How many Router R1 Cannot Reach R3 Practice Questions questions are on this page?

This page has 15 Router R1 Cannot Reach R3 Practice Questions scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

Router R1 Cannot Reach R3 Practice Questions

Practise identifying common networking hardware like routers, switches, access points, and their roles in a network.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach router r1 cannot reach r3 practice questions

Practise routing and connectivity troubleshooting scenarios involving R1, R2, R3, static routes, OSPF, next hops and routing tables.

Quick answer

Tests identification, purpose, and configuration of routers, switches, access points, and patch panels.

Identify routers, switches, and access points by function

Understand PoE and PoE+ power requirements

Differentiate managed vs unmanaged switches

Recognize cable types: Cat5e, Cat6, fiber

Practice scenarios

Question 1mediummultiple choice

Read the full DHCP explanation →

Consider the following DHCPv6 configuration on router R2:

ipv6 dhcp pool DHCP6_POOL dns-server 2001:db8::1 domain-name example.com !

interface GigabitEthernet0/0

ipv6 address 2001:db8:1::1/64 ipv6 dhcp server DHCP6_POOL ipv6 nd other-config-flag

no shutdown

What is the effect of this configuration?

A
Hosts on this subnet will use SLAAC to obtain their IPv6 address and then use DHCPv6 to get DNS and domain information.
The other-config-flag indicates that hosts should use SLAAC for addressing and DHCPv6 for additional parameters, which is stateless DHCPv6.
B
Hosts will obtain both their IPv6 address and DNS information from the DHCPv6 pool.
Why wrong: The other-config-flag means DHCPv6 is only for other configuration, not for address assignment. For address assignment, the managed-config-flag would be needed.
C
The DHCPv6 pool is missing the address prefix, so it will not provide any configuration to clients.
Why wrong: In stateless DHCPv6, the pool does not need an address prefix; it only provides other parameters like DNS and domain.
D
The ipv6 nd other-config-flag command is ignored because the DHCPv6 server is configured on the interface.
Why wrong: The flag is not ignored; it works together with the DHCPv6 server to provide stateless configuration.

Full breakdown with real-world context →

Question 2mediumdrag order

Review the full OSPF breakdown →

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path *> 10.3.3.0/24 10.1.1.2 0 100 0 i

Total number of prefixes 1

What does this output indicate?

A
BGP is not receiving any routes due to CoPP dropping updates.
Why wrong: One route is received, so updates are being processed.
B
BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.
The route is received from neighbor 10.1.1.2 with valid attributes.
C
BGP is receiving routes but not installing them in the routing table due to CoPP.
Why wrong: The output shows received routes, not installation status.
D
BGP session is flapping due to CoPP.
Why wrong: No session flap is indicated; the output is stable.

Full breakdown with real-world context →

Question 4hardmultiple choice

Study the full EIGRP explanation →

An MPLS network with EIGRP as the IGP is experiencing label distribution failures. Router R1 shows: 'show mpls ldp neighbor' does not list R2. R1's configuration: mpls ip on interfaces, but no router-id configured. R2's configuration: mpls ldp router-id Loopback0 force. R1 and R2 are directly connected. What is the root cause?

A
R1's LDP router-id is not configured, so it uses the IP of the interface facing R2, which may not be reachable from R2's loopback.
LDP requires a reachable router-id. Without explicit configuration, R1 uses the interface IP, which may not be in R2's routing table.
B
R2 has a loopback interface that is not advertised via EIGRP, so R1 cannot reach it.
Why wrong: The issue is LDP session establishment, not reachability to the loopback.
C
R1 has an ACL that blocks LDP UDP packets (port 646).
Why wrong: No ACL is mentioned.
D
R2's 'force' keyword causes it to use the loopback even if it is not reachable.
Why wrong: The 'force' keyword ensures the router-id is used, but it does not cause failure.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full VPN explanation →

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

A
The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.
Without NHS configuration, spokes do not register with the hub, so NHRP cannot provide the mapping for spoke-to-spoke tunnels.
B
The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.
Why wrong: Spokes typically use mGRE as well; if they used p2p GRE, they would only connect to the hub, but the scenario does not indicate this.
C
The NHRP network-id is different on R2 and R3, preventing communication.
Why wrong: The network-id must match, but the scenario shows it is 1 on the hub; if spokes had different IDs, they would not register.
D
The tunnel source interface is not reachable between spokes.
Why wrong: Spoke-to-spoke reachability is established via NHRP; if NHRP is not working, the tunnel source may be reachable but the tunnel itself fails.

Full breakdown with real-world context →

Question 6hardmultiple choice

Review the full routing breakdown →

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a customer network. The customer has a default route pointing to the router. After enabling uRPF, the router drops traffic from the customer that has a source IP address that is not in the routing table as a directly connected or static route. What is the most likely explanation?

A
Strict mode uRPF requires a specific route for the source IP; a default route is not sufficient.
Strict mode checks for a matching route with the same incoming interface; a default route does not provide a specific interface match.
B
The customer's default route causes asymmetric routing, which breaks strict mode.
Why wrong: Asymmetric routing is a problem for strict mode, but the issue here is missing route for the source IP.
C
The uRPF mode should be loose mode to allow the default route.
Why wrong: Loose mode only checks that a route exists, not the interface, but the question specifies strict mode.
D
The router has an ACL that is blocking the traffic before uRPF checks.
Why wrong: uRPF is applied before ACLs, so ACL is not the cause.

Full breakdown with real-world context →

Question 7hardmultiple choice

Review the full OSPF breakdown →

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

A
The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.
The ACL prevents OSPF from learning the route, but redistribution allows EIGRP to carry it, and EIGRP's lower AD makes it the best path.
B
The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.
Why wrong: Outbound ACL would affect outgoing updates, not incoming learning.
C
The router has a static route for the prefix with AD 1.
Why wrong: Static route would override both, but the question does not mention static.
D
The OSPF process has a distribute-list that is filtering the route.
Why wrong: Distribute-list would filter the route from the routing table, but the ACL is the configured filter.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:2::1, subnet is 2001:DB8:2::/64 Joined group address(es): FF02::1 FF02::2 ICMP redirects are enabled ICMP unreachables are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

A
uRPF is disabled
Why wrong: The output shows uRPF is enabled.
B
uRPF is enabled in strict mode
Why wrong: The output specifies loose mode, not strict.
C
uRPF is enabled in loose mode
The output confirms loose mode uRPF.
D
uRPF is enabled but only for IPv4
Why wrong: This is an IPv6 interface, and uRPF is configured for IPv6.

Full breakdown with real-world context →

Question 9mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full VPN explanation →

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

A
The hub router does not have a route to the remote spoke's LAN subnet.
Correct because the hub must have a route to the destination subnet to send an NHRP redirect.
B
The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.
Why wrong: Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.
C
The spoke's routing table has a static route to the remote spoke's LAN via the hub.
Why wrong: Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.
D
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Full breakdown with real-world context →

Question 11hardmultiple choice

Study the full IPv6 explanation →

A DMVPN phase 3 network with IPv6 over IPv4 tunnels is experiencing spoke-to-spoke tunnel failures. Hub router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp network-id 1 ip nhrp map multicast dynamic ipv6 nhrp map multicast dynamic. Spoke router R2 shows: R2# show dmvpn detail Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete NHRP domain: 1 Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, Total NBMA Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.0.2.2 2001:DB8:1::2 UP 00:10:00 D. What is the root cause?

A
The hub is missing the ip nhrp redirect command under Tunnel0.
This command enables NHRP redirect messages, which are essential for phase 3 spoke-to-spoke shortcut establishment.
B
The spoke is missing the ip nhrp shortcut command under Tunnel0.
Why wrong: While the spoke also needs this command, the hub's missing redirect is the primary cause here.
C
The tunnel mode should be gre multipoint on the spokes.
Why wrong: Spokes can use point-to-point GRE tunnels; multipoint is only required on the hub.
D
IPv6 NHRP is not supported on DMVPN phase 3.
Why wrong: IPv6 NHRP is supported on DMVPN phase 3 with appropriate configuration.

Full breakdown with real-world context →

Question 12hardmultiple choice

Review the full OSPF breakdown →

In a VRF-Lite setup, Router R1 and R2 are running OSPF in VRF-A. R1 has interface Gig0/0 in VRF-A with ip ospf network point-to-point. R2 has interface Gig0/1 in VRF-A with default network type (broadcast). The link between them is a direct Ethernet connection. OSPF neighbors are not forming. What is the root cause?

A
The OSPF network types are mismatched: one side is point-to-point, the other is broadcast, causing neighbor adjacency failure.
Correct: OSPF requires matching network types on the same link; mismatch leads to no neighbor formation.
B
The VRF names must match for OSPF to form neighbors.
Why wrong: Incorrect: VRF names are local; OSPF process is per VRF, but network type mismatch is the issue.
C
The OSPF process ID must be the same on both routers.
Why wrong: Incorrect: OSPF process ID is local and does not need to match.
D
The interface must be configured with the same IP subnet mask.
Why wrong: Incorrect: While IP subnet mismatch can cause issues, the primary problem here is network type mismatch.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

A
The IPsec SA is established successfully with ESP 3DES and SHA.
Why wrong: The output says 'proposal doesn't match' and 'no inbound or outbound SPI', indicating failure.
B
The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.
The debug explicitly states the proposal is not supported, meaning a mismatch in transform set.
C
The ACL for the crypto map is misconfigured, causing the traffic to not match.
Why wrong: The debug shows src_proxy and dst_proxy, indicating the ACL matched, but the transform set is the issue.
D
The IKE phase 1 SA is not established before IPsec negotiation.
Why wrong: The debug does not mention IKE phase 1; it focuses on IPsec transform validation.

Full breakdown with real-world context →

Question 14mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify

IPv6 verify source: strict

What does this output indicate?

A
Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.
Correct. Strict uRPF requires both a matching route and that the interface used to reach the source is the same as the receiving interface.
B
Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.
Why wrong: Incorrect. Strict uRPF checks both the route and the interface; loose uRPF only checks the route.
C
Loose uRPF is enabled, which only checks if the source address is in the routing table.
Why wrong: Incorrect. The output explicitly says 'strict'.
D
uRPF is disabled on this interface.
Why wrong: Incorrect. The output shows it is enabled with strict mode.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1

protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0

Based on this output, what is the problem?

A
The IPsec SA is not established; phase 1 is still pending.
Why wrong: The SA is present with a current peer; phase 1 and 2 are complete.
B
The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.
Zero packet counts indicate no traffic has been encapsulated; check the crypto ACL and routing.
C
The remote peer is unreachable; the SA is in a dead state.
Why wrong: The SA is still present; if the peer were unreachable, the SA would be deleted or show errors.
D
The tunnel interface is down; the SA cannot be used.
Why wrong: The output does not show interface state; SA presence suggests tunnel is up.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Router R1 Cannot Reach R3 Practice Questions

How to approach router r1 cannot reach r3 practice questions

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.