mediumMultiple Choice
350-401 Practice Question: Issues the following command on Router R2: R2#…
A network engineer issues the following command on Router R2:
R2# show ip mroute 239.1.1.1 IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet, X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement, U - URD, I - Received Source Specific Host Report, Z - Multicast Tunnel, z - MDT-data group session, Y - Joined MDT-data group, y - Sending to MDT-data group Outgoing interface flags: H - Hardware switched, A - Assert winner Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 239.1.1.1), 00:03:45/00:02:15, RP 10.0.0.1, flags: S Incoming interface: GigabitEthernet0/0, RPF nbr 10.0.0.1 Outgoing interface list: GigabitEthernet0/1, Forward/Sparse, 00:03:45/00:02:15
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the ability to read the flags field in 'show ip mroute' output, where candidates mistakenly interpret the 'S' flag as 'SSM' instead of 'Sparse', or overlook that the 'RP' field explicitly identifies the Rendezvous Point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RP for this group is 10.0.0.1.
The output shows a (*, G) entry for 239.1.1.1 with the flags field containing 'S', which indicates Sparse Mode. The line 'RP 10.0.0.1' explicitly identifies the Rendezvous Point for this group. Therefore, option B is correct because the RP is indeed 10.0.0.1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The group is using PIM dense mode.
Why it's wrong here
The mroute table for this group shows the flag 'S', which explicitly indicates PIM Sparse-Mode (PIM-SM). Dense mode would instead display a 'D' flag, and dense-mode entries do not reference a Rendezvous Point (RP) because they forward traffic on all interfaces in the absence of explicit joins. Since the output includes an RP address (10.0.0.1) and the 'S' flag, the group is definitively running in sparse mode, making the dense-mode claim incorrect.
- ✓
The RP for this group is 10.0.0.1.
Why this is correct
The multicast routing table output for group ff2fef explicitly contains a (*,G) entry with the text 'RP 10.0.0.1', which is the Rendezvous Point address used by PIM-SM to build the shared tree. In PIM-SM, the RP is the root of the (*,G) tree; receivers join towards the RP and sources register with it. The presence of this RP statement in the output is authoritative and confirms that 10.0.0.1 is indeed the RP for this group, so the statement is correct.
- ✗
The multicast traffic is being hardware switched.
Why it's wrong here
In Cisco multicast route output, the outgoing interface flags include 'H' when the entry is hardware-switched (i.e., programmed into the forwarding hardware such as ASIC or TCAM). The shown entry does not include an 'H' flag on any interface, indicating the packet replication is being performed in software by the CPU, not in hardware. This absence of 'H' is the definitive sign that multicast traffic for this group is not hardware switched, so the claim is wrong, and it also implies potential performance limitations at high traffic rates.
- ✗
The group is a Bidir group.
Why it's wrong here
The flags field in the mroute entry shows 'S' for sparse mode, not 'B' which would specifically denote a Bidir (bidirectional) group. In Bidir PIM, the router maintains only (*,G) state with no (S,G) entries, and all traffic flows along a shared tree rooted at the RP without source registration. Since the output displays the 'S' flag and likely includes (S,G) state (as evidenced by a sparse-mode entry), and critically lacks the 'B' flag, the group cannot be Bidir. Therefore, this option is incorrect.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.