Question 1mediumdrag order
Read the full Layer 3 Technologies explanation →300-410 · topic practice
Layer 3 Technologies practice questions
Practise Cisco CCNP ENARSI 300-410 Layer 3 Technologies practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
What to know about Layer 3 Technologies
Layer 3 Technologies questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Common Layer 3 Technologies exam traps
- ▸Answering from memory before reading the full scenario.
- ▸Missing a constraint such as cost, availability, security, scope or command context.
- ▸Choosing a broad answer when the question asks for the most specific fix.
- ▸Ignoring why the wrong options are tempting.
Practice set
Layer 3 Technologies questions
17 questions · select your answer, then reveal the explanation
Question 2hardmultiple choice
Read the full DHCP explanation →What is the default DHCPv6 client DUID type on a Cisco IOS-XE router?
Trap 1: DUID-LLT (Link-Layer plus Time)
DUID-LLT is used by some implementations but not the default on Cisco IOS-XE.
Trap 2: DUID-EN (Enterprise Number)
DUID-EN is used for vendor-specific DUIDs, not the default.
Trap 3: DUID-UUID (Universally Unique Identifier)
DUID-UUID is not a standard DUID type in RFC 8415.
- A
DUID-LLT (Link-Layer plus Time)
Why wrong: DUID-LLT is used by some implementations but not the default on Cisco IOS-XE.
- B
DUID-EN (Enterprise Number)
Why wrong: DUID-EN is used for vendor-specific DUIDs, not the default.
- C
DUID-LL (Link-Layer)
Cisco IOS-XE defaults to DUID-LL for DHCPv6 clients.
- D
DUID-UUID (Universally Unique Identifier)
Why wrong: DUID-UUID is not a standard DUID type in RFC 8415.
Question 3hardmultiple choice
Read the full NAT/PAT explanation →A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?
Trap 1: The PAT port range is exhausted.
Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.
Trap 2: The phone's default gateway is misconfigured.
Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.
Trap 3: The outside interface has a firewall blocking UDP ports.
Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.
- A
The PAT port range is exhausted.
Why wrong: Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.
- B
The router's SIP ALG is disabled, so the private IP in the SDP is not translated.
Correct because without SIP ALG, the router does not inspect and translate the IP addresses inside the SIP messages, causing media to be sent to the private IP.
- C
The phone's default gateway is misconfigured.
Why wrong: Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.
- D
The outside interface has a firewall blocking UDP ports.
Why wrong: Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.
Question 4mediummulti select
Study the full ACL explanation →Which TWO statements about Control Plane Policing (CoPP) are true? (Choose TWO.)
Trap 1: CoPP is applied directly to physical interfaces to protect the…
CoPP is applied globally to the control plane using the 'service-policy input' command under 'control-plane', not to individual interfaces.
Trap 2: CoPP operates at Layer 2 to filter Ethernet frames before they…
CoPP operates at Layer 3 and above, classifying packets based on IP headers and upper-layer information, not Ethernet frames.
Trap 3: CoPP replaces the need for access control lists (ACLs) on the…
CoPP complements ACLs but does not replace them; ACLs are often used within class maps for CoPP classification.
- A
CoPP uses Modular QoS CLI (MQC) to define traffic classes and actions.
CoPP relies on MQC with class maps to match traffic and policy maps to define policing actions.
- B
CoPP is applied directly to physical interfaces to protect the control plane.
Why wrong: CoPP is applied globally to the control plane using the 'service-policy input' command under 'control-plane', not to individual interfaces.
- C
CoPP can be used to rate-limit traffic destined to the CPU, such as routing protocol packets or management traffic.
CoPP is designed to police traffic that is processed by the route processor, including OSPF, BGP, SSH, and SNMP.
- D
CoPP operates at Layer 2 to filter Ethernet frames before they reach the CPU.
Why wrong: CoPP operates at Layer 3 and above, classifying packets based on IP headers and upper-layer information, not Ethernet frames.
- E
CoPP replaces the need for access control lists (ACLs) on the device.
Why wrong: CoPP complements ACLs but does not replace them; ACLs are often used within class maps for CoPP classification.
Question 5mediummultiple choice
Study the full ACL explanation →Which control plane protocol packets are classified as 'critical' in the default CoPP policy?
Trap 1: ICMP echo requests and SSH
ICMP and SSH are typically classified as 'normal' or 'management' traffic, not critical.
Trap 2: Telnet and HTTP
Telnet and HTTP are management protocols, usually classified as 'normal' or 'management'.
Trap 3: NTP and SNMP
NTP and SNMP are important but not as time-sensitive as routing protocol hellos; they are often placed in a lower priority class.
- A
ICMP echo requests and SSH
Why wrong: ICMP and SSH are typically classified as 'normal' or 'management' traffic, not critical.
- B
OSPF hello packets and BGP keepalives
Routing protocol hello and keepalive packets are considered critical for network stability and are assigned to the critical class in CoPP.
- C
Telnet and HTTP
Why wrong: Telnet and HTTP are management protocols, usually classified as 'normal' or 'management'.
- D
NTP and SNMP
Why wrong: NTP and SNMP are important but not as time-sensitive as routing protocol hellos; they are often placed in a lower priority class.
Question 6mediummultiple choice
Study the full ACL explanation →What is the default CoPP classification for ARP packets on a Cisco IOS-XE device?
Trap 1: Normal
ARP is considered critical because it is required for basic connectivity.
Trap 2: Management
Management traffic includes protocols like SSH and SNMP, not ARP.
Trap 3: Best-effort
Best-effort is for non-critical traffic; ARP is critical for network operation.
- A
Normal
Why wrong: ARP is considered critical because it is required for basic connectivity.
- B
Critical
ARP is classified as critical to ensure that address resolution is not starved by CoPP.
- C
Management
Why wrong: Management traffic includes protocols like SSH and SNMP, not ARP.
- D
Best-effort
Why wrong: Best-effort is for non-critical traffic; ARP is critical for network operation.
Question 7mediummultiple choice
Study the full IPv6 explanation →A network engineer runs the following command on Router R1:
R1# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface 2001:DB8:1::1 0 aaaa.bbbb.cccc REACH Gi0/0/0 2001:DB8:1::2 10 aaaa.bbbb.cccd STALE Gi0/0/0 2001:DB8:1::3 - aaaa.bbbb.ccce DELAY Gi0/0/1 FE80::1 0 aaaa.bbbb.cccf REACH Gi0/0/0
Based on this output, which statement is correct?
Trap 1: All neighbors are in a stable state.
The DELAY state indicates a transition; not all are stable.
Trap 2: The neighbor 2001:DB8:1::2 is unreachable.
STALE state means the entry is valid but not recently verified.
Trap 3: The link-local address FE80::1 is not valid.
It is REACH, so it is valid.
- A
All neighbors are in a stable state.
Why wrong: The DELAY state indicates a transition; not all are stable.
- B
The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.
DELAY state means a NS is pending after a delay timer.
- C
The neighbor 2001:DB8:1::2 is unreachable.
Why wrong: STALE state means the entry is valid but not recently verified.
- D
The link-local address FE80::1 is not valid.
Why wrong: It is REACH, so it is valid.
Question 8mediummultiple choice
Open the full VLAN trunking answer →A network engineer runs the following command to verify IPv6 binding table:
R1# show ipv6 neighbors binding
IPv6 Address Age Link-layer Addr State Interface VLAN Policy 2001:db8::1 10 0011.2233.4455 REACH Fa0/1 10 TRUSTED 2001:db8::2 5 00aa.bbcc.ddee STALE Fa0/0 10 INSPECT 2001:db8::3 0 1111.2222.3333 INCOMP Fa0/0 10 -
What does this output indicate?
Trap 1: The binding table is empty, indicating no ND activity.
There are three entries, so it is not empty.
Trap 2: The binding table shows all entries as reachable, indicating stable…
One entry is STALE and one is INCOMP, not all reachable.
Trap 3: The binding table is only for DHCPv6-learned addresses.
The table includes ND-learned addresses, not just DHCPv6.
- A
The binding table shows three entries: one reachable on trusted port, one stale on untrusted port, and one incomplete, indicating active ND learning.
The output correctly shows the state and policy for each entry.
- B
The binding table is empty, indicating no ND activity.
Why wrong: There are three entries, so it is not empty.
- C
The binding table shows all entries as reachable, indicating stable neighbor relationships.
Why wrong: One entry is STALE and one is INCOMP, not all reachable.
- D
The binding table is only for DHCPv6-learned addresses.
Why wrong: The table includes ND-learned addresses, not just DHCPv6.
Question 9hardmulti select
Study the full IPv6 explanation →Which TWO statements about IPv6 First Hop Security (FHS) RA Guard are true? (Choose TWO.)
Trap 1: RA Guard validates the source MAC address of Router Advertisements…
Incorrect. RA Guard does not perform source MAC validation; it checks router preference and hop limit fields.
Trap 2: The default RA Guard policy action is to log Router Advertisements…
Incorrect. The default action is 'block', not 'log'. Logging can be configured separately.
Trap 3: RA Guard is typically enabled on trunk ports to protect against…
Incorrect. RA Guard is usually applied on access ports; trunk ports often need to forward legitimate RAs.
- A
The default RA Guard policy action is to block Router Advertisements from unauthorized ports.
Correct. The default action for an RA Guard policy is 'block', which drops unauthorized RAs.
- B
RA Guard validates the source MAC address of Router Advertisements against the IPv6 source address.
Why wrong: Incorrect. RA Guard does not perform source MAC validation; it checks router preference and hop limit fields.
- C
The default RA Guard policy action is to log Router Advertisements from unauthorized ports.
Why wrong: Incorrect. The default action is 'block', not 'log'. Logging can be configured separately.
- D
RA Guard can be applied on a per-interface or per-VLAN basis using a policy map.
Correct. RA Guard policies are applied using a policy map that can be attached to an interface or a VLAN.
- E
RA Guard is typically enabled on trunk ports to protect against rogue RAs from other VLANs.
Why wrong: Incorrect. RA Guard is usually applied on access ports; trunk ports often need to forward legitimate RAs.
Question 10hardmulti select
Read the full NAT/PAT explanation →An engineer is troubleshooting a PAT overload configuration on a Cisco router. Inside hosts can access the Internet, but some applications (e.g., FTP, SIP) fail. Which TWO commands can be used to verify the NAT translations and identify the issue? (Choose TWO.)
Trap 1: 'show ip nat statistics'
Incorrect. This shows hit counts and configuration summary, not per-translation details needed for application failure analysis.
Trap 2: 'show ip access-lists'
Incorrect. This shows ACL entries and matches, not NAT translations.
Trap 3: 'show running-config | include nat'
Incorrect. This shows the NAT configuration, not the operational translations or debug output.
- A
'show ip nat translations'
Correct. This shows the current NAT table, including inside local, inside global, outside local, and outside global addresses and ports.
- B
'debug ip nat detailed'
Correct. This debug provides detailed information about each packet being translated, including application-layer changes.
- C
'show ip nat statistics'
Why wrong: Incorrect. This shows hit counts and configuration summary, not per-translation details needed for application failure analysis.
- D
'show ip access-lists'
Why wrong: Incorrect. This shows ACL entries and matches, not NAT translations.
- E
'show running-config | include nat'
Why wrong: Incorrect. This shows the NAT configuration, not the operational translations or debug output.
Question 11mediumdrag order
Study the full EIGRP explanation →Drag and drop the steps to troubleshoot EIGRP neighbor adjacency formation into the correct order, from first to last.
Question 12hardmultiple choice
Review the full OSPF breakdown →A network engineer runs the following command on Router R3:
R3# show logging | include %OSPF-5-ADJCHG *Mar 1 00:05:10.123: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done *Mar 1 00:06:20.456: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired *Mar 1 00:07:30.789: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from DOWN to INIT, Received Hello *Mar 1 00:08:40.012: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from INIT to EXSTART, Event: start *Mar 1 00:09:50.345: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXSTART to EXCHANGE, Event: Negotiation Done *Mar 1 00:10:00.678: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXCHANGE to LOADING, Event: Exchange Done *Mar 1 00:11:10.901: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done *Mar 1 00:12:20.234: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
Based on this output, what is the most likely problem?
Trap 1: The OSPF process is misconfigured with mismatched area IDs.
If area IDs mismatched, the neighbor would not reach FULL at all; the adjacency goes through all states, indicating correct area configuration.
Trap 2: The OSPF dead timer is set too high, causing slow convergence.
A high dead timer would make the neighbor take longer to go down, but the pattern shows quick transitions, suggesting a short timer or actual connectivity loss.
Trap 3: The router is running out of memory, causing OSPF process restarts.
There is no indication of memory issues; the OSPF process is running and forming adjacencies repeatedly.
- A
The OSPF process is misconfigured with mismatched area IDs.
Why wrong: If area IDs mismatched, the neighbor would not reach FULL at all; the adjacency goes through all states, indicating correct area configuration.
- B
There is a Layer 1 or Layer 2 issue causing intermittent connectivity on GigabitEthernet0/0.
The dead timer expiration indicates that hello packets are not received in time, which is often due to flapping interfaces or high error rates.
- C
The OSPF dead timer is set too high, causing slow convergence.
Why wrong: A high dead timer would make the neighbor take longer to go down, but the pattern shows quick transitions, suggesting a short timer or actual connectivity loss.
- D
The router is running out of memory, causing OSPF process restarts.
Why wrong: There is no indication of memory issues; the OSPF process is running and forming adjacencies repeatedly.
Question 13easymultiple choice
Review the full routing breakdown →A network engineer runs the following command on Router R5:
R5# show logging | include %LINEPROTO-5-UPDOWN *Mar 1 00:00:10.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:00:20.456: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down *Mar 1 00:00:30.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:00:40.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down *Mar 1 00:00:50.345: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up *Mar 1 00:01:00.678: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
Based on this output, what is the most likely problem?
Trap 1: The interface is administratively down.
The interface is going up and down, not administratively down; that would show a different message.
Trap 2: The interface is configured with a high bandwidth delay product.
Bandwidth delay product does not cause flapping.
Trap 3: The router is experiencing a high CPU load due to routing updates.
High CPU might cause slow processing but not line protocol flapping every 10 seconds.
- A
The interface is administratively down.
Why wrong: The interface is going up and down, not administratively down; that would show a different message.
- B
There is a physical layer issue causing the interface to flap.
Repeated line protocol up/down messages indicate a flapping interface, typically due to physical or Layer 2 issues.
- C
The interface is configured with a high bandwidth delay product.
Why wrong: Bandwidth delay product does not cause flapping.
- D
The router is experiencing a high CPU load due to routing updates.
Why wrong: High CPU might cause slow processing but not line protocol flapping every 10 seconds.
Question 14mediummultiple choice
Review the full OSPF breakdown →A network engineer is troubleshooting an OSPFv2 adjacency issue between two directly connected routers, R1 and R2, both running IOS-XE. The link is a point-to-point Ethernet link. The engineer issues 'show ip ospf neighbor' on R1 and sees no neighbors. 'show ip ospf interface GigabitEthernet0/0' on R1 shows 'Network Type BROADCAST', but the link is actually a point-to-point link. Both routers have 'ip ospf 1 area 0' configured on the interface. What is the most likely cause of the adjacency not forming?
Trap 1: The OSPF network type mismatch between the two routers (one is…
Both show BROADCAST, so no mismatch.
Trap 2: The interface is configured with 'ip ospf passive-interface'.
Passive interface would still allow the router to receive hellos but not send them, but the neighbor list would show the neighbor in INIT state, not absent.
Trap 3: The OSPF process is not enabled globally; 'router ospf 1' is…
If 'ip ospf 1 area 0' is configured on the interface, the process is automatically created if not already present.
- A
The OSPF network type mismatch between the two routers (one is BROADCAST, the other is POINT-TO-POINT).
Why wrong: Both show BROADCAST, so no mismatch.
- B
The routers have duplicate OSPF router IDs.
Duplicate router IDs prevent OSPF adjacency from forming; each router must have a unique router ID.
- C
The interface is configured with 'ip ospf passive-interface'.
Why wrong: Passive interface would still allow the router to receive hellos but not send them, but the neighbor list would show the neighbor in INIT state, not absent.
- D
The OSPF process is not enabled globally; 'router ospf 1' is missing.
Why wrong: If 'ip ospf 1 area 0' is configured on the interface, the process is automatically created if not already present.
Question 15hardmultiple choice
Review the full OSPF breakdown →A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers across a Frame Relay network. R1 and R2 are connected via a point-to-point subinterface. The engineer configures 'ip ospf network point-to-point' on both subinterfaces. However, the adjacency does not form. 'show ip ospf interface' on R1 shows the interface is up and OSPF is enabled, but no neighbors are seen. What is the most likely cause?
Trap 1: The OSPF network type is set to broadcast, causing a DR/BDR…
The engineer set it to point-to-point, so this is not the issue.
Trap 2: The subinterface is not configured with an IP address.
If there were no IP address, OSPF would not be enabled on the interface.
Trap 3: The OSPF hello and dead timers are mismatched between R1 and R2.
While timer mismatch can cause adjacency issues, it is less likely than a Layer 2 problem, and the stem does not indicate any timer configuration.
- A
The OSPF network type is set to broadcast, causing a DR/BDR election that fails on a point-to-point subinterface.
Why wrong: The engineer set it to point-to-point, so this is not the issue.
- B
The subinterface is not configured with an IP address.
Why wrong: If there were no IP address, OSPF would not be enabled on the interface.
- C
The Frame Relay map is missing or the DLCI is not assigned to the subinterface.
Without a proper DLCI mapping, the router cannot send Layer 2 frames to the neighbor, preventing OSPF hello packets from being exchanged.
- D
The OSPF hello and dead timers are mismatched between R1 and R2.
Why wrong: While timer mismatch can cause adjacency issues, it is less likely than a Layer 2 problem, and the stem does not indicate any timer configuration.
Question 16mediummultiple choice
Review the full OSPF breakdown →A network engineer is troubleshooting an OSPFv2 route flapping issue. The router R1 is learning a route to 192.168.1.0/24 via two different paths: one through R2 and one through R3. The route is flapping between the two paths every few seconds. 'show ip ospf interface' shows that both interfaces are stable. What is the most likely cause?
Trap 1: The route is being redistributed by both R2 and R3 with different…
Different metrics would cause the router to prefer one path, not flap.
Trap 2: The OSPF network type on the interfaces is set to broadcast,…
If the interfaces are stable, the DR/BDR election is stable.
Trap 3: The link between R1 and R2 has a high error rate causing…
The stem says the interfaces are stable, indicating no Layer 1 issues.
- A
The routers R2 and R3 have the same OSPF router ID.
Duplicate router IDs can cause OSPF to see the same route from two different neighbors as different, leading to route flapping.
- B
The route is being redistributed by both R2 and R3 with different metrics.
Why wrong: Different metrics would cause the router to prefer one path, not flap.
- C
The OSPF network type on the interfaces is set to broadcast, causing DR/BDR instability.
Why wrong: If the interfaces are stable, the DR/BDR election is stable.
- D
The link between R1 and R2 has a high error rate causing intermittent packet loss.
Why wrong: The stem says the interfaces are stable, indicating no Layer 1 issues.
Question 17mediummultiple choice
Review the full OSPF breakdown →A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?
Trap 1: The OSPF hello interval is mismatched between the two routers.
A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
Trap 2: The subinterfaces are in different VLANs, preventing Layer 2…
If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
Trap 3: The OSPF network type is set to point-to-point on one side and…
A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.
- A
The routers have the same OSPF router ID.
When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.
- B
The OSPF hello interval is mismatched between the two routers.
Why wrong: A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
- C
The subinterfaces are in different VLANs, preventing Layer 2 communication.
Why wrong: If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
- D
The OSPF network type is set to point-to-point on one side and broadcast on the other.
Why wrong: A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.
Free account
Track your progress over time
Create a free account to save your results and see which topics improve across sessions.
Focused Layer 3 Technologies sessions
Start a Layer 3 Technologies only practice session
Every question in these sessions is drawn from the Layer 3 Technologies domain — nothing else.
Related practice questions
Related 300-410 topic practice pages
Move into related areas when this topic feels solid.
Layer 3 Technologies practice questions
Practise 300-410 questions linked to Layer 3 Technologies.
EIGRP Troubleshooting practice questions
Practise 300-410 questions linked to EIGRP Troubleshooting.
OSPF Troubleshooting (v2/v3) practice questions
Practise 300-410 questions linked to OSPF Troubleshooting (v2/v3).
BGP Troubleshooting practice questions
Practise 300-410 questions linked to BGP Troubleshooting.
Route Redistribution practice questions
Practise 300-410 questions linked to Route Redistribution.
Policy-Based Routing (PBR) practice questions
Practise 300-410 questions linked to Policy-Based Routing (PBR).
VRF-Lite practice questions
Practise 300-410 questions linked to VRF-Lite.
Route Maps and Route Filtering practice questions
Practise 300-410 questions linked to Route Maps and Route Filtering.
Administrative Distance practice questions
Practise 300-410 questions linked to Administrative Distance.
Route Summarization practice questions
Practise 300-410 questions linked to Route Summarization.
Bidirectional Forwarding Detection (BFD) practice questions
Practise 300-410 questions linked to Bidirectional Forwarding Detection (BFD).
VPN Technologies practice questions
Practise 300-410 questions linked to VPN Technologies.
Frequently asked questions
- What does the 300-410 exam test about Layer 3 Technologies?
- Layer 3 Technologies questions test whether you can apply the concept in context, not just recognise a definition.
- How should I use these practice questions?
- Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
- Can I practise just Layer 3 Technologies questions in a focused session?
- Yes — the session launcher on this page draws every question from the Layer 3 Technologies domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
- Where can I practise other 300-410 topics?
- Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
- Are these real exam questions or dumps?
- These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.
Track your progress
A free account saves results across sessions and highlights which topics need work.
Sign up freeExam traps to avoid
- ▸Answering from memory before reading the full scenario.
- ▸Missing a constraint such as cost, availability, security, scope or command context.
- ▸Choosing a broad answer when the question asks for the most specific fix.
- ▸Ignoring why the wrong options are tempting.