Layer 3 Technologies practice questions

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

Trap 1: The OSPF hello interval is mismatched between the two routers.

A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.

Trap 2: The subinterfaces are in different VLANs, preventing Layer 2…

If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.

Trap 3: The OSPF network type is set to point-to-point on one side and…

A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

A
The routers have the same OSPF router ID.
When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.
B
The OSPF hello interval is mismatched between the two routers.
Why wrong: A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
C
The subinterfaces are in different VLANs, preventing Layer 2 communication.
Why wrong: If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
D
The OSPF network type is set to point-to-point on one side and broadcast on the other.
Why wrong: A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

Study the full AAA explanation →

Question 2mediummultiple choice

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Trap 1: The TACACS+ server shared key is incorrect.

Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.

Trap 2: The username 'admin' does not exist on the TACACS+ server.

Incorrect because the test command would still receive a response from the server indicating authentication failure.

Trap 3: The TACACS+ server is not configured for the router's IP address.

Incorrect because the server would still respond with a reject if the client is not authorized.

A
TCP port 49 is blocked between the router and the TACACS+ server.
Correct because TACACS+ uses TCP port 49; if blocked, the router cannot establish a connection to the server.
B
The TACACS+ server shared key is incorrect.
Why wrong: Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.
C
The username 'admin' does not exist on the TACACS+ server.
Why wrong: Incorrect because the test command would still receive a response from the server indicating authentication failure.
D
The TACACS+ server is not configured for the router's IP address.
Why wrong: Incorrect because the server would still respond with a reject if the client is not authorized.

Question 3mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors

IPv6 Address Age Link-layer Addr State Interface 2001:DB8:1::1 0 aaaa.bbbb.cccc REACH Gi0/0/0 2001:DB8:1::2 10 aaaa.bbbb.cccd STALE Gi0/0/0 2001:DB8:1::3 - aaaa.bbbb.ccce DELAY Gi0/0/1 FE80::1 0 aaaa.bbbb.cccf REACH Gi0/0/0

Based on this output, which statement is correct?

Trap 1: All neighbors are in a stable state.

The DELAY state indicates a transition; not all are stable.

Trap 2: The neighbor 2001:DB8:1::2 is unreachable.

STALE state means the entry is valid but not recently verified.

Trap 3: The link-local address FE80::1 is not valid.

It is REACH, so it is valid.

A
All neighbors are in a stable state.
Why wrong: The DELAY state indicates a transition; not all are stable.
B
The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.
DELAY state means a NS is pending after a delay timer.
C
The neighbor 2001:DB8:1::2 is unreachable.
Why wrong: STALE state means the entry is valid but not recently verified.
D
The link-local address FE80::1 is not valid.
Why wrong: It is REACH, so it is valid.

Question 4mediummultiple choice

A network engineer is troubleshooting an OSPFv2 route flapping issue. The router R1 is learning a route to 192.168.1.0/24 via two different paths: one through R2 and one through R3. The route is flapping between the two paths every few seconds. 'show ip ospf interface' shows that both interfaces are stable. What is the most likely cause?

Trap 1: The route is being redistributed by both R2 and R3 with different…

Different metrics would cause the router to prefer one path, not flap.

Trap 2: The OSPF network type on the interfaces is set to broadcast,…

If the interfaces are stable, the DR/BDR election is stable.

Trap 3: The link between R1 and R2 has a high error rate causing…

The stem says the interfaces are stable, indicating no Layer 1 issues.

A
The routers R2 and R3 have the same OSPF router ID.
Duplicate router IDs can cause OSPF to see the same route from two different neighbors as different, leading to route flapping.
B
The route is being redistributed by both R2 and R3 with different metrics.
Why wrong: Different metrics would cause the router to prefer one path, not flap.
C
The OSPF network type on the interfaces is set to broadcast, causing DR/BDR instability.
Why wrong: If the interfaces are stable, the DR/BDR election is stable.
D
The link between R1 and R2 has a high error rate causing intermittent packet loss.
Why wrong: The stem says the interfaces are stable, indicating no Layer 1 issues.

Review the full routing breakdown →

Question 5mediumdrag order

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 6mediummultiple choice

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

Trap 1: The router forwards the packet normally.

IPv6 does not allow multicast source addresses.

Trap 2: The router sends an ICMPv6 error message back to the source.

No ICMP error is generated for invalid source addresses; the packet is simply dropped.

Trap 3: The router rewrites the source address to the link-local address of…

Routers do not modify source addresses; they drop invalid packets.

A
The router forwards the packet normally.
Why wrong: IPv6 does not allow multicast source addresses.
B
The router drops the packet silently.
Per RFC 2460, a packet with a multicast source address is invalid and must be discarded.
C
The router sends an ICMPv6 error message back to the source.
Why wrong: No ICMP error is generated for invalid source addresses; the packet is simply dropped.
D
The router rewrites the source address to the link-local address of the interface.
Why wrong: Routers do not modify source addresses; they drop invalid packets.

Question 7hardmultiple choice

Which IPv6 traffic filter can be used to match traffic based on the Flow Label field?

Trap 1: IPv6 prefix-list

Prefix-lists match on prefixes, not flow labels.

Trap 2: IPv6 route-map with match ipv6 address

Route-maps can reference access-lists but do not directly match flow labels.

Trap 3: IPv6 uRPF

uRPF checks routing table reachability, not flow labels.

A
IPv6 access-list with the 'flow-label' option
The 'flow-label' keyword allows matching the 20-bit Flow Label field in the IPv6 header.
B
IPv6 prefix-list
Why wrong: Prefix-lists match on prefixes, not flow labels.
C
IPv6 route-map with match ipv6 address
Why wrong: Route-maps can reference access-lists but do not directly match flow labels.
D
IPv6 uRPF
Why wrong: uRPF checks routing table reachability, not flow labels.

Question 8mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Trap 1: Enable DHCPv6 Guard to block DHCPv6 messages from the secondary…

Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.

Trap 2: Use IPv6 Source Guard to filter traffic from the secondary router.

Incorrect because IPv6 Source Guard filters data traffic, not RAs.

Trap 3: Configure the switch to act as a router and send its own RAs with a…

Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

A
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
B
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why wrong: Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the secondary router.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not RAs.
D
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why wrong: Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

Read the full DHCP explanation →

Question 9hardmultiple choice

What is the default DHCPv6 client DUID type on a Cisco IOS-XE router?

Trap 1: DUID-LLT (Link-Layer plus Time)

DUID-LLT is used by some implementations but not the default on Cisco IOS-XE.

Trap 2: DUID-EN (Enterprise Number)

DUID-EN is used for vendor-specific DUIDs, not the default.

Trap 3: DUID-UUID (Universally Unique Identifier)

DUID-UUID is not a standard DUID type in RFC 8415.

A
DUID-LLT (Link-Layer plus Time)
Why wrong: DUID-LLT is used by some implementations but not the default on Cisco IOS-XE.
B
DUID-EN (Enterprise Number)
Why wrong: DUID-EN is used for vendor-specific DUIDs, not the default.
C
DUID-LL (Link-Layer)
Cisco IOS-XE defaults to DUID-LL for DHCPv6 clients.
D
DUID-UUID (Universally Unique Identifier)
Why wrong: DUID-UUID is not a standard DUID type in RFC 8415.

Read the full Layer 3 Technologies explanation →

Question 10hardmulti select

Which TWO statements about the limitations of local SPAN are correct? (Choose TWO.)

Trap 1: A local SPAN destination port can be a routed port or a switchport…

Incorrect. The destination port must be a switchport in access mode; it cannot be a routed port or a trunk port.

Trap 2: A local SPAN session can include a VLAN as a source, which monitors…

Incorrect. VLAN-based SPAN monitors all traffic in the VLAN, including control plane traffic like STP BPDUs, but it does not monitor traffic that is switched in hardware only (e.g., some CEF-switched traffic may be missed).

Trap 3: A local SPAN session can have multiple destination ports to send…

Incorrect. A single local SPAN session can have only one destination port (or one destination interface). Multiple destinations require multiple sessions.

A
A local SPAN session can only monitor traffic on the same switch where the session is configured.
Correct. Local SPAN is confined to a single switch; it cannot extend across switches.
B
A local SPAN destination port can be a routed port or a switchport in trunk mode.
Why wrong: Incorrect. The destination port must be a switchport in access mode; it cannot be a routed port or a trunk port.
C
A local SPAN session can monitor both ingress and egress traffic simultaneously on the same source interface.
Correct. You can specify 'both' as the direction for the source, capturing both incoming and outgoing frames.
D
A local SPAN session can include a VLAN as a source, which monitors all traffic in that VLAN except the control plane traffic.
Why wrong: Incorrect. VLAN-based SPAN monitors all traffic in the VLAN, including control plane traffic like STP BPDUs, but it does not monitor traffic that is switched in hardware only (e.g., some CEF-switched traffic may be missed).
E
A local SPAN session can have multiple destination ports to send the mirrored traffic to multiple analyzers.
Why wrong: Incorrect. A single local SPAN session can have only one destination port (or one destination interface). Multiple destinations require multiple sessions.

Question 11harddrag order

Drag and drop the steps to troubleshoot OSPF adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummultiple choice

Examine this configuration on Router R4: ```

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

ipv6 address 2001:DB8:6::1/64 tunnel source GigabitEthernet0/0 tunnel destination 172.16.1.2 tunnel mode gre ip ``` What will be the effect?

Trap 1: The tunnel will only carry IPv4 traffic because the mode is 'gre…

GRE can carry multiple protocols; 'gre ip' means transport is IPv4, but payload can be IPv4, IPv6, etc.

Trap 2: The tunnel will fail because the tunnel source is an interface, not…

Using an interface as tunnel source is valid and recommended.

Trap 3: The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.

GRE can carry IPv6; ipv6ip is only for IPv6 over IPv4 without GRE.

A
The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.
Why wrong: GRE can carry multiple protocols; 'gre ip' means transport is IPv4, but payload can be IPv4, IPv6, etc.
B
The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.
GRE allows multiprotocol payload; the IPv4 and IPv6 addresses on the tunnel interface are valid.
C
The tunnel will fail because the tunnel source is an interface, not an IP address.
Why wrong: Using an interface as tunnel source is valid and recommended.
D
The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.
Why wrong: GRE can carry IPv6; ipv6ip is only for IPv6 over IPv4 without GRE.

Read the full Layer 3 Technologies explanation →

Question 13mediumdrag order

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14hardmulti select

Read the full VRF explanation →

An engineer is troubleshooting a VRF-Lite setup where two VRFs (BLUE and RED) are configured on a router. Hosts in VRF BLUE cannot ping the default gateway of VRF RED. Which TWO statements correctly explain why this is expected behavior? (Choose TWO.)

Trap 1: The ARP cache in VRF BLUE does not contain the MAC address of the…

Incorrect. ARP is per-interface; the host in BLUE would ARP for its own gateway, not for the RED gateway. The failure is due to routing, not ARP.

Trap 2: The default gateway in VRF RED is not reachable from VRF BLUE…

Incorrect. The gateway is reachable within its own VRF; the issue is that VRF BLUE cannot route to the RED subnet.

Trap 3: The ping fails because VRF BLUE does not have a default route…

Incorrect. Even with a default route, VRF BLUE cannot forward packets to a different VRF without inter-VRF routing.

A
Each VRF maintains its own separate routing table, so VRF BLUE has no route to the subnet of VRF RED.
Correct. VRFs have isolated routing tables; without inter-VRF routing, there is no path.
B
The ARP cache in VRF BLUE does not contain the MAC address of the VRF RED gateway.
Why wrong: Incorrect. ARP is per-interface; the host in BLUE would ARP for its own gateway, not for the RED gateway. The failure is due to routing, not ARP.
C
By default, a router does not forward packets between different VRFs unless inter-VRF routing is explicitly configured.
Correct. VRF-Lite inherently isolates traffic; inter-VRF forwarding requires additional configuration (e.g., route leaking or a router with interfaces in both VRFs).
D
The default gateway in VRF RED is not reachable from VRF BLUE because the gateway interface is in a different VRF.
Why wrong: Incorrect. The gateway is reachable within its own VRF; the issue is that VRF BLUE cannot route to the RED subnet.
E
The ping fails because VRF BLUE does not have a default route pointing to the VRF RED gateway.
Why wrong: Incorrect. Even with a default route, VRF BLUE cannot forward packets to a different VRF without inter-VRF routing.

Question 15mediummultiple choice

A network engineer is troubleshooting an OSPFv2 adjacency issue between two directly connected routers, R1 and R2, both running IOS-XE. The link is a point-to-point Ethernet link. The engineer issues 'show ip ospf neighbor' on R1 and sees no neighbors. 'show ip ospf interface GigabitEthernet0/0' on R1 shows 'Network Type BROADCAST', but the link is actually a point-to-point link. Both routers have 'ip ospf 1 area 0' configured on the interface. What is the most likely cause of the adjacency not forming?

Trap 1: The OSPF network type mismatch between the two routers (one is…

Both show BROADCAST, so no mismatch.

Trap 2: The interface is configured with 'ip ospf passive-interface'.

Passive interface would still allow the router to receive hellos but not send them, but the neighbor list would show the neighbor in INIT state, not absent.

Trap 3: The OSPF process is not enabled globally; 'router ospf 1' is…

If 'ip ospf 1 area 0' is configured on the interface, the process is automatically created if not already present.

A
The OSPF network type mismatch between the two routers (one is BROADCAST, the other is POINT-TO-POINT).
Why wrong: Both show BROADCAST, so no mismatch.
B
The routers have duplicate OSPF router IDs.
Duplicate router IDs prevent OSPF adjacency from forming; each router must have a unique router ID.
C
The interface is configured with 'ip ospf passive-interface'.
Why wrong: Passive interface would still allow the router to receive hellos but not send them, but the neighbor list would show the neighbor in INIT state, not absent.
D
The OSPF process is not enabled globally; 'router ospf 1' is missing.
Why wrong: If 'ip ospf 1 area 0' is configured on the interface, the process is automatically created if not already present.

Review the full subnetting walkthrough →

Question 16hardmultiple choice

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for traffic that is fragmented. What is the most likely reason?

Trap 1: The route-map is missing a 'match fragment' command.

No such command exists in PBR.

Trap 2: Fragmented packets are always dropped by PBR.

They are not dropped but may be forwarded normally.

Trap 3: The ACL in the route-map is using a 'deny' statement for fragmented…

ACLs can match fragments, but PBR behavior is specific to the first fragment.

A
PBR only matches the first fragment; subsequent fragments are forwarded based on the routing table because they lack Layer 4 headers.
Fragments after the first do not have Layer 4 info, so ACLs with port matching fail; PBR may not apply.
B
The route-map is missing a 'match fragment' command.
Why wrong: No such command exists in PBR.
C
Fragmented packets are always dropped by PBR.
Why wrong: They are not dropped but may be forwarded normally.
D
The ACL in the route-map is using a 'deny' statement for fragmented packets.
Why wrong: ACLs can match fragments, but PBR behavior is specific to the first fragment.