How should I use these Infrastructure practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Infrastructure questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Infrastructure domain.

350-401 · topic practice

Infrastructure practice questions

Infrastructure is 30% of ENCOR 350-401 and covers Layer 2 and Layer 3 forwarding on Cisco IOS-XE platforms. Expect scenario items on VLANs and trunking, STP variants, EtherChannel, OSPF, EIGRP, BGP, first-hop redundancy, NAT, and NTP, plus configuration-syntax and show-command interpretation rather than pure recall.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Infrastructure

Practice 10 questions Browse domain →

What the exam tests

What to know about Infrastructure

Configure and verify VLANs, 802.1Q trunks, EtherChannel, OSPF/EIGRP/BGP, HSRP, NAT, and NTP on IOS-XE, interpreting show commands like show ip ospf neighbor. The critical skill is correct Layer 2/Layer 3 forwarding and routing adjacency formation.

Configuring 802.1Q trunk and access ports, native VLAN, and VTP modes on IOS switches

Comparing RSTP, MST, and PVST+ port roles, states, and root bridge election

Tuning OSPF neighbor adjacencies, network types, cost, and passive interfaces

Implementing HSRP, VRRP, or GLBP and verifying with show standby brief

Watch out for

Common Infrastructure exam traps

▸Mixing up HSRP active/standby versus VRRP master/backup terminology, and forgetting HSRP's default priority of 100
▸Assuming DTP negotiates trunks on all platforms; some Catalyst switches default to dynamic auto or access
▸Configuring OSPF passive interfaces on links that must form adjacencies, silently blocking hello packets

Practice set

Infrastructure questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Open the full BGP breakdown →

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Trap 1: The AS number is incorrect.

If the AS number were incorrect, the BGP neighbors would fail to establish a session because the OPEN message would contain a conflicting AS number, triggering a NOTIFICATION and transitioning to Idle/Active state. Since the session is already established and routes are being exchanged, an AS number mismatch is not the cause of the missing route. This condition specifically prevents peering, not route installation after peering is up.

Trap 2: The BGP session is using an incorrect interface.

Configuring the BGP session on the wrong interface would mean the TCP connection to the peer could never be established, as BGP would send packets from an interface that cannot reach the peer's IP address. The fact that the session is up proves the interface selection and underlying IP connectivity are correct. Therefore, an incorrect interface cannot be the reason a specific route is absent from the routing table.

Trap 3: The network is not advertised under BGP.

Not advertising a network under BGP only affects what the local router sends to its peers; it has no effect on the routes received from an established neighbor. If the network is missing from BGP updates, the problem would be on the advertising side, not on this router's inability to install a received route. Since the issue is about a route not being received or installed, this option does not explain the symptom.

Study all Infrastructure common traps →

A
The AS number is incorrect.
Why it fails: If the AS number were incorrect, the BGP neighbors would fail to establish a session because the OPEN message would contain a conflicting AS number, triggering a NOTIFICATION and transitioning to Idle/Active state. Since the session is already established and routes are being exchanged, an AS number mismatch is not the cause of the missing route. This condition specifically prevents peering, not route installation after peering is up.
B
The BGP session is using an incorrect interface.
Why it fails: Configuring the BGP session on the wrong interface would mean the TCP connection to the peer could never be established, as BGP would send packets from an interface that cannot reach the peer's IP address. The fact that the session is up proves the interface selection and underlying IP connectivity are correct. Therefore, an incorrect interface cannot be the reason a specific route is absent from the routing table.
C
The network is not advertised under BGP.
Why it fails: Not advertising a network under BGP only affects what the local router sends to its peers; it has no effect on the routes received from an established neighbor. If the network is missing from BGP updates, the problem would be on the advertising side, not on this router's inability to install a received route. Since the issue is about a route not being received or installed, this option does not explain the symptom.
D
The next-hop IP address is not reachable.
In eBGP, the received route's next hop is often not directly connected, requiring an IGP route or static route to resolve it. If that next-hop IP is unreachable, the router can still store the route in the BGP table but will not install it into the IP routing table. This is a classic cause of 'BGP route present but not in RIB' and matches the described troubleshooting scenario.

Full breakdown with real-world context →

Question 2easymultiple choice

Review the full routing breakdown →

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Trap 1: Apply an extended ACL to the vty lines.

Applying an extended ACL to the vty lines filters inbound SSH by source address, but the stem asks how to permit management access, which is achieved with the access-class command referencing a standard ACL. Extended ACLs on vty lines suit filtering by protocol or port, not restricting management sources.

Trap 2: Apply a named ACL to the interface.

ACL should be applied to vty lines, not interface.

Trap 3: Apply an ACL to the console line.

Applying an ACL to the console line filters traffic reaching the physical console port, not inbound SSH sessions arriving on VTY lines; SSH access is controlled by an ACL referenced on the vty lines or by an access-class statement there. It is tempting because line-level ACLs do restrict management access, but only for the line they are attached to.

Study all Infrastructure common traps →

A
Apply an extended ACL to the vty lines.
Why it fails: Applying an extended ACL to the vty lines filters inbound SSH by source address, but the stem asks how to permit management access, which is achieved with the access-class command referencing a standard ACL. Extended ACLs on vty lines suit filtering by protocol or port, not restricting management sources.
B
Apply a named ACL to the interface.
Why it fails: ACL should be applied to vty lines, not interface.
C
Apply an ACL to the console line.
Why it fails: Applying an ACL to the console line filters traffic reaching the physical console port, not inbound SSH sessions arriving on VTY lines; SSH access is controlled by an ACL referenced on the vty lines or by an access-class statement there. It is tempting because line-level ACLs do restrict management access, but only for the line they are attached to.
D
Apply a standard ACL to the vty lines.
A standard ACL matches only source addresses, so applying it to the vty lines with `access-class` permits SSH from 192.168.1.0/24 while denying other sources. This satisfies the management-network restriction, since vty access control filters inbound Telnet and SSH sessions by source IP without needing destination or port criteria.

Full breakdown with real-world context →

Question 3mediummulti select

Open the full VLAN trunking answer →

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Trap 1: switchport mode trunk

The 'switchport mode trunk' command unconditionally enables trunking, but it does not specify the encapsulation protocol. On older Catalyst switches that support both ISL and 802.1Q, the default encapsulation may be ISL, so this command alone does not directly configure 802.1Q trunking. To ensure 802.1Q, an explicit encapsulation command is required, making this option incomplete for the stated task.

Trap 2: switchport mode access

The 'switchport mode access' command forcibly disables trunking by setting the interface as an access port, which carries traffic for only a single VLAN and sends all frames untagged. This is the opposite of trunking and, therefore, cannot be used to configure 802.1Q trunking. Even if a remote switch is configured for trunk, an access port will not form a trunk link.

Trap 3: switchport trunk native vlan 1

The 'switchport trunk native vlan 1' command only designates VLAN 1 as the native VLAN for an existing trunk, and does not enable trunking itself. This command is applied after trunking is established, and it controls which VLAN is sent untagged on the trunk. Without first configuring trunk mode and encapsulation, this command has no effect on enabling 802.1Q trunking.

Study all Infrastructure common traps →

A
switchport mode dynamic auto
The 'switchport mode dynamic auto' command permits the interface to actively negotiate trunking with the remote peer using Dynamic Trunking Protocol (DTP). It is a valid configuration for 802.1Q trunking because the interface will become a trunk if the neighbor is set to 'dynamic desirable' or 'trunk' mode. On switches that support both ISL and 802.1Q, the encapsulation must also be defined, but this mode is a necessary component of dynamic trunk setup.
B
switchport mode trunk
Why it fails: The 'switchport mode trunk' command unconditionally enables trunking, but it does not specify the encapsulation protocol. On older Catalyst switches that support both ISL and 802.1Q, the default encapsulation may be ISL, so this command alone does not directly configure 802.1Q trunking. To ensure 802.1Q, an explicit encapsulation command is required, making this option incomplete for the stated task.
C
switchport mode access
Why it fails: The 'switchport mode access' command forcibly disables trunking by setting the interface as an access port, which carries traffic for only a single VLAN and sends all frames untagged. This is the opposite of trunking and, therefore, cannot be used to configure 802.1Q trunking. Even if a remote switch is configured for trunk, an access port will not form a trunk link.
D
switchport trunk native vlan 1
Why it fails: The 'switchport trunk native vlan 1' command only designates VLAN 1 as the native VLAN for an existing trunk, and does not enable trunking itself. This command is applied after trunking is established, and it controls which VLAN is sent untagged on the trunk. Without first configuring trunk mode and encapsulation, this command has no effect on enabling 802.1Q trunking.
E
switchport trunk encapsulation dot1q
The 'switchport trunk encapsulation dot1q' command explicitly selects IEEE 802.1Q as the trunking encapsulation method on the interface. This is a direct and required action on switches that support both ISL and 802.1Q, ensuring that frames are tagged according to the 802.1Q standard. Without this command, the interface may default to ISL or fail to trunk, so it is a valid and necessary configuration step for 802.1Q trunking.

Full breakdown with real-world context →

Question 4hardmulti select

Review the full OSPF breakdown →

Which THREE conditions are required for OSPF routers to become fully adjacent? (Choose three.)

Trap 1: Matching authentication (if configured)

Authentication is optional in OSPF, so in a default configuration there is no authentication parameter to compare and adjacencies form without it. Only when authentication is explicitly enabled must the type (null, simple, cryptographic) and the password or key ID match, causing Hello packets to be discarded if a mismatch occurs. Since it is contingent on configuration, it is not a universal requirement for adjacency establishment.

Trap 2: Same subnet mask

The Hello protocol checks that the network number of the receiving interface matches the network number of the sending interface, but it does not compare subnet masks directly. Two routers can form an adjacency if their IP addresses belong to the same subnet even if the configured masks differ, because OSPF derives the network number from the address and mask. On point-to-point links, the mask is ignored entirely, further confirming that identical subnet masks are not a prerequisite.

Study all Infrastructure common traps →

A
Same area ID
Hello packets carry the area ID, and a receiving router drops any Hello whose area ID does not match the area configured for the receiving interface. The area ID defines the boundary of the link-state database, as LSAs are not flooded across area borders except in summarized form by ABRs. Therefore, to exchange link-state information and become neighbors, both routers must have the same area ID on the connecting link.
B
Matching hello and dead intervals
OSPF neighbors must agree on the Hello interval and the Dead interval because these timers govern the liveness detection on the link. The Dead interval, by default four times the Hello interval, determines when a silent neighbor is declared unreachable; if both ends use different values, a router may consider the neighbor dead while it is still active. Mismatched timers are detected in the Hello packet and cause the adjacency to fail before reaching the ExStart state.
C
Matching authentication (if configured)
Why it fails: Authentication is optional in OSPF, so in a default configuration there is no authentication parameter to compare and adjacencies form without it. Only when authentication is explicitly enabled must the type (null, simple, cryptographic) and the password or key ID match, causing Hello packets to be discarded if a mismatch occurs. Since it is contingent on configuration, it is not a universal requirement for adjacency establishment.
D
Different router IDs
A router ID uniquely identifies the originator of every OSPF LSA. If two routers share the same router ID, the link-state database becomes ambiguous because the LSA type, ID, and advertising router triplet cannot distinguish the source, causing flapping adjacencies and potential routing loops. This uniqueness is enforced domain-wide, not just per area.
E
Same subnet mask
Why it fails: The Hello protocol checks that the network number of the receiving interface matches the network number of the sending interface, but it does not compare subnet masks directly. Two routers can form an adjacency if their IP addresses belong to the same subnet even if the configured masks differ, because OSPF derives the network number from the address and mask. On point-to-point links, the mask is ignored entirely, further confirming that identical subnet masks are not a prerequisite.

Full breakdown with real-world context →

Question 5easymulti select

Review the full routing breakdown →

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

Trap 1: Enable AAA authentication.

AAA is a broader framework.

Trap 2: Use the service password-encryption command.

Encrypts passwords but does not set enable password.

Trap 3: Configure login local on the console line.

This is for user authentication, not enable.

Study all Infrastructure common traps →

A
Enable AAA authentication.
Why it fails: AAA is a broader framework.
B
Configure the enable secret password.
Provides encrypted access.
C
Use the service password-encryption command.
Why it fails: Encrypts passwords but does not set enable password.
D
Configure the enable password.
Sets an unencrypted enable password.
E
Configure login local on the console line.
Why it fails: This is for user authentication, not enable.

Full breakdown with real-world context →

Question 6mediummultiple choice

Review the full OSPF breakdown →

R1 has an OSPF priority of 0. What is its role on the OSPF network?

Exhibit

Refer to the exhibit.

R1# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 10.1.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 10.1.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Trap 1: Backup Designated Router

In OSPF's DR/BDR election process on a broadcast or non-broadcast multi-access network, a router with interface priority 0 is explicitly marked as ineligible to become either the Designated Router or the Backup Designated Router. Since the exhibit shows priority 0 for r1, it cannot fulfill the BDR role, making this option incorrect. The BDR role would only be possible if the priority were greater than 0 and r1 lost the DR election to a higher-priority router.

Trap 2: Regular router

The term 'regular router' is not a valid OSPF state or role in the neighbor state machine. OSPF defines specific states for routers on multi-access networks: DR, BDR, and DROther, along with neighbor states like Full and Two-Way. Calling r1 a 'regular router' is vague and incorrect because it does not correspond to any protocol-specific function. In the context of OSPF operation, r1's actual role is DROther.

Trap 3: Designated Router

The Designated Router (DR) election also uses the router priority value, and a priority of 0 disqualifies r1 from becoming the DR on this segment. Even if r1 has the highest router ID, its configured priority of 0 overrides that and prevents any chance of winning the election. Therefore, r1 cannot be the DR, and the exhibit's priority 0 setting directly contradicts this option.

Study all Infrastructure common traps →

A
Backup Designated Router
Why it fails: In OSPF's DR/BDR election process on a broadcast or non-broadcast multi-access network, a router with interface priority 0 is explicitly marked as ineligible to become either the Designated Router or the Backup Designated Router. Since the exhibit shows priority 0 for r1, it cannot fulfill the BDR role, making this option incorrect. The BDR role would only be possible if the priority were greater than 0 and r1 lost the DR election to a higher-priority router.
B
DROther
A router interface configured with OSPF priority 0 is always placed in the DROther state because it is excluded from DR/BDR elections. As a DROther, r1 will still form full adjacencies with the DR and BDR and exchange Link-State Advertisements with them, but it will only maintain two-way neighbor state with other DROther routers. This is exactly the behavior shown in the exhibit, confirming that DROther is the correct role.
C
Regular router
Why it fails: The term 'regular router' is not a valid OSPF state or role in the neighbor state machine. OSPF defines specific states for routers on multi-access networks: DR, BDR, and DROther, along with neighbor states like Full and Two-Way. Calling r1 a 'regular router' is vague and incorrect because it does not correspond to any protocol-specific function. In the context of OSPF operation, r1's actual role is DROther.
D
Designated Router
Why it fails: The Designated Router (DR) election also uses the router priority value, and a priority of 0 disqualifies r1 from becoming the DR on this segment. Even if r1 has the highest router ID, its configured priority of 0 overrides that and prevents any chance of winning the election. Therefore, r1 cannot be the DR, and the exhibit's priority 0 setting directly contradicts this option.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Infrastructure explanation →

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Refer to the exhibit.

! Running-config on R1
ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq www
 permit tcp 192.168.1.0 0.0.0.255 any eq https
!
interface GigabitEthernet0/0
 ip access-group FILTER out
!

Trap 1: ICMP traffic from any source

The ACL does not include a permit icmp any any entry, so ICMP from any source is discarded by the implicit deny at the list's end. ICMP would be permitted only where an explicit permit icmp statement exists. It is tempting because ping is often allowed for troubleshooting, but the exhibit omits it.

Trap 2: FTP traffic from 192.168.1.0/24

FTP is not permitted.

Trap 3: SSH traffic from 192.168.1.0/24

SSH is not permitted.

Study all Infrastructure common traps →

A
HTTP and HTTPS traffic from 192.168.1.0/24
The zone-based firewall policy permits outbound traffic matching the HTTP and HTTPS class, sourced from 192.168.1.0/24 on GigabitEthernet0/0. This satisfies the exhibit's requirement that only web traffic from that subnet egresses the interface, as the class-map and policy-map pair explicitly inspect and allow those ports.
B
ICMP traffic from any source
Why it fails: The ACL does not include a permit icmp any any entry, so ICMP from any source is discarded by the implicit deny at the list's end. ICMP would be permitted only where an explicit permit icmp statement exists. It is tempting because ping is often allowed for troubleshooting, but the exhibit omits it.
C
FTP traffic from 192.168.1.0/24
Why it fails: FTP is not permitted.
D
SSH traffic from 192.168.1.0/24
Why it fails: SSH is not permitted.

Full breakdown with real-world context →

Question 8easymulti select

Read the full Infrastructure explanation →

Which TWO characteristics are true about the operation of Rapid PVST+? (Choose two.)

Trap 1: It runs a single spanning-tree instance for all VLANs.

Rapid PVST+ does not run a single spanning-tree instance for all VLANs; that behavior describes MST (Multiple Spanning Tree) or the legacy Common Spanning Tree (CST). Instead, Rapid PVST+ creates a separate RSTP instance for every VLAN, allowing per-VLAN path optimization, per-VLAN root bridge selection, and independent port states for each VLAN's topology.

Trap 2: It eliminates the need for BPDUs.

Rapid PVST+ absolutely still requires BPDUs for loop prevention and topology discovery. It sends and receives 802.1w RSTP BPDUs on all ports, using flags for proposal/agreement, learning, forwarding, and topology change. Without BPDUs, switches could not exchange root information, detect loops, or converge; eliminating BPDUs would break spanning-tree operation entirely.

Trap 3: It supports PortFast to enable immediate transition to forwarding.

PortFast is an optional, per-port feature that can be manually enabled on edge ports to skip the listening and learning states and immediately transition to forwarding; it is not an inherent characteristic of Rapid PVST+ operation. The protocol itself still runs RSTP and brings up normal ports through the learning state. Saying Rapid PVST+ 'supports PortFast' is true, but that support is a configuration tool, not a default behavior or protocol mechanism, so it is not a characteristic of the protocol's operation.

Study all Infrastructure common traps →

A
It runs a single spanning-tree instance for all VLANs.
Why it fails: Rapid PVST+ does not run a single spanning-tree instance for all VLANs; that behavior describes MST (Multiple Spanning Tree) or the legacy Common Spanning Tree (CST). Instead, Rapid PVST+ creates a separate RSTP instance for every VLAN, allowing per-VLAN path optimization, per-VLAN root bridge selection, and independent port states for each VLAN's topology.
B
It eliminates the need for BPDUs.
Why it fails: Rapid PVST+ absolutely still requires BPDUs for loop prevention and topology discovery. It sends and receives 802.1w RSTP BPDUs on all ports, using flags for proposal/agreement, learning, forwarding, and topology change. Without BPDUs, switches could not exchange root information, detect loops, or converge; eliminating BPDUs would break spanning-tree operation entirely.
C
It supports PortFast to enable immediate transition to forwarding.
Why it fails: PortFast is an optional, per-port feature that can be manually enabled on edge ports to skip the listening and learning states and immediately transition to forwarding; it is not an inherent characteristic of Rapid PVST+ operation. The protocol itself still runs RSTP and brings up normal ports through the learning state. Saying Rapid PVST+ 'supports PortFast' is true, but that support is a configuration tool, not a default behavior or protocol mechanism, so it is not a characteristic of the protocol's operation.
D
It uses a separate root bridge per VLAN.
This statement is incorrect because, by default, Rapid PVST+ uses the same root bridge for all VLANs. While it is possible to configure different root bridges per VLAN, it is not a default characteristic of Rapid PVST+ operation.
E
It provides faster convergence than PVST+.
Rapid PVST+ converges faster than classic PVST+ because it is built on RSTP, which uses an explicit proposal/agreement handshake to transition designated ports to forwarding almost immediately, rather than waiting the 30 seconds of listening and learning states. It also introduces alternate and backup port roles that pre-compute loop-free failover paths, so when a root port fails, an alternate port can switch to forwarding without delay or re-convergence.

Full breakdown with real-world context →

Question 9mediummultiple choice

Open the full VLAN trunking answer →

Your company has a campus network with two distribution switches (DS1 and DS2) each connected to two access switches (AS1-AS4). All switches run Rapid PVST+. The root bridge for VLAN 10 is DS1. Recently, users on AS2 (VLAN 10) report intermittent connectivity. You notice that AS2's root port for VLAN 10 is flapping between two uplinks to DS1 and DS2. The link from AS2 to DS1 is a 1 Gbps fiber, and the link to DS2 is a 1 Gbps copper. The cost of both links is 4 (default for 1 Gbps). The network administrator previously configured PortFast on all access ports but did not configure any other spanning-tree parameters. Which action should you take to stabilize the topology?

Trap 1: Disable PortFast on all access ports to force proper RSTP…

Disabling PortFast on access ports does not affect root port selection and would only slow down convergence for end devices; it does not solve the equal-cost path flapping.

Trap 2: Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it…

Lowering DS1's priority to 4096 is unnecessary because DS1 is already the root bridge (priority 32768 by default). This does not change the fact that both uplinks from AS2 have equal cost, so flapping continues.

Trap 3: Increase DS2's priority to 8192 to make it less likely to become…

Increasing DS2's priority to 8192 makes it even less likely to become root, but since it is not the root, this does not affect the equal-cost path selection from AS2; the tie remains.

Study all Infrastructure common traps →

A
Disable PortFast on all access ports to force proper RSTP convergence.
Why it fails: Disabling PortFast on access ports does not affect root port selection and would only slow down convergence for end devices; it does not solve the equal-cost path flapping.
B
Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it remains the root and that AS2 selects the uplink to DS1 as root port.
Why it fails: Lowering DS1's priority to 4096 is unnecessary because DS1 is already the root bridge (priority 32768 by default). This does not change the fact that both uplinks from AS2 have equal cost, so flapping continues.
C
Increase DS2's priority to 8192 to make it less likely to become the root.
Why it fails: Increasing DS2's priority to 8192 makes it even less likely to become root, but since it is not the root, this does not affect the equal-cost path selection from AS2; the tie remains.
D
Change the fiber link between AS2 and DS1 to operate at 10 Gbps to reduce its cost.
Changing the fiber link to 10 Gbps reduces its port cost to 2 (from 4), breaking the tie and making the path via DS1 the only best path. This stabilizes the root port and resolves the flapping.

Full breakdown with real-world context →

Question 10mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step…

This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.

Trap 2: Step 1: Configure VTP domain name → Step 2: Configure VTP mode →…

This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.

Trap 3: Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step…

This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.

Study all Infrastructure common traps →

A
Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status
This is the correct order because VTP mode must be set first to define the switch's role, followed by the domain name to group switches, then trunk ports to propagate advertisements, and finally verification to confirm operation.
B
Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why it fails: This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.
C
Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status
Why it fails: This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.
D
Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why it fails: This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.

Full breakdown with real-world context →

Question 11mediumdrag order

Study the full EIGRP explanation →

Drag and drop the steps for the EIGRP neighbor discovery process in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Exchange routing updates

Routing updates cannot be sent before an EIGRP adjacency exists. EIGRP relies on Hello packets to establish a neighbor relationship and determine initial parameters such as hold time and K-values. The reliable transport (RTP) used for updates requires an active neighbor entry with sequence numbers and a RTT calculated from the Hello exchange. Without the initial Hello/discovery phase, there is no neighbor to send updates to, so this ordering is fundamentally invalid.

Trap 2: Step 1: Discover neighbors

Neighbor discovery in EIGRP is not an explicit step that can happen before any packets are sent—it is a consequence of receiving Hello packets. A router actively multicasts Hello packets to 224.0.0.10 on directly connected interfaces; a neighbor is 'discovered' only when a Hello is heard. Thus, placing 'Discover neighbors' before 'Send Hello packets' reverses the cause-and-effect relationship. The discovery event is the start of forming an adjacency, but it must be triggered by the Hello exchange itself.

Trap 3: Step 1: Send Hello packets

This sequence incorrectly places routing updates before adjacency has been fully formed. After sending Hello packets, a router must receive Hello packets back and pass neighbor-matching checks (AS number, K-values, hold timer) before the neighbor is considered discovered and an adjacency is established. Only after that per-neighbor condition is met can routing updates be exchanged via multicast to 224.0.0.10. Prioritizing updates before discovery would require a valid route to a non-existent neighbor and is logically impossible in the neighbor state machine.

Study all Infrastructure common traps →

A
Step 1: Send Hello packets. Step 2: Discover neighbors. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.
This is the correct order because EIGRP first uses Hello packets to discover potential neighbors, then upon receiving a Hello, a neighbor is discovered and adjacency is formed. After adjacency, routing updates are exchanged to propagate routing information, and finally, Hello packets continue to maintain the neighbor relationship.
B
Step 1: Exchange routing updates. Step 2: Send Hello packets. Step 3: Discover neighbors. Step 4: Maintain neighbor state.
Why it fails: Routing updates cannot be sent before an EIGRP adjacency exists. EIGRP relies on Hello packets to establish a neighbor relationship and determine initial parameters such as hold time and K-values. The reliable transport (RTP) used for updates requires an active neighbor entry with sequence numbers and a RTT calculated from the Hello exchange. Without the initial Hello/discovery phase, there is no neighbor to send updates to, so this ordering is fundamentally invalid.
C
Step 1: Discover neighbors. Step 2: Send Hello packets. Step 3: Exchange routing updates. Step 4: Maintain neighbor state.
Why it fails: Neighbor discovery in EIGRP is not an explicit step that can happen before any packets are sent—it is a consequence of receiving Hello packets. A router actively multicasts Hello packets to 224.0.0.10 on directly connected interfaces; a neighbor is 'discovered' only when a Hello is heard. Thus, placing 'Discover neighbors' before 'Send Hello packets' reverses the cause-and-effect relationship. The discovery event is the start of forming an adjacency, but it must be triggered by the Hello exchange itself.
D
Step 1: Send Hello packets. Step 2: Exchange routing updates. Step 3: Discover neighbors. Step 4: Maintain neighbor state.
Why it fails: This sequence incorrectly places routing updates before adjacency has been fully formed. After sending Hello packets, a router must receive Hello packets back and pass neighbor-matching checks (AS number, K-values, hold timer) before the neighbor is considered discovered and an adjacency is established. Only after that per-neighbor condition is met can routing updates be exchanged via multicast to 224.0.0.10. Prioritizing updates before discovery would require a valid route to a non-existent neighbor and is logically impossible in the neighbor state machine.

Full breakdown with real-world context →

Question 12mediummatching

Read the full Infrastructure explanation →

Match each Cisco IOS command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays the routing table

Displays interface status and statistics

Displays VLAN information

Displays the current configuration

Enables OSPF event debugging

Trap 1: show ip route: Tests network connectivity

Incorrect — this describes the ping command, not show ip route.

Trap 2: ping: Displays the IP routing table

Incorrect — this describes the show ip route command, not ping.

Study all Infrastructure common traps →

A
show ip route: Displays the IP routing table
The 'show ip route' command is used to view the router's routing table, which contains routes to networks.
B
show ip interface brief: Provides a summary of interface status and IP addresses
This command displays a concise summary of all interfaces, including their status, protocol, and IP addresses.
C
ping: Tests basic network connectivity
The ping command sends ICMP echo requests to a destination IP address to verify reachability.
D
traceroute: Traces the path packets take to a destination
The traceroute command shows the route packets take across an IP network, listing each hop.
E
show ip route: Tests network connectivity
Why it fails: Incorrect — this describes the ping command, not show ip route.
F
ping: Displays the IP routing table
Why it fails: Incorrect — this describes the show ip route command, not ping.

Full breakdown with real-world context →

Question 13mediummatching

Study the full EIGRP explanation →

Match each EIGRP term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Best metric to a destination

Metric advertised by neighbor

Backup route without loops

Primary route with lowest metric

Ensures loop-free backup routes

Trap 1: Feasible Distance: The metric advertised by a neighboring router…

Incorrect — this definition describes Reported Distance, not Feasible Distance.

Trap 2: Reported Distance: The total metric from the local router to the…

Incorrect — this definition describes Feasible Distance, not Reported Distance.

Study all Infrastructure common traps →

A
Feasible Distance: The total metric from the local router to the destination network.
Feasible Distance is the best metric (lowest total cost) to reach a destination from the local router.
B
Reported Distance: The metric advertised by a neighboring router for a specific route.
Reported Distance is the metric that a neighbor advertises for a route; it represents the neighbor's cost to reach the destination.
C
Feasible Condition: The condition where the reported distance is less than the feasible distance.
The Feasible Condition (RD < FD) ensures loop-free paths by only allowing routes from neighbors with a lower reported distance.
D
Successor: The next-hop router that has the lowest feasible distance to a destination.
A successor is the primary next-hop router; it has the lowest Feasible Distance to the destination.
E
Feasible Distance: The metric advertised by a neighboring router for a specific route.
Why it fails: Incorrect — this definition describes Reported Distance, not Feasible Distance.
F
Reported Distance: The total metric from the local router to the destination network.
Why it fails: Incorrect — this definition describes Feasible Distance, not Reported Distance.

Full breakdown with real-world context →

Question 14hardmulti select

Open the full BGP breakdown →

A network engineer is implementing VXLAN with BGP EVPN on Cisco Nexus switches. The engineer must ensure that the underlay network provides the necessary transport and that the overlay control plane distributes MAC and IP address reachability information. Which two statements about the operation of BGP EVPN in a VXLAN environment are true? (Choose two.)

Trap 1: BGP EVPN requires that all VTEPs be in the same autonomous system.

BGP EVPN can operate across multiple autonomous systems. iBGP or eBGP can be used, and route reflectors can be deployed. There is no requirement for all VTEPs to be in the same AS; eBGP EVPN is common for multi-site deployments.

Trap 2: BGP EVPN uses Route Type 5 to advertise IP prefixes for external…

Route Type 5 is the IP Prefix Route, used for advertising IP prefixes (not MACs) for layer 3 connectivity, such as from an external network. It is not used for host MAC/IP bindings, which are handled by Route Type 2. So this statement is true in general but not specifically for host reachability.

Trap 3: BGP EVPN requires that the underlay network use OSPF for unicast…

BGP EVPN does not mandate OSPF for the underlay. Any routing protocol that provides IP reachability between VTEP loopback interfaces can be used, such as OSPF, IS-IS, or eBGP. The underlay is independent of the EVPN control plane.

Study all Infrastructure common traps →

A
BGP EVPN requires that all VTEPs be in the same autonomous system.
Why it fails: BGP EVPN can operate across multiple autonomous systems. iBGP or eBGP can be used, and route reflectors can be deployed. There is no requirement for all VTEPs to be in the same AS; eBGP EVPN is common for multi-site deployments.
B
BGP EVPN uses Route Type 3 to advertise VTEP IP addresses for multicast replication.
Route Type 3 is the Inclusive Multicast Ethernet Tag Route, which advertises the VTEP IP address and the multicast group or head-end replication list for BUM traffic. It enables VTEPs to join the multicast group or learn the replication list for a given VNI.
C
BGP EVPN uses Route Type 2 to advertise MAC and IP address bindings for hosts.
Route Type 2 in BGP EVPN is the MAC/IP Advertisement Route, which carries both MAC and IP address information for a host. It allows VTEPs to learn the mapping of MAC to IP and to the remote VTEP, enabling efficient forwarding and ARP suppression.
D
BGP EVPN uses Route Type 5 to advertise IP prefixes for external connectivity.
Why it fails: Route Type 5 is the IP Prefix Route, used for advertising IP prefixes (not MACs) for layer 3 connectivity, such as from an external network. It is not used for host MAC/IP bindings, which are handled by Route Type 2. So this statement is true in general but not specifically for host reachability.
E
BGP EVPN requires that the underlay network use OSPF for unicast routing between VTEPs.
Why it fails: BGP EVPN does not mandate OSPF for the underlay. Any routing protocol that provides IP reachability between VTEP loopback interfaces can be used, such as OSPF, IS-IS, or eBGP. The underlay is independent of the EVPN control plane.

Full breakdown with real-world context →

Question 15easymultiple choice

Open the full VLAN trunking answer →

A network administrator is configuring a Cisco IOS switch and needs to ensure that the management VLAN interface is reachable from a remote subnet. The switch currently has no IP address configured on any interface. Which command must be applied to assign an IP address to the management VLAN?

Trap 1: ip default-gateway 192.168.10.1 on the switch

The ip default-gateway command sets the default gateway for the switch but does not assign an IP address to any interface. Without an IP address on a management interface, the switch cannot be managed remotely. This command alone is insufficient; an IP address must first be configured on an SVI.

Trap 2: ip address 192.168.10.2 255.255.255.0 on the console port

The console port is a physical management port used for local CLI access and does not support IP address configuration. It is not a network interface and cannot be assigned an IP address. Management IP addresses are assigned to VLAN interfaces or routed ports, not to console or auxiliary ports.

Trap 3: ip address 192.168.10.2 255.255.255.0 on the physical interface…

Assigning an IP address directly to a physical switch port is not typical for management access. Switch ports are Layer 2 by default and cannot have IP addresses unless they are routed ports on multilayer switches. For management, the IP is usually assigned to a VLAN interface (SVI). This command would be invalid on a standard Layer 2 switch port.

Study all Infrastructure common traps →

A
ip default-gateway 192.168.10.1 on the switch
Why it fails: The ip default-gateway command sets the default gateway for the switch but does not assign an IP address to any interface. Without an IP address on a management interface, the switch cannot be managed remotely. This command alone is insufficient; an IP address must first be configured on an SVI.
B
ip address 192.168.10.2 255.255.255.0 on the console port
Why it fails: The console port is a physical management port used for local CLI access and does not support IP address configuration. It is not a network interface and cannot be assigned an IP address. Management IP addresses are assigned to VLAN interfaces or routed ports, not to console or auxiliary ports.
C
interface vlan 1 then ip address 192.168.10.2 255.255.255.0
The management IP on a Cisco switch is typically assigned to a switched virtual interface (SVI) for a VLAN. The default management VLAN is VLAN 1. Entering interface vlan 1 and configuring an IP address provides management access. This allows the switch to be reached from other subnets if a default gateway is configured.
D
ip address 192.168.10.2 255.255.255.0 on the physical interface GigabitEthernet0/1
Why it fails: Assigning an IP address directly to a physical switch port is not typical for management access. Switch ports are Layer 2 by default and cannot have IP addresses unless they are routed ports on multilayer switches. For management, the IP is usually assigned to a VLAN interface (SVI). This command would be invalid on a standard Layer 2 switch port.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Infrastructure explanation →

A network engineer is configuring a pair of Cisco Catalyst 9300 switches in a StackWise stack. The engineer wants to ensure that a single switch failure does not cause the entire stack to lose its control plane. Which StackWise cabling topology should be used?

Trap 1: Connect all switches to a central master switch using one cable per…

StackWise does not support a star topology. The stack ports must be connected in a daisy-chain ring. A star topology would require a central switch with multiple stack ports, which is not how StackWise operates. Additionally, a central master failure would bring down the entire stack, defeating the purpose of redundancy.

Trap 2: Daisy-chain the stack ports in a single ring using only one cable…

A single daisy-chain ring using only one cable between each switch provides connectivity but does not offer redundancy for the stack control plane. If one cable or switch fails, the ring breaks and the stack may split or lose connectivity. StackWise requires a full-ring topology with two cables between adjacent switches to maintain resiliency.

Trap 3: Use a single StackWise cable to connect the first switch to the…

Leaving middle switches unconnected breaks the stack ring and prevents them from participating in the stack. StackWise requires all switches to be connected in a ring. A single cable between first and last switch does not provide the necessary connectivity for the middle switches, and the stack would not form correctly.

Study all Infrastructure common traps →

A
Connect all switches to a central master switch using one cable per switch in a star topology.
Why it fails: StackWise does not support a star topology. The stack ports must be connected in a daisy-chain ring. A star topology would require a central switch with multiple stack ports, which is not how StackWise operates. Additionally, a central master failure would bring down the entire stack, defeating the purpose of redundancy.
B
Connect the switches in a full-ring topology using two StackWise cables between each adjacent switch.
A full-ring topology with two cables between each adjacent switch provides redundant paths for stack control and data traffic. If a single cable or switch fails, the stack remains operational because the ring can reconverge. This is the recommended cabling for StackWise to ensure control plane redundancy and avoid a single point of failure.
C
Daisy-chain the stack ports in a single ring using only one cable between each switch.
Why it fails: A single daisy-chain ring using only one cable between each switch provides connectivity but does not offer redundancy for the stack control plane. If one cable or switch fails, the ring breaks and the stack may split or lose connectivity. StackWise requires a full-ring topology with two cables between adjacent switches to maintain resiliency.
D
Use a single StackWise cable to connect the first switch to the last switch, and leave the middle switches unconnected.
Why it fails: Leaving middle switches unconnected breaks the stack ring and prevents them from participating in the stack. StackWise requires all switches to be connected in a ring. A single cable between first and last switch does not provide the necessary connectivity for the middle switches, and the stack would not form correctly.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Infrastructure explanation →

A network engineer is configuring a pair of Cisco Catalyst 9300 switches to operate as a single logical switch using StackWise Virtual technology. The engineer has already configured the domain ID and priority on both switches and physically connected them with the appropriate cables. After reloading both switches, the engineer notices that the stack is not forming and both switches remain in standalone mode. Which action should the engineer take next?

Trap 1: Verify that the SVL link is using fiber optic cables and not copper…

StackWise Virtual supports both copper and fiber connections depending on the hardware and distance. The type of cable is not a strict requirement for stack formation as long as the ports are supported. The issue is more likely related to software compatibility rather than cable media type.

Trap 2: Confirm that the StackWise Virtual domain ID is unique and does not…

While a unique domain ID is important, the engineer already configured the domain ID on both switches. If the domain IDs were mismatched, the stack would not form, but the scenario states the engineer configured the domain ID. The most likely cause after reload is a software version mismatch, not a domain ID conflict.

Trap 3: Verify that the StackWise Virtual link is configured as a trunk…

The StackWise Virtual link is a special-purpose link that runs a proprietary protocol and does not use VLAN tagging or trunking. Configuring it as a trunk would not help and is not a valid configuration for the SVL. The link must be a direct physical connection between the two switches using supported ports.

Study all Infrastructure common traps →

A
Verify that the SVL link is using fiber optic cables and not copper cables.
Why it fails: StackWise Virtual supports both copper and fiber connections depending on the hardware and distance. The type of cable is not a strict requirement for stack formation as long as the ports are supported. The issue is more likely related to software compatibility rather than cable media type.
B
Confirm that the StackWise Virtual domain ID is unique and does not conflict with any other stack in the network.
Why it fails: While a unique domain ID is important, the engineer already configured the domain ID on both switches. If the domain IDs were mismatched, the stack would not form, but the scenario states the engineer configured the domain ID. The most likely cause after reload is a software version mismatch, not a domain ID conflict.
C
Verify that the StackWise Virtual link is configured as a trunk carrying all VLANs.
Why it fails: The StackWise Virtual link is a special-purpose link that runs a proprietary protocol and does not use VLAN tagging or trunking. Configuring it as a trunk would not help and is not a valid configuration for the SVL. The link must be a direct physical connection between the two switches using supported ports.
D
Ensure that the switches are running the same Cisco IOS XE software version and have matching licenses.
For StackWise Virtual to form, both switches must run the same Cisco IOS XE software version and have compatible licenses. A mismatch in software version or licensing can prevent the stack from forming, leaving both switches in standalone mode. Verifying and aligning software versions is a critical troubleshooting step.

Full breakdown with real-world context →

Question 18mediummultiple choice

Review the full OSPF breakdown →

A network engineer is configuring a new Cisco IOS router that will run OSPFv2. The router must be able to form adjacencies with its directly connected neighbors and must also allow remote networks to be reachable through it. The engineer issues the following commands: router ospf 1, network 10.0.0.0 0.0.0.255 area 0, and network 192.168.1.0 0.0.0.255 area 1. However, the router is not forming an adjacency with a neighbor on the 10.0.0.0/24 interface. Which action is the most likely cause of the problem?

Trap 1: The OSPF router ID is not explicitly configured, so the router…

OSPF will automatically select a router ID from the highest loopback or active physical interface IP address if none is manually set. The absence of an explicit router ID does not prevent adjacency formation; it only affects the identifier used in the OSPF domain. Therefore, this is not the cause of the adjacency failure.

Trap 2: The OSPF process ID is set to 1, but the neighbor is using process…

OSPF process IDs are locally significant and do not need to match between neighbors. The process ID is used only to distinguish multiple OSPF instances on the same router. Therefore, a mismatch in process ID does not prevent adjacency formation. This is a common misconception.

Trap 3: The network commands are using wildcard masks, but OSPF requires…

Cisco IOS OSPF configuration uses wildcard masks in the network command, not subnet masks. The syntax shown is correct for OSPF. Using a subnet mask would be invalid and result in an error. Thus, this is not the reason for the adjacency issue.

Study all Infrastructure common traps →

A
The OSPF router ID is not explicitly configured, so the router cannot form adjacencies.
Why it fails: OSPF will automatically select a router ID from the highest loopback or active physical interface IP address if none is manually set. The absence of an explicit router ID does not prevent adjacency formation; it only affects the identifier used in the OSPF domain. Therefore, this is not the cause of the adjacency failure.
B
The OSPF process ID is set to 1, but the neighbor is using process ID 2.
Why it fails: OSPF process IDs are locally significant and do not need to match between neighbors. The process ID is used only to distinguish multiple OSPF instances on the same router. Therefore, a mismatch in process ID does not prevent adjacency formation. This is a common misconception.
C
The network commands are using wildcard masks, but OSPF requires subnet masks.
Why it fails: Cisco IOS OSPF configuration uses wildcard masks in the network command, not subnet masks. The syntax shown is correct for OSPF. Using a subnet mask would be invalid and result in an error. Thus, this is not the reason for the adjacency issue.
D
The interface on the 10.0.0.0/24 network is passive, preventing OSPF hello packets.
If an interface is configured as passive under OSPF, it will not send or receive OSPF hello packets. Without hellos, no adjacency can form on that interface. The network command alone does not make an interface passive; however, a common mistake is to configure all interfaces as passive and then forget to disable passive mode on the neighbor-facing interface. This would directly prevent adjacency formation.

Full breakdown with real-world context →

Question 19hardmultiple choice

Review the full OSPF breakdown →

A network engineer is implementing OSPFv3 in an IPv6 network. The engineer wants to enable OSPFv3 on an interface and ensure that the interface participates in OSPF area 0. Which command is required to enable OSPFv3 on an interface in Cisco IOS?

Trap 1: ospfv3 1 ipv6 area 0

The command ospfv3 1 ipv6 area 0 is used in address-family configuration mode for OSPFv3, but it is not the interface-level command to enable OSPFv3. The correct interface command is ipv6 ospf process-id area area-id. The ospfv3 command is used under router configuration for address family settings.

Trap 2: router ospfv3 1 then address-family ipv6 unicast

This sequence enters OSPFv3 router configuration and address-family configuration, but it does not enable OSPFv3 on an interface. To enable OSPFv3 on an interface, you must go to interface configuration mode and use the ipv6 ospf command. The router ospfv3 command alone does not activate the protocol on any interface.

Trap 3: ipv6 router ospf 1 then network 2001:db8::/64 area 0

OSPFv3 does not use network statements to enable OSPF on interfaces. Instead, OSPFv3 is enabled directly on the interface using the ipv6 ospf command. The network command under router ospf is for OSPFv2 only. Therefore, this configuration would not enable OSPFv3 on the interface.

Study all Infrastructure common traps →

A
ospfv3 1 ipv6 area 0
Why it fails: The command ospfv3 1 ipv6 area 0 is used in address-family configuration mode for OSPFv3, but it is not the interface-level command to enable OSPFv3. The correct interface command is ipv6 ospf process-id area area-id. The ospfv3 command is used under router configuration for address family settings.
B
router ospfv3 1 then address-family ipv6 unicast
Why it fails: This sequence enters OSPFv3 router configuration and address-family configuration, but it does not enable OSPFv3 on an interface. To enable OSPFv3 on an interface, you must go to interface configuration mode and use the ipv6 ospf command. The router ospfv3 command alone does not activate the protocol on any interface.
C
ipv6 ospf 1 area 0
In Cisco IOS, OSPFv3 is enabled on an interface using the ipv6 ospf process-id area area-id command. This command activates OSPFv3 on the interface and associates it with the specified area. It is the correct method to enable OSPFv3 per interface, unlike OSPFv2 which can use network statements under router configuration.
D
ipv6 router ospf 1 then network 2001:db8::/64 area 0
Why it fails: OSPFv3 does not use network statements to enable OSPF on interfaces. Instead, OSPFv3 is enabled directly on the interface using the ipv6 ospf command. The network command under router ospf is for OSPFv2 only. Therefore, this configuration would not enable OSPFv3 on the interface.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Infrastructure explanation →

A network engineer is implementing a first-hop redundancy protocol on a pair of switches. The requirement is to have one switch actively forward traffic for the virtual IP while the other switch stands by, and to allow the standby switch to take over if the active switch fails. Which protocol should be used to meet these requirements?

Trap 1: STP

Spanning Tree Protocol (STP) is a Layer 2 loop prevention protocol and does not provide first-hop redundancy or a virtual IP address. It is unrelated to default gateway redundancy. STP ensures a loop-free topology but does not offer gateway failover capabilities.

Trap 2: HSRPv2

HSRPv2 is a Cisco-proprietary protocol that provides active/standby operation. However, the question does not specify a Cisco-only environment, and VRRPv3 is an open standard that also meets the requirements. While HSRPv2 would work, VRRPv3 is the more appropriate choice for multi-vendor interoperability.

Trap 3: GLBP

GLBP provides load balancing across multiple gateways, with all routers actively forwarding traffic. While it offers redundancy, it does not strictly follow the active/standby model; instead, it uses an active virtual gateway and multiple active virtual forwarders. The requirement specifies active/standby, so GLBP is not the best fit.

Study all Infrastructure common traps →

A
STP
Why it fails: Spanning Tree Protocol (STP) is a Layer 2 loop prevention protocol and does not provide first-hop redundancy or a virtual IP address. It is unrelated to default gateway redundancy. STP ensures a loop-free topology but does not offer gateway failover capabilities.
B
HSRPv2
Why it fails: HSRPv2 is a Cisco-proprietary protocol that provides active/standby operation. However, the question does not specify a Cisco-only environment, and VRRPv3 is an open standard that also meets the requirements. While HSRPv2 would work, VRRPv3 is the more appropriate choice for multi-vendor interoperability.
C
GLBP
Why it fails: GLBP provides load balancing across multiple gateways, with all routers actively forwarding traffic. While it offers redundancy, it does not strictly follow the active/standby model; instead, it uses an active virtual gateway and multiple active virtual forwarders. The requirement specifies active/standby, so GLBP is not the best fit.
D
VRRPv3
VRRPv3 is an open standard first-hop redundancy protocol that provides active/standby operation. One router or switch is the master and forwards traffic for the virtual IP, while others are backups. It supports IPv4 and IPv6 and is widely interoperable. It meets the requirement of active/standby with failover.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Infrastructure sessions

Start a Infrastructure only practice session

Every question in these sessions is drawn from the Infrastructure domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Infrastructure questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about Infrastructure?: Configure and verify VLANs, 802.1Q trunks, EtherChannel, OSPF/EIGRP/BGP, HSRP, NAT, and NTP on IOS-XE, interpreting show commands like show ip ospf neighbor. The critical skill is correct Layer 2/Layer 3 forwarding and routing adjacency formation.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Infrastructure questions in a focused session?: Yes — the session launcher on this page draws every question from the Infrastructure domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

Infrastructure only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions Infrastructure domain overview 350-401 exam guide

Exam traps to avoid

▸Mixing up HSRP active/standby versus VRRP master/backup terminology, and forgetting HSRP's default priority of 100
▸Assuming DTP negotiates trunks on all platforms; some Catalyst switches default to dynamic auto or access
▸Configuring OSPF passive interfaces on links that must form adjacencies, silently blocking hello packets

Infrastructure practice questions

What to know about Infrastructure

Common Infrastructure exam traps

Infrastructure questions

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Which THREE conditions are required for OSPF routers to become fully adjacent? (Choose three.)

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

R1 has an OSPF priority of 0. What is its role on the OSPF network?

Exhibit

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Which TWO characteristics are true about the operation of Rapid PVST+? (Choose two.)

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag and drop the steps for the EIGRP neighbor discovery process in the correct order.

Match each Cisco IOS command to its function.

Match each EIGRP term to its definition.

A network administrator is configuring a Cisco IOS switch and needs to ensure that the management VLAN interface is reachable from a remote subnet. The switch currently has no IP address configured on any interface. Which command must be applied to assign an IP address to the management VLAN?

A network engineer is configuring a pair of Cisco Catalyst 9300 switches in a StackWise stack. The engineer wants to ensure that a single switch failure does not cause the entire stack to lose its control plane. Which StackWise cabling topology should be used?

A network engineer is implementing OSPFv3 in an IPv6 network. The engineer wants to enable OSPFv3 on an interface and ensure that the interface participates in OSPF area 0. Which command is required to enable OSPFv3 on an interface in Cisco IOS?

Track your progress over time

Start a Infrastructure only practice session

Related 350-401 topic practice pages

Architecture practice questions

Virtualization practice questions