VRF and Path Isolation practice questions

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

Trap 1: The route-target import/export values are mismatched with the route…

Incorrect because the route-target values are only relevant for route distribution among PEs; the route reflector simply reflects VPNv4 routes regardless of RT.

Trap 2: The CE router is not configured with a default route pointing to…

Incorrect because the CE can ping the PE's VRF interface, indicating Layer 3 connectivity; the issue is with remote route reachability.

Trap 3: The PE router needs the mpls ip command on the interface facing the…

Incorrect because MPLS is not required on the CE-facing interface; it is needed on core-facing interfaces.

A
The route-target import/export values are mismatched with the route reflector's configuration.
Why wrong: Incorrect because the route-target values are only relevant for route distribution among PEs; the route reflector simply reflects VPNv4 routes regardless of RT.
B
The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.
Correct because without this command, the PE does not redistribute VRF routes into VPNv4 or import VPNv4 routes into the VRF.
C
The CE router is not configured with a default route pointing to the PE.
Why wrong: Incorrect because the CE can ping the PE's VRF interface, indicating Layer 3 connectivity; the issue is with remote route reachability.
D
The PE router needs the mpls ip command on the interface facing the CE router.
Why wrong: Incorrect because MPLS is not required on the CE-facing interface; it is needed on core-facing interfaces.

Open the full VLAN trunking answer →

Question 2hardmultiple choice

An enterprise uses VRF-lite to isolate guest Wi-Fi traffic from corporate traffic on a Cisco Catalyst 9300 switch. The guest VRF (GUEST) is configured on VLAN 100, and the corporate VRF (CORP) on VLAN 200. Both VRFs use the same default gateway router connected via a trunk. The engineer notices that guest devices can reach the internet but cannot access the guest captive portal hosted on a server in VLAN 100. The server's IP is reachable from the switch itself. What is the issue?

Trap 1: The trunk between the switch and the router is not allowing VLAN…

Incorrect because the switch can reach the server's IP, indicating the server is reachable from the switch itself, so VLAN 100 is allowed on the trunk.

Trap 2: The guest VRF is missing the route-target export command.

Incorrect because VRF-lite does not require route-target; route-targets are used in MPLS VPN environments.

Trap 3: The captive portal server is configured with a default gateway that…

Incorrect because if the server were in the corporate VRF, it would not be reachable from the switch in the GUEST VRF; the switch can reach it, so it must be in the same VRF.

A
The guest server is in a different VLAN than the guest wireless subnet, and inter-VLAN routing is not configured within the GUEST VRF.
Correct because if the guest wireless clients and the captive portal server are in different VLANs but both in the GUEST VRF, the switch must have an SVI for each VLAN in the GUEST VRF and routing must be enabled. Without proper VRF-aware routing, packets are dropped.
B
The trunk between the switch and the router is not allowing VLAN 100.
Why wrong: Incorrect because the switch can reach the server's IP, indicating the server is reachable from the switch itself, so VLAN 100 is allowed on the trunk.
C
The guest VRF is missing the route-target export command.
Why wrong: Incorrect because VRF-lite does not require route-target; route-targets are used in MPLS VPN environments.
D
The captive portal server is configured with a default gateway that points to the corporate VRF.
Why wrong: Incorrect because if the server were in the corporate VRF, it would not be reachable from the switch in the GUEST VRF; the switch can reach it, so it must be in the same VRF.

Read the full MPLS explanation →

Question 3hardmultiple choice

A service provider uses MPLS L3VPN with multiple VRFs on a Cisco ASR 1000 PE router. One customer VRF (RED) has overlapping IP addresses with another VRF (BLUE). The engineer configures route-target import/export as 100:1 for RED and 200:2 for BLUE. Both VRFs have a static default route pointing to the CE. The PE receives VPNv4 routes from the route reflector for both VRFs. However, traffic from RED to its CE is working, but traffic from BLUE to its CE is intermittently failing. What is the most likely cause?

Trap 1: The route-target import for BLUE is 200:2, but the route reflector…

Incorrect because if the route-target were mismatched, no VPNv4 routes would be imported into BLUE, causing complete failure, not intermittent.

Trap 2: The PE router has too many VRFs, causing memory exhaustion.

Incorrect because memory exhaustion would affect all VRFs, not just one.

Trap 3: The BLUE VRF is missing the rd command.

Incorrect because a missing route distinguisher would prevent VPNv4 route advertisement, causing complete failure, not intermittent.

A
The BLUE VRF's interface is not configured with the ip vrf forwarding BLUE command, so the interface is in the global routing table.
Correct because if the interface is not associated with the VRF, traffic from that interface uses the global table, causing intermittent failures when the global table has conflicting routes.
B
The route-target import for BLUE is 200:2, but the route reflector exports routes with a different route-target.
Why wrong: Incorrect because if the route-target were mismatched, no VPNv4 routes would be imported into BLUE, causing complete failure, not intermittent.
C
The PE router has too many VRFs, causing memory exhaustion.
Why wrong: Incorrect because memory exhaustion would affect all VRFs, not just one.
D
The BLUE VRF is missing the rd command.
Why wrong: Incorrect because a missing route distinguisher would prevent VPNv4 route advertisement, causing complete failure, not intermittent.

Open the full VLAN trunking answer →

Question 4mediummultiple choice

A network engineer is troubleshooting a VRF-lite deployment on a Cisco Nexus 9000 switch. Two VRFs, PROD and DEV, are configured. The switch has an SVI for VLAN 10 in VRF PROD and VLAN 20 in VRF DEV. A firewall is connected to a Layer 3 port in VRF PROD for internet access. The engineer needs to allow the DEV VRF to reach the internet through the same firewall, but without using a separate physical interface. What should the engineer configure?

Trap 1: Place the firewall interface in both VRFs using the ip vrf…

Incorrect because a single interface can only belong to one VRF.

Trap 2: Create a VLAN trunk between the switch and firewall, and assign the…

Incorrect because a VLAN cannot be in two VRFs simultaneously.

Trap 3: Use policy-based routing (PBR) in VRF DEV to forward traffic to the…

Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.

A
Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.
Correct because route leaking allows one VRF to use a next-hop in another VRF. A static route with the appropriate VRF and route-map can achieve this.
B
Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.
Why wrong: Incorrect because a single interface can only belong to one VRF.
C
Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.
Why wrong: Incorrect because a VLAN cannot be in two VRFs simultaneously.
D
Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.
Why wrong: Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.

Question 5mediummultiple choice

An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?

Trap 1: The VRF is not configured with a route distinguisher.

Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.

Trap 2: The route-target import/export values are incorrect.

Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.

Trap 3: The interface in the VRF is not configured with the ipv4 address.

Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.

A
The VRF is not configured with a route distinguisher.
Why wrong: Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.
B
The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.
Correct because without this, the VRF routes are not injected into BGP VPNv4.
C
The route-target import/export values are incorrect.
Why wrong: Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.
D
The interface in the VRF is not configured with the ipv4 address.
Why wrong: Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.

Question 6easymultiple choice

A company uses VRF-lite to separate management traffic (VRF MGMT) from user traffic (VRF USER) on a Cisco Catalyst 3850 stack. The management network is 10.0.0.0/24, and the user network is 192.168.1.0/24. The engineer wants to allow SSH access from the user network to the management network for device administration. The switch has an SVI for each VRF. What is the simplest way to achieve this while maintaining VRF isolation?

Trap 1: Place both SVIs in the same VRF and use access-lists to restrict…

Incorrect because this defeats VRF isolation.

Trap 2: Use a firewall between the VRFs to filter traffic.

Incorrect because this is more complex and not the simplest method.

Trap 3: Configure the switch to use the global routing table for SSH…

Incorrect because the switch cannot selectively use global table for SSH; VRF assignment is interface-based.

A
Configure a static route in VRF USER pointing to the VRF MGMT's SVI IP address, and enable route leaking between the VRFs.
Correct because route leaking allows inter-VRF communication while keeping the VRFs separate. The static route tells USER how to reach MGMT.
B
Place both SVIs in the same VRF and use access-lists to restrict traffic.
Why wrong: Incorrect because this defeats VRF isolation.
C
Use a firewall between the VRFs to filter traffic.
Why wrong: Incorrect because this is more complex and not the simplest method.
D
Configure the switch to use the global routing table for SSH traffic only.
Why wrong: Incorrect because the switch cannot selectively use global table for SSH; VRF assignment is interface-based.

Read the full MPLS explanation →

Question 7mediummultiple choice

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?

Trap 1: The VRF is missing the route-target export command.

Incorrect because the PE can reach remote sites, meaning VPNv4 routes are imported correctly, so export is working.

Trap 2: The PE router is not running a routing protocol with the CE router.

Incorrect because even without a routing protocol, static routes can be used; the issue is the CE's lack of a route.

Trap 3: The MPLS LDP is not enabled on the PE-CE link.

Incorrect because MPLS is not required on the PE-CE link for L3VPN.

A
The CE router does not have a default route pointing to the PE's VRF interface.
Correct because if the CE does not have a route to remote sites, it cannot send traffic. The PE can ping because it has the routes in the VRF.
B
The VRF is missing the route-target export command.
Why wrong: Incorrect because the PE can reach remote sites, meaning VPNv4 routes are imported correctly, so export is working.
C
The PE router is not running a routing protocol with the CE router.
Why wrong: Incorrect because even without a routing protocol, static routes can be used; the issue is the CE's lack of a route.
D
The MPLS LDP is not enabled on the PE-CE link.
Why wrong: Incorrect because MPLS is not required on the PE-CE link for L3VPN.

Read the full DHCP explanation →

Question 8hardmultiple choice

An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?

Trap 1: The DHCP relay agent is not configured to use the VRF GUEST; the ip…

Incorrect because the helper-address is applied on the interface in the GUEST VRF; the issue is that the relay cannot forward to a server in a different VRF without route leaking.

Trap 2: The DHCP server is not configured with a scope for the guest subnet.

Incorrect because this would cause the server to not respond, but the relay might still forward the request; the issue is that the request never reaches the server.

Trap 3: The guest VRF is missing the ip dhcp relay command globally.

Incorrect because DHCP relay is enabled by default; the global command is not required.

A
The DHCP relay agent is not configured to use the VRF GUEST; the ip helper-address command must be applied under the VRF interface, but the DHCP server is in a different VRF, requiring inter-VRF routing or the use of the ip dhcp relay information option.
Why wrong: Incorrect because the helper-address is applied on the interface in the GUEST VRF; the issue is that the relay cannot forward to a server in a different VRF without route leaking.
B
The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.
Correct because DHCP relay forwards the request based on the routing table of the source VRF. Without a route to the server in the GUEST VRF, the relay fails.
C
The DHCP server is not configured with a scope for the guest subnet.
Why wrong: Incorrect because this would cause the server to not respond, but the relay might still forward the request; the issue is that the request never reaches the server.
D
The guest VRF is missing the ip dhcp relay command globally.
Why wrong: Incorrect because DHCP relay is enabled by default; the global command is not required.

Question 9easymultiple choice

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

Trap 1: The BGP neighbor is not configured with the password command.

Incorrect because a password is not required for BGP to come up.

Trap 2: The route-target import/export values are incorrect for the…

Incorrect because route-targets affect VPNv4 route distribution, not the BGP session directly.

Trap 3: The engineer forgot to configure the VRF under the BGP router-id.

Incorrect because the router-id is global and not VRF-specific.

A
The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.
Correct because the ip vrf forwarding command clears the IP address on the interface, requiring it to be re-entered.
B
The BGP neighbor is not configured with the password command.
Why wrong: Incorrect because a password is not required for BGP to come up.
C
The route-target import/export values are incorrect for the customer.
Why wrong: Incorrect because route-targets affect VPNv4 route distribution, not the BGP session directly.
D
The engineer forgot to configure the VRF under the BGP router-id.
Why wrong: Incorrect because the router-id is global and not VRF-specific.

Review the full OSPF breakdown →

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip route vrf CUSTOMER-A

VRF CUSTOMER-A: Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.100
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.100
B        10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34

Based on this output, what can be concluded?

Trap 1: VRF CUSTOMER-A is not using BGP for routing

The B entry clearly shows BGP is used.

Trap 2: The default route is learned via BGP

The gateway of last resort is 10.0.1.1, which is not necessarily BGP; it could be static or from another protocol.

Trap 3: GigabitEthernet0/0.100 is not associated with VRF CUSTOMER-A

The directly connected routes on that subinterface appear in the VRF routing table, so it is associated.

A
VRF CUSTOMER-A has a BGP-learned route to 10.0.2.0/24
The B entry shows a BGP route with next-hop 192.168.1.2, indicating BGP learned the prefix 10.0.2.0/24.
B
VRF CUSTOMER-A is not using BGP for routing
Why wrong: The B entry clearly shows BGP is used.
C
The default route is learned via BGP
Why wrong: The gateway of last resort is 10.0.1.1, which is not necessarily BGP; it could be static or from another protocol.
D
GigabitEthernet0/0.100 is not associated with VRF CUSTOMER-A
Why wrong: The directly connected routes on that subinterface appear in the VRF routing table, so it is associated.

Study the full IPv6 explanation →

Question 11hardmultiple choice

A network engineer runs the following command on Router R2:

R2# show vrf detail

VRF CUSTOMER-B (VRF Id = 1); default RD 65000:1; default VPNID <not set>

Interfaces:

GigabitEthernet0/0.200 GigabitEthernet0/1.200 Address family IPV4 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100

No export route-map
    No import route-map

Address family IPV6 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100 Members:

10.0.0.0/24

Based on this output, what can be concluded?

Trap 1: The VRF is configured for IPv4 only

Both IPv4 and IPv6 address families are listed.

Trap 2: The VRF uses different route-targets for import and export

Both import and export use the same RT:65000:100.

Trap 3: The VRF has no interfaces assigned

Two interfaces are listed under Interfaces.

A
The VRF is configured for IPv4 only
Why wrong: Both IPv4 and IPv6 address families are listed.
B
The VRF uses different route-targets for import and export
Why wrong: Both import and export use the same RT:65000:100.
C
The VRF supports both IPv4 and IPv6 VPNs with matching route-targets
Both address families are present and use the same route-target for import and export.
D
The VRF has no interfaces assigned
Why wrong: Two interfaces are listed under Interfaces.

Question 12mediummultiple choice

A network engineer runs the following command on Router R3:

R3# show bgp vpnv4 unicast all summary

BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65000    1000    1000       10    0    0 01:23:45        5
192.168.2.2     4        65000     800     800       10    0    0 00:45:12        3

Based on this output, what can be concluded?

Trap 1: Both neighbors are eBGP peers

Both have AS 65000, matching the local AS, so they are iBGP peers.

Trap 2: The neighbor 192.168.1.1 is not receiving any prefixes

PfxRcd for 192.168.1.1 is 5, so it is receiving prefixes.

Trap 3: The BGP table has 20 prefixes

The output shows 10 network entries, not 20.

A
Both neighbors are eBGP peers
Why wrong: Both have AS 65000, matching the local AS, so they are iBGP peers.
B
Both neighbors are iBGP peers exchanging VPNv4 prefixes
The local AS is 65000 and both neighbors have the same AS, indicating iBGP. PfxRcd shows prefixes received.
C
The neighbor 192.168.1.1 is not receiving any prefixes
Why wrong: PfxRcd for 192.168.1.1 is 5, so it is receiving prefixes.
D
The BGP table has 20 prefixes
Why wrong: The output shows 10 network entries, not 20.

Read the full MPLS explanation →

Question 13hardmultiple choice

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor vrf CUSTOMER-C

Peer LDP Ident: 10.0.0.5:0; Local LDP Ident 10.0.0.4:0 TCP connection: 10.0.0.5.646 - 10.0.0.4.646 State: Oper; Msgs sent/rcvd: 500/500; Downstream Up time: 02:30:00 LDP discovery sources: GigabitEthernet0/0.300, Src IP addr: 10.0.1.2 hello sent/rcvd: 1000/1000 Addresses bound to peer LDP Ident:

10.0.1.2        10.0.2.2

Based on this output, what can be concluded?

Trap 1: LDP is not configured for VRF CUSTOMER-C

The command shows a neighbor, so LDP is configured.

Trap 2: The LDP session is using TCP port 179

LDP uses TCP port 646, not 179.

Trap 3: The peer is discovered via OSPF

Discovery is via hello messages on GigabitEthernet0/0.300, not OSPF.

A
LDP is not configured for VRF CUSTOMER-C
Why wrong: The command shows a neighbor, so LDP is configured.
B
The LDP session is operational with peer 10.0.0.5
State is 'Oper' (operational), indicating the session is up.
C
The LDP session is using TCP port 179
Why wrong: LDP uses TCP port 646, not 179.
D
The peer is discovered via OSPF
Why wrong: Discovery is via hello messages on GigabitEthernet0/0.300, not OSPF.

Question 14mediummultiple choice

A network engineer runs the following command on Router R5:

R5# show ip interface brief | include VRF

Interface                  IP-Address      OK? Method Status                Protocol

GigabitEthernet0/0.100 10.0.0.1 YES NVRAM up up GigabitEthernet0/0.200 10.0.1.1 YES NVRAM up up GigabitEthernet0/0.300 10.0.2.1 YES NVRAM up up Loopback100 10.100.0.1 YES NVRAM up up

R5# show vrf brief

Name Default RD Protocols Interfaces CUSTOMER-A 65000:1 ipv4 Gi0/0.100 CUSTOMER-B 65000:2 ipv4 Gi0/0.200 CUSTOMER-C 65000:3 ipv4 Gi0/0.300

Based on this output, what can be concluded?

Trap 1: All interfaces belong to the same VRF

Each subinterface is in a different VRF.

Trap 2: Loopback100 is in VRF CUSTOMER-C

Loopback100 is not listed in any VRF in the vrf brief output.

Trap 3: There is no VRF configured on Router R5

Three VRFs are clearly listed.

A
All interfaces belong to the same VRF
Why wrong: Each subinterface is in a different VRF.
B
VRF CUSTOMER-A uses RD 65000:1 and is associated with GigabitEthernet0/0.100
The output shows CUSTOMER-A with RD 65000:1 and interface Gi0/0.100.
C
Loopback100 is in VRF CUSTOMER-C
Why wrong: Loopback100 is not listed in any VRF in the vrf brief output.
D
There is no VRF configured on Router R5
Why wrong: Three VRFs are clearly listed.

Question 15hardmultiple choice

A network engineer runs the following command on Router R6:

R6# show ip route vrf CUSTOMER-D

VRF CUSTOMER-D:

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.400
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.400
      192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask
B        192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00

R6# show ip bgp vpnv4 vrf CUSTOMER-D

BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i

Based on this output, what can be concluded?

Trap 1: The route 192.168.1.0/24 is learned via OSPF

Both outputs show it is BGP (B and BGP table).

Trap 2: The next-hop 10.0.0.2 is not reachable

The route is valid and best (*>), indicating reachability.

Trap 3: VRF CUSTOMER-D has no directly connected networks

There is a directly connected network 10.0.0.0/30.

A
The route 192.168.1.0/24 is learned via OSPF
Why wrong: Both outputs show it is BGP (B and BGP table).
B
The route 192.168.1.0/24 is installed in the VRF routing table from BGP
The VRF route shows B, and the BGP table shows the same prefix with next-hop 10.0.0.2.
C
The next-hop 10.0.0.2 is not reachable
Why wrong: The route is valid and best (*>), indicating reachability.
D
VRF CUSTOMER-D has no directly connected networks
Why wrong: There is a directly connected network 10.0.0.0/30.

Review the full OSPF breakdown →

Question 16mediummultiple choice

A network engineer runs the following command on Router R7:

R7# show ip ospf neighbor vrf CUSTOMER-E

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.8         1   FULL/DR         00:00:35    10.0.1.2        GigabitEthernet0/0.500
10.0.0.9         1   FULL/BDR        00:00:31    10.0.2.2        GigabitEthernet0/0.600

Based on this output, what can be concluded?

Trap 1: OSPF is not configured for VRF CUSTOMER-E

Neighbors are shown, so OSPF is configured.

Trap 2: There is only one OSPF neighbor in VRF CUSTOMER-E

Two neighbors are listed.

Trap 3: The DR is 10.0.0.9

The DR is 10.0.0.8 (state FULL/DR).

A
OSPF is not configured for VRF CUSTOMER-E
Why wrong: Neighbors are shown, so OSPF is configured.
B
There is only one OSPF neighbor in VRF CUSTOMER-E
Why wrong: Two neighbors are listed.
C
OSPF is operating within VRF CUSTOMER-E with two neighbors
Two neighbors are in FULL state, indicating OSPF adjacency.
D
The DR is 10.0.0.9
Why wrong: The DR is 10.0.0.8 (state FULL/DR).

Study the full multicast explanation →

Question 17hardmultiple choice

A network engineer runs the following command on Router R8:

R8# show ip pim neighbor vrf CUSTOMER-F

Neighbor          Interface                Uptime/Expires    Ver   DR
10.0.3.2          GigabitEthernet0/0.700   02:00:00/00:01:30 v2    1/ DR
10.0.4.2          GigabitEthernet0/0.800   01:30:00/00:01:45 v2    0/ NDR (BDR)

Based on this output, what can be concluded?

Trap 1: PIM is not configured for VRF CUSTOMER-F

Neighbors are shown, so PIM is configured.

Trap 2: The DR is 10.0.4.2

The DR is 10.0.3.2 (indicated by 1/ DR).

Trap 3: Both neighbors are using PIM version 1

The Ver column shows v2 for both.

A
PIM is not configured for VRF CUSTOMER-F
Why wrong: Neighbors are shown, so PIM is configured.
B
The DR is 10.0.4.2
Why wrong: The DR is 10.0.3.2 (indicated by 1/ DR).
C
PIM is enabled in VRF CUSTOMER-F with a DR and BDR
Both neighbors are present with DR and BDR roles.
D
Both neighbors are using PIM version 1
Why wrong: The Ver column shows v2 for both.

Study the full QoS explanation →

Question 18hardmultiple choice

A network engineer runs the following command on Router R9:

R9# show policy-map interface GigabitEthernet0/0.900

GigabitEthernet0/0.900

Service-policy input: QOS_POLICY_VRF_G Class-map: CLASS_VOICE (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: CLASS_DATA (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) police: cir 2000000 bps, bc 62500 bytes, be 62500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any

Based on this output, what can be concluded?

Trap 1: No QoS policy is applied to this interface

A service-policy is clearly shown.

Trap 2: The policy only polices voice traffic

Both voice and data classes are policed.

Trap 3: The policy is applied outbound

It says 'Service-policy input', so inbound.

A
No QoS policy is applied to this interface
Why wrong: A service-policy is clearly shown.
B
The policy only polices voice traffic
Why wrong: Both voice and data classes are policed.
C
A QoS policy is applied inbound on GigabitEthernet0/0.900, policing voice and data traffic
The policy is applied input, with classes for voice (DSCP EF) and data (DSCP AF31), each with police actions.
D
The policy is applied outbound
Why wrong: It says 'Service-policy input', so inbound.

Question 19mediummultiple choice

Examine the following configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip vrf forwarding BLUE
 ip address 192.168.1.1 255.255.255.0
 no shutdown

What is the effect of this configuration?

Trap 1: The interface remains in the global routing table but is allowed to…

Incorrect. The interface is moved into VRF BLUE, not kept global.

Trap 2: The interface is placed into VRF BLUE, but the IP address is…

Incorrect. The IP address is part of VRF BLUE's address space.

Trap 3: The configuration is invalid because VRF BLUE must be created first…

Incorrect. While VRF must exist, the command is valid if VRF is already defined; the snippet assumes VRF exists.

A
The interface is placed into VRF BLUE, and all traffic sent or received on this interface uses the routing table of VRF BLUE.
Correct. The interface is now in VRF BLUE and uses its separate routing table.
B
The interface remains in the global routing table but is allowed to communicate with VRF BLUE via route leaking.
Why wrong: Incorrect. The interface is moved into VRF BLUE, not kept global.
C
The interface is placed into VRF BLUE, but the IP address is assigned from the global routing table.
Why wrong: Incorrect. The IP address is part of VRF BLUE's address space.
D
The configuration is invalid because VRF BLUE must be created first using 'vrf definition BLUE'.
Why wrong: Incorrect. While VRF must exist, the command is valid if VRF is already defined; the snippet assumes VRF exists.

Question 20mediummultiple choice

Consider the following configuration on a Cisco IOS-XE router:

vrf definition RED rd 100:1 route-target export 100:1 route-target import 100:1 !

interface GigabitEthernet0/2

vrf forwarding RED

ip address 10.10.10.1 255.255.255.0

Which statement is true about this configuration?

Trap 1: The 'rd' command is optional for VRF operation and can be omitted.

Incorrect. RD is required for VRF to be used in MPLS VPNs.

Trap 2: The 'route-target export' and 'route-target import' must match the…

Incorrect. RTs can be different from RD; they control route distribution.

Trap 3: This configuration will cause the interface to use the global…

Incorrect. The interface uses VRF RED's routing table.

A
The VRF RED is correctly configured for MPLS L3VPN, and the interface is placed in VRF RED.
Correct. RD and RTs are set, and the interface uses VRF RED.
B
The 'rd' command is optional for VRF operation and can be omitted.
Why wrong: Incorrect. RD is required for VRF to be used in MPLS VPNs.
C
The 'route-target export' and 'route-target import' must match the RD value exactly.
Why wrong: Incorrect. RTs can be different from RD; they control route distribution.
D
This configuration will cause the interface to use the global routing table for forwarding.
Why wrong: Incorrect. The interface uses VRF RED's routing table.