Courseiva

ENCOR 350-401 (350-401) — Questions 526–600

1839 questions total · 25pages · All types, answers revealed

Take a mock examExam hub
Page 7

Page 8 of 25

Page 9
526
MCQmedium

Examine this configuration: interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8::1/64 ipv6 ospf 1 area 0 What is the effect of the 'ipv6 ospf 1 area 0' command?

A.It enables OSPFv3 process 1 on this interface and assigns it to area 0.
B.It enables OSPFv2 process 1 on this interface and assigns it to area 0.
C.It enables OSPFv3 on this interface but the process ID must match the router ospf process ID; if not, it will be ignored.
D.It enables OSPFv3 on this interface but area 0 is invalid for IPv6; OSPFv3 uses area 0.0.0.0.
AnswerA

Correct. This is the correct syntax to enable OSPFv3 on an interface and specify the area.

Why this answer

The 'ipv6 ospf 1 area 0' command enables OSPFv3 (the IPv6 version of OSPF) on the specified interface, assigns it to OSPFv3 process 1, and places the interface in area 0 (the backbone area). This is the correct syntax for activating OSPFv3 on an interface under a specific process and area, independent of any global OSPFv3 process configuration.

Exam trap

Cisco often tests the distinction between OSPFv2 and OSPFv3 interface commands, and the trap here is that candidates confuse 'ip ospf' (OSPFv2) with 'ipv6 ospf' (OSPFv3) or assume the process ID must match a pre-existing global process, when in fact the interface command can auto-create the process.

How to eliminate wrong answers

Option B is wrong because 'ipv6 ospf' is specific to OSPFv3, not OSPFv2; OSPFv2 uses the 'ip ospf' command for IPv4. Option C is wrong because the process ID in the interface command does not need to match a global 'router ospf' process ID; OSPFv3 can be configured directly on the interface, and if no global process exists, one is automatically created. Option D is wrong because area 0 is perfectly valid for OSPFv3; OSPFv3 uses the same area numbering (including decimal 0 for the backbone) as OSPFv2, not area 0.0.0.0 as a required format.

Full explanation →
527
Multi-Selectmedium

Which three statements about STP topology changes and convergence are true? (Choose three.)

Select 3 answers
A.A switch that detects a topology change sends a TCN BPDU toward the root bridge.
B.The root bridge sets the Topology Change (TC) flag in its BPDUs after receiving a TCN.
C.When the TC flag is set, switches reduce the MAC address aging timer to the forward delay time.
D.The Max Age timer is used to flush MAC address entries during a topology change.
E.The forward delay timer determines how long a switch waits before transitioning from listening to learning state.
AnswersA, B, C

Correct because the TCN (Topology Change Notification) is sent to inform the root bridge of a change.

Why this answer

When a topology change occurs in 802.1D STP, the switch that detects the change sends a TCN BPDU toward the root bridge. The root bridge then sets the TC flag in its BPDUs, causing all switches to shorten their MAC address aging timers to flush stale entries. This process ensures rapid convergence of the forwarding database.

The Max Age timer is used to age out BPDU information, not to flush MAC addresses. The forward delay timer is used during listening and learning states, not directly for MAC aging.

Full explanation →
528
MCQeasy

In Cisco SD-WAN, what is the default OMP hello interval (in seconds) between a vEdge router and a vSmart controller?

A.10 seconds
B.30 seconds
C.60 seconds
D.5 seconds
AnswerA

The default OMP hello interval is 10 seconds.

Why this answer

The default OMP hello interval between a vEdge router and a vSmart controller in Cisco SD-WAN is 10 seconds. OMP (Overlay Management Protocol) uses these periodic hello messages to maintain adjacency and detect failures, with a default dead interval of 60 seconds (6 times the hello interval).

Exam trap

Cisco often tests the distinction between the OMP hello interval (10 seconds) and the OMP dead interval (60 seconds), and candidates frequently confuse the two or mistakenly apply BGP or OSPF default timers to OMP.

How to eliminate wrong answers

Option B (30 seconds) is wrong because it is the default OMP hello interval for vBond controllers, not for vEdge-to-vSmart communication. Option C (60 seconds) is wrong because that is the default OMP dead interval, not the hello interval. Option D (5 seconds) is wrong because it is the default hello interval for BGP or OSPF in some contexts, but not for OMP in Cisco SD-WAN.

Full explanation →
529
MCQhard

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

A.The connection timeout is set too low
B.The device has reached the maximum number of SSH sessions
C.The device's SSH server is not fully initialized
D.The device requires an enable password but none was provided
AnswerC

The device may still be booting or SSH service is not started.

Why this answer

The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Exam trap

The trap here is that candidates often confuse network reachability or credential validity with SSH session state, assuming that if the device is pingable and credentials are correct, the SSH session must work, but Cisco tests the understanding that SSH session initialization is a separate process that can fail even when the device is reachable.

How to eliminate wrong answers

Option A is wrong because a low connection timeout would typically result in a 'Connection timed out' or 'Timeout' error, not a 'ValueError: SSH session not active' which indicates the session was initiated but not active. Option B is wrong because reaching the maximum number of SSH sessions would produce an error like 'Too many connections' or 'Connection refused', not a ValueError about session inactivity. Option D is wrong because a missing enable password would cause an authentication failure or privilege escalation error after the SSH session is established, not a failure to activate the SSH session itself.

Full explanation →
530
MCQmedium

A network engineer is deploying a new virtualized application on a VMware vSphere cluster. The application requires dedicated CPU cores to meet licensing requirements, and the engineer must ensure that no other virtual machine can use those cores. The cluster uses VMware ESXi 7.0. Which configuration should the engineer apply to the virtual machine?

A.Configure CPU affinity to pin the VM to specific physical cores.
B.Set a CPU reservation equal to the number of vCPUs.
C.Enable NUMA node affinity for the VM.
D.Configure a CPU limit equal to the number of vCPUs.
AnswerA

Correct because CPU affinity binds the VM to designated cores, ensuring exclusive use.

Why this answer

CPU affinity (option A) is the correct configuration because it explicitly binds a virtual machine's vCPUs to specific physical cores, ensuring that no other VM can use those cores. This meets the licensing requirement for dedicated CPU cores by preventing co-scheduling or sharing of those physical cores with other workloads, which CPU reservation alone does not guarantee.

Exam trap

The trap here is that candidates confuse CPU reservation with dedicated core assignment, assuming that reserving CPU resources guarantees exclusive access to physical cores, when in fact reservation only guarantees resource availability, not exclusivity.

How to eliminate wrong answers

Option B is wrong because a CPU reservation guarantees that the specified amount of CPU resources (in MHz) will be available to the VM, but it does not prevent other VMs from using the same physical cores; the hypervisor can still schedule other VMs on those cores when the VM is idle. Option C is wrong because NUMA node affinity optimizes memory locality for performance by binding a VM to a specific NUMA node, but it does not provide exclusive access to individual CPU cores; other VMs can still run on cores within that NUMA node. Option D is wrong because a CPU limit caps the maximum CPU usage of the VM, but it does not reserve or dedicate cores; it only restricts the VM from consuming more than the specified amount, and other VMs can still use the same physical cores.

Full explanation →
531
MCQhard

A network engineer runs the following command on Switch SW1: SW1# show vlan id 10 VLAN ID: 10 VLAN Name: Sales VLAN Type: Ethernet VLAN State: active MTU: 1500 Remote SPAN VLAN: No Primary VLAN ID: 10 Private VLAN Type: Primary Associated Secondary VLAN IDs: 100, 200 Based on this output, what can be concluded?

A.VLAN 10 is a community VLAN.
B.VLAN 10 is an isolated VLAN.
C.VLAN 10 is a primary private VLAN.
D.VLAN 10 is a normal data VLAN with no private VLAN features.
AnswerC

The output shows 'Private VLAN Type: Primary' and associated secondary VLANs.

Why this answer

The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Exam trap

Cisco often tests the distinction between the 'show vlan' output for a primary VLAN versus a secondary VLAN, and the trap here is that candidates mistakenly think the presence of 'Associated Secondary VLAN IDs' means the VLAN itself is a secondary VLAN, when in fact only the primary VLAN lists its associated secondary VLANs.

How to eliminate wrong answers

Option A is wrong because a community VLAN is a type of secondary private VLAN that allows communication within the same community and with the primary VLAN, but the output explicitly identifies VLAN 10 as a Primary VLAN, not a community VLAN. Option B is wrong because an isolated VLAN is another type of secondary private VLAN that only allows communication with the primary VLAN, and the output shows VLAN 10 as the Primary VLAN, not an isolated VLAN. Option D is wrong because the presence of 'Private VLAN Type: Primary' and associated secondary VLANs indicates that VLAN 10 is participating in private VLAN features, making it a private VLAN rather than a normal data VLAN.

Full explanation →
532
Multi-Selectmedium

Which two statements about NetFlow are true? (Choose two.)

Select 2 answers
A.NetFlow records are unidirectional by default.
B.Sampled NetFlow reduces CPU impact by analyzing only a subset of packets.
C.Flexible NetFlow can export user-defined flow keys using NetFlow v5 format.
D.NetFlow can be used as a replacement for SNMP polling for interface utilization.
E.NetFlow v9 supports only IPv4 traffic.
AnswersA, B

Correct because NetFlow aggregates packets based on flow keys (e.g., source/destination IP, ports) and records traffic in one direction only.

Why this answer

NetFlow is a Cisco technology that collects IP traffic statistics. Traditional NetFlow (v5/v9) is unidirectional and sampled flow is used to reduce CPU load. Flexible NetFlow allows user-defined keys but still exports in NetFlow v9 or IPFIX format.

NetFlow does not replace SNMP; they serve different purposes.

Full explanation →
533
Matchingmedium

Drag and drop each ACL type on the left to its matching capability on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Filters based on source IP address only

Filters based on source/destination IP, protocol, and port numbers

Allows identification by alphanumeric name instead of number

Applies a time range to restrict access during specific periods

Authenticates a user and then opens a temporary hole in the firewall

Why these pairings

Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow identification by name; Time-based ACLs use time ranges; Dynamic ACLs authenticate per-user.

Full explanation →
534
MCQhard

An engineer is designing a Layer 2 network with redundancy. The network uses MST (Multiple Spanning Tree) to reduce the number of STP instances. The engineer has configured two regions: Region 1 and Region 2. The engineer notices that switches in Region 1 are not forming a single MST region, and instead, they are treating each other as if they are in different regions. The engineer checks the configuration and finds that the region name and revision number are the same on all switches in Region 1, but the VLAN-to-instance mapping is different on one switch. What is the most likely cause of the issue?

A.The VLAN-to-instance mapping is not consistent across all switches in Region 1.
B.The root bridge for each MST instance is not configured correctly.
C.BPDU Guard is enabled on the inter-switch links, preventing BPDU exchange.
D.PortFast is enabled on the inter-switch links, causing the switches to ignore BPDUs.
AnswerA

Correct because MST requires identical VLAN-to-instance mapping, region name, and revision number for switches to be in the same region.

Why this answer

In MST, all switches within a region must agree on three parameters: the region name, the revision number, and the VLAN-to-instance mapping. Even if the region name and revision number match, a single mismatch in the VLAN-to-instance mapping causes the switches to treat each other as if they belong to different regions, preventing them from forming a single MST region.

Exam trap

Cisco often tests the fact that all three components of the MST configuration (name, revision, and VLAN-to-instance mapping) must match exactly for switches to be in the same region, and candidates mistakenly think only the name and revision matter.

How to eliminate wrong answers

Option B is wrong because the root bridge configuration for each MST instance affects the spanning-tree topology within the region but does not determine whether switches belong to the same region; region membership is based solely on the MST configuration identifier (name, revision, mapping). Option C is wrong because BPDU Guard is a port security feature that shuts down a port upon receiving a BPDU, but it does not prevent BPDU exchange before the port is err-disabled; moreover, the issue described is about region formation, not BPDU filtering. Option D is wrong because PortFast immediately transitions a port to the forwarding state but does not cause switches to ignore BPDUs; BPDUs are still processed, and PortFast does not affect MST region formation.

Full explanation →
535
MCQeasy

A network engineer uses the following Python script with Netmiko to send a command to a Cisco IOS-XE device: ```python from netmiko import ConnectHandler device = { 'device_type': 'cisco_ios', 'ip': '10.1.1.1', 'username': 'admin', 'password': 'password', 'secret': 'enable_secret' } connection = ConnectHandler(**device) output = connection.send_command('show ip interface brief') print(output) connection.disconnect() ``` What is the purpose of the 'secret' parameter in the device dictionary?

A.It is used for SSH key-based authentication.
B.It is used to enter enable mode after connecting to the device.
C.It is used to encrypt the session.
D.It is used to set the SNMP community string.
AnswerB

The 'secret' parameter provides the enable password to enter privileged EXEC mode.

Why this answer

The 'secret' parameter is used to enter enable mode (privileged EXEC mode) on Cisco devices. Netmiko will automatically use this password to elevate privileges after connecting.

Full explanation →
536
Matchingmedium

Drag and drop each SNMPv3 security level on the left to its matching protection description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

No authentication and no encryption

Authentication with MD5 or SHA, no encryption

Authentication and encryption (e.g., DES, AES)

Uses SHA for authentication only

Uses SHA for authentication and AES for encryption

Why these pairings

noAuthNoPriv provides no authentication or encryption; authNoPriv provides authentication only; authPriv provides both authentication and encryption.

Full explanation →
537
Multi-Selecthard

Which three statements about queuing and congestion avoidance in a QoS architecture are true? (Choose three.)

Select 3 answers
A.Class-Based Weighted Fair Queuing (CBWFQ) assigns a weight to each class and guarantees a minimum bandwidth during congestion.
B.Low Latency Queuing (LLQ) provides a strict priority queue that is serviced before any other queues, which can cause starvation of other queues if not policed.
C.Weighted Random Early Detection (WRED) can be used only with TCP traffic and drops packets randomly based on the average queue depth.
D.Tail drop is a congestion avoidance mechanism that drops packets from the front of the queue when it is full.
E.WRED can be configured per class within a policy map using the 'random-detect' command under the class.
AnswersA, B, E

Correct. CBWFQ allocates bandwidth to each class based on the configured bandwidth or weight, ensuring each class gets its minimum share when the link is congested.

Why this answer

Queuing manages packets when output is congested, using algorithms like CBWFQ and LLQ. Congestion avoidance techniques like WRED proactively drop packets to prevent tail drops. LLQ provides strict priority queuing for delay-sensitive traffic.

WRED can be configured per class in a policy map.

Full explanation →
538
Drag & Dropmedium

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

SFC path setup starts with the classifier identifying traffic to be steered, then the classifier adds an NSH encapsulation to the packet. The first SFF receives the packet and forwards it to the first SF. After processing, the SF returns the packet to the SFF, which then forwards it to the next SFF in the chain.

This repeats until the packet reaches the last SFF, which removes the NSH and forwards the packet.

Full explanation →
539
Matchingmedium

Drag and drop each VLAN type on the left to its matching purpose on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Carries user data traffic

Carries VoIP traffic, typically uses QoS

Used for out-of-band management access

Carries untagged frames on a trunk port

VLAN 1 by default on all Cisco switches

Why these pairings

Data VLAN carries user traffic; voice VLAN carries VoIP; management VLAN for device access; native VLAN for untagged frames on trunk; default VLAN is VLAN 1.

Full explanation →
540
Multi-Selecthard

Which three statements about syslog configuration on Cisco IOS devices are true? (Choose three.)

Select 3 answers
A.The command 'logging host 192.168.1.100' configures the device to send syslog messages to the server at that IP address.
B.The command 'logging trap 4' configures the device to send syslog messages with severity 4 (warnings) and higher (0-4) to the syslog server.
C.The command 'logging source-interface Loopback0' ensures that syslog messages use the Loopback0 IP address as the source.
D.The default logging trap level on Cisco IOS is level 7 (debugging).
E.The command 'logging console 3' limits syslog messages displayed on the console to severity 3 (errors) and lower (0-3).
AnswersA, B, C

Correct because 'logging host' specifies the destination syslog server IP address.

Why this answer

The logging host command specifies the syslog server IP. The logging trap level sets the severity for messages sent to the syslog server; default is level 6 (informational). The logging source-interface sets the source IP of syslog packets.

The logging buffered command stores messages in RAM. The logging console command affects messages sent to the console port, not to the syslog server.

Full explanation →
541
MCQmedium

Given the following Ansible playbook snippet: --- - name: Configure OSPF hosts: routers gather_facts: no tasks: - name: OSPF config ios_config: lines: - router ospf 1 - network 10.0.0.0 0.255.255.255 area 0 parents: router ospf 1 What is wrong with this playbook?

A.The 'parents' parameter should not be used with 'router ospf 1' in lines; it causes a configuration error.
B.The network statement uses a wildcard mask instead of subnet mask, which is incorrect.
C.The OSPF process ID must be 1, but it can be any number.
D.There is no error; the playbook works correctly.
AnswerA

Correct. The 'parents' parameter already enters the mode, so the 'router ospf 1' line inside lines is redundant and causes an error.

Why this answer

The `parents` parameter in the `ios_config` module specifies the parent configuration mode under which the `lines` should be applied. When `lines` already includes `router ospf 1`, using `parents: router ospf 1` causes Ansible to attempt entering the OSPF router configuration mode twice, leading to a configuration error. The correct approach is to either omit the `parents` parameter or include only the network statement in `lines` with the appropriate parent.

Exam trap

Cisco often tests the misconception that the `parents` parameter is optional or redundant when the mode entry command is already in `lines`, but in reality, it causes a duplicate command error because the module enters the parent mode first.

How to eliminate wrong answers

Option B is wrong because Cisco IOS uses wildcard masks in OSPF network statements (e.g., `network 10.0.0.0 0.255.255.255 area 0`), which is correct syntax; a subnet mask would be invalid. Option C is wrong because the OSPF process ID can be any number, but the playbook does not enforce a specific value; the issue is not about the process ID being 1. Option D is wrong because the playbook contains a logical error in the use of the `parents` parameter, as explained in the correct answer.

Full explanation →
542
MCQmedium

Given the following configuration: aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius local aaa accounting exec default start-stop group radius radius-server host 192.168.1.100 key Cisco123 radius-server host 192.168.1.101 key Cisco123 Which statement is true about this configuration?

A.If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local.
B.The RADIUS servers are used for authentication only, not for authorization or accounting.
C.Local authentication is always attempted first, then RADIUS.
D.The RADIUS key is optional; if omitted, the router uses an empty key.
AnswerA

Correct. RADIUS servers are tried in the order configured; if all RADIUS servers fail, the fallback method (local) is used.

Why this answer

The configuration uses the 'default' method list for login authentication, exec authorization, and exec accounting. The order 'group radius local' means the router first attempts authentication, authorization, and accounting via the RADIUS servers in the order they are configured. If the first RADIUS server (192.168.1.100) is unreachable, the second server (192.168.1.101) is tried before falling back to local authentication.

This is because the 'group radius' keyword directs the router to try all configured RADIUS servers in sequence before resorting to the 'local' fallback method.

Exam trap

Cisco often tests the misconception that 'group radius local' means local authentication is tried first, or that RADIUS servers are only used for authentication, when in fact the order of methods in the list determines the sequence, and the same method list can apply to authentication, authorization, and accounting.

How to eliminate wrong answers

Option B is wrong because the configuration includes 'aaa authorization exec default group radius local' and 'aaa accounting exec default start-stop group radius', which explicitly use RADIUS for both authorization and accounting, not just authentication. Option C is wrong because the order 'group radius local' specifies that RADIUS is attempted first, and local authentication is only used as a fallback if all RADIUS servers are unreachable. Option D is wrong because the 'key' is mandatory when using RADIUS; if omitted, the router will not be able to authenticate with the RADIUS server, and the command 'radius-server host' requires a key to be specified for secure communication.

Full explanation →
543
Multi-Selecteasy

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

Select 2 answers
A.Predictable latency between any two devices
B.Increased number of single points of failure
C.Increased broadcast domain size
D.Reduced need for VLANs
E.Higher bandwidth utilization through multiple equal-cost paths
AnswersA, E

Traffic always traverses one spine hop, resulting in consistent latency.

Why this answer

A is correct because spine-leaf architecture ensures that every leaf switch is connected to every spine switch, creating a full-mesh topology. This design guarantees that traffic between any two leaf switches traverses at most one spine hop, resulting in predictable, consistent latency regardless of which devices are communicating.

Exam trap

Cisco often tests the misconception that spine-leaf eliminates VLANs or reduces broadcast domains, but the architecture actually uses Layer 3 routing to contain broadcast domains while still requiring VLANs for Layer 2 segmentation at the leaf level.

Full explanation →
544
MCQmedium

A network engineer runs the following command on a Cisco WLC: WLC# show ap rf-profile summary RF-Profile Name: default-rf-profile Description: Default RF Profile Band: 5 GHz Channel Width: 20/40/80 MHz Data Rates: 6,9,12,18,24,36,48,54 Mbps Power Level: 1 (max) RF-Profile Name: high-density Description: High Density RF Profile Band: 5 GHz Channel Width: 20 MHz Data Rates: 12,18,24,36,48,54 Mbps Power Level: 3 Based on this output, what can be concluded?

A.The high-density profile is designed to support more clients by using narrower channels and lower power.
B.The default profile uses only 20 MHz channels.
C.The high-density profile disables all data rates below 12 Mbps.
D.The default profile is used for 2.4 GHz band.
AnswerA

Narrower channels (20 MHz) and lower power reduce co-channel interference, which is beneficial in high-density environments.

Why this answer

The high-density RF profile uses a fixed 20 MHz channel width, which reduces co-channel interference and allows more non-overlapping channels, combined with a lower power level (3 vs. 1) to shrink cell size and increase overall capacity for many clients in a dense environment.

Exam trap

Cisco often tests the misconception that 'high-density' profiles always disable lower data rates completely, but in reality the profile only defines which rates are supported/mandatory, and the key differentiators are channel width and power level to control cell size and capacity.

How to eliminate wrong answers

Option B is wrong because the default profile shows 'Channel Width: 20/40/80 MHz', meaning it supports channel bonding up to 80 MHz, not only 20 MHz. Option C is wrong because the high-density profile lists data rates starting at 12 Mbps, but it does not disable rates below 12 Mbps; it simply does not include 6 and 9 Mbps in the mandatory/supported list, but those rates could still be enabled if configured differently. Option D is wrong because the default profile explicitly shows 'Band: 5 GHz', not 2.4 GHz; the 2.4 GHz band would typically be configured in a separate RF profile.

Full explanation →
545
Drag & Dropmedium

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

WPA3 uses Simultaneous Authentication of Equals (SAE) handshake. The client first sends an SAE commit to the AP, the AP responds with its own SAE commit, then both compute a shared key. Next, the client sends an SAE confirm message, and finally the AP sends its SAE confirm to complete authentication.

Full explanation →
546
Drag & Dropmedium

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

WPA3 uses SAE (Simultaneous Authentication of Equals) handshake. First, the AP announces WPA3 capability in beacons. The client then initiates the SAE commit exchange, followed by the SAE confirm exchange.

After SAE completes, the 4-Way Handshake occurs, and finally group key is installed.

Full explanation →
547
Drag & Dropmedium

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Full explanation →
548
Drag & Dropmedium

Drag and drop the steps of MST region configuration and operation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

MST configuration begins with entering MST mode and defining the region name, revision number, and VLAN-to-instance mapping. After configuration, the switch computes an MD5 digest of the MST configuration to identify region membership. Switches in the same region then run IST (Internal Spanning Tree) and CIST (Common and Internal Spanning Tree) to elect a root bridge for the region.

Finally, per-instance spanning trees are calculated within the region.

Full explanation →
549
MCQmedium

An engineer is troubleshooting a syslog issue on a Cisco switch. The switch is configured with 'logging host 10.1.1.1' and 'logging trap informational'. The syslog server at 10.1.1.1 receives messages from other devices but not from this switch. The engineer can ping 10.1.1.1 from the switch. What is the most likely cause?

A.The syslog server is configured to accept messages only from a specific source IP address.
B.The switch's logging process is disabled by default and must be enabled with 'logging on'.
C.The 'logging trap informational' command is incorrect; it should be 'logging trap 6'.
D.The switch uses UDP port 514, but the server listens on TCP port 514.
AnswerB

Correct because 'logging on' is required to start the syslog logging process; without it, no messages are sent even if hosts are configured.

Why this answer

The 'logging on' command is required to enable the syslog logging process on Cisco IOS devices. Without it, the switch will not generate or send syslog messages to any configured server, even though the server is reachable via ping. The fact that other devices send messages to the server confirms the server is functional, so the issue is local to the switch's logging process being disabled by default.

Exam trap

Cisco often tests the fact that 'logging on' is required to enable syslog message generation, and candidates mistakenly assume that configuring 'logging host' alone is sufficient to start sending logs.

How to eliminate wrong answers

Option A is wrong because if the server were filtering by source IP, the engineer would likely see no messages from any device, but the scenario states the server receives messages from other devices, making a server-side filter unlikely. Option C is wrong because 'logging trap informational' is a valid command that sets the severity level to 6 (Informational), which is equivalent to 'logging trap 6'; the command is not incorrect. Option D is wrong because both the switch and the syslog server use UDP port 514 by default for syslog; TCP port 514 is used for rshell, not standard syslog, and the switch does not support TCP syslog without additional configuration.

Full explanation →
550
Drag & Dropmedium

Drag and drop the steps of Control Plane Policing (CoPP) rate-limit evaluation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

CoPP first classifies traffic using an access list, then matches it to a class map, then applies a policy map with a police action (rate-limit), activates the policy on the control plane, and finally the hardware performs policing.

Full explanation →
551
Drag & Dropmedium

Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

sFlow begins with the agent sampling packets at a configured rate, then extracts header and counter information, encapsulates the sample into an sFlow datagram, sends the datagram to the collector via UDP, and finally the collector analyzes the samples for monitoring.

Full explanation →
552
Matchingmedium

Drag and drop each flow record field on the left to its matching category (key or non-key) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Key field

Key field

Key field

Non-key field

Non-key field

Why these pairings

Key fields define the flow identity (e.g., IP addresses, ports, protocol). Non-key fields provide additional information about the flow (e.g., packet counts, timestamps, TCP flags).

Full explanation →
553
MCQmedium

Router R6 has the following OSPF configuration: router ospf 1 router-id 6.6.6.6 network 192.168.0.0 0.0.255.255 area 0 passive-interface default no passive-interface GigabitEthernet0/0 ! interface GigabitEthernet0/0 ip address 192.168.1.6 255.255.255.0 ip ospf 1 area 0 What is the effect of the 'passive-interface default' command?

A.All OSPF interfaces become passive, including GigabitEthernet0/0.
B.Only GigabitEthernet0/0 is active; all other OSPF interfaces are passive.
C.OSPF adjacencies are formed on all interfaces.
D.The 'passive-interface default' command is ignored because the 'network' command is used.
AnswerB

The default passive setting applies to all interfaces except those explicitly set to 'no passive-interface'.

Why this answer

The 'passive-interface default' command sets all OSPF interfaces to passive by default, meaning they will not send or receive OSPF hello packets and thus cannot form adjacencies. The subsequent 'no passive-interface GigabitEthernet0/0' overrides this for that specific interface, making it the only active OSPF interface. This matches option B.

Exam trap

Cisco often tests the interaction between 'passive-interface default' and 'no passive-interface' to see if candidates understand that the default command applies to all interfaces and must be explicitly overridden per interface, rather than assuming the 'network' command alone controls adjacency formation.

How to eliminate wrong answers

Option A is wrong because the 'no passive-interface GigabitEthernet0/0' command explicitly overrides the default passive setting for that interface, so not all interfaces become passive. Option C is wrong because OSPF adjacencies are only formed on interfaces that are not passive; with 'passive-interface default', only GigabitEthernet0/0 is active, so adjacencies form only on that interface. Option D is wrong because the 'passive-interface default' command is not ignored; it works in conjunction with the 'network' command, which defines which interfaces participate in OSPF, but the passive setting controls whether hellos are sent and adjacencies are formed on those interfaces.

Full explanation →
554
Multi-Selectmedium

Which two statements about Cisco DNA Center automation workflows are true? (Choose two.)

Select 2 answers
A.Cisco DNA Center supports Plug and Play (PnP) for zero-touch device onboarding.
B.Cisco DNA Center uses template-based provisioning to apply consistent configurations across devices.
C.Cisco DNA Center only supports GUI-based configuration; CLI access is not available.
D.Cisco DNA Center automates configuration of all network devices, including third-party switches.
E.Cisco DNA Center uses SNMP to push configuration changes to devices.
AnswersA, B

Correct because PnP is a built-in feature of DNA Center that automates the initial deployment of new devices without manual intervention.

Why this answer

Cisco DNA Center uses intent-based APIs and templates to automate network provisioning. The correct answers highlight key automation capabilities: PnP for zero-touch deployment and template-based provisioning for consistent configuration. The incorrect options misrepresent the GUI-only nature (CLI is also available via templates), the role of Assurance (monitoring, not configuration), the scope of SD-Access (fabric, not all devices), and the integration method (REST APIs, not SNMP).

Full explanation →
555
Multi-Selectmedium

Which three statements about NAT traversal and translation are true? (Choose three.)

Select 3 answers
A.IPsec NAT traversal uses UDP encapsulation on port 4500 to allow ESP traffic to pass through a NAT device.
B.The ip nat outside source command translates the source IP address of packets arriving on the outside interface.
C.NAT can translate both source and destination IP addresses in the same packet for different translation rules.
D.NAT automatically translates IP addresses embedded in application-layer payloads such as FTP or SIP.
E.The ip nat inside destination command translates the destination MAC address of packets entering the inside interface.
AnswersA, B, C

Correct because NAT-T encapsulates ESP in UDP port 4500 to avoid issues with NAT modifying the IP header.

Why this answer

NAT traversal for IPsec uses UDP encapsulation (4500) to allow ESP through NAT devices. NAT can translate both source and destination addresses simultaneously in different scenarios. The ip nat outside source command translates source addresses of packets entering the outside interface.

NAT can cause issues with applications that embed IP addresses in payload (e.g., FTP, SIP). NAT does not translate MAC addresses, only IP and port information. The ip nat inside destination command translates destination addresses of packets entering the inside interface.

Full explanation →
556
MCQmedium

Consider the following configuration: router bgp 65000 bgp router-id 192.168.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 ebgp-multihop 2 neighbor 10.0.0.2 update-source Loopback0 ! interface Loopback0 ip address 192.168.0.1 255.255.255.255 What is missing for this BGP session to establish?

A.A route to reach 10.0.0.2 is missing; the neighbor must be reachable via the routing table.
B.The ebgp-multihop value should be 1 for a directly connected neighbor.
C.The remote-as must be the same as the local AS for EBGP.
D.The router-id must be the same as the update-source interface IP.
AnswerA

BGP requires TCP connectivity; without a route to the neighbor's IP, the session cannot form.

Why this answer

For an eBGP session to establish, the neighbor IP address (10.0.0.2) must be reachable via the routing table. The configuration uses `ebgp-multihop 2` and an update-source of Loopback0, but there is no route (static or dynamic) to reach 10.0.0.2, so the TCP connection cannot be initiated. Without reachability, BGP will remain in the Idle state.

Exam trap

Cisco often tests the misconception that ebgp-multihop alone ensures connectivity, but the trap here is that candidates forget BGP requires IP reachability in the routing table for the neighbor address, not just a configured multihop value.

How to eliminate wrong answers

Option B is wrong because ebgp-multihop 2 is correctly used when the neighbor is not directly connected (e.g., using loopback interfaces); setting it to 1 would assume a directly connected interface, which is not the case here. Option C is wrong because for eBGP, the remote-as must be different from the local AS (65000 vs 65001), so stating it must be the same is incorrect. Option D is wrong because the router-id does not need to match the update-source interface IP; the router-id is used for BGP identifier purposes and can be any unique IP, while the update-source specifies which interface's IP to use for the TCP connection.

Full explanation →
557
Drag & Dropmedium

Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The workflow begins by importing required modules (threading and Netmiko), defining a function for device connection and command execution, creating a list of devices, then using threading.Thread to spawn threads for each device, and finally joining threads to wait for completion.

Full explanation →
558
Drag & Dropmedium

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

Full explanation →
559
Drag & Dropmedium

Drag and drop the steps of syslog message generation and storage into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

A process or kernel generates a syslog message with a facility and severity, the syslogd daemon compares the severity to the configured logging level, then writes the message to the local buffer, optionally forwards it to a remote syslog server, and finally the message is stored or displayed.

Full explanation →
560
Drag & Dropmedium

Drag and drop the steps of MPLS L2VPN (AToM) pseudowire setup into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

AToM pseudowire setup starts with configuring the attachment circuit on both PE routers. Then a pseudowire class is defined, specifying encapsulation and control word. The VC label is signaled via LDP, and the pseudowire is bound to the attachment circuit.

Finally, the pseudowire becomes operational and forwards L2 frames.

Full explanation →
561
Drag & Drophard

Drag and drop the steps of DMVPN phase 2 spoke-to-spoke tunnel establishment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In DMVPN phase 2, each spoke first registers with the hub via mGRE and NHRP. When a spoke wants to reach another spoke, it sends an NHRP Resolution Request to the hub. The hub forwards the request to the destination spoke, which replies with its real (non-NBMA) address.

The source spoke then initiates a direct mGRE tunnel to the destination spoke, and finally the spokes exchange routing information over the direct tunnel.

Full explanation →
562
Matchinghard

Drag and drop each Ansible variable precedence level on the left to its matching scope on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Highest precedence, passed via --extra-vars on command line

Lowest precedence, defined in defaults/main.yml of a role

Variables specific to a single host, defined in host_vars/

Variables applied to all hosts in a group, defined in group_vars/

Variables defined in the vars: section of a play

Why these pairings

Extra-vars override all others, role defaults have lowest precedence, host vars apply per host, group vars apply per group, and play vars apply to the entire play.

Full explanation →
563
MCQmedium

A network engineer runs the following command on Switch SW1: SW1# show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?

A.The EtherChannel is using PAgP.
B.Port Gi0/3 is bundled in the channel.
C.The port-channel is a Layer 3 interface.
D.The EtherChannel has two active member links.
AnswerD

Gi0/1 and Gi0/2 are marked P (bundled), so two links are active.

Why this answer

The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Exam trap

Cisco often tests the interpretation of the 'show etherchannel summary' flags, where candidates mistakenly assume a port listed in the output is active, ignoring the specific flag character (e.g., 'D' vs 'P').

How to eliminate wrong answers

Option A is wrong because the protocol column explicitly shows 'LACP', not PAgP. Option B is wrong because Gi0/3 has a flag of 'D' (down), not 'P' (bundled), meaning it is not part of the active bundle. Option C is wrong because the 'S' in 'Po1(SU)' indicates Layer 2, not Layer 3 (which would be 'R').

Full explanation →
564
MCQeasy

A REST API call is made to Cisco DNA Center to get the list of network devices: GET /dna/intent/api/v1/network-device Headers: X-Auth-Token: <token> The response is: { "response": [ { "id": "123456", "managementIpAddress": "10.10.10.1", "platformId": "C9300-24P", "role": "ACCESS" } ], "version": "1.0" } What does this response indicate?

A.The response contains a single device with management IP 10.10.10.1 and role ACCESS.
B.The response indicates an error because the 'version' field is missing a value.
C.The response contains multiple devices, but only one is shown due to pagination.
D.The response requires authentication because the token is missing.
AnswerA

The JSON array has one element with the given fields.

Why this answer

The response is a valid JSON object from Cisco DNA Center's REST API. The 'response' array contains one device object with fields 'id', 'managementIpAddress', 'platformId', and 'role'. The 'version' field is informational and correctly present.

Therefore, option A correctly interprets the response as containing a single device with management IP 10.10.10.1 and role ACCESS.

Exam trap

Cisco often tests the misconception that a missing or incomplete 'version' field indicates an error, but in reality, the 'version' field is always present and valid in successful DNA Center API responses.

How to eliminate wrong answers

Option B is wrong because the 'version' field is present with a value of '1.0', so it is not missing; the response is valid. Option C is wrong because the response shows a single object in the 'response' array, not multiple devices; pagination would be indicated by additional fields like 'totalCount' or 'pageSize', which are absent. Option D is wrong because the request includes the 'X-Auth-Token' header with a token value, so authentication is already provided; the response does not indicate any authentication error.

Full explanation →
565
Drag & Dropmedium

Drag and drop the steps of Netconf/Yang-based device monitoring subscription into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First establish NETCONF session, then subscribe to YANG data, then receive periodic updates, and finally unsubscribe.

Full explanation →
566
MCQhard

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

A.Centralized WLC architecture, because it provides better RF management and security.
B.Converged access (SD-Access) wireless, because it allows local switching of traffic at the access layer, reducing latency.
C.Centralized WLC architecture, because it requires fewer access points to cover the warehouse.
D.Converged access (SD-Access) wireless, because it requires fewer WLCs to manage the network.
AnswerB

Correct because SD-Access wireless enables local switching, which minimizes latency for real-time traffic by avoiding backhaul to a central WLC.

Why this answer

Converged access (SD-Access) wireless enables local switching of traffic at the access layer, which eliminates the need to hairpin traffic through a centralized WLC. This reduces latency significantly, which is critical for real-time applications like voice and video in high-density warehouse environments. Centralized CAPWAP tunnels would add unnecessary delay by forcing all traffic back to the WLC.

Exam trap

Cisco often tests the misconception that centralized WLC is always better for RF management and security, but the trap here is ignoring the latency requirements of real-time applications, which favor local switching in SD-Access wireless.

How to eliminate wrong answers

Option A is wrong because while centralized WLC architecture does provide centralized RF management and security, it introduces higher latency due to CAPWAP encapsulation and hairpinning of all traffic to the WLC, which is detrimental to real-time voice and video. Option C is wrong because the number of access points required is determined by coverage and capacity needs, not the architecture choice; centralized WLC does not inherently require fewer APs. Option D is wrong because converged access (SD-Access) wireless does not necessarily reduce the number of WLCs; it may even require additional fabric controllers, and the primary benefit is local switching, not WLC count reduction.

Full explanation →
567
MCQmedium

interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network broadcast ip ospf priority 0 ! router ospf 1 network 192.168.1.0 0.0.0.255 area 0 What is the effect of setting the OSPF priority to 0 on this interface?

A.The router will never become the DR or BDR on this segment.
B.The router will have a higher chance of becoming the DR.
C.The router will only form adjacencies with other routers that have priority 0.
D.The router will use a longer hello interval.
AnswerA

Correct. A priority of 0 means the router is ineligible for DR/BDR election.

Why this answer

Setting the OSPF priority to 0 on an interface prevents the router from participating in the Designated Router (DR) and Backup Designated Router (BDR) election process. This means the router will never become the DR or BDR on that broadcast segment, as per RFC 2328. It will instead remain a DROTHER and only form full adjacencies with the DR and BDR, not with other DROTHER routers.

Exam trap

Cisco often tests the misconception that priority 0 means 'lowest priority' or 'least likely to become DR,' when in fact it means 'ineligible to become DR or BDR' — a binary disqualification, not a comparative value.

How to eliminate wrong answers

Option B is wrong because a priority of 0 eliminates the chance of becoming DR, not increases it; higher priority values (1-255) increase the chance. Option C is wrong because OSPF routers with priority 0 still form adjacencies with the DR and BDR, not only with other priority 0 routers; DROTHER routers do not form full adjacencies with each other. Option D is wrong because the hello interval is configured independently via the 'ip ospf hello-interval' command and is not affected by the priority setting.

Full explanation →
568
Matchingmedium

Drag and drop each WAN technology on the left to its matching layer on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Layer 2.5

Layer 2

Layer 3 and above

Layer 3

Layer 3

Why these pairings

MPLS operates at Layer 2.5 (shim header between Layer 2 and Layer 3). Metro Ethernet is a Layer 2 technology. SD-WAN abstracts the underlay and operates at Layer 3 and above.

DMVPN is a Layer 3 VPN overlay.

Full explanation →
569
MCQeasy

A network engineer is planning to use Cisco DNA Center to automate the deployment of a new branch office. The engineer has already discovered the devices and added them to Inventory. The engineer wants to use a template to configure the devices consistently. Which tool in DNA Center should the engineer use to create and apply the template?

A.Use the 'Template Editor' to create a CLI template and apply it during provisioning.
B.Use the 'Policy Editor' to create a policy-based configuration.
C.Use the 'Command Runner' to execute commands on multiple devices.
D.Use the 'Network Profiles' to define the configuration.
AnswerA

Correct because Template Editor is designed for creating and applying configuration templates in DNA Center.

Why this answer

Cisco DNA Center includes a feature called 'Template Editor' (or 'Network Templates') that allows engineers to create CLI templates for device configuration. These templates can be parameterized and applied to devices during provisioning, ensuring consistent configuration across the branch.

Full explanation →
570
MCQmedium

Examine the following configuration: interface Port-channel1 switchport mode trunk ! interface GigabitEthernet0/1 switchport mode trunk channel-group 1 mode active spanning-tree portfast ! interface GigabitEthernet0/2 switchport mode trunk channel-group 1 mode active spanning-tree portfast What is the effect of the 'spanning-tree portfast' command on the member interfaces of this EtherChannel?

A.The PortFast will be applied to the EtherChannel, causing it to immediately transition to forwarding.
B.The PortFast on the member interfaces will be ignored because they are part of an EtherChannel.
C.The PortFast will cause the EtherChannel to form faster.
D.The configuration will cause a spanning-tree loop because PortFast is used on trunk ports.
AnswerB

Correct. When interfaces are bundled into an EtherChannel, STP is handled at the port-channel level, and per-interface PortFast is overridden.

Why this answer

When interfaces are configured as members of an EtherChannel, any spanning-tree configuration applied directly to the member interfaces (such as 'spanning-tree portfast') is ignored. Spanning-tree operates on the logical port-channel interface, not the individual physical members. Therefore, the PortFast command on GigabitEthernet0/1 and GigabitEthernet0/2 has no effect; instead, PortFast must be configured on the Port-channel interface itself to apply to the bundle.

Exam trap

Cisco often tests the misconception that STP features configured on physical interfaces are inherited by the EtherChannel, when in fact they are ignored and must be applied to the logical port-channel interface.

How to eliminate wrong answers

Option A is wrong because PortFast is not applied to the EtherChannel from the member interfaces; it is ignored, so the EtherChannel does not immediately transition to forwarding. Option C is wrong because PortFast on member interfaces does not cause the EtherChannel to form faster; EtherChannel formation depends on LACP or PAgP negotiation, not PortFast. Option D is wrong because using PortFast on trunk ports does not inherently cause a spanning-tree loop; loops are prevented by spanning-tree itself, and PortFast simply bypasses the listening/learning states on access or trunk ports (with caution), but here it is ignored entirely.

Full explanation →
571
Multi-Selectmedium

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

Select 3 answers
A.Use a channel reuse plan that minimizes co-channel interference.
B.Prefer the 5 GHz band over 2.4 GHz for client connectivity.
C.Lower AP transmit power to reduce cell size and increase capacity.
D.Increase AP transmit power to maximize coverage.
E.Enable 2.4 GHz band only to maximize range.
AnswersA, B, C

Proper channel planning is essential in high-density environments.

Why this answer

A channel reuse plan that minimizes co-channel interference is essential in high-density environments to ensure that adjacent access points (APs) do not use the same or overlapping channels, which would degrade throughput. By carefully planning channel assignments (e.g., using non-overlapping channels in the 5 GHz band), you maximize spatial reuse and overall network capacity.

Exam trap

Cisco often tests the misconception that increasing AP transmit power always improves coverage and performance, when in fact, in high-density environments, lowering power and reducing cell size is the correct strategy to increase capacity and minimize interference.

Full explanation →
572
MCQmedium

A network engineer runs the following command on Router R8: R8# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Based on this output, what can be concluded?

A.Voice traffic is being prioritized but not policed.
B.The interface is not passing any traffic.
C.Data traffic is being dropped due to policing.
D.The policy-map is applied to input traffic.
AnswerB

All counters are zero, indicating no traffic has been forwarded.

Why this answer

The output shows all counters at zero for every class, including the class-default, and the '5 minute offered rate' is 0 bps for all classes. This indicates that no packets have been processed by this policy-map on GigabitEthernet0/1, meaning the interface is not passing any traffic. The presence of policing and queuing configurations does not imply traffic is being dropped; the counters confirm zero activity.

Exam trap

Cisco often tests the ability to interpret zero counters in QoS output, trapping candidates who assume that configured policies (like policing or queuing) are actively dropping or shaping traffic without verifying the actual packet counts.

How to eliminate wrong answers

Option A is wrong because the output explicitly shows a police command under the VOICE class with a CIR of 1000000 bps, meaning voice traffic is both prioritized (strict priority queue) and policed. Option B is correct as explained. Option C is wrong because the DATA class shows zero packets, zero drops, and a drop rate of 0 bps, indicating no traffic has been processed, let alone dropped due to policing.

Option D is wrong because the output states 'Service-policy output: QOS_POLICY', which means the policy-map is applied in the output direction, not input.

Full explanation →
573
MCQmedium

A network engineer runs the following command on Switch SW5: SW5# show running-config | section interface port-channel interface Port-channel1 switchport mode trunk switchport trunk allowed vlan 1-100,200-300 ! interface Port-channel2 switchport mode access switchport access vlan 10 ! SW5# show interfaces trunk Port Mode Encapsulation Status Native vlan Po1 on 802.1q trunking 1 Port Vlans allowed on trunk Po1 1-100,200-300 Port Vlans allowed and active in management domain Po1 1-100,200-300 Port Vlans in spanning tree forwarding state and not pruned Po1 1-100,200-300 Based on this output, what can be concluded?

A.Port-channel2 is also trunking but not displayed due to a software bug.
B.Port-channel1 is trunking and allowed VLANs include VLANs 101-199.
C.Port-channel1 is operational as a trunk with the configured allowed VLANs.
D.The native VLAN on Po1 is VLAN 10.
AnswerC

The trunk output confirms the trunk is up and the allowed VLAN list matches.

Why this answer

The 'show interfaces trunk' output confirms that Port-channel1 is trunking with an operational status of 'trunking', and the 'Vlans allowed on trunk' line matches the configured allowed VLANs (1-100,200-300). This indicates the trunk is up and functioning with the intended VLAN list, making option C correct.

Exam trap

Cisco often tests the distinction between trunk and access port behavior, and the trap here is assuming that a port-channel with an access configuration will still appear in trunk output or that the native VLAN can be inferred from the access VLAN configuration.

How to eliminate wrong answers

Option A is wrong because Port-channel2 is configured as an access port (switchport mode access), so it will not appear in the 'show interfaces trunk' output, which only displays trunk ports; there is no software bug. Option B is wrong because the allowed VLANs explicitly exclude VLANs 101-199, as shown in the configuration and trunk output (only 1-100 and 200-300 are allowed). Option D is wrong because the native VLAN on Po1 is VLAN 1, as indicated by the 'Native vlan' column in the trunk output, not VLAN 10.

Full explanation →
574
Multi-Selectmedium

Which two statements about DMVPN Phase 2 are true? (Choose two.)

Select 2 answers
A.Spokes can establish direct tunnels to each other without traversing the hub.
B.All traffic must pass through the hub router at all times.
C.NHRP is used to resolve the public IP addresses of spokes.
D.Phase 2 uses only point-to-point GRE tunnels on the hub.
E.Phase 2 does not support dynamic routing protocols between spokes.
AnswersA, C

Correct because Phase 2 enables spoke-to-spoke dynamic tunnels.

Why this answer

DMVPN Phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses mGRE on spokes, and supports dynamic routing between spokes. NHRP is used for resolution.

Full explanation →
575
Multi-Selecthard

Which three statements about IP SLA threshold monitoring and reaction configuration are true? (Choose three.)

Select 3 answers
A.The 'threshold' command sets the rising threshold that triggers a reaction when exceeded.
B.The 'reaction' configuration can specify an action such as 'connection-loss' to trigger when the probe fails to receive a response.
C.The IP SLA reaction can be used to update a tracking object, which can then influence policy-based routing or static route removal.
D.The 'reaction' command supports a 'timeout' type that triggers when the probe response time exceeds a configured value.
E.The 'reaction' command can only monitor round-trip time and cannot be used for jitter or packet loss.
AnswersA, B, C

Correct because the 'threshold' command defines the upper boundary; when the measured value exceeds it, the reaction is triggered.

Why this answer

IP SLA allows configuring rising and falling thresholds to trigger events. The reaction can be tied to a tracking object, which can then influence routing decisions. The 'connection-loss' type triggers when all probes fail.

The 'timeout' reaction is not a valid type; the correct keyword is 'timeout' within the threshold configuration. The 'react' command can also monitor jitter values.

Full explanation →
576
Drag & Dropmedium

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

VTP requires setting mode and domain before trunking works; verification confirms operation.

Full explanation →
577
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.2 1 FULL/DR 00:00:32 192.168.1.2 GigabitEthernet0/0 10.0.0.3 1 2WAY/DROTHER 00:00:35 192.168.1.3 GigabitEthernet0/0 Based on this output, what can be concluded?

A.R1 is the Backup Designated Router (BDR) on this segment.
B.R1 has a full OSPF adjacency with the neighbor 10.0.0.3.
C.R1 is a DROTHER on this segment.
D.The OSPF network type is point-to-point.
AnswerC

Since the DR is 10.0.0.2 and the BDR is not listed, and R1 has a full adjacency only with the DR, R1 must be a DROTHER.

Why this answer

The output shows R1 has a neighbor with state 2WAY/DROTHER (10.0.0.3), which indicates that R1 is also a DROTHER on this broadcast multiaccess segment. The FULL/DR neighbor (10.0.0.2) is the Designated Router, and since R1 is not the BDR (no FULL/BDR state), it must be a DROTHER.

Exam trap

Cisco often tests the misconception that 2WAY state means a full adjacency, but in OSPF, 2WAY is a normal neighbor state on broadcast networks between DROTHERs, not a full adjacency (which requires FULL state).

How to eliminate wrong answers

Option A is wrong because R1 is not the BDR; the BDR would appear with state FULL/BDR, but the only FULL neighbor is the DR (10.0.0.2). Option B is wrong because the neighbor 10.0.0.3 is in the 2WAY state, not FULL, meaning they have an established neighbor relationship but not a full adjacency (they exchange Hellos but not LSAs directly). Option D is wrong because the presence of DR/BDR states (FULL/DR, 2WAY/DROTHER) indicates a broadcast multiaccess network type, not point-to-point.

Full explanation →
578
MCQhard

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

A.The VM's virtual disk size is too small for the WAN edge image.
B.The VM's CPU type is set to 'host-passthrough' instead of 'qemu64'.
C.The boot order in the VM configuration does not have the CD-ROM (ISO) as the first device.
D.The ISO image is corrupted and NFVIS cannot read it.
AnswerC

Correct because the VM attempts to boot from the hard disk first, which is empty, leading to the error.

Why this answer

The error 'No bootable device found' indicates that the VM attempted to boot from a device that does not contain a bootable operating system. In NFVIS, when deploying a virtual WAN edge device from an ISO, the VM's boot order must be configured to prioritize the CD-ROM (ISO) device. If the boot order defaults to the virtual hard disk (which is empty before installation), the VM will fail to find a bootable medium and produce this exact error.

Exam trap

Cisco often tests the distinction between image upload errors (corruption, size) and boot process errors (boot order), leading candidates to incorrectly suspect the ISO or disk configuration when the real issue is a missing boot device priority.

How to eliminate wrong answers

Option A is wrong because the virtual disk size does not prevent the VM from booting from the ISO; the disk is only used after the OS is installed. Option B is wrong because the CPU type 'host-passthrough' is actually recommended for Cisco SD-WAN VMs on NFVIS to expose the full CPU feature set; 'qemu64' would be a less compatible choice. Option D is wrong because if the ISO were corrupted, NFVIS would typically report a checksum or mount error, not a 'No bootable device found' message, which specifically points to boot order misconfiguration.

Full explanation →
579
MCQhard

A network engineer issues the following command on a router: R1# show tacacs TACACS+ Server: 10.1.1.10/49 Socket opens: 5 Socket closes: 3 Socket aborts: 0 Total packets sent: 10 Total packets received: 9 Retransmissions: 1 Timeouts: 1 Current idle time: 30 seconds Based on this output, what can be concluded?

A.The TACACS+ server is unreachable.
B.There have been no authentication attempts.
C.The TACACS+ server experienced a single timeout.
D.All packets were successfully acknowledged.
AnswerC

The timeout count is 1, indicating one packet timed out.

Why this answer

The output shows 'Timeouts: 1', which indicates that exactly one TACACS+ request did not receive a response within the expected time. This confirms that the TACACS+ server experienced a single timeout, making option C correct. The server is reachable (socket opens/closes show successful connections), and authentication attempts have occurred (total packets sent/received).

Exam trap

Cisco often tests the distinction between 'timeouts' and 'server unreachable' — candidates may incorrectly assume a timeout means the server is unreachable, but the output clearly shows successful socket opens, proving the server is reachable and the timeout was a single failed request.

How to eliminate wrong answers

Option A is wrong because the output shows socket opens (5) and socket closes (3), indicating successful TCP connections to the server, so it is reachable. Option B is wrong because total packets sent (10) and received (9) prove authentication attempts have occurred. Option D is wrong because the retransmission count (1) and timeout count (1) indicate that not all packets were successfully acknowledged; one packet timed out.

Full explanation →
580
Drag & Dropmedium

Drag and drop the steps of Metro Ethernet E-Line service provisioning into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

E-Line provisioning starts with defining the service attributes and customer endpoints. The provider then configures the UNI on each customer edge device. Next, the EVC is created across the provider network to connect the two UNIs.

Finally, the service is tested and activated for the customer.

Full explanation →
581
MCQmedium

A network engineer runs the following command on Router R6: R6# show mpls ldp neighbor 10.6.6.7 detail Peer LDP Ident: 10.6.6.7:0; Local LDP Ident 10.6.6.6:0 TCP connection: 10.6.6.7.646 - 10.6.6.6.179 State: Oper; Msgs sent/rcvd: 200/195; Downstream Up time: 1d04h LDP discovery sources: Targeted Hello 10.6.6.6 -> 10.6.6.7, active, passive Addresses bound to peer LDP Ident: 10.6.6.7 192.168.6.7 Hold time: 15 seconds; keepalive interval: 5 seconds Peer hold time: 15 seconds; keepalive interval: 5 seconds Based on this output, what type of LDP session is this?

A.This is a link-local LDP session because the discovery source is an interface.
B.This is a targeted LDP session established between two non-directly connected routers.
C.This is a multicast LDP session because the hold time is 15 seconds.
D.This is a BGP session because the TCP connection shows port 179.
AnswerB

Targeted hellos are used for non-directly connected peers, and the output confirms targeted discovery.

Why this answer

The output shows a targeted hello (10.6.6.6 -> 10.6.6.7) as the LDP discovery source, and the TCP connection uses port 646 (LDP) on one side and port 179 (BGP) on the other. This indicates the session is established between two routers that are not directly connected (non-adjacent), which is the definition of a targeted LDP session. The presence of 'active, passive' in the discovery source confirms that one router initiated the targeted hello and the other responded.

Exam trap

Cisco often tests the distinction between link-local (directly connected) and targeted (non-directly connected) LDP sessions, and the trap here is that candidates see port 179 and assume it is BGP, when in fact it is a targeted LDP session using a non-standard TCP port.

How to eliminate wrong answers

Option A is wrong because the discovery source is a targeted hello, not an interface; link-local LDP sessions use interface-based hellos (multicast to 224.0.0.2) between directly connected neighbors. Option C is wrong because LDP does not use multicast sessions; the hold time of 15 seconds is a standard LDP timer, not an indicator of session type. Option D is wrong because the TCP connection shows port 646 (LDP) on the remote side and port 179 (BGP) on the local side, but this is a common misconfiguration or observation in targeted LDP where the local router uses a BGP port number; the session is still LDP, not BGP.

Full explanation →
582
MCQeasy

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

A.30 seconds
B.60 seconds
C.120 seconds
D.10 seconds
AnswerB

The default quiet-period is 60 seconds.

Why this answer

The default quiet-period timer in Cisco IOS 802.1X configuration is 60 seconds. This timer defines the period the switch waits after a failed authentication attempt before re-initiating authentication with the same supplicant. It prevents repeated authentication attempts from overwhelming the switch and the RADIUS server.

Exam trap

Cisco often tests the quiet-period timer by confusing it with the tx-period (10 seconds) or the re-authentication timer (30 seconds), so candidates must memorize the exact default values for each distinct 802.1X timer.

How to eliminate wrong answers

Option A (30 seconds) is wrong because it is the default value for the re-authentication timer, not the quiet-period timer. Option C (120 seconds) is wrong because it is not a default timer value in 802.1X; it might be confused with the server timeout or a manually configured value. Option D (10 seconds) is wrong because it is the default value for the tx-period timer, which controls how often EAP-Request/Identity frames are retransmitted to a supplicant that has not responded.

Full explanation →
583
Matchingmedium

Drag and drop each streaming telemetry mode on the left to its matching trigger on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Data is sent at a fixed interval

Data is sent only when a value changes

The device decides when to send data

On-change with additional suppression rules

Combination of periodic and on-change triggers

Why these pairings

Periodic sends at intervals, on-change sends on value change, target-defined leaves timing to the device, on-change-with-policy adds conditions, and periodic-and-on-change combines both.

Full explanation →
584
MCQmedium

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

A.The interface bandwidth command is not set to 50000 kbps
B.The voice class should use priority instead of bandwidth
C.The video class should use bandwidth remaining percent
D.The policy map is applied in the input direction
AnswerA

Correct because bandwidth percent uses the interface bandwidth value; if it is set to a default (e.g., 1000000 for Ethernet), the percentages do not match the actual link speed.

Why this answer

The bandwidth percent command allocates a percentage of the interface bandwidth, which by default is derived from the physical interface speed. On a Cisco ASR 1000, if the interface bandwidth is not manually set to 50000 kbps, the router may use a different default value (e.g., 1000000 kbps for Ethernet), causing the bandwidth percent to allocate a much larger absolute amount than intended. This leads to incorrect bandwidth guarantees, such as voice not receiving its required 10 Mbps during congestion.

Exam trap

Cisco often tests the misconception that bandwidth percent always uses the physical link speed, when in fact it uses the interface bandwidth value, which must be explicitly set if the link speed differs from the default.

How to eliminate wrong answers

Option B is wrong because using priority instead of bandwidth would give voice strict priority queuing, which could starve other classes but does not address the root cause of incorrect bandwidth allocation due to the interface bandwidth mismatch. Option C is wrong because bandwidth remaining percent is used for distributing leftover bandwidth after priority queues, but the issue here is that the base bandwidth percentage is miscalculated, not that video needs a different allocation method. Option D is wrong because applying the policy map in the input direction would affect inbound traffic, but the problem is about outbound bandwidth guarantees during congestion; QoS typically shapes or polices inbound traffic differently, and the scenario implies outbound congestion.

Full explanation →
585
Matchingmedium

Drag and drop each VRF component on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Uniquely identifies a VRF to allow overlapping IPv4 prefixes

Determines which routes are imported into or exported from a VRF

Stores all routes learned within a specific VRF

Holds routes for the default or global routing table

Used by hardware to make forwarding decisions based on the RIB

Why these pairings

Route Distinguisher (RD) makes IPv4 prefixes unique across VRFs; Route Target (RT) controls import/export of routes; the VRF RIB stores routes learned within that VRF; the global RIB holds routes for the global routing table; the FIB is used for forwarding decisions.

Full explanation →
586
Multi-Selecthard

Which three statements about BGP route reflectors are true? (Choose three.)

Select 3 answers
A.Route reflectors reduce the number of required iBGP sessions in an AS.
B.A route reflector client must be fully meshed with all other clients.
C.The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes.
D.The ORIGINATOR_ID attribute is used to prevent routing loops in a route reflector environment.
E.Non-client peers of a route reflector must be fully meshed with each other.
AnswersA, C, D

Correct because route reflectors allow a hub-and-spoke topology, reducing sessions.

Why this answer

Route reflectors reduce the number of required iBGP sessions by allowing clients to peer only with the route reflector. The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes, preserving path information. The ORIGINATOR_ID attribute is used to prevent routing loops by identifying the originator of a route.

Option E is incorrect because non-client peers of a route reflector do not need to be fully meshed; they may be clients of other route reflectors, and the full mesh requirement applies only to iBGP speakers that are not clients of any route reflector.

Full explanation →
587
Matchingmedium

Drag and drop each ERSPAN version on the left to its correct header format description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

4-byte GRE header with 4-byte session ID

4-byte GRE header with 8-byte ERSPAN header

4-byte GRE header with 12-byte ERSPAN header

Indicates ERSPAN encapsulated packet

Optionally included in ERSPAN Type II/III

Why these pairings

ERSPAN Type I uses a 4-byte GRE header with 4-byte session ID; ERSPAN Type II uses a 4-byte GRE header with an 8-byte ERSPAN header; ERSPAN Type III uses a 4-byte GRE header with a 12-byte ERSPAN header.

Full explanation →
588
MCQmedium

Consider the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet0/3 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 1 What is the effect of this configuration?

A.The interface will operate as an 802.1Q trunk, and untagged frames will be associated with VLAN 1.
B.The interface will operate as an ISL trunk.
C.The interface will drop all untagged frames.
D.The interface will only forward traffic for VLAN 1.
AnswerA

Correct. The native VLAN is 1, so untagged frames belong to VLAN 1.

Why this answer

The configuration sets the interface to 802.1Q trunking mode and explicitly defines VLAN 1 as the native VLAN. On an 802.1Q trunk, the native VLAN is the VLAN to which untagged frames are assigned when received on the trunk port. Since VLAN 1 is the default native VLAN and is explicitly configured here, untagged frames will be associated with VLAN 1, allowing them to traverse the trunk without an 802.1Q tag.

Exam trap

Cisco often tests the misconception that a trunk port drops untagged frames or that the native VLAN is only for management traffic, when in fact untagged frames are always associated with the native VLAN on an 802.1Q trunk.

How to eliminate wrong answers

Option B is wrong because the command 'switchport trunk encapsulation dot1q' explicitly sets the trunking protocol to 802.1Q, not ISL; ISL is a Cisco-proprietary encapsulation that is not supported on modern IOS-XE switches and would require 'switchport trunk encapsulation isl'. Option C is wrong because an 802.1Q trunk does not drop untagged frames; instead, it assigns them to the native VLAN (VLAN 1 by default or as configured). Option D is wrong because the interface is configured as a trunk, which forwards traffic for multiple VLANs (all allowed VLANs by default), not only VLAN 1; the native VLAN setting only affects how untagged frames are handled, not the scope of VLANs forwarded.

Full explanation →
589
Drag & Dropmedium

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

Full explanation →
590
Drag & Dropmedium

Drag and drop the steps of GET VPN key server registration and rekey into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In GET VPN, the group member first registers with the key server using ISAKMP. The key server authenticates the member and pushes the initial policy and key. After registration, the key server periodically sends rekey messages to update the group encryption key.

The group member acknowledges the rekey, and then both sides install the new key for ongoing encryption.

Full explanation →
591
Drag & Dropmedium

Drag and drop the steps of Multicast RP discovery using Auto-RP into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Auto-RP uses a mapping agent to discover RPs. Candidate RPs announce their services to a well-known group (224.0.1.39). The mapping agent collects these announcements and sends RP-to-group mappings to another group (224.0.1.40).

Routers then learn the RP for each group.

Full explanation →
592
MCQeasy

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

A.Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
B.Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.
C.Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.
D.Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.
AnswerA

This is the fundamental architectural difference.

Why this answer

Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Exam trap

Cisco often tests the misconception that Type 2 hypervisors are more secure due to an additional OS layer, but the trap here is that the extra layer actually increases the attack surface and reduces security isolation compared to a Type 1 hypervisor.

How to eliminate wrong answers

Option B is wrong because Type 1 hypervisors include their own built-in device drivers and do not require a host OS for device drivers; Type 2 hypervisors rely on the host OS for driver support. Option C is wrong because Type 2 hypervisors are generally less secure than Type 1 due to the larger attack surface introduced by the host OS layer, not more secure. Option D is wrong because Type 1 hypervisors fully support hardware passthrough (e.g., PCIe passthrough via Intel VT-d or AMD IOMMU), while Type 2 hypervisors often have limited or more complex passthrough support due to the host OS abstraction.

Full explanation →
593
Drag & Dropmedium

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

LLQ for voice requires first classifying voice traffic, then creating a policy map with a priority queue, applying it to the interface, and verifying the configuration. The priority queue ensures low latency for voice packets.

Full explanation →
594
Drag & Dropmedium

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Validation begins with loading the YANG model, then using the tool to check path syntax, verifying existence, and confirming with device capabilities.

Full explanation →
595
Matchingmedium

Drag and drop each EAP method on the left to its matching authentication type on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Certificate-based mutual authentication

Tunneled authentication with MSCHAPv2

Protected Access Credential (PAC) based

Simple password hash (no server certificate)

Generic Token Card (one-time password)

Why these pairings

EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses PAC, EAP-MD5 uses simple password hash.

Full explanation →
596
Drag & Dropmedium

Drag and drop the steps of EIGRP named mode configuration steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

EIGRP named mode uses an address-family configuration. First, create the named EIGRP instance, then enter address-family IPv4, configure the network, optionally adjust timers, and finally verify the configuration.

Full explanation →
597
MCQmedium

A network engineer is troubleshooting an EtherChannel between two Cisco switches. The show etherchannel 1 port-channel command shows the port-channel is up, but traffic is not load-balanced evenly. The engineer notices that all traffic is using only one link. The physical ports are all configured identically. What is the most likely cause?

A.The load-balancing method is set to src-mac, and the traffic is from multiple MAC addresses.
B.The load-balancing method is set to src-dst-ip, and all traffic is between the same two IP addresses.
C.The physical ports have different speeds.
D.The port-channel is configured with 'lacp fast-switchover'.
AnswerB

Correct because src-dst-ip hashes on source and destination IP; if they are the same, all traffic goes to the same link.

Why this answer

When the load-balancing method is set to src-dst-ip, the hash is computed from the source and destination IP addresses. If all traffic flows between the same two IP addresses, the hash result will always be identical, causing all frames to be forwarded over the same physical link. This explains why the port-channel is up but only one link carries all traffic.

Exam trap

Cisco often tests the misconception that any load-balancing method will automatically distribute traffic evenly, but the trap here is that the hash algorithm's output depends on the diversity of the hashed fields—if those fields are identical for all traffic, only one link is used regardless of the method.

How to eliminate wrong answers

Option A is wrong because src-mac load balancing would hash based on source MAC addresses; if traffic comes from multiple MAC addresses, the hash would likely distribute across multiple links, not concentrate on one. Option C is wrong because the question states the physical ports are configured identically, so differing speeds cannot be the cause; moreover, EtherChannel requires all ports to have the same speed and duplex. Option D is wrong because 'lacp fast-switchover' is not a valid Cisco command or feature; LACP uses fast or slow rate for PDU transmission, but this does not affect load-balancing behavior.

Full explanation →
598
Matchingmedium

Drag and drop each queuing mechanism on the left to its matching feature on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Single queue, no differentiation

Per-flow flow-based fair queuing

User-defined traffic classes with guaranteed bandwidth

Strict priority queue with rate limiting

Always serves highest-priority queue first

Why these pairings

FIFO uses a single queue with no prioritization. WFQ provides per-flow fairness. CBWFQ allows user-defined classes.

LLQ provides strict priority with policing. PQ always services the highest-priority queue first.

Full explanation →
599
MCQhard

A network engineer runs the following command on Switch SW1: SW1# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005 Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20 Based on this output, what can be concluded?

A.VLANs 2-9 are allowed but not active on the trunk.
B.The trunk is using ISL encapsulation.
C.VLAN 1 is pruned from the trunk.
D.Only VLANs 10 and 20 are forwarding traffic.
AnswerA

The 'allowed' list includes 1-1005, but only VLANs 1,10,20 are active; thus VLANs 2-9 are allowed but not active (not created in VLAN database).

Why this answer

The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Exam trap

Cisco often tests the difference between 'allowed on trunk' and 'active in management domain' to trick candidates into thinking all allowed VLANs are forwarding, when in fact only active VLANs forward traffic.

How to eliminate wrong answers

Option B is wrong because the encapsulation is explicitly shown as '802.1q', not ISL, which is a Cisco proprietary protocol that is now largely deprecated. Option C is wrong because VLAN 1 is listed in the 'Vlans in spanning tree forwarding state and not pruned' section, indicating it is forwarding and not pruned; pruning would remove it from that list. Option D is wrong because VLAN 1 is also in the forwarding state and not pruned, so traffic for VLAN 1 is also being forwarded, not just VLANs 10 and 20.

Full explanation →
600
MCQmedium

Given the following configuration on a Cisco IOS router: policy-map SHAPE class class-default shape average 1000000 interface Serial0/0/0 service-policy output SHAPE What is the effect of this configuration?

A.The router will limit the transmit rate on Serial0/0/0 to an average of 1 Mbps by queuing excess packets.
B.The router will drop any traffic exceeding 1 Mbps on Serial0/0/0.
C.The router will mark all traffic with a rate limit of 1 Mbps but not enforce it.
D.The configuration is invalid because 'shape average' requires a class-map with a match statement.
AnswerA

Correct. Shaping buffers traffic to conform to the specified rate.

Why this answer

The configuration applies a shaping policy to the Serial0/0/0 interface, which limits the transmit rate to an average of 1 Mbps. Shaping works by queuing excess packets that exceed the configured rate, smoothing the traffic burst and preventing packet loss due to interface congestion. This is why Option A is correct.

Exam trap

Cisco often tests the distinction between shaping (queuing) and policing (dropping/remarking), so candidates mistakenly choose the dropping option (B) when they see a rate limit, not realizing shaping buffers excess traffic.

How to eliminate wrong answers

Option B is wrong because shaping does not drop traffic; it queues excess packets to enforce the rate, whereas policing would drop or remark traffic. Option C is wrong because shaping actively enforces the rate by buffering, not just marking traffic without enforcement. Option D is wrong because 'shape average' in the class-default class does not require a match statement; class-default matches all unclassified traffic by default.

Full explanation →
Page 7

Page 8 of 25

Page 9

All pages

12345678910111213141516171819202122232425

Practice 350-401 by domain

Target a specific domain to shore up weak areas.

ArchitectureVirtualizationInfrastructureNetwork AssuranceSecurityAutomation
See all domains with question counts →

Study 350-401 by topic

Focused topic pages — one weak area at a time.

BGP QuestionsOSPF QuestionsEIGRP QuestionsSD-Access QuestionsSD-WAN QuestionsACLs and CoPP QuestionsQoS QuestionsVPN QuestionsWireless QuestionsAnsible QuestionsPython Automation QuestionsREST API and YANG QuestionsMPLS QuestionsAAA QuestionsSTP QuestionsVLANs and Trunking Questions