Courseiva

ENCOR 350-401 (350-401) — Questions 226300

1840 questions total · 25pages · All types, answers revealed

Page 3

Page 4 of 25

Page 5
226
Drag & Dropmedium

Drag and drop the steps to configure OSPF on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

OSPF configuration starts with enabling the OSPF process, then defining networks and areas.

227
MCQmedium

A network engineer runs the following command on Switch SW3: SW3# show etherchannel summary Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+--------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?

A.All three ports are actively participating in the EtherChannel.
B.The EtherChannel is using LACP protocol.
C.The EtherChannel is a Layer 3 port-channel.
D.Port Gi0/3 is in standby mode.
AnswerB

The Protocol column shows 'LACP'.

Why this answer

The output shows the EtherChannel is using LACP as the protocol, as indicated in the 'Protocol' column. The 'SU' flags on Po1 mean the port-channel is Layer 2 (S) and in use (U), confirming it is active. Therefore, option B is correct because LACP is explicitly listed as the protocol for this EtherChannel.

Exam trap

Cisco often tests the misinterpretation of the 'D' flag as 'down' versus 'standby', leading candidates to incorrectly assume a down port is in a standby or backup role, when in fact it is not participating at all.

How to eliminate wrong answers

Option A is wrong because port Gi0/3 has a flag of 'D' (down), meaning it is not actively participating in the EtherChannel; only Gi0/1 and Gi0/2 are up. Option C is wrong because the 'S' in 'SU' indicates Layer 2, not Layer 3 (which would be 'RU'). Option D is wrong because the 'D' flag on Gi0/3 means 'down', not 'Hot-standby' (which would be 'H' in LACP); standby mode is not supported in this context.

228
MCQhard

A network engineer runs the following command on Router R6: R6# show ip route vrf CUSTOMER-D VRF CUSTOMER-D: 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.400 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.400 192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask B 192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00 R6# show ip bgp vpnv4 vrf CUSTOMER-D BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i Based on this output, what can be concluded?

A.The route 192.168.1.0/24 is learned via OSPF
B.The route 192.168.1.0/24 is installed in the VRF routing table from BGP
C.The next-hop 10.0.0.2 is not reachable
D.VRF CUSTOMER-D has no directly connected networks
AnswerB

The VRF route shows B, and the BGP table shows the same prefix with next-hop 10.0.0.2.

Why this answer

The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Exam trap

Cisco often tests the distinction between the routing table (show ip route) and the BGP table (show ip bgp), where a route can be present in BGP but not installed in the routing table if the next-hop is unreachable, but here the route is installed, confirming reachability.

How to eliminate wrong answers

Option A is wrong because the route is marked with 'B' in the routing table, which indicates BGP, not OSPF (which would show 'O'). Option C is wrong because the route is marked as 'best' (>) in BGP and installed in the routing table, which requires the next-hop 10.0.0.2 to be reachable via the directly connected subnet 10.0.0.0/30. Option D is wrong because the VRF has directly connected networks (10.0.0.0/30 and 10.0.0.1/32) as shown by the 'C' and 'L' entries in the routing table.

229
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail EIGRP-IPv4 Interfaces for AS(100) Interface: GigabitEthernet0/0 Mtu: 1500, Bandwidth: 1000000 Kbit, Delay: 100 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 3 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Interface: GigabitEthernet0/1 Mtu: 1500, Bandwidth: 100000 Kbit, Delay: 1000 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 1 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Based on this output, what can be concluded?

A.Both interfaces have the same metric weight for bandwidth and delay.
B.GigabitEthernet0/1 will have a higher EIGRP metric than GigabitEthernet0/0 for the same prefix.
C.Interface Gi0/1 is configured as a passive interface.
D.EIGRP authentication is enabled on both interfaces.
AnswerB

EIGRP metric uses bandwidth and delay; lower bandwidth and higher delay increase the metric.

Why this answer

EIGRP uses the composite metric formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * (K5 / (reliability + K4)). With default K values (K1=K3=1, others=0), the metric simplifies to bandwidth + delay. Gi0/0 has bandwidth 1,000,000 Kbit and delay 100 microseconds, while Gi0/1 has bandwidth 100,000 Kbit and delay 1000 microseconds.

The lower bandwidth and higher delay on Gi0/1 result in a higher metric for the same prefix.

Exam trap

Cisco often tests the misconception that the 'show ip eigrp interfaces detail' command displays the K values or metric weights, when in fact it only shows per-interface parameters like bandwidth and delay, and the K values must be verified separately with 'show ip protocols'.

How to eliminate wrong answers

Option A is wrong because the metric weights (K values) are not shown in the output; the command only displays interface-specific parameters like bandwidth and delay, not the K values themselves. Option C is wrong because the output explicitly shows 'Passive interface: No' for Gi0/1, meaning it is not configured as a passive interface. Option D is wrong because the output shows 'Authentication: None' for both interfaces, indicating no EIGRP authentication is enabled.

230
Matchingmedium

Drag and drop each DNA Center Intent API on the left to its matching use on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Retrieves detailed device information including serial numbers and software versions

Returns physical and logical network topology maps

Lists network issues with severity and suggested actions

Subscribes to and retrieves real-time network events and syslog messages

Manages site hierarchy and associated device assignments

Why these pairings

Intent APIs: inventory retrieves device details; topology maps network connections; issues identifies network problems; events provides real-time notifications.

231
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp topology EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.1.1.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.2.2.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.3.3.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 Based on this output, what can be concluded?

A.All routes have a feasible successor.
B.The routes are in Active state, meaning the router is querying for alternate paths.
C.Each route has exactly one successor and no feasible successor.
D.The router is using EIGRP stub routing.
AnswerC

The output shows one successor per route and the RD equals the FD, so no feasible successor.

Why this answer

The output shows each route with a code 'P' (Passive) and exactly one successor, with no feasible successor listed. In EIGRP, a feasible successor is only present if there is a backup route that satisfies the feasibility condition (reported distance < feasible distance). Since only one next-hop is shown per route and no additional entries exist, there is no feasible successor.

Option C correctly identifies this.

Exam trap

Cisco often tests the distinction between Passive and Active states in EIGRP topology table output, where candidates mistakenly think 'P' stands for 'Primary' or 'Path' instead of 'Passive', leading them to misinterpret the route state and miss the absence of feasible successors.

How to eliminate wrong answers

Option A is wrong because the output does not show any feasible successor; each route has only one successor and no backup path, so the statement 'All routes have a feasible successor' is false. Option B is wrong because the routes are in Passive state (code 'P'), not Active; Active state would indicate the router is actively querying neighbors for alternate paths, which is not the case here. Option D is wrong because the output does not indicate stub routing; EIGRP stub routing is configured with the 'eigrp stub' command and would not be evident from the topology table alone, and the routes are normal learned routes, not stub-specific behavior.

232
MCQmedium

In Cisco SD-WAN, what is the maximum number of TLOCs that can be associated with a single OMP route?

A.8
B.4
C.16
D.Unlimited
AnswerA

The maximum number of TLOCs per OMP route is 8, allowing for up to 8 paths for load balancing.

Why this answer

In Cisco SD-WAN, a single OMP route can have up to 8 TLOCs (Transport Locations) associated with it. This limit is enforced by the OMP protocol to balance path diversity and control-plane scalability, ensuring that the vSmart controller does not advertise an excessive number of next-hop paths for a single prefix.

Exam trap

Cisco often tests the 8-TLOC limit to catch candidates who confuse OMP's TLOC-per-route limit with the 16-path limit common in BGP or with the default 4-path limit in some IGP protocols.

How to eliminate wrong answers

Option B (4) is wrong because the maximum is 8, not 4; this misconception may arise from the default number of TLOCs per OMP route in some older configurations, but the hard limit is 8. Option C (16) is wrong because 16 is the maximum number of OMP paths per prefix in some other routing protocols (e.g., BGP), but Cisco SD-WAN OMP specifically caps TLOCs per route at 8. Option D (Unlimited) is wrong because OMP has a fixed limit of 8 TLOCs per route to prevent control-plane overload; unlimited TLOCs would allow unbounded route churn and memory consumption on vSmart and vEdge/cEdge devices.

233
MCQmedium

A network engineer writes the following Python script using the Requests library to retrieve interface information from a Cisco IOS-XE device via RESTCONF: ```python import requests import json url = "https://10.1.1.1:443/restconf/data/ietf-interfaces:interfaces" headers = { "Accept": "application/yang-data+json", "Content-Type": "application/yang-data+json" } auth = ("admin", "password") response = requests.get(url, headers=headers, auth=auth, verify=False) print(response.json()) ``` What is the primary issue with this code?

A.The URL uses HTTPS but the device only supports HTTP, causing a connection error.
B.The 'Content-Type' header is misspelled as 'Contet-Type', which will cause the server to reject the request.
C.The 'verify=False' parameter is not valid for the requests library; it should be 'ssl_verify=False'.
D.The 'auth' tuple should be passed as a dictionary with 'username' and 'password' keys.
AnswerB

The header 'Contet-Type' is incorrect; it should be 'Content-Type'. This will cause the server to not recognize the media type.

Why this answer

The primary issue is a typo in the 'Content-Type' header: it is written as 'Contet-Type'. RESTCONF requires the correct header to indicate the YANG data format. This misspelling will cause the server to reject the request with a 400 Bad Request error because it does not recognize the media type.

The code is otherwise correct for RESTCONF access.

Exam trap

Always double-check HTTP header spellings. A simple typo like 'Contet-Type' instead of 'Content-Type' will break RESTCONF requests.

234
Matchingmedium

Drag and drop each PnP workflow step on the left to its matching action on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Assigns the device to a site and triggers the provisioning process

Deploys day-0 configuration, templates, and software image

Applies the configuration and brings the device into operational state

Checks device connectivity and validates configuration compliance

Tracks device status, logs, and alerts during the PnP workflow

Why these pairings

PnP steps: Claim device assigns it to a site; Provision deploys configuration; Activate applies image; Verify checks connectivity; Monitor tracks status.

235
Drag & Dropmedium

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Standard ACLs are configured by first entering global configuration mode, then defining ACL entries with permit or deny statements, where each entry specifies a source IP and wildcard mask. After defining all entries, the ACL is applied to an interface in the inbound or outbound direction. Finally, verification with 'show access-lists' confirms the ACL is active and shows hit counts.

236
Matchingmedium

Drag and drop each VM storage type on the left to its matching characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Allocates storage on demand, grows as needed

Pre-allocates full storage at creation

Provides direct access to a physical LUN

VMware virtual disk file format

Hyper-V virtual disk file format

Why these pairings

Thin provisioning allocates space on demand, thick provisioning allocates full space at creation, RDM provides direct LUN access, VMDK is VMware's virtual disk format, and VHDX is Hyper-V's virtual disk format.

237
MCQeasy

What is the default port used by TACACS+ for communication?

A.49
B.1812
C.1645
D.389
AnswerA

Correct. TACACS+ uses TCP port 49.

Why this answer

TACACS+ uses TCP port 49 by default for communication between the Network Access Server (NAS) and the TACACS+ server. This port is defined in the TACACS+ protocol specification (RFC 1492) and is the well-known port reserved for the TACACS+ authentication, authorization, and accounting (AAA) service. Unlike RADIUS, which uses UDP, TACACS+ relies on TCP for reliable, connection-oriented transport.

Exam trap

Cisco often tests the default port for TACACS+ (49) versus RADIUS (1812/1645) to catch candidates who confuse the two protocols, especially since both are used for AAA but operate on different transport layers and ports.

How to eliminate wrong answers

Option B is wrong because port 1812 is the default port for RADIUS authentication (UDP), not TACACS+. Option C is wrong because port 1645 is an older, deprecated port historically used by RADIUS (before RFC 2865 standardized port 1812), and is not associated with TACACS+. Option D is wrong because port 389 is the default port for LDAP (Lightweight Directory Access Protocol), used for directory services, not for TACACS+ AAA communication.

238
Matchingmedium

Drag and drop each Ansible connection type on the left to its matching protocol on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

SSH-based connection for Cisco IOS/IOS-XE CLI

SSH-based connection for NETCONF protocol

HTTP/HTTPS-based connection for REST APIs

Runs modules on the control node, not on the target

Pure Python SSH implementation for legacy devices

Why these pairings

network_cli uses SSH for CLI-based devices; netconf uses SSH for NETCONF-based devices; httpapi uses HTTP/HTTPS for REST APIs like NX-API or IOS-XE RESTCONF.

239
Matchingmedium

Drag and drop each EAP method on the left to its matching authentication type on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Mutual certificate-based authentication

Server-side certificate with MSCHAPv2 inner method

Protected Access Credential (PAC) for secure tunneling

Simple username and password hash (no mutual authentication)

Generic Token Card for one-time password or certificate

Why these pairings

EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.

240
Matchingmedium

Drag and drop each multicast tree type on the left to its matching description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Tree rooted at the source, uses optimal path to each receiver

Shared tree rooted at the RP, used in PIM Sparse Mode

Shared tree that allows multicast traffic to flow in both directions

A tree rooted at the source of the multicast traffic

A tree rooted at the RP, shared by all sources for a given group

Why these pairings

SPT is the shortest path from source to receivers; RPT is a shared tree rooted at the RP; Bidirectional tree allows traffic to flow both ways; Source tree is a tree rooted at the source; Shared tree is a tree rooted at the RP.

241
Drag & Dropmedium

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

IPsec VPN setup requires IKE phase 1, then phase 2 (transform set and crypto map).

242
MCQhard

A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?

A.The devices have existing QoS configurations that conflict with the new policy.
B.The devices are not running a supported IOS-XE version for QoS automation.
C.The DNA Center appliance does not have enough storage to process the QoS policy.
D.The QoS policy was created with an invalid DSCP value.
AnswerA

Correct because DNA Center's compliance check compares the intended configuration with the actual device configuration. Conflicts cause compliance errors.

Why this answer

In brownfield deployments, devices may have existing configurations that conflict with the intended policies. DNA Center performs a compliance check before provisioning. If the current device configuration does not match the intended configuration (e.g., existing QoS settings), DNA Center reports a compliance error.

The engineer must either update the device configuration to match the intent or modify the intent to accommodate the existing configuration.

243
Drag & Dropmedium

Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

At the enterprise WAN edge, traffic is first classified based on existing markings or other criteria. Then a policy-map is created to set the new DSCP value. The policy is applied outbound on the WAN interface.

The router re-marks packets as they exit. Finally, the new DSCP value is verified using show commands.

244
MCQeasy

An engineer is configuring multicast on a Cisco router. The router receives multicast traffic from a source on interface GigabitEthernet0/0 and needs to forward it to receivers on interface GigabitEthernet0/1. The engineer enables PIM sparse mode on both interfaces and configures a static RP. However, the router does not create a multicast routing entry for the (S,G) pair. What is the most likely missing configuration?

A.The global command 'ip multicast-routing' is not configured.
B.The interface GigabitEthernet0/0 is not configured with an IP address.
C.The RP address is not reachable from the router.
D.The router is not configured as a candidate RP.
AnswerA

Correct because this command is required to enable multicast routing on the router.

Why this answer

The most likely missing configuration is the global command 'ip multicast-routing'. Without this command, the router cannot enable multicast forwarding or build multicast routing tables, regardless of PIM configuration on interfaces or static RP definition. PIM sparse mode and RP configuration are dependent on multicast routing being globally enabled first.

Exam trap

Cisco often tests the prerequisite of 'ip multicast-routing' as a hidden requirement, leading candidates to focus on PIM modes or RP configuration while overlooking the fundamental global enablement command.

How to eliminate wrong answers

Option B is wrong because an interface without an IP address cannot participate in routing, but the scenario states the router receives multicast traffic on GigabitEthernet0/0, implying it has an IP address; the issue is the lack of multicast routing enablement, not interface addressing. Option C is wrong because while RP reachability is necessary for PIM sparse mode operations, the router would still create a multicast routing entry for the (S,G) pair if multicast routing were enabled; unreachable RP would cause registration issues but not prevent the initial entry creation. Option D is wrong because a static RP does not require the router to be a candidate RP; candidate RP is used for dynamic RP discovery (e.g., Auto-RP or BSR), but static RP configuration on the router is sufficient for PIM sparse mode when multicast routing is enabled.

245
Matchingmedium

Drag and drop each 802.11 standard on the left to its matching frequency band and maximum speed on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

2.4 GHz, 11 Mbps

5 GHz, 54 Mbps

2.4 GHz, 54 Mbps

2.4/5 GHz, 600 Mbps

5 GHz, 6.9 Gbps

Why these pairings

802.11b operates at 2.4 GHz with 11 Mbps; 802.11a at 5 GHz with 54 Mbps; 802.11g at 2.4 GHz with 54 Mbps; 802.11n can use both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates only at 5 GHz with up to 6.9 Gbps.

246
Multi-Selectmedium

Which two statements about REST API HTTP methods are true? (Choose two.)

Select 2 answers
A.GET is a safe method that must not change server state.
B.POST is idempotent, meaning multiple identical requests have the same effect.
C.DELETE is non-idempotent and each request may have a different outcome.
D.PUT is idempotent and replaces the entire resource at the target URI.
E.PATCH is always idempotent because it uses a patch document.
AnswersA, D

Correct because GET is defined as safe and idempotent in REST.

Why this answer

The correct answers are A and D. A is correct because GET is defined as a safe method that does not modify server state. D is correct because PUT is idempotent — multiple identical requests produce the same result.

B is incorrect because POST is not idempotent; it often creates new resources. C is incorrect because DELETE is idempotent, not non-idempotent. E is incorrect because PATCH is typically non-idempotent unless applied carefully.

247
Matchingmedium

Drag and drop each BGP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Establishes BGP peering parameters

Advertises or withdraws prefixes

Reports error conditions

Maintains session liveness

Requests re-advertisement of routes

Why these pairings

OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.

248
Multi-Selecthard

Which three statements about Cisco AP join process and discovery are true? (Choose three.)

Select 3 answers
A.An AP can discover a WLC using DHCP option 43, which provides the WLC management IP address.
B.An AP can discover a WLC by sending a DNS query for 'CISCO-CAPWAP-CONTROLLER.localdomain'.
C.An AP must have a valid certificate installed to establish a DTLS session with the WLC.
D.An AP can discover a WLC by sending an SNMP broadcast to the local subnet.
E.An AP can be manually configured with the primary WLC name via the AP CLI before joining.
AnswersA, B, C

Correct because DHCP option 43 is a standard method for APs to learn the WLC IP address during boot.

Why this answer

APs discover WLCs via DHCP option 43, DNS, or local subnet broadcast. They use CAPWAP for control and data. The AP must have a valid certificate for DTLS.

APs can be pre-configured with a primary WLC name. APs do not use SNMP to find WLCs.

249
MCQhard

A network engineer runs the following command on Switch SW7: SW7# show monitor session 7 Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20 Encapsulation : Native Ingress : Enabled Based on this output, what can be concluded?

A.The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.
B.This is an RSPAN session with a remote VLAN.
C.Only egress traffic from Gi1/0/1 is mirrored.
D.The destination port is configured to block all incoming traffic.
AnswerA

Ingress enabled allows the port to forward received traffic.

Why this answer

The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Exam trap

Cisco often tests the misconception that a SPAN destination port always drops all incoming traffic, but the 'Ingress : Enabled' setting explicitly overrides that default behavior, making it a common trap for candidates who overlook the ingress field in the output.

How to eliminate wrong answers

Option B is wrong because the session type is explicitly 'Local Session', not RSPAN; RSPAN uses a remote VLAN to transport mirrored traffic to a different switch, which is not indicated here. Option C is wrong because the source port is configured with 'Both', meaning both ingress and egress traffic from Gi1/0/1 are mirrored, not only egress. Option D is wrong because 'Ingress : Enabled' indicates the destination port is configured to accept incoming traffic, not block it; blocking incoming traffic is the default behavior when ingress is disabled.

250
Multi-Selecteasy

Which two statements about IP SLA probe scheduling and operation states are true? (Choose two.)

Select 2 answers
A.The 'schedule' command with 'start-time now' causes the IP SLA operation to begin immediately.
B.An IP SLA operation in the 'active' state indicates that the probe is currently being sent and responses are being collected.
C.The 'life' parameter in the IP SLA configuration sets the frequency at which probes are sent.
D.An IP SLA operation remains in the 'pending' state until the 'start-time' is reached, even if the configuration is complete.
E.The 'schedule' command with 'life forever' causes the operation to stop after a single probe.
AnswersA, B

Correct because 'start-time now' starts the operation as soon as the command is entered.

Why this answer

IP SLA operations can be scheduled to start immediately or at a specific time, and they can run indefinitely or for a fixed duration. The 'life' parameter controls how long the operation runs. An operation in 'active' state is currently sending probes.

The 'pending' state means the operation is configured but not yet scheduled. The 'life forever' command makes the operation run until manually stopped.

251
Drag & Dropmedium

Drag and drop the steps of stateless DHCPv6 address assignment steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Stateless DHCPv6 uses SLAAC for addressing and DHCPv6 for additional parameters. The host sends an RS, receives an RA with the O flag, then sends an Information-Request and receives a Reply with options like DNS.

252
MCQmedium

Consider the following configuration: router eigrp 100 network 10.0.0.0 0.255.255.255 passive-interface default no passive-interface GigabitEthernet0/0 Which statement is true about this EIGRP configuration?

A.EIGRP will send and receive updates only on GigabitEthernet0/0.
B.EIGRP will send updates on all interfaces except GigabitEthernet0/0.
C.EIGRP will not send any updates because the network statement is incorrect.
D.EIGRP will form adjacencies on all interfaces that have an IP address in the 10.0.0.0/8 range.
AnswerA

All interfaces are passive by default, but Gi0/0 is explicitly enabled for EIGRP updates.

Why this answer

The `passive-interface default` command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets (and thus updates) on them. The `no passive-interface GigabitEthernet0/0` command then overrides this default for that specific interface, allowing EIGRP to send and receive updates only on GigabitEthernet0/0. The network statement 10.0.0.0 0.255.255.255 enables EIGRP on any interface matching the 10.0.0.0/8 range, but the passive-interface logic restricts actual adjacency formation.

Exam trap

Cisco often tests the interaction between `passive-interface default` and `no passive-interface` to see if candidates understand that the default passive setting overrides all interfaces except those explicitly enabled, rather than the reverse.

How to eliminate wrong answers

Option B is wrong because the configuration uses `passive-interface default` followed by `no passive-interface GigabitEthernet0/0`, which makes only GigabitEthernet0/0 active for EIGRP updates, not all interfaces except GigabitEthernet0/0. Option C is wrong because the network statement `10.0.0.0 0.255.255.255` is a valid wildcard mask that matches the 10.0.0.0/8 prefix, and EIGRP will enable on any interface with an IP in that range; the passive-interface logic does not invalidate the network statement. Option D is wrong because although the network statement enables EIGRP on all interfaces in the 10.0.0.0/8 range, the `passive-interface default` command suppresses hello packets and adjacency formation on all interfaces except GigabitEthernet0/0, so adjacencies will not form on other interfaces.

253
MCQhard

A network engineer runs the following command on Router R7: R7# show ip sla monitor statistics 6 Round Trip Time (RTT) for Index 6 Latest RTT: NoConnection/Busy/Timeout Latest Operation Start Time: 18:00:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: Timeout Number of successes: 0 Number of failures: 15 Over thresholds: 0 Based on this output, what is the status of the IP SLA operation?

A.The operation is functioning normally with occasional timeouts.
B.The target is reachable but with high latency.
C.The target is unreachable, as all probes have timed out.
D.The operation has been configured but not started.
AnswerC

15 failures and timeout indicate unreachable target.

Why this answer

The output shows 15 failures with a 'Timeout' return code and no successes, indicating that every probe sent has timed out. In IP SLA, a 'NoConnection/Busy/Timeout' RTT and a 'Timeout' return code mean the target is not responding to the probe, confirming unreachability. Option C correctly states the target is unreachable because all probes have failed.

Exam trap

Cisco often tests the distinction between 'timeout' (no response) and 'high latency' (slow but successful responses), so candidates may incorrectly assume timeouts indicate latency rather than unreachability.

How to eliminate wrong answers

Option A is wrong because the operation is not functioning normally; zero successes and 15 failures indicate persistent timeouts, not occasional ones. Option B is wrong because high latency would still show some successful RTT values, but here the RTT is 'NoConnection/Busy/Timeout' with no successes, meaning the target is not reachable at all. Option D is wrong because the operation has clearly started—it has a start time and 15 failures—so it is not merely configured but not started.

254
Multi-Selectmedium

Which three statements about OSPF route summarization are true? (Choose three.)

Select 3 answers
A.Inter-area route summarization is configured on ABRs using the "area range" command.
B.External route summarization is configured on ASBRs using the "summary-address" command.
C.Route summarization reduces the size of the LSDB and improves network convergence.
D.Route summarization can be configured on any OSPF router to reduce Type 1 LSAs.
E.Summarization in OSPF can be applied to Type 1 and Type 2 LSAs to reduce flooding.
AnswersA, B, C

Correct because ABRs use the "area range" command to summarize routes between areas, reducing Type 3 LSAs.

Why this answer

Inter-area summarization is configured on ABRs to reduce the number of Type 3 LSAs. Option B is correct because external route summarization is configured on ASBRs to reduce Type 5 LSAs. Option C is correct because summarization helps reduce the routing table size and LSA flooding, improving network stability.

Option D is incorrect because summarization is not supported on internal routers; it is only performed on ABRs and ASBRs. Option E is incorrect because summarization does not affect Type 1 or Type 2 LSAs; it only affects Type 3 and Type 5 LSAs.

255
MCQmedium

A network engineer runs the following command on Router R3: R3# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65000 1000 1000 10 0 0 01:23:45 5 192.168.2.2 4 65000 800 800 10 0 0 00:45:12 3 Based on this output, what can be concluded?

A.Both neighbors are eBGP peers
B.Both neighbors are iBGP peers exchanging VPNv4 prefixes
C.The neighbor 192.168.1.1 is not receiving any prefixes
D.The BGP table has 20 prefixes
AnswerB

The local AS is 65000 and both neighbors have the same AS, indicating iBGP. PfxRcd shows prefixes received.

Why this answer

The command `show bgp vpnv4 unicast all summary` displays BGP VPNv4 unicast summary information for all VRFs. Both neighbors (192.168.1.1 and 192.168.2.2) are in the same AS 65000, and the output shows they are exchanging VPNv4 prefixes (State/PfxRcd shows 5 and 3 prefixes received). This confirms they are iBGP peers within the same AS, specifically for VPNv4 address family, which is used in MPLS Layer 3 VPN environments to carry customer VPN routes.

Exam trap

Cisco often tests the distinction between eBGP and iBGP by using the same AS number in the output, and candidates may overlook that the `vpnv4 unicast all` address family is specifically for MPLS VPN iBGP peering, not for standard IPv4 unicast.

How to eliminate wrong answers

Option A is wrong because both neighbors have the same AS number (65000) as the local router, which indicates iBGP peering, not eBGP (which requires different AS numbers). Option C is wrong because the State/PfxRcd column shows 5 prefixes received from 192.168.1.1, meaning it is actively receiving prefixes. Option D is wrong because the output clearly states '10 network entries' and '20/10 prefixes' (activity counters), not 20 prefixes in the current BGP table.

256
MCQeasy

Which of the following is a valid AP mode on Cisco 9800 WLCs that allows the AP to function as a standalone access point without controller management?

A.Local mode
B.FlexConnect mode
C.Monitor mode
D.Sniffer mode
AnswerB

FlexConnect allows standalone operation with local switching.

Why this answer

FlexConnect mode (option B) is the correct answer because it allows a Cisco AP to switch client traffic locally at the AP and continue forwarding traffic even if the connection to the Cisco 9800 WLC is lost, effectively functioning as a standalone access point without controller management. In this mode, the AP can operate in a 'connected' or 'standalone' state, with the latter providing full local switching and authentication when the CAPWAP tunnel to the controller is down.

Exam trap

Cisco often tests the misconception that FlexConnect is only a 'remote office' mode and not a true standalone mode, leading candidates to incorrectly choose Local mode because they assume all APs require constant controller contact.

How to eliminate wrong answers

Option A is wrong because Local mode requires the AP to maintain a CAPWAP tunnel to the WLC at all times; if the controller is unreachable, the AP stops serving clients. Option C is wrong because Monitor mode is a dedicated RF-sensing mode used for rogue detection and wireless intrusion prevention, not for serving client traffic. Option D is wrong because Sniffer mode is used to capture and forward 802.11 frames to a remote packet analyzer, and it does not provide any client connectivity or standalone functionality.

257
Multi-Selecteasy

Which four statements about multicast group addresses and Layer 2 mapping are true? (Choose four.)

Select 4 answers
A.The multicast MAC address is derived by placing the lower 23 bits of the multicast IP address into the OUI 01-00-5E.
B.Multiple multicast IP addresses can map to the same multicast MAC address.
C.The multicast IP address 224.0.0.1 maps to the MAC address 01-00-5E-00-00-01.
D.The multicast IP address range 224.0.0.0/24 is reserved for global scope and can be routed across the internet.
E.The multicast MAC address 01-00-5E-00-00-05 corresponds to the IP address 224.0.0.5.
AnswersA, B, C, E

Correct. The multicast MAC address is derived by placing the lower 23 bits of the multicast IP address into the OUI 01-00-5E.

Why this answer

Multicast IP addresses in the 224.0.0.0/4 range map to Layer 2 MAC addresses using the OUI 01-00-5E. The lower 23 bits of the IP address are placed into the last three bytes of the MAC address, with the 24th bit set to 0. This mapping is not unique, so multiple IP addresses can map to the same MAC (e.g., 224.0.0.1 maps to 01-00-5E-00-00-01, and 224.128.0.1 also maps to the same MAC).

Statement A is correct because it describes the derivation. Statement B is correct because of the 23-bit mapping. Statement C is correct: 224.0.0.1 maps to 01-00-5E-00-00-01.

Statement D is false because 224.0.0.0/24 is the local network control block used for link-local communication and is not routable across the internet. Statement E is correct: 01-00-5E-00-00-05 corresponds to 224.0.0.5 since the low 23 bits (0.0.5) match.

258
Multi-Selectmedium

Which two statements about BGP TTL security are true? (Choose two.)

Select 2 answers
A.BGP TTL security uses the Generalized TTL Security Mechanism (GTSM) to validate the TTL of incoming BGP packets.
B.The command 'neighbor <ip> ttl-security hops <hop-count>' is used to enable BGP TTL security on a per-neighbor basis.
C.The default TTL value for eBGP packets is 64.
D.BGP TTL security encrypts the BGP update messages to prevent eavesdropping.
E.BGP TTL security is only applicable to eBGP sessions, not iBGP.
AnswersA, B

Correct because GTSM checks that the TTL is within a valid range based on the configured hop count.

Why this answer

BGP TTL security (GTSM) protects against CPU-based attacks by ensuring incoming BGP packets have a TTL of 255 minus the expected hop count. The neighbor ttl-security hops command is used on Cisco IOS-XE to enable this feature, and it must be configured on both peers to be effective. Option C is incorrect because the default TTL for eBGP is 1, not 64.

Option D is incorrect because GTSM does not encrypt BGP updates. Option E is incorrect because GTSM is supported for both eBGP and iBGP.

259
Matchingmedium

Drag and drop each SD-WAN controller on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Centralized management, monitoring, and configuration of the SD-WAN fabric

Control plane distribution of OMP routes, TLOCs, and policies

Orchestration of initial authentication and NAT traversal for WAN edge devices

WAN edge router that forwards data plane traffic and terminates overlay tunnels

Historical and real-time analytics for network visibility and troubleshooting

Why these pairings

vManage provides centralized management and monitoring; vSmart is the control plane controller that distributes routing and policy; vBond handles authentication and orchestration of the overlay network.

260
Drag & Dropmedium

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

TrustSec inline tagging starts with the ingress switch classifying traffic and adding an SGT to the frame, then forwarding it across the fabric, the egress switch reading the SGT, matching it to an SGACL, and finally enforcing the permit/deny decision.

261
MCQmedium

Given this NAT configuration: ``` interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat outside ! ip nat inside source static 10.0.0.5 198.51.100.5 ``` What is the purpose of this configuration?

A.It translates all traffic from 10.0.0.0/24 to 198.51.100.0/24 using PAT.
B.It creates a one-to-one mapping between 10.0.0.5 and 198.51.100.5, allowing inbound and outbound traffic.
C.It translates only outbound traffic from 10.0.0.5 to 198.51.100.5.
D.The configuration is incomplete; it needs an access-list.
AnswerB

Correct. Static NAT provides a fixed mapping for both directions.

Why this answer

The configuration uses the 'ip nat inside source static' command to create a permanent one-to-one mapping between the inside local address 10.0.0.5 and the inside global address 198.51.100.5. This static NAT allows both outbound traffic (source translation) and inbound traffic (destination translation) to and from the mapped host, enabling bidirectional communication without the need for an access list.

Exam trap

Cisco often tests the misconception that all NAT configurations require an access list, but static NAT is a notable exception—it uses a direct mapping and does not need an ACL to define the inside host.

How to eliminate wrong answers

Option A is wrong because the configuration uses static NAT, not PAT (Port Address Translation), and it only translates traffic for a single host (10.0.0.5), not the entire 10.0.0.0/24 subnet. Option C is wrong because static NAT translates both outbound and inbound traffic; it is not limited to outbound traffic only. Option D is wrong because the configuration is complete; static NAT does not require an access list (unlike dynamic NAT or PAT, which often use an ACL to define which inside addresses are eligible for translation).

262
Multi-Selecthard

Which three statements about configuring model-driven telemetry on Cisco IOS-XE devices are true? (Choose three.)

Select 3 answers
A.The 'telemetry' command enters the telemetry configuration submode, where subscriptions and sensor groups are defined.
B.A sensor group can contain multiple sensor paths, each referencing a YANG data model path.
C.The 'update-policy' command is used to set the on-change trigger for a subscription.
D.A single subscription can only have one sensor group and one receiver.
E.The 'receiver' command specifies the destination IP address, port, and protocol (e.g., gRPC or TCP) for the telemetry stream.
AnswersA, B, E

Correct because 'telemetry' at global config mode enters the telemetry configuration context, where you can configure subscriptions, sensor groups, and receivers.

Why this answer

On IOS-XE, telemetry is configured under the 'telemetry' submode. A subscription defines the destination (e.g., IP, port, protocol) and the sensor paths (YANG paths). Multiple sensor groups can be associated with one subscription.

The 'update-policy' command sets the periodic interval. The 'receiver' command specifies the collector details. TLS is supported for secure dial-out connections.

263
Matchingmedium

Drag and drop each MPLS label operation on the left to its matching action on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Adds a new label to the top of the label stack

Removes the top label from the label stack

Replaces the top label with a new label value

Pops the label at the penultimate hop before the egress LER

Copies the IP TTL value into the MPLS TTL field

Why these pairings

Push adds a new label to the stack, pop removes the top label, swap replaces the top label with a new one, PHP pops the label before the egress LER, and TTL propagation copies the IP TTL into the label TTL field.

264
Multi-Selecthard

Which two statements about EtherChannel configuration and verification are true? (Choose two.)

Select 2 answers
A.On IOS-XE, the 'channel-group 1 mode active' command creates the port-channel interface automatically if it does not exist.
B.The 'show etherchannel load-balance' command displays the current load-balancing method and the hash algorithm used.
C.In a Layer 3 EtherChannel, you must assign an IP address to the port-channel interface and also to each member interface.
D.The 'channel-group 1 mode desirable' command is valid on both IOS-XE and NX-OS platforms.
E.If physical ports in an EtherChannel have different speed or duplex settings, the EtherChannel will still form but with reduced bandwidth.
AnswersA, B

Correct because when the first physical port is added with a mode that enables LACP, the port-channel interface is dynamically created.

Why this answer

EtherChannel interfaces can be configured as Layer 2 (switchport) or Layer 3 (no switchport). The 'channel-group' command assigns a physical port to a port-channel. The 'show etherchannel summary' command displays the state and bundle information.

On NX-OS, the 'channel-group' command uses the 'force' option to override mismatched parameters.

265
MCQmedium

A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics: GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 Accept: application/yang-data+json Response: { "ietf-interfaces:interface": [ { "name": "GigabitEthernet1", "type": "iana-if-type:ethernetCsmacd", "enabled": true, "ietf-ip:ipv4": { "address": [ { "ip": "192.168.1.1", "netmask": "255.255.255.0" } ] } } ] } What does the response indicate about the interface?

A.The interface GigabitEthernet1 is enabled and has an IPv4 address of 192.168.1.1/24.
B.The interface is disabled because the 'enabled' field is missing.
C.The response indicates an error because the interface type is incorrect.
D.The response shows that the interface has no IP address configured.
AnswerA

The 'enabled' field is true, and the IPv4 address with netmask indicates /24.

Why this answer

The response includes an 'enabled' field set to 'true' and an IPv4 address of '192.168.1.1' with a netmask of '255.255.255.0', which corresponds to a /24 prefix. The RESTCONF GET request successfully retrieves the interface configuration from the ietf-interfaces YANG data model, confirming the interface is administratively up and has an IPv4 address configured.

Exam trap

Cisco often tests the distinction between configuration data and operational state data in RESTCONF/NETCONF responses; the trap here is that candidates may assume the 'enabled' field is missing or misinterpret the netmask as a prefix length, leading them to incorrectly select options B or D.

How to eliminate wrong answers

Option B is wrong because the 'enabled' field is present and set to 'true', not missing; the response clearly shows 'enabled': true. Option C is wrong because the interface type 'iana-if-type:ethernetCsmacd' is the correct standard type for a GigabitEthernet interface per the IANA ifType definitions, so there is no error. Option D is wrong because the response explicitly includes an IPv4 address (192.168.1.1) with a netmask, indicating an IP address is configured.

266
Drag & Dropmedium

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

267
MCQhard

A network engineer runs the following command on Router R9: R9# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 --- 192.0.2.21 10.0.0.21 --- --- Based on this output, what can be concluded?

A.All translations are dynamic.
B.The router is using both static NAT and PAT simultaneously.
C.The router is configured with a single NAT pool.
D.The inside global address 192.0.2.20 is used for both static and dynamic translations.
AnswerB

Static NAT for 10.0.0.21 and PAT for 10.0.0.20 are both active.

Why this answer

The output shows two types of NAT entries: a dynamic PAT entry for UDP (192.0.2.20:1234) and TCP (192.0.2.20:5678), and a static one-to-one translation for 192.0.2.21 to 10.0.0.21 (indicated by '---' in the protocol and port fields). This combination of dynamic PAT and static NAT on the same router confirms that both static NAT and PAT are being used simultaneously.

Exam trap

Cisco often tests the distinction between static NAT (no ports) and dynamic PAT (with ports) in the 'show ip nat translations' output, leading candidates to mistakenly think all entries are dynamic when they see multiple translations sharing the same inside global address.

How to eliminate wrong answers

Option A is wrong because the translation for 192.0.2.21 to 10.0.0.21 has no protocol or port, which is characteristic of a static NAT entry, not a dynamic one. Option C is wrong because the presence of both static and dynamic translations does not imply a single NAT pool; static NAT uses a fixed mapping, while dynamic PAT uses a pool or overload, and the output does not indicate a single pool. Option D is wrong because 192.0.2.20 is used only for dynamic PAT translations (with ports), while 192.0.2.21 is the static translation; they are separate inside global addresses.

268
MCQmedium

A network engineer is migrating a physical server running a critical database to a virtual machine on a VMware vSphere cluster. The database requires high I/O performance and low latency. The engineer decides to use VMFS datastores with multiple extents to improve performance. After migration, the database performance is worse than on the physical server. What is the most likely reason?

A.VMFS datastores with multiple extents can cause I/O to span multiple LUNs, increasing latency.
B.The VMFS datastore does not support files larger than 2 TB.
C.The virtual disk is configured as thin provisioned, causing write amplification.
D.The virtual disk is configured as thick eager zeroed, causing slow initial writes.
AnswerA

Correct because multiple extents can lead to I/O being split across LUNs, adding overhead.

Why this answer

VMFS datastores with multiple extents distribute data across multiple LUNs, which can cause I/O operations to span physical storage devices. This introduces additional latency due to the need for coordination across LUNs, negating the performance benefit expected from a single, contiguous LUN. For a database requiring high I/O and low latency, this spanning effect degrades performance compared to a physical server with direct-attached storage.

Exam trap

Cisco often tests the misconception that multiple extents improve performance by aggregating bandwidth, when in fact they increase latency due to I/O spanning and SCSI locking overhead.

How to eliminate wrong answers

Option B is wrong because VMFS datastores support files larger than 2 TB; VMFS-5 and later allow virtual disks up to 62 TB, so file size is not the issue. Option C is wrong because thin provisioning can cause write amplification due to on-demand allocation, but the question specifies the engineer used multiple extents, and thin provisioning is not mentioned as the chosen configuration; the primary performance issue here is the extent spanning. Option D is wrong because thick eager zeroed pre-allocates and zeros blocks during creation, which can slow initial writes but does not explain ongoing poor performance after migration; the problem is persistent latency from multi-extent I/O.

269
Drag & Dropmedium

Drag and drop the steps of Cisco ISE profiling and policy assignment flow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The flow starts with endpoint authentication via 802.1X/MAB, then ISE collects profiling data (e.g., DHCP, HTTP). ISE matches the endpoint to a profiling policy, assigns an identity group, and finally applies the appropriate authorization policy (e.g., SGT, VLAN).

270
MCQmedium

Consider the following DMVPN configuration on a hub router: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 no ip redirects ip nhrp map multicast dynamic ip nhrp network-id 100 tunnel source GigabitEthernet0/0/0 tunnel mode gre multipoint What is the effect of the command 'ip nhrp map multicast dynamic'?

A.It statically maps the hub's own NBMA address to the multicast group.
B.It enables the hub to dynamically add spoke NBMA addresses to the multicast NHRP map for forwarding multicast traffic to all spokes.
C.It configures the hub to send NHRP registration requests to the multicast address 224.0.0.1.
D.It disables multicast forwarding over the tunnel interface.
AnswerB

This is the correct function: the hub learns spoke addresses dynamically and uses them for multicast replication.

Why this answer

The command 'ip nhrp map multicast dynamic' on a DMVPN hub router instructs the router to dynamically add the NBMA addresses of spoke routers to the multicast NHRP mapping table as they register. This allows the hub to replicate multicast traffic (e.g., routing protocol hellos) to all spokes by using the dynamically learned NBMA addresses, enabling efficient dynamic spoke-to-spoke communication via the hub.

Exam trap

Cisco often tests the distinction between static and dynamic NHRP multicast mapping, where candidates mistakenly think 'dynamic' refers to the hub dynamically registering with a multicast group (like IGMP) rather than dynamically learning spoke NBMA addresses for multicast replication.

How to eliminate wrong answers

Option A is wrong because the command does not statically map the hub's own NBMA address; static mapping is done with 'ip nhrp map' without the 'dynamic' keyword. Option C is wrong because NHRP registration requests are sent by spokes to the hub, not by the hub to a multicast address; the hub uses this command to accept and map those registrations for multicast forwarding. Option D is wrong because the command enables multicast forwarding over the tunnel interface, not disables it; disabling multicast would require 'no ip nhrp map multicast' or similar.

271
Drag & Dropmedium

Drag and drop the steps of a NETCONF get-config operation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The NETCONF get-config operation begins with establishing a secure SSH session, then the client sends a hello message to exchange capabilities. After the server responds with its hello, the client sends the get-config request. The server retrieves the configuration and sends the reply.

272
Multi-Selectmedium

Which two statements about policing and shaping are true? (Choose two.)

Select 2 answers
A.Policing can be configured on both ingress and egress interfaces, whereas shaping is typically applied only on egress interfaces.
B.Shaping drops packets that exceed the configured rate, while policing buffers them to meet the rate.
C.Both policing and shaping use a token bucket algorithm to measure traffic rates.
D.Shaping is more suitable than policing for traffic that must be dropped immediately, such as scavenger-class traffic.
E.Policing always introduces additional latency due to queuing, while shaping does not.
AnswersA, C

Correct. Policing is bidirectional; shaping is unidirectional (outbound) because it requires buffering.

Why this answer

Policing drops or re-marks packets that exceed a configured rate, while shaping buffers excess packets and delays them to smooth traffic. Policing can be applied inbound or outbound, but shaping is typically outbound only. Shaping uses a buffer, which can introduce jitter.

273
Matchingmedium

Drag and drop each AAA method list on the left to its correct fallback order on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

local case (no server defined): local

RADIUS then local

TACACS+ then local

local (no fallback)

none (no authentication required)

Why these pairings

Method lists define the order of authentication sources. The default login method uses local as fallback; a common RADIUS-first list uses local; a TACACS+-first list uses local; a local-only list uses no fallback; and a none list allows access without authentication.

274
Drag & Dropmedium

Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

LDP session establishment starts with discovering neighbors via Hello messages over UDP, then opening a TCP connection. The LSRs exchange initialization parameters over TCP, followed by Keepalive messages to confirm the session. Finally, label mappings are exchanged for FECs.

275
Multi-Selectmedium

Which two statements about the Cisco Enterprise Campus Architecture are true? (Choose two.)

Select 2 answers
A.The distribution layer provides policy-based connectivity and controls traffic flow between access and core layers.
B.The access layer is responsible for routing between VLANs and providing high-speed switching for the campus backbone.
C.The core layer should be designed for high-speed transport and minimal latency, avoiding CPU-intensive features like ACLs.
D.A two-tier hierarchical design (collapsed core) is recommended for large campus networks with thousands of users.
E.The core layer should enforce security policies and perform packet inspection to protect the campus network.
AnswersA, C

Correct because the distribution layer is the policy enforcement boundary, implementing routing, QoS, and security policies.

Why this answer

The Cisco Enterprise Campus Architecture uses a hierarchical model to improve scalability, performance, and manageability. The access layer provides user and device connectivity, often with VLANs and PoE. The distribution layer aggregates access switches and provides policy enforcement, while the core layer provides high-speed transport.

The collapsed core design merges core and distribution for smaller networks. Option A is correct because the distribution layer is indeed the policy enforcement point. Option C is correct because the core layer should be optimized for high-speed switching without complex policies.

Option B is incorrect because the access layer typically does not perform routing between VLANs (that is a distribution layer function). Option D is incorrect because a two-tier design (collapsed core) is actually recommended for smaller campuses, not larger ones. Option E is incorrect because the core layer should not be used for security filtering, which is a distribution layer role.

276
MCQmedium

Examine the following configuration snippet: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip ospf hello-interval 20 ip ospf dead-interval 80 What is the effect of this configuration?

A.The OSPF hello interval is changed to 20 seconds, and the dead interval is changed to 80 seconds, maintaining the default 4:1 ratio.
B.The OSPF hello interval is changed to 20 seconds, but the dead interval remains at the default of 40 seconds.
C.The OSPF hello interval is changed to 20 seconds, and the dead interval is automatically set to 60 seconds.
D.This configuration will cause OSPF adjacency failure because the dead interval must be exactly 4 times the hello interval.
AnswerA

Correct. The hello interval is set to 20, and dead interval to 80, which is 4 times the hello interval, as required by OSPF.

Why this answer

The configuration explicitly sets the OSPF hello interval to 20 seconds and the dead interval to 80 seconds, which maintains the default 4:1 ratio (dead = hello × 4). OSPF allows manual configuration of these timers, and as long as both sides of the adjacency match, the ratio can be any value; the 4:1 default is not enforced by the protocol.

Exam trap

Cisco often tests the misconception that the dead interval must always be exactly 4 times the hello interval, but the actual requirement is that the timers must match between neighbors, not that a specific ratio must be maintained.

How to eliminate wrong answers

Option B is wrong because the 'ip ospf dead-interval 80' command explicitly overrides the default dead interval (40 seconds for a 10-second hello), so it does not remain at 40. Option C is wrong because OSPF does not automatically set the dead interval to 60 seconds when the hello interval is changed; the dead interval must be explicitly configured or it stays at the default (which would be 80 seconds if the hello were 20, but here it is explicitly set to 80). Option D is wrong because OSPF does not require the dead interval to be exactly 4 times the hello interval; the only requirement is that the timers match on both OSPF neighbors for adjacency to form, and any ratio is acceptable as long as it is consistent.

277
Matchingmedium

Drag and drop each ISE policy result on the left to its matching enforcement action on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Downloadable ACL applied to the port after authentication

Assigns the endpoint to a specific VLAN ID

Tags the endpoint with a security group tag for TrustSec

Sets the maximum time before re-authentication is required

Forces HTTP traffic to a captive portal or compliance page

Why these pairings

DACL filters traffic, VLAN assignment places the endpoint, and SGT tagging applies a security group tag.

278
Multi-Selectmedium

Which two statements about NAT configuration on Cisco IOS-XE are true? (Choose two.)

Select 2 answers
A.NAT overload (PAT) allows multiple internal hosts to share a single public IP address by using unique source port numbers.
B.The ip nat inside source list 1 pool POOL overload command enables dynamic NAT without port translation.
C.A static NAT entry is created using the ip nat inside source static 192.168.1.10 203.0.113.10 command.
D.The ip nat outside command is applied to the internal interface to mark it as the source of NAT translations.
E.Dynamic NAT without overload translates multiple inside addresses to a single outside address using port numbers.
AnswersA, C

Correct because PAT uses port multiplexing to distinguish sessions from different internal hosts sharing one global IP.

Why this answer

NAT overload (PAT) translates multiple inside local addresses to a single inside global address using port numbers. The ip nat inside source list command with the overload keyword enables this. The ip nat inside source static command creates a one-to-one mapping, not many-to-one.

Dynamic NAT without overload uses a pool of global addresses one-to-one. The ip nat outside command is applied to the external interface, not inside. NAT can translate source addresses for traffic leaving the inside network.

279
Matchingmedium

Drag and drop each DNA Center API category on the left to its matching endpoint group on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Endpoints for inventory, topology, and health summaries

Endpoints for site, building, and floor creation and management

Endpoints for network device discovery and reachability testing

Endpoints for software image management, device reboot, and configuration archive

Endpoints for creating and applying access and QoS policies

Why these pairings

DNA Center API categories map to endpoint groups: Know Your Network includes inventory and topology; Site Management handles building and floor details; Connectivity covers network device discovery; Operational Tasks includes software image management and device reboot.

280
Drag & Dropmedium

Drag and drop the steps of OMP route advertisement between vSmart and vEdge into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

OMP route advertisement begins with the vEdge learning a route locally, then originating an OMP route and sending it to vSmart, which processes and installs it in the route table, then advertises it to other vEdge routers, and finally the receiving vEdge installs the OMP route into its forwarding table.

281
MCQmedium

An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?

A.Apply a shape average policy on the egress interface of the WAN edge router, setting the CIR and burst parameters to match the provider contract.
B.Use a policer on the ingress interface to drop traffic exceeding the CIR.
C.Configure a shaper on the provider's device instead of the customer router.
D.Set the interface bandwidth to the CIR and rely on FIFO queuing.
AnswerA

Shape average enforces the CIR with bursting, preventing tail drops at the provider's policer.

Why this answer

'shape average' on the egress interface allows the router to buffer excess traffic and transmit it at the contracted CIR, while the burst parameters (Bc and Be) enable short-term bursts above CIR to accommodate real-time traffic spikes without drops. This prevents the provider's policer from discarding packets, as the shaper ensures the outbound traffic rate stays within the agreed contract limits.

Exam trap

Cisco often tests the distinction between shaping and policing—the trap here is that candidates may choose policing (Option B) because it seems simpler, but they overlook that shaping buffers bursts to avoid drops, which is essential when the provider enforces a policer downstream.

How to eliminate wrong answers

Option B is wrong because policing on the ingress interface drops or marks traffic exceeding the CIR, which does not prevent packet loss from the provider's egress policer and fails to buffer bursts; it also does not shape traffic to match the contract. Option C is wrong because the provider's device is typically not under the customer's administrative control, and shaping on the provider side would not allow the customer to prioritize their own real-time traffic or manage bursts locally. Option D is wrong because setting interface bandwidth to CIR does not perform shaping—it only influences routing metrics and QoS calculations, and FIFO queuing provides no prioritization for real-time traffic, leading to jitter and potential drops.

282
MCQmedium

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?

A.Ansible lacks the appropriate module for VLAN configuration
B.The inventory file has a syntax error for that specific host
C.The switch runs a different IOS version with different VLAN CLI syntax
D.SSH connectivity to the switch is blocked by an ACL
AnswerC

VLAN configuration syntax can vary between IOS versions; the playbook may use commands not supported on that version.

Why this answer

The most likely cause is that the switch runs a different IOS version with different VLAN CLI syntax. Ansible executes commands via SSH, and if the switch expects a different command format (e.g., 'vlan 10' vs. 'vlan database' on older CatOS), the playbook will fail with a command-not-recognized error. This is a common issue when automating across heterogeneous network devices.

Exam trap

The trap here is that candidates may assume a module or connectivity issue, but Cisco tests the understanding that different IOS versions or platforms (e.g., IOS vs. CatOS) have distinct VLAN CLI syntax, which Ansible modules must handle via conditional logic or version-specific variables.

How to eliminate wrong answers

Option A is wrong because Ansible has dedicated modules like 'ios_vlan' for VLAN configuration on Cisco IOS devices, so lacking a module is not the issue. Option B is wrong because an inventory file syntax error would typically cause a connection failure or host-not-found error, not a command-not-recognized error during execution. Option D is wrong because if SSH connectivity were blocked by an ACL, the playbook would fail at the connection stage with a timeout or authentication error, not after successfully sending a command.

283
Multi-Selectmedium

Which two statements about Cisco DNA Center software image management (SWIM) are true? (Choose two.)

Select 2 answers
A.Cisco DNA Center allows administrators to define a golden image for each device family and automatically enforce compliance.
B.Cisco DNA Center can upgrade device images remotely without requiring physical access to the devices.
C.Cisco DNA Center SWIM requires all devices to have a TFTP server configured locally to receive new images.
D.Cisco DNA Center SWIM does not provide any compliance reporting or audit trails for image versions.
E.Cisco DNA Center SWIM only supports Cisco Catalyst 9000 series switches and cannot manage older platforms.
AnswersA, B

Correct because SWIM enables setting a desired image version (golden image) and then checking devices against it, flagging non-compliant ones.

Why this answer

SWIM in DNA Center automates image upgrades and compliance. The correct answers describe golden image definition and remote upgrade capabilities. The wrong answers incorrectly claim mandatory TFTP usage, lack of compliance reporting, and that SWIM only works with specific hardware models.

284
MCQhard

A network engineer runs the following command on Router R4: R4# show ip pim rp mapping PIM Group-to-RP Mappings This system is an RP (Auto-RP) This system is an RP (BSR) Group(s) 224.0.0.0/4 RP 10.0.0.2 (?), v2v1 Info source: 10.0.0.2 (?), elected via Auto-RP, expires in 00:01:30 RP 10.0.0.3 (?), v2v1 Info source: 10.0.0.3 (?), elected via BSR, expires in 00:02:00 Based on this output, what can be concluded?

A.Only Auto-RP is being used for RP mapping.
B.Only BSR is being used for RP mapping.
C.Both Auto-RP and BSR are configured, causing multiple RP mappings.
D.The router is not an RP.
AnswerC

The output shows two different RPs for the same group range, learned from different protocols.

Why this answer

The output shows two separate RP mappings for the same group range 224.0.0.0/4: one from Auto-RP (RP 10.0.0.2) and one from BSR (RP 10.0.0.3). The router also explicitly states 'This system is an RP (Auto-RP)' and 'This system is an RP (BSR)', confirming that both protocols are actively configured and providing RP information, leading to multiple RP mappings.

Exam trap

Cisco often tests the misconception that a router cannot be an RP for both Auto-RP and BSR simultaneously, but the output confirms it can, and the trap is that candidates assume only one protocol is active when both are clearly listed.

How to eliminate wrong answers

Option A is wrong because the output clearly shows a BSR-elected RP (10.0.0.3) in addition to the Auto-RP mapping, so Auto-RP is not the only protocol in use. Option B is wrong because the output also shows an Auto-RP-elected RP (10.0.0.2), so BSR is not the only protocol in use. Option D is wrong because the router explicitly states 'This system is an RP (Auto-RP)' and 'This system is an RP (BSR)', indicating it is acting as an RP for both protocols.

285
MCQmedium

Examine the following configuration: policy-map MARKING class VOICE set dscp ef class VIDEO set dscp af41 class class-default set dscp default interface GigabitEthernet0/0 service-policy input MARKING Which statement is true?

A.Incoming packets matching the VOICE class will have their DSCP set to EF (46), VIDEO to AF41 (34), and all others to default (0).
B.The policy-map will only mark packets if the interface is congested.
C.The configuration is invalid because 'set dscp' cannot be used in a 'service-policy input' direction.
D.The policy-map will remark the DSCP of outgoing packets on GigabitEthernet0/0.
AnswerA

Correct. The 'set dscp' command modifies the DSCP field of matching packets.

Why this answer

The configuration applies the MARKING policy-map as a service-policy input on GigabitEthernet0/0. This means all incoming packets are classified and have their DSCP values set according to the policy: VOICE class packets get DSCP EF (46), VIDEO class packets get DSCP AF41 (34), and all other packets (class-default) get DSCP default (0). The 'set dscp' action is valid in the input direction and does not require congestion to take effect.

Exam trap

The trap here is that candidates often confuse marking with congestion management, assuming that QoS actions like 'set dscp' only take effect during congestion, when in fact marking is a non-congestion-dependent action that applies to every matching packet.

How to eliminate wrong answers

Option B is wrong because the 'set dscp' action in a policy-map is a marking action that occurs on every matching packet regardless of congestion; it is not a queuing or dropping action that depends on congestion. Option C is wrong because 'set dscp' is perfectly valid in the input direction; marking can be applied to incoming packets before they are processed by the router. Option D is wrong because the service-policy is applied in the input direction, meaning it processes incoming packets, not outgoing packets; for outgoing marking, the policy would need to be applied as 'service-policy output'.

286
MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.MED (Multi-Exit Discriminator)
B.Local Preference
C.Weight
D.AS Path
AnswerA

The MED attribute is used to indicate the preferred path into an AS; lower MED is better.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

Exam trap

Cisco often tests the distinction between attributes where higher is preferred (Local Preference, Weight) versus lower is preferred (MED, AS Path length), and the trap here is that candidates might confuse MED with Local Preference or Weight, both of which use higher values as better.

How to eliminate wrong answers

Option B (Local Preference) is wrong because Local Preference is used to influence outbound traffic from an AS, and a higher value is preferred, not lower. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has a higher value, not lower. Option D (AS Path) is wrong because a shorter AS Path length is preferred, meaning a lower count is better, but the question asks for an attribute where the lowest value is preferred, and AS Path is not typically described as a 'value' in the same sense as MED; moreover, AS Path length is a count, not a metric like MED, and the question's phrasing aligns more directly with MED's explicit numeric comparison.

287
Matchingmedium

Drag and drop each SD-Access layer on the left to its matching technology on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

IS-IS routing protocol for physical network connectivity

VXLAN encapsulation and LISP for host mobility and location

Cisco TrustSec (CTS) for SGT-based access control

Cisco DNA Center for automation and assurance

LISP control plane and VXLAN data plane for fabric forwarding

Why these pairings

The underlay uses IS-IS for physical connectivity, the overlay uses VXLAN and LISP for encapsulation and location mapping, and the policy layer uses CTS for SGT-based segmentation.

288
MCQeasy

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

A.The DHCP server is sending packets with an incorrect server identifier option.
B.The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.
C.The DHCP client is sending a request with an incorrect transaction ID.
D.The DHCP offer packet is arriving on an untrusted port.
AnswerB

MAC address mismatch occurs when the chaddr field does not match the source MAC.

Why this answer

The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.

Exam trap

Cisco often tests the distinction between Layer 2 MAC checks (frame vs. chaddr) and Layer 3 or application-layer checks (server identifier, transaction ID), leading candidates to confuse DHCP snooping drops with client-side validation failures.

How to eliminate wrong answers

Option A is wrong because the DHCP server identifier option (option 54) is used by clients to identify which server to respond to, and an incorrect server identifier would cause a client to ignore the offer, not a switch to drop the packet due to MAC mismatch. Option B is correct as described. Option C is wrong because an incorrect transaction ID (XID) would cause the DHCP client to ignore the server's reply, but the switch does not check the XID for MAC mismatch drops; the XID mismatch is a client-side validation issue.

Option D is wrong because an untrusted port is a DHCP snooping concept where the switch drops DHCP server messages (OFFER, ACK, etc.) received on that port, not client messages, and the 'MAC Address Mismatch' check applies to client messages on untrusted ports as well, but the specific cause described is the mismatch between frame MAC and chaddr.

289
Matchingmedium

Drag and drop each OSPF area type on the left to its matching characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Must connect all other areas; area 0

Blocks Type 5 LSAs; allows Type 3 summary LSAs

Blocks Type 5 and Type 3 LSAs; uses default route only

Allows Type 7 LSAs for external routes; blocks Type 5 LSAs

Blocks Type 5 and Type 3; allows Type 7 for external routes

Why these pairings

Backbone area (0) connects all other areas; Stub area blocks Type 5 LSAs but allows Type 3; Totally stubby area blocks both Type 5 and Type 3 (default route only); NSSA allows Type 7 LSAs for external routes but blocks Type 5; NSSA totally stubby blocks Type 5 and Type 3 but allows Type 7.

290
Matchingmedium

Drag and drop each CAPWAP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Manages AP configuration, keepalive, and state

Encapsulates user data frames between AP and WLC

Sent by AP to find WLCs

Sent by AP to join a WLC

Sent by WLC to push new settings to AP

Why these pairings

CAPWAP Control messages manage the AP (e.g., keepalive, configuration); CAPWAP Data messages carry user traffic between AP and WLC.

291
Multi-Selecteasy

Which two statements about PortFast are true? (Choose two.)

Select 2 answers
A.PortFast allows a port to transition directly from blocking to forwarding state.
B.PortFast should be enabled on ports that connect to end-user devices.
C.PortFast disables BPDU processing on the port.
D.PortFast is automatically enabled on all trunk ports.
E.PortFast changes the root bridge election process.
AnswersA, B

Correct because PortFast bypasses the listening and learning states, enabling immediate forwarding.

Why this answer

PortFast is a Cisco enhancement that allows a port to transition immediately from blocking to forwarding, bypassing the listening and learning states. It is intended for ports connected to end hosts, not to other switches. When PortFast is enabled, the port still participates in STP BPDU processing, but the BPDU guard feature can be used to protect against accidental loops.

PortFast does not affect the root bridge election or the designated port selection process.

292
Drag & Dropmedium

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, trust the DSCP on the ingress interface. Then, map DSCP to CoS using a table-map. Apply the table-map in a policy-map.

Finally, apply the policy-map to the interface.

293
Drag & Dropmedium

Drag and drop the steps of the CAPWAP discovery and join process between a lightweight AP and a WLC into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The CAPWAP process starts with the AP obtaining an IP address (via DHCP), then discovering the WLC (via DHCP option 43 or DNS). The AP sends a Discovery Request, the WLC replies with a Discovery Response, and finally the AP sends a Join Request to establish the control tunnel.

294
Matchingmedium

Drag and drop each data encoding format on the left to its typical use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Human-readable, commonly used in REST APIs

Verbose, supports schemas and namespaces

Human-friendly, often used for configuration files

Compact binary format for efficient serialization

Why these pairings

Correct pairings: JSON is human-readable and widely used in REST APIs; XML is verbose with schema support; YAML is human-friendly for configuration files; Protobuf is a compact binary format for high-performance RPC.

295
Drag & Dropmedium

Drag and drop the steps of SNMPv3 authentication and privacy negotiation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

SNMPv3 first discovers the engine ID, then negotiates authentication, then privacy, and finally processes the request.

296
MCQhard

A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?

A.The queue-limit is set too low, causing tail drops.
B.The switch uses a single queue for all traffic unless multiple queues are configured.
C.The video traffic is not being marked with DSCP AF41.
D.The policy-map must be applied to the output direction.
AnswerB

Correct because by default, switches may use a single queue; the engineer must configure multiple queues and assign the class to a specific queue.

Why this answer

By default, Cisco switches use a single queue for all traffic. Creating a policy-map that sets a queue-limit for the AF41 class does not automatically create a separate queue for that class; the switch must have multiple egress queues configured (e.g., via the 'priority-queue out' command or by mapping DSCP values to specific queues). Without multiple queues, all traffic shares the same queue, and setting a queue-limit on a class within a single-queue system does not prevent drops during congestion.

Exam trap

Cisco often tests the misconception that creating a class-map and policy-map with a queue-limit automatically creates a separate queue for that traffic, when in fact the switch must have multiple queues explicitly configured to isolate traffic classes.

How to eliminate wrong answers

Option A is wrong because setting the queue-limit too low could cause tail drops, but the question states the engineer created a queue-limit for the AF41 class, and the core issue is that the switch is not using separate queues for different traffic classes. Option C is wrong because the problem is not about marking; the engineer is configuring QoS for video traffic marked as DSCP AF41, and the drops occur even if the marking is correct, due to the lack of multiple queues. Option D is wrong because the policy-map must be applied in the output direction for egress queuing, but the engineer likely applied it correctly; the real issue is that the switch does not have multiple queues configured to isolate the AF41 traffic.

297
Matchingmedium

Drag and drop each EIGRP metric component on the left to its matching variable on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Bandwidth

Load

Delay

Reliability

Why these pairings

K1 corresponds to bandwidth, K2 to load, K3 to delay, and K4 to reliability. K5 is not directly assigned to a single metric component; it is a multiplier used with reliability in the metric formula. MTU is not a K variable; it is only used in the feasibility condition.

Exam trap

A common mistake is to assign MTU to K5, but MTU is not a component of the EIGRP metric formula.

298
MCQhard

A network engineer runs the following command on Router R8: R8# show ip dhcp server statistics Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 10 Manual bindings: 2 Expired bindings: 1 Malformed messages: 0 Message Received BOOTREQUEST 0 DHCPDISCOVER 100 DHCPREQUEST 95 DHCPDECLINE 1 DHCPRELEASE 2 DHCPINFORM 0 Based on this output, what can be concluded?

A.The DHCP server has received more DHCPDISCOVER messages than DHCPREQUEST messages, indicating some clients did not proceed to request.
B.The DHCP server has 12 active leases.
C.The DHCP server rejected 5 DHCPDISCOVER messages.
D.The DHCP server has 2 manual bindings that are static reservations.
AnswerA

100 DISCOVER vs 95 REQUEST shows 5 clients did not send REQUEST.

Why this answer

The DHCP server received 100 DHCPDISCOVER messages but only 95 DHCPREQUEST messages. This indicates that 5 clients sent DHCPDISCOVER messages but did not proceed to send a DHCPREQUEST, which could be due to network issues, client configuration, or the client not selecting an offered IP address. The DHCP process requires a client to send a DHCPREQUEST after receiving a DHCPOFFER, so the discrepancy shows incomplete DORA (Discover, Offer, Request, Acknowledge) cycles.

Exam trap

Cisco often tests the ability to interpret DHCP server statistics by presenting numbers that seem to imply a direct relationship (like DISCOVER vs. REQUEST) and expects candidates to understand the DORA flow rather than jumping to conclusions about rejections or malformed messages.

How to eliminate wrong answers

Option B is wrong because the total active leases are the sum of automatic bindings (10) and manual bindings (2), which equals 12, but the output shows 'Expired bindings: 1', meaning one lease has expired and is no longer active; thus, active leases are 11, not 12. Option C is wrong because the output shows 'Malformed messages: 0', indicating no messages were rejected due to malformation; the difference between DHCPDISCOVER (100) and DHCPREQUEST (95) does not imply rejection but rather clients that did not proceed in the DORA process. Option D is wrong because manual bindings (2) are indeed static reservations, but this is a true statement based on the output; however, the question asks 'what can be concluded?' and Option D is not a conclusion derived from the statistics—it is a factual restatement of the output, and the correct conclusion is the one about the discrepancy between DISCOVER and REQUEST messages.

299
Multi-Selecthard

Which three statements about MPLS VPN (Layer 3 VPN) are true? (Choose three.)

Select 3 answers
A.PE routers maintain separate VRF instances for each customer.
B.Route distinguishers (RDs) are used to make overlapping customer prefixes unique.
C.Route targets (RTs) control the import and export of routes between VRFs.
D.P routers must maintain customer VPN routing information.
E.MPLS VPNs use a single label to forward packets across the service provider core.
AnswersA, B, C

Correct because VRFs isolate customer routing tables on the PE.

Why this answer

In MPLS Layer 3 VPNs, the PE routers maintain separate VRF instances for each customer. Route distinguishers (RDs) make overlapping customer prefixes unique, while route targets (RTs) control the import/export of routes between VRFs. The P (provider) routers do not need to know about customer routes; they only switch based on MPLS labels.

Option D is incorrect because P routers do not maintain customer routes. Option E is incorrect because MPLS VPNs use two labels: the inner label identifies the egress PE, and the outer label is used for transport through the core.

300
Drag & Drophard

Drag and drop the steps of configuring NETCONF YANG-based telemetry with on-change subscription into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, enable NETCONF on the device. Then, define a sensor group that includes the YANG paths to monitor for changes. Next, create a subscription that specifies the sensor group, a receiver, and the on-change update policy.

After that, apply the subscription to activate it. Finally, the device sends updates only when the monitored data changes.

Page 3

Page 4 of 25

Page 5