How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Cisco CCNP ENARSI 300-410 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Review the full OSPF breakdown →

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path *> 10.3.3.0/24 10.1.1.2 0 100 0 i

Total number of prefixes 1

What does this output indicate?

A
BGP is not receiving any routes due to CoPP dropping updates.
Why wrong: One route is received, so updates are being processed.
B
BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.
The route is received from neighbor 10.1.1.2 with valid attributes.
C
BGP is receiving routes but not installing them in the routing table due to CoPP.
Why wrong: The output shows received routes, not installation status.
D
BGP session is flapping due to CoPP.
Why wrong: No session flap is indicated; the output is stable.

Full breakdown with real-world context →

Question 3mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full VPN explanation →

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

A
The hub router does not have a route to the remote spoke's LAN subnet.
Correct because the hub must have a route to the destination subnet to send an NHRP redirect.
B
The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.
Why wrong: Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.
C
The spoke's routing table has a static route to the remote spoke's LAN via the hub.
Why wrong: Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.
D
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full OSPF breakdown →

In a VRF-Lite setup, Router R1 and R2 are running OSPF in VRF-A. R1 has interface Gig0/0 in VRF-A with ip ospf network point-to-point. R2 has interface Gig0/1 in VRF-A with default network type (broadcast). The link between them is a direct Ethernet connection. OSPF neighbors are not forming. What is the root cause?

A
The OSPF network types are mismatched: one side is point-to-point, the other is broadcast, causing neighbor adjacency failure.
Correct: OSPF requires matching network types on the same link; mismatch leads to no neighbor formation.
B
The VRF names must match for OSPF to form neighbors.
Why wrong: Incorrect: VRF names are local; OSPF process is per VRF, but network type mismatch is the issue.
C
The OSPF process ID must be the same on both routers.
Why wrong: Incorrect: OSPF process ID is local and does not need to match.
D
The interface must be configured with the same IP subnet mask.
Why wrong: Incorrect: While IP subnet mismatch can cause issues, the primary problem here is network type mismatch.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

A
The IPsec SA is established successfully with ESP 3DES and SHA.
Why wrong: The output says 'proposal doesn't match' and 'no inbound or outbound SPI', indicating failure.
B
The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.
The debug explicitly states the proposal is not supported, meaning a mismatch in transform set.
C
The ACL for the crypto map is misconfigured, causing the traffic to not match.
Why wrong: The debug shows src_proxy and dst_proxy, indicating the ACL matched, but the transform set is the issue.
D
The IKE phase 1 SA is not established before IPsec negotiation.
Why wrong: The debug does not mention IKE phase 1; it focuses on IPsec transform validation.

Full breakdown with real-world context →

Question 7harddrag order

Review the full routing breakdown →

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8mediummultiple choice

Full question →

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# debug ip sla trace

IP SLAs trace debugging is on

*Mar  1 12:34:56.789: IP SLAs: Starting operation 10
*Mar  1 12:34:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: RTT = 12 ms
*Mar  1 12:34:56.790: IP SLAs: Operation 10 completed successfully
*Mar  1 12:35:56.789: IP SLAs: Starting operation 10
*Mar  1 12:35:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: RTT = 14 ms
*Mar  1 12:35:56.790: IP SLAs: Operation 10 completed successfully

What does this output indicate?

A
The IP SLA operation is failing because the RTT values are too high.
Why wrong: RTT values of 12-14 ms are normal.
B
The IP SLA operation is successfully completing each probe cycle.
Each cycle shows 'completed successfully'.
C
The IP SLA operation is not configured because no configuration is shown.
Why wrong: The debug output shows operation 10 is running.
D
The IP SLA operation is timing out because no reply is received.
Why wrong: Replies are received in each cycle.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full OSPF breakdown →

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

A
The routers have the same OSPF router ID.
When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.
B
The OSPF hello interval is mismatched between the two routers.
Why wrong: A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
C
The subinterfaces are in different VLANs, preventing Layer 2 communication.
Why wrong: If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
D
The OSPF network type is set to point-to-point on one side and broadcast on the other.
Why wrong: A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full VPN explanation →

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

A
The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.
Without these commands, the hub does not trigger NHRP resolution for spoke-to-spoke traffic, and spokes do not install the necessary routes.
B
The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.
Why wrong: Authentication mismatch would prevent NHRP registration, but the mapping exists.
C
The tunnel interface on R1 is not in the correct VRF.
Why wrong: VRF misconfiguration would cause other issues, but not specifically spoke-to-spoke failure with existing NHRP mapping.
D
The IPsec transform set is mismatched between spokes.
Why wrong: IPsec mismatch would prevent tunnel establishment, but the DMVPN session is up.

Full breakdown with real-world context →

Question 11mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER

IPv6 access list FILTER

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence

permit ipv6 any any sequence 30

What does this output indicate?

A
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.
Correct. Sequence 10 permits the first prefix, sequence 20 denies the second, and sequence 30 permits everything else.
B
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.
Why wrong: Incorrect. There is an explicit permit any any at sequence 30, so other traffic is permitted.
C
The access list will deny all traffic because of the deny statement.
Why wrong: Incorrect. The deny only applies to the specified prefix; other traffic is permitted by sequence 30.
D
The access list is invalid because IPv6 access lists require implicit deny at the end.
Why wrong: Incorrect. IPv6 access lists do have an implicit deny, but the explicit permit any any overrides it.

Full breakdown with real-world context →

Question 12mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

A
The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.
Correct because if the ACL referenced in the route map does not exist, the route map will not match any traffic, and PBR will not be applied.
B
The 'set ip next-hop' command is misspelled as 'set ip nexthop'.
Why wrong: Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.
C
The router is running an older IOS version that does not support PBR.
Why wrong: Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.
D
The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.
Why wrong: Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

Full breakdown with real-world context →

Question 13mediummultiple choice

Study the full AAA explanation →

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

A
TCP port 49 is blocked between the router and the TACACS+ server.
Correct because TACACS+ uses TCP port 49; if blocked, the router cannot establish a connection to the server.
B
The TACACS+ server shared key is incorrect.
Why wrong: Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.
C
The username 'admin' does not exist on the TACACS+ server.
Why wrong: Incorrect because the test command would still receive a response from the server indicating authentication failure.
D
The TACACS+ server is not configured for the router's IP address.
Why wrong: Incorrect because the server would still respond with a reject if the client is not authorized.

Full breakdown with real-world context →

Question 14hardmultiple choice

Open the full BGP breakdown →

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24

BGP routing table entry for 192.168.1.0/24, version 12 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 65001

10.1.1.2 from 10.1.1.2 (10.1.1.2)

Origin IGP, metric 0, localpref 100, valid, external Refresh Epoch 2 65002

10.2.2.2 from 10.2.2.2 (10.2.2.2)

Origin IGP, metric 0, localpref 100, valid, external, best

What does this output indicate?

A
Both paths are equally preferred, and BGP load-balances traffic.
Why wrong: Only one path is marked as best; load-balancing requires multiple best paths.
B
The path from AS 65002 is best because it has a higher local preference.
Why wrong: Both paths have localpref 100, so local preference is equal.
C
The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.
When attributes are equal, BGP uses tie-breakers like lower router ID. The best path is from AS 65002.
D
The path from AS 65001 is best because it was received first.
Why wrong: The output shows the path from AS 65002 as best, not AS 65001.

Full breakdown with real-world context →

Question 15harddrag order

Study the full IPv6 explanation →

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.