CCNA Bgp Questions — Page 1 of 2

Drag & Drophard

Drag and drop the steps of BGP best path selection process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

BGP best path selection follows a strict order: first, prefer the path with the highest weight (Cisco proprietary). If equal, prefer highest local preference. Next, prefer locally originated routes (network/aggregate).

Then, prefer the shortest AS_PATH. Finally, prefer the lowest MED (if same AS).

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Practice this question →

MCQhard

A network engineer is troubleshooting a BGP issue where a router is not installing a specific prefix in its routing table, even though the prefix is present in the BGP table. The engineer runs 'show ip bgp 10.0.0.0/24' and sees that the route is valid but not best. The BGP table shows that the route has a higher local preference than the current best path, but the AS_PATH is longer. What is the most likely reason the route is not being selected as best?

A.The route with higher local preference has a lower weight than the current best path.

B.The route with higher local preference has a higher MED value.

C.The route with higher local preference is not synchronized with IGP.

D.The route with higher local preference was learned from an eBGP peer, while the current best path is from an iBGP peer.

AnswerA

Correct because weight is checked before local preference in BGP path selection; a higher weight on the current best path would make it preferred even if local preference is lower.

Why this answer

BGP selects the best path based on a sequence of comparison steps. Local preference is checked before AS_PATH length, so a higher local preference should normally win. However, weight is the very first criterion in the BGP best-path selection algorithm.

If the current best path has a higher weight than the route with higher local preference, weight overrides local preference, making the higher-local-preference route not best.

Exam trap

Cisco often tests the order of BGP best-path selection steps, specifically that weight is evaluated before local preference, leading candidates to incorrectly assume that a higher local preference always wins regardless of weight.

How to eliminate wrong answers

Option B is wrong because MED is compared only after the AS_PATH length and origin code, and it is not relevant when a higher local preference is present; the issue here is that weight, which is checked first, is higher on the current best path. Option C is wrong because BGP synchronization is a Cisco-specific feature that requires an IGP route for the next-hop before installing an iBGP route, but it does not affect the best-path selection process; the route is already in the BGP table as valid, and synchronization would prevent installation, not selection as best. Option D is wrong because eBGP routes are preferred over iBGP routes only if all earlier steps (weight, local preference, locally originated) are equal; here, local preference is higher on the candidate route, but weight is the first tiebreaker and is higher on the current best path, so the eBGP vs iBGP comparison never occurs.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to its preferred value (highest or lowest) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Highest

Lowest

Why these pairings

Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

Practice this question →

MCQmedium

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

A.Local preference

B.AS path length

C.MED

D.Origin code

AnswerA

Correct. After weight, BGP compares local preference (higher is better).

Why this answer

When multiple BGP paths exist for the same prefix and the Weight attribute (Cisco proprietary, local to the router) is equal, the next tie-breaker in the BGP best path selection algorithm is the Local Preference (Local Pref). A higher Local Preference value is preferred, and this attribute is used to influence outbound traffic from an AS. Since the question states weight is equal, Local Preference becomes the first differentiator.

Exam trap

Cisco often tests the exact order of BGP path selection attributes, and the trap here is that candidates mistakenly think AS path length or MED is the first tie-breaker after weight, when in fact Local Preference is always compared second.

How to eliminate wrong answers

Option B is wrong because AS path length is the third tie-breaker in the BGP best path selection process, used only after comparing Weight and Local Preference. Option C is wrong because MED (Multi-Exit Discriminator) is a later tie-breaker (typically fifth) and is used to influence inbound traffic into an AS, not the first comparison after weight. Option D is wrong because Origin code is compared after AS path length and MED in the BGP decision process, making it a much later tie-breaker.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you define the prefix-list to match specific routes. Then you create the route-map with the suppress clause. Next, you configure the aggregate-address command referencing the route-map.

After that, you verify the aggregated route in the BGP table. Finally, you check that more specific routes are suppressed.

Practice this question →

MCQmedium

An enterprise is implementing MPLS L3VPN to connect multiple branch offices. The PE routers are using eBGP to exchange VPNv4 routes. The engineer notices that some VPN routes are not being advertised to the remote PE. The 'show bgp vpnv4 unicast all' on the local PE shows the routes as valid but not best. What is the most likely reason?

A.The route has a higher local preference than the best path.

B.The route is not valid due to a missing label.

C.The route is not in the BGP table.

D.The route has a higher MED value than the best path.

AnswerD

Correct. MED is a metric that influences inbound traffic; a higher MED value is less preferred. If this route has a higher MED than the best path, it will not be chosen as best.

Why this answer

In BGP, the route with the highest local preference is preferred, so option A is incorrect. The route is valid, so options B and C are incorrect because a missing label would make it invalid, and being in the BGP table is confirmed. MED (Multi-Exit Discriminator) is used in the BGP path selection process; a higher MED value makes a route less preferred compared to a lower MED.

Therefore, if the route has a higher MED than the best path, it will not be selected as best, even though it is valid. This is the most likely reason for the route being valid but not best.

Exam trap

Candidates often assume that a valid route is always advertised, but BGP only advertises the best path. The trap here is confusing local preference and MED: high local preference increases preference, while high MED decreases preference.

How to eliminate wrong answers

Option B is wrong because if the route were missing a label, it would be marked as 'not valid' in the BGP table, not 'valid but not best'. Option C is wrong because the question explicitly states the route is shown in the 'show bgp vpnv4 unicast all' output, so it is in the BGP table. Option D is wrong because a higher MED value would make the route less preferred only if the paths are from the same neighboring AS; however, the route is already valid, and MED is compared after LP and AS-path length, so a higher MED would not cause the route to be valid but not best if LP is the deciding factor.

Practice this question →

MCQmedium

Consider the following BGP configuration: router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET-MED out ! route-map SET-MED permit 10 set metric 50 ! What is the effect of this route-map on outbound updates to neighbor 10.0.0.2?

A.It sets the MED to 50 for all routes advertised to 10.0.0.2, but only if they match a prefix-list.

B.It sets the MED to 50 for all routes advertised to 10.0.0.2.

C.It sets the local preference to 50 for routes received from 10.0.0.2.

D.It filters all routes to 10.0.0.2 because there is no match statement.

AnswerB

Correct. The route-map permits all routes and sets MED to 50.

Why this answer

The route-map SET-MED is applied to outbound updates to neighbor 10.0.0.2 with a permit sequence 10 and a set metric 50 command, but no match statement. In BGP, a route-map with a permit clause and no match condition matches all routes by default. Therefore, the MED (Multi-Exit Discriminator) attribute is set to 50 for every route advertised to that neighbor.

Exam trap

Cisco often tests the misconception that a route-map without a match statement will deny or filter all routes, but in reality, a permit clause with no match matches everything and applies the set actions.

How to eliminate wrong answers

Option A is wrong because the route-map does not reference any prefix-list, so it applies to all routes, not only those matching a prefix-list. Option C is wrong because the set metric command modifies the MED, not local preference; local preference is set with set local-preference and is an inbound attribute. Option D is wrong because a permit route-map without a match statement does not filter routes; it matches all routes and applies the set actions.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.MED (Multi-Exit Discriminator)

B.Local Preference

C.Weight

D.Origin

AnswerA

MED is a non-transitive attribute; lower values are preferred.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic from neighboring ASes. A lower MED value is preferred over a higher one, making it the correct answer for an attribute where the lowest value is favored.

Exam trap

Cisco often tests the MED attribute by contrasting it with Weight and Local Preference, where candidates mistakenly think all BGP attributes prefer the lowest value, but only MED does among these options.

How to eliminate wrong answers

Option B (Local Preference) is wrong because a higher Local Preference value is preferred, not a lower one. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute where a higher value is preferred. Option D (Origin) is wrong because the Origin attribute has a preference order (IGP < EGP < incomplete), not a numeric lowest-value comparison.

Practice this question →

MCQmedium

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

A.Local preference

B.AS path length

C.Origin code

D.MED

AnswerA

Correct. After weight, local preference is the next attribute compared; higher is preferred.

Why this answer

When multiple BGP paths are available for the same prefix, the first tie-breaker after comparing weight (where higher weight is preferred) is Local Preference (Local Pref). Since weight is a Cisco-proprietary attribute that is only locally significant, the next step in the BGP best-path selection algorithm is to compare the Local Preference value, with the highest value being preferred. This makes Local Preference the correct first tie-breaker when weight is equal.

Exam trap

Cisco often tests the order of BGP path selection steps, and the trap here is that candidates confuse the Cisco-proprietary 'weight' attribute (which is checked first) with the standard 'Local Preference' attribute (which is checked second), leading them to incorrectly select AS path length or MED as the next tie-breaker.

How to eliminate wrong answers

Option B is wrong because AS path length is the third tie-breaker in the BGP best-path selection process, used only after comparing weight and Local Preference. Option C is wrong because Origin code (IGP, EGP, incomplete) is the fourth tie-breaker, evaluated after AS path length. Option D is wrong because MED (Multi-Exit Discriminator) is the fifth tie-breaker, used only after comparing Origin code, and it is compared only when paths come from the same neighboring AS.

Practice this question →

Multi-Selectmedium

Which three statements about BGP peering are true? (Choose three.)

Select 3 answers

A.eBGP peers are typically directly connected, but can be multi-hop with the ebgp-multihop command.

B.iBGP peers can be non-directly connected and often use loopback interfaces for reachability.

C.The default TTL for eBGP packets is 255.

D.In iBGP, all routers within the same AS must be fully meshed unless route reflectors or confederations are used.

E.The BGP router ID is used only for OSPF, not for BGP.

AnswersA, B, D

Correct because eBGP by default assumes direct connection, but multi-hop is possible.

Why this answer

eBGP peers typically use a directly connected interface or a loopback with proper routing. iBGP peers can be non-directly connected and often use loopback interfaces for stability. The TTL for eBGP is set to 1 by default, but can be increased with the ebgp-multihop command. iBGP requires that all routers in the same AS are fully meshed or use route reflectors to avoid loops. The BGP identifier (router ID) is used to identify the BGP speaker and is used in loop prevention for iBGP.

Practice this question →

Multi-Selecthard

Which three statements about BGP route selection are true? (Choose three.)

Select 3 answers

A.A route with a lower MED is preferred over a route with a higher MED when all other factors are equal.

B.A route with a higher LOCAL_PREF is preferred over a route with a lower LOCAL_PREF.

C.A route with a shorter AS_PATH is preferred over a route with a longer AS_PATH.

D.A route with a lower weight is preferred over a route with a higher weight.

E.A route with ORIGIN code EGP is preferred over a route with ORIGIN code IGP.

AnswersA, B, C

Correct: MED is used to influence inbound traffic; a lower MED is preferred.

Why this answer

The BGP best-path selection algorithm considers the highest weight first, then highest LOCAL_PREF, then locally originated routes (network or aggregate), then shortest AS_PATH, then lowest ORIGIN code (IGP < EGP < incomplete), then lowest MED, and so on. Routes with a lower MED are preferred. The highest LOCAL_PREF is preferred.

The shortest AS_PATH is preferred. The lowest ORIGIN code is preferred. The lowest weight is not preferred; weight is Cisco-specific and higher weight is preferred.

Practice this question →

MCQmedium

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

A.BGP sessions may flap due to dropped keepalives.

B.Data plane traffic will be dropped.

C.Only SSH sessions will be rate-limited.

D.SNMP and SSH will be unaffected because they are explicitly permitted.

AnswerA

BGP keepalives are matched and subject to the policer.

Why this answer

The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.

Exam trap

Cisco often tests the misconception that CoPP affects data plane traffic or that only management protocols like SSH are impacted, when in fact control plane policing targets all control plane packets, including routing protocol keepalives.

How to eliminate wrong answers

Option B is wrong because CoPP operates on the control plane, not the data plane; data plane traffic is forwarded in hardware and unaffected by control plane policing. Option C is wrong because the policy affects all control plane traffic matching the class maps, not just SSH; BGP and SNMP are also subject to rate-limiting or dropping. Option D is wrong because SNMP and SSH are not 'unaffected' — they are explicitly permitted only if they match a permit ACE in the class map; if the class map drops or rate-limits them, they will be affected.

Practice this question →

MCQeasy

A network engineer runs the following command on Router R4: R4# show mpls interfaces Interface IP Tunnel BGP Static Operational GigabitEthernet0/0 Yes No No No Yes GigabitEthernet0/1 Yes No No No Yes GigabitEthernet0/2 No No No No No Based on this output, what can be concluded?

A.MPLS is enabled and operational on GigabitEthernet0/0 and GigabitEthernet0/1.

B.MPLS is enabled on all three interfaces, but only Gi0/0 and Gi0/1 are operational.

C.BGP and Static label switching are enabled on Gi0/0 and Gi0/1.

D.Tunnel interfaces are configured on Gi0/0 and Gi0/1.

AnswerA

Both interfaces show IP: Yes and Operational: Yes.

Why this answer

The 'show mpls interfaces' command displays MPLS status per interface. The 'Operational' column indicates whether MPLS is actively forwarding labels. GigabitEthernet0/0 and GigabitEthernet0/1 both show 'Yes' in the Operational column, confirming MPLS is enabled and operational on those interfaces.

GigabitEthernet0/2 shows 'No' in both the IP and Operational columns, meaning MPLS is not enabled or operational there.

Exam trap

Cisco often tests the distinction between the 'IP' column (configuration) and the 'Operational' column (actual forwarding state), leading candidates to mistakenly assume an interface is operational just because MPLS is configured, or to misinterpret the 'No' in the IP column as meaning MPLS is disabled entirely rather than just not enabled for IP label distribution.

How to eliminate wrong answers

Option B is wrong because the output shows GigabitEthernet0/2 has 'No' in the IP column and 'No' in the Operational column, indicating MPLS is not enabled on that interface, not just non-operational. Option C is wrong because the BGP and Static columns both show 'No' for all interfaces, meaning BGP label switching and static label switching are not enabled on Gi0/0 or Gi0/1. Option D is wrong because the Tunnel column shows 'No' for all interfaces, indicating no tunnel interfaces are configured on Gi0/0 or Gi0/1.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of configuring an iBGP route reflector cluster into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, enable BGP on the route reflector. Second, configure the route reflector's cluster ID (if not using router-id). Third, configure the route reflector clients.

Fourth, establish iBGP peerings between the route reflector and its clients. Finally, verify that the route reflector is advertising routes correctly.

Practice this question →

MCQhard

A network engineer runs the following command on Router R2: R2# show ip bgp summary BGP router identifier 10.0.0.2, local AS number 65002 BGP table version is 10, main routing table version 10 4 network entries using 576 bytes of memory 4 path entries using 320 bytes of memory 3/2 BGP path/bestpath attribute entries using 456 bytes of memory 1 BGP AS-PATH entries using 24 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 1376 total bytes of memory BGP activity 6/2 prefixes, 6/2 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65001 1024 1020 10 0 0 02:15:30 3 192.168.1.3 4 65003 0 0 0 0 0 00:00:12 Idle (Admin) Based on this output, what can be concluded?

A.The BGP session to 192.168.1.3 is down due to a network failure.

B.The BGP session to 192.168.1.3 has been manually disabled.

C.Router R2 has received 3 routes from 192.168.1.1.

D.The BGP table version is 10, meaning 10 routes are in the table.

AnswerB, C

Correct. The 'Idle (Admin)' state explicitly indicates the BGP session to 192.168.1.3 has been manually disabled via the 'neighbor shutdown' command.

Why this answer

The output shows the BGP session to neighbor 192.168.1.3 is in the 'Idle (Admin)' state, which specifically indicates the session has been administratively shut down using the 'neighbor shutdown' command. Additionally, the State/PfxRcd column for neighbor 192.168.1.1 shows '3', meaning Router R2 has received 3 prefixes from that neighbor. Therefore, both statements B and C are correct conclusions from the output.

Exam trap

Cisco often tests the distinction between 'Idle' (caused by network issues like missing route to neighbor) and 'Idle (Admin)' (caused by manual shutdown), and candidates frequently misinterpret the 'State/PfxRcd' column as routes instead of prefixes.

How to eliminate wrong answers

Option A is wrong because 'Idle (Admin)' indicates the session was manually disabled, not a network failure; a network failure would show 'Idle' without the '(Admin)' tag or 'Active' state. Option C is wrong because the 'State/PfxRcd' column shows '3' for neighbor 192.168.1.1, which is the number of prefixes received, not routes—BGP prefixes are network layer reachability information (NLRI), not routes. Option D is wrong because the BGP table version (10) is a version counter incremented with each table change, not the number of routes; the output explicitly shows '4 network entries' and '3' prefixes received from 192.168.1.1.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.Local Preference

B.Weight

C.MED (Multi-Exit Discriminator)

D.AS Path

AnswerC

MED is used to influence inbound traffic; lower MED is preferred.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer for the attribute preferred when it has the lowest value.

Exam trap

Cisco often tests the misconception that all BGP attributes follow a 'lower is better' rule, but candidates must remember that Local Preference and Weight use 'higher is better', while MED and IGP metric (for next-hop reachability) use 'lower is better'.

How to eliminate wrong answers

Option A is wrong because Local Preference is preferred when it has the highest value, not the lowest, and it influences outbound traffic from an AS. Option B is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has the highest value, and it is local to the router. Option D is wrong because AS Path is preferred when it is shortest (lowest number of AS hops), but the question asks for the attribute preferred with the lowest value, and AS Path is not typically compared as a numeric value in the same way as MED; the comparison is based on path length, not a single metric value.

Practice this question →

MCQhard

A network engineer runs the following command on Router R6: R6# show ip route vrf CUSTOMER-D VRF CUSTOMER-D: 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.400 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.400 192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask B 192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00 R6# show ip bgp vpnv4 vrf CUSTOMER-D BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i Based on this output, what can be concluded?

A.The route 192.168.1.0/24 is learned via OSPF

B.The route 192.168.1.0/24 is installed in the VRF routing table from BGP

C.The next-hop 10.0.0.2 is not reachable

D.VRF CUSTOMER-D has no directly connected networks

AnswerB

The VRF route shows B, and the BGP table shows the same prefix with next-hop 10.0.0.2.

Why this answer

The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Exam trap

Cisco often tests the distinction between the routing table (show ip route) and the BGP table (show ip bgp), where a route can be present in BGP but not installed in the routing table if the next-hop is unreachable, but here the route is installed, confirming reachability.

How to eliminate wrong answers

Option A is wrong because the route is marked with 'B' in the routing table, which indicates BGP, not OSPF (which would show 'O'). Option C is wrong because the route is marked as 'best' (>) in BGP and installed in the routing table, which requires the next-hop 10.0.0.2 to be reachable via the directly connected subnet 10.0.0.0/30. Option D is wrong because the VRF has directly connected networks (10.0.0.0/30 and 10.0.0.1/32) as shown by the 'C' and 'L' entries in the routing table.

Practice this question →

Matchingmedium

Drag and drop each BGP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establishes BGP peering parameters

Advertises or withdraws prefixes

Reports error conditions

Maintains session liveness

Requests re-advertisement of routes

Why these pairings

OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R3: R3# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65000 1000 1000 10 0 0 01:23:45 5 192.168.2.2 4 65000 800 800 10 0 0 00:45:12 3 Based on this output, what can be concluded?

A.Both neighbors are eBGP peers

B.Both neighbors are iBGP peers exchanging VPNv4 prefixes

C.The neighbor 192.168.1.1 is not receiving any prefixes

D.The BGP table has 20 prefixes

AnswerB

The local AS is 65000 and both neighbors have the same AS, indicating iBGP. PfxRcd shows prefixes received.

Why this answer

The command `show bgp vpnv4 unicast all summary` displays BGP VPNv4 unicast summary information for all VRFs. Both neighbors (192.168.1.1 and 192.168.2.2) are in the same AS 65000, and the output shows they are exchanging VPNv4 prefixes (State/PfxRcd shows 5 and 3 prefixes received). This confirms they are iBGP peers within the same AS, specifically for VPNv4 address family, which is used in MPLS Layer 3 VPN environments to carry customer VPN routes.

Exam trap

Cisco often tests the distinction between eBGP and iBGP by using the same AS number in the output, and candidates may overlook that the `vpnv4 unicast all` address family is specifically for MPLS VPN iBGP peering, not for standard IPv4 unicast.

How to eliminate wrong answers

Option A is wrong because both neighbors have the same AS number (65000) as the local router, which indicates iBGP peering, not eBGP (which requires different AS numbers). Option C is wrong because the State/PfxRcd column shows 5 prefixes received from 192.168.1.1, meaning it is actively receiving prefixes. Option D is wrong because the output clearly states '10 network entries' and '20/10 prefixes' (activity counters), not 20 prefixes in the current BGP table.

Practice this question →

Multi-Selectmedium

Which two statements about BGP TTL security are true? (Choose two.)

Select 2 answers

A.BGP TTL security uses the Generalized TTL Security Mechanism (GTSM) to validate the TTL of incoming BGP packets.

B.The command 'neighbor <ip> ttl-security hops <hop-count>' is used to enable BGP TTL security on a per-neighbor basis.

C.The default TTL value for eBGP packets is 64.

D.BGP TTL security encrypts the BGP update messages to prevent eavesdropping.

E.BGP TTL security is only applicable to eBGP sessions, not iBGP.

AnswersA, B

Correct because GTSM checks that the TTL is within a valid range based on the configured hop count.

Why this answer

BGP TTL security (GTSM) protects against CPU-based attacks by ensuring incoming BGP packets have a TTL of 255 minus the expected hop count. The neighbor ttl-security hops command is used on Cisco IOS-XE to enable this feature, and it must be configured on both peers to be effective. Option C is incorrect because the default TTL for eBGP is 1, not 64.

Option D is incorrect because GTSM does not encrypt BGP updates. Option E is incorrect because GTSM is supported for both eBGP and iBGP.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.MED (Multi-Exit Discriminator)

B.Local Preference

C.Weight

D.AS Path

AnswerA

The MED attribute is used to indicate the preferred path into an AS; lower MED is better.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

Exam trap

Cisco often tests the distinction between attributes where higher is preferred (Local Preference, Weight) versus lower is preferred (MED, AS Path length), and the trap here is that candidates might confuse MED with Local Preference or Weight, both of which use higher values as better.

How to eliminate wrong answers

Option B (Local Preference) is wrong because Local Preference is used to influence outbound traffic from an AS, and a higher value is preferred, not lower. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has a higher value, not lower. Option D (AS Path) is wrong because a shorter AS Path length is preferred, meaning a lower count is better, but the question asks for an attribute where the lowest value is preferred, and AS Path is not typically described as a 'value' in the same sense as MED; moreover, AS Path length is a count, not a metric like MED, and the question's phrasing aligns more directly with MED's explicit numeric comparison.

Practice this question →

MCQhard

A network engineer runs the following command on Router R6: R6# show ip bgp vpnv4 all summary BGP router identifier 10.0.0.6, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 800 bytes of memory 4/3 BGP path/bestpath attribute entries using 576 bytes of memory 2 BGP AS-PATH entries using 48 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory BGP using 2896 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.0.7 4 65001 1000 1000 10 0 0 00:20:00 5 10.0.0.8 4 65002 500 500 10 0 0 00:10:00 3 Based on this output, what can be concluded?

A.Both BGP sessions are in the Idle state.

B.The router is receiving VPNv4 prefixes from both neighbors.

C.The BGP table has no entries because the table version is 10.

D.The neighbor 10.0.0.8 is not configured for VPNv4.

AnswerB

The State/PfxRcd shows 5 and 3 prefixes received, confirming VPNv4 route exchange.

Why this answer

The output shows that neighbor 10.0.0.7 (AS 65001) has 5 prefixes received (State/PfxRcd = 5) and neighbor 10.0.0.8 (AS 65002) has 3 prefixes received (State/PfxRcd = 3). Since the command 'show ip bgp vpnv4 all summary' specifically displays VPNv4 address family information, these received prefixes are VPNv4 routes. Therefore, Router R6 is successfully receiving VPNv4 prefixes from both BGP neighbors.

Exam trap

Cisco often tests the misinterpretation of the 'State/PfxRcd' column, where candidates mistakenly think a numeric value indicates a state like 'Idle' or 'Active', rather than recognizing it as the count of received prefixes confirming an Established session.

How to eliminate wrong answers

Option A is wrong because both neighbors show an Up/Down time (00:20:00 and 00:10:00) and a numeric State/PfxRcd value, indicating the sessions are in the Established state, not Idle. Option C is wrong because the BGP table version being 10 indicates the table has been updated and is stable; the output explicitly shows '10 network entries' and '10 path entries', proving the BGP table has entries. Option D is wrong because neighbor 10.0.0.8 shows 3 prefixes received (State/PfxRcd = 3) under the VPNv4 summary, confirming it is configured for VPNv4 and is actively exchanging VPNv4 routes.

Practice this question →

Multi-Selectmedium

Which two statements about BGP path attributes are true? (Choose two.)

Select 2 answers

A.AS_PATH is a well-known mandatory attribute.

B.LOCAL_PREF is a well-known discretionary attribute.

C.MED is an optional transitive attribute.

D.ORIGIN is a well-known discretionary attribute used for loop prevention.

E.NEXT_HOP is an optional non-transitive attribute.

AnswersA, B

Correct: AS_PATH is well-known mandatory; it is always included in BGP updates and is used for loop prevention and path selection.

Why this answer

The AS_PATH attribute is well-known mandatory and is used for loop prevention and path selection. The LOCAL_PREF attribute is well-known discretionary and is used to influence outbound traffic from an AS. The MED attribute is optional non-transitive and is used to influence inbound traffic.

The ORIGIN attribute is well-known mandatory but not used for loop prevention. The NEXT_HOP attribute is well-known mandatory but is not optional.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP confederations setup between sub-ASes into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you assign the confederation identifier (main AS). Then you define the member sub-AS numbers. Next, you configure eBGP peering between sub-ASes using the sub-AS numbers.

After that, you ensure iBGP is configured within each sub-AS. Finally, you verify confederation peers with show ip bgp neighbors.

Practice this question →

MCQeasy

Which BGP attribute is preferred with the lowest value?

A.MULTI_EXIT_DISC (MED)

B.LOCAL_PREF

C.AS_PATH

D.WEIGHT

AnswerA

Correct. MED is used to influence inbound traffic and lower values are preferred.

Why this answer

In BGP path selection, the LOCAL_PREF attribute is used to prefer paths within an AS. A higher LOCAL_PREF is preferred, but the question asks for the attribute preferred with the lowest value. The WEIGHT attribute is Cisco-specific and is preferred with the highest value.

The MULTI_EXIT_DISC (MED) attribute is preferred with the lowest value.

Practice this question →

MCQhard

A network engineer runs the following command on Router R5: R5# show ip route vrf CUSTOMER-A Routing Table: CUSTOMER-A Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.1.1.1 to network 0.0.0.0 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.1.1.0/24 is directly connected, GigabitEthernet0/0 B 10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20 Based on this output, what can be concluded?

A.The VRF has no routes and is not functional.

B.The route 10.2.2.0/24 is learned via OSPF.

C.The VRF has a default route pointing to 10.1.1.1.

D.The BGP route is sourced from an internal BGP peer.

AnswerC

The gateway of last resort is 10.1.1.1, meaning a default route exists via that next hop.

Why this answer

The output shows a VRF routing table with a gateway of last resort set to 10.1.1.1 for network 0.0.0.0, which is a default route. This indicates that the VRF has a default route pointing to 10.1.1.1, making option C correct. The presence of a connected route and a BGP-learned route further confirms the VRF is functional.

Exam trap

Cisco often tests the distinction between eBGP and iBGP by using administrative distance values; the trap here is that candidates may assume any BGP route is from an internal peer without checking the AD value, which for eBGP is 20 and for iBGP is 200.

How to eliminate wrong answers

Option A is wrong because the VRF has both a connected route (10.1.1.0/24) and a BGP-learned route (10.2.2.0/24), so it is functional. Option B is wrong because the route 10.2.2.0/24 is marked with 'B' in the routing table, which indicates it is learned via BGP, not OSPF. Option D is wrong because the BGP route shows an administrative distance of 20 and a metric of 0, which are typical for eBGP (external BGP) routes, not iBGP (internal BGP) routes; iBGP routes typically have an administrative distance of 200.

Practice this question →

Matchinghard

Drag and drop each BGP path selection criterion on the left to its order of preference (1 = highest priority) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Why these pairings

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH (shortest), then ORIGIN (IGP < EGP < incomplete).

Practice this question →

MCQmedium

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

A.The AS-path contains the local AS number.

B.The next-hop IP address is not reachable.

C.BGP synchronization is enabled.

D.The maximum-prefix limit has been exceeded.

AnswerB

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

Why this answer

For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Exam trap

Cisco often tests the distinction between routes being received in the BGP table versus being installed in the routing table, and the trap here is that candidates confuse synchronization (a deprecated feature) with the next-hop reachability requirement, which is the immediate cause of the 'not valid' status.

How to eliminate wrong answers

Option A is wrong because if the AS-path contains the local AS number, BGP would reject the route due to loop prevention (the route would be marked as invalid or not received at all), but the question states routes are received. Option C is wrong because BGP synchronization is disabled by default in modern IOS versions and, even if enabled, it would affect the route's validity only if the prefix is not present in the IGP, but the next-hop reachability check is more fundamental. Option D is wrong because exceeding the maximum-prefix limit would cause the BGP session to be torn down or the neighbor to be shut down, not simply mark routes as not valid while keeping them in the BGP table.

Practice this question →

MCQeasy

Which BGP attribute is preferred with the lowest value?

A.MED

B.Local Preference

C.Weight

D.Origin

AnswerA

Correct. Lower MED is preferred in BGP path selection.

Why this answer

MED (Multi-Exit Discriminator) is a BGP attribute that is preferred with the lowest value. It is used to influence inbound traffic to an AS when multiple entry points exist, and a lower MED value is more preferred over a higher one.

Exam trap

Cisco often tests the confusion between attributes that use 'lowest is best' (like MED and IGP metric) versus 'highest is best' (like Local Preference and Weight), so candidates mistakenly apply the 'highest is best' rule to MED.

How to eliminate wrong answers

Option B (Local Preference) is wrong because Local Preference is preferred with the highest value, not the lowest, and is used to influence outbound traffic from an AS. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute that is preferred with the highest value, and it is local to the router. Option D (Origin) is wrong because Origin is preferred in the order IGP < EGP < incomplete, not based on a numeric value.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to its matching attribute type on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Well-known mandatory

Well-known discretionary

Optional transitive

Optional non-transitive

Well-known mandatory

Why these pairings

AS_PATH is well-known mandatory; LOCAL_PREF is well-known discretionary; COMMUNITY is optional transitive; MULTI_EXIT_DISC is optional non-transitive; ORIGIN is well-known mandatory.

Practice this question →

MCQmedium

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

A.Set a lower MED for routes advertised to ISP A and a higher MED for routes advertised to ISP B.

B.Use AS path prepending on routes advertised to ISP B and set a higher local preference for routes learned from ISP A.

C.Advertise a more specific prefix (e.g., /25) to ISP A and a less specific prefix (/24) to ISP B.

D.Configure the CE router to use BGP multipath with both ISPs.

AnswerB

Correct. AS path prepending makes the path to ISP B longer, discouraging inbound traffic from using it. Setting a higher local preference for routes from ISP A makes outbound traffic prefer ISP A.

Why this answer

AS path prepending makes the route to ISP B appear less attractive for inbound traffic, while setting a higher local preference on routes learned from ISP A makes ISP A the preferred path for outbound traffic. This combination achieves the asymmetric routing goal: inbound traffic uses both links (since prepending only influences ISP B's decision, not ISP A's), and outbound traffic prefers ISP A due to the higher local preference.

Exam trap

Cisco often tests the distinction between inbound and outbound traffic engineering: candidates confuse attributes that influence inbound traffic (like MED and AS path prepending) with those that influence outbound traffic (like local preference and weight), leading them to pick Option A or C incorrectly.

How to eliminate wrong answers

Option A is wrong because MED is a metric sent to a specific neighbor and is only compared when paths come from the same AS; since the two ISPs are different ASes, MED would not be compared, and even if it were, lower MED makes a route more preferred, which would attract more inbound traffic to ISP A, not balance it. Option C is wrong because advertising a more specific prefix (/25) to ISP A would cause ISP A to prefer that route over the /24, attracting all inbound traffic to ISP A, not balancing it; also, this violates the requirement to advertise the same /24 prefix to both ISPs. Option D is wrong because BGP multipath allows the CE router to load-balance outbound traffic across both ISPs, but the requirement is to prefer ISP A for outbound traffic, not to load-balance equally.

Practice this question →

Matchingmedium

Drag and drop each BGP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establishes a BGP session and negotiates capabilities

Advertises new routes or withdraws previously advertised routes

Reports an error condition and closes the BGP session

Periodically sent to keep the BGP session alive

Requests that a peer readvertise its routes

Why these pairings

OPEN establishes a BGP session; UPDATE advertises or withdraws routes; NOTIFICATION indicates an error; KEEPALIVE maintains the session; ROUTE-REFRESH requests readvertisement of routes.

Practice this question →

MCQeasy

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast summary | include 10.0.1.5 10.0.1.5 4 65005 3456 3457 15 0 0 00:15:22 5 Based on this output, what can be concluded?

A.The BGP session with 10.0.1.5 has been down for 15 minutes and 22 seconds.

B.The BGP session with 10.0.1.5 is up and has received 5 prefixes.

C.The BGP session with 10.0.1.5 is in the 'Active' state.

D.The BGP session with 10.0.1.5 has sent 5 prefixes.

AnswerB

The number 5 in the State/PfxRcd column indicates 5 prefixes received, and the lack of a state word means the session is established.

Why this answer

The 'show bgp ipv4 unicast summary' output displays BGP neighbor status. The column 'Up/Down' shows '00:15:22', indicating the session has been established for 15 minutes and 22 seconds, not down. The last column shows '5', which under the 'PfxRcd' (Prefixes Received) column indicates the number of prefixes received from the neighbor.

Therefore, the session is up and has received 5 prefixes.

Exam trap

Cisco often tests the misinterpretation of the 'Up/Down' column, where candidates mistakenly read it as downtime instead of uptime, and the confusion between prefixes received (PfxRcd) and prefixes sent (PfxSent), which is not shown in this output.

How to eliminate wrong answers

Option A is wrong because the 'Up/Down' column value '00:15:22' represents the duration the session has been up, not down; a down session would show a different state or 'never'. Option C is wrong because the output shows a valid neighbor IP, AS number, and uptime, indicating the session is in the Established state, not Active; the Active state would not show prefixes received. Option D is wrong because the '5' in the output corresponds to prefixes received (PfxRcd), not sent; sent prefixes are not displayed in this summary output.

Practice this question →

MCQhard

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

A.The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.

B.The ACL is applied in the wrong order; the deny statement should be before the permit statement.

C.BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

D.CoPP does not affect BGP sessions because they are established before the policy is applied.

AnswerA

Correct because CoPP only applies to traffic matched by the class-map; if the ACL denies traffic, it is not matched, and the default class (often permit) allows it.

Why this answer

The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic.

This explains why BGP sessions from other peers are still being established.

Exam trap

Cisco often tests the misconception that a deny statement in an ACL used with CoPP will drop traffic, when in reality it only prevents the traffic from being matched by that class, allowing it to fall through to the default class which typically permits everything.

How to eliminate wrong answers

Option B is wrong because the order of permit and deny statements in an ACL is critical, but here the permit for host 10.0.0.1 is correctly placed before the deny all; the issue is not about order but about how CoPP treats deny entries. Option C is wrong because BGP uses TCP port 179, not UDP; this is a fundamental protocol fact. Option D is wrong because CoPP affects all traffic arriving at the control plane after the policy is applied, regardless of when sessions were established; existing sessions are still subject to rate-limiting.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R3: R3# show ip route ospf Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set 10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks O IA 10.1.1.0/24 [110/20] via 192.168.1.1, 00:12:34, GigabitEthernet0/0 O 10.2.2.0/24 [110/10] via 192.168.1.2, 00:15:22, GigabitEthernet0/0 O E2 10.3.3.0/24 [110/20] via 192.168.1.3, 00:08:11, GigabitEthernet0/0 Based on this output, what can be concluded?

A.The route to 10.3.3.0/24 is an external route redistributed into OSPF.

B.The route to 10.1.1.0/24 is in the same OSPF area as R3.

C.The metric for 10.3.3.0/24 includes the internal cost to the ASBR.

D.R3 is an ASBR.

AnswerA

O E2 indicates an OSPF external route of type 2, typically redistributed from another routing protocol.

Why this answer

The route to 10.3.3.0/24 is marked as 'O E2' in the output, which stands for OSPF external type 2. This indicates that the route was redistributed into OSPF from another routing protocol or a different OSPF process, making it an external route. The 'E2' designation confirms it is an external route with a fixed metric that does not include the internal cost to the ASBR.

Exam trap

Cisco often tests the difference between OSPF external type 1 (E1) and type 2 (E2) routes, specifically that E2 routes do not include the internal cost to the ASBR, which is a common misconception that leads candidates to incorrectly select option C.

How to eliminate wrong answers

Option B is wrong because the route to 10.1.1.0/24 is marked as 'O IA' (OSPF inter-area), which means it originates from a different OSPF area than R3, not the same area. Option C is wrong because for an OSPF external type 2 (E2) route, the metric shown (20) is the external metric only and does not include the internal cost to the ASBR; that behavior is specific to external type 1 (E1) routes. Option D is wrong because R3 is simply receiving these OSPF routes; there is no indication in the output that R3 is redistributing routes into OSPF, which would be required for it to be an ASBR.

Practice this question →

MCQmedium

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

A.The route-target import/export values are mismatched with the route reflector's configuration.

B.The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.

C.The CE router is not configured with a default route pointing to the PE.

D.The PE router needs the mpls ip command on the interface facing the CE router.

AnswerB

Correct because without this command, the PE does not redistribute VRF routes into VPNv4 or import VPNv4 routes into the VRF.

Why this answer

The CE router can ping the PE's VRF interface IP, confirming Layer 2 and VRF interface configuration are correct. However, the CE cannot reach remote VPNv4 routes, which indicates that the PE is not advertising or installing those routes into the VRF. The most likely cause is that the VRF CUSTOMER_A has not been activated under BGP using the 'address-family ipv4 vrf CUSTOMER_A' command, which is required to exchange IPv4 routes between the PE and CE within the VRF context and to redistribute them into MP-BGP for VPNv4 propagation.

Exam trap

Cisco often tests the misconception that a working BGP session to the route reflector and correct route-target values alone are sufficient for VPNv4 route exchange, when in fact the VRF must be explicitly activated under BGP to enable route advertisement and import.

How to eliminate wrong answers

Option A is wrong because the route-target import/export values (100:1) are configured on the PE, and the route reflector does not need matching route-targets; it only reflects VPNv4 routes based on the RTs attached to the routes, and the PE's import RT must match the export RT of the remote PE, not the route reflector. Option C is wrong because the CE router not having a default route pointing to the PE would affect reachability to remote networks from the CE, but the symptom is that the CE cannot reach remote VPNv4 routes at all, which is a routing advertisement issue on the PE, not a missing default route on the CE. Option D is wrong because the 'mpls ip' command is required on the PE's core-facing interfaces to enable MPLS forwarding, not on the interface facing the CE, which is a Layer 3 VRF interface that does not require MPLS encapsulation.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you create the prefix-list or AS-path ACL to match routes. Then you define the route-map with match and set clauses. Next, you apply the route-map to a neighbor under the BGP address-family.

After that, you clear the BGP session to apply the policy. Finally, you verify the policy effect with show ip bgp.

Practice this question →

Matchinghard

Drag and drop each BGP path selection criterion on the left to its correct order of preference (1 = highest priority) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Why these pairings

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH length (shortest), then ORIGIN (IGP > EGP > incomplete).

Practice this question →

MCQeasy

An engineer is configuring MPLS L3VPN with BGP as the PE-CE protocol. The customer uses eBGP between CE and PE. The engineer notices that the CE router is not receiving any VPN routes from the PE. The 'show bgp vpnv4 unicast all' on the PE shows the routes as valid and best. What is the most likely missing configuration?

A.The 'redistribute bgp' command is missing under the VRF BGP address-family on the PE.

B.The BGP session between PE and CE is not established.

C.The route-target import is not configured on the PE.

D.The VRF is not configured on the PE.

AnswerA

Correct because without redistribution, the PE does not advertise VPN routes to the CE via eBGP.

Why this answer

The PE has the VPNv4 routes in its BGP table as valid and best, but the CE is not receiving them. This indicates that the routes are not being installed into the VRF's BGP table for advertisement to the CE. The missing 'redistribute bgp' command under the VRF BGP address-family on the PE is the most likely cause, as it is required to inject the VPNv4 routes (which are learned via MP-BGP) into the per-VRF BGP process so they can be advertised to the CE via eBGP.

Exam trap

Cisco often tests the distinction between the global BGP table and the per-VRF BGP table, leading candidates to assume that valid VPNv4 routes automatically propagate to the CE without requiring explicit redistribution into the VRF BGP process.

How to eliminate wrong answers

Option B is wrong because if the BGP session between PE and CE were not established, the CE would not receive any routes at all, but the question states the CE is not receiving VPN routes specifically, and the PE shows the routes as valid and best, implying the session is up. Option C is wrong because route-target import is used to control which VPNv4 routes are imported into the VRF on the PE; if it were missing, the routes would not appear in the 'show bgp vpnv4 unicast all' output as valid and best. Option D is wrong because if the VRF were not configured on the PE, the PE would not have a VRF context to associate with the CE, and the VPNv4 routes would not be present in the VRF's BGP table.

Practice this question →

Multi-Selecthard

Which two statements about BGP route selection are true? (Choose two.)

Select 2 answers

A.A route with a higher LOCAL_PREF is preferred over a route with a lower LOCAL_PREF.

B.A route learned via eBGP is preferred over a route learned via iBGP, all else being equal.

C.A route with a longer AS_PATH is preferred over a route with a shorter AS_PATH.

D.The MED attribute is always compared regardless of the AS of the neighbor.

E.The IGP metric to the next hop is the first criterion in BGP path selection.

AnswersA, B

Correct because BGP prefers higher local preference.

Why this answer

BGP prefers a route with a higher LOCAL_PREF (local preference) over a lower one. A route learned via eBGP is preferred over iBGP because eBGP routes have a lower administrative distance in the BGP decision process (step 7: prefer eBGP over iBGP). The MED is compared only if the routes are from the same neighboring AS.

The shortest AS_PATH is preferred, not the longest. The IGP metric to the next hop is compared only after many other steps.

Practice this question →

MCQmedium

A network engineer is deploying model-driven telemetry on a Cisco Nexus 9000 switch to monitor BGP prefix changes. The engineer wants to use YANG data models and prefers a transport protocol that is lightweight and uses UDP. Which transport protocol should the engineer select for the telemetry stream?

A.gRPC

B.NETCONF

C.RESTCONF

D.SNMP

AnswerD

SNMP uses UDP as its transport protocol, making it lightweight and meeting the engineer's preference. Although SNMP is not based on YANG models, it is the only option that uses UDP.

Why this answer

The engineer explicitly prefers a lightweight transport protocol using UDP. Among the options, only SNMP uses UDP as its transport. Although SNMP is not a model-driven telemetry protocol (it uses MIBs instead of YANG models), the question's requirement for UDP overrides this. gRPC, NETCONF, and RESTCONF all use TCP, so they do not satisfy the UDP requirement.

Therefore, SNMP is the correct answer in this scenario.

Exam trap

The trap is that candidates often associate model-driven telemetry with gRPC and ignore the UDP requirement. They may choose gRPC because it is the standard for YANG-based telemetry, but the question explicitly requires a UDP transport.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order starts with the PE learning the customer route via IGP or static, then redistributing it into MP-BGP as a VPNv4 route with a route distinguisher, advertising it to the other PE via MP-BGP update, the receiving PE importing the route based on matching route targets, and finally installing the route into the appropriate VRF.

Practice this question →

MCQmedium

Consider the following configuration: router bgp 65000 bgp router-id 192.168.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 ebgp-multihop 2 neighbor 10.0.0.2 update-source Loopback0 ! interface Loopback0 ip address 192.168.0.1 255.255.255.255 What is missing for this BGP session to establish?

A.A route to reach 10.0.0.2 is missing; the neighbor must be reachable via the routing table.

B.The ebgp-multihop value should be 1 for a directly connected neighbor.

C.The remote-as must be the same as the local AS for EBGP.

D.The router-id must be the same as the update-source interface IP.

AnswerA

BGP requires TCP connectivity; without a route to the neighbor's IP, the session cannot form.

Why this answer

For an eBGP session to establish, the neighbor IP address (10.0.0.2) must be reachable via the routing table. The configuration uses `ebgp-multihop 2` and an update-source of Loopback0, but there is no route (static or dynamic) to reach 10.0.0.2, so the TCP connection cannot be initiated. Without reachability, BGP will remain in the Idle state.

Exam trap

Cisco often tests the misconception that ebgp-multihop alone ensures connectivity, but the trap here is that candidates forget BGP requires IP reachability in the routing table for the neighbor address, not just a configured multihop value.

How to eliminate wrong answers

Option B is wrong because ebgp-multihop 2 is correctly used when the neighbor is not directly connected (e.g., using loopback interfaces); setting it to 1 would assume a directly connected interface, which is not the case here. Option C is wrong because for eBGP, the remote-as must be different from the local AS (65000 vs 65001), so stating it must be the same is incorrect. Option D is wrong because the router-id does not need to match the update-source interface IP; the router-id is used for BGP identifier purposes and can be any unique IP, while the update-source specifies which interface's IP to use for the TCP connection.

Practice this question →

Multi-Selecthard

Which three statements about BGP route reflectors are true? (Choose three.)

Select 3 answers

A.Route reflectors reduce the number of required iBGP sessions in an AS.

B.A route reflector client must be fully meshed with all other clients.

C.The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes.

D.The ORIGINATOR_ID attribute is used to prevent routing loops in a route reflector environment.

E.Non-client peers of a route reflector must be fully meshed with each other.

AnswersA, C, D

Correct because route reflectors allow a hub-and-spoke topology, reducing sessions.

Why this answer

Route reflectors reduce the number of required iBGP sessions by allowing clients to peer only with the route reflector. The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes, preserving path information. The ORIGINATOR_ID attribute is used to prevent routing loops by identifying the originator of a route.

Option E is incorrect because non-client peers of a route reflector do not need to be fully meshed; they may be clients of other route reflectors, and the full mesh requirement applies only to iBGP speakers that are not clients of any route reflector.

Practice this question →

Multi-Selecthard

Which three statements about BGP route reflectors are true? (Choose three.)

Select 3 answers

A.Route reflectors allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh.

B.A route reflector client must be fully meshed with all other clients in the same cluster.

C.The route reflector can be a client of another route reflector.

D.The cluster ID is used to prevent routing loops in a route reflector environment.

E.The route reflector modifies the AS_PATH attribute to prevent loops.

AnswersA, C, D

Correct: This is the primary purpose of route reflectors; they relax the full mesh requirement.

Why this answer

Route reflectors are used to reduce the number of iBGP peers in an AS. They allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh. A route reflector client does not need to be fully meshed with other clients; it only peers with the route reflector.

The route reflector can be a client itself. The cluster ID is used to identify a route reflector cluster and to prevent loops. The route reflector does not modify the AS_PATH or NEXT_HOP attributes by default.

Practice this question →

MCQmedium

Which BGP attribute is preferred when it has the lowest value?

A.WEIGHT

B.LOCAL_PREF

C.MED

D.ORIGIN

AnswerC

MED is the attribute where a lower value is preferred.

Why this answer

BGP uses multiple attributes to determine the best path. The WEIGHT attribute is Cisco-specific and is preferred when it has the highest value, not lowest. The LOCAL_PREF attribute is preferred with the highest value.

The MED (Multi-Exit Discriminator) attribute is preferred with the lowest value. The ORIGIN attribute prefers IGP over EGP and incomplete.

Practice this question →

MCQmedium

Which BGP attribute is preferred when it has the lowest value?

A.Weight

B.Local Preference

C.MED (Multi-Exit Discriminator)

D.Origin

AnswerC

Lower MED is preferred when paths are from the same AS.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer for the attribute that is preferred when it has the lowest value.

Exam trap

Cisco often tests the confusion between Weight and MED, as both are used for path selection but Weight is preferred with the highest value while MED is preferred with the lowest value.

How to eliminate wrong answers

Option A is wrong because Weight is a Cisco-proprietary BGP attribute that is preferred when it has the highest value, not the lowest. Option B is wrong because Local Preference is preferred when it has the highest value, influencing outbound traffic from an AS. Option D is wrong because Origin is a well-known mandatory attribute that indicates how a route was learned (IGP, EGP, or incomplete), and its preference order is IGP > EGP > incomplete, not based on a numeric lowest value.

Practice this question →

MCQmedium

Given the following SD-WAN configuration on a Cisco IOS-XE router: router ospf 1 redistribute bgp 65000 subnets network 192.168.1.0 0.0.0.255 area 0 ! interface GigabitEthernet0/0/0 ip address 192.168.1.1 255.255.255.0 ip ospf network point-to-point ! Which statement is true?

A.The OSPF network type is point-to-point, so the hello interval defaults to 10 seconds on this interface.

B.The OSPF network type is point-to-point, so the dead interval defaults to 120 seconds.

C.The redistribution of BGP into OSPF will cause OSPF to advertise all BGP routes, including those learned via SD-WAN overlay.

D.The configuration is incomplete because OSPF requires a router-id to be manually configured.

AnswerA

On a point-to-point network type, the default OSPF hello interval is 10 seconds (same as broadcast). This is correct.

Why this answer

On a Cisco IOS-XE router, when the OSPF network type is set to point-to-point, the default hello interval is 10 seconds (not 30 seconds as on broadcast networks). The dead interval defaults to 40 seconds (four times the hello interval), not 120 seconds. This configuration is valid and does not require a manually configured router-id, as OSPF can dynamically select one.

The redistribution of BGP into OSPF only injects routes that are in the BGP table; it does not automatically include all SD-WAN overlay routes unless they are present in BGP.

Exam trap

Cisco often tests the default OSPF timer values for different network types, specifically tricking candidates into thinking point-to-point uses 30-second hello or 120-second dead intervals, which are actually defaults for NBMA networks.

How to eliminate wrong answers

Option B is wrong because the OSPF dead interval for a point-to-point network defaults to 40 seconds (4 × hello interval of 10 seconds), not 120 seconds. Option C is wrong because the 'redistribute bgp 65000 subnets' command only redistributes BGP routes that are in the BGP routing table; it does not automatically advertise all SD-WAN overlay routes unless they are learned via BGP and meet redistribution criteria (e.g., subnets keyword includes classless prefixes). Option D is wrong because OSPF does not require a manually configured router-id; if none is configured, OSPF automatically selects the highest IP address on a loopback interface or the highest IP address on any active physical interface.

Practice this question →

MCQmedium

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_COMMUNITY in ! route-map SET_COMMUNITY permit 10 set community 100:200 ! What is the effect of this configuration?

A.Routes received from 10.0.0.2 are tagged with community 100:200, but the community is not sent to other BGP peers unless send-community is configured.

B.Routes received from 10.0.0.2 are tagged with community 100:200 and automatically sent to all neighbors.

C.The route-map is applied to outbound updates to 10.0.0.2, setting community on routes sent to that neighbor.

D.The configuration is invalid because the community must be a string, not a numeric value.

AnswerA

Correct. The route-map sets the community on inbound updates, but without send-community, the community is not propagated.

Why this answer

The route-map SET_COMMUNITY is applied to inbound updates from neighbor 10.0.0.2, so routes received from that neighbor are tagged with community 100:200. However, BGP does not propagate communities to other peers unless the neighbor is explicitly configured with the send-community command. Without send-community, the community attribute is stripped from outbound updates, so the community is not sent to other BGP peers.

Exam trap

Cisco often tests the distinction between inbound and outbound route-map application, and the fact that communities are not automatically sent to peers without explicit send-community configuration, leading candidates to assume the community is propagated by default.

How to eliminate wrong answers

Option B is wrong because BGP does not automatically send communities to all neighbors; the send-community command is required under the neighbor configuration for the community attribute to be included in outbound updates. Option C is wrong because the route-map is applied with the 'in' keyword, meaning it affects inbound routes from 10.0.0.2, not outbound updates to that neighbor. Option D is wrong because the community value 100:200 is a valid numeric format (AS:value) and is perfectly acceptable in BGP configuration.

Practice this question →

MCQmedium

Examine the following BGP configuration on a Cisco IOS-XE router: ``` router bgp 65000 bgp default local-preference 150 neighbor 10.1.1.1 remote-as 65001 neighbor 10.1.1.1 password cisco123 neighbor 10.1.1.1 route-map SET-MED out ! route-map SET-MED permit 10 set metric 50 ``` What is the effect of the route-map on outbound updates to 10.1.1.1?

A.The MED value of routes advertised to 10.1.1.1 is set to 50.

B.The local preference of routes received from 10.1.1.1 is set to 150.

C.The route-map filters routes; only those with metric 50 are advertised.

D.The password is applied to the BGP session, but the route-map is ignored due to the password.

AnswerA

Correct. The route-map sets the MED attribute to 50.

Why this answer

The route-map SET-MED is applied to outbound updates to neighbor 10.1.1.1 using the 'route-map SET-MED out' command. The route-map permits all routes (no match statement) and sets the MED (Multi-Exit Discriminator) attribute to 50. This means that when the local router advertises routes to this eBGP neighbor, the MED value in those updates will be 50, influencing the neighbor's inbound path selection.

Exam trap

Cisco often tests the distinction between 'route-map out' (affects outbound updates) and 'route-map in' (affects inbound updates), and the trap here is assuming the route-map filters routes when it actually sets an attribute without any match conditions.

How to eliminate wrong answers

Option B is wrong because the 'bgp default local-preference 150' command sets the default local preference for routes received from all eBGP peers, not just 10.1.1.1, and the route-map does not affect local preference. Option C is wrong because the route-map has no match clause, so it permits all routes; it does not filter based on metric 50—it sets the metric to 50 on all advertised routes. Option D is wrong because the password and route-map are independent configurations; the route-map is not ignored due to the password—both are applied correctly.

Practice this question →

MCQhard

An enterprise has two BGP routers, R1 and R2, both in AS 65000. R1 peers with ISP1 (AS 100) and R2 peers with ISP2 (AS 200). The enterprise advertises a prefix 192.168.0.0/24 to both ISPs. The engineer wants to ensure that traffic from the Internet to this prefix enters the network primarily via R1, and only uses R2 if the link to ISP1 fails. Which BGP attribute should be manipulated on the updates sent to the ISPs?

A.Prepend AS 65000 multiple times on R2's updates to ISP2.

B.Set a higher MED on R1's updates to ISP1.

C.Set a higher local preference on R1 for routes learned from ISP1.

D.Use the no-export community on R1's updates to ISP1.

AnswerA

Correct because AS_PATH prepending makes the path through R2 longer, so ISP2 will prefer the path through ISP1, directing traffic to R1.

Why this answer

To influence inbound traffic from the Internet, you must manipulate attributes sent to the ISPs. AS path prepending makes a route appear less preferred by artificially lengthening the AS path. By prepending AS 65000 multiple times on R2's updates to ISP2, ISP2 will see a longer AS path for the prefix and prefer the shorter path via ISP1, causing traffic to enter primarily via R1 unless the ISP1 link fails.

Exam trap

Cisco often tests the distinction between attributes that influence inbound vs. outbound traffic; the trap here is confusing local preference (outbound) with AS path prepending (inbound), leading candidates to incorrectly choose local preference manipulation.

How to eliminate wrong answers

Option B is wrong because MED is a metric exchanged between ASes to influence inbound traffic from a neighboring AS, but it is only compared when paths come from the same neighboring AS; here ISP1 and ISP2 are different ASes, so MED would not be compared. Option C is wrong because local preference is an attribute used within an AS to influence outbound traffic, not sent to external peers; setting it on R1 for routes learned from ISP1 affects R1's choice of exit path, not how ISPs send traffic inbound. Option D is wrong because the no-export community prevents a route from being advertised to any eBGP peers beyond the immediate neighbor; using it on R1's updates to ISP1 would block the prefix from being propagated further, which is unrelated to influencing inbound path preference.

Practice this question →

MCQmedium

ip vrf BLUE rd 100:1 route-target export 100:1 route-target import 100:1 ! interface GigabitEthernet0/1 ip vrf forwarding BLUE ip address 10.1.1.1 255.255.255.0 ! router bgp 65000 neighbor 192.168.1.1 remote-as 65000 neighbor 192.168.1.1 update-source Loopback0 address-family ipv4 vrf BLUE neighbor 192.168.1.1 activate network 10.1.1.0 mask 255.255.255.0 ! What is missing from this MPLS L3VPN configuration?

A.The BGP neighbor needs 'send-community extended' under the address-family to exchange VPN routes.

B.The VRF definition is missing the 'mdt' command for multicast VPN.

C.The interface needs 'mpls ip' enabled for MPLS forwarding.

D.The BGP neighbor needs 'remote-as 65000' under the VRF address-family.

AnswerA

Correct. Without 'send-community extended', the router will not send extended communities, which are essential for VPN route import/export.

Why this answer

In an MPLS L3VPN, the BGP neighbor must be configured to send extended communities to carry the route target (RT) information that identifies VPN membership. Without the 'send-community extended' command under the address-family ipv4 vrf BLUE, the BGP updates will not include the RT, and the remote PE will not import the routes into the correct VRF. This is a mandatory step for VPNv4 or VPN address-family operation, even when using the VRF address-family directly.

Exam trap

Cisco often tests the misconception that 'mpls ip' must be enabled on every interface in an MPLS network, but the trap here is that it is only required on core-facing interfaces, not on the customer-facing VRF interface.

How to eliminate wrong answers

Option B is wrong because the 'mdt' command is used for multicast VPN (MVPN) configurations, which is not required for a basic unicast MPLS L3VPN setup like this one. Option C is wrong because 'mpls ip' is needed on the core-facing interfaces (e.g., between P and PE routers) to enable MPLS label switching, but not on the customer-facing interface (GigabitEthernet0/1) which is attached to the VRF; MPLS forwarding on the CE-facing interface is not required. Option D is wrong because the 'remote-as 65000' is already configured globally under router bgp 65000 for the neighbor 192.168.1.1, and it does not need to be repeated under the VRF address-family; the VRF address-family inherits the neighbor's remote-as from the global BGP configuration.

Practice this question →

MCQhard

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-POLICY Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what can be concluded?

A.SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.

B.BGP traffic is being dropped because it exceeds the CIR.

C.All traffic to the control plane is being dropped.

D.The control-plane policy is applied in the output direction.

AnswerA

The SNMP class shows 150 conformed and 50 dropped (exceeded+violated), while BGP shows all 50 conformed.

Why this answer

The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

Exam trap

The trap here is that candidates may misinterpret the 'exceeded' and 'violated' counters as indicating that all traffic in a class is being dropped, when in fact only packets that exceed the policer thresholds are dropped, while conforming traffic is still transmitted.

How to eliminate wrong answers

Option B is wrong because the BGP-CLASS shows 0 exceeded and 0 violated packets, indicating no drops; it is not exceeding its CIR. Option C is wrong because the output shows that conformed packets for all classes are being transmitted, so not all traffic is dropped. Option D is wrong because the command 'show policy-map control-plane' and the output explicitly state 'Service-policy input: CoPP-POLICY', meaning the policy is applied in the input direction, not output.

Practice this question →

MCQeasy

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

A.The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.

B.The BGP neighbor is not configured with the password command.

C.The route-target import/export values are incorrect for the customer.

D.The engineer forgot to configure the VRF under the BGP router-id.

AnswerA

Correct because the ip vrf forwarding command clears the IP address on the interface, requiring it to be re-entered.

Why this answer

When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

Exam trap

Cisco often tests the fact that applying a VRF to an interface removes the IP address, leading candidates to overlook the need to reconfigure it, and instead focus on BGP or VRF configuration errors.

How to eliminate wrong answers

Option B is wrong because BGP password configuration is optional and not required for session establishment; the session fails due to missing IP address, not authentication. Option C is wrong because the engineer verified correct route-target import/export values, so this is not the issue. Option D is wrong because BGP router-id is a global or VRF-level parameter that does not need to be explicitly configured under the VRF; it defaults to the highest loopback or interface IP, and the session failure is unrelated to router-id.

Practice this question →

MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 1024 1020 10 0 0 02:30:15 5 192.168.1.3 4 65003 500 498 10 0 0 00:15:20 3 10.0.0.2 4 65004 0 0 0 0 0 never Active Based on this output, what can be concluded?

A.All BGP neighbors are fully established.

B.The BGP session to 10.0.0.2 is down due to a TCP connection issue.

C.The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

D.The router is receiving prefixes from all neighbors.

AnswerB

The Active state indicates the router is trying to open a TCP connection but has not succeeded.

Why this answer

The BGP session to neighbor 10.0.0.2 is in the 'Active' state with 'never' uptime and zero messages sent/received. This indicates that the router is actively trying to establish a TCP connection (port 179) but has not yet succeeded, typically due to a connectivity issue such as an unreachable IP, ACL blocking, or incorrect neighbor configuration. The 'Active' state specifically means the BGP process is waiting for the TCP connection to complete, confirming a TCP-level problem.

Exam trap

Cisco often tests the distinction between 'Active' and 'Idle' states—candidates may confuse 'Active' as meaning the session is up or partially up, but 'Active' specifically indicates a TCP connection failure, not a BGP configuration error like wrong AS number (which would cause 'Idle').

How to eliminate wrong answers

Option A is wrong because the neighbor 10.0.0.2 is in 'Active' state, not 'Established', so not all BGP neighbors are fully established. Option C is wrong because the 'Up/Down' column shows 02:30:15 for neighbor 192.168.1.2, not 192.168.1.3, which has an uptime of 00:15:20. Option D is wrong because the router is receiving prefixes only from the two established neighbors (5 and 3 prefixes), but the neighbor 10.0.0.2 has zero prefixes received (State/PfxRcd is blank), so it is not receiving prefixes from all neighbors.

Practice this question →

MCQmedium

Examine the following BGP configuration: router bgp 65001 bgp log-neighbor-changes neighbor 10.1.1.1 remote-as 65002 neighbor 10.1.1.1 route-map SET_MED out ! route-map SET_MED permit 10 set metric 50 What is the purpose of this configuration?

A.It sets the MED value to 50 for all routes sent to the neighbor 10.1.1.1.

B.It sets the local preference to 50 for routes received from the neighbor.

C.It filters routes with a metric of 50 from being advertised to the neighbor.

D.It sets the weight to 50 for routes learned from the neighbor.

AnswerA

The route-map is applied outbound, and the set metric command sets the MED attribute.

Why this answer

The configuration applies a route-map named SET_MED to outbound updates toward neighbor 10.1.1.1. The route-map permits all routes (no match statement) and sets the Multi-Exit Discriminator (MED) to 50. MED is a BGP path attribute that influences inbound traffic from the neighbor AS, making this path less preferred if the neighbor has a lower MED from another entry point.

Thus, all routes sent to 10.1.1.1 will carry a MED of 50.

Exam trap

Cisco often tests the distinction between BGP path attributes (MED vs. local preference vs. weight) and the direction in which they are applied (inbound vs. outbound), causing candidates to confuse 'set metric' with 'set local-preference' or 'set weight'.

How to eliminate wrong answers

Option B is wrong because local preference is set using the 'set local-preference' command in a route-map, and it applies to inbound updates, not outbound; the configuration here uses 'set metric' (MED) on outbound updates. Option C is wrong because the route-map is configured with 'permit' and no match condition, so it does not filter routes; it modifies the MED attribute of all advertised routes, not filtering based on metric. Option D is wrong because weight is a Cisco-proprietary attribute set with 'set weight' in a route-map, and it applies to inbound updates; this configuration sets MED on outbound updates, not weight.

Practice this question →

MCQmedium

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream BGP route updates to a collector using gRPC dial-out. The engineer wants to ensure that the telemetry data is encrypted in transit. Which additional configuration is required to secure the gRPC telemetry stream?

A.Configure IPsec between the router and the collector

B.Enable TLS on the gRPC connection by configuring a trustpoint and using the 'transport grpc tls' command

C.Use SSH tunneling for the gRPC connection

D.Configure DTLS on the telemetry receiver

AnswerB

TLS provides encryption for gRPC telemetry, and IOS-XE supports it with proper trustpoint configuration.

Why this answer

To configure TLS on the gRPC connection. gRPC supports TLS for encryption, and on IOS-XE, this requires configuring a trustpoint and enabling TLS under the telemetry receiver. The other options are incorrect because IPsec is not directly integrated with gRPC telemetry; SSH is used for NETCONF, not gRPC; and DTLS is used for UDP-based telemetry, not gRPC.

Practice this question →

MCQmedium

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_MED out ! route-map SET_MED permit 10 set metric 50 ! What is the effect of this configuration on routes advertised to 10.0.0.2?

A.All routes sent to 10.0.0.2 will have the MED value set to 50.

B.Routes received from 10.0.0.2 will have their MED set to 50.

C.The local preference of routes sent to 10.0.0.2 is set to 50.

D.The configuration is invalid because MED cannot be set on outbound updates.

AnswerA

Correct. The route-map sets MED on outbound updates.

Why this answer

The route-map SET_MED is applied to outbound updates to neighbor 10.0.0.2, and the 'set metric 50' command sets the Multi-Exit Discriminator (MED) attribute to 50 for all routes advertised to that neighbor. The MED is a metric used to influence inbound traffic from the AS of the neighbor, and it is propagated to the neighbor's BGP table.

Exam trap

Cisco often tests the distinction between outbound and inbound route-map application, and the trap here is confusing the 'set metric' command (which sets MED) with 'set local-preference' or assuming that MED cannot be set on outbound updates.

How to eliminate wrong answers

Option B is wrong because the route-map is applied to outbound updates ('out'), not inbound updates, so it does not affect routes received from 10.0.0.2. Option C is wrong because the 'set metric' command sets the MED, not the local preference; local preference is set using 'set local-preference' and is used for outbound traffic within the local AS. Option D is wrong because the configuration is valid; MED can be set on outbound updates using a route-map with the 'set metric' command, and this is a common practice for influencing path selection in neighboring ASes.

Practice this question →

MCQmedium

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map SET_ORIGIN in ! route-map SET_ORIGIN permit 10 set origin incomplete ! What is the effect of this configuration?

A.Routes received from 10.0.0.2 will have their origin set to incomplete, making them less preferred compared to IGP origin.

B.Routes sent to 10.0.0.2 will have their origin set to incomplete.

C.The router will not advertise any routes with origin incomplete to other peers.

D.The configuration is invalid because origin cannot be changed with a route-map.

AnswerA

Correct. Incomplete origin is the least preferred.

Why this answer

The route-map SET_ORIGIN is applied as an inbound filter to neighbor 10.0.0.2. When a route is received, the 'set origin incomplete' command changes the origin attribute to incomplete (value 2). In BGP path selection, origin incomplete is the least preferred origin type, making these routes less preferred than routes with IGP (value 0) or EGP (value 1) origin.

Exam trap

Cisco often tests the directionality of route-maps (in vs out) and the fact that origin can be modified with a route-map, leading candidates to mistakenly think the route-map applies to outbound updates or that origin is immutable.

How to eliminate wrong answers

Option B is wrong because the route-map is applied 'in' (inbound), not 'out' (outbound), so it affects received routes, not sent routes. Option C is wrong because the configuration does not filter or suppress routes; it only modifies the origin attribute of received routes, and routes with origin incomplete can still be advertised to other peers. Option D is wrong because the origin attribute can be changed using a route-map with the 'set origin' command; this is a valid BGP configuration.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order for BGP route aggregation with suppress-map is: first, define a prefix-list to match the more-specific routes you want to suppress. Second, create a route-map with a suppress clause that references the prefix-list. Third, configure the aggregate-address in BGP under the address-family.

Fourth, apply the suppress-map to the aggregate-address command (typically as part of the aggregate-address command itself). Finally, verify the summary route and the suppressed routes.

Practice this question →

MCQmedium

Which BGP attribute is preferred when the local preference is equal?

A.AS-path length (shorter is better)

B.MED (lower is better)

C.Origin code (IGP is preferred over EGP)

D.Next-hop IP address (lowest is preferred)

AnswerA

After local preference, BGP compares AS-path length; shorter paths are preferred.

Why this answer

When the local preference is equal, BGP selects the path with the shortest AS-path length. This is because AS-path length is the second tiebreaker in the BGP best path selection algorithm (after highest weight, then highest local preference). A shorter AS-path implies fewer autonomous system hops, which is generally preferred for routing efficiency.

Exam trap

Cisco often tests the order of BGP path selection tiebreakers, and the trap here is that candidates mistakenly think MED is compared before AS-path length, or that next-hop IP address is a valid tiebreaker.

How to eliminate wrong answers

Option B is wrong because MED (Multi-Exit Discriminator) is compared only when the paths come from the same neighboring AS; it is not the next tiebreaker after local preference — AS-path length is evaluated first. Option C is wrong because origin code (IGP < EGP < incomplete) is compared after AS-path length, not before. Option D is wrong because the next-hop IP address is never a tiebreaker in BGP path selection; BGP uses the IGP metric to the next-hop, not the IP address value.

Practice this question →

MCQmedium

router bgp 65000 bgp router-id 10.0.0.1 neighbor 10.0.0.2 remote-as 65001 neighbor 10.0.0.2 route-map FILTER in ! route-map FILTER deny 10 match ip address prefix-list BLOCKED route-map FILTER permit 20 ! ip prefix-list BLOCKED seq 5 permit 10.0.0.0/8 ! What is the effect of this configuration?

A.All routes from neighbor 10.0.0.2 are accepted except those matching 10.0.0.0/8.

B.Only routes matching 10.0.0.0/8 are accepted from the neighbor.

C.The configuration is invalid because route-map must have a permit statement first.

D.The prefix-list is misconfigured because it should use 'deny' instead of 'permit'.

AnswerA

Correct. The deny statement blocks the specific prefix, and the permit allows everything else.

Why this answer

The route-map FILTER is applied inbound from neighbor 10.0.0.2. Sequence 10 denies routes that match the prefix-list BLOCKED, which permits 10.0.0.0/8. Sequence 20 is a permit statement with no match, which implicitly permits all other routes.

Therefore, only routes matching 10.0.0.0/8 are denied, and all other routes are accepted.

Exam trap

Cisco often tests the interaction between route-map sequence numbers and the implicit deny at the end of a route-map, leading candidates to forget that a permit statement with no match (like sequence 20) is needed to allow all other routes through.

How to eliminate wrong answers

Option B is wrong because the configuration denies routes matching 10.0.0.0/8, not accepts them. Option C is wrong because route-maps can start with a deny statement; there is no requirement for the first statement to be permit. Option D is wrong because the prefix-list uses 'permit' to define which prefixes are matched by the route-map's deny clause; using 'deny' in the prefix-list would not match the intended prefixes.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to the value that is preferred (highest or lowest) during path selection on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Highest

Lowest

Why these pairings

Higher weight is preferred; higher LOCAL_PREF is preferred; shorter AS_PATH length is preferred; lower MULTI_EXIT_DISC is preferred; lower IGP metric to next-hop is preferred.

Practice this question →

MCQmedium

An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?

A.The VRF is not configured with a route distinguisher.

B.The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.

C.The route-target import/export values are incorrect.

D.The interface in the VRF is not configured with the ipv4 address.

AnswerB

Correct because without this, the VRF routes are not injected into BGP VPNv4.

Why this answer

In MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.

Exam trap

Cisco often tests the misconception that configuring the VRF and establishing the BGP VPNv4 session is enough, but the trap is that candidates overlook the mandatory redistribution step under the VRF-specific BGP address family, which is required to inject routes into the VPNv4 table.

How to eliminate wrong answers

Option A is wrong because a route distinguisher (RD) is required for VRF configuration to make routes unique across VPNs, but its absence would cause the VRF to fail to install routes or cause route duplication, not specifically prevent advertisement to the route reflector; the question states the VRF is configured with route-target import/export, implying an RD is likely present. Option C is wrong because the route-target import 100:1 and export 100:1 values are correctly matched, which is necessary for route distribution between PE routers; incorrect values would affect import/export filtering but not the initial advertisement from the PE to the route reflector. Option D is wrong because an interface in the VRF with an IPv4 address is required for the VRF to have local routes, but the issue is about route advertisement to the route reflector, not about the existence of routes; the VRF could have routes from other sources (e.g., static) without a directly connected interface.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP session establishment between eBGP peers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

BGP session establishment begins with the TCP three-way handshake (SYN, SYN-ACK, ACK). Once TCP is established, BGP sends an OPEN message to negotiate capabilities. The peer responds with an OPEN message.

After both OPENs are exchanged, BGP sends KEEPALIVE messages. Finally, the session moves to the Established state and UPDATE messages can be exchanged.

Practice this question →

Matchingmedium

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Carries MPLS Layer 3 VPN routes with route distinguisher and route target

Carries standard IPv4 unicast routes (non-VPN)

Carries standard IPv6 unicast routes

Carries MPLS Layer 3 VPN routes for IPv6 customer prefixes

Carries Layer 2 VPN information such as VPLS or EVPN

Why these pairings

The VPNv4 unicast address family carries MPLS VPN routes with RD and RT; IPv4 unicast carries standard IPv4 routes; IPv6 unicast carries IPv6 routes; VPNv6 unicast carries IPv6 MPLS VPN routes; L2VPN address family carries Layer 2 VPN information like VPLS.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.MED (Multi-Exit Discriminator)

B.Local Preference

C.Weight

D.AS Path

AnswerA

Correct. Lower MED is preferred.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from a neighboring AS. A lower MED value is preferred because it indicates a more preferred path into the AS, making it the correct answer when the question asks for the attribute preferred with the lowest value.

Exam trap

Cisco often tests the confusion between attributes that prefer the lowest value (MED) versus those that prefer the highest value (Weight, Local Preference), and candidates mistakenly apply the 'lowest is best' rule to all attributes without remembering the specific behavior of each.

How to eliminate wrong answers

Option B is wrong because Local Preference is preferred when it has the highest value, not the lowest, as it influences outbound traffic from the local AS. Option C is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has the highest value, not the lowest, and it is local to the router. Option D is wrong because AS Path is preferred when it is the shortest (lowest number of AS hops), but the question asks for the attribute preferred with the lowest value, and AS Path is not a numerical value in the same sense; it is a sequence of AS numbers, and the preference is based on length, not a single lowest value.

Practice this question →

MCQmedium

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

A.Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.

B.Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

C.Use SNMP traps to send interface and BGP state changes to the collector.

D.Deploy IP SLA responders on the switches to measure performance and send results via syslog.

AnswerA

Correct because MDT with gRPC/gNMI provides scalable, real-time streaming of structured data from NX-OS devices.

Why this answer

Model-driven telemetry (MDT) using gRPC or gNMI is the correct choice because it provides a push-based, scalable, and real-time streaming mechanism for subscribing to specific YANG data paths, such as interface counters and BGP neighbor state, directly from Cisco Nexus 9000 switches running NX-OS. This approach eliminates the polling overhead of SNMP and supports high-frequency data collection, making it ideal for large-scale enterprise monitoring.

Exam trap

Cisco often tests the distinction between streaming telemetry (push-based, model-driven) and legacy monitoring methods like SNMP or NetFlow, where candidates mistakenly choose NetFlow because it sounds similar to 'streaming' or SNMP traps because they think 'state changes' imply event-driven traps, but the key is that MDT provides structured, scalable, and real-time data for operational state, not just flow records or performance metrics.

How to eliminate wrong answers

Option B is wrong because NetFlow v9 is designed for traffic flow analysis (e.g., IP flows, protocols, ports) and does not natively stream interface counters or BGP neighbor state changes; it focuses on network traffic metadata, not device operational state. Option C is wrong because SNMP traps are event-driven but lack the scalability and granularity of streaming telemetry; they are pull-based for counters and can miss state changes due to unreliable UDP transport, and they do not support the high-frequency, model-driven subscriptions required for real-time visibility. Option D is wrong because IP SLA responders measure network performance metrics like latency and jitter, not interface counters or BGP neighbor state; they send results via syslog, which is a log-based, non-structured method unsuitable for streaming telemetry.

Practice this question →

MCQmedium

An engineer is troubleshooting an MPLS VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are running OSPF with the CE routers. On PE1, the 'show ip route vrf CUSTOMER' output shows 10.2.2.0/24 as an OSPF route, but the prefix is not present in the global BGP table. What is the most likely cause?

A.Redistribution from OSPF into BGP under the VRF is not configured on PE1.

B.The OSPF adjacency between PE1 and CE1 is down.

C.The VRF forwarding table on PE1 is full.

D.MPLS LDP is not enabled on the PE1-CE1 link.

AnswerA

Correct because VRF routes must be redistributed into BGP to be advertised as VPNv4 prefixes.

Why this answer

In an MPLS VPN, the PE router must redistribute OSPF routes learned from the CE into MP-BGP under the VRF to propagate them across the MPLS backbone. Without this redistribution, the prefix 10.2.2.0/24 appears in the VRF routing table as an OSPF route but is never injected into the BGP table, so it cannot be advertised to the remote PE. This explains why CE1 cannot reach CE2 despite the route being present locally on PE1.

Exam trap

Cisco often tests the distinction between a route being present in the VRF routing table versus being present in the BGP table, trapping candidates who assume that OSPF-learned routes are automatically propagated across the MPLS VPN backbone without explicit redistribution into MP-BGP.

How to eliminate wrong answers

Option B is wrong because if the OSPF adjacency between PE1 and CE1 were down, the 10.2.2.0/24 route would not appear in the VRF routing table at all, but the question states it is present. Option C is wrong because a full VRF forwarding table would cause route installation failures or drops, not the specific symptom of a route missing from the global BGP table while present in the VRF. Option D is wrong because MPLS LDP on the PE1-CE1 link is irrelevant for MPLS VPN; LDP is used for label distribution in the core, not on the CE-facing link, and the issue is about BGP route propagation, not label switching.

Practice this question →

MCQhard

A large enterprise uses a centralized automation platform based on Ansible Tower to manage its network infrastructure. The network consists of 500 Cisco IOS XE routers and switches distributed across multiple sites. The automation team has created a playbook that configures BGP peerings on all devices. The playbook uses the ios_bgp module. Recently, during a maintenance window, the playbook was run against a subset of devices that were supposed to be upgraded to a new IOS XE version. However, after the run, several devices lost their BGP configurations entirely. The team discovers that the new IOS XE version introduced a new BGP configuration model that is not fully compatible with the ios_bgp module's expected CLI commands. The playbook failed silently on those devices, and the existing BGP configuration was removed. The team needs to prevent this from happening in future maintenance windows. Which action should be taken?

A.Add a pre-task that validates the device's OS version and conditionally applies the appropriate module or command set

B.Implement idempotency checks in the playbook using the 'check_mode' option

C.Set 'gather_facts: no' in the playbook to speed up execution and avoid version detection issues

D.Replace the ios_bgp module with the ios_config module and use raw CLI commands for BGP configuration

AnswerA

Pre-validation allows the playbook to use version-appropriate modules or commands, preventing silent failures.

Why this answer

It directly addresses the root cause: the new IOS XE version uses an incompatible BGP configuration model. By adding a pre-task that validates the OS version, the playbook can conditionally apply the correct module (e.g., ios_bgp for older versions or a different module/CLI for the new model), preventing silent failures and configuration loss. This ensures the automation adapts to version-specific changes, maintaining idempotency and safety.

Exam trap

Cisco often tests the misconception that idempotency (check_mode) or simply using raw CLI commands (ios_config) solves version incompatibility, when the real solution is version-aware conditional logic to handle model changes.

How to eliminate wrong answers

Option B is wrong because 'check_mode' only simulates changes without applying them; it does not prevent the ios_bgp module from removing existing BGP configs due to incompatibility, nor does it handle version-specific behavior. Option C is wrong because setting 'gather_facts: no' would skip version detection entirely, making the playbook blind to the OS version and increasing the risk of applying incompatible commands. Option D is wrong because replacing ios_bgp with ios_config and raw CLI commands bypasses Ansible's structured module logic, losing idempotency and validation, and still requires version-aware logic to avoid the same incompatibility issue.

Practice this question →

MCQmedium

Given the following BGP configuration on a Cisco IOS-XE device: router bgp 65001 bgp router-id 1.1.1.1 neighbor 10.0.0.2 remote-as 65002 neighbor 10.0.0.2 update-source Loopback0 neighbor 10.0.0.2 ebgp-multihop 2 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 What is the purpose of the 'ebgp-multihop 2' command?

A.It allows the BGP session to be established even if the neighbor is not directly connected, with a maximum of 2 hops.

B.It sets the BGP session to use two TCP connections for redundancy.

C.It enables BGP to use two different paths to reach the neighbor.

D.It is required because the neighbor is configured with a loopback interface as the update source.

AnswerA

Correct. EBGP multihop with value 2 allows the neighbor to be up to 2 hops away (TTL=2).

Why this answer

EBGP multihop allows the BGP session to be established between non-directly connected peers. The number specifies the maximum TTL for the BGP packets. Here, TTL=2 allows one intermediate hop.

Practice this question →

MCQmedium

ip vrf RED rd 200:1 route-target export 200:1 route-target import 200:1 ! interface GigabitEthernet0/1 ip vrf forwarding RED ip address 10.1.1.1 255.255.255.0 ! router bgp 65000 neighbor 192.168.1.1 remote-as 65000 neighbor 192.168.1.1 update-source Loopback0 address-family vpnv4 neighbor 192.168.1.1 activate neighbor 192.168.1.1 send-community extended ! Which statement about this configuration is true?

A.The configuration is correct for MPLS L3VPN, but the VRF RED must also be configured under BGP with 'address-family ipv4 vrf RED'.

B.The 'send-community extended' command is unnecessary because it is enabled by default.

C.The interface GigabitEthernet0/1 requires 'mpls ip' to forward MPLS packets.

D.The VRF RED will automatically import routes from the VPNv4 address-family without additional configuration.

AnswerA

Correct. The VRF needs to be activated under BGP to advertise and receive VPN routes.

Why this answer

In an MPLS L3VPN configuration, after creating the VRF and applying it to an interface, you must also configure the VRF under BGP using the 'address-family ipv4 vrf RED' command to exchange IPv4 routes within that VRF. Without this, the VRF will not participate in BGP route exchange, and the VPNv4 address-family alone cannot import or export VRF routes. The given configuration is incomplete, as it lacks the VRF-specific address-family under BGP.

Exam trap

Cisco often tests the misconception that applying a VRF to an interface and configuring route-target import/export is sufficient for BGP route exchange, but the missing 'address-family ipv4 vrf' under BGP is the critical step that candidates overlook.

How to eliminate wrong answers

Option B is wrong because the 'send-community extended' command is not enabled by default for VPNv4 neighbors; it must be explicitly configured to allow the exchange of extended communities, which are essential for MPLS L3VPN route target filtering. Option C is wrong because the 'mpls ip' command is required on interfaces that participate in MPLS forwarding (e.g., core-facing interfaces), but not on the customer-facing interface GigabitEthernet0/1, which only needs VRF forwarding and an IP address. Option D is wrong because VRF RED will not automatically import routes from the VPNv4 address-family; you must explicitly configure the VRF under BGP with 'address-family ipv4 vrf RED' and then use the 'import' and 'export' route-target commands (already done in VRF definition) to control route exchange.

Practice this question →

MCQhard

A service provider uses MPLS L3VPN with OSPF as the PE-CE routing protocol. A customer reports that a new subnet added on CE1 is not reachable from CE2, even though the PE1 router has the route in its VRF and BGP table. The 'show ip bgp vpnv4 vrf CUSTOMER' on PE2 shows the prefix with a valid next-hop. What should the engineer check next?

A.Verify that LDP has allocated a label for the BGP next-hop address on PE2.

B.Check if OSPF is redistributed into BGP on PE1.

C.Ensure the route is present in the global BGP table on PE2.

D.Confirm that the VRF on PE2 has the correct route-target import.

AnswerA

Correct because without a label for the next-hop, the VPN route cannot be forwarded.

Why this answer

The issue is that PE2 has the prefix in its BGP VPNv4 table with a valid next-hop, but the route is not reachable from CE2. This indicates a label-switching problem in the MPLS core. The next step is to verify that LDP has allocated a label for the BGP next-hop address on PE2, because without an LDP label for the next-hop, the MPLS forwarding path is broken and packets cannot be label-switched across the provider core.

Exam trap

Cisco often tests the distinction between control-plane reachability (BGP table) and data-plane forwarding (MPLS label switching), trapping candidates who assume that a route in the BGP table guarantees end-to-end connectivity.

How to eliminate wrong answers

Option B is wrong because OSPF redistribution into BGP on PE1 is already confirmed working—PE1 has the route in its VRF and BGP table, so redistribution is not the issue. Option C is wrong because the route is already present in the BGP VPNv4 table on PE2 (as shown by 'show ip bgp vpnv4 vrf CUSTOMER'), and the global BGP table is irrelevant for VRF routes. Option D is wrong because if the VRF on PE2 had incorrect route-target import, the prefix would not appear in the VRF or BGP VPNv4 table at all, but the question states it is present with a valid next-hop.

Practice this question →

MCQmedium

An enterprise network uses BGP to connect to two ISPs. The router has a BGP configuration that includes the command 'bgp bestpath med missing-as-worst'. The engineer notices that routes from ISP-A that do not have the MED attribute are being preferred over routes from ISP-B that have a MED of 50. What is the effect of the 'bgp bestpath med missing-as-worst' command?

A.It causes routes without the MED attribute to be treated as having the highest MED value, making them less preferred.

B.It causes routes without the MED attribute to be treated as having a MED value of 0, making them more preferred.

C.It causes routes with the MED attribute to be ignored during path selection.

D.It causes the router to add a MED value of 0 to all routes that are missing MED.

AnswerA

Correct because the command sets missing MED to the worst possible value, which is the highest MED, making those routes less preferred in path selection.

Why this answer

The 'bgp bestpath med missing-as-worst' command instructs the router to treat routes that lack the MED (Multi-Exit Discriminator) attribute as if they have the highest possible MED value (effectively infinity). Since a higher MED value is less preferred in BGP path selection, routes without MED become the least preferred among paths from the same AS. In this scenario, routes from ISP-A missing MED are treated as having a very high MED, making them less preferred than routes from ISP-B with a MED of 50, which contradicts the observed behavior, but the command's intended effect is to make missing-MED routes less preferred.

Exam trap

Cisco often tests the default behavior versus the modified behavior with 'missing-as-worst', and the trap here is that candidates mistakenly think the command makes missing-MED routes more preferred (like a MED of 0) instead of less preferred (like the highest MED).

How to eliminate wrong answers

Option B is wrong because the command does not treat missing MED as 0; treating missing MED as 0 would make those routes more preferred, which is the default behavior without this command. Option C is wrong because the command does not ignore MED during path selection; it specifically modifies how missing MED is evaluated, but MED is still considered. Option D is wrong because the command does not add a MED value of 0 to routes; it only changes the comparison logic so that missing MED is treated as the highest value, not a literal addition of 0.

Practice this question →