How many Show Command Output Questions questions are on this page?

This page has 9 Show Command Output Questions scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Show Command Output Questions

Practise ENCOR 350-401 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach show command output questions

These questions present the output of IOS show commands — show ip route, show interfaces, show ip ospf neighbor, show vlan brief — and ask you to interpret what they reveal about the network state. Reading IOS output accurately is one of the highest-value skills on the CCNA.

Quick answer

Show Command Output Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1

Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005

Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20

Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20

Based on this output, what can be concluded?

A
VLANs 2-9 are allowed but not active on the trunk.
The 'allowed' list includes 1-1005, but only VLANs 1,10,20 are active; thus VLANs 2-9 are allowed but not active (not created in VLAN database).
B
The trunk is using ISL encapsulation.
Why wrong: The encapsulation is shown as 802.1q.
C
VLAN 1 is pruned from the trunk.
Why wrong: VLAN 1 is in the forwarding state, so it is not pruned.
D
Only VLANs 10 and 20 are forwarding traffic.
Why wrong: VLAN 1 is also forwarding.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full BGP breakdown →

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

A
The AS-path contains the local AS number.
Why wrong: This is incorrect. While an AS-path containing the local AS number can cause routes to be rejected due to loop prevention, the typical symptom is routes not being received at all or being marked as invalid, not the specific 'received but not valid' status. The most common cause for 'not valid' is next-hop unreachability.
B
The next-hop IP address is not reachable.
Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.
C
BGP synchronization is enabled.
Why wrong: This is incorrect. BGP synchronization is a legacy feature that requires the route to be in the IGP before it is advertised. In modern networks, synchronization is disabled by default. Even if enabled, it affects advertisement, not the validity of received routes in the BGP table.
D
The maximum-prefix limit has been exceeded.
Why wrong: This is incorrect. Exceeding the maximum-prefix limit typically causes the BGP session to reset or routes to be withdrawn, not to be marked as 'not valid' in the BGP table. Routes would likely be removed entirely, not just marked invalid.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full routing breakdown →

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 150

10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    
20 deny tcp any any eq 23 (8 matches)
    
30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    
40 deny tcp any any eq 22 (1 match)
    
50 permit ip any any (15 matches)

Based on this output, what can be concluded?

A
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).
B
Telnet from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits Telnet from 10.0.0.0/8.
C
SSH from 172.16.0.0/16 is denied.
Why wrong: Entry 30 permits SSH from 172.16.0.0/16.
D
All traffic is permitted.
Why wrong: Telnet and SSH from unauthorized sources are denied.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static

Based on this output, what can be concluded?

A
These translations will expire after a configurable timeout.
Why wrong: The timeout is 'never', so they do not expire.
B
The translations are dynamic and will be removed after idle timeout.
Why wrong: The flags indicate 'static', not dynamic.
C
The router is performing PAT for these addresses.
Why wrong: No protocol or port is shown; these are simple static NAT entries.
D
The translations are static and will remain until manually removed.
Static NAT entries with timeout 'never' persist indefinitely.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full OSPF breakdown →

A network engineer issues the following command on Router R4:

R4# show ip ospf database

OSPF Router with ID (4.4.4.4) (Process ID 1)

Router Link States (Area 0)

Link ID ADV Router Age Seq# Checksum Link count

1.1.1.1         1.1.1.1         123         0x80000002 0x00A1B2 2
2.2.2.2         2.2.2.2         456         0x80000003 0x00B2C3 3
4.4.4.4         4.4.4.4         789         0x80000001 0x00C3D4 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# Checksum

192.168.1.2     2.2.2.2         234         0x80000001 0x00D4E5

Based on this output, what can be concluded?

A
Router 2.2.2.2 is the Designated Router on the segment 192.168.1.0/24.
The Net Link State is originated by the DR, and the ADV Router is 2.2.2.2, so it is the DR.
B
Router 1.1.1.1 has three OSPF-enabled interfaces.
Why wrong: The link count for 1.1.1.1 is 2, not 3.
C
Router 4.4.4.4 is the BDR on the segment.
Why wrong: The BDR is not indicated in the database; the Net Link State is only from the DR.
D
There are multiple broadcast segments in area 0.
Why wrong: Only one Net Link State is listed, suggesting one broadcast segment.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full Python automation breakdown →

A network engineer is using Netmiko to connect to a Cisco IOS-XE device that is managed by Cisco DNA Center. The script is:

from netmiko import ConnectHandler

device = { 'device_type': 'cisco_ios', 'host': '10.10.10.1', 'username': 'admin', 'password': 'cisco123', 'secret': 'enable123'

connection = ConnectHandler(**device) connection.enable() output = connection.send_command('show ip interface brief')

print(output)

connection.disconnect()

What is a potential security concern with this script in the context of DNA Center?

A
The script does not handle authentication failures gracefully.
Why wrong: While true, the main security concern is plain text credentials.
B
The enable secret is hardcoded in plain text, which is a security risk.
Correct. Hardcoding credentials is insecure. They should be stored in a secure manner.
C
The device_type should be 'cisco_xe' for IOS-XE.
Why wrong: 'cisco_ios' works for IOS-XE devices as well.
D
The script should use SSH keys instead of passwords.
Why wrong: While SSH keys are more secure, the immediate issue is plain text storage.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R9:

R9# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 --- 192.0.2.21 10.0.0.21 --- ---

Based on this output, what can be concluded?

A
All translations are dynamic.
Why wrong: The third entry has no protocol, indicating it is static.
B
The router is using both static NAT and PAT simultaneously.
Static NAT for 10.0.0.21 and PAT for 10.0.0.20 are both active.
C
The router is configured with a single NAT pool.
Why wrong: Static NAT does not use a pool; PAT may use a pool or interface.
D
The inside global address 192.0.2.20 is used for both static and dynamic translations.
Why wrong: 192.0.2.20 is used only for dynamic PAT; static uses 192.0.2.21.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full Python automation breakdown →

Examine the following Python script snippet that uses netmiko to configure a Cisco IOS-XE device:

```python

from netmiko import ConnectHandler

device = { 'device_type': 'cisco_ios', 'ip': '192.168.1.1', 'username': 'admin', 'password': 'cisco',

connection = ConnectHandler(**device) output = connection.send_command('show ip interface brief')

print(output)

connection.disconnect() ```

What is the primary purpose of this script?

A
It configures an IP address on an interface.
Why wrong: The script only sends a show command, not configuration commands.
B
It retrieves and prints the output of 'show ip interface brief'.
The script connects, sends a show command, prints the output, and disconnects.
C
It saves the running configuration to startup configuration.
Why wrong: There is no write memory or copy command in the script.
D
It backs up the configuration to a TFTP server.
Why wrong: No TFTP transfer is performed.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:32    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:35    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

A
R1 is the Backup Designated Router (BDR) on this segment.
Why wrong: The state field does not show BDR; R1's own state is not displayed, but the neighbor states indicate R1 is a DROTHER.
B
R1 has a full OSPF adjacency with the neighbor 10.0.0.3.
Why wrong: The state for 10.0.0.3 is 2WAY, not FULL, so only a two-way relationship exists.
C
R1 is a DROTHER on this segment.
Since the DR is 10.0.0.2 and the BDR is not listed, and R1 has a full adjacency only with the DR, R1 must be a DROTHER.
D
The OSPF network type is point-to-point.
Why wrong: The presence of DR/BDR states indicates a broadcast or NBMA network type, not point-to-point.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Show Command Output Questions

How to approach show command output questions

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Virtualization practice questions

Infrastructure practice questions

Network Assurance practice questions

Security practice questions

Automation practice questions

ENCOR BGP practice questions

ENCOR OSPF practice questions

ENCOR EIGRP practice questions

ENCOR VLANs and trunking practice questions

ENCOR STP practice questions

ENCOR ACLs and CoPP practice questions

Practice scenarios

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?