How should I use these Troubleshooting practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Troubleshooting questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Troubleshooting domain.

300-410 · topic practice

Troubleshooting practice questions

Practise Cisco CCNP ENARSI 300-410 Troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Troubleshooting

Practice 10 questions Browse domain →

What the exam tests

What to know about Troubleshooting

Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Trap 1: The EIGRP router ID is not configured.

Incorrect because the neighbor relationship is established, indicating the router ID is valid.

Trap 2: The ACL is applied outbound, blocking the EIGRP updates from being…

Incorrect because the ACL is inbound, as stated.

Trap 3: The EIGRP for IPv6 is not enabled on the interface.

Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Study all Troubleshooting common traps →

A
The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.
Correct because EIGRP queries and replies are used to ensure route consistency and convergence; blocking them can prevent route installation.
B
The EIGRP router ID is not configured.
Why wrong: Incorrect because the neighbor relationship is established, indicating the router ID is valid.
C
The ACL is applied outbound, blocking the EIGRP updates from being sent.
Why wrong: Incorrect because the ACL is inbound, as stated.
D
The EIGRP for IPv6 is not enabled on the interface.
Why wrong: Incorrect because the neighbor relationship is established, meaning EIGRP is enabled.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full VPN explanation →

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

Trap 1: The spoke's 'ip nhrp shortcut' command is missing on the tunnel…

Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.

Trap 2: The spoke's routing table has a static route to the remote spoke's…

Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.

Trap 3: The hub's tunnel interface has 'no ip nhrp redirect' configured.

Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Study all Troubleshooting common traps →

A
The hub router does not have a route to the remote spoke's LAN subnet.
Correct because the hub must have a route to the destination subnet to send an NHRP redirect.
B
The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.
Why wrong: Incorrect because the engineer verified that 'ip nhrp shortcut' is enabled.
C
The spoke's routing table has a static route to the remote spoke's LAN via the hub.
Why wrong: Incorrect because a static route would not prevent shortcut creation; the redirect is still needed.
D
The hub's tunnel interface has 'no ip nhrp redirect' configured.
Why wrong: Incorrect because the engineer verified that 'ip nhrp redirect' is enabled.

Full breakdown with real-world context →

Question 3mediummultiple choice

Review the full OSPF breakdown →

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

Trap 1: The OSPF hello interval is mismatched between the two routers.

A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.

Trap 2: The subinterfaces are in different VLANs, preventing Layer 2…

If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.

Trap 3: The OSPF network type is set to point-to-point on one side and…

A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

Study all Troubleshooting common traps →

A
The routers have the same OSPF router ID.
When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.
B
The OSPF hello interval is mismatched between the two routers.
Why wrong: A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
C
The subinterfaces are in different VLANs, preventing Layer 2 communication.
Why wrong: If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
D
The OSPF network type is set to point-to-point on one side and broadcast on the other.
Why wrong: A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

Full breakdown with real-world context →

Question 4mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Trap 1: The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.

Trap 2: The router is running an older IOS version that does not support…

Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.

Trap 3: The 'ip policy route-map' command is applied to the outgoing…

Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

Study all Troubleshooting common traps →

A
The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.
Correct because if the ACL referenced in the route map does not exist, the route map will not match any traffic, and PBR will not be applied.
B
The 'set ip next-hop' command is misspelled as 'set ip nexthop'.
Why wrong: Incorrect because a misspelled command would cause a configuration error that the router would reject; the configuration would not be applied.
C
The router is running an older IOS version that does not support PBR.
Why wrong: Incorrect because PBR is supported in most IOS versions; the engineer would know if the router does not support it.
D
The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.
Why wrong: Incorrect because the scenario states the command is applied to interface GigabitEthernet0/0, which is the incoming interface.

Full breakdown with real-world context →

Question 5mediummultiple choice

Study the full AAA explanation →

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Trap 1: The TACACS+ server shared key is incorrect.

Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.

Trap 2: The username 'admin' does not exist on the TACACS+ server.

Incorrect because the test command would still receive a response from the server indicating authentication failure.

Trap 3: The TACACS+ server is not configured for the router's IP address.

Incorrect because the server would still respond with a reject if the client is not authorized.

Study all Troubleshooting common traps →

A
TCP port 49 is blocked between the router and the TACACS+ server.
Correct because TACACS+ uses TCP port 49; if blocked, the router cannot establish a connection to the server.
B
The TACACS+ server shared key is incorrect.
Why wrong: Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.
C
The username 'admin' does not exist on the TACACS+ server.
Why wrong: Incorrect because the test command would still receive a response from the server indicating authentication failure.
D
The TACACS+ server is not configured for the router's IP address.
Why wrong: Incorrect because the server would still respond with a reject if the client is not authorized.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full BGP breakdown →

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24

BGP routing table entry for 192.168.1.0/24, version 12 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch 1 65001

10.1.1.2 from 10.1.1.2 (10.1.1.2)

Origin IGP, metric 0, localpref 100, valid, external Refresh Epoch 2 65002

10.2.2.2 from 10.2.2.2 (10.2.2.2)

Origin IGP, metric 0, localpref 100, valid, external, best

What does this output indicate?

Trap 1: Both paths are equally preferred, and BGP load-balances traffic.

Only one path is marked as best; load-balancing requires multiple best paths.

Trap 2: The path from AS 65002 is best because it has a higher local…

Both paths have localpref 100, so local preference is equal.

Trap 3: The path from AS 65001 is best because it was received first.

The output shows the path from AS 65002 as best, not AS 65001.

Study all Troubleshooting common traps →

A
Both paths are equally preferred, and BGP load-balances traffic.
Why wrong: Only one path is marked as best; load-balancing requires multiple best paths.
B
The path from AS 65002 is best because it has a higher local preference.
Why wrong: Both paths have localpref 100, so local preference is equal.
C
The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.
When attributes are equal, BGP uses tie-breakers like lower router ID. The best path is from AS 65002.
D
The path from AS 65001 is best because it was received first.
Why wrong: The output shows the path from AS 65002 as best, not AS 65001.

Full breakdown with real-world context →

Question 7harddrag order

Study the full IPv6 explanation →

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8mediummulti select

Study the full ACL explanation →

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Trap 1: IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

IPv6 ACLs use prefix-length notation, not wildcard masks.

Trap 2: IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by…

There is no automatic permit; you must explicitly configure it.

Trap 3: IPv6 ACLs support the remark keyword for documentation.

The 'remark' keyword is not supported in classic IOS IPv6 ACLs (it is available in some IOS-XE versions, but not universally).

Study all Troubleshooting common traps →

A
IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.
Correct: The command is 'ipv6 traffic-filter' in interface configuration mode.
B
IPv6 ACLs use wildcard masks similar to IPv4 ACLs.
Why wrong: IPv6 ACLs use prefix-length notation, not wildcard masks.
C
The implicit deny at the end of an IPv6 ACL also blocks ICMPv6 neighbor discovery messages.
Correct: The implicit deny applies to all traffic, including ND; you must explicitly permit necessary ND messages.
D
IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.
Why wrong: There is no automatic permit; you must explicitly configure it.
E
IPv6 ACLs support the remark keyword for documentation.
Why wrong: The 'remark' keyword is not supported in classic IOS IPv6 ACLs (it is available in some IOS-XE versions, but not universally).

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full OSPF breakdown →

A network engineer is troubleshooting an OSPFv2 route flapping issue. The router R1 is learning a route to 192.168.1.0/24 via two different paths: one through R2 and one through R3. The route is flapping between the two paths every few seconds. 'show ip ospf interface' shows that both interfaces are stable. What is the most likely cause?

Trap 1: The route is being redistributed by both R2 and R3 with different…

Different metrics would cause the router to prefer one path, not flap.

Trap 2: The OSPF network type on the interfaces is set to broadcast,…

If the interfaces are stable, the DR/BDR election is stable.

Trap 3: The link between R1 and R2 has a high error rate causing…

The stem says the interfaces are stable, indicating no Layer 1 issues.

Study all Troubleshooting common traps →

A
The routers R2 and R3 have the same OSPF router ID.
Duplicate router IDs can cause OSPF to see the same route from two different neighbors as different, leading to route flapping.
B
The route is being redistributed by both R2 and R3 with different metrics.
Why wrong: Different metrics would cause the router to prefer one path, not flap.
C
The OSPF network type on the interfaces is set to broadcast, causing DR/BDR instability.
Why wrong: If the interfaces are stable, the DR/BDR election is stable.
D
The link between R1 and R2 has a high error rate causing intermittent packet loss.
Why wrong: The stem says the interfaces are stable, indicating no Layer 1 issues.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full VPN explanation →

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Trap 1: 'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

Incorrect. 'show crypto isakmp sa' is for IKEv1; for IKEv2 use 'show crypto ikev2 sa'.

Trap 2: The 'pkts encaps' counter in 'show crypto ipsec sa' increments on…

Incorrect. 'pkts encaps' increments on the outbound SA; inbound SA uses 'pkts decaps'.

Trap 3: 'show crypto map' displays the current packet count for each IPsec…

Incorrect. 'show crypto map' shows the crypto map configuration, not packet counters.

Study all Troubleshooting common traps →

A
'show crypto session' displays the IKEv2 SA status and the IPsec SA status.
Correct. This command shows both IKE and IPsec session information.
B
'show crypto ipsec sa' shows the number of packets that have been encrypted and decrypted.
Correct. The output includes 'pkts encaps' and 'pkts decaps' counters.
C
'show crypto isakmp sa' is the correct command to view IKEv2 SAs.
Why wrong: Incorrect. 'show crypto isakmp sa' is for IKEv1; for IKEv2 use 'show crypto ikev2 sa'.
D
The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.
Why wrong: Incorrect. 'pkts encaps' increments on the outbound SA; inbound SA uses 'pkts decaps'.
E
'show crypto map' displays the current packet count for each IPsec SA.
Why wrong: Incorrect. 'show crypto map' shows the crypto map configuration, not packet counters.

Full breakdown with real-world context →

Question 11mediummultiple choice

Open the full BGP breakdown →

A network engineer is troubleshooting a BGP route-map that is supposed to set a community value on routes from a specific neighbor. The engineer configures a route-map with 'set community 100:100' and applies it inbound to the neighbor. After the configuration, the engineer checks the BGP table on the local router and sees that the routes do not have the community set. What is the most likely cause?

Trap 1: The route-map is applied outbound instead of inbound.

Incorrect because the scenario says it is applied inbound.

Trap 2: The community value 100:100 is reserved and cannot be used.

Incorrect because 100:100 is a valid community value.

Trap 3: The route-map has a 'match community' statement that is filtering…

Incorrect because the scenario does not mention a match community statement.

Study all Troubleshooting common traps →

A
The neighbor is missing the 'send-community' command under the BGP neighbor configuration.
Correct because communities are not exchanged without this command.
B
The route-map is applied outbound instead of inbound.
Why wrong: Incorrect because the scenario says it is applied inbound.
C
The community value 100:100 is reserved and cannot be used.
Why wrong: Incorrect because 100:100 is a valid community value.
D
The route-map has a 'match community' statement that is filtering the routes before the set command.
Why wrong: Incorrect because the scenario does not mention a match community statement.

Full breakdown with real-world context →

Question 12mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13hardmultiple choice

Review the full OSPF breakdown →

An engineer is troubleshooting a network where R1 and R2 are running EIGRP, and R2 redistributes a static route for 192.168.1.0/24 into EIGRP. R1 also learns the same prefix via OSPF from R3 with an AD of 110. The engineer observes that R1 prefers the EIGRP external route (AD 170) over the OSPF route. What configuration change would cause this behavior?

Trap 1: The OSPF route is a type 5 LSA, which has a higher AD than type 3…

OSPF AD is 110 for all OSPF routes regardless of LSA type, unless modified.

Trap 2: The OSPF route has a metric of 20, while the EIGRP route has a…

Administrative distance is compared before metric; OSPF AD 110 is lower than EIGRP external AD 170, so metric is irrelevant unless ADs are equal.

Trap 3: The static route was redistributed with a route-map that sets the…

Changing the metric does not affect AD; the EIGRP external route still has AD 170, so OSPF would still be preferred.

Study all Troubleshooting common traps →

A
The OSPF route is a type 5 LSA, which has a higher AD than type 3 LSAs.
Why wrong: OSPF AD is 110 for all OSPF routes regardless of LSA type, unless modified.
B
The engineer applied the distance eigrp 90 100 command under EIGRP, lowering the AD for external routes to 100.
This sets the AD for EIGRP internal routes to 90 and external to 100, making the external route (AD 100) preferred over OSPF (AD 110).
C
The OSPF route has a metric of 20, while the EIGRP route has a metric of 2560.
Why wrong: Administrative distance is compared before metric; OSPF AD 110 is lower than EIGRP external AD 170, so metric is irrelevant unless ADs are equal.
D
The static route was redistributed with a route-map that sets the EIGRP metric to 1.
Why wrong: Changing the metric does not affect AD; the EIGRP external route still has AD 170, so OSPF would still be preferred.

Full breakdown with real-world context →

Question 14mediummultiple choice

Study the full IPv6 explanation →

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Trap 1: Enable DHCPv6 Guard to block DHCPv6 messages from the secondary…

Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.

Trap 2: Use IPv6 Source Guard to filter traffic from the secondary router.

Incorrect because IPv6 Source Guard filters data traffic, not RAs.

Trap 3: Configure the switch to act as a router and send its own RAs with a…

Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

Study all Troubleshooting common traps →

A
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
B
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why wrong: Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the secondary router.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not RAs.
D
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why wrong: Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full EIGRP explanation →

A network engineer is troubleshooting a route redistribution issue between two EIGRP processes. Router R1 runs EIGRP AS 100 and EIGRP AS 200, and redistributes routes between them. The engineer notices that routes from EIGRP AS 100 are not appearing in the EIGRP topology table of AS 200 on R1. The redistribute eigrp 100 command is configured under EIGRP AS 200. What is the most likely cause?

Trap 1: EIGRP AS 100 has a higher administrative distance than EIGRP AS 200.

Administrative distance is not relevant when redistributing between processes on the same router.

Trap 2: The redistribute eigrp 100 command under EIGRP AS 200 is missing…

The subnets keyword is not used in EIGRP redistribution.

Trap 3: EIGRP AS 200 has a route map that is filtering all routes.

While possible, the missing metric is a more common and likely cause.

Study all Troubleshooting common traps →

A
The redistribute eigrp 100 command under EIGRP AS 200 is missing the metric specification.
Correct: Without a metric, EIGRP does not accept redistributed routes.
B
EIGRP AS 100 has a higher administrative distance than EIGRP AS 200.
Why wrong: Administrative distance is not relevant when redistributing between processes on the same router.
C
The redistribute eigrp 100 command under EIGRP AS 200 is missing the subnets keyword.
Why wrong: The subnets keyword is not used in EIGRP redistribution.
D
EIGRP AS 200 has a route map that is filtering all routes.
Why wrong: While possible, the missing metric is a more common and likely cause.

Full breakdown with real-world context →

Question 16hardmulti select

Review the full routing breakdown →

Which TWO statements about the default administrative distances for different route sources are correct? (Choose TWO.)

Trap 1: The default administrative distance for internal BGP (iBGP) is 20.

Incorrect. The default AD for iBGP is 200. 20 is the default AD for external BGP (eBGP).

Trap 2: The default administrative distance for RIP is 100.

Incorrect. The default AD for RIP is 120, not 100.

Trap 3: The default administrative distance for OSPF is 90.

Incorrect. The default AD for OSPF is 110, not 90. 90 is for EIGRP internal routes.

Study all Troubleshooting common traps →

A
The default administrative distance for a connected interface is 0.
Correct. Connected routes have the highest trustworthiness with an AD of 0.
B
The default administrative distance for internal BGP (iBGP) is 20.
Why wrong: Incorrect. The default AD for iBGP is 200. 20 is the default AD for external BGP (eBGP).
C
The default administrative distance for external EIGRP routes is 170.
Correct. External EIGRP routes (redistributed) have a default AD of 170, which is higher than internal EIGRP (90).
D
The default administrative distance for RIP is 100.
Why wrong: Incorrect. The default AD for RIP is 120, not 100.
E
The default administrative distance for OSPF is 90.
Why wrong: Incorrect. The default AD for OSPF is 110, not 90. 90 is for EIGRP internal routes.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full network assurance explanation →

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

Trap 1: The 'logging on' command is missing from the configuration.

Incorrect because 'show logging' indicates syslog is enabled; if 'logging on' were missing, it would show 'logging disabled'.

Trap 2: The syslog server is using TCP, but the router is configured for…

Incorrect because by default, the router uses UDP; if the server expects TCP, the router would still send UDP packets, but the server would not receive them. However, the 'show logging' output would still show messages as sent (no drops), so this is less likely than a source-interface issue.

Trap 3: The logging buffer is full, preventing new messages from being…

Incorrect because the buffer being full does not stop the router from sending messages; it only affects local storage.

Study all Troubleshooting common traps →

A
The 'logging source-interface' is configured to an interface that is administratively down.
Correct because if the source interface is down, the router cannot use its IP address, and the syslog server may drop messages from an unexpected source IP or the packets may be routed incorrectly.
B
The 'logging on' command is missing from the configuration.
Why wrong: Incorrect because 'show logging' indicates syslog is enabled; if 'logging on' were missing, it would show 'logging disabled'.
C
The syslog server is using TCP, but the router is configured for UDP.
Why wrong: Incorrect because by default, the router uses UDP; if the server expects TCP, the router would still send UDP packets, but the server would not receive them. However, the 'show logging' output would still show messages as sent (no drops), so this is less likely than a source-interface issue.
D
The logging buffer is full, preventing new messages from being generated.
Why wrong: Incorrect because the buffer being full does not stop the router from sending messages; it only affects local storage.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting NAT for a VPN tunnel. The router has a static NAT rule 'ip nat inside source static 10.0.0.10 203.0.113.10' for a server. The VPN traffic from the remote site to 203.0.113.10 is being NATed to 10.0.0.10, but the return traffic from the server to the remote site is not being translated back. The engineer sees that the server sends packets with source 10.0.0.10 to the remote site's public IP. What should the engineer do to fix this?

Trap 1: Add an 'ip nat outside' command on the inside interface.

Incorrect because the inside interface should be 'ip nat inside'; adding outside would break the NAT logic.

Trap 2: Configure a route-map to exempt the VPN traffic from NAT.

Incorrect because the issue is that NAT is not translating the outbound traffic; exempting would make it worse.

Trap 3: Change the static NAT to 'ip nat inside source static 10.0.0.10…

Incorrect because 'extendable' allows multiple static NATs for the same inside host, but it does not fix the routing/interface issue.

Study all Troubleshooting common traps →

A
Add an 'ip nat outside' command on the inside interface.
Why wrong: Incorrect because the inside interface should be 'ip nat inside'; adding outside would break the NAT logic.
B
Configure a route-map to exempt the VPN traffic from NAT.
Why wrong: Incorrect because the issue is that NAT is not translating the outbound traffic; exempting would make it worse.
C
Ensure that the router has a route to the remote site's public IP via the outside interface, and that the static NAT entry is correctly applied.
Correct because if the return traffic from the server is routed out a different interface (e.g., a VPN tunnel interface), the NAT might not be applied; the router needs to route the traffic via the outside interface where NAT is configured.
D
Change the static NAT to 'ip nat inside source static 10.0.0.10 203.0.113.10 extendable'.
Why wrong: Incorrect because 'extendable' allows multiple static NATs for the same inside host, but it does not fix the routing/interface issue.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Trap 1: The logging buffer is full and needs to be cleared.

Incorrect because a full buffer does not disable syslog; it only prevents new messages from being stored locally.

Trap 2: The router has run out of memory to generate syslog messages.

Incorrect because memory exhaustion would cause other symptoms, and 'show logging' would not show 'disabled'.

Trap 3: The 'logging host' command is missing, so no destination is…

Incorrect because even without a remote host, local logging to buffer or console would still work if 'logging on' is enabled.

Study all Troubleshooting common traps →

A
The 'logging on' command is not configured.
Correct because 'logging on' globally enables syslog; without it, no messages are produced.
B
The logging buffer is full and needs to be cleared.
Why wrong: Incorrect because a full buffer does not disable syslog; it only prevents new messages from being stored locally.
C
The router has run out of memory to generate syslog messages.
Why wrong: Incorrect because memory exhaustion would cause other symptoms, and 'show logging' would not show 'disabled'.
D
The 'logging host' command is missing, so no destination is configured.
Why wrong: Incorrect because even without a remote host, local logging to buffer or console would still work if 'logging on' is enabled.

Full breakdown with real-world context →

Question 20mediummultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Trap 1: IPv6 Source Guard is blocking inter-host traffic because the hosts'…

Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.

Trap 2: RA Guard is blocking Neighbor Advertisements between hosts.

Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.

Trap 3: DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Study all Troubleshooting common traps →

A
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
B
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
C
RA Guard is blocking Neighbor Advertisements between hosts.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
D
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why wrong: Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Troubleshooting sessions

Start a Troubleshooting only practice session

Every question in these sessions is drawn from the Troubleshooting domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Troubleshooting questions →Mixed 300-410 session

Frequently asked questions

What does the 300-410 exam test about Troubleshooting?: Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Troubleshooting questions in a focused session?: Yes — the session launcher on this page draws every question from the Troubleshooting domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 300-410 topics?: Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.

Troubleshooting only

10 questions 20 questions 30 questions 50 questions

Mixed 300-410 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 300-410 questions Troubleshooting domain overview 300-410 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Troubleshooting practice questions

What to know about Troubleshooting

Common Troubleshooting exam traps

Troubleshooting questions

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Which TWO statements about the default administrative distances for different route sources are correct? (Choose TWO.)

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Track your progress over time

Start a Troubleshooting only practice session

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid