How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

Which Command Should the Administrator Use Practice Questions

Q: How many Which Command Should the Administrator Use Practice Questions questions are on this page?

This page has 15 Which Command Should the Administrator Use Practice Questions scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

Practise Cisco CCNP ENARSI 300-410 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach which command should the administrator use practice questions

Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.

Quick answer

Which Command Should the Administrator Use Practice Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Review the full OSPF breakdown →

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediumdrag order

Study the full IPv6 explanation →

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediumdrag order

Study the full ACL explanation →

Drag and drop the steps to verify and validate the operational state of IPv4 ACLs into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 4mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path *> 10.3.3.0/24 10.1.1.2 0 100 0 i

Total number of prefixes 1

What does this output indicate?

A
BGP is not receiving any routes due to CoPP dropping updates.
Why wrong: One route is received, so updates are being processed.
B
BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.
The route is received from neighbor 10.1.1.2 with valid attributes.
C
BGP is receiving routes but not installing them in the routing table due to CoPP.
Why wrong: The output shows received routes, not installation status.
D
BGP session is flapping due to CoPP.
Why wrong: No session flap is indicated; the output is stable.

Full breakdown with real-world context →

Question 5hardmultiple choice

Study the full ACL explanation →

An engineer configures an IPsec VPN between two routers using a transform-set with ESP encryption (AES 256) and ESP authentication (SHA-256). The engineer also applies an IPv4 ACL to define interesting traffic that matches all IP traffic. After configuration, the VPN tunnel comes up, but only ICMP traffic is encrypted; other traffic like HTTP is sent in clear text. What is the most likely explanation?

A
The ACL for interesting traffic only permits ICMP, so only ICMP is encrypted.
IPsec uses the ACL to determine which traffic to protect; if only ICMP is permitted, other traffic is not encrypted.
B
The transform-set does not support HTTP traffic due to port filtering.
Why wrong: Transform-set defines encryption and authentication algorithms, not traffic selection.
C
The IPsec SA is only established for ICMP; other traffic requires a separate SA.
Why wrong: The SA is triggered by the ACL; if the ACL is narrow, only matched traffic creates SAs.
D
The router has a NAT rule that bypasses IPsec for HTTP traffic.
Why wrong: NAT can interfere, but the question does not mention NAT.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full EIGRP explanation →

An MPLS network with EIGRP as the IGP is experiencing label distribution failures. Router R1 shows: 'show mpls ldp neighbor' does not list R2. R1's configuration: mpls ip on interfaces, but no router-id configured. R2's configuration: mpls ldp router-id Loopback0 force. R1 and R2 are directly connected. What is the root cause?

A
R1's LDP router-id is not configured, so it uses the IP of the interface facing R2, which may not be reachable from R2's loopback.
LDP requires a reachable router-id. Without explicit configuration, R1 uses the interface IP, which may not be in R2's routing table.
B
R2 has a loopback interface that is not advertised via EIGRP, so R1 cannot reach it.
Why wrong: The issue is LDP session establishment, not reachability to the loopback.
C
R1 has an ACL that blocks LDP UDP packets (port 646).
Why wrong: No ACL is mentioned.
D
R2's 'force' keyword causes it to use the loopback even if it is not reachable.
Why wrong: The 'force' keyword ensures the router-id is used, but it does not cause failure.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full VPN explanation →

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

A
The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.
Without NHS configuration, spokes do not register with the hub, so NHRP cannot provide the mapping for spoke-to-spoke tunnels.
B
The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.
Why wrong: Spokes typically use mGRE as well; if they used p2p GRE, they would only connect to the hub, but the scenario does not indicate this.
C
The NHRP network-id is different on R2 and R3, preventing communication.
Why wrong: The network-id must match, but the scenario shows it is 1 on the hub; if spokes had different IDs, they would not register.
D
The tunnel source interface is not reachable between spokes.
Why wrong: Spoke-to-spoke reachability is established via NHRP; if NHRP is not working, the tunnel source may be reachable but the tunnel itself fails.

Full breakdown with real-world context →

Question 8hardmultiple choice

Review the full routing breakdown →

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a customer network. The customer has a default route pointing to the router. After enabling uRPF, the router drops traffic from the customer that has a source IP address that is not in the routing table as a directly connected or static route. What is the most likely explanation?

A
Strict mode uRPF requires a specific route for the source IP; a default route is not sufficient.
Strict mode checks for a matching route with the same incoming interface; a default route does not provide a specific interface match.
B
The customer's default route causes asymmetric routing, which breaks strict mode.
Why wrong: Asymmetric routing is a problem for strict mode, but the issue here is missing route for the source IP.
C
The uRPF mode should be loose mode to allow the default route.
Why wrong: Loose mode only checks that a route exists, not the interface, but the question specifies strict mode.
D
The router has an ACL that is blocking the traffic before uRPF checks.
Why wrong: uRPF is applied before ACLs, so ACL is not the cause.

Full breakdown with real-world context →

Question 9hardmultiple choice

Review the full OSPF breakdown →

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

A
The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.
The ACL prevents OSPF from learning the route, but redistribution allows EIGRP to carry it, and EIGRP's lower AD makes it the best path.
B
The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.
Why wrong: Outbound ACL would affect outgoing updates, not incoming learning.
C
The router has a static route for the prefix with AD 1.
Why wrong: Static route would override both, but the question does not mention static.
D
The OSPF process has a distribute-list that is filtering the route.
Why wrong: Distribute-list would filter the route from the routing table, but the ACL is the configured filter.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full VPN explanation →

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

A
The hub router does not have a route to the remote spoke's LAN subnet.
Correct because the hub must have a route to the destination subnet to send an NHRP redirect.
B
The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.
Why wrong: Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.
C
The spoke's routing table has a static route to the remote spoke's LAN via the hub.
Why wrong: Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.
D
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full VPN explanation →

An engineer configures a DMVPN Phase 2 network. Spoke routers are configured with a route map that sets the next-hop to the tunnel interface for routes learned from the hub. This is intended to allow spoke-to-spoke direct communication. However, spoke-to-spoke traffic still goes through the hub. Which is the most likely explanation?

A
The route map is applied on the spoke router inbound from the hub, but it should be applied on the hub router outbound to the spokes.
The hub must set the next-hop to the remote spoke's tunnel IP; the spoke cannot change the next-hop for routes received from the hub.
B
The route map uses a prefix-list that does not match the spoke's subnet.
Why wrong: Even if matched, the next-hop would still be the hub's tunnel IP.
C
The spoke routers have NHRP authentication mismatch, preventing direct communication.
Why wrong: NHRP authentication affects registration, not route next-hop.
D
The tunnel mode is mGRE on the spokes, which does not support spoke-to-spoke.
Why wrong: Phase 2 supports spoke-to-spoke with mGRE.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

A
The IPsec SA is established successfully with ESP 3DES and SHA.
Why wrong: The output says 'proposal doesn't match' and 'no inbound or outbound SPI', indicating failure.
B
The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.
The debug explicitly states the proposal is not supported, meaning a mismatch in transform set.
C
The ACL for the crypto map is misconfigured, causing the traffic to not match.
Why wrong: The debug shows src_proxy and dst_proxy, indicating the ACL matched, but the transform set is the issue.
D
The IKE phase 1 SA is not established before IPsec negotiation.
Why wrong: The debug does not mention IKE phase 1; it focuses on IPsec transform validation.

Full breakdown with real-world context →

Question 14mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify

IPv6 verify source: strict

What does this output indicate?

A
Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.
Correct. Strict uRPF requires both a matching route and that the interface used to reach the source is the same as the receiving interface.
B
Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.
Why wrong: Incorrect. Strict uRPF checks both the route and the interface; loose uRPF only checks the route.
C
Loose uRPF is enabled, which only checks if the source address is in the routing table.
Why wrong: Incorrect. The output explicitly says 'strict'.
D
uRPF is disabled on this interface.
Why wrong: Incorrect. The output shows it is enabled with strict mode.

Full breakdown with real-world context →

Question 15harddrag order

Review the full routing breakdown →

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Which Command Should the Administrator Use Practice Questions

How to approach which command should the administrator use practice questions

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot OSPF DR/BDR election on a multi-access segment into the correct order, from first to last.

Drag and drop the steps to verify and validate IPv6 traffic filtering and uRPF operational state into the correct order, from first to last.

Drag and drop the steps to verify and validate the operational state of IPv4 ACLs into the correct order, from first to last.

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.