Policy-Based Routing (PBR) practice questions

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting a PBR configuration on a Cisco router. The engineer has configured a route map named 'PBR-MAP' with a match statement matching traffic from source IP 10.1.1.0/24 and a set statement to forward the traffic to next-hop 192.168.1.2. The engineer applies the route map to the incoming interface GigabitEthernet0/0 using 'ip policy route-map PBR-MAP'. However, traffic from 10.1.1.0/24 is still being forwarded using the routing table instead of the PBR next-hop. What is the most likely cause?

Trap 1: The 'set ip next-hop' command requires the 'verify-availability'…

Incorrect because 'verify-availability' is optional and not required for basic PBR operation.

Trap 2: The route map sequence number is missing; PBR requires sequence…

Incorrect because route maps can have implicit sequence numbers; missing explicit numbers do not prevent PBR.

Trap 3: The 'ip policy route-map' command must be applied globally under…

Incorrect because 'ip route-cache policy' is not a valid command; PBR is applied per interface.

A
The route map is applied to the outgoing interface instead of the incoming interface.
Correct because PBR must be applied to the incoming interface to intercept traffic before routing decision.
B
The 'set ip next-hop' command requires the 'verify-availability' keyword to activate PBR.
Why wrong: Incorrect because 'verify-availability' is optional and not required for basic PBR operation.
C
The route map sequence number is missing; PBR requires sequence numbers to be explicitly defined.
Why wrong: Incorrect because route maps can have implicit sequence numbers; missing explicit numbers do not prevent PBR.
D
The 'ip policy route-map' command must be applied globally under 'ip route-cache policy'.
Why wrong: Incorrect because 'ip route-cache policy' is not a valid command; PBR is applied per interface.

Open the full VLAN trunking answer →

Question 2mediummultiple choice

A network engineer is troubleshooting PBR on a Cisco router where traffic from VLAN 100 (192.168.10.0/24) should be forwarded to next-hop 10.10.10.2 via a route map named 'VLAN100-PBR'. The engineer has applied the route map to interface GigabitEthernet0/0.100 (subinterface) using 'ip policy route-map VLAN100-PBR'. The engineer verifies that the route map is correctly configured with 'match ip address 100' and 'set ip next-hop 10.10.10.2', and the access list 100 matches the source subnet. However, traffic from VLAN 100 is still forwarded using the routing table. What is the most likely cause?

Trap 1: The access list 100 is missing the 'permit' keyword; PBR only…

Incorrect because access lists default to deny, but if the ACL is missing 'permit', no traffic would match; however, the symptom is that traffic is forwarded normally (routing table), not dropped, indicating the ACL is likely correct.

Trap 2: The 'set ip next-hop' command must be followed by 'force' to…

Incorrect because 'force' is not a valid keyword for 'set ip next-hop' in PBR.

Trap 3: The route map must be applied to the VLAN interface (SVI) instead…

Incorrect because PBR can be applied to subinterfaces; the issue is not about the type of interface.

Study all Policy-Based Routing (PBR) common traps →

A
The traffic is arriving on the physical interface GigabitEthernet0/0 instead of the subinterface GigabitEthernet0/0.100.
Correct because PBR is applied per-interface; traffic must ingress the subinterface where the policy is configured.
B
The access list 100 is missing the 'permit' keyword; PBR only processes permit statements.
Why wrong: Incorrect because access lists default to deny, but if the ACL is missing 'permit', no traffic would match; however, the symptom is that traffic is forwarded normally (routing table), not dropped, indicating the ACL is likely correct.
C
The 'set ip next-hop' command must be followed by 'force' to override the routing table.
Why wrong: Incorrect because 'force' is not a valid keyword for 'set ip next-hop' in PBR.
D
The route map must be applied to the VLAN interface (SVI) instead of the subinterface.
Why wrong: Incorrect because PBR can be applied to subinterfaces; the issue is not about the type of interface.

Question 3hardmultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from source 10.1.2.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-TEST' is configured with 'match ip address 101' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for most traffic, but traffic from a specific host (10.1.2.100) is not being policy-routed. The engineer checks the ACL 101 and confirms it includes 10.1.2.0/24. What is the most likely cause?

Trap 1: The host 10.1.2.100 is sending traffic with a different source IP…

Incorrect because the ACL matches the subnet, so any host in that subnet should be matched; the symptom is specific to one host, but the ACL is correct.

Trap 2: The 'set ip next-hop' command requires the next-hop to be directly…

Incorrect because if the next-hop were unreachable, PBR would fall back to routing table for all traffic, not just one host.

Trap 3: The route map is missing a 'sequence 10' statement; PBR requires…

Incorrect because route maps can have implicit sequence numbers; missing explicit numbers do not cause selective failure.

A
The router is using CEF switching, and PBR is not applied to CEF-switched traffic without the 'ip route-cache policy' command.
Correct because by default, PBR only affects process-switched packets; CEF-switched packets ignore PBR unless 'ip route-cache policy' is enabled.
B
The host 10.1.2.100 is sending traffic with a different source IP than expected.
Why wrong: Incorrect because the ACL matches the subnet, so any host in that subnet should be matched; the symptom is specific to one host, but the ACL is correct.
C
The 'set ip next-hop' command requires the next-hop to be directly connected, and 192.168.1.2 is not reachable.
Why wrong: Incorrect because if the next-hop were unreachable, PBR would fall back to routing table for all traffic, not just one host.
D
The route map is missing a 'sequence 10' statement; PBR requires explicit sequence numbers.
Why wrong: Incorrect because route maps can have implicit sequence numbers; missing explicit numbers do not cause selective failure.

Question 4mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.1.0/24 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is applied to interface GigabitEthernet0/0. The engineer notices that the PBR policy is not working at all. The engineer checks the route map configuration and sees 'match ip address 110' and 'set ip next-hop 10.10.10.2'. The engineer also checks the ACL 110 and confirms it matches 172.16.1.0/24. The engineer then checks the interface configuration and sees 'ip policy route-map PBR-172' applied. What should the engineer do next to isolate the issue?

Trap 1: Add the 'set ip default next-hop' command to the route map.

Incorrect because 'set ip default next-hop' is used for default routing, not for PBR; it would not fix the issue.

Trap 2: Change the route map to use 'set interface' instead of 'set ip…

Incorrect because the issue is likely reachability, not the type of set command.

Trap 3: Apply the route map to the outgoing interface instead of the…

Incorrect because PBR must be applied to the incoming interface; applying to outgoing interface would not work.

A
Check if the next-hop 10.10.10.2 is reachable via the routing table.
Correct because PBR requires the next-hop to be reachable; if not, traffic uses the routing table.
B
Add the 'set ip default next-hop' command to the route map.
Why wrong: Incorrect because 'set ip default next-hop' is used for default routing, not for PBR; it would not fix the issue.
C
Change the route map to use 'set interface' instead of 'set ip next-hop'.
Why wrong: Incorrect because the issue is likely reachability, not the type of set command.
D
Apply the route map to the outgoing interface instead of the incoming interface.
Why wrong: Incorrect because PBR must be applied to the incoming interface; applying to outgoing interface would not work.

Review the full subnetting walkthrough →

Question 5mediummultiple choice

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.20.0/24 should be forwarded to next-hop 10.20.20.2. The route map 'PBR-20' is configured with 'match ip address 120' and 'set ip next-hop 10.20.20.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.20.0/24, but traffic from other subnets is also being forwarded to 10.20.20.2. What is the most likely cause?

Trap 1: The 'set ip next-hop' command is applied globally under the routing…

Incorrect because 'set ip next-hop' is a route-map command, not a global routing command.

Trap 2: The route map is applied to the wrong interface, but the interface…

Incorrect because if applied to the wrong interface, PBR would not work at all for the intended subnet.

Study all Policy-Based Routing (PBR) common traps →

A
The route map has a permit statement with no match condition, causing all traffic to be policy-routed.
Correct because a permit statement without a match condition matches all traffic, causing PBR to apply to all packets.
B
The 'set ip next-hop' command is applied globally under the routing process.
Why wrong: Incorrect because 'set ip next-hop' is a route-map command, not a global routing command.
C
The ACL 120 is configured with 'permit ip any any' at the end.
Correct because if the ACL has a 'permit ip any any' statement, it will match all traffic, causing PBR to apply to all packets.
D
The route map is applied to the wrong interface, but the interface is receiving traffic from all subnets.
Why wrong: Incorrect because if applied to the wrong interface, PBR would not work at all for the intended subnet.

Question 6hardmultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.10.10.0/24 should be forwarded to next-hop 192.168.100.2. The route map 'PBR-10' is configured with 'match ip address 130' and 'set ip next-hop 192.168.100.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is dropping packets instead of forwarding them. The engineer checks the ACL 130 and confirms it matches 10.10.10.0/24. What is the most likely cause?

Trap 1: The next-hop 192.168.100.2 is unreachable, and PBR drops packets…

Incorrect because by default, if the next-hop is unreachable, PBR falls back to the routing table; it does not drop packets.

Trap 2: The 'ip policy route-map' command is applied to the wrong…

Incorrect because if applied to the wrong interface, PBR would not be evaluated; dropping would be due to other ACLs, not PBR.

Trap 3: The ACL 130 is missing the 'permit' keyword, causing all traffic to…

Incorrect because if the ACL denies traffic, the route map would not match, and PBR would not apply; the router would use the routing table, not drop packets.

A
The route map has a deny statement that matches the traffic, causing packets to be dropped.
Correct because a deny statement in the route map will cause the router to drop the packet if no other permit statement matches.
B
The next-hop 192.168.100.2 is unreachable, and PBR drops packets when the next-hop is down.
Why wrong: Incorrect because by default, if the next-hop is unreachable, PBR falls back to the routing table; it does not drop packets.
C
The 'ip policy route-map' command is applied to the wrong interface, and the router is dropping packets due to ACL filtering.
Why wrong: Incorrect because if applied to the wrong interface, PBR would not be evaluated; dropping would be due to other ACLs, not PBR.
D
The ACL 130 is missing the 'permit' keyword, causing all traffic to be denied.
Why wrong: Incorrect because if the ACL denies traffic, the route map would not match, and PBR would not apply; the router would use the routing table, not drop packets.

Question 7hardmultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.0.0/16 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is configured with 'match ip address 140' and 'set ip next-hop 10.10.10.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 172.16.1.0/24 but not for traffic from 172.16.2.0/24. The engineer checks the ACL 140 and confirms it includes the entire 172.16.0.0/16 subnet. What is the most likely cause?

Trap 1: The next-hop 10.10.10.2 is not reachable from the 172.16.2.0/24…

Incorrect because reachability is not subnet-specific; if the next-hop is reachable, it is reachable from all subnets.

Trap 2: The 'ip policy route-map' command is applied to a subinterface that…

Incorrect because the scenario states the route map is applied to interface GigabitEthernet0/0, not a subinterface.

A
The route map has a sequence that matches 172.16.1.0/24 with a permit, and a later sequence that denies 172.16.2.0/24.
Correct because route maps are processed in sequence order; a later deny statement can override an earlier permit.
B
The ACL 140 has a deny statement for 172.16.2.0/24 before the permit statement.
Correct because ACLs are processed top-down; a deny statement before the permit will cause the traffic to be denied and not matched by the route map.
C
The next-hop 10.10.10.2 is not reachable from the 172.16.2.0/24 subnet.
Why wrong: Incorrect because reachability is not subnet-specific; if the next-hop is reachable, it is reachable from all subnets.
D
The 'ip policy route-map' command is applied to a subinterface that only receives traffic from 172.16.1.0/24.
Why wrong: Incorrect because the scenario states the route map is applied to interface GigabitEthernet0/0, not a subinterface.

Question 8mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Trap 1: The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.

Trap 2: The router is running an older IOS version that does not support…

Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.

Trap 3: The 'ip policy route-map' command is applied to the outgoing…

Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

A
The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.
Correct because if the ACL referenced in the route map does not exist, the route map will not match any traffic, and PBR will not be applied.
B
The 'set ip next-hop' command is misspelled as 'set ip nexthop'.
Why wrong: Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.
C
The router is running an older IOS version that does not support PBR.
Why wrong: Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.
D
The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.
Why wrong: Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

Question 9hardmultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.50.0/24 should be forwarded to next-hop 10.50.50.2. The route map 'PBR-50' is configured with 'match ip address 160' and 'set ip next-hop 10.50.50.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.50.0/24, but the router is also policy-routing traffic from other subnets that should not be affected. The engineer checks the ACL 160 and confirms it only matches 192.168.50.0/24. What is the most likely cause?

Trap 1: The 'ip policy route-map' command is applied to multiple…

Incorrect because the scenario states the route map is applied to interface GigabitEthernet0/0 only.

Trap 2: The router is using CEF switching, and PBR is applied to all…

Incorrect because CEF switching does not cause PBR to ignore ACLs; PBR still uses ACLs to match traffic.

A
The route map has a sequence with no match condition, which matches all traffic.
Correct because a route map sequence without a match condition will match all packets, causing PBR to apply to all traffic.
B
The ACL 160 has a 'permit ip any any' statement at the end.
Correct because if the ACL has a 'permit ip any any' statement, it will match all traffic, causing PBR to apply to all packets.
C
The 'ip policy route-map' command is applied to multiple interfaces, and traffic from other subnets is entering those interfaces.
Why wrong: Incorrect because the scenario states the route map is applied to interface GigabitEthernet0/0 only.
D
The router is using CEF switching, and PBR is applied to all traffic regardless of ACL.
Why wrong: Incorrect because CEF switching does not cause PBR to ignore ACLs; PBR still uses ACLs to match traffic.

Question 10mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer runs the following command on Router R1:

R1# show route-map

route-map PBR-ROUTE, permit, sequence 10 Match clauses:

ip address (access-lists): ACL-PBR

Set clauses:

ip next-hop 192.168.1.2

Policy routing matches: 0 packets, 0 bytes

route-map PBR-ROUTE, permit, sequence 20 Match clauses: Set clauses:

ip next-hop 192.168.2.2

Policy routing matches: 0 packets, 0 bytes

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-ROUTE

Based on this output, what is the most likely problem?

Trap 1: The route map is not applied to an interface.

The show ip policy output shows it is applied to GigabitEthernet0/0.

Trap 2: The next-hop 192.168.1.2 is unreachable.

Even if the next-hop is unreachable, packets would still be matched and counted; the issue is zero matches.

Trap 3: The route map is missing a permit statement.

The route map has permit statements; the problem is no traffic matching.

A
The route map is not applied to an interface.
Why wrong: The show ip policy output shows it is applied to GigabitEthernet0/0.
B
The access list ACL-PBR does not exist or matches no traffic.
Zero matches in sequence 10 suggest ACL-PBR is not matching any packets. Sequence 20 has no match clause and would match all, but its counter is also zero, indicating no traffic is being processed by PBR at all, likely because ACL-PBR is missing or incorrect.
C
The next-hop 192.168.1.2 is unreachable.
Why wrong: Even if the next-hop is unreachable, packets would still be matched and counted; the issue is zero matches.
D
The route map is missing a permit statement.
Why wrong: The route map has permit statements; the problem is no traffic matching.

Question 11mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/1 PBR-MAP

R1# show route-map PBR-MAP

route-map PBR-MAP, permit, sequence 10 Match clauses:

ip address (access-lists): 101

Set clauses:

ip next-hop verify-availability 10.1.1.2 10 track 1

Policy routing matches: 150 packets, 12000 bytes

R1# show track 1
Track 1
  IP SLA 1 reachability

Reachability is Down 1 change, last change 00:05:20 Latest operation return code: timeout

Tracked by:

ROUTE-MAP 0

Based on this output, what is the most likely outcome?

Trap 1: Packets matching ACL 101 are forwarded to 10.1.1.2 regardless.

The verify-availability feature checks the track object; since track 1 is down, the next-hop is not used.

Trap 2: Packets matching ACL 101 are dropped.

PBR does not drop packets when the set clause is not applied; they are forwarded using the routing table.

Trap 3: The route map is removed from the interface due to the track…

The route map remains applied; only the next-hop selection is affected.

A
Packets matching ACL 101 are forwarded to 10.1.1.2 regardless.
Why wrong: The verify-availability feature checks the track object; since track 1 is down, the next-hop is not used.
B
Packets matching ACL 101 are dropped.
Why wrong: PBR does not drop packets when the set clause is not applied; they are forwarded using the routing table.
C
Packets matching ACL 101 are routed normally via the routing table.
When the tracked object is down, PBR skips the set clause and the packet is forwarded using the destination-based routing table.
D
The route map is removed from the interface due to the track failure.
Why wrong: The route map remains applied; only the next-hop selection is affected.

Review the full OSPF breakdown →

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-TEST

R1# show route-map PBR-TEST

route-map PBR-TEST, permit, sequence 10 Match clauses:

ip address (access-lists): 110

Set clauses:

ip next-hop 192.168.100.1

Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 110

Extended IP access list 110

10 permit tcp 10.0.0.0 0.255.255.255 any eq 80
    
20 permit tcp 10.0.0.0 0.255.255.255 any eq 443

R1# show ip route 192.168.100.1

Routing entry for 192.168.100.1/32 Known via "ospf 1", distance 110, metric 20 Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely reason for zero policy routing matches?

Trap 1: The next-hop 192.168.100.1 is not reachable.

The show ip route output shows it is reachable via OSPF.

Trap 2: The route map sequence number is too high.

Sequence numbers do not affect matching; they just determine order.

Trap 3: The route map needs to be applied globally.

PBR is applied per interface; global application is not standard.

Study all Policy-Based Routing (PBR) common traps →

A
The next-hop 192.168.100.1 is not reachable.
Why wrong: The show ip route output shows it is reachable via OSPF.
B
The access list 110 is not matching any traffic arriving on GigabitEthernet0/0.
Zero matches indicate that no packets matching the ACL have been received on the interface where PBR is applied.
C
The route map sequence number is too high.
Why wrong: Sequence numbers do not affect matching; they just determine order.
D
The route map needs to be applied globally.
Why wrong: PBR is applied per interface; global application is not standard.

Study the full QoS explanation →

Question 13hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-QOS

R1# show route-map PBR-QOS

route-map PBR-QOS, permit, sequence 10 Match clauses:

ip address (access-lists): 120

Set clauses:

ip next-hop 10.0.0.2

Policy routing matches: 500 packets, 45000 bytes

R1# show access-lists 120

Extended IP access list 120

10 permit ip 192.168.1.0 0.0.0.255 any

R1# debug ip policy

Policy routing debugging is on

*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy match
*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy rejected

Based on this output, what is the most likely problem?

Trap 1: The access list 120 is misconfigured.

The debug shows a policy match, so the ACL is working.

Trap 2: The route map is applied to the wrong interface.

The debug shows packets arriving on GigabitEthernet0/0, which matches the interface where the route map is applied.

Trap 3: The route map sequence number is incorrect.

Sequence numbers are fine; the match occurs.

Study all Policy-Based Routing (PBR) common traps →

A
The next-hop 10.0.0.2 is unreachable.
The debug 'policy rejected' after a match typically means the set next-hop is not reachable, so the packet is not policy-routed.
B
The access list 120 is misconfigured.
Why wrong: The debug shows a policy match, so the ACL is working.
C
The route map is applied to the wrong interface.
Why wrong: The debug shows packets arriving on GigabitEthernet0/0, which matches the interface where the route map is applied.
D
The route map sequence number is incorrect.
Why wrong: Sequence numbers are fine; the match occurs.

Question 14mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-VOICE

R1# show route-map PBR-VOICE

route-map PBR-VOICE, permit, sequence 10 Match clauses:

ip address (access-lists): 130

Set clauses:

ip next-hop 192.168.10.1

Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 130

Extended IP access list 130

10 permit udp any any range 16384 32767

R1# show interfaces GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up Internet address is 10.1.1.1/24

R1# show ip route 192.168.10.1

% Network not in routing table

Based on this output, what is the most likely problem?

Trap 1: The access list 130 is not matching any traffic.

While possible, the missing route is a more direct problem.

Trap 2: The interface GigabitEthernet0/0 is down.

The show interfaces output shows it is up.

Trap 3: The route map is missing a permit statement.

The route map has a permit statement.

A
The access list 130 is not matching any traffic.
Why wrong: While possible, the missing route is a more direct problem.
B
The next-hop 192.168.10.1 is not reachable.
The show ip route output indicates the network is not in the routing table, so the next-hop is unreachable, causing PBR to fail to apply the set clause.
C
The interface GigabitEthernet0/0 is down.
Why wrong: The show interfaces output shows it is up.
D
The route map is missing a permit statement.
Why wrong: The route map has a permit statement.

Study the full EIGRP explanation →

Question 15hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-MULTI

R1# show route-map PBR-MULTI

route-map PBR-MULTI, permit, sequence 10 Match clauses:

ip address (access-lists): 140

Set clauses:

ip next-hop 10.0.0.2 10.0.0.3

Policy routing matches: 200 packets, 18000 bytes

R1# show ip route 10.0.0.2

Routing entry for 10.0.0.2/32 Known via "eigrp 1", distance 90, metric 28160 Last update from 192.168.1.2 on GigabitEthernet0/1

R1# show ip route 10.0.0.3

% Network not in routing table

Based on this output, what is the most likely behavior for packets matching ACL 140?

Trap 1: Packets are load-balanced between 10.0.0.2 and 10.0.0.3.

PBR does not load-balance across multiple next-hops; it uses the first reachable one.

Trap 2: Packets are dropped because one next-hop is unreachable.

PBR uses the first reachable next-hop; unreachable ones are skipped.

Trap 3: Packets are forwarded to 10.0.0.3 via a recursive lookup.

10.0.0.3 is not in the routing table, so it cannot be used.

Study all Policy-Based Routing (PBR) common traps →

A
Packets are load-balanced between 10.0.0.2 and 10.0.0.3.
Why wrong: PBR does not load-balance across multiple next-hops; it uses the first reachable one.
B
Packets are forwarded to 10.0.0.2.
Since 10.0.0.2 is reachable, PBR uses it. The unreachable 10.0.0.3 is ignored.
C
Packets are dropped because one next-hop is unreachable.
Why wrong: PBR uses the first reachable next-hop; unreachable ones are skipped.
D
Packets are forwarded to 10.0.0.3 via a recursive lookup.
Why wrong: 10.0.0.3 is not in the routing table, so it cannot be used.

Review the full OSPF breakdown →

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-DEFAULT

R1# show route-map PBR-DEFAULT

route-map PBR-DEFAULT, permit, sequence 10 Match clauses:

ip address (access-lists): 150

Set clauses:

ip next-hop 10.0.0.2

Policy routing matches: 0 packets, 0 bytes

route-map PBR-DEFAULT, deny, sequence 20 Match clauses: Set clauses: Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 150

Extended IP access list 150

10 permit ip 192.168.1.0 0.0.0.255 any

R1# show ip route 10.0.0.2

Routing entry for 10.0.0.2/32 Known via "ospf 1", distance 110, metric 20 Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely problem?

Trap 1: The deny sequence 20 is blocking all traffic from being…

Sequence 20 would only affect packets that reach it, but counters show zero matches, so no traffic reaches either sequence.

Trap 2: The next-hop 10.0.0.2 is unreachable.

It is reachable via OSPF.

Trap 3: The route map is missing a permit statement.

Sequence 10 is a permit; sequence 20 is deny, but the issue is no traffic.

Study all Policy-Based Routing (PBR) common traps →

A
The deny sequence 20 is blocking all traffic from being policy-routed.
Why wrong: Sequence 20 would only affect packets that reach it, but counters show zero matches, so no traffic reaches either sequence.
B
No traffic matching ACL 150 is arriving on GigabitEthernet0/0.
Zero matches on both sequences indicate no packets are being evaluated by the route map.
C
The next-hop 10.0.0.2 is unreachable.
Why wrong: It is reachable via OSPF.
D
The route map is missing a permit statement.
Why wrong: Sequence 10 is a permit; sequence 20 is deny, but the issue is no traffic.

Read the full NAT/PAT explanation →

Question 17mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-SET

R1# show route-map PBR-SET

route-map PBR-SET, permit, sequence 10 Match clauses:

ip address (access-lists): 160

Set clauses:

ip next-hop 192.168.1.2
    ip tos 184

Policy routing matches: 300 packets, 24000 bytes

R1# show access-lists 160

Extended IP access list 160

10 permit ip 10.0.0.0 0.255.255.255 any

R1# show interfaces GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up Internet address is 10.0.0.1/24

Based on this output, a packet from source 10.0.0.5 to destination 8.8.8.8 arrives on GigabitEthernet0/0. What is the most likely behavior?

Trap 1: The packet is forwarded using the routing table because the…

The next-hop is specified; the 300 matches indicate it is working.

Trap 2: The packet is dropped because the ToS value is invalid.

ToS 184 is a valid value (binary 10111000).

Trap 3: The packet is forwarded to 192.168.1.2 but the ToS is not changed.

The set clause includes ip tos, so ToS is changed.

Study all Policy-Based Routing (PBR) common traps →

A
The packet is forwarded using the routing table because the next-hop is not specified correctly.
Why wrong: The next-hop is specified; the 300 matches indicate it is working.
B
The packet is forwarded to 192.168.1.2 with the ToS field set to 184.
The route map matches the packet and sets both next-hop and ToS, so the packet is policy-routed with the new ToS value.
C
The packet is dropped because the ToS value is invalid.
Why wrong: ToS 184 is a valid value (binary 10111000).
D
The packet is forwarded to 192.168.1.2 but the ToS is not changed.
Why wrong: The set clause includes ip tos, so ToS is changed.

Study the full EIGRP explanation →

Question 18mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map

GigabitEthernet0/0 PBR-TRACK

R1# show route-map PBR-TRACK

route-map PBR-TRACK, permit, sequence 10 Match clauses:

ip address (access-lists): 170

Set clauses:

ip next-hop verify-availability 10.0.0.2 10 track 2

Policy routing matches: 100 packets, 8000 bytes

R1# show track 2
Track 2
  IP SLA 2 reachability

Reachability is Up 2 changes, last change 00:01:30 Latest operation return code: ok

Tracked by:

ROUTE-MAP 0

R1# show ip route 10.0.0.2

Routing entry for 10.0.0.2/32 Known via "eigrp 1", distance 90, metric 28160 Last update from 192.168.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely behavior for packets matching ACL 170?

Trap 1: Packets are forwarded using the routing table because the next-hop…

The next-hop is reachable and the track is Up.

Trap 2: Packets are dropped because the track object is not configured…

Track 2 is configured and Up.

Trap 3: Packets are load-balanced between the next-hop and the routing…

PBR does not load-balance with the routing table; it uses the next-hop if available.

Study all Policy-Based Routing (PBR) common traps →

A
Packets are forwarded to 10.0.0.2.
Since track 2 is Up, the next-hop is verified as available and used for policy routing.
B
Packets are forwarded using the routing table because the next-hop is not reachable.
Why wrong: The next-hop is reachable and the track is Up.
C
Packets are dropped because the track object is not configured correctly.
Why wrong: Track 2 is configured and Up.
D
Packets are load-balanced between the next-hop and the routing table.
Why wrong: PBR does not load-balance with the routing table; it uses the next-hop if available.

Question 19mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

Router R1 has the following configuration:

```

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT

! route-map PBR-OUT permit 10 match ip address 100 set ip next-hop 192.168.1.1 !

access-list 100 permit ip host 10.1.1.100 any

``` What is the effect of this configuration?

Trap 1: Packets transmitted out of GigabitEthernet0/1 to destination…

PBR is applied to incoming packets, not outgoing. The direction is inbound on the interface.

Trap 2: All packets from 10.1.1.100 are dropped because the route-map does…

The route-map has a permit statement, so matching packets are allowed and policy-routed.

Trap 3: The configuration is invalid because the ACL must match…

ACLs can match source or destination; matching source is valid for PBR.

A
Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.
The route-map is applied inbound, so packets arriving on this interface from 10.1.1.100 are policy-routed to 192.168.1.1.
B
Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.
Why wrong: PBR is applied to incoming packets, not outgoing. The direction is inbound on the interface.
C
All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.
Why wrong: The route-map has a permit statement, so matching packets are allowed and policy-routed.
D
The configuration is invalid because the ACL must match destination, not source.
Why wrong: ACLs can match source or destination; matching source is valid for PBR.

Question 20mediummultiple choice

Study all Policy-Based Routing (PBR) common traps →

Router R2 has the following configuration:

```

interface GigabitEthernet0/2
 ip address 10.2.2.2 255.255.255.0
 ip policy route-map CHECK

! route-map CHECK permit 10 match ip address 101 set interface GigabitEthernet0/3 !

access-list 101 permit tcp any any eq 80

``` What is the effect of this configuration?

Trap 1: Outgoing TCP packets with source port 80 on G0/2 are forwarded out…

PBR is applied inbound, and the ACL matches destination port 80, not source.

Trap 2: All TCP traffic is forwarded out G0/3 regardless of port.

The ACL specifically matches port 80, so only HTTP traffic is affected.

Trap 3: The configuration is invalid because 'set interface' cannot be used…

'set interface' is a valid PBR action.

A
Incoming TCP packets with destination port 80 on G0/2 are forwarded out G0/3, overriding the routing table.
PBR matches the ACL and sets the output interface, bypassing the routing table.
B
Outgoing TCP packets with source port 80 on G0/2 are forwarded out G0/3.
Why wrong: PBR is applied inbound, and the ACL matches destination port 80, not source.
C
All TCP traffic is forwarded out G0/3 regardless of port.
Why wrong: The ACL specifically matches port 80, so only HTTP traffic is affected.
D
The configuration is invalid because 'set interface' cannot be used with a route-map.
Why wrong: 'set interface' is a valid PBR action.