1840 questions total · 25pages · All types, answers revealed
Drag and drop the steps to configure OSPF on a Cisco router in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
OSPF configuration starts with enabling the OSPF process, then defining networks and areas.
A network engineer runs the following command on Switch SW3: SW3# show etherchannel summary Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+--------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?
The Protocol column shows 'LACP'.
Why this answer
The output shows the EtherChannel is using LACP as the protocol, as indicated in the 'Protocol' column. The 'SU' flags on Po1 mean the port-channel is Layer 2 (S) and in use (U), confirming it is active. Therefore, option B is correct because LACP is explicitly listed as the protocol for this EtherChannel.
Exam trap
Cisco often tests the misinterpretation of the 'D' flag as 'down' versus 'standby', leading candidates to incorrectly assume a down port is in a standby or backup role, when in fact it is not participating at all.
How to eliminate wrong answers
Option A is wrong because port Gi0/3 has a flag of 'D' (down), meaning it is not actively participating in the EtherChannel; only Gi0/1 and Gi0/2 are up. Option C is wrong because the 'S' in 'SU' indicates Layer 2, not Layer 3 (which would be 'RU'). Option D is wrong because the 'D' flag on Gi0/3 means 'down', not 'Hot-standby' (which would be 'H' in LACP); standby mode is not supported in this context.
A network engineer runs the following command on Router R6: R6# show ip route vrf CUSTOMER-D VRF CUSTOMER-D: 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.400 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.400 192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask B 192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00 R6# show ip bgp vpnv4 vrf CUSTOMER-D BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i Based on this output, what can be concluded?
The VRF route shows B, and the BGP table shows the same prefix with next-hop 10.0.0.2.
Why this answer
The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).
Exam trap
Cisco often tests the distinction between the routing table (show ip route) and the BGP table (show ip bgp), where a route can be present in BGP but not installed in the routing table if the next-hop is unreachable, but here the route is installed, confirming reachability.
How to eliminate wrong answers
Option A is wrong because the route is marked with 'B' in the routing table, which indicates BGP, not OSPF (which would show 'O'). Option C is wrong because the route is marked as 'best' (>) in BGP and installed in the routing table, which requires the next-hop 10.0.0.2 to be reachable via the directly connected subnet 10.0.0.0/30. Option D is wrong because the VRF has directly connected networks (10.0.0.0/30 and 10.0.0.1/32) as shown by the 'C' and 'L' entries in the routing table.
A network engineer runs the following command on Router R1: R1# show ip eigrp interfaces detail EIGRP-IPv4 Interfaces for AS(100) Interface: GigabitEthernet0/0 Mtu: 1500, Bandwidth: 1000000 Kbit, Delay: 100 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 3 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Interface: GigabitEthernet0/1 Mtu: 1500, Bandwidth: 100000 Kbit, Delay: 1000 microseconds Reliability: 255/255, Load: 1/255, Min MTU: 1500 Hello interval: 5 sec, Hold time: 15 sec Next hello in: 1 secs Passive interface: No Split horizon: Enabled Authentication: None Neighbor count: 1 Based on this output, what can be concluded?
EIGRP metric uses bandwidth and delay; lower bandwidth and higher delay increase the metric.
Why this answer
EIGRP uses the composite metric formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * (K5 / (reliability + K4)). With default K values (K1=K3=1, others=0), the metric simplifies to bandwidth + delay. Gi0/0 has bandwidth 1,000,000 Kbit and delay 100 microseconds, while Gi0/1 has bandwidth 100,000 Kbit and delay 1000 microseconds.
The lower bandwidth and higher delay on Gi0/1 result in a higher metric for the same prefix.
How to eliminate wrong answers
Option A is wrong because the metric weights (K values) are not shown in the output; the command only displays interface-specific parameters like bandwidth and delay, not the K values themselves. Option C is wrong because the output explicitly shows 'Passive interface: No' for Gi0/1, meaning it is not configured as a passive interface. Option D is wrong because the output shows 'Authentication: None' for both interfaces, indicating no EIGRP authentication is enabled.
Drag and drop each DNA Center Intent API on the left to its matching use on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Retrieves detailed device information including serial numbers and software versions
Returns physical and logical network topology maps
Lists network issues with severity and suggested actions
Subscribes to and retrieves real-time network events and syslog messages
Manages site hierarchy and associated device assignments
Why these pairings
Intent APIs: inventory retrieves device details; topology maps network connections; issues identifies network problems; events provides real-time notifications.
A network engineer runs the following command on Router R1: R1# show ip eigrp topology EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.1.1.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.2.2.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 P 10.3.3.0/24, 1 successors, FD is 1310720 via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0 Based on this output, what can be concluded?
The output shows one successor per route and the RD equals the FD, so no feasible successor.
Why this answer
The output shows each route with a code 'P' (Passive) and exactly one successor, with no feasible successor listed. In EIGRP, a feasible successor is only present if there is a backup route that satisfies the feasibility condition (reported distance < feasible distance). Since only one next-hop is shown per route and no additional entries exist, there is no feasible successor.
Option C correctly identifies this.
Exam trap
Cisco often tests the distinction between Passive and Active states in EIGRP topology table output, where candidates mistakenly think 'P' stands for 'Primary' or 'Path' instead of 'Passive', leading them to misinterpret the route state and miss the absence of feasible successors.
How to eliminate wrong answers
Option A is wrong because the output does not show any feasible successor; each route has only one successor and no backup path, so the statement 'All routes have a feasible successor' is false. Option B is wrong because the routes are in Passive state (code 'P'), not Active; Active state would indicate the router is actively querying neighbors for alternate paths, which is not the case here. Option D is wrong because the output does not indicate stub routing; EIGRP stub routing is configured with the 'eigrp stub' command and would not be evident from the topology table alone, and the routes are normal learned routes, not stub-specific behavior.
In Cisco SD-WAN, what is the maximum number of TLOCs that can be associated with a single OMP route?
The maximum number of TLOCs per OMP route is 8, allowing for up to 8 paths for load balancing.
Why this answer
In Cisco SD-WAN, a single OMP route can have up to 8 TLOCs (Transport Locations) associated with it. This limit is enforced by the OMP protocol to balance path diversity and control-plane scalability, ensuring that the vSmart controller does not advertise an excessive number of next-hop paths for a single prefix.
Exam trap
Cisco often tests the 8-TLOC limit to catch candidates who confuse OMP's TLOC-per-route limit with the 16-path limit common in BGP or with the default 4-path limit in some IGP protocols.
How to eliminate wrong answers
Option B (4) is wrong because the maximum is 8, not 4; this misconception may arise from the default number of TLOCs per OMP route in some older configurations, but the hard limit is 8. Option C (16) is wrong because 16 is the maximum number of OMP paths per prefix in some other routing protocols (e.g., BGP), but Cisco SD-WAN OMP specifically caps TLOCs per route at 8. Option D (Unlimited) is wrong because OMP has a fixed limit of 8 TLOCs per route to prevent control-plane overload; unlimited TLOCs would allow unbounded route churn and memory consumption on vSmart and vEdge/cEdge devices.
A network engineer writes the following Python script using the Requests library to retrieve interface information from a Cisco IOS-XE device via RESTCONF: ```python import requests import json url = "https://10.1.1.1:443/restconf/data/ietf-interfaces:interfaces" headers = { "Accept": "application/yang-data+json", "Content-Type": "application/yang-data+json" } auth = ("admin", "password") response = requests.get(url, headers=headers, auth=auth, verify=False) print(response.json()) ``` What is the primary issue with this code?
The header 'Contet-Type' is incorrect; it should be 'Content-Type'. This will cause the server to not recognize the media type.
Why this answer
The primary issue is a typo in the 'Content-Type' header: it is written as 'Contet-Type'. RESTCONF requires the correct header to indicate the YANG data format. This misspelling will cause the server to reject the request with a 400 Bad Request error because it does not recognize the media type.
The code is otherwise correct for RESTCONF access.
Exam trap
Always double-check HTTP header spellings. A simple typo like 'Contet-Type' instead of 'Content-Type' will break RESTCONF requests.
Drag and drop each PnP workflow step on the left to its matching action on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Assigns the device to a site and triggers the provisioning process
Deploys day-0 configuration, templates, and software image
Applies the configuration and brings the device into operational state
Checks device connectivity and validates configuration compliance
Tracks device status, logs, and alerts during the PnP workflow
Why these pairings
PnP steps: Claim device assigns it to a site; Provision deploys configuration; Activate applies image; Verify checks connectivity; Monitor tracks status.
Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Standard ACLs are configured by first entering global configuration mode, then defining ACL entries with permit or deny statements, where each entry specifies a source IP and wildcard mask. After defining all entries, the ACL is applied to an interface in the inbound or outbound direction. Finally, verification with 'show access-lists' confirms the ACL is active and shows hit counts.
Drag and drop each VM storage type on the left to its matching characteristic on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Allocates storage on demand, grows as needed
Pre-allocates full storage at creation
Provides direct access to a physical LUN
VMware virtual disk file format
Hyper-V virtual disk file format
Why these pairings
Thin provisioning allocates space on demand, thick provisioning allocates full space at creation, RDM provides direct LUN access, VMDK is VMware's virtual disk format, and VHDX is Hyper-V's virtual disk format.
What is the default port used by TACACS+ for communication?
Correct. TACACS+ uses TCP port 49.
Why this answer
TACACS+ uses TCP port 49 by default for communication between the Network Access Server (NAS) and the TACACS+ server. This port is defined in the TACACS+ protocol specification (RFC 1492) and is the well-known port reserved for the TACACS+ authentication, authorization, and accounting (AAA) service. Unlike RADIUS, which uses UDP, TACACS+ relies on TCP for reliable, connection-oriented transport.
How to eliminate wrong answers
Option B is wrong because port 1812 is the default port for RADIUS authentication (UDP), not TACACS+. Option C is wrong because port 1645 is an older, deprecated port historically used by RADIUS (before RFC 2865 standardized port 1812), and is not associated with TACACS+. Option D is wrong because port 389 is the default port for LDAP (Lightweight Directory Access Protocol), used for directory services, not for TACACS+ AAA communication.
Drag and drop each Ansible connection type on the left to its matching protocol on the right.
Drag a concept onto its matching description — or click a concept then click the description.
SSH-based connection for Cisco IOS/IOS-XE CLI
SSH-based connection for NETCONF protocol
HTTP/HTTPS-based connection for REST APIs
Runs modules on the control node, not on the target
Pure Python SSH implementation for legacy devices
Drag and drop each EAP method on the left to its matching authentication type on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Mutual certificate-based authentication
Server-side certificate with MSCHAPv2 inner method
Protected Access Credential (PAC) for secure tunneling
Simple username and password hash (no mutual authentication)
Generic Token Card for one-time password or certificate
Why these pairings
EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.
Drag and drop each multicast tree type on the left to its matching description on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Tree rooted at the source, uses optimal path to each receiver
Shared tree rooted at the RP, used in PIM Sparse Mode
Shared tree that allows multicast traffic to flow in both directions
A tree rooted at the source of the multicast traffic
A tree rooted at the RP, shared by all sources for a given group
Why these pairings
SPT is the shortest path from source to receivers; RPT is a shared tree rooted at the RP; Bidirectional tree allows traffic to flow both ways; Source tree is a tree rooted at the source; Shared tree is a tree rooted at the RP.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?
Correct because DNA Center's compliance check compares the intended configuration with the actual device configuration. Conflicts cause compliance errors.
Why this answer
In brownfield deployments, devices may have existing configurations that conflict with the intended policies. DNA Center performs a compliance check before provisioning. If the current device configuration does not match the intended configuration (e.g., existing QoS settings), DNA Center reports a compliance error.
The engineer must either update the device configuration to match the intent or modify the intent to accommodate the existing configuration.
Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
At the enterprise WAN edge, traffic is first classified based on existing markings or other criteria. Then a policy-map is created to set the new DSCP value. The policy is applied outbound on the WAN interface.
The router re-marks packets as they exit. Finally, the new DSCP value is verified using show commands.
An engineer is configuring multicast on a Cisco router. The router receives multicast traffic from a source on interface GigabitEthernet0/0 and needs to forward it to receivers on interface GigabitEthernet0/1. The engineer enables PIM sparse mode on both interfaces and configures a static RP. However, the router does not create a multicast routing entry for the (S,G) pair. What is the most likely missing configuration?
Correct because this command is required to enable multicast routing on the router.
Why this answer
The most likely missing configuration is the global command 'ip multicast-routing'. Without this command, the router cannot enable multicast forwarding or build multicast routing tables, regardless of PIM configuration on interfaces or static RP definition. PIM sparse mode and RP configuration are dependent on multicast routing being globally enabled first.
Exam trap
Cisco often tests the prerequisite of 'ip multicast-routing' as a hidden requirement, leading candidates to focus on PIM modes or RP configuration while overlooking the fundamental global enablement command.
How to eliminate wrong answers
Option B is wrong because an interface without an IP address cannot participate in routing, but the scenario states the router receives multicast traffic on GigabitEthernet0/0, implying it has an IP address; the issue is the lack of multicast routing enablement, not interface addressing. Option C is wrong because while RP reachability is necessary for PIM sparse mode operations, the router would still create a multicast routing entry for the (S,G) pair if multicast routing were enabled; unreachable RP would cause registration issues but not prevent the initial entry creation. Option D is wrong because a static RP does not require the router to be a candidate RP; candidate RP is used for dynamic RP discovery (e.g., Auto-RP or BSR), but static RP configuration on the router is sufficient for PIM sparse mode when multicast routing is enabled.
Drag and drop each 802.11 standard on the left to its matching frequency band and maximum speed on the right.
Drag a concept onto its matching description — or click a concept then click the description.
2.4 GHz, 11 Mbps
5 GHz, 54 Mbps
2.4 GHz, 54 Mbps
2.4/5 GHz, 600 Mbps
5 GHz, 6.9 Gbps
Why these pairings
802.11b operates at 2.4 GHz with 11 Mbps; 802.11a at 5 GHz with 54 Mbps; 802.11g at 2.4 GHz with 54 Mbps; 802.11n can use both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates only at 5 GHz with up to 6.9 Gbps.
Correct because GET is defined as safe and idempotent in REST.
Why this answer
The correct answers are A and D. A is correct because GET is defined as a safe method that does not modify server state. D is correct because PUT is idempotent — multiple identical requests produce the same result.
B is incorrect because POST is not idempotent; it often creates new resources. C is incorrect because DELETE is idempotent, not non-idempotent. E is incorrect because PATCH is typically non-idempotent unless applied carefully.
Drag and drop each BGP message type on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Establishes BGP peering parameters
Advertises or withdraws prefixes
Reports error conditions
Maintains session liveness
Requests re-advertisement of routes
Why these pairings
OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.
Which three statements about Cisco AP join process and discovery are true? (Choose three.)
Correct because DHCP option 43 is a standard method for APs to learn the WLC IP address during boot.
A network engineer runs the following command on Switch SW7: SW7# show monitor session 7 Session 7 --------- Type : Local Session Source Ports : Both : Gi1/0/1 Destination Ports : Gi1/0/20 Encapsulation : Native Ingress : Enabled Based on this output, what can be concluded?
Ingress enabled allows the port to forward received traffic.
Why this answer
The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.
Exam trap
Cisco often tests the misconception that a SPAN destination port always drops all incoming traffic, but the 'Ingress : Enabled' setting explicitly overrides that default behavior, making it a common trap for candidates who overlook the ingress field in the output.
How to eliminate wrong answers
Option B is wrong because the session type is explicitly 'Local Session', not RSPAN; RSPAN uses a remote VLAN to transport mirrored traffic to a different switch, which is not indicated here. Option C is wrong because the source port is configured with 'Both', meaning both ingress and egress traffic from Gi1/0/1 are mirrored, not only egress. Option D is wrong because 'Ingress : Enabled' indicates the destination port is configured to accept incoming traffic, not block it; blocking incoming traffic is the default behavior when ingress is disabled.
Which two statements about IP SLA probe scheduling and operation states are true? (Choose two.)
Correct because 'start-time now' starts the operation as soon as the command is entered.
Why this answer
IP SLA operations can be scheduled to start immediately or at a specific time, and they can run indefinitely or for a fixed duration. The 'life' parameter controls how long the operation runs. An operation in 'active' state is currently sending probes.
The 'pending' state means the operation is configured but not yet scheduled. The 'life forever' command makes the operation run until manually stopped.
Drag and drop the steps of stateless DHCPv6 address assignment steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Consider the following configuration: router eigrp 100 network 10.0.0.0 0.255.255.255 passive-interface default no passive-interface GigabitEthernet0/0 Which statement is true about this EIGRP configuration?
All interfaces are passive by default, but Gi0/0 is explicitly enabled for EIGRP updates.
Why this answer
The `passive-interface default` command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets (and thus updates) on them. The `no passive-interface GigabitEthernet0/0` command then overrides this default for that specific interface, allowing EIGRP to send and receive updates only on GigabitEthernet0/0. The network statement 10.0.0.0 0.255.255.255 enables EIGRP on any interface matching the 10.0.0.0/8 range, but the passive-interface logic restricts actual adjacency formation.
Exam trap
Cisco often tests the interaction between `passive-interface default` and `no passive-interface` to see if candidates understand that the default passive setting overrides all interfaces except those explicitly enabled, rather than the reverse.
How to eliminate wrong answers
Option B is wrong because the configuration uses `passive-interface default` followed by `no passive-interface GigabitEthernet0/0`, which makes only GigabitEthernet0/0 active for EIGRP updates, not all interfaces except GigabitEthernet0/0. Option C is wrong because the network statement `10.0.0.0 0.255.255.255` is a valid wildcard mask that matches the 10.0.0.0/8 prefix, and EIGRP will enable on any interface with an IP in that range; the passive-interface logic does not invalidate the network statement. Option D is wrong because although the network statement enables EIGRP on all interfaces in the 10.0.0.0/8 range, the `passive-interface default` command suppresses hello packets and adjacency formation on all interfaces except GigabitEthernet0/0, so adjacencies will not form on other interfaces.
A network engineer runs the following command on Router R7: R7# show ip sla monitor statistics 6 Round Trip Time (RTT) for Index 6 Latest RTT: NoConnection/Busy/Timeout Latest Operation Start Time: 18:00:00.000 UTC Mon Mar 1 2021 Latest Operation Return Code: Timeout Number of successes: 0 Number of failures: 15 Over thresholds: 0 Based on this output, what is the status of the IP SLA operation?
15 failures and timeout indicate unreachable target.
Why this answer
The output shows 15 failures with a 'Timeout' return code and no successes, indicating that every probe sent has timed out. In IP SLA, a 'NoConnection/Busy/Timeout' RTT and a 'Timeout' return code mean the target is not responding to the probe, confirming unreachability. Option C correctly states the target is unreachable because all probes have failed.
Exam trap
Cisco often tests the distinction between 'timeout' (no response) and 'high latency' (slow but successful responses), so candidates may incorrectly assume timeouts indicate latency rather than unreachability.
How to eliminate wrong answers
Option A is wrong because the operation is not functioning normally; zero successes and 15 failures indicate persistent timeouts, not occasional ones. Option B is wrong because high latency would still show some successful RTT values, but here the RTT is 'NoConnection/Busy/Timeout' with no successes, meaning the target is not reachable at all. Option D is wrong because the operation has clearly started—it has a start time and 15 failures—so it is not merely configured but not started.
Which three statements about OSPF route summarization are true? (Choose three.)
Correct because ABRs use the "area range" command to summarize routes between areas, reducing Type 3 LSAs.
Why this answer
Inter-area summarization is configured on ABRs to reduce the number of Type 3 LSAs. Option B is correct because external route summarization is configured on ASBRs to reduce Type 5 LSAs. Option C is correct because summarization helps reduce the routing table size and LSA flooding, improving network stability.
Option D is incorrect because summarization is not supported on internal routers; it is only performed on ABRs and ASBRs. Option E is incorrect because summarization does not affect Type 1 or Type 2 LSAs; it only affects Type 3 and Type 5 LSAs.
A network engineer runs the following command on Router R3: R3# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65000 1000 1000 10 0 0 01:23:45 5 192.168.2.2 4 65000 800 800 10 0 0 00:45:12 3 Based on this output, what can be concluded?
The local AS is 65000 and both neighbors have the same AS, indicating iBGP. PfxRcd shows prefixes received.
Why this answer
The command `show bgp vpnv4 unicast all summary` displays BGP VPNv4 unicast summary information for all VRFs. Both neighbors (192.168.1.1 and 192.168.2.2) are in the same AS 65000, and the output shows they are exchanging VPNv4 prefixes (State/PfxRcd shows 5 and 3 prefixes received). This confirms they are iBGP peers within the same AS, specifically for VPNv4 address family, which is used in MPLS Layer 3 VPN environments to carry customer VPN routes.
How to eliminate wrong answers
Option A is wrong because both neighbors have the same AS number (65000) as the local router, which indicates iBGP peering, not eBGP (which requires different AS numbers). Option C is wrong because the State/PfxRcd column shows 5 prefixes received from 192.168.1.1, meaning it is actively receiving prefixes. Option D is wrong because the output clearly states '10 network entries' and '20/10 prefixes' (activity counters), not 20 prefixes in the current BGP table.
Which of the following is a valid AP mode on Cisco 9800 WLCs that allows the AP to function as a standalone access point without controller management?
FlexConnect allows standalone operation with local switching.
Why this answer
FlexConnect mode (option B) is the correct answer because it allows a Cisco AP to switch client traffic locally at the AP and continue forwarding traffic even if the connection to the Cisco 9800 WLC is lost, effectively functioning as a standalone access point without controller management. In this mode, the AP can operate in a 'connected' or 'standalone' state, with the latter providing full local switching and authentication when the CAPWAP tunnel to the controller is down.
Exam trap
Cisco often tests the misconception that FlexConnect is only a 'remote office' mode and not a true standalone mode, leading candidates to incorrectly choose Local mode because they assume all APs require constant controller contact.
How to eliminate wrong answers
Option A is wrong because Local mode requires the AP to maintain a CAPWAP tunnel to the WLC at all times; if the controller is unreachable, the AP stops serving clients. Option C is wrong because Monitor mode is a dedicated RF-sensing mode used for rogue detection and wireless intrusion prevention, not for serving client traffic. Option D is wrong because Sniffer mode is used to capture and forward 802.11 frames to a remote packet analyzer, and it does not provide any client connectivity or standalone functionality.
Which four statements about multicast group addresses and Layer 2 mapping are true? (Choose four.)
Correct. The multicast MAC address is derived by placing the lower 23 bits of the multicast IP address into the OUI 01-00-5E.
Why this answer
Multicast IP addresses in the 224.0.0.0/4 range map to Layer 2 MAC addresses using the OUI 01-00-5E. The lower 23 bits of the IP address are placed into the last three bytes of the MAC address, with the 24th bit set to 0. This mapping is not unique, so multiple IP addresses can map to the same MAC (e.g., 224.0.0.1 maps to 01-00-5E-00-00-01, and 224.128.0.1 also maps to the same MAC).
Statement A is correct because it describes the derivation. Statement B is correct because of the 23-bit mapping. Statement C is correct: 224.0.0.1 maps to 01-00-5E-00-00-01.
Statement D is false because 224.0.0.0/24 is the local network control block used for link-local communication and is not routable across the internet. Statement E is correct: 01-00-5E-00-00-05 corresponds to 224.0.0.5 since the low 23 bits (0.0.5) match.
Which two statements about BGP TTL security are true? (Choose two.)
Correct because GTSM checks that the TTL is within a valid range based on the configured hop count.
Why this answer
BGP TTL security (GTSM) protects against CPU-based attacks by ensuring incoming BGP packets have a TTL of 255 minus the expected hop count. The neighbor ttl-security hops command is used on Cisco IOS-XE to enable this feature, and it must be configured on both peers to be effective. Option C is incorrect because the default TTL for eBGP is 1, not 64.
Option D is incorrect because GTSM does not encrypt BGP updates. Option E is incorrect because GTSM is supported for both eBGP and iBGP.
Drag and drop each SD-WAN controller on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Centralized management, monitoring, and configuration of the SD-WAN fabric
Control plane distribution of OMP routes, TLOCs, and policies
Orchestration of initial authentication and NAT traversal for WAN edge devices
WAN edge router that forwards data plane traffic and terminates overlay tunnels
Historical and real-time analytics for network visibility and troubleshooting
Why these pairings
vManage provides centralized management and monitoring; vSmart is the control plane controller that distributes routing and policy; vBond handles authentication and orchestration of the overlay network.
Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
TrustSec inline tagging starts with the ingress switch classifying traffic and adding an SGT to the frame, then forwarding it across the fabric, the egress switch reading the SGT, matching it to an SGACL, and finally enforcing the permit/deny decision.
Given this NAT configuration: ``` interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 ip nat outside ! ip nat inside source static 10.0.0.5 198.51.100.5 ``` What is the purpose of this configuration?
Correct. Static NAT provides a fixed mapping for both directions.
Why this answer
The configuration uses the 'ip nat inside source static' command to create a permanent one-to-one mapping between the inside local address 10.0.0.5 and the inside global address 198.51.100.5. This static NAT allows both outbound traffic (source translation) and inbound traffic (destination translation) to and from the mapped host, enabling bidirectional communication without the need for an access list.
How to eliminate wrong answers
Option A is wrong because the configuration uses static NAT, not PAT (Port Address Translation), and it only translates traffic for a single host (10.0.0.5), not the entire 10.0.0.0/24 subnet. Option C is wrong because static NAT translates both outbound and inbound traffic; it is not limited to outbound traffic only. Option D is wrong because the configuration is complete; static NAT does not require an access list (unlike dynamic NAT or PAT, which often use an ACL to define which inside addresses are eligible for translation).
Which three statements about configuring model-driven telemetry on Cisco IOS-XE devices are true? (Choose three.)
Correct because 'telemetry' at global config mode enters the telemetry configuration context, where you can configure subscriptions, sensor groups, and receivers.
Why this answer
On IOS-XE, telemetry is configured under the 'telemetry' submode. A subscription defines the destination (e.g., IP, port, protocol) and the sensor paths (YANG paths). Multiple sensor groups can be associated with one subscription.
The 'update-policy' command sets the periodic interval. The 'receiver' command specifies the collector details. TLS is supported for secure dial-out connections.
Drag and drop each MPLS label operation on the left to its matching action on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Adds a new label to the top of the label stack
Removes the top label from the label stack
Replaces the top label with a new label value
Pops the label at the penultimate hop before the egress LER
Copies the IP TTL value into the MPLS TTL field
Why these pairings
Push adds a new label to the stack, pop removes the top label, swap replaces the top label with a new one, PHP pops the label before the egress LER, and TTL propagation copies the IP TTL into the label TTL field.
Which two statements about EtherChannel configuration and verification are true? (Choose two.)
Correct because when the first physical port is added with a mode that enables LACP, the port-channel interface is dynamically created.
Why this answer
EtherChannel interfaces can be configured as Layer 2 (switchport) or Layer 3 (no switchport). The 'channel-group' command assigns a physical port to a port-channel. The 'show etherchannel summary' command displays the state and bundle information.
On NX-OS, the 'channel-group' command uses the 'force' option to override mismatched parameters.
A RESTCONF request is sent to a Cisco IOS-XE device to retrieve interface statistics: GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 Accept: application/yang-data+json Response: { "ietf-interfaces:interface": [ { "name": "GigabitEthernet1", "type": "iana-if-type:ethernetCsmacd", "enabled": true, "ietf-ip:ipv4": { "address": [ { "ip": "192.168.1.1", "netmask": "255.255.255.0" } ] } } ] } What does the response indicate about the interface?
The 'enabled' field is true, and the IPv4 address with netmask indicates /24.
Why this answer
The response includes an 'enabled' field set to 'true' and an IPv4 address of '192.168.1.1' with a netmask of '255.255.255.0', which corresponds to a /24 prefix. The RESTCONF GET request successfully retrieves the interface configuration from the ietf-interfaces YANG data model, confirming the interface is administratively up and has an IPv4 address configured.
Exam trap
Cisco often tests the distinction between configuration data and operational state data in RESTCONF/NETCONF responses; the trap here is that candidates may assume the 'enabled' field is missing or misinterpret the netmask as a prefix length, leading them to incorrectly select options B or D.
How to eliminate wrong answers
Option B is wrong because the 'enabled' field is present and set to 'true', not missing; the response clearly shows 'enabled': true. Option C is wrong because the interface type 'iana-if-type:ethernetCsmacd' is the correct standard type for a GigabitEthernet interface per the IANA ifType definitions, so there is no error. Option D is wrong because the response explicitly includes an IPv4 address (192.168.1.1) with a netmask, indicating an IP address is configured.
Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.
A network engineer runs the following command on Router R9: R9# show ip nat translations Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 --- 192.0.2.21 10.0.0.21 --- --- Based on this output, what can be concluded?
Static NAT for 10.0.0.21 and PAT for 10.0.0.20 are both active.
Why this answer
The output shows two types of NAT entries: a dynamic PAT entry for UDP (192.0.2.20:1234) and TCP (192.0.2.20:5678), and a static one-to-one translation for 192.0.2.21 to 10.0.0.21 (indicated by '---' in the protocol and port fields). This combination of dynamic PAT and static NAT on the same router confirms that both static NAT and PAT are being used simultaneously.
How to eliminate wrong answers
Option A is wrong because the translation for 192.0.2.21 to 10.0.0.21 has no protocol or port, which is characteristic of a static NAT entry, not a dynamic one. Option C is wrong because the presence of both static and dynamic translations does not imply a single NAT pool; static NAT uses a fixed mapping, while dynamic PAT uses a pool or overload, and the output does not indicate a single pool. Option D is wrong because 192.0.2.20 is used only for dynamic PAT translations (with ports), while 192.0.2.21 is the static translation; they are separate inside global addresses.
A network engineer is migrating a physical server running a critical database to a virtual machine on a VMware vSphere cluster. The database requires high I/O performance and low latency. The engineer decides to use VMFS datastores with multiple extents to improve performance. After migration, the database performance is worse than on the physical server. What is the most likely reason?
Correct because multiple extents can lead to I/O being split across LUNs, adding overhead.
Why this answer
VMFS datastores with multiple extents distribute data across multiple LUNs, which can cause I/O operations to span physical storage devices. This introduces additional latency due to the need for coordination across LUNs, negating the performance benefit expected from a single, contiguous LUN. For a database requiring high I/O and low latency, this spanning effect degrades performance compared to a physical server with direct-attached storage.
Exam trap
Cisco often tests the misconception that multiple extents improve performance by aggregating bandwidth, when in fact they increase latency due to I/O spanning and SCSI locking overhead.
How to eliminate wrong answers
Option B is wrong because VMFS datastores support files larger than 2 TB; VMFS-5 and later allow virtual disks up to 62 TB, so file size is not the issue. Option C is wrong because thin provisioning can cause write amplification due to on-demand allocation, but the question specifies the engineer used multiple extents, and thin provisioning is not mentioned as the chosen configuration; the primary performance issue here is the extent spanning. Option D is wrong because thick eager zeroed pre-allocates and zeros blocks during creation, which can slow initial writes but does not explain ongoing poor performance after migration; the problem is persistent latency from multi-extent I/O.
Drag and drop the steps of Cisco ISE profiling and policy assignment flow into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Consider the following DMVPN configuration on a hub router: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 no ip redirects ip nhrp map multicast dynamic ip nhrp network-id 100 tunnel source GigabitEthernet0/0/0 tunnel mode gre multipoint What is the effect of the command 'ip nhrp map multicast dynamic'?
This is the correct function: the hub learns spoke addresses dynamically and uses them for multicast replication.
Why this answer
The command 'ip nhrp map multicast dynamic' on a DMVPN hub router instructs the router to dynamically add the NBMA addresses of spoke routers to the multicast NHRP mapping table as they register. This allows the hub to replicate multicast traffic (e.g., routing protocol hellos) to all spokes by using the dynamically learned NBMA addresses, enabling efficient dynamic spoke-to-spoke communication via the hub.
Exam trap
Cisco often tests the distinction between static and dynamic NHRP multicast mapping, where candidates mistakenly think 'dynamic' refers to the hub dynamically registering with a multicast group (like IGMP) rather than dynamically learning spoke NBMA addresses for multicast replication.
How to eliminate wrong answers
Option A is wrong because the command does not statically map the hub's own NBMA address; static mapping is done with 'ip nhrp map' without the 'dynamic' keyword. Option C is wrong because NHRP registration requests are sent by spokes to the hub, not by the hub to a multicast address; the hub uses this command to accept and map those registrations for multicast forwarding. Option D is wrong because the command enables multicast forwarding over the tunnel interface, not disables it; disabling multicast would require 'no ip nhrp map multicast' or similar.
Drag and drop the steps of a NETCONF get-config operation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The NETCONF get-config operation begins with establishing a secure SSH session, then the client sends a hello message to exchange capabilities. After the server responds with its hello, the client sends the get-config request. The server retrieves the configuration and sends the reply.
Which two statements about policing and shaping are true? (Choose two.)
Correct. Policing is bidirectional; shaping is unidirectional (outbound) because it requires buffering.
Why this answer
Policing drops or re-marks packets that exceed a configured rate, while shaping buffers excess packets and delays them to smooth traffic. Policing can be applied inbound or outbound, but shaping is typically outbound only. Shaping uses a buffer, which can introduce jitter.
Drag and drop each AAA method list on the left to its correct fallback order on the right.
Drag a concept onto its matching description — or click a concept then click the description.
local case (no server defined): local
RADIUS then local
TACACS+ then local
local (no fallback)
none (no authentication required)
Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Which two statements about the Cisco Enterprise Campus Architecture are true? (Choose two.)
Correct because the distribution layer is the policy enforcement boundary, implementing routing, QoS, and security policies.
Why this answer
The Cisco Enterprise Campus Architecture uses a hierarchical model to improve scalability, performance, and manageability. The access layer provides user and device connectivity, often with VLANs and PoE. The distribution layer aggregates access switches and provides policy enforcement, while the core layer provides high-speed transport.
The collapsed core design merges core and distribution for smaller networks. Option A is correct because the distribution layer is indeed the policy enforcement point. Option C is correct because the core layer should be optimized for high-speed switching without complex policies.
Option B is incorrect because the access layer typically does not perform routing between VLANs (that is a distribution layer function). Option D is incorrect because a two-tier design (collapsed core) is actually recommended for smaller campuses, not larger ones. Option E is incorrect because the core layer should not be used for security filtering, which is a distribution layer role.
Examine the following configuration snippet: interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ip ospf hello-interval 20 ip ospf dead-interval 80 What is the effect of this configuration?
Correct. The hello interval is set to 20, and dead interval to 80, which is 4 times the hello interval, as required by OSPF.
Why this answer
The configuration explicitly sets the OSPF hello interval to 20 seconds and the dead interval to 80 seconds, which maintains the default 4:1 ratio (dead = hello × 4). OSPF allows manual configuration of these timers, and as long as both sides of the adjacency match, the ratio can be any value; the 4:1 default is not enforced by the protocol.
Exam trap
Cisco often tests the misconception that the dead interval must always be exactly 4 times the hello interval, but the actual requirement is that the timers must match between neighbors, not that a specific ratio must be maintained.
How to eliminate wrong answers
Option B is wrong because the 'ip ospf dead-interval 80' command explicitly overrides the default dead interval (40 seconds for a 10-second hello), so it does not remain at 40. Option C is wrong because OSPF does not automatically set the dead interval to 60 seconds when the hello interval is changed; the dead interval must be explicitly configured or it stays at the default (which would be 80 seconds if the hello were 20, but here it is explicitly set to 80). Option D is wrong because OSPF does not require the dead interval to be exactly 4 times the hello interval; the only requirement is that the timers match on both OSPF neighbors for adjacency to form, and any ratio is acceptable as long as it is consistent.
Drag and drop each ISE policy result on the left to its matching enforcement action on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Downloadable ACL applied to the port after authentication
Assigns the endpoint to a specific VLAN ID
Tags the endpoint with a security group tag for TrustSec
Sets the maximum time before re-authentication is required
Forces HTTP traffic to a captive portal or compliance page
Why these pairings
DACL filters traffic, VLAN assignment places the endpoint, and SGT tagging applies a security group tag.
Which two statements about NAT configuration on Cisco IOS-XE are true? (Choose two.)
Correct because PAT uses port multiplexing to distinguish sessions from different internal hosts sharing one global IP.
Why this answer
NAT overload (PAT) translates multiple inside local addresses to a single inside global address using port numbers. The ip nat inside source list command with the overload keyword enables this. The ip nat inside source static command creates a one-to-one mapping, not many-to-one.
Dynamic NAT without overload uses a pool of global addresses one-to-one. The ip nat outside command is applied to the external interface, not inside. NAT can translate source addresses for traffic leaving the inside network.
Drag and drop each DNA Center API category on the left to its matching endpoint group on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Endpoints for inventory, topology, and health summaries
Endpoints for site, building, and floor creation and management
Endpoints for network device discovery and reachability testing
Endpoints for software image management, device reboot, and configuration archive
Endpoints for creating and applying access and QoS policies
Why these pairings
DNA Center API categories map to endpoint groups: Know Your Network includes inventory and topology; Site Management handles building and floor details; Connectivity covers network device discovery; Operational Tasks includes software image management and device reboot.
Drag and drop the steps of OMP route advertisement between vSmart and vEdge into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
OMP route advertisement begins with the vEdge learning a route locally, then originating an OMP route and sending it to vSmart, which processes and installs it in the route table, then advertises it to other vEdge routers, and finally the receiving vEdge installs the OMP route into its forwarding table.
An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?
Shape average enforces the CIR with bursting, preventing tail drops at the provider's policer.
Why this answer
'shape average' on the egress interface allows the router to buffer excess traffic and transmit it at the contracted CIR, while the burst parameters (Bc and Be) enable short-term bursts above CIR to accommodate real-time traffic spikes without drops. This prevents the provider's policer from discarding packets, as the shaper ensures the outbound traffic rate stays within the agreed contract limits.
Exam trap
Cisco often tests the distinction between shaping and policing—the trap here is that candidates may choose policing (Option B) because it seems simpler, but they overlook that shaping buffers bursts to avoid drops, which is essential when the provider enforces a policer downstream.
How to eliminate wrong answers
Option B is wrong because policing on the ingress interface drops or marks traffic exceeding the CIR, which does not prevent packet loss from the provider's egress policer and fails to buffer bursts; it also does not shape traffic to match the contract. Option C is wrong because the provider's device is typically not under the customer's administrative control, and shaping on the provider side would not allow the customer to prioritize their own real-time traffic or manage bursts locally. Option D is wrong because setting interface bandwidth to CIR does not perform shaping—it only influences routing metrics and QoS calculations, and FIFO queuing provides no prioritization for real-time traffic, leading to jitter and potential drops.
A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook runs successfully on most switches, but one switch fails with an error indicating that the VLAN configuration command is not recognized. What is the most likely cause?
VLAN configuration syntax can vary between IOS versions; the playbook may use commands not supported on that version.
Why this answer
The most likely cause is that the switch runs a different IOS version with different VLAN CLI syntax. Ansible executes commands via SSH, and if the switch expects a different command format (e.g., 'vlan 10' vs. 'vlan database' on older CatOS), the playbook will fail with a command-not-recognized error. This is a common issue when automating across heterogeneous network devices.
Exam trap
The trap here is that candidates may assume a module or connectivity issue, but Cisco tests the understanding that different IOS versions or platforms (e.g., IOS vs. CatOS) have distinct VLAN CLI syntax, which Ansible modules must handle via conditional logic or version-specific variables.
How to eliminate wrong answers
Option A is wrong because Ansible has dedicated modules like 'ios_vlan' for VLAN configuration on Cisco IOS devices, so lacking a module is not the issue. Option B is wrong because an inventory file syntax error would typically cause a connection failure or host-not-found error, not a command-not-recognized error during execution. Option D is wrong because if SSH connectivity were blocked by an ACL, the playbook would fail at the connection stage with a timeout or authentication error, not after successfully sending a command.
Which two statements about Cisco DNA Center software image management (SWIM) are true? (Choose two.)
Correct because SWIM enables setting a desired image version (golden image) and then checking devices against it, flagging non-compliant ones.
Why this answer
SWIM in DNA Center automates image upgrades and compliance. The correct answers describe golden image definition and remote upgrade capabilities. The wrong answers incorrectly claim mandatory TFTP usage, lack of compliance reporting, and that SWIM only works with specific hardware models.
A network engineer runs the following command on Router R4: R4# show ip pim rp mapping PIM Group-to-RP Mappings This system is an RP (Auto-RP) This system is an RP (BSR) Group(s) 224.0.0.0/4 RP 10.0.0.2 (?), v2v1 Info source: 10.0.0.2 (?), elected via Auto-RP, expires in 00:01:30 RP 10.0.0.3 (?), v2v1 Info source: 10.0.0.3 (?), elected via BSR, expires in 00:02:00 Based on this output, what can be concluded?
The output shows two different RPs for the same group range, learned from different protocols.
Why this answer
The output shows two separate RP mappings for the same group range 224.0.0.0/4: one from Auto-RP (RP 10.0.0.2) and one from BSR (RP 10.0.0.3). The router also explicitly states 'This system is an RP (Auto-RP)' and 'This system is an RP (BSR)', confirming that both protocols are actively configured and providing RP information, leading to multiple RP mappings.
Exam trap
Cisco often tests the misconception that a router cannot be an RP for both Auto-RP and BSR simultaneously, but the output confirms it can, and the trap is that candidates assume only one protocol is active when both are clearly listed.
How to eliminate wrong answers
Option A is wrong because the output clearly shows a BSR-elected RP (10.0.0.3) in addition to the Auto-RP mapping, so Auto-RP is not the only protocol in use. Option B is wrong because the output also shows an Auto-RP-elected RP (10.0.0.2), so BSR is not the only protocol in use. Option D is wrong because the router explicitly states 'This system is an RP (Auto-RP)' and 'This system is an RP (BSR)', indicating it is acting as an RP for both protocols.
Examine the following configuration: policy-map MARKING class VOICE set dscp ef class VIDEO set dscp af41 class class-default set dscp default interface GigabitEthernet0/0 service-policy input MARKING Which statement is true?
Correct. The 'set dscp' command modifies the DSCP field of matching packets.
Why this answer
The configuration applies the MARKING policy-map as a service-policy input on GigabitEthernet0/0. This means all incoming packets are classified and have their DSCP values set according to the policy: VOICE class packets get DSCP EF (46), VIDEO class packets get DSCP AF41 (34), and all other packets (class-default) get DSCP default (0). The 'set dscp' action is valid in the input direction and does not require congestion to take effect.
How to eliminate wrong answers
Option B is wrong because the 'set dscp' action in a policy-map is a marking action that occurs on every matching packet regardless of congestion; it is not a queuing or dropping action that depends on congestion. Option C is wrong because 'set dscp' is perfectly valid in the input direction; marking can be applied to incoming packets before they are processed by the router. Option D is wrong because the service-policy is applied in the input direction, meaning it processes incoming packets, not outgoing packets; for outgoing marking, the policy would need to be applied as 'service-policy output'.
Which BGP attribute is preferred when it has the lowest value?
The MED attribute is used to indicate the preferred path into an AS; lower MED is better.
Why this answer
The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.
Exam trap
Cisco often tests the distinction between attributes where higher is preferred (Local Preference, Weight) versus lower is preferred (MED, AS Path length), and the trap here is that candidates might confuse MED with Local Preference or Weight, both of which use higher values as better.
How to eliminate wrong answers
Option B (Local Preference) is wrong because Local Preference is used to influence outbound traffic from an AS, and a higher value is preferred, not lower. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has a higher value, not lower. Option D (AS Path) is wrong because a shorter AS Path length is preferred, meaning a lower count is better, but the question asks for an attribute where the lowest value is preferred, and AS Path is not typically described as a 'value' in the same sense as MED; moreover, AS Path length is a count, not a metric like MED, and the question's phrasing aligns more directly with MED's explicit numeric comparison.
Drag and drop each SD-Access layer on the left to its matching technology on the right.
Drag a concept onto its matching description — or click a concept then click the description.
IS-IS routing protocol for physical network connectivity
VXLAN encapsulation and LISP for host mobility and location
Cisco TrustSec (CTS) for SGT-based access control
Cisco DNA Center for automation and assurance
LISP control plane and VXLAN data plane for fabric forwarding
Why these pairings
The underlay uses IS-IS for physical connectivity, the overlay uses VXLAN and LISP for encapsulation and location mapping, and the policy layer uses CTS for SGT-based segmentation.
Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?
MAC address mismatch occurs when the chaddr field does not match the source MAC.
Why this answer
The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.
Exam trap
Cisco often tests the distinction between Layer 2 MAC checks (frame vs. chaddr) and Layer 3 or application-layer checks (server identifier, transaction ID), leading candidates to confuse DHCP snooping drops with client-side validation failures.
How to eliminate wrong answers
Option A is wrong because the DHCP server identifier option (option 54) is used by clients to identify which server to respond to, and an incorrect server identifier would cause a client to ignore the offer, not a switch to drop the packet due to MAC mismatch. Option B is correct as described. Option C is wrong because an incorrect transaction ID (XID) would cause the DHCP client to ignore the server's reply, but the switch does not check the XID for MAC mismatch drops; the XID mismatch is a client-side validation issue.
Option D is wrong because an untrusted port is a DHCP snooping concept where the switch drops DHCP server messages (OFFER, ACK, etc.) received on that port, not client messages, and the 'MAC Address Mismatch' check applies to client messages on untrusted ports as well, but the specific cause described is the mismatch between frame MAC and chaddr.
Drag and drop each OSPF area type on the left to its matching characteristic on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Must connect all other areas; area 0
Blocks Type 5 LSAs; allows Type 3 summary LSAs
Blocks Type 5 and Type 3 LSAs; uses default route only
Allows Type 7 LSAs for external routes; blocks Type 5 LSAs
Blocks Type 5 and Type 3; allows Type 7 for external routes
Why these pairings
Backbone area (0) connects all other areas; Stub area blocks Type 5 LSAs but allows Type 3; Totally stubby area blocks both Type 5 and Type 3 (default route only); NSSA allows Type 7 LSAs for external routes but blocks Type 5; NSSA totally stubby blocks Type 5 and Type 3 but allows Type 7.
Drag and drop each CAPWAP message type on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Manages AP configuration, keepalive, and state
Encapsulates user data frames between AP and WLC
Sent by AP to find WLCs
Sent by AP to join a WLC
Sent by WLC to push new settings to AP
Why these pairings
CAPWAP Control messages manage the AP (e.g., keepalive, configuration); CAPWAP Data messages carry user traffic between AP and WLC.
Which two statements about PortFast are true? (Choose two.)
Correct because PortFast bypasses the listening and learning states, enabling immediate forwarding.
Why this answer
PortFast is a Cisco enhancement that allows a port to transition immediately from blocking to forwarding, bypassing the listening and learning states. It is intended for ports connected to end hosts, not to other switches. When PortFast is enabled, the port still participates in STP BPDU processing, but the BPDU guard feature can be used to protect against accidental loops.
PortFast does not affect the root bridge election or the designated port selection process.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop the steps of the CAPWAP discovery and join process between a lightweight AP and a WLC into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop each data encoding format on the left to its typical use case on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Human-readable, commonly used in REST APIs
Verbose, supports schemas and namespaces
Human-friendly, often used for configuration files
Compact binary format for efficient serialization
Drag and drop the steps of SNMPv3 authentication and privacy negotiation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
SNMPv3 first discovers the engine ID, then negotiates authentication, then privacy, and finally processes the request.
A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?
Correct because by default, switches may use a single queue; the engineer must configure multiple queues and assign the class to a specific queue.
Why this answer
By default, Cisco switches use a single queue for all traffic. Creating a policy-map that sets a queue-limit for the AF41 class does not automatically create a separate queue for that class; the switch must have multiple egress queues configured (e.g., via the 'priority-queue out' command or by mapping DSCP values to specific queues). Without multiple queues, all traffic shares the same queue, and setting a queue-limit on a class within a single-queue system does not prevent drops during congestion.
Exam trap
Cisco often tests the misconception that creating a class-map and policy-map with a queue-limit automatically creates a separate queue for that traffic, when in fact the switch must have multiple queues explicitly configured to isolate traffic classes.
How to eliminate wrong answers
Option A is wrong because setting the queue-limit too low could cause tail drops, but the question states the engineer created a queue-limit for the AF41 class, and the core issue is that the switch is not using separate queues for different traffic classes. Option C is wrong because the problem is not about marking; the engineer is configuring QoS for video traffic marked as DSCP AF41, and the drops occur even if the marking is correct, due to the lack of multiple queues. Option D is wrong because the policy-map must be applied in the output direction for egress queuing, but the engineer likely applied it correctly; the real issue is that the switch does not have multiple queues configured to isolate the AF41 traffic.
Drag a concept onto its matching description — or click a concept then click the description.
Bandwidth
Load
Delay
Reliability
Why these pairings
A network engineer runs the following command on Router R8: R8# show ip dhcp server statistics Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 10 Manual bindings: 2 Expired bindings: 1 Malformed messages: 0 Message Received BOOTREQUEST 0 DHCPDISCOVER 100 DHCPREQUEST 95 DHCPDECLINE 1 DHCPRELEASE 2 DHCPINFORM 0 Based on this output, what can be concluded?
100 DISCOVER vs 95 REQUEST shows 5 clients did not send REQUEST.
Why this answer
The DHCP server received 100 DHCPDISCOVER messages but only 95 DHCPREQUEST messages. This indicates that 5 clients sent DHCPDISCOVER messages but did not proceed to send a DHCPREQUEST, which could be due to network issues, client configuration, or the client not selecting an offered IP address. The DHCP process requires a client to send a DHCPREQUEST after receiving a DHCPOFFER, so the discrepancy shows incomplete DORA (Discover, Offer, Request, Acknowledge) cycles.
Exam trap
Cisco often tests the ability to interpret DHCP server statistics by presenting numbers that seem to imply a direct relationship (like DISCOVER vs. REQUEST) and expects candidates to understand the DORA flow rather than jumping to conclusions about rejections or malformed messages.
How to eliminate wrong answers
Option B is wrong because the total active leases are the sum of automatic bindings (10) and manual bindings (2), which equals 12, but the output shows 'Expired bindings: 1', meaning one lease has expired and is no longer active; thus, active leases are 11, not 12. Option C is wrong because the output shows 'Malformed messages: 0', indicating no messages were rejected due to malformation; the difference between DHCPDISCOVER (100) and DHCPREQUEST (95) does not imply rejection but rather clients that did not proceed in the DORA process. Option D is wrong because manual bindings (2) are indeed static reservations, but this is a true statement based on the output; however, the question asks 'what can be concluded?' and Option D is not a conclusion derived from the statistics—it is a factual restatement of the output, and the correct conclusion is the one about the discrepancy between DISCOVER and REQUEST messages.
Which three statements about MPLS VPN (Layer 3 VPN) are true? (Choose three.)
Correct because VRFs isolate customer routing tables on the PE.
Why this answer
In MPLS Layer 3 VPNs, the PE routers maintain separate VRF instances for each customer. Route distinguishers (RDs) make overlapping customer prefixes unique, while route targets (RTs) control the import/export of routes between VRFs. The P (provider) routers do not need to know about customer routes; they only switch based on MPLS labels.
Option D is incorrect because P routers do not maintain customer routes. Option E is incorrect because MPLS VPNs use two labels: the inner label identifies the egress PE, and the outer label is used for transport through the core.
Drag and drop the steps of configuring NETCONF YANG-based telemetry with on-change subscription into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, enable NETCONF on the device. Then, define a sensor group that includes the YANG paths to monitor for changes. Next, create a subscription that specifies the sensor group, a receiver, and the on-change update policy.
After that, apply the subscription to activate it. Finally, the device sends updates only when the monitored data changes.
Practice 350-401 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →Study 350-401 by topic
Focused topic pages — one weak area at a time.