CCNA Bgp Questions

Drag & Drophard

Drag and drop the steps of BGP best path selection process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

BGP best path selection follows a strict order: first, prefer the path with the highest weight (Cisco proprietary). If equal, prefer highest local preference. Next, prefer locally originated routes (network/aggregate).

Then, prefer the shortest AS_PATH. Finally, prefer the lowest MED (if same AS).

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to its preferred value (highest or lowest) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Highest

Lowest

Why these pairings

Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you define the prefix-list to match specific routes. Then you create the route-map with the suppress clause. Next, you configure the aggregate-address command referencing the route-map.

After that, you verify the aggregated route in the BGP table. Finally, you check that more specific routes are suppressed.

Practice this question →

Multi-Selectmedium

Which three statements about BGP peering are true? (Choose three.)

Select 3 answers

A.eBGP peers are typically directly connected, but can be multi-hop with the ebgp-multihop command.

B.iBGP peers can be non-directly connected and often use loopback interfaces for reachability.

C.The default TTL for eBGP packets is 255.

D.In iBGP, all routers within the same AS must be fully meshed unless route reflectors or confederations are used.

E.The BGP router ID is used only for OSPF, not for BGP.

AnswersA, B, D

Correct because eBGP by default assumes direct connection, but multi-hop is possible.

Why this answer

eBGP peers typically use a directly connected interface or a loopback with proper routing. iBGP peers can be non-directly connected and often use loopback interfaces for stability. The TTL for eBGP is set to 1 by default, but can be increased with the ebgp-multihop command. iBGP requires that all routers in the same AS are fully meshed or use route reflectors to avoid loops. The BGP identifier (router ID) is used to identify the BGP speaker and is used in loop prevention for iBGP.

Practice this question →

Multi-Selecthard

Which three statements about BGP route selection are true? (Choose three.)

Select 3 answers

A.A route with a lower MED is preferred over a route with a higher MED when all other factors are equal.

B.A route with a higher LOCAL_PREF is preferred over a route with a lower LOCAL_PREF.

C.A route with a shorter AS_PATH is preferred over a route with a longer AS_PATH.

D.A route with a lower weight is preferred over a route with a higher weight.

E.A route with ORIGIN code EGP is preferred over a route with ORIGIN code IGP.

AnswersA, B, C

Correct: MED is used to influence inbound traffic; a lower MED is preferred.

Why this answer

The BGP best-path selection algorithm considers the highest weight first, then highest LOCAL_PREF, then locally originated routes (network or aggregate), then shortest AS_PATH, then lowest ORIGIN code (IGP < EGP < incomplete), then lowest MED, and so on. Routes with a lower MED are preferred. The highest LOCAL_PREF is preferred.

The shortest AS_PATH is preferred. The lowest ORIGIN code is preferred. The lowest weight is not preferred; weight is Cisco-specific and higher weight is preferred.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of configuring an iBGP route reflector cluster into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, enable BGP on the route reflector. Second, configure the route reflector's cluster ID (if not using router-id). Third, configure the route reflector clients.

Fourth, establish iBGP peerings between the route reflector and its clients. Finally, verify that the route reflector is advertising routes correctly.

Practice this question →

MCQhard

A network engineer runs the following command on Router R6: R6# show ip route vrf CUSTOMER-D VRF CUSTOMER-D: 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.400 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.400 192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask B 192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00 R6# show ip bgp vpnv4 vrf CUSTOMER-D BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i Based on this output, what can be concluded?

A.The route 192.168.1.0/24 is learned via OSPF

B.The route 192.168.1.0/24 is installed in the VRF routing table from BGP

C.The next-hop 10.0.0.2 is not reachable

D.VRF CUSTOMER-D has no directly connected networks

AnswerB

The VRF route shows B, and the BGP table shows the same prefix with next-hop 10.0.0.2.

Why this answer

The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Exam trap

Cisco often tests the distinction between the routing table (show ip route) and the BGP table (show ip bgp), where a route can be present in BGP but not installed in the routing table if the next-hop is unreachable, but here the route is installed, confirming reachability.

How to eliminate wrong answers

Option A is wrong because the route is marked with 'B' in the routing table, which indicates BGP, not OSPF (which would show 'O'). Option C is wrong because the route is marked as 'best' (>) in BGP and installed in the routing table, which requires the next-hop 10.0.0.2 to be reachable via the directly connected subnet 10.0.0.0/30. Option D is wrong because the VRF has directly connected networks (10.0.0.0/30 and 10.0.0.1/32) as shown by the 'C' and 'L' entries in the routing table.

Practice this question →

Matchingmedium

Drag and drop each BGP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establishes BGP peering parameters

Advertises or withdraws prefixes

Reports error conditions

Maintains session liveness

Requests re-advertisement of routes

Why these pairings

OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.

Practice this question →

Multi-Selectmedium

Which two statements about BGP TTL security are true? (Choose two.)

Select 2 answers

A.BGP TTL security uses the Generalized TTL Security Mechanism (GTSM) to validate the TTL of incoming BGP packets.

B.The command 'neighbor <ip> ttl-security hops <hop-count>' is used to enable BGP TTL security on a per-neighbor basis.

C.The default TTL value for eBGP packets is 64.

D.BGP TTL security encrypts the BGP update messages to prevent eavesdropping.

E.BGP TTL security is only applicable to eBGP sessions, not iBGP.

AnswersA, B

Correct because GTSM checks that the TTL is within a valid range based on the configured hop count.

Why this answer

BGP TTL security (GTSM) protects against CPU-based attacks by ensuring incoming BGP packets have a TTL of 255 minus the expected hop count. The neighbor ttl-security hops command is used on Cisco IOS-XE to enable this feature, and it must be configured on both peers to be effective. Option C is incorrect because the default TTL for eBGP is 1, not 64.

Option D is incorrect because GTSM does not encrypt BGP updates. Option E is incorrect because GTSM is supported for both eBGP and iBGP.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.MED (Multi-Exit Discriminator)

B.Local Preference

C.Weight

D.AS Path

AnswerA

The MED attribute is used to indicate the preferred path into an AS; lower MED is better.

Why this answer

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

Exam trap

Cisco often tests the distinction between attributes where higher is preferred (Local Preference, Weight) versus lower is preferred (MED, AS Path length), and the trap here is that candidates might confuse MED with Local Preference or Weight, both of which use higher values as better.

How to eliminate wrong answers

Option B (Local Preference) is wrong because Local Preference is used to influence outbound traffic from an AS, and a higher value is preferred, not lower. Option C (Weight) is wrong because Weight is a Cisco-proprietary attribute that is preferred when it has a higher value, not lower. Option D (AS Path) is wrong because a shorter AS Path length is preferred, meaning a lower count is better, but the question asks for an attribute where the lowest value is preferred, and AS Path is not typically described as a 'value' in the same sense as MED; moreover, AS Path length is a count, not a metric like MED, and the question's phrasing aligns more directly with MED's explicit numeric comparison.

Practice this question →

Multi-Selectmedium

Which two statements about BGP path attributes are true? (Choose two.)

Select 2 answers

A.AS_PATH is a well-known mandatory attribute.

B.LOCAL_PREF is a well-known discretionary attribute.

C.MED is an optional transitive attribute.

D.ORIGIN is a well-known discretionary attribute used for loop prevention.

E.NEXT_HOP is an optional non-transitive attribute.

AnswersA, B

Correct: AS_PATH is well-known mandatory; it is always included in BGP updates and is used for loop prevention and path selection.

Why this answer

The AS_PATH attribute is well-known mandatory and is used for loop prevention and path selection. The LOCAL_PREF attribute is well-known discretionary and is used to influence outbound traffic from an AS. The MED attribute is optional non-transitive and is used to influence inbound traffic.

The ORIGIN attribute is well-known mandatory but not used for loop prevention. The NEXT_HOP attribute is well-known mandatory but is not optional.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP confederations setup between sub-ASes into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you assign the confederation identifier (main AS). Then you define the member sub-AS numbers. Next, you configure eBGP peering between sub-ASes using the sub-AS numbers.

After that, you ensure iBGP is configured within each sub-AS. Finally, you verify confederation peers with show ip bgp neighbors.

Practice this question →

MCQeasy

Which BGP attribute is preferred with the lowest value?

A.MULTI_EXIT_DISC (MED)

B.LOCAL_PREF

C.AS_PATH

D.WEIGHT

AnswerA

Correct. MED is used to influence inbound traffic and lower values are preferred.

Why this answer

In BGP path selection, the LOCAL_PREF attribute is used to prefer paths within an AS. A higher LOCAL_PREF is preferred, but the question asks for the attribute preferred with the lowest value. The WEIGHT attribute is Cisco-specific and is preferred with the highest value.

The MULTI_EXIT_DISC (MED) attribute is preferred with the lowest value.

Practice this question →

Matchinghard

Drag and drop each BGP path selection criterion on the left to its order of preference (1 = highest priority) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Why these pairings

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH (shortest), then ORIGIN (IGP < EGP < incomplete).

Practice this question →

MCQmedium

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

A.The AS-path contains the local AS number.

B.The next-hop IP address is not reachable.

C.BGP synchronization is enabled.

D.The maximum-prefix limit has been exceeded.

AnswerB

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

Why this answer

For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Exam trap

Cisco often tests the distinction between routes being received in the BGP table versus being installed in the routing table, and the trap here is that candidates confuse synchronization (a deprecated feature) with the next-hop reachability requirement, which is the immediate cause of the 'not valid' status.

How to eliminate wrong answers

Option A is wrong because if the AS-path contains the local AS number, BGP would reject the route due to loop prevention (the route would be marked as invalid or not received at all), but the question states routes are received. Option C is wrong because BGP synchronization is disabled by default in modern IOS versions and, even if enabled, it would affect the route's validity only if the prefix is not present in the IGP, but the next-hop reachability check is more fundamental. Option D is wrong because exceeding the maximum-prefix limit would cause the BGP session to be torn down or the neighbor to be shut down, not simply mark routes as not valid while keeping them in the BGP table.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to its matching attribute type on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Well-known mandatory

Well-known discretionary

Optional transitive

Optional non-transitive

Well-known mandatory

Why these pairings

AS_PATH is well-known mandatory; LOCAL_PREF is well-known discretionary; COMMUNITY is optional transitive; MULTI_EXIT_DISC is optional non-transitive; ORIGIN is well-known mandatory.

Practice this question →

Matchingmedium

Drag and drop each BGP message type on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establishes a BGP session and negotiates capabilities

Advertises new routes or withdraws previously advertised routes

Reports an error condition and closes the BGP session

Periodically sent to keep the BGP session alive

Requests that a peer readvertise its routes

Why these pairings

OPEN establishes a BGP session; UPDATE advertises or withdraws routes; NOTIFICATION indicates an error; KEEPALIVE maintains the session; ROUTE-REFRESH requests readvertisement of routes.

Practice this question →

MCQhard

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

A.The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.

B.The ACL is applied in the wrong order; the deny statement should be before the permit statement.

C.BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

D.CoPP does not affect BGP sessions because they are established before the policy is applied.

AnswerA

Correct because CoPP only applies to traffic matched by the class-map; if the ACL denies traffic, it is not matched, and the default class (often permit) allows it.

Why this answer

The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic.

This explains why BGP sessions from other peers are still being established.

Exam trap

Cisco often tests the misconception that a deny statement in an ACL used with CoPP will drop traffic, when in reality it only prevents the traffic from being matched by that class, allowing it to fall through to the default class which typically permits everything.

How to eliminate wrong answers

Option B is wrong because the order of permit and deny statements in an ACL is critical, but here the permit for host 10.0.0.1 is correctly placed before the deny all; the issue is not about order but about how CoPP treats deny entries. Option C is wrong because BGP uses TCP port 179, not UDP; this is a fundamental protocol fact. Option D is wrong because CoPP affects all traffic arriving at the control plane after the policy is applied, regardless of when sessions were established; existing sessions are still subject to rate-limiting.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you create the prefix-list or AS-path ACL to match routes. Then you define the route-map with match and set clauses. Next, you apply the route-map to a neighbor under the BGP address-family.

After that, you clear the BGP session to apply the policy. Finally, you verify the policy effect with show ip bgp.

Practice this question →

Matchinghard

Drag and drop each BGP path selection criterion on the left to its correct order of preference (1 = highest priority) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Why these pairings

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH length (shortest), then ORIGIN (IGP > EGP > incomplete).

Practice this question →

Multi-Selecthard

Which two statements about BGP route selection are true? (Choose two.)

Select 2 answers

A.A route with a higher LOCAL_PREF is preferred over a route with a lower LOCAL_PREF.

B.A route learned via eBGP is preferred over a route learned via iBGP, all else being equal.

C.A route with a longer AS_PATH is preferred over a route with a shorter AS_PATH.

D.The MED attribute is always compared regardless of the AS of the neighbor.

E.The IGP metric to the next hop is the first criterion in BGP path selection.

AnswersA, B

Correct because BGP prefers higher local preference.

Why this answer

BGP prefers a route with a higher LOCAL_PREF (local preference) over a lower one. A route learned via eBGP is preferred over iBGP because eBGP routes have a lower administrative distance in the BGP decision process (step 7: prefer eBGP over iBGP). The MED is compared only if the routes are from the same neighboring AS.

The shortest AS_PATH is preferred, not the longest. The IGP metric to the next hop is compared only after many other steps.

Practice this question →

MCQmedium

A network engineer is deploying model-driven telemetry on a Cisco Nexus 9000 switch to monitor BGP prefix changes. The engineer wants to use YANG data models and prefers a transport protocol that is lightweight and uses UDP. Which transport protocol should the engineer select for the telemetry stream?

A.gRPC

B.NETCONF

C.RESTCONF

D.SNMP

AnswerD

SNMP uses UDP as its transport protocol, making it lightweight and meeting the engineer's preference. Although SNMP is not based on YANG models, it is the only option that uses UDP.

Why this answer

The engineer explicitly prefers a lightweight transport protocol using UDP. Among the options, only SNMP uses UDP as its transport. Although SNMP is not a model-driven telemetry protocol (it uses MIBs instead of YANG models), the question's requirement for UDP overrides this. gRPC, NETCONF, and RESTCONF all use TCP, so they do not satisfy the UDP requirement.

Therefore, SNMP is the correct answer in this scenario.

Exam trap

The trap is that candidates often associate model-driven telemetry with gRPC and ignore the UDP requirement. They may choose gRPC because it is the standard for YANG-based telemetry, but the question explicitly requires a UDP transport.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order starts with the PE learning the customer route via IGP or static, then redistributing it into MP-BGP as a VPNv4 route with a route distinguisher, advertising it to the other PE via MP-BGP update, the receiving PE importing the route based on matching route targets, and finally installing the route into the appropriate VRF.

Practice this question →

Multi-Selecthard

Which three statements about BGP route reflectors are true? (Choose three.)

Select 3 answers

A.Route reflectors reduce the number of required iBGP sessions in an AS.

B.A route reflector client must be fully meshed with all other clients.

C.The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes.

D.The ORIGINATOR_ID attribute is used to prevent routing loops in a route reflector environment.

E.Non-client peers of a route reflector must be fully meshed with each other.

AnswersA, C, D

Correct because route reflectors allow a hub-and-spoke topology, reducing sessions.

Why this answer

Route reflectors reduce the number of required iBGP sessions by allowing clients to peer only with the route reflector. The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes, preserving path information. The ORIGINATOR_ID attribute is used to prevent routing loops by identifying the originator of a route.

Option E is incorrect because non-client peers of a route reflector do not need to be fully meshed; they may be clients of other route reflectors, and the full mesh requirement applies only to iBGP speakers that are not clients of any route reflector.

Practice this question →

Multi-Selecthard

Which three statements about BGP route reflectors are true? (Choose three.)

Select 3 answers

A.Route reflectors allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh.

B.A route reflector client must be fully meshed with all other clients in the same cluster.

C.The route reflector can be a client of another route reflector.

D.The cluster ID is used to prevent routing loops in a route reflector environment.

E.The route reflector modifies the AS_PATH attribute to prevent loops.

AnswersA, C, D

Correct: This is the primary purpose of route reflectors; they relax the full mesh requirement.

Why this answer

Route reflectors are used to reduce the number of iBGP peers in an AS. They allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh. A route reflector client does not need to be fully meshed with other clients; it only peers with the route reflector.

The route reflector can be a client itself. The cluster ID is used to identify a route reflector cluster and to prevent loops. The route reflector does not modify the AS_PATH or NEXT_HOP attributes by default.

Practice this question →

MCQmedium

Which BGP attribute is preferred when it has the lowest value?

A.WEIGHT

B.LOCAL_PREF

C.MED

D.ORIGIN

AnswerC

MED is the attribute where a lower value is preferred.

Why this answer

BGP uses multiple attributes to determine the best path. The WEIGHT attribute is Cisco-specific and is preferred when it has the highest value, not lowest. The LOCAL_PREF attribute is preferred with the highest value.

The MED (Multi-Exit Discriminator) attribute is preferred with the lowest value. The ORIGIN attribute prefers IGP over EGP and incomplete.

Practice this question →

MCQhard

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-POLICY Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Based on this output, what can be concluded?

A.SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.

B.BGP traffic is being dropped because it exceeds the CIR.

C.All traffic to the control plane is being dropped.

D.The control-plane policy is applied in the output direction.

AnswerA

The SNMP class shows 150 conformed and 50 dropped (exceeded+violated), while BGP shows all 50 conformed.

Why this answer

The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

Exam trap

The trap here is that candidates may misinterpret the 'exceeded' and 'violated' counters as indicating that all traffic in a class is being dropped, when in fact only packets that exceed the policer thresholds are dropped, while conforming traffic is still transmitted.

How to eliminate wrong answers

Option B is wrong because the BGP-CLASS shows 0 exceeded and 0 violated packets, indicating no drops; it is not exceeding its CIR. Option C is wrong because the output shows that conformed packets for all classes are being transmitted, so not all traffic is dropped. Option D is wrong because the command 'show policy-map control-plane' and the output explicitly state 'Service-policy input: CoPP-POLICY', meaning the policy is applied in the input direction, not output.

Practice this question →

MCQeasy

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

A.The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.

B.The BGP neighbor is not configured with the password command.

C.The route-target import/export values are incorrect for the customer.

D.The engineer forgot to configure the VRF under the BGP router-id.

AnswerA

Correct because the ip vrf forwarding command clears the IP address on the interface, requiring it to be re-entered.

Why this answer

When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

Exam trap

Cisco often tests the fact that applying a VRF to an interface removes the IP address, leading candidates to overlook the need to reconfigure it, and instead focus on BGP or VRF configuration errors.

How to eliminate wrong answers

Option B is wrong because BGP password configuration is optional and not required for session establishment; the session fails due to missing IP address, not authentication. Option C is wrong because the engineer verified correct route-target import/export values, so this is not the issue. Option D is wrong because BGP router-id is a global or VRF-level parameter that does not need to be explicitly configured under the VRF; it defaults to the highest loopback or interface IP, and the session failure is unrelated to router-id.

Practice this question →

MCQmedium

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream BGP route updates to a collector using gRPC dial-out. The engineer wants to ensure that the telemetry data is encrypted in transit. Which additional configuration is required to secure the gRPC telemetry stream?

A.Configure IPsec between the router and the collector

B.Enable TLS on the gRPC connection by configuring a trustpoint and using the 'transport grpc tls' command

C.Use SSH tunneling for the gRPC connection

D.Configure DTLS on the telemetry receiver

AnswerB

TLS provides encryption for gRPC telemetry, and IOS-XE supports it with proper trustpoint configuration.

Why this answer

To configure TLS on the gRPC connection. gRPC supports TLS for encryption, and on IOS-XE, this requires configuring a trustpoint and enabling TLS under the telemetry receiver. The other options are incorrect because IPsec is not directly integrated with gRPC telemetry; SSH is used for NETCONF, not gRPC; and DTLS is used for UDP-based telemetry, not gRPC.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order for BGP route aggregation with suppress-map is: first, define a prefix-list to match the more-specific routes you want to suppress. Second, create a route-map with a suppress clause that references the prefix-list. Third, configure the aggregate-address in BGP under the address-family.

Fourth, apply the suppress-map to the aggregate-address command (typically as part of the aggregate-address command itself). Finally, verify the summary route and the suppressed routes.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to the value that is preferred (highest or lowest) during path selection on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Highest

Lowest

Why these pairings

Higher weight is preferred; higher LOCAL_PREF is preferred; shorter AS_PATH length is preferred; lower MULTI_EXIT_DISC is preferred; lower IGP metric to next-hop is preferred.

Practice this question →

MCQmedium

An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?

A.The VRF is not configured with a route distinguisher.

B.The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.

C.The route-target import/export values are incorrect.

D.The interface in the VRF is not configured with the ipv4 address.

AnswerB

Correct because without this, the VRF routes are not injected into BGP VPNv4.

Why this answer

In MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.

Exam trap

Cisco often tests the misconception that configuring the VRF and establishing the BGP VPNv4 session is enough, but the trap is that candidates overlook the mandatory redistribution step under the VRF-specific BGP address family, which is required to inject routes into the VPNv4 table.

How to eliminate wrong answers

Option A is wrong because a route distinguisher (RD) is required for VRF configuration to make routes unique across VPNs, but its absence would cause the VRF to fail to install routes or cause route duplication, not specifically prevent advertisement to the route reflector; the question states the VRF is configured with route-target import/export, implying an RD is likely present. Option C is wrong because the route-target import 100:1 and export 100:1 values are correctly matched, which is necessary for route distribution between PE routers; incorrect values would affect import/export filtering but not the initial advertisement from the PE to the route reflector. Option D is wrong because an interface in the VRF with an IPv4 address is required for the VRF to have local routes, but the issue is about route advertisement to the route reflector, not about the existence of routes; the VRF could have routes from other sources (e.g., static) without a directly connected interface.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP session establishment between eBGP peers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

BGP session establishment begins with the TCP three-way handshake (SYN, SYN-ACK, ACK). Once TCP is established, BGP sends an OPEN message to negotiate capabilities. The peer responds with an OPEN message.

After both OPENs are exchanged, BGP sends KEEPALIVE messages. Finally, the session moves to the Established state and UPDATE messages can be exchanged.

Practice this question →

Matchingmedium

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Carries MPLS Layer 3 VPN routes with route distinguisher and route target

Carries standard IPv4 unicast routes (non-VPN)

Carries standard IPv6 unicast routes

Carries MPLS Layer 3 VPN routes for IPv6 customer prefixes

Carries Layer 2 VPN information such as VPLS or EVPN

Why these pairings

The VPNv4 unicast address family carries MPLS VPN routes with RD and RT; IPv4 unicast carries standard IPv4 routes; IPv6 unicast carries IPv6 routes; VPNv6 unicast carries IPv6 MPLS VPN routes; L2VPN address family carries Layer 2 VPN information like VPLS.

Practice this question →

MCQmedium

Given the following BGP configuration on a Cisco IOS-XE device: router bgp 65001 bgp router-id 1.1.1.1 neighbor 10.0.0.2 remote-as 65002 neighbor 10.0.0.2 update-source Loopback0 neighbor 10.0.0.2 ebgp-multihop 2 ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 What is the purpose of the 'ebgp-multihop 2' command?

A.It allows the BGP session to be established even if the neighbor is not directly connected, with a maximum of 2 hops.

B.It sets the BGP session to use two TCP connections for redundancy.

C.It enables BGP to use two different paths to reach the neighbor.

D.It is required because the neighbor is configured with a loopback interface as the update source.

AnswerA

Correct. EBGP multihop with value 2 allows the neighbor to be up to 2 hops away (TTL=2).

Why this answer

EBGP multihop allows the BGP session to be established between non-directly connected peers. The number specifies the maximum TTL for the BGP packets. Here, TTL=2 allows one intermediate hop.

Practice this question →

MCQhard

A service provider uses MPLS L3VPN with OSPF as the PE-CE routing protocol. A customer reports that a new subnet added on CE1 is not reachable from CE2, even though the PE1 router has the route in its VRF and BGP table. The 'show ip bgp vpnv4 vrf CUSTOMER' on PE2 shows the prefix with a valid next-hop. What should the engineer check next?

A.Verify that LDP has allocated a label for the BGP next-hop address on PE2.

B.Check if OSPF is redistributed into BGP on PE1.

C.Ensure the route is present in the global BGP table on PE2.

D.Confirm that the VRF on PE2 has the correct route-target import.

AnswerA

Correct because without a label for the next-hop, the VPN route cannot be forwarded.

Why this answer

The issue is that PE2 has the prefix in its BGP VPNv4 table with a valid next-hop, but the route is not reachable from CE2. This indicates a label-switching problem in the MPLS core. The next step is to verify that LDP has allocated a label for the BGP next-hop address on PE2, because without an LDP label for the next-hop, the MPLS forwarding path is broken and packets cannot be label-switched across the provider core.

Exam trap

Cisco often tests the distinction between control-plane reachability (BGP table) and data-plane forwarding (MPLS label switching), trapping candidates who assume that a route in the BGP table guarantees end-to-end connectivity.

How to eliminate wrong answers

Option B is wrong because OSPF redistribution into BGP on PE1 is already confirmed working—PE1 has the route in its VRF and BGP table, so redistribution is not the issue. Option C is wrong because the route is already present in the BGP VPNv4 table on PE2 (as shown by 'show ip bgp vpnv4 vrf CUSTOMER'), and the global BGP table is irrelevant for VRF routes. Option D is wrong because if the VRF on PE2 had incorrect route-target import, the prefix would not appear in the VRF or BGP VPNv4 table at all, but the question states it is present with a valid next-hop.

Practice this question →

MCQmedium

Consider the following BGP configuration on a Cisco IOS-XE router: router bgp 65001 neighbor 10.0.0.2 remote-as 65002 neighbor 10.0.0.2 route-map SET_COMMUNITY out ! route-map SET_COMMUNITY permit 10 set community 65001:100 What is the effect of this configuration?

A.The router will set the community to 65001:100 on all routes received from neighbor 10.0.0.2.

B.The router will set the community to 65001:100 on all routes advertised to neighbor 10.0.0.2.

C.The router will filter routes with community 65001:100 from being advertised.

D.The router will remove the community from routes advertised to the neighbor.

AnswerB

The 'out' direction and route-map cause the community to be set on outbound updates.

Why this answer

The route-map is applied to outbound updates to neighbor 10.0.0.2. It sets the BGP community value to 65001:100 on all routes advertised to that neighbor. The community is a well-known transitive attribute that can be used for routing policy.

Practice this question →

Matchingmedium

Drag and drop each BGP attribute on the left to its matching type on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Well-known mandatory

Well-known discretionary

Optional non-transitive

Optional transitive

Why these pairings

AS_PATH and NEXT_HOP are well-known mandatory; LOCAL_PREF is well-known discretionary; MED is optional non-transitive; COMMUNITY is optional transitive.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order starts with the local PE learning the customer route via IGP or static, then redistributing it into MP-BGP with a route distinguisher, advertising the VPNv4 route to the remote PE, which receives and installs it into the VRF, and finally the remote PE redistributes the route into the customer-facing IGP.

Practice this question →

Multi-Selecteasy

Which two statements about BGP neighbor states are true? (Choose two.)

Select 2 answers

A.In the Idle state, BGP is waiting for a start event before initiating a TCP connection.

B.In the Active state, BGP is actively trying to establish a TCP connection with the neighbor.

C.In the Established state, BGP has sent an OPEN message but has not yet received an OPEN message from the peer.

D.In the OpenSent state, BGP is waiting for the TCP connection to complete.

E.In the Connect state, BGP is actively trying to establish a TCP connection.

AnswersA, B

Correct: Idle is the initial state; BGP does not initiate a TCP connection until a start event (e.g., neighbor configuration) occurs.

Why this answer

The BGP neighbor state machine includes Idle, Connect, Active, OpenSent, OpenConfirm, and Established. In the Idle state, BGP does not initiate any connection and may be waiting for a start event. In the Active state, BGP is actively trying to establish a TCP connection.

In the Established state, BGP has successfully formed a peering session and is exchanging routing updates. The OpenSent state is when BGP has sent an OPEN message and is waiting for an OPEN message from the peer. The Connect state is when BGP is waiting for the TCP connection to complete.

Practice this question →

MCQmedium

In BGP best path selection, which of the following is compared first?

A.Highest weight

B.Highest local preference

C.Shortest AS-path

D.Lowest MED

AnswerA

Correct. Weight is the first attribute compared in BGP best path selection.

Why this answer

BGP best path selection begins by comparing the weight attribute, which is Cisco-proprietary and local to the router. The path with the highest weight is preferred first, making option A correct. Weight is evaluated before any other BGP attribute, including local preference, AS-path length, and MED.

Exam trap

Cisco often tests the exact order of BGP path selection attributes, and the trap here is that candidates mistakenly think local preference or AS-path length is the first comparison, because those are more commonly discussed in multi-AS designs, but weight always comes first in Cisco's implementation.

How to eliminate wrong answers

Option B is wrong because highest local preference is compared after weight, not first. Option C is wrong because shortest AS-path is the third attribute compared, after weight and local preference. Option D is wrong because lowest MED is compared after AS-path length (and other attributes like origin type) in the BGP decision process.

Practice this question →

Multi-Selectmedium

Which two statements about BGP path attributes are true? (Choose two.)

Select 2 answers

A.The AS_PATH attribute is well-known mandatory.

B.The LOCAL_PREF attribute is well-known discretionary.

C.The MED attribute is well-known mandatory.

D.The ORIGIN attribute is optional transitive.

E.The COMMUNITY attribute is well-known mandatory.

AnswersA, B

Correct because AS_PATH is always included in BGP updates and is well-known mandatory.

Why this answer

The ORIGIN attribute is well-known mandatory. The COMMUNITY attribute is optional transitive.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of iBGP route reflection configuration steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Route reflection requires first enabling BGP, then configuring the cluster ID, designating the route reflector client, and finally verifying the reflection behavior.

Practice this question →

MCQeasy

Which BGP attribute is preferred when it has the lowest value?

A.Weight

B.Local Preference

C.MED (Multi-Exit Discriminator)

D.AS Path Length

AnswerC

Correct. MED is a metric that is preferred with the lowest value.

Why this answer

BGP uses multiple attributes in its path selection algorithm. The weight attribute is Cisco-specific and is preferred with the highest value. The local preference is also preferred with the highest value.

The MED (Multi-Exit Discriminator) is preferred with the lowest value.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP confederations setup between sub-ASes into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Confederation setup requires enabling BGP, configuring the confederation identifier and sub-AS list, then peering between sub-ASes, and finally verifying the confederation membership.

Practice this question →

MCQhard

A network engineer runs the following command on Router R1: R1# show bgp ipv4 unicast 10.10.10.0 BGP routing table entry for 10.10.10.0/24, version 20 Paths: (2 available, best #1, table default) Advertised to update-groups: 1 Refresh Epoch 1 65050 65100 10.0.1.2 from 10.0.1.2 (10.0.0.2) Origin IGP, metric 0, localpref 100, weight 0, valid, external, best rx pathid: 0, tx pathid: 0x0 65050 65100 65200 10.0.1.3 from 10.0.1.3 (10.0.0.3) Origin IGP, metric 0, localpref 100, weight 0, valid, external rx pathid: 0, tx pathid: 0x0 Based on this output, what can be concluded?

A.Path #2 is the best path because it has a longer AS_PATH, indicating more specific routing.

B.Path #1 is the best path because it has a shorter AS_PATH length.

C.Both paths are equally preferred, and BGP uses tie-breaking rules like router ID.

D.Path #1 is the best path because it is received from a higher IP address.

AnswerB

Path #1 has AS_PATH length 2 (65050 65100) while path #2 has length 3 (65050 65100 65200). Shorter AS_PATH is preferred.

Why this answer

B is correct because BGP selects the best path based on the shortest AS_PATH length when all other attributes (weight, local preference, origin) are equal. In the output, Path #1 has an AS_PATH of '65050 65100' (2 AS numbers) while Path #2 has '65050 65100 65200' (3 AS numbers), making Path #1 the best path. The 'best #1' annotation confirms this selection.

Exam trap

Cisco often tests the AS_PATH length comparison by presenting two paths with different AS_PATH lengths but identical other attributes, expecting candidates to know that shorter AS_PATH is preferred, not longer.

How to eliminate wrong answers

Option A is wrong because a longer AS_PATH does not indicate more specific routing; BGP prefers shorter AS_PATH lengths, not longer ones. Option C is wrong because the paths are not equally preferred; Path #1 is explicitly marked as best due to shorter AS_PATH, so tie-breaking rules like router ID are not invoked. Option D is wrong because BGP does not use the IP address of the next-hop or neighbor as a tie-breaker for best path selection; the decision is based on AS_PATH length in this case.

Practice this question →

Matchinghard

Drag and drop each BGP community on the left to its standard behavior on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Do not advertise to eBGP peers (except within confederation)

Do not advertise to any peer

Do not advertise to external peers (confederation boundary)

Do not advertise to any BGP peer

Advertise to all BGP peers (default behavior)

Why these pairings

NO_EXPORT prevents advertisement outside confederation; NO_ADVERTISE prevents any advertisement; LOCAL_AS prevents advertisement to external peers; INTERNET advertises to all BGP peers.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Policy application starts with defining match criteria (prefix-list or AS-path ACL), then creating a route-map with permit/deny and set actions, applying it to a neighbor, and finally verifying the policy effect.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, both peers advertise the graceful restart capability in the OPEN message. Then they exchange the restart time and stale-path timer via capabilities. Next, the helper router marks routes as stale upon session failure.

After that, the restarting router re-establishes the session. Finally, the helper removes stale routes if not refreshed.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of iBGP route reflection configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, you enable the BGP process and define the local AS. Then you configure the router as a route reflector using the neighbor route-reflector-client command. Next, you specify the cluster ID if needed, then adjust the next-hop behavior with next-hop-self.

Finally, you verify the configuration with show ip bgp neighbors.

Practice this question →

Matchingmedium

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Carries IPv4 VPN routes with MPLS labels across the provider core

Carries IPv6 VPN routes with MPLS labels across the provider core

Carries global IPv4 unicast routes (non-VPN)

Carries global IPv6 unicast routes (non-VPN)

Carries Layer 2 VPN information such as pseudowires and VPLS

Why these pairings

VPNv4 address family carries IPv4 VPN routes; VPNv6 carries IPv6 VPN routes; IPv4 unicast carries global IPv4 routes; IPv6 unicast carries global IPv6 routes; L2VPN address family carries Layer 2 VPN information.

Practice this question →