How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Cisco CCNP ENARSI 300-410 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1harddrag order

Read the full VPN explanation →

Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.

Question 2harddrag order

Study the full IPv6 explanation →

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Question 3mediumdrag order

Full question →

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Question 4harddrag order

Study the full ACL explanation →

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Question 5mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

A
The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.
Correct because ICMPv6 echo replies are sourced from the destination address (R2) and must be permitted inbound on R1 for the ping to succeed.
B
The ACL is applied outbound on R1 and blocks the echo request.
Why wrong: Incorrect because the ACL is applied inbound, not outbound.
C
IPv6 unicast-routing is not enabled on R1.
Why wrong: Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.
D
The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.
Why wrong: Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).

Full breakdown with real-world context →

Question 6hardmultiple choice

Review the full OSPF breakdown →

A large enterprise network uses OSPFv3 for IPv6 routing. Router R1 and R2 are connected via a multi-access Ethernet link. R1 is configured with 'ipv6 ospf network point-to-point' while R2 uses the default broadcast network type. R1 has an IPv6 ACL applied inbound on its interface that permits only OSPF (89) and denies all other traffic. R2 is unable to form a full OSPF adjacency with R1. R2 shows 'OSPFv3 adjacency state is EXSTART/EXCHANGE' and logs 'Bad LSReq'. What is the root cause?

A
R1's ACL blocks OSPFv3 multicast hello packets (FF02::5), preventing adjacency formation on the broadcast link.
On a broadcast network, OSPFv3 sends hellos to FF02::5. R1's ACL permits only OSPF protocol, but the destination address is filtered because the ACL does not explicitly permit multicast. The network type mismatch exacerbates the issue as R1 expects unicast hellos.
B
R2's OSPFv3 process is configured with a different router-id, causing a DR election conflict.
Why wrong: Router-id mismatch would not cause 'Bad LSReq' specifically; it would affect neighbor state earlier.
C
The MTU mismatch between R1 and R2 causes OSPFv3 packet fragmentation, leading to LSReq errors.
Why wrong: MTU mismatch typically causes 'Bad LSA' or adjacency stuck in EXSTART, not specifically 'Bad LSReq'.
D
R2 has a passive interface configured, preventing it from sending OSPFv3 hellos.
Why wrong: A passive interface would prevent neighbor discovery entirely, not cause EXSTART/EXCHANGE state.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full DHCP explanation →

A network engineer runs the following debug command to troubleshoot a DHCPv4 issue on router R1:

R1# debug ip dhcp server events

Output: DHCPD: DHCPDISCOVER received from 0050.7966.6800 on interface GigabitEthernet0/0 DHCPD: Sending DHCPOFFER to 0050.7966.6800 via GigabitEthernet0/0 DHCPD: DHCPREQUEST received from 0050.7966.6800 DHCPD: No binding found for client 0050.7966.6800 DHCPD: Adding binding for client 0050.7966.6800 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0 DHCPD: DHCPINFORM received from 0050.7966.6800 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0

What does this output indicate?

A
The DHCP server failed to create a binding for the client.
Why wrong: The output shows 'Adding binding' and 'Sending DHCPACK', indicating successful binding creation.
B
The DHCP server successfully assigned an IP address to the client, and the client sent a DHCPINFORM to request additional parameters.
The sequence shows a successful DORA process (DISCOVER, OFFER, REQUEST, ACK) followed by an INFORM, which is used to get additional options like DNS servers.
C
The DHCP client is using a relay agent because the DISCOVER was received on a different interface.
Why wrong: The DISCOVER was received on GigabitEthernet0/0, which is the same interface the OFFER and ACK are sent on; no relay is indicated.
D
The DHCP server rejected the DHCPREQUEST because no binding was found.
Why wrong: The server created a new binding and sent an ACK; the 'No binding found' message is normal for a new client.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full DHCP explanation →

A network engineer is troubleshooting a DHCPv6 prefix delegation issue on router R1 and runs the following command:

R1# debug ipv6 dhcp detail

Output: IPv6 DHCP: Received SOLICIT message from FE80::21A:2BFF:FE3C:4D01 on GigabitEthernet0/0 IPv6 DHCP: Using interface pool DHCP_POOL IPv6 DHCP: Sending ADVERTISE message to FE80::21A:2BFF:FE3C:4D01 IPv6 DHCP: Received REQUEST message from FE80::21A:2BFF:FE3C:4D01 IPv6 DHCP: Client requests prefix 2001:DB8:1::/48 IPv6 DHCP: Prefix 2001:DB8:1::/48 not available in pool DHCP_POOL IPv6 DHCP: Sending REPLY message with Status Code NoPrefixAvail

What does this output indicate?

A
The DHCPv6 client successfully received the prefix 2001:DB8:1::/48.
Why wrong: The server sent a REPLY with NoPrefixAvail, meaning the prefix was not assigned.
B
The DHCPv6 server has a pool configured but the requested prefix is not in that pool or is already allocated.
The server used pool DHCP_POOL but the prefix 2001:DB8:1::/48 is not available, likely because it is not included in the pool or is already assigned to another client.
C
The DHCPv6 client is using a relay agent because the SOLICIT was received on a different interface.
Why wrong: The SOLICIT was received directly on GigabitEthernet0/0; no relay is indicated.
D
The DHCPv6 server is configured with a stateless configuration because it sent an ADVERTISE without a prefix.
Why wrong: The ADVERTISE was sent, but the server later indicated the prefix was not available; this is stateful DHCPv6 for prefix delegation.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full DHCP explanation →

A network engineer runs the following command to troubleshoot DHCPv6 address assignment on router R1:

R1# show ipv6 dhcp binding

Output: Client: FE80::21A:2BFF:FE3C:4D01 DUID: 0003000121A2B3C4D5E6

Username: unassigned

VRF: default IA NA: IA ID 0x00040001, T1 302400, T2 483840 Address: 2001:DB8:1::100 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 01 2025 12:00 PM (2592000 seconds) IA PD: IA ID 0x00040002, T1 302400, T2 483840 Prefix: 2001:DB8:1::/48 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 01 2025 12:00 PM (2592000 seconds)

What does this output indicate?

A
The DHCPv6 server has assigned only an IPv6 address to the client.
Why wrong: The output shows both an IA NA (address) and an IA PD (prefix delegation).
B
The DHCPv6 server has assigned both an IPv6 address and a prefix delegation to the client.
The IA NA section shows an address assignment, and the IA PD section shows a prefix delegation, both with lifetimes.
C
The DHCPv6 client is using stateless autoconfiguration (SLAAC) because no address is shown.
Why wrong: An address is shown under IA NA, indicating stateful DHCPv6.
D
The DHCPv6 server has a pool with only one prefix available.
Why wrong: The output only shows one binding; it does not indicate the size of the pool.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER

IPv6 access list FILTER

permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence

permit ipv6 any any sequence 30

What does this output indicate?

A
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.
Correct. Sequence 10 permits the first prefix, sequence 20 denies the second, and sequence 30 permits everything else.
B
The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.
Why wrong: Incorrect. There is an explicit permit any any at sequence 30, so other traffic is permitted.
C
The access list will deny all traffic because of the deny statement.
Why wrong: Incorrect. The deny only applies to the specified prefix; other traffic is permitted by sequence 30.
D
The access list is invalid because IPv6 access lists require implicit deny at the end.
Why wrong: Incorrect. IPv6 access lists do have an implicit deny, but the explicit permit any any overrides it.

Full breakdown with real-world context →

Question 11harddrag order

Study the full IPv6 explanation →

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Question 12mediummultiple choice

Read the full DHCP explanation →

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1:

R1# debug ipv6 dhcp relay

Output: IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0

What does this output indicate?

A
The DHCPv6 relay agent is not functioning because messages are not being forwarded.
Why wrong: The output clearly shows messages being forwarded in both directions.
B
The DHCPv6 relay agent is successfully forwarding messages between the client and server.
The relay receives client messages, forwards them to the server, and forwards server responses back to the client.
C
The DHCPv6 server is unreachable because no REPLY is received.
Why wrong: A REPLY is received and forwarded to the client.
D
The DHCPv6 client is using a global unicast address as its link-local address.
Why wrong: The client uses FE80::1, which is a link-local address.

Full breakdown with real-world context →

Question 13harddrag order

Read the full DHCP explanation →

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Question 14mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is troubleshooting connectivity from a host inside a corporate network to a public web server. The host has IP 10.1.1.10/24, and the router's outside interface is 203.0.113.1/24. The engineer configured a dynamic NAT pool (203.0.113.10-203.0.113.20) and an access list permitting 10.1.1.0/24. However, traffic from the host fails. A 'show ip nat translations' reveals no translations. What is the most likely cause?

A
The NAT pool is exhausted.
Why wrong: Incorrect because the pool has 11 addresses, and only one host is trying to translate; no translations appear at all, not a pool exhaustion issue.
B
The 'ip nat inside' and 'ip nat outside' commands are misapplied on the interfaces.
Why wrong: Incorrect because if the interfaces are not correctly designated, translations might still appear but traffic would not flow; however, no translations at all suggests the ACL is the issue.
C
The access list used in the NAT configuration does not match the source IP of the host.
Correct because dynamic NAT requires the ACL to match the source; if the ACL is misconfigured (e.g., denies the subnet), no translations are created.
D
The host's default gateway is not the router's inside interface.
Why wrong: Incorrect because even if the gateway is wrong, the router would still see the traffic and attempt NAT if the ACL matches; no translations indicate a different issue.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

A
The NAT pool is not configured with overload.
Why wrong: Incorrect because overload is configured, as seen by the many translations sharing the same IP.
B
The outside interface is flapping, causing translations to be cleared.
Why wrong: Incorrect because if the interface flapped, translations would be cleared, not accumulated.
C
The router has run out of available port numbers for PAT.
Correct because PAT uses a limited port range (usually 1024-65535), and with many sessions, ports can be exhausted, preventing new translations.
D
The access list is denying some inside hosts.
Why wrong: Incorrect because if the ACL were denying hosts, those hosts would never get translations; the issue is that translations exist but new ones fail.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Practice scenarios

Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.