Courseiva

ENCOR 350-401 (350-401) — Questions 1–75

1958 questions total · 27pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 27

Page 2
1
Matchingmedium

Drag and drop each NFV management layer on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Lifecycle management of VNF instances (instantiate, scale, terminate)

Orchestration of network services across multiple VNFs and NFVI

Management of compute, storage, and network resources in NFVI

Service assurance, billing, and customer management layers interfacing with NFV

FCAPS management for individual VNFs

Why these pairings

VNFM manages individual VNFs; NFVO orchestrates network services; VIM controls NFVI resources.

Full explanation →
2
MCQmedium

Review this IP SLA configuration on Router R1: ip sla 6 icmp-echo 10.6.6.6 frequency 10 ip sla schedule 6 life forever start-time now ip sla reaction-configuration 6 react timeout threshold-type immediate action-type triggerOnly Which statement is true about the 'threshold-type immediate' parameter?

A.It triggers an event immediately when a timeout occurs.
B.It triggers an event after a delay of 10 seconds.
C.It triggers an event only if the timeout persists for 5 consecutive probes.
D.It triggers an event only if the timeout occurs within the first 10 seconds.
AnswerA

'immediate' triggers on the first occurrence of the condition.

Why this answer

The 'threshold-type immediate' parameter in an IP SLA reaction configuration causes the router to trigger the specified action (in this case, 'triggerOnly') as soon as a single probe timeout occurs, without waiting for any additional probes or a delay. This is correct because the configuration explicitly sets the threshold type to immediate, meaning the reaction is instantaneous upon detecting the timeout event.

Exam trap

Cisco often tests the distinction between 'immediate' and 'consecutive' threshold types, and the trap here is that candidates may confuse 'immediate' with a delayed or cumulative condition, assuming it requires multiple failures or a specific time window.

How to eliminate wrong answers

Option B is wrong because 'threshold-type immediate' does not introduce any delay; a delay would require a different threshold type, such as 'threshold-type x' with a specific time value. Option C is wrong because triggering only after 5 consecutive timeouts would require the 'threshold-type consecutive' parameter, not 'immediate'. Option D is wrong because the 'immediate' threshold is not limited to the first 10 seconds; it reacts to any timeout regardless of when it occurs within the probe's frequency interval.

Full explanation →
3
Multi-Selecthard

Which three statements about Cisco DNA Center integration with external systems are true? (Choose three.)

Select 3 answers
A.Cisco DNA Center provides a RESTful API that allows external applications to retrieve network inventory and topology data.
B.Cisco DNA Center can forward syslog messages to external SIEM systems for centralized logging and analysis.
C.Cisco DNA Center can synchronize IP address pools with external IPAM solutions such as Infoblox or SolarWinds.
D.Cisco DNA Center establishes BGP peering sessions with external routers to exchange routing information.
E.Cisco DNA Center only supports SNMP traps as the northbound interface for event notifications.
AnswersA, B, C

Correct because the DNA Center REST API is a primary northbound interface for integration with third-party tools and custom scripts.

Why this answer

DNA Center integrates with various systems for extended functionality. The correct answers cover REST API integration, syslog forwarding, and IPAM synchronization. The wrong answers incorrectly claim direct BGP peering for routing and that SNMP traps are the only northbound interface.

Full explanation →
4
MCQeasy

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

A.IS-IS
B.RIP
C.EIGRP
D.BGP
AnswerA

IS-IS is the preferred underlay routing protocol for SD-Access fabric.

Why this answer

IS-IS is the correct choice because it is a link-state routing protocol that provides fast convergence, is highly scalable, and is the most commonly recommended routing protocol for the underlay of an SD-Access fabric. Cisco SD-Access designs frequently use IS-IS to support the fabric's control plane and data plane requirements, leveraging its ability to handle large, flat network topologies with minimal overhead.

Exam trap

Cisco often tests the misconception that EIGRP is the best choice for fast convergence in Cisco-centric designs, but for SD-Access underlay, the recommended protocol is IS-IS due to its open standard nature and alignment with Cisco's validated fabric architecture.

How to eliminate wrong answers

Option B (RIP) is wrong because RIP is a distance-vector protocol with slow convergence, a maximum hop count of 15, and is not suitable for modern, scalable SD-Access underlays. Option C (EIGRP) is wrong because while EIGRP offers fast convergence, it is a Cisco proprietary protocol that is not recommended for SD-Access underlays; Cisco's validated designs for SD-Access specify IS-IS or OSPF for multi-vendor interoperability and fabric consistency. Option D (BGP) is wrong because BGP is a path-vector protocol designed for inter-domain routing and policy control, not for fast convergence in a single-domain underlay; it is used in SD-Access for the overlay (e.g., LISP/VXLAN) but not as the underlay routing protocol.

Full explanation →
5
MCQmedium

An engineer is configuring a new access switch for a branch office. The switch must support multiple VLANs for different departments: VLAN 10 (Engineering), VLAN 20 (Sales), and VLAN 30 (Management). The uplink to the distribution switch is a trunk. The engineer wants to ensure that only the required VLANs are allowed on the trunk and that the native VLAN is changed from the default to VLAN 99 for security reasons. Which configuration commands should the engineer apply on the access switch's uplink interface?

A.switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30
B.switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan except 10,20,30
C.switchport mode dynamic desirable; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30
D.switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 99
AnswerA

Correct because it sets the trunk, changes the native VLAN, and restricts allowed VLANs.

Why this answer

It explicitly sets the interface to trunk mode, changes the native VLAN from the default VLAN 1 to VLAN 99 for security, and uses the 'allowed vlan' command to permit only VLANs 10, 20, and 30 on the trunk. This ensures that only the required department VLANs are carried, reducing unnecessary broadcast traffic and preventing VLAN hopping attacks by changing the native VLAN.

Exam trap

Cisco often tests the distinction between 'allowed vlan' and 'allowed vlan except' — candidates may confuse the syntax and select the option that excludes the required VLANs instead of permitting them.

How to eliminate wrong answers

Option B is wrong because 'switchport trunk allowed vlan except 10,20,30' permits all VLANs except 10, 20, and 30, which is the opposite of the requirement. Option C is wrong because 'switchport mode dynamic desirable' uses DTP to negotiate trunking, which is less secure and not a deterministic trunk configuration; the requirement is for a static trunk. Option D is wrong because it omits the 'switchport trunk allowed vlan' command, so all VLANs would be permitted by default, failing to restrict the trunk to only the required VLANs.

Full explanation →
6
Multi-Selecthard

Which three statements about telemetry data collection intervals and on-change notifications are true? (Choose three.)

Select 3 answers
A.Periodic telemetry sends data at a configured interval regardless of whether the value has changed.
B.On-change telemetry sends data only when the monitored value changes, reducing network overhead.
C.A single telemetry subscription can include both periodic and on-change sensors.
D.On-change telemetry guarantees that every change, no matter how brief, will be reported.
E.Periodic telemetry is always preferred over on-change for all use cases.
AnswersA, B, C

Correct because periodic subscriptions push data on a timer, ensuring consistent updates.

Why this answer

Periodic telemetry sends data at fixed intervals, while on-change sends data only when a value changes. On-change reduces bandwidth but may miss transient events if suppression is used. Periodic ensures regular updates but increases load.

Both can be combined in a single subscription. On-change is not always supported for all YANG paths.

Full explanation →
7
Drag & Dropmedium

Drag and drop the steps of NAPALM get_facts() retrieval from IOS-XE device into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with importing the NAPALM library, then establishing a connection to the device, calling get_facts() to retrieve device facts, processing the returned dictionary, and finally closing the connection to free resources.

Full explanation →
8
MCQmedium

interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 mpls ip ! interface GigabitEthernet0/2 ip address 10.2.2.1 255.255.255.0 mpls ip ! router ospf 1 network 10.0.0.0 0.255.255.255 area 0 ! router ldp interface GigabitEthernet0/1 ! What is the effect of this configuration?

A.LDP will only form an adjacency over GigabitEthernet0/1; no label exchange occurs on GigabitEthernet0/2.
B.LDP will automatically enable on GigabitEthernet0/2 because MPLS is enabled there.
C.The configuration will fail because LDP must be enabled on all MPLS interfaces.
D.OSPF will automatically enable LDP on all interfaces in area 0.
AnswerA

Correct. LDP adjacencies are only formed on interfaces where LDP is explicitly enabled.

Why this answer

LDP is explicitly enabled only on GigabitEthernet0/1 under the 'router ldp' configuration. Although MPLS IP is enabled on GigabitEthernet0/2, LDP does not automatically form an adjacency or exchange labels on that interface unless it is explicitly configured under the LDP router process. LDP adjacencies are interface-specific and require the 'interface' command under 'router ldp' to be activated.

Exam trap

Cisco often tests the distinction between 'mpls ip' (which enables MPLS forwarding) and LDP configuration (which controls label distribution adjacencies), trapping candidates who assume that enabling MPLS on an interface automatically activates LDP.

How to eliminate wrong answers

Option B is wrong because enabling 'mpls ip' on an interface does not automatically enable LDP; LDP must be explicitly configured under 'router ldp' with the specific interface. Option C is wrong because the configuration will not fail; LDP can be selectively enabled on a subset of MPLS-enabled interfaces, and MPLS forwarding can still occur on other interfaces via static labels or other label distribution protocols. Option D is wrong because OSPF has no mechanism to automatically enable LDP; LDP is a separate protocol that must be configured independently, regardless of the IGP.

Full explanation →
9
MCQhard

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

A.The policy is not attached to the correct VPN or site list.
B.The voice traffic is using a different DSCP value than the one defined in the policy.
C.The MPLS link is not in the 'up' state in the vManage overlay.
D.The policy is configured as a local policy instead of a centralized policy.
AnswerA

Correct. In vManage, policies must be associated with specific VPNs or sites. If the policy is not attached to the VPN that carries voice traffic, it will not be applied.

Why this answer

The most likely cause is that the policy is not attached to the correct VPN or site list. In Cisco SD-WAN, a centralized data policy must be applied to a specific VPN (e.g., VPN 0 for transport, VPN 10 for service-side) and/or a site list to take effect. Even if the policy correctly sets the preferred color to 'mpls', it will not influence traffic forwarding unless it is properly associated with the VPN carrying the voice traffic and the site list containing the affected routers.

Exam trap

Cisco often tests the misconception that configuring a policy alone is sufficient, when in fact the policy must be attached to the correct VPN and site list to be activated—candidates overlook the attachment step and assume the policy is automatically applied to all traffic.

How to eliminate wrong answers

Option B is wrong because if the voice traffic uses a different DSCP value than the one defined in the policy, the policy would simply not match that traffic, but the question states the policy is configured to set the preferred color for voice traffic—implying the match condition is correct; the core issue is the policy not being applied. Option C is wrong because the MPLS link being 'up' in vManage is a prerequisite for the policy to work, but the engineer confirmed the MPLS link is up, so this is not the cause. Option D is wrong because a local policy (applied per device) would still affect traffic if attached correctly; the distinction between local and centralized policy affects scope and management, not the fundamental ability to steer traffic—the failure here is due to lack of attachment, not policy type.

Full explanation →
10
Drag & Dropmedium

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Full explanation →
11
MCQmedium

An enterprise is deploying a leaf-spine architecture in its data center to support high-bandwidth east-west traffic. The design must include QoS to prioritize storage replication traffic (iSCSI) over backup traffic, while ensuring low latency for real-time applications. Where should the architect apply QoS classification and queuing policies in this topology?

A.Apply classification and marking on the leaf switches at ingress, and queuing policies on egress interfaces of both leaf and spine switches.
B.Apply all QoS policies only on the spine switches, since they handle inter-leaf traffic.
C.Configure QoS only on the default gateway router, which is upstream of the leaf-spine fabric.
D.Use a single QoS policy on all interfaces with default settings, relying on hardware buffers.
AnswerA

Ingress classification at the leaf marks traffic; egress queuing on leaf and spine ensures consistent PHB across the fabric.

Why this answer

In a leaf-spine architecture, QoS classification and marking must occur at the ingress of leaf switches (where traffic enters the fabric) to identify iSCSI, backup, and real-time flows. Queuing policies must be applied on egress interfaces of both leaf and spine switches to manage congestion and prioritize latency-sensitive traffic across the entire path, ensuring end-to-end QoS for east-west traffic.

Exam trap

Cisco often tests the misconception that QoS policies should be applied only at the core or spine layer, but the correct approach requires classification at the edge (leaf ingress) and queuing on all egress interfaces to ensure end-to-end treatment across the fabric.

How to eliminate wrong answers

Option B is wrong because applying QoS only on spine switches ignores the need for classification at the network edge (leaf switches) and fails to manage congestion on leaf egress interfaces, where traffic first enters the fabric. Option C is wrong because the default gateway router is upstream of the leaf-spine fabric and does not handle inter-leaf east-west traffic; QoS must be applied within the fabric itself. Option D is wrong because relying on default settings and hardware buffers does not provide the granular classification, marking, and queuing required to differentiate iSCSI, backup, and real-time traffic, leading to potential packet loss and latency issues.

Full explanation →
12
Drag & Dropmedium

Drag and drop the steps of hierarchical LAN design implementation phases into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Hierarchical LAN design starts with the access layer for endpoint connectivity, then the distribution layer for policy and aggregation, followed by the core layer for high-speed transport. After physical design, VLANs and trunking are configured, and finally routing protocols are deployed for inter-VLAN communication.

Full explanation →
13
Multi-Selecthard

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

Select 2 answers
A.VXLAN encapsulation is used for data plane traffic within the fabric.
B.Control plane nodes host the LISP mapping database.
C.Wireless access points must be directly connected to the fabric edge switches.
D.Fabric edge nodes are responsible for connecting the fabric to external networks.
E.The fabric uses VLANs to isolate tenant traffic.
AnswersA, B

VXLAN is the encapsulation used to carry Layer 2 frames over Layer 3 fabric.

Why this answer

VXLAN is the encapsulation protocol used in the Cisco SD-Access fabric to carry data plane traffic between fabric edge nodes. VXLAN provides a Layer 2 overlay over a Layer 3 underlay, enabling scalable segmentation and mobility without VLAN limitations.

Exam trap

Cisco often tests the misconception that VLANs are used for fabric segmentation, but the correct answer is VXLAN VNIs; similarly, candidates may confuse the roles of fabric edge and border nodes, thinking edges handle external connectivity.

Full explanation →
14
Drag & Dropmedium

Drag and drop the steps of DHCP snooping and dynamic ARP inspection flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

DHCP snooping builds a binding table used by DAI. The switch validates DHCP messages, creates bindings, then intercepts ARP packets and compares them against the binding table to prevent spoofing.

Full explanation →
15
Matchingmedium

Drag and drop each CAPWAP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Manages AP configuration and keepalive

Carries user traffic between AP and controller

AP finds available controllers

AP associates with a controller

Controller pushes settings to AP

Why these pairings

Control messages manage the AP (e.g., configuration, keepalive); Data messages carry user traffic; Discovery messages find controllers; Join messages establish the AP-controller association; Configuration messages push settings to the AP.

Full explanation →
16
Drag & Dropmedium

Drag and drop the steps of configuring a local SPAN session on a Cisco IOS switch into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

Full explanation →
17
MCQhard

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

A.The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
B.The police rate is too low, and the traffic is being dropped due to exceeding the rate.
C.The DSCP value AF41 is not supported on Nexus switches.
D.The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.
AnswerA

Correct because if the conform-action is set to drop, all traffic in that class is dropped, even if it is within the police rate.

Why this answer

The CoPP policy's conform-action of drop explicitly instructs the switch to discard all packets that match the class-map, regardless of the traffic rate. Even though the traffic rate is only 5 Mbps (below the 10 Mbps police rate), the drop action overrides the policing logic, causing legitimate AF41 traffic to be dropped. This is a common misconfiguration where the engineer sets the action to 'drop' instead of 'transmit' for conforming traffic.

Exam trap

Cisco often tests the distinction between the police rate and the police action, trapping candidates who assume that a rate below the configured limit automatically allows traffic, without checking the conform-action parameter.

How to eliminate wrong answers

Option B is wrong because the traffic rate of 5 Mbps is below the configured police rate of 10 Mbps, so traffic should not be dropped due to exceeding the rate; the issue is the action, not the rate. Option C is wrong because DSCP AF41 (decimal value 34) is fully supported on Nexus 9000 switches as part of the standard DiffServ code point set defined in RFC 2474. Option D is wrong because CoPP policies are applied to the control-plane interface globally, not to a specific queue; queue-based dropping would involve QoS policies, not CoPP.

Full explanation →
18
Multi-Selecthard

Which three statements about IPsec VPNs are true? (Choose three.)

Select 3 answers
A.IPsec transport mode encrypts the entire original IP packet, including the IP header.
B.IKEv2 is more resilient to network changes than IKEv1 because it supports Dead Peer Detection (DPD) as a built-in feature.
C.AES is a symmetric encryption algorithm commonly used in IPsec to provide data confidentiality.
D.IKE uses TCP port 500 for key exchange and negotiation of security associations.
E.ESP in tunnel mode can provide both encryption and authentication for the entire IP packet.
AnswersB, C, E

Correct because IKEv2 includes DPD as a standard mechanism to detect peer liveness, whereas IKEv1 requires separate configuration.

Why this answer

IPsec VPNs can operate in transport mode (protecting payload only) or tunnel mode (protecting entire IP packet). IKEv2 is more robust than IKEv1, supporting EAP authentication and built-in DPD. AES is a symmetric encryption algorithm used for data confidentiality.

SHA is used for integrity, not encryption. IKE uses UDP port 500, not TCP. ESP can provide both encryption and authentication, but authentication is optional in some implementations.

Full explanation →
19
Matchingmedium

Drag and drop each Python data structure on the left to its matching network config use on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Storing key-value pairs for device configuration parameters

Ordered collection of configuration commands or interface names

Immutable sequence for storing device credentials

Unordered collection of unique VLAN IDs

Immutable set of allowed SNMP communities

Why these pairings

dict stores key-value config pairs like interface settings, list stores ordered config lines, tuple stores immutable device credentials, set stores unique VLAN IDs, and frozenset stores immutable sets of allowed protocols.

Full explanation →
20
MCQmedium

A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?

A.Configure Flexible NetFlow on the routers with a flow monitor that includes the 'drop' keyword to capture dropped packets per flow.
B.Enable SNMP polling of interface counters to identify the total number of dropped packets on the WAN interface.
C.Use Embedded Event Manager (EEM) to trigger on interface drops and capture a packet trace.
D.Deploy IP SLA probes to measure latency and jitter, and correlate with drop events.
AnswerA

Correct because Flexible NetFlow with the 'drop' keyword allows per-flow drop monitoring, directly identifying which flows are being dropped.

Why this answer

Flexible NetFlow with the 'drop' keyword allows the router to capture and report packets that are dropped due to various reasons (e.g., ACLs, QoS, or buffer exhaustion) on a per-flow basis. This provides granular visibility into which specific traffic flows are being dropped, enabling the engineer to identify the problematic traffic types without impacting production traffic.

Exam trap

Cisco often tests the distinction between aggregate drop counters (SNMP) and per-flow drop visibility (Flexible NetFlow), leading candidates to mistakenly choose SNMP polling because they think it provides sufficient detail to identify specific flows.

How to eliminate wrong answers

Option B is wrong because SNMP polling of interface counters only provides aggregate drop counts (e.g., 'in discards' or 'out discards') and cannot identify which specific flows or traffic types are being dropped. Option C is wrong because EEM can trigger on interface drop events, but it cannot capture a detailed per-flow breakdown of dropped packets; it would require additional scripting and still lacks the flow-level granularity that NetFlow provides. Option D is wrong because IP SLA probes measure latency, jitter, and packet loss for synthetic traffic, not for actual production flows; they cannot identify which specific traffic types are being dropped in the real data stream.

Full explanation →
21
Drag & Drophard

Drag and drop the steps of BGP best path selection process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

BGP best path selection follows a strict order: first, prefer the path with the highest weight (Cisco proprietary). If equal, prefer highest local preference. Next, prefer locally originated routes (network/aggregate).

Then, prefer the shortest AS_PATH. Finally, prefer the lowest MED (if same AS).

Full explanation →
22
Drag & Dropmedium

Drag and drop the steps of Rapid PVST+ topology change notification process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In Rapid PVST+, the correct order of the topology change notification process is: first, the switch sends a proposal message on its designated port (B). The neighbor receives the proposal and synchronizes port roles (C). Then the neighbor sends an agreement message back (D).

After agreement, the port transitions to forwarding (A). Finally, the switch propagates the topology change via the TC-while timer (E). This sequence ensures loop-free convergence.

Full explanation →
23
Multi-Selecteasy

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Select 2 answers
A.Enables Layer 2 extension across Layer 3 boundaries.
B.Eliminates the need for STP by using a centralized controller.
C.Uses only multicast for control plane learning.
D.Supports up to 16 million logical networks.
E.Provides native encryption for data in transit.
AnswersA, D

VXLAN tunnels Layer 2 over Layer 3.

Why this answer

VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Exam trap

Cisco often tests the misconception that VXLAN eliminates STP or provides native encryption, but VXLAN is an overlay technology that still relies on the underlay network's STP and does not include encryption by default.

Full explanation →
24
Multi-Selectmedium

Which two statements about Rapid PVST+ are true? (Choose two.)

Select 2 answers
A.Rapid PVST+ converges faster than classic STP because it uses synchronized handshakes between switches.
B.Rapid PVST+ uses a separate BPDU version for each VLAN to maintain per-VLAN spanning-tree instances.
C.In Rapid PVST+, an alternate port provides a backup path to the root bridge and is in a discarding state when the root port is operational.
D.Rapid PVST+ requires the use of UplinkFast and BackboneFast features to achieve sub-second convergence.
E.Rapid PVST+ supports only one spanning-tree instance per VLAN, but it can load-balance traffic across multiple VLANs.
AnswersA, E

Correct. Rapid PVST+ uses synchronized handshakes to achieve faster convergence.

Why this answer

Rapid PVST+ is the Cisco implementation of RSTP per VLAN. It converges faster than classic STP due to synchronized handshakes (A). It supports one spanning-tree instance per VLAN, allowing load balancing across multiple VLANs by configuring different root bridges for different VLANs (E).

Option C is incorrect because, while alternate ports provide a backup path to the root bridge, the statement about being in a discarding state when the root port is operational is overly simplistic; in RSTP, alternate ports are in discarding state by default, but this is a characteristic of all RSTP port roles, not a unique feature of alternate ports.

Full explanation →
25
Multi-Selecthard

Which THREE are valid methods for automating network device configuration using Cisco IOS XE? (Choose three.)

Select 3 answers
A.NETCONF/YANG
B.SNMP Set requests
C.Telnet with Expect scripts
D.CLI via SSH with Python (e.g., Netmiko)
E.RESTCONF
AnswersA, D, E

NETCONF is a standard protocol for configuration.

Why this answer

NETCONF/YANG is a valid method for automating network device configuration on Cisco IOS XE. NETCONF (RFC 6241) uses an XML-based RPC protocol to establish a secure SSH session (port 830) for configuration operations, while YANG (RFC 7950) provides a structured data model to define the configuration and state data. This combination allows for programmatic, transactional, and standardized configuration management, making it a core automation technology supported by Cisco.

Exam trap

Cisco often tests the distinction between monitoring protocols (SNMP) and configuration automation protocols (NETCONF/RESTCONF), and the trap here is that candidates mistakenly think SNMP Set requests are a valid configuration automation method, overlooking that SNMP is designed for read-heavy monitoring and lacks the transactional, model-driven capabilities of YANG-based protocols.

Full explanation →
26
MCQmedium

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

A.The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.
B.An ACL applied to the management interface is blocking ICMP from the monitoring server.
C.The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.
D.The switch's CPU is overloaded, causing CoPP to drop all packets.
AnswerA

Correct because CoPP polices traffic to the control plane; if the rate is too low, legitimate ICMP packets may be dropped.

Why this answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. CoPP (Control Plane Policing) protects the switch's CPU by rate-limiting control plane traffic, including ICMP. When the policer rate is set too low, even legitimate ICMP echo requests from the monitoring server are dropped, causing intermittent reachability issues.

Exam trap

The trap here is that candidates may assume CoPP drops are always due to CPU overload or a misconfigured ACL, but the key clue is the intermittent nature and the specific class-map match, pointing directly to an overly restrictive policer rate.

How to eliminate wrong answers

Option B is wrong because an ACL applied to the management interface would block ICMP consistently, not intermittently, and the CoPP statistics explicitly show drops from the policy, not ACL hits. Option C is wrong because ICMP packets with a TTL of 1 would be dropped by routers along the path, not by the destination switch's CoPP policy; the monitoring server typically sends TTL values of 64 or 128. Option D is wrong because an overloaded CPU would cause CoPP to drop all packets indiscriminately, but the scenario states only ICMP packets from the monitoring server are being dropped, indicating a specific rate-limit issue rather than general CPU exhaustion.

Full explanation →
27
MCQeasy

A network engineer runs the following command on Router R9: R9# show mpls ldp bindings 10.9.9.0 255.255.255.0 lib entry: 10.9.9.0/24, rev 10 local binding: label: 22 remote binding: lsr: 10.9.9.1:0, label: 23 remote binding: lsr: 10.9.9.2:0, label: 24 remote binding: lsr: 10.9.9.3:0, label: 25 Based on this output, how many remote LDP peers have advertised a label for the prefix 10.9.9.0/24?

A.1
B.2
C.3
D.4
AnswerC

Three remote LSRs are listed: 10.9.9.1:0, 10.9.9.2:0, and 10.9.9.3:0.

Why this answer

The output shows three remote bindings, each from a different LSR (10.9.9.1:0, 10.9.9.2:0, and 10.9.9.3:0), advertising a label for the prefix 10.9.9.0/24. The local binding (label 22) is not a remote peer, so only the three remote entries count. Therefore, the correct answer is 3.

Exam trap

The trap here is that candidates often mistakenly count the local binding as a remote peer, leading them to select 4 instead of 3, because they overlook the distinction between 'local binding' and 'remote binding' in the command output.

How to eliminate wrong answers

Option A is wrong because there are three remote bindings, not one; a single remote binding would show only one 'remote binding' line. Option B is wrong because two remote bindings would appear if only two LSRs were listed, but the output clearly shows three distinct LSRs. Option D is wrong because the local binding is not a remote peer, so counting it as a fourth remote peer is incorrect; only the three remote LSRs are valid.

Full explanation →
28
MCQmedium

Given this telemetry configuration on a Cisco IOS-XE device: telemetry ietf subscription 400 encoding encode-kvgpb filter xpath /interfaces/interface/state stream yang-push update-policy periodic 1000 receiver ip address 10.1.1.1 50000 protocol grpc source-interface Loopback0 What is the effect of the source-interface Loopback0 command?

A.It forces the telemetry receiver to listen on Loopback0.
B.It uses the IP address of Loopback0 as the source for telemetry packets to the receiver.
C.It restricts the telemetry data to only Loopback0 interface counters.
D.It changes the update policy to on-change for Loopback0.
AnswerB

This is the standard behavior of source-interface in telemetry configuration.

Why this answer

The source-interface command ensures that all telemetry packets sent to the receiver use the IP address of Loopback0 as the source.

Full explanation →
29
Drag & Dropmedium

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Full explanation →
30
Multi-Selecthard

Which two statements about DHCP snooping are true? (Choose two.)

Select 2 answers
A.DHCP snooping treats all ports as untrusted by default, except those explicitly configured as trusted.
B.The ip dhcp snooping trust command is applied on ports connected to DHCP clients.
C.DHCP snooping builds a binding database that maps client MAC addresses, IP addresses, VLAN, and port information.
D.DHCP snooping can be configured globally without enabling it on specific VLANs.
E.DHCP snooping drops all DHCP packets that contain option 82 information from untrusted ports.
AnswersA, C

Correct because DHCP snooping defaults all ports to untrusted to prevent rogue DHCP server attacks; only trusted ports (usually uplink to legitimate DHCP server) are configured.

Why this answer

This question tests detailed knowledge of DHCP snooping operation and configuration, including trusted/untrusted ports and option 82.

Full explanation →
31
MCQmedium

A network engineer runs the following command on Router R7: R7# show ip nat translations verbose Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static Based on this output, what can be concluded?

A.These translations will expire after a configurable timeout.
B.The translations are dynamic and will be removed after idle timeout.
C.The router is performing PAT for these addresses.
D.The translations are static and will remain until manually removed.
AnswerD

Static NAT entries with timeout 'never' persist indefinitely.

Why this answer

The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.

Exam trap

Cisco often tests the distinction between static and dynamic NAT by hiding the 'flags' field or using the 'timeout' value; candidates may incorrectly assume all NAT entries have a timeout or that the presence of 'use' timestamps implies dynamic behavior.

How to eliminate wrong answers

Option A is wrong because the timeout is set to 'never', meaning these translations will not expire after any configurable timeout. Option B is wrong because the flags field shows 'static', not 'dynamic', and dynamic translations would have an idle timeout and be removed automatically. Option C is wrong because there is no port information in the output (no 'Pro' protocol column with TCP/UDP and port numbers), which is required for PAT (Port Address Translation); this is a static one-to-one NAT.

Full explanation →
32
Matchingmedium

Drag and drop each WPA security version on the left to its matching authentication method on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

TKIP with PSK or 802.1X

CCMP (AES) with PSK or 802.1X

GCMP-256 with SAE or 802.1X

PSK

802.1X with GCMP-256

Why these pairings

WPA uses TKIP with PSK or 802.1X; WPA2 uses CCMP (AES) with PSK or 802.1X; WPA3 uses GCMP-256 with SAE or 802.1X; WPA2-Personal uses PSK; WPA3-Enterprise uses 802.1X with GCMP-256.

Full explanation →
33
Drag & Dropmedium

Drag and drop the steps of NAT overload (PAT) packet translation process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

PAT translates private source IPs to a public IP with unique port numbers. The host sends a packet, the router creates a translation entry, replaces the source IP and port, forwards the packet, and reverses the process on the return.

Full explanation →
34
Multi-Selectmedium

Which two statements about REST API HTTP methods are true? (Choose two.)

Select 2 answers
A.GET requests are idempotent and safe.
B.POST requests are idempotent and safe.
C.PUT requests are idempotent.
D.DELETE requests are safe.
E.PATCH requests are always idempotent.
AnswersA, C

Correct because GET is designed to retrieve data without modifying state, making it both idempotent and safe.

Why this answer

In REST APIs, the GET method is used to retrieve a representation of a resource without side effects (idempotent and safe). The PUT method is used to update or create a resource at a specific URI and is idempotent, meaning multiple identical requests have the same effect as a single request. POST is not idempotent; it is typically used to create a new resource at a server-defined URI.

DELETE is idempotent but not safe. PATCH is used for partial updates and is not necessarily idempotent.

Full explanation →
35
MCQeasy

What is the maximum number of active member links supported in a single EtherChannel on Cisco Catalyst switches?

A.4
B.8
C.16
D.32
AnswerB

Correct. Up to 8 active links are supported in a single EtherChannel.

Why this answer

Cisco Catalyst switches support a maximum of 8 active member links in a single EtherChannel. This limit is defined by the IEEE 802.3ad standard and Cisco's implementation, ensuring that the load-balancing algorithm distributes traffic effectively across all links. The 8-link limit applies to both PAgP and LACP modes.

Exam trap

Cisco often tests the distinction between the maximum number of configured ports (16 with LACP) versus the maximum number of active ports (8), leading candidates to mistakenly choose 16.

How to eliminate wrong answers

Option A is wrong because 4 is the maximum number of links supported in a port channel on some older or lower-end platforms, but not on modern Catalyst switches for a single EtherChannel. Option C is wrong because 16 is the maximum number of links that can be configured in an EtherChannel when using LACP in active/passive mode, but only 8 can be active at a time; the remaining 8 are placed in hot-standby state. Option D is wrong because 32 is not a supported limit for active member links in any standard EtherChannel implementation; it may be confused with the total number of ports in a switch stack or the maximum number of EtherChannels per switch.

Full explanation →
36
MCQeasy

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

A.The IPsec SA is using a weak encryption algorithm.
B.The IPsec SA is using ESP in tunnel mode with authentication only.
C.The traffic is taking multiple paths, causing packets to arrive out of order.
D.The IPsec SA lifetime is too short, causing frequent rekeying.
AnswerC

Correct. Anti-replay checks rely on sequence numbers. If packets arrive out of order, the receiver may drop them if they fall outside the anti-replay window.

Why this answer

The anti-replay check in IPsec uses sequence numbers to protect against replay attacks. When packets arrive out of order, the anti-replay window (default size 64 or 1024 packets) may reject packets that fall outside the window, causing the counter to increment. This is typical when traffic takes multiple paths, as packets can be reordered before reaching the peer.

Exam trap

Cisco often tests the anti-replay mechanism by linking it to packet reordering from asymmetric routing or multi-path forwarding, leading candidates to mistakenly blame rekeying or encryption settings instead of the actual cause of out-of-order delivery.

How to eliminate wrong answers

Option A is wrong because a weak encryption algorithm does not cause anti-replay failures; it affects confidentiality, not packet ordering. Option B is wrong because ESP in tunnel mode with authentication only (no encryption) still uses sequence numbers for anti-replay; the mode or encryption choice does not cause out-of-order delivery. Option D is wrong because a short IPsec SA lifetime causes frequent rekeying, which may drop traffic during rekey but does not increment the anti-replay failure counter; rekeying creates new SAs with fresh sequence numbers, not out-of-order packets.

Full explanation →
37
Matchingmedium

Drag and drop each congestion avoidance mechanism on the left to its matching method on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Drops all arriving packets when the queue is full

Drops packets probabilistically based on average queue depth before the queue is full

Drops packets probabilistically with different thresholds per IP precedence or DSCP value

Marks packets instead of dropping them when RED is enabled and endpoints support ECN

Drops packets based on a per-class drop threshold but still drops all when threshold exceeded

Why these pairings

Tail-drop drops all packets when queue is full; RED starts dropping packets probabilistically before queue full; WRED uses IP precedence or DSCP to vary drop probability per class.

Full explanation →
38
MCQhard

An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?

A.The IP SLA operation must be configured with a 'request-data-size' value to match the remote router's MTU.
B.The remote router must have an IP SLA responder configured to process the UDP jitter probes.
C.The source router needs a 'frequency' setting that matches the remote router's response interval.
D.The firewall on the remote router is blocking the UDP port 16384, preventing the probe from reaching the target.
AnswerB

Correct. For UDP jitter (and other UDP-based probes), the destination router must run the IP SLA responder to echo the packets back. Without it, the source cannot compute one-way metrics.

Why this answer

For UDP jitter IP SLA operations to collect jitter and latency statistics, the remote router must be configured as an IP SLA responder. The responder processes the probe packets and sends back time-stamped responses, which are essential for calculating jitter and one-way delay. Without the responder, the source router can send probes (showing 'Active' state) but cannot compute meaningful statistics because it never receives the required response packets.

Exam trap

Cisco often tests the misconception that simply sending probes (State: Active) is enough to collect statistics, when in fact the IP SLA responder is mandatory for UDP jitter and other advanced operations that require two-way time-stamped communication.

How to eliminate wrong answers

Option A is wrong because the 'request-data-size' parameter controls the payload size of the probe, but it does not affect whether the remote router responds; mismatched MTU would cause fragmentation or drops, not a lack of response. Option C is wrong because the 'frequency' setting on the source router defines how often probes are sent, and it does not need to match any interval on the remote router; the responder simply replies to each probe it receives. Option D is wrong because if a firewall were blocking UDP port 16384, the source router would likely see the operation as 'Timeout' or 'Inactive', not 'Active'; the 'Active' state indicates the source is successfully sending probes, but the lack of response points to the absence of a responder, not a firewall.

Full explanation →
39
Drag & Dropmedium

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

IKEv2 fragmentation occurs when the IKE packet exceeds the MTU. The sender fragments the packet, marks it with a fragment number, and sends all fragments. The receiver reassembles them.

DPD keepalives are sent periodically to verify the peer is still reachable; if no response is received, the peer is declared dead.

Full explanation →
40
Matchingmedium

Drag and drop each Ansible component on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Defines the list of managed hosts and groups

YAML file containing ordered tasks to execute

Structured directory for reusable variables, tasks, and handlers

Executable code that performs a specific configuration or operational task

Special task triggered only when notified by another task

Why these pairings

Each component has a distinct role: Inventory defines managed nodes, Playbook is the execution blueprint, Role organizes content, Module is the execution unit, and Handler reacts to changes.

Full explanation →
41
Matchingmedium

Drag and drop each DSCP PHB on the left to its matching queue treatment on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Expedited forwarding, strict priority queuing, low delay and jitter

Assured forwarding, four classes with three drop probabilities per class

Class selector, backward compatible with IP precedence, simple priority queuing

Best-effort, default queue, no guarantees

Default forwarding, same as best-effort (DSCP 0)

Why these pairings

EF PHB (DSCP 46) is for low-loss, low-latency traffic; AF PHBs (AF1x-AF4x) provide assured forwarding with four classes and three drop precedences; CS PHBs (CS1-CS7) are backward-compatible with IP precedence; BE (DSCP 0) is best-effort; DF (DSCP 0) is the default PHB.

Full explanation →
42
Drag & Dropmedium

Drag and drop the steps of NUMA-aware VM placement process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

NUMA-aware VM placement begins by inspecting the host's NUMA topology to understand node boundaries and memory topology (A). Next, the VM's vCPU count is compared to the node size to determine if it fits entirely within a single NUMA node (B). If it fits, the VM is assigned to a specific NUMA node (C).

Then, memory is allocated from that assigned NUMA node to ensure locality (D). Finally, the VM is powered on with NUMA pinning to enforce the placement (E). This order ensures resource awareness and proper allocation before pinning.

Full explanation →
43
Drag & Dropmedium

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

Full explanation →
44
MCQhard

A network engineer is troubleshooting a BGP issue where a router is not installing a specific prefix in its routing table, even though the prefix is present in the BGP table. The engineer runs 'show ip bgp 10.0.0.0/24' and sees that the route is valid but not best. The BGP table shows that the route has a higher local preference than the current best path, but the AS_PATH is longer. What is the most likely reason the route is not being selected as best?

A.The route with higher local preference has a lower weight than the current best path.
B.The route with higher local preference has a higher MED value.
C.The route with higher local preference is not synchronized with IGP.
D.The route with higher local preference was learned from an eBGP peer, while the current best path is from an iBGP peer.
AnswerA

Correct because weight is checked before local preference in BGP path selection; a higher weight on the current best path would make it preferred even if local preference is lower.

Why this answer

BGP selects the best path based on a sequence of comparison steps. Local preference is checked before AS_PATH length, so a higher local preference should normally win. However, weight is the very first criterion in the BGP best-path selection algorithm.

If the current best path has a higher weight than the route with higher local preference, weight overrides local preference, making the higher-local-preference route not best.

Exam trap

Cisco often tests the order of BGP best-path selection steps, specifically that weight is evaluated before local preference, leading candidates to incorrectly assume that a higher local preference always wins regardless of weight.

How to eliminate wrong answers

Option B is wrong because MED is compared only after the AS_PATH length and origin code, and it is not relevant when a higher local preference is present; the issue here is that weight, which is checked first, is higher on the current best path. Option C is wrong because BGP synchronization is a Cisco-specific feature that requires an IGP route for the next-hop before installing an iBGP route, but it does not affect the best-path selection process; the route is already in the BGP table as valid, and synchronization would prevent installation, not selection as best. Option D is wrong because eBGP routes are preferred over iBGP routes only if all earlier steps (weight, local preference, locally originated) are equal; here, local preference is higher on the candidate route, but weight is the first tiebreaker and is higher on the current best path, so the eBGP vs iBGP comparison never occurs.

Full explanation →
45
Matchingmedium

Drag and drop each HTTP method on the left to its matching REST operation on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Retrieve a resource

Create a new resource

Replace an existing resource entirely

Remove a resource

Apply partial modifications to a resource

Why these pairings

GET retrieves; POST creates; PUT replaces; DELETE removes; PATCH partially updates.

Full explanation →
46
MCQeasy

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows: { "response": [ { "deviceId": "1234567890", "hostname": "Core-Switch-1", "score": 8, "overallHealth": "good", "timestamp": 1623456789 } ], "version": "1.0" } The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

A.health = response['response'][0]['overallHealth']
B.health = response['overallHealth']
C.health = response['response']['overallHealth']
D.health = response[0]['overallHealth']
AnswerA

Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.

Why this answer

The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Full explanation →
47
Drag & Dropmedium

Drag and drop the steps of Q-in-Q (802.1ad) double-tagging configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Q-in-Q configuration requires first enabling the feature globally, then configuring the trunk port as a dot1q tunnel port, setting the native VLAN, and finally applying the service instance to encapsulate traffic. Verification ensures proper double-tagging.

Full explanation →
48
Matchingmedium

Drag and drop each trunk encapsulation type on the left to its matching standard or characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Open standard (IEEE); inserts 4-byte tag; supports native VLAN

Cisco proprietary; encapsulates entire frame; no native VLAN concept

VLAN 1 by default; frames sent untagged on trunk

Adds 26-byte header and 4-byte trailer

Contains 12-bit VLAN ID (0–4095)

Why these pairings

802.1Q is an open standard that inserts a 4-byte tag, supports native VLAN, and is the default on modern switches. ISL is Cisco proprietary, encapsulates the entire frame, and does not support native VLAN.

Full explanation →
49
Matchingmedium

Drag and drop each BGP attribute on the left to its preferred value (highest or lowest) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Highest

Highest

Lowest

Lowest

Lowest

Why these pairings

Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

Full explanation →
50
Drag & Dropmedium

Drag and drop the steps of RESTCONF GET with depth and field query parameters into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The process starts with constructing the URI, then appending depth and field parameters, sending the GET request, the server filtering the response, and finally the client parsing the returned data.

Full explanation →
51
MCQmedium

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

A.Local preference
B.AS path length
C.MED
D.Origin code
AnswerA

Correct. After weight, BGP compares local preference (higher is better).

Why this answer

When multiple BGP paths exist for the same prefix and the Weight attribute (Cisco proprietary, local to the router) is equal, the next tie-breaker in the BGP best path selection algorithm is the Local Preference (Local Pref). A higher Local Preference value is preferred, and this attribute is used to influence outbound traffic from an AS. Since the question states weight is equal, Local Preference becomes the first differentiator.

Exam trap

Cisco often tests the exact order of BGP path selection attributes, and the trap here is that candidates mistakenly think AS path length or MED is the first tie-breaker after weight, when in fact Local Preference is always compared second.

How to eliminate wrong answers

Option B is wrong because AS path length is the third tie-breaker in the BGP best path selection process, used only after comparing Weight and Local Preference. Option C is wrong because MED (Multi-Exit Discriminator) is a later tie-breaker (typically fifth) and is used to influence inbound traffic into an AS, not the first comparison after weight. Option D is wrong because Origin code is compared after AS path length and MED in the BGP decision process, making it a much later tie-breaker.

Full explanation →
52
MCQeasy

What is the default EIGRP hello interval on a point-to-point serial link?

A.5 seconds
B.10 seconds
C.30 seconds
D.60 seconds
AnswerA

Correct. The default hello interval for point-to-point serial links is 5 seconds.

Why this answer

The default EIGRP hello interval on a point-to-point serial link is 5 seconds. EIGRP uses different hello intervals depending on the media type: for high-speed broadcast links (e.g., Ethernet) and point-to-point links, the default is 5 seconds; for multipoint non-broadcast links (e.g., Frame Relay), the default is 60 seconds.

Exam trap

Cisco often tests the distinction between EIGRP and OSPF hello intervals, so the trap here is that candidates confuse the 10-second OSPF default with EIGRP's 5-second default on point-to-point links.

How to eliminate wrong answers

Option B (10 seconds) is wrong because 10 seconds is the default hello interval for OSPF on broadcast and point-to-point links, not for EIGRP. Option C (30 seconds) is wrong because 30 seconds is not a standard EIGRP hello interval; it is the default hold time multiplier factor (3x hello) on some links, but not the hello timer itself. Option D (60 seconds) is wrong because 60 seconds is the default EIGRP hello interval only on low-speed multipoint non-broadcast links (e.g., Frame Relay multipoint), not on point-to-point serial links.

Full explanation →
53
MCQmedium

An architect is designing an SD-WAN deployment for a multinational enterprise. The design must ensure that control plane traffic remains separate from data plane traffic and that the solution can scale to thousands of sites. Which architectural component is responsible for maintaining the control plane and distributing routing information?

A.vBond orchestrator
B.vManage NMS
C.vSmart controller
D.vEdge router
AnswerC

vSmart is the control plane element that distributes routes and policies.

Why this answer

The vSmart controller is the centralized control plane component in Cisco SD-WAN that distributes routing information (OMP routes) and policies to all vEdge/cEdge routers. It maintains the control plane by separating route advertisement and policy enforcement from the data plane, which is handled by the vEdge routers. This separation allows the solution to scale to thousands of sites because vSmart controllers can be clustered and do not process actual data traffic.

Exam trap

Cisco often tests the misconception that the vBond orchestrator handles control plane functions because of its role in initial authentication and orchestration, but vBond does not distribute routing information—that is exclusively the vSmart controller's role.

How to eliminate wrong answers

Option A is wrong because the vBond orchestrator is responsible for initial authentication, NAT traversal, and orchestrating connections between vSmart, vManage, and vEdge devices, not for maintaining the control plane or distributing routing information. Option B is wrong because vManage NMS is the network management system that provides centralized configuration, monitoring, and analytics, but it does not participate in the control plane or distribute routing updates. Option D is wrong because the vEdge router is a data plane device that forwards traffic based on routes learned from the vSmart controller; it does not originate or distribute routing information to other sites.

Full explanation →
54
MCQhard

A network engineer runs the following command on Router R9: R9# show policy-map interface GigabitEthernet0/0.900 GigabitEthernet0/0.900 Service-policy input: QOS_POLICY_VRF_G Class-map: CLASS_VOICE (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: CLASS_DATA (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) police: cir 2000000 bps, bc 62500 bytes, be 62500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Based on this output, what can be concluded?

A.No QoS policy is applied to this interface
B.The policy only polices voice traffic
C.A QoS policy is applied inbound on GigabitEthernet0/0.900, policing voice and data traffic
D.The policy is applied outbound
AnswerC

The policy is applied input, with classes for voice (DSCP EF) and data (DSCP AF31), each with police actions.

Why this answer

The output shows the 'Service-policy input: QOS_POLICY_VRF_G' line, confirming that a QoS policy is applied inbound on GigabitEthernet0/0.900. The policy contains two user-defined class maps: CLASS_VOICE (matching DSCP EF) with a police rate of 1 Mbps and CLASS_DATA (matching DSCP AF31) with a police rate of 2 Mbps, both with conform/transmit and exceed/violate drop actions. This demonstrates that both voice and data traffic are being policed, making option C correct.

Exam trap

Cisco often tests the ability to read the 'Service-policy input' or 'output' direction in the command output, as candidates may overlook the direction keyword and incorrectly assume the policy is applied outbound or not applied at all.

How to eliminate wrong answers

Option A is wrong because the 'Service-policy input: QOS_POLICY_VRF_G' line explicitly shows a QoS policy is applied inbound on the subinterface. Option B is wrong because the policy includes both CLASS_VOICE and CLASS_DATA class maps, each with policing actions, so it polices both voice and data traffic, not just voice. Option D is wrong because the command output specifies 'Service-policy input', indicating the policy is applied inbound, not outbound.

Full explanation →
55
MCQmedium

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

A.The IKEv2 proposal does not match between hub and spoke.
B.The certificate authority is not trusted by the hub.
C.The tunnel interface is not in an up/up state.
D.The loopback0 is not advertised in the routing protocol.
AnswerD

Correct because without a route, the spokes cannot reach the loopback.

Why this answer

The spokes can establish the IKEv2 tunnel and ping the hub's tunnel IP, confirming that the tunnel interface is up and the IKEv2 session is functional. However, the loopback0 address (10.0.0.1/32) is not reachable from the spokes because it is not advertised into the routing protocol (e.g., OSPF, EIGRP, or BGP) used over the FlexVPN tunnel. Without a route to the loopback0 prefix, the spokes' traffic to 10.0.0.1 is dropped by the hub's routing table, even though the tunnel is operational.

Exam trap

Cisco often tests the distinction between tunnel reachability (IKEv2 and tunnel interface up) and routing reachability (prefixes advertised over the tunnel), leading candidates to incorrectly focus on IKEv2 or certificate issues when the tunnel is already established.

How to eliminate wrong answers

Option A is wrong because the IKEv2 proposal mismatch would prevent the IKEv2 tunnel from establishing at all, yet the spokes can establish the tunnel and ping the hub's tunnel IP. Option B is wrong because if the certificate authority were not trusted by the hub, the IKEv2 authentication would fail during the certificate exchange, preventing tunnel establishment. Option C is wrong because the tunnel interface must be in an up/up state for the spokes to successfully ping the hub's tunnel IP, which is confirmed in the scenario.

Full explanation →
56
MCQmedium

Given the following SPAN configuration on a Cisco IOS-XE switch: monitor session 4 source interface GigabitEthernet1/0/6 tx monitor session 4 destination interface GigabitEthernet1/0/7 What does this configuration do?

A.Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
B.Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.
C.Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.
D.The configuration is invalid because the destination interface must be in the same VLAN as the source.
AnswerA

The 'tx' keyword specifies egress traffic only.

Why this answer

The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.

Exam trap

Cisco often tests the subtle difference between the default SPAN behavior (both ingress and egress) and the explicit 'tx' or 'rx' keywords, leading candidates to assume both directions are always monitored.

How to eliminate wrong answers

Option B is wrong because it assumes both ingress and egress traffic are copied, but the 'tx' keyword explicitly restricts monitoring to transmitted traffic only. Option C is wrong because it reverses the source and destination roles; the configuration copies traffic from GigabitEthernet1/0/6 to GigabitEthernet1/0/7, not the other way around. Option D is wrong because there is no requirement for the source and destination interfaces to be in the same VLAN; SPAN can copy traffic across VLANs, and the destination interface is typically placed in a separate monitoring VLAN or left in its default VLAN.

Full explanation →
57
MCQmedium

Consider the following configuration snippet: ``` interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/2 ip address 203.0.113.1 255.255.255.0 ip nat outside ! ip nat inside source list 1 interface GigabitEthernet0/2 overload access-list 1 permit 192.168.1.0 0.0.0.255 ``` What is the effect of this configuration?

A.It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.
B.It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.
C.It translates only traffic from 192.168.1.1 to the outside interface IP.
D.The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.
AnswerA

Correct. The 'overload' keyword enables PAT, and the interface IP is used as the translated address.

Why this answer

This configuration implements dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The access list matches the 192.168.1.0/24 source network, and the 'ip nat inside source list 1 interface GigabitEthernet0/2 overload' command translates all matching inside local addresses to the single outside interface IP (203.0.113.1) using unique port numbers to differentiate sessions. This allows multiple internal hosts to share the public IP simultaneously.

Exam trap

Cisco often tests the distinction between dynamic NAT (with or without overload) and static NAT, and the trap here is that candidates may think 'overload' implies static mapping or that the access list only applies to the first host, when in fact it applies to the entire subnet and enables PAT.

How to eliminate wrong answers

Option B is wrong because static NAT would require individual 'ip nat inside source static' commands for each host, and the configuration uses a dynamic access list with overload, not a one-to-one mapping to unique IPs. Option C is wrong because the access list permits the entire 192.168.1.0/24 subnet, not just host 192.168.1.1, so all hosts in that subnet are translated. Option D is wrong because the interfaces are correctly configured: GigabitEthernet0/1 is the inside network (private) and GigabitEthernet0/2 is the outside network (public), which is the standard placement for NAT.

Full explanation →
58
Multi-Selecthard

Which three statements about the benefits and challenges of NFV are true? (Choose three.)

Select 3 answers
A.NFV reduces capital expenditure by allowing network functions to run on standard, off-the-shelf hardware.
B.NFV enables faster time-to-market for new services by decoupling software from hardware.
C.One challenge of NFV is the potential performance overhead introduced by the virtualization layer.
D.NFV reduces the overall security attack surface by consolidating multiple functions into a single physical device.
E.NFV eliminates the need for physical cabling in the data center.
AnswersA, B, C

Correct because NFV replaces proprietary appliances with software on commodity servers, lowering hardware costs.

Why this answer

NFV offers reduced hardware costs, faster service deployment, and operational agility. However, it introduces challenges such as performance overhead from virtualization and increased complexity in management. Option A is correct because NFV reduces CAPEX by using commodity hardware.

Option B is correct because NFV enables rapid deployment of new services. Option C is correct because virtualization can introduce latency and throughput overhead. Option D is incorrect because NFV typically increases, not decreases, the attack surface.

Option E is incorrect because NFV does not eliminate the need for physical cabling; it only virtualizes network functions.

Full explanation →
59
MCQmedium

A network engineer is automating the deployment of VLAN configurations on a set of Cisco IOS-XE switches using Ansible. The playbook uses the ios_vlans module and runs successfully on the first switch, but fails on the second switch with an error indicating that the module is not found. Both switches are running the same IOS-XE version and have the same management access configured. What is the most likely cause of this issue?

A.The second switch does not have the ios_vlans module installed locally.
B.The cisco.ios collection is not installed on the Ansible control node.
C.The second switch has a different SSH key that is not accepted by the Ansible control node.
D.The playbook uses a fully qualified collection name (FQCN) incorrectly.
AnswerB

If the cisco.ios collection is missing, the ios_vlans module will not be found, generating the error. This is the most likely cause.

Why this answer

Ansible modules are not installed on network devices; they are executed from the control node. The 'module not found' error indicates the required module is missing on the control node, not on the switch. For Cisco IOS-XE devices, the ios_vlans module is part of the cisco.ios collection, which must be installed on the Ansible control node.

The first switch might have succeeded due to a cached module from a previous execution or a different playbook, but the root cause is a missing collection on the control node.

Exam trap

Cisco exams often test the misconception that Ansible modules are installed on network devices. Candidates may mistakenly choose an option suggesting the module is missing on the device itself, but in reality, modules run from the Ansible control node.

How to eliminate wrong answers

Option A is wrong because the ios_vlans module is not installed on the switch; it is a Python-based module executed on the Ansible control node, not on the network device. Option C is wrong because an SSH key mismatch would cause an authentication or connection failure, not a 'module not found' error, which is a control-node-side issue. Option D is wrong because an incorrect FQCN would cause a syntax or import error consistently across all hosts, not a failure that occurs only on the second switch.

Full explanation →
60
MCQmedium

A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between two Cisco routers. The tunnel is established and IKEv2 Phase 1 is up, but no traffic passes. The engineer checks the crypto map and sees that the ACL is configured to permit traffic between the two LAN subnets. However, 'show crypto ipsec sa' shows that the number of packets encapsulated and decapsulated is zero. What is the most likely cause?

A.The crypto map is not applied to the correct interface.
B.The IPsec transform set uses ESP with SHA-1, but the remote router expects AES-GCM.
C.The ACL on the crypto map is missing the 'permit ip' statement for the return traffic.
D.The tunnel interface is down due to a routing issue.
AnswerB

Correct. A mismatch in the transform set (e.g., encryption or authentication algorithms) will prevent Phase 2 from establishing, even though Phase 1 (which uses a different proposal) may succeed.

Why this answer

The IPsec transform set mismatch between ESP with SHA-1 and AES-GCM will cause Phase 2 to fail or produce non-functional SAs. Even though IKEv2 Phase 1 is up, the IPsec SAs (shown in 'show crypto ipsec sa') will have zero packet encapsulation/decapsulation because the two peers cannot agree on the encryption and authentication algorithms for the data plane. This mismatch prevents any traffic from being encrypted and sent across the tunnel.

Exam trap

Cisco often tests the misconception that a successful IKE Phase 1 means the entire VPN is functional, but in reality, Phase 2 (IPsec SA) can fail due to transform set mismatches, leaving the tunnel up but unable to pass traffic.

How to eliminate wrong answers

Option A is wrong because if the crypto map were not applied to the correct interface, the tunnel would not establish at all, and 'show crypto ipsec sa' would show no SAs. Option B is the correct answer as explained. Option C is wrong because the ACL on the crypto map only needs to match the traffic that should be encrypted; return traffic is handled by the reverse ACL entry automatically in the IPsec SA (the peer's ACL mirrors the local ACL).

Option D is wrong because a routing issue would prevent the tunnel from establishing Phase 1, or would cause the tunnel interface to be down, but the question states the tunnel is established and Phase 1 is up.

Full explanation →
61
MCQmedium

A network engineer is deploying IP multicast in an OSPF-based enterprise network. The network uses PIM sparse mode with a static RP. The engineer notices that multicast traffic from a source to a group is not reaching receivers in a remote subnet, even though the RP is reachable and the receivers have sent IGMP joins. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry is present, but the outgoing interface list (OIL) is empty. What is the most likely reason for the empty OIL?

A.The RP is not configured on the last-hop router.
B.The multicast source is not registered with the RP.
C.PIM dense mode is enabled on the last-hop router.
D.The TTL of the multicast packets is too low.
AnswerA

Correct because without the RP configured, the router cannot send a PIM join to the RP, so the OIL remains empty.

Why this answer

In PIM sparse mode, the last-hop router must have the RP address configured (either statically or via Auto-RP/BSR) to send PIM join messages toward the RP for the multicast group. Without the RP configured, the router cannot initiate the shared tree join, so even though the (S,G) entry exists (learned via IGMP or data-driven events), the outgoing interface list (OIL) remains empty because the router has no path to forward traffic downstream. The fact that the RP is reachable does not substitute for the explicit RP configuration on the last-hop router.

Exam trap

Cisco often tests the misconception that RP reachability is enough for multicast forwarding, when in fact each router must have the RP explicitly configured to participate in PIM sparse mode shared tree building.

How to eliminate wrong answers

Option B is wrong because the source registration with the RP (via PIM register messages) is a first-hop router function; the last-hop router's empty OIL is unrelated to whether the source has registered. Option C is wrong because PIM dense mode would populate the OIL with all downstream interfaces (flood-and-prune), not leave it empty; the scenario explicitly states PIM sparse mode is used. Option D is wrong because a low TTL would cause packets to be dropped before reaching the last-hop router, not result in an empty OIL on an existing (S,G) entry; the OIL emptiness is a control-plane issue, not a data-plane TTL issue.

Full explanation →
62
Matchingmedium

Drag and drop each OSPF packet type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Discovers neighbors and maintains adjacency state

Contains a list of LSA headers for database synchronization

Requests specific LSAs from a neighbor

Sends one or more complete LSAs to a neighbor

Confirms receipt of LSU packets

Why these pairings

Hello packets discover and maintain neighbor relationships; DBD packets contain a summary of the LSDB; LSR packets request specific LSAs; LSU packets send full LSAs in response to LSRs; LSAck packets acknowledge receipt of LSUs.

Full explanation →
63
Drag & Dropmedium

Drag and drop the steps of stateless DHCPv6 address assignment steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Stateless DHCPv6 uses SLAAC for the address and DHCPv6 for additional parameters. The host first sends an RS to discover routers. The router replies with an RA containing the prefix and flags indicating stateless DHCPv6.

The host generates its own IPv6 address using SLAAC. It then sends an Information-Request to the DHCPv6 server. The server replies with options like DNS and domain name.

Full explanation →
64
Drag & Dropmedium

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, you define the prefix-list to match specific routes. Then you create the route-map with the suppress clause. Next, you configure the aggregate-address command referencing the route-map.

After that, you verify the aggregated route in the BGP table. Finally, you check that more specific routes are suppressed.

Full explanation →
65
MCQhard

An engineer is writing a Python script to use the Cisco DNA Center API to assign a device to a site. The code snippet is: import requests url = "https://dna-center.local/dna/intent/api/v1/network-device/assign" headers = { "X-Auth-Token": "token", "Content-Type": "application/json" } payload = { "deviceId": "device-uuid", "siteId": "site-uuid" } response = requests.post(url, headers=headers, json=payload, verify=False) print(response.status_code) What is a potential issue with this code?

A.The HTTP method should be PUT instead of POST for assigning a device to a site.
B.The payload should include 'deviceId' and 'siteId' as a list.
C.The URL is missing the version number.
D.The code should use requests.put instead of requests.post.
AnswerD

Correct. The code uses requests.post, but the API requires PUT, so the code should use requests.put instead.

Why this answer

The Cisco DNA Center API endpoint for assigning a device to a site requires the PUT HTTP method. In the code, the requests.post method is used incorrectly; the correct method is requests.put. Option D directly identifies this code-level fix, while option A is also conceptually correct but less specific to the code.

Since this is a single-answer question, D is the best choice as it directly addresses the code snippet.

Full explanation →
66
MCQeasy

An engineer is using the Cisco DNA Center GUI to create a new site hierarchy. They add a building under an existing area. After saving, they run a Python script to verify the site via API: import requests url = "https://dna-center.local/dna/intent/api/v1/site" headers = {"X-Auth-Token": "token"} response = requests.get(url, headers=headers, verify=False) sites = response.json()['response'] for site in sites: if site['name'] == 'Building-A': print(site['id']) What is the output if the building was created successfully?

A.A UUID string such as '123e4567-e89b-12d3-a456-426614174000'
B.The script will print 'Building-A'
C.The script will print the entire site dictionary
D.The script will raise an error because the API returns paginated results
AnswerA

Correct. The API returns a UUID for each site, and the script prints it.

Why this answer

The script prints the site ID of the building if it exists. The output will be a string representing the UUID of the building.

Full explanation →
67
Drag & Dropmedium

Drag and drop the steps of IP SLA scheduling with frequency and lifetime into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, create the IP SLA operation. Then configure the frequency (how often probes are sent). Next, set the lifetime (how long the operation runs).

After that, schedule the operation with a start time. Finally, verify the scheduling parameters are active.

Full explanation →
68
Drag & Dropmedium

Drag and drop the steps of troubleshooting NetFlow export issues into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by verifying NetFlow is enabled on the interface. Then check the exporter configuration and collector reachability. Next, inspect the flow cache for active records.

Finally, review export statistics for errors.

Full explanation →
69
Matchingmedium

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Defines when the operation begins

Sets the interval between probes

Sets the total duration of the operation

Removes the operation after inactivity

Sets the value that triggers a reaction

Why these pairings

Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.

Full explanation →
70
Drag & Dropmedium

Drag and drop the steps of the 802.1X/EAP authentication process for a wireless client into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order is: 1. Client sends EAPoL-Start to the AP (A). 2. AP sends EAP-Request Identity (B). 3.

Client sends EAP-Response Identity (C). 4. RADIUS sends EAP-Request credentials (D). 5. Client sends EAP-Response credentials (E).

This sequence is standard for 802.1X/EAP wireless authentication.

Full explanation →
71
MCQmedium

Examine this configuration for a site-to-site VPN on a Cisco router: crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 14 lifetime 86400 ! crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac mode tunnel ! crypto map CMAP 10 ipsec-isakmp set peer 192.168.1.1 set transform-set TSET match address 101 ! interface GigabitEthernet0/0/0 ip address 10.0.0.1 255.255.255.0 crypto map CMAP ! access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 Which statement about this configuration is true?

A.The crypto map uses IKEv2 for key exchange because the transform set uses SHA-256.
B.The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.
C.The ISAKMP policy lifetime of 86400 seconds is too long and will cause the tunnel to fail.
D.The crypto map should be applied to the tunnel interface, not the physical interface.
AnswerB

The 'match address 101' in the crypto map references ACL 101, which permits the specified source and destination networks. Only matching traffic triggers IPsec encryption.

Why this answer

Access-list 101 is used by the crypto map to match traffic that should be encrypted via IPsec. The ACL permits traffic from source network 192.168.10.0/24 to destination network 192.168.20.0/24, so that traffic will be protected by the IPsec tunnel. This is the standard method for defining interesting traffic in a site-to-site VPN.

Exam trap

Cisco often tests the misconception that the crypto map should be applied to a tunnel interface, but in reality it must be applied to the physical egress interface for site-to-site VPNs.

How to eliminate wrong answers

Option A is wrong because the use of SHA-256 in the transform set does not indicate IKEv2; IKEv2 is configured with the 'crypto ikev2' commands, not with ISAKMP policy commands, and the configuration shown uses 'crypto isakmp policy' which is IKEv1. Option C is wrong because an ISAKMP lifetime of 86400 seconds (24 hours) is a common and valid default value; it will not cause the tunnel to fail. Option D is wrong because the crypto map must be applied to the physical interface (or subinterface) that connects to the remote peer, not to a tunnel interface; applying it to a tunnel interface would be incorrect for a site-to-site VPN.

Full explanation →
72
MCQmedium

A network engineer configures VRF-lite on a router with the following snippet: vrf definition GREEN rd 200:1 ! interface GigabitEthernet0/3 vrf forwarding GREEN ip address 172.16.1.1 255.255.255.0 ! router ospf 10 vrf GREEN network 172.16.1.0 0.0.0.255 area 0 What is missing from this configuration to enable proper OSPF routing within VRF GREEN?

A.The configuration is complete and OSPF will operate correctly within VRF GREEN.
B.The 'network' command should specify the interface instead of the subnet.
C.The 'vrf definition GREEN' must include a 'route-target' command.
D.The OSPF process must be configured under the global VRF context, not using 'vrf GREEN'.
AnswerA

Correct. OSPF will run in VRF GREEN with the given commands; router-id can be auto-selected.

Why this answer

The configuration is complete for VRF-lite OSPF routing. In VRF-lite, the 'vrf definition GREEN' with an RD, the interface assignment via 'vrf forwarding GREEN', and the OSPF process with 'vrf GREEN' and the network statement are all that is required. OSPF will operate correctly within VRF GREEN using the specified network in area 0.

Exam trap

Cisco often tests the misconception that VRF-lite requires 'route-target' commands, which are actually only necessary for MPLS VPNs, not for simple VRF-lite configurations.

How to eliminate wrong answers

Option B is wrong because the 'network' command in OSPF can specify a subnet with a wildcard mask, which is the standard method; it does not need to specify the interface directly. Option C is wrong because 'route-target' commands are required for MPLS VPN (VRF-lite does not use MPLS), not for VRF-lite where only the RD is needed for route distinguishment. Option D is wrong because the OSPF process can be configured under the global VRF context using the 'vrf GREEN' keyword after the process ID, which is the correct syntax for associating an OSPF process with a VRF.

Full explanation →
73
Matchingmedium

Drag and drop each MQC command on the left to its matching configuration level on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Defines a traffic class using match criteria

Associates a traffic class with QoS actions (e.g., bandwidth, priority, police)

Applies a policy-map to an interface (input or output) or globally

Used inside a class-map to specify classification criteria

Used inside a policy-map class to allocate minimum bandwidth

Why these pairings

class-map defines traffic classes; policy-map associates actions with classes; service-policy applies the policy to an interface or globally.

Full explanation →
74
MCQmedium

A network engineer configures IP SLA 1 to monitor HTTP server availability at 10.1.1.1 using HTTP GET. The operation is used as a track object for a backup static route. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 200 ms', but the track object shows 'Track 1: up' even though the HTTP server returns a 404 error. What is the cause?

A.The IP SLA HTTP operation must be configured with a 'url' that includes the full path, otherwise it defaults to the root and returns 404.
B.The IP SLA HTTP operation does not interpret HTTP status codes by default; it only checks if a TCP connection is established.
C.The track object must be configured with a 'down' threshold to trigger when the HTTP response time exceeds a value.
D.The HTTP server is responding, so the IP SLA operation correctly shows success; the engineer must use a different type of probe, like TCP connect, to detect the 404.
AnswerB

Correct. IP SLA HTTP probe by default only verifies that the TCP handshake succeeds and a response is received. It does not parse the HTTP status code unless a 'status-code' match is configured.

Why this answer

The IP SLA HTTP operation, by default, only verifies that a TCP three-way handshake completes with the destination host on port 80 (or the configured port). It does not parse or evaluate the HTTP response status code (e.g., 404). Therefore, even though the server returns a 404 error, the TCP connection succeeds, the operation shows 'Active', and the track object remains 'up'.

To detect a 404, you must use the 'http-get' operation with a specific URL and enable status code checking via the 'expect' option.

Exam trap

Cisco often tests the misconception that IP SLA HTTP operations automatically validate HTTP response codes, when in fact they only verify TCP connectivity unless explicitly configured with 'expect' statements.

How to eliminate wrong answers

Option A is wrong because the IP SLA HTTP operation does not require a full URL path to function; it defaults to '/' and the 404 response is irrelevant since the operation only checks TCP connectivity, not the HTTP response content. Option C is wrong because the track object's threshold parameters (e.g., 'down' threshold) affect state transitions based on RTT or other metrics, but they do not cause the track to go down when a 404 is returned; the operation itself never interprets the HTTP status code. Option D is wrong because the HTTP server is indeed responding, but the engineer's goal is to detect a 404 error; using a TCP connect probe would also only check TCP connectivity, not the HTTP status code, so it would not solve the problem.

Full explanation →
75
Multi-Selectmedium

Which three statements about Control Plane Policing (CoPP) are true? (Choose three.)

Select 3 answers
A.CoPP applies QoS policy-map logic to traffic that is destined to the control plane of the router.
B.CoPP is configured under the 'control-plane' global configuration mode.
C.CoPP can be applied to both IPv4 and IPv6 traffic in a single policy-map.
D.CoPP is applied to traffic transiting the router, not to traffic originated by the router.
E.The default action for CoPP is to permit all control-plane traffic.
AnswersA, B, C

Correct because CoPP uses QoS policy-maps to police traffic destined to the control plane.

Why this answer

Control Plane Policing (CoPP) protects the router's control plane by applying QoS policies to traffic destined to the router itself. It is configured under the 'control-plane' global configuration mode using class-maps and policy-maps. Option C is correct: CoPP can apply to both IPv4 and IPv6 traffic in a single policy-map by using multiple class-maps (one for each protocol).

Option D describes data-plane ACLs, not CoPP. Option E is wrong because the default action of CoPP is to drop unmatched traffic, not permit.

Exam trap

CoPP is applied to traffic destined to the control plane, not to transit traffic. The configuration is under the 'control-plane' configuration mode.

Full explanation →

Page 1 of 27

Page 2

All pages

123456789101112131415161718192021222324252627

Practice 350-401 by domain

Target a specific domain to shore up weak areas.

ArchitectureVirtualizationInfrastructureNetwork AssuranceSecurityAutomation
See all domains with question counts →

Study 350-401 by topic

Focused topic pages — one weak area at a time.

BGP QuestionsOSPF QuestionsEIGRP QuestionsSD-Access QuestionsSD-WAN QuestionsACLs and CoPP QuestionsQoS QuestionsVPN QuestionsWireless QuestionsAnsible QuestionsPython Automation QuestionsREST API and YANG QuestionsMPLS QuestionsAAA QuestionsSTP QuestionsVLANs and Trunking Questions