like public Wi-Fi, but not Cisco's default. Option B is wrong because 43200 seconds (12 hours) is a typical lease time for some enterprise networks but is not the Cisco IOS-XE DHCP server default. Option D is wrong because 604800 seconds (7 days) is a longer lease time often used for stable networks with few changes, but it is not the default on Cisco IOS-XE.
A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP class-map: MANAGEMENT (match-all) 100 packets, 10000 bytes 5 minute offered rate 0 bps police: cir 8000 bps, bc 1500 bytes conformed 100 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps Based on this output, which statement is correct?
The 'conformed' count shows 100 packets transmitted, and 'exceeded' is 0, meaning no drops.
Why this answer
The output shows that all 100 packets matched by the MANAGEMENT class-map were conformed (100 packets, 10000 bytes) and the action for conformed traffic is 'transmit', with zero exceeded packets. This indicates that the policing rate of 8000 bps (CIR) was sufficient for the offered traffic, and no packets were dropped. The 'exceeded 0 packets' field confirms no drops occurred.
Exam trap
Cisco often tests the misconception that a low police rate automatically implies drops, but the trap here is that the output must be read carefully—'exceeded 0 packets' proves no drops occurred, regardless of the configured CIR.
How to eliminate wrong answers
Option B is wrong because the police rate of 8000 bps is not causing drops; the output shows 0 exceeded packets, meaning the traffic rate is within the CIR. Option C is wrong because the command 'show policy-map control-plane' explicitly displays the policy applied to the control plane, and the output confirms 'Service-policy input: CoPP' is active. Option D is wrong because the class-map MANAGEMENT is matching traffic, as evidenced by the 100 packets and 10000 bytes counted under that class.
An engineer configures SPAN on a Cisco switch to monitor traffic from a port that is also a SPAN destination for another session. The switch rejects the configuration. What is the most likely reason?
The switch enforces that a port used as a destination cannot also be a source, as it would create a loop in the monitoring path.
Why this answer
A SPAN destination port cannot be used as a SPAN source port in any session. This is a hardware limitation: the port is dedicated to receiving mirrored traffic and cannot also be monitored. The switch will return an error if you try to configure it as a source.
An engineer configures mutual redistribution between OSPF and EIGRP on a PE router in an MPLS L3VPN. The engineer does not configure any route tagging or filtering. After a few minutes, the OSPF and EIGRP domains become unstable, with routes flapping and high CPU usage. What is the most likely explanation?
Correct. Without route tagging or filtering, routes can be re-redistributed indefinitely, causing instability.
Why this answer
Mutual redistribution without route tagging or filtering can cause a routing loop. When OSPF routes are redistributed into EIGRP, and then those EIGRP routes are redistributed back into OSPF, the same prefixes can be learned from both protocols. Without a route tag or a filter to prevent re-redistribution, the router will continuously re-advertise the same routes, causing route flapping and high CPU.
This is a classic edge case in redistribution. The solution is to use route tags and filtering to prevent loops.
What is the default tunnel mode for an IPv6 tunnel configured on Cisco IOS-XE?
GRE is the default tunnel mode for IPv6 tunnels in IOS-XE.
Why this answer
The default tunnel mode for an IPv6 tunnel on Cisco IOS-XE is GRE (Generic Routing Encapsulation), as specified by the 'tunnel mode gre ipv6' command. When you create a tunnel interface and configure an IPv6 tunnel source and destination without explicitly setting the tunnel mode, the router defaults to GRE encapsulation, which provides a multiprotocol transport capable of carrying both IPv4 and IPv6 payloads.
Exam trap
Cisco often tests the misconception that the default tunnel mode for IPv6 tunnels is 'ipv6ip' (manual IPv6-over-IPv4) because of its simplicity, but the actual default is GRE, which is a more feature-rich encapsulation.
How to eliminate wrong answers
Option A (IPv6IP) is wrong because IPv6IP is not a default tunnel mode; it is a specific mode used for IPv6-over-IPv4 manual tunnels, configured with 'tunnel mode ipv6ip', and must be explicitly set. Option C (ISATAP) is wrong because ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) is a specific automatic tunneling mechanism that uses a non-default tunnel mode and requires explicit configuration with 'tunnel mode ipv6ip isatap'. Option D (6to4) is wrong because 6to4 is another automatic tunneling technique that uses a non-default tunnel mode, configured with 'tunnel mode ipv6ip 6to4', and is not the default; it also relies on a specific IPv6 prefix (2002::/16).
The 'metric' keyword in the redistribute command sets the EIGRP metric for all redistributed routes.
Why this answer
The configuration redistributes OSPF routes into EIGRP with specific bandwidth, delay, reliability, load, and MTU metrics. The 'subnets' keyword in OSPF redistribution ensures that all subnets (including classless prefixes) are redistributed. Without 'subnets', only classful networks are redistributed.
Router R1 and R2 are OSPF neighbors over a FastEthernet link with BFD enabled. R1 has 'ip ospf network point-to-point' configured. R2 does not. After a reload, BFD sessions fail to establish. R1#show bfd neighbors shows no sessions. R2#show bfd neighbors shows no sessions. What is the root cause?
Mismatched OSPF network types cause BFD to fail because BFD uses interface parameters derived from OSPF network type.
Why this answer
BFD requires matching OSPF network types on the same link for proper session establishment. When R1 is configured as point-to-point and R2 remains as broadcast, OSPF forms a neighbor relationship but BFD sessions fail because BFD expects consistent interface parameters.
An engineer must ensure that all syslog messages with severity level 4 (warning) and higher are sent to a remote syslog server at 10.1.1.100, while also logging messages of severity 6 (informational) to the console. Which TWO configuration commands are required? (Choose TWO.)
Correct. This sets the remote syslog server and limits messages sent to severity 4 (warning) and higher (0-4).
Why this answer
The 'logging host' command with the 'trap' keyword sets the severity filter for remote logging; default trap level is 6 (informational), so to limit to level 4 and higher, the trap level must be set to 4. The 'logging console' command controls console logging; default is level 7 (debugging), so setting it to 6 allows informational and higher (0-6). The 'logging buffered' command affects buffer logging, not console.
The 'logging source-interface' sets the source IP but does not filter severity. The 'logging monitor' affects terminal lines, not console.
Correct. K5 is the K value for MTU, and it is disabled by default.
Why this answer
By default, EIGRP uses only K1 (bandwidth) and K3 (delay) in its composite metric calculation, with K1 and K3 set to 1. K2 (load), K4 (reliability), and K5 (MTU) are set to 0, meaning they are disabled by default. This question specifically targets the K value related to MTU, which is K5.
Therefore, K5 (MTU) is the correct answer.
Which TWO statements about VRF-Lite and DHCP are true? (Choose TWO.)
Correct. Example: 'ip dhcp relay vrf BLUE 10.1.1.1' relays requests from VRF BLUE to the DHCP server at 10.1.1.1 (which could be in another VRF or global).
Why this answer
In VRF-Lite, DHCP can be configured to operate within a specific VRF. The 'ip dhcp relay' command can be used with the 'vrf' keyword to relay DHCP requests from a VRF to a DHCP server in another VRF or the global table. Option A is correct because the relay can forward to a server in a different VRF.
Option D is correct because the DHCP server can be in the global routing table and still serve clients in a VRF if the relay is configured correctly. Option B is incorrect because DHCP clients can obtain addresses from a server in the same VRF without relay. Option C is incorrect because the 'ip dhcp pool' command does not have a 'vrf' keyword; pools are global.
Option E is incorrect because DHCP snooping is not required for VRF-Lite DHCP to work.
Which NetFlow version is the default export format when using Flexible NetFlow with the 'record netflow ipv4 original-input' command?
Flexible NetFlow uses NetFlow v9 as the default export format because it supports template-based records.
Why this answer
This question tests knowledge of the default export version for Flexible NetFlow predefined records.
A multi-router network uses PBR to steer traffic from subnet 172.16.1.0/24 through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being dropped. Router R1 shows: 'show route-map' indicates the route-map is applied, 'show ip policy' shows the policy on the interface, but 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2'. What is the root cause?
PBR drops packets if the set next-hop is not reachable. Using 'set ip default next-hop' allows PBR to use the routing table as a fallback if the next-hop is unreachable.
Why this answer
PBR requires the next-hop to be reachable via a route in the routing table. If the next-hop is not reachable (e.g., due to a routing change or a missing route), PBR will drop the packet unless a fallback is configured. In this case, the next-hop 10.10.10.2 is not reachable, so PBR drops the traffic.
The solution is to either ensure the next-hop is reachable or configure a default route or fallback action.
Given the following partial configuration on router R1: ip sla 10 icmp-echo 192.168.1.1 source-ip 10.0.0.1 frequency 10 ip sla schedule 10 life forever start-time now Which statement best describes the effect of this configuration?
The icmp-echo command defines the destination, source-ip sets the source, and frequency sets the interval.
Why this answer
The configuration creates an IP SLA operation that sends ICMP echo probes to 192.168.1.1 every 10 seconds, using source IP 10.0.0.1. The schedule starts immediately and runs indefinitely.
Which TWO commands can be used to verify the VRF configuration and associated interfaces on a Cisco IOS-XE router running VRF-Lite? (Choose TWO.)
Displays a summary of all VRFs, including route distinguisher and interface assignments.
Why this answer
The 'show vrf' command displays a summary of all VRFs, including their RD and interfaces, while 'show ip vrf interfaces' lists each VRF with its associated interfaces and IP addresses. The other options are incorrect: 'show ip route vrf' shows the routing table for a specific VRF but not the interfaces, 'show running-config | section vrf' shows configuration but not operational status, and 'show ip interface brief' does not display VRF information.
A network engineer runs the following command on Router R1: R1# show ip dhcp relay information trusted Interface Trusted GigabitEthernet0/1 Yes GigabitEthernet0/2 No Based on this output, which statement is correct?
Trusted interfaces accept option 82.
Why this answer
The command 'show ip dhcp relay information trusted' displays the trust status of each interface for DHCP relay information (option 82). When an interface is marked as 'Yes' under the Trusted column, it means the router will accept and forward DHCP packets that already contain option 82 information from that interface. Therefore, on GigabitEthernet0/1, option 82 packets are accepted.
Exam trap
Cisco often tests the misconception that 'trusted' means the interface is trusted to send DHCP requests, when in fact it means the interface is trusted to receive and forward packets that already contain option 82 information.
How to eliminate wrong answers
Option B is wrong because the output clearly shows that GigabitEthernet0/2 is marked as 'No', indicating it is not trusted, so both interfaces are not trusted. Option C is wrong because the output explicitly shows that DHCP relay information is configured and trusted on at least one interface (GigabitEthernet0/1). Option D is wrong because GigabitEthernet0/2 is not trusted (marked 'No'), and on untrusted interfaces, option 82 packets are dropped, not accepted; the statement incorrectly says option 82 packets are dropped on a trusted interface.
Drag and drop the steps to enable and verify RESTCONF on IOS-XE into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Troubleshooting starts with checking the uRPF configuration on the interface, then verifying the routing table for the source prefix, checking for ACLs that might block traffic, examining uRPF drop counters, and finally using debug ipv6 packet to capture dropped packets.
Practice 300-410 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →