How should I use these WAN Technologies practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just WAN Technologies questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the WAN Technologies domain.

350-401 · topic practice

WAN Technologies practice questions

Practise ENCOR 350-401 WAN Technologies practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: WAN Technologies

Practice 10 questions Browse domain →

What the exam tests

What to know about WAN Technologies

WAN Technologies questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common WAN Technologies exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

WAN Technologies questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Study the full EIGRP explanation →

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

Trap 1: The hub router is configured with 'no ip next-hop-self eigrp' under…

Incorrect because disabling next-hop-self would actually help spokes learn the real next hop of remote spokes. The issue is that next-hop-self is still enabled, causing spokes to see the hub as the next hop.

Trap 2: The spoke routers have 'ip nhrp shortcut' configured but the hub…

Incorrect. NHRP redirect is used on the hub to inform spokes that a better path exists. Without it, spokes may still forward through the hub, but the primary cause here is the next-hop-self behavior in EIGRP.

Trap 3: The spoke routers are using static NHRP mappings to the hub only,…

Incorrect. Dynamic NHRP registration is needed for spokes to learn each other, but the scenario describes correct NHRP and mGRE configuration. The routing protocol's next-hop behavior is the key issue.

Study all WAN Technologies common traps →

A
The hub router is configured with 'no ip next-hop-self eigrp' under the tunnel interface.
Why wrong: Incorrect because disabling next-hop-self would actually help spokes learn the real next hop of remote spokes. The issue is that next-hop-self is still enabled, causing spokes to see the hub as the next hop.
B
The hub router is configured with 'ip next-hop-self eigrp' under the tunnel interface.
Correct. With next-hop-self enabled, the hub advertises routes with its own IP as the next hop, preventing spokes from learning the remote spoke's tunnel IP and thus no direct tunnel is built.
C
The spoke routers have 'ip nhrp shortcut' configured but the hub does not have 'ip nhrp redirect'.
Why wrong: Incorrect. NHRP redirect is used on the hub to inform spokes that a better path exists. Without it, spokes may still forward through the hub, but the primary cause here is the next-hop-self behavior in EIGRP.
D
The spoke routers are using static NHRP mappings to the hub only, without dynamic NHRP registration.
Why wrong: Incorrect. Dynamic NHRP registration is needed for spokes to learn each other, but the scenario describes correct NHRP and mGRE configuration. The routing protocol's next-hop behavior is the key issue.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full BGP breakdown →

An enterprise is replacing its legacy Frame Relay WAN with MPLS L3VPN. The new MPLS provider assigns a single VRF to the customer. The customer's CE routers are running BGP with the provider's PE routers. The engineer notices that the CE routers can ping the PE loopback addresses but cannot reach remote CE loopbacks. The BGP sessions are established and routes are received. What is the most likely cause?

Trap 1: The CE router is not configured with 'no bgp default ipv4-unicast'.

Incorrect. This command prevents the BGP process from automatically advertising IPv4 unicast routes, but it would not cause the specific symptom of being able to ping the PE but not the remote CE.

Trap 2: The PE router is not sending the customer routes to the remote CE…

Incorrect. Route-target mismatch would prevent routes from being imported into the VRF, but the scenario says routes are received on the CE, so route-targets are likely correct.

Trap 3: The CE router is not advertising its own loopback into BGP, so the…

Incorrect. The question states that routes are received, so the remote CE should have the route. The issue is that the CE can ping the PE but not the remote CE, indicating a problem with the route's next-hop reachability.

Study all WAN Technologies common traps →

A
The CE router is not configured with 'no bgp default ipv4-unicast'.
Why wrong: Incorrect. This command prevents the BGP process from automatically advertising IPv4 unicast routes, but it would not cause the specific symptom of being able to ping the PE but not the remote CE.
B
The PE router is not sending the customer routes to the remote CE because the next-hop is set to the local PE's loopback, which is reachable, but the remote PE is not advertising the routes due to route-target mismatch.
Why wrong: Incorrect. Route-target mismatch would prevent routes from being imported into the VRF, but the scenario says routes are received on the CE, so route-targets are likely correct.
C
The CE router is not advertising its own loopback into BGP, so the remote CE does not have a route to it.
Why wrong: Incorrect. The question states that routes are received, so the remote CE should have the route. The issue is that the CE can ping the PE but not the remote CE, indicating a problem with the route's next-hop reachability.
D
The PE router is not disabling BGP next-hop-self for the VRF, so the routes advertised to the CE have the remote CE's IP as the next-hop, which is not reachable from the local CE.
Correct. In MPLS L3VPN, the PE should set next-hop-self when advertising routes to the CE so that the CE uses the PE as the next hop. If not, the CE will try to reach the remote CE directly, which is not possible over the MPLS network.

Full breakdown with real-world context →

Question 3mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between two Cisco routers. The tunnel is established and IKEv2 Phase 1 is up, but no traffic passes. The engineer checks the crypto map and sees that the ACL is configured to permit traffic between the two LAN subnets. However, 'show crypto ipsec sa' shows that the number of packets encapsulated and decapsulated is zero. What is the most likely cause?

Trap 1: The crypto map is not applied to the correct interface.

Incorrect. If the crypto map were not applied, Phase 1 would not come up. Phase 1 is up, so the crypto map is applied correctly.

Trap 2: The ACL on the crypto map is missing the 'permit ip' statement for…

Incorrect. The ACL only needs to match the traffic that will be encrypted; it is not required to permit return traffic explicitly because IPsec uses the same SA for both directions if configured correctly.

Trap 3: The tunnel interface is down due to a routing issue.

Incorrect. The tunnel interface is not used in a crypto map-based VPN; it is a site-to-site VPN using physical interfaces. The tunnel interface is not relevant here.

Study all WAN Technologies common traps →

A
The crypto map is not applied to the correct interface.
Why wrong: Incorrect. If the crypto map were not applied, Phase 1 would not come up. Phase 1 is up, so the crypto map is applied correctly.
B
The IPsec transform set uses ESP with SHA-1, but the remote router expects AES-GCM.
Correct. A mismatch in the transform set (e.g., encryption or authentication algorithms) will prevent Phase 2 from establishing, even though Phase 1 (which uses a different proposal) may succeed.
C
The ACL on the crypto map is missing the 'permit ip' statement for the return traffic.
Why wrong: Incorrect. The ACL only needs to match the traffic that will be encrypted; it is not required to permit return traffic explicitly because IPsec uses the same SA for both directions if configured correctly.
D
The tunnel interface is down due to a routing issue.
Why wrong: Incorrect. The tunnel interface is not used in a crypto map-based VPN; it is a site-to-site VPN using physical interfaces. The tunnel interface is not relevant here.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full VPN explanation →

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

Trap 1: The hub is missing the 'tunnel protection ipsec' command on the…

Incorrect. If tunnel protection were missing, the tunnel would not come up at all. The tunnel is up, so protection is configured.

Trap 2: The spoke's crypto map is not using the correct pre-shared key.

Incorrect. If the pre-shared key were incorrect, Phase 1 would fail, and the tunnel would not come up.

Trap 3: The hub's IKEv2 profile is not configured with 'authentication…

Incorrect. The authentication method must match between peers. If it didn't match, the tunnel would not establish. The tunnel is up, so authentication is successful.

Study all WAN Technologies common traps →

A
The spoke is configured with a static IP address on the tunnel interface that is not in the hub's IP pool.
Correct. In FlexVPN, the hub assigns IP addresses from a pool. If the spoke statically configures an IP address, the hub may not have a route back to that address, causing asymmetric routing or unreachability.
B
The hub is missing the 'tunnel protection ipsec' command on the tunnel interface.
Why wrong: Incorrect. If tunnel protection were missing, the tunnel would not come up at all. The tunnel is up, so protection is configured.
C
The spoke's crypto map is not using the correct pre-shared key.
Why wrong: Incorrect. If the pre-shared key were incorrect, Phase 1 would fail, and the tunnel would not come up.
D
The hub's IKEv2 profile is not configured with 'authentication remote rsa-sig'.
Why wrong: Incorrect. The authentication method must match between peers. If it didn't match, the tunnel would not establish. The tunnel is up, so authentication is successful.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full BGP breakdown →

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

Trap 1: Set a lower MED for routes advertised to ISP A and a higher MED for…

Incorrect. MED is used to influence inbound traffic, but it is a multi-exit discriminator that is only considered when the same AS receives routes from multiple points. In a dual-homed scenario with different ISPs, MED is not typically used because the ISPs are different ASes.

Trap 2: Advertise a more specific prefix (e.g., /25) to ISP A and a less…

Incorrect. Advertising different prefix lengths can cause suboptimal routing and may not be accepted by ISPs. It is not a standard practice for load balancing.

Trap 3: Configure the CE router to use BGP multipath with both ISPs.

Incorrect. BGP multipath allows load balancing of outbound traffic, but it does not influence inbound traffic. The scenario requires different behaviors for inbound and outbound.

Study all WAN Technologies common traps →

A
Set a lower MED for routes advertised to ISP A and a higher MED for routes advertised to ISP B.
Why wrong: Incorrect. MED is used to influence inbound traffic, but it is a multi-exit discriminator that is only considered when the same AS receives routes from multiple points. In a dual-homed scenario with different ISPs, MED is not typically used because the ISPs are different ASes.
B
Use AS path prepending on routes advertised to ISP B and set a higher local preference for routes learned from ISP A.
Correct. AS path prepending makes the path to ISP B longer, discouraging inbound traffic from using it. Setting a higher local preference for routes from ISP A makes outbound traffic prefer ISP A.
C
Advertise a more specific prefix (e.g., /25) to ISP A and a less specific prefix (/24) to ISP B.
Why wrong: Incorrect. Advertising different prefix lengths can cause suboptimal routing and may not be accepted by ISPs. It is not a standard practice for load balancing.
D
Configure the CE router to use BGP multipath with both ISPs.
Why wrong: Incorrect. BGP multipath allows load balancing of outbound traffic, but it does not influence inbound traffic. The scenario requires different behaviors for inbound and outbound.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full MPLS explanation →

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

Trap 1: The voice traffic is using a different DSCP value than the one…

Incorrect. The scenario states that the policy sets the preferred color for voice traffic. If the traffic does not match the policy match criteria, it would not be affected, but the question implies the policy is correctly matching voice traffic.

Trap 2: The MPLS link is not in the 'up' state in the vManage overlay.

Incorrect. The scenario says the MPLS link is up, so this is not the cause.

Trap 3: The policy is configured as a local policy instead of a centralized…

Incorrect. Both centralized and local policies can set preferred color. The issue is more likely related to policy attachment or application order.

Study all WAN Technologies common traps →

A
The policy is not attached to the correct VPN or site list.
Correct. In vManage, policies must be associated with specific VPNs or sites. If the policy is not attached to the VPN that carries voice traffic, it will not be applied.
B
The voice traffic is using a different DSCP value than the one defined in the policy.
Why wrong: Incorrect. The scenario states that the policy sets the preferred color for voice traffic. If the traffic does not match the policy match criteria, it would not be affected, but the question implies the policy is correctly matching voice traffic.
C
The MPLS link is not in the 'up' state in the vManage overlay.
Why wrong: Incorrect. The scenario says the MPLS link is up, so this is not the cause.
D
The policy is configured as a local policy instead of a centralized policy.
Why wrong: Incorrect. Both centralized and local policies can set preferred color. The issue is more likely related to policy attachment or application order.

Full breakdown with real-world context →

Question 7easymultiple choice

Review the full routing breakdown →

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Trap 1: The physical interface is configured with 'no ip address'.

Incorrect. The physical interface does not need an IP address for PPPoE; the dialer interface handles the IP layer.

Trap 2: The default route is pointing to the wrong next-hop IP.

Incorrect. The default route via the dialer interface uses the interface itself as the next hop, not an IP address. This is typical for PPPoE.

Trap 3: The ISP's gateway is not responding to ICMP.

Incorrect. While possible, the most common cause is the missing IP address on the dialer interface. The scenario states the session is established, so the gateway is reachable at Layer 2.

Study all WAN Technologies common traps →

A
The dialer interface does not have an IP address negotiated via IPCP.
Correct. In PPPoE, the ISP typically assigns an IP address via IPCP. If the dialer interface does not receive an IP address, the router cannot communicate with the gateway.
B
The physical interface is configured with 'no ip address'.
Why wrong: Incorrect. The physical interface does not need an IP address for PPPoE; the dialer interface handles the IP layer.
C
The default route is pointing to the wrong next-hop IP.
Why wrong: Incorrect. The default route via the dialer interface uses the interface itself as the next hop, not an IP address. This is typical for PPPoE.
D
The ISP's gateway is not responding to ICMP.
Why wrong: Incorrect. While possible, the most common cause is the missing IP address on the dialer interface. The scenario states the session is established, so the gateway is reachable at Layer 2.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full VPN explanation →

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

Trap 1: The IPsec SA is using a weak encryption algorithm.

Incorrect. The encryption algorithm does not affect anti-replay checks.

Trap 2: The IPsec SA is using ESP in tunnel mode with authentication only.

Incorrect. The mode or authentication does not cause anti-replay failures.

Trap 3: The IPsec SA lifetime is too short, causing frequent rekeying.

Incorrect. Frequent rekeying can cause temporary drops, but it would not cause anti-replay failures specifically.

Study all WAN Technologies common traps →

A
The IPsec SA is using a weak encryption algorithm.
Why wrong: Incorrect. The encryption algorithm does not affect anti-replay checks.
B
The IPsec SA is using ESP in tunnel mode with authentication only.
Why wrong: Incorrect. The mode or authentication does not cause anti-replay failures.
C
The traffic is taking multiple paths, causing packets to arrive out of order.
Correct. Anti-replay checks rely on sequence numbers. If packets arrive out of order, the receiver may drop them if they fall outside the anti-replay window.
D
The IPsec SA lifetime is too short, causing frequent rekeying.
Why wrong: Incorrect. Frequent rekeying can cause temporary drops, but it would not cause anti-replay failures specifically.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full routing breakdown →

A company is implementing a WAN optimization solution using Cisco WAAS. The engineer configures WAAS devices at the data center and remote branch. The WAAS devices are configured to use inline mode. However, the engineer notices that optimized traffic is not being intercepted. The WAAS devices are directly connected to the WAN router and the LAN switch. What is the most likely cause?

Trap 1: The WAAS device is not configured with the correct WAN and LAN…

Incorrect. In inline mode, the WAAS device must have the correct interfaces configured, but the most common issue is the lack of redirection from the router.

Trap 2: The WAAS device is not licensed for optimization.

Incorrect. Licensing issues would prevent optimization, but the traffic would still be intercepted and passed through.

Trap 3: The WAAS device is using a different subnet than the LAN and WAN.

Incorrect. The WAAS device can be on a different subnet as long as routing is correct, but the redirection is the key.

Study all WAN Technologies common traps →

A
The WAAS device is not configured with the correct WAN and LAN interfaces.
Why wrong: Incorrect. In inline mode, the WAAS device must have the correct interfaces configured, but the most common issue is the lack of redirection from the router.
B
The WAN router is not configured with WCCP or PBR to redirect traffic to the WAAS device.
Correct. Without WCCP or PBR, the WAN router will forward traffic directly, bypassing the WAAS device.
C
The WAAS device is not licensed for optimization.
Why wrong: Incorrect. Licensing issues would prevent optimization, but the traffic would still be intercepted and passed through.
D
The WAAS device is using a different subnet than the LAN and WAN.
Why wrong: Incorrect. The WAAS device can be on a different subnet as long as routing is correct, but the redirection is the key.

Full breakdown with real-world context →

Question 10mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show ip route 10.1.1.0

Routing entry for 10.1.1.0/24 Known via "bgp 65001", distance 200, metric 0 Tag 65002, type external Last update from 192.168.1.2 00:00:15 ago Routing Descriptor Blocks:

* 192.168.1.2, from 192.168.1.2, 00:00:15 ago

Route metric is 0, traffic share count is 1 AS Hops 1 Route tag 65002 MPLS label: 18

Based on this output, what can be concluded?

Trap 1: The route is learned via OSPF and tagged with an MPLS label.

The route is learned via BGP, not OSPF.

Trap 2: The route is a directly connected interface with an MPLS label.

The route is not directly connected; it is learned via BGP.

Trap 3: The route is a static route with an MPLS label.

The route is learned via BGP, not static.

Study all WAN Technologies common traps →

A
The route is learned via OSPF and tagged with an MPLS label.
Why wrong: The route is learned via BGP, not OSPF.
B
The route is learned via BGP and has an MPLS label assigned, indicating MPLS forwarding.
The output clearly shows 'Known via bgp 65001' and 'MPLS label: 18', confirming BGP learned route with MPLS label.
C
The route is a directly connected interface with an MPLS label.
Why wrong: The route is not directly connected; it is learned via BGP.
D
The route is a static route with an MPLS label.
Why wrong: The route is learned via BGP, not static.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full MPLS explanation →

A network engineer executes the following command on Router R2:

R2# show mpls ldp neighbor

Peer LDP Ident: 192.168.1.1:0; Local LDP Ident 192.168.1.2:0 TCP connection: 192.168.1.1.646 - 192.168.1.2.54321 State: Oper; Msgs sent/rcvd: 1234/1234; Downstream Up time: 2d04h LDP discovery sources: GigabitEthernet0/0, Src IP addr: 192.168.1.1 holdtime: 15000 ms, hello interval: 5000 ms Addresses bound to peer LDP Ident:

192.168.1.1        10.0.0.1

Based on this output, what is true about the LDP session?

Trap 1: The LDP session is down because the state is 'Oper'.

'Oper' means operational, not down.

Trap 2: The LDP session is using UDP port 646 for the TCP connection.

LDP uses TCP port 646; the output shows TCP connection, not UDP.

Trap 3: The LDP session is using the default hello interval of 5000 ms.

The hello interval is 5000 ms but it is not necessarily default; however, the question asks what is true, and the holdtime is explicitly correct.

Study all WAN Technologies common traps →

A
The LDP session is down because the state is 'Oper'.
Why wrong: 'Oper' means operational, not down.
B
The LDP session is using UDP port 646 for the TCP connection.
Why wrong: LDP uses TCP port 646; the output shows TCP connection, not UDP.
C
The LDP session is operational and the holdtime is 15000 ms.
The state is 'Oper' and holdtime is explicitly shown as 15000 ms.
D
The LDP session is using the default hello interval of 5000 ms.
Why wrong: The hello interval is 5000 ms but it is not necessarily default; however, the question asks what is true, and the holdtime is explicitly correct.

Full breakdown with real-world context →

Question 12mediummultiple choice

Open the full BGP breakdown →

A network engineer issues the following command on Router R3:

R3# show ip bgp summary

BGP router identifier 10.0.0.3, local AS number 65003 BGP table version is 12345, main routing table version 12345

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65001   12345   12345    12345    0    0 1w2d        150
192.168.1.2     4        65002   12345   12345    12345    0    0 2w0d        200

Based on this output, what can be concluded?

Trap 1: Both BGP neighbors are in the 'Idle' state.

The State/PfxRcd column shows numbers (150, 200), which means the session is established and prefixes are received.

Trap 2: The BGP session with 192.168.1.1 is down.

The presence of 150 prefixes indicates the session is up.

Trap 3: Router R3 is in AS 65001.

The local AS number is 65003, not 65001.

Study all WAN Technologies common traps →

A
Both BGP neighbors are in the 'Idle' state.
Why wrong: The State/PfxRcd column shows numbers (150, 200), which means the session is established and prefixes are received.
B
Router R3 has received a total of 350 prefixes from its BGP neighbors.
150 + 200 = 350 prefixes received.
C
The BGP session with 192.168.1.1 is down.
Why wrong: The presence of 150 prefixes indicates the session is up.
D
Router R3 is in AS 65001.
Why wrong: The local AS number is 65003, not 65001.

Full breakdown with real-world context →

Question 13mediummultiple choice

Study the full multicast explanation →

A network engineer runs the following command on Router R4:

R4# show interfaces tunnel 0

Tunnel0 is up, line protocol is up Hardware is Tunnel Internet address is 10.0.0.4/30 MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set Tunnel source 192.168.1.4, destination 192.168.2.4 Tunnel protocol/transport GRE/IP Key disabled, sequencing disabled Checksumming of packets disabled Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out

Based on this output, what is true about this tunnel?

Trap 1: The tunnel is using IPsec encryption.

The encapsulation is GRE/IP, not IPsec.

Trap 2: The tunnel is using MPLS over GRE.

No MPLS is indicated; it is plain GRE.

Trap 3: The tunnel is down because there are no packets.

The tunnel is up/up; lack of traffic does not mean it is down.

Study all WAN Technologies common traps →

A
The tunnel is using IPsec encryption.
Why wrong: The encapsulation is GRE/IP, not IPsec.
B
The tunnel is a GRE tunnel that is up and operational.
The interface is up/up and protocol is GRE/IP.
C
The tunnel is using MPLS over GRE.
Why wrong: No MPLS is indicated; it is plain GRE.
D
The tunnel is down because there are no packets.
Why wrong: The tunnel is up/up; lack of traffic does not mean it is down.

Full breakdown with real-world context →

Question 14hardmultiple choice

Review the full OSPF breakdown →

A network engineer executes the following command on Router R5:

R5# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.6         1   FULL/DR         00:00:35    192.168.1.6    GigabitEthernet0/0
10.0.0.7         1   FULL/BDR        00:00:32    192.168.1.7    GigabitEthernet0/0
10.0.0.8         1   2WAY/DROTHER    00:00:38    192.168.1.8    GigabitEthernet0/0

Based on this output, what can be concluded about the OSPF network?

Trap 1: The OSPF network type is point-to-point.

Point-to-point networks do not have DR/BDR; they show FULL state without DR/BDR.

Trap 2: Router R5 is the DR on this segment.

The output does not show R5's own state; it shows neighbors. R5 could be DR, BDR, or DROTHER. The neighbor with state FULL/DR is 10.0.0.6, indicating that 10.0.0.6 is the DR.

Trap 3: All neighbors are in the FULL state.

One neighbor is in 2WAY state, not FULL.

Study all WAN Technologies common traps →

A
The OSPF network type is point-to-point.
Why wrong: Point-to-point networks do not have DR/BDR; they show FULL state without DR/BDR.
B
Router R5 is the DR on this segment.
Why wrong: The output does not show R5's own state; it shows neighbors. R5 could be DR, BDR, or DROTHER. The neighbor with state FULL/DR is 10.0.0.6, indicating that 10.0.0.6 is the DR.
C
The OSPF network type is broadcast.
The presence of DR, BDR, and DROTHER states is characteristic of a broadcast multiaccess network.
D
All neighbors are in the FULL state.
Why wrong: One neighbor is in 2WAY state, not FULL.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full NAT/PAT explanation →

A network engineer issues the following command on Router R6:

R6# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.168.1.100 10.0.0.10 --- --- --- 192.168.1.101 10.0.0.11 --- --- udp 192.168.1.100:1234 10.0.0.10:1234 203.0.113.5:53 203.0.113.5:53 tcp 192.168.1.101:80 10.0.0.11:80 198.51.100.2:443 198.51.100.2:443

Based on this output, what is true about the NAT translations?

Trap 1: All translations are static NAT entries.

Static NAT would show a consistent mapping; here we see dynamic translations with ports.

Trap 2: The router is performing only PAT (overload).

Both dynamic NAT and PAT are present.

Trap 3: The outside global address is the same for all translations.

Outside global addresses differ (203.0.113.5 and 198.51.100.2).

Study all WAN Technologies common traps →

A
All translations are static NAT entries.
Why wrong: Static NAT would show a consistent mapping; here we see dynamic translations with ports.
B
The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.
The first two entries have no protocol or port, indicating a simple one-to-one dynamic NAT. The later entries show PAT with ports.
C
The router is performing only PAT (overload).
Why wrong: Both dynamic NAT and PAT are present.
D
The outside global address is the same for all translations.
Why wrong: Outside global addresses differ (203.0.113.5 and 198.51.100.2).

Full breakdown with real-world context →

Question 16mediummultiple choice

Study the full IPv6 explanation →

A network engineer runs the following command on Router R7:

R7# show vrf brief

Name Default RD Protocols Interfaces Mgmt-intf <not set> ipv4,ipv6 GigabitEthernet0/0 CUSTOMER-A 65001:100 ipv4 GigabitEthernet0/1.10 CUSTOMER-B 65001:200 ipv4 GigabitEthernet0/1.20

Based on this output, what can be concluded?

Trap 1: VRF CUSTOMER-A is using IPv6.

The protocols column shows only ipv4 for CUSTOMER-A.

Trap 2: VRF Mgmt-intf has a route distinguisher set.

The Default RD for Mgmt-intf is '<not set>'.

Trap 3: All VRFs are using the same route distinguisher.

Each VRF has a different RD.

Study all WAN Technologies common traps →

A
VRF CUSTOMER-A is using IPv6.
Why wrong: The protocols column shows only ipv4 for CUSTOMER-A.
B
VRF Mgmt-intf has a route distinguisher set.
Why wrong: The Default RD for Mgmt-intf is '<not set>'.
C
VRF CUSTOMER-B is associated with subinterface GigabitEthernet0/1.20.
The output shows CUSTOMER-B with interface GigabitEthernet0/1.20.
D
All VRFs are using the same route distinguisher.
Why wrong: Each VRF has a different RD.

Full breakdown with real-world context →

Question 17hardmultiple choice

Review the full routing breakdown →

A network engineer issues the following command on Router R8:

R8# show policy-map interface gigabitethernet 0/1

GigabitEthernet0/1

Service-policy output: SHAPE-1M Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any queue limit 64 packets (queue depth 0) (congestion occurrences) shape (average) cir 1000000, bc 10000, be 10000 target shape rate 1000000

Based on this output, what is true about the traffic shaping policy?

Trap 1: The policy is policing traffic to 1 Mbps.

The output shows 'shape (average)', not police.

Trap 2: The policy is dropping all traffic because the queue is full.

The queue depth is 0, and drop rate is 0 bps.

Trap 3: The policy is applied in the input direction.

The output says 'Service-policy output: SHAPE-1M', so it is output direction.

Study all WAN Technologies common traps →

A
The policy is policing traffic to 1 Mbps.
Why wrong: The output shows 'shape (average)', not police.
B
The policy is shaping traffic to an average rate of 1 Mbps.
The command 'shape (average) cir 1000000' indicates shaping to 1 Mbps.
C
The policy is dropping all traffic because the queue is full.
Why wrong: The queue depth is 0, and drop rate is 0 bps.
D
The policy is applied in the input direction.
Why wrong: The output says 'Service-policy output: SHAPE-1M', so it is output direction.

Full breakdown with real-world context →

Question 18mediummultiple choice

Study the full multicast explanation →

A network engineer runs the following command on Router R9:

R9# show ip pim neighbor

PIM Neighbor Table

Neighbor Address     Interface          Uptime    Expires    Mode
192.168.1.10         GigabitEthernet0/0 1w2d      00:01:30   Dense
192.168.1.11         GigabitEthernet0/0 2w0d      00:01:25   Sparse
192.168.1.12         GigabitEthernet0/1 3d04h     00:01:28   Sparse

Based on this output, what can be concluded?

Trap 1: All PIM neighbors are operating in Sparse mode.

One neighbor is in Dense mode.

Trap 2: The PIM neighbor 192.168.1.12 is on the same interface as the…

192.168.1.12 is on GigabitEthernet0/1, while the others are on GigabitEthernet0/0.

Trap 3: All PIM neighbors are in the 'Expires' state.

The Expires column shows remaining time, not a state.

Study all WAN Technologies common traps →

A
All PIM neighbors are operating in Sparse mode.
Why wrong: One neighbor is in Dense mode.
B
Router R9 has three PIM neighbors, one in Dense mode and two in Sparse mode.
The output lists three neighbors with modes: Dense, Sparse, Sparse.
C
The PIM neighbor 192.168.1.12 is on the same interface as the others.
Why wrong: 192.168.1.12 is on GigabitEthernet0/1, while the others are on GigabitEthernet0/0.
D
All PIM neighbors are in the 'Expires' state.
Why wrong: The Expires column shows remaining time, not a state.

Full breakdown with real-world context →

Question 19mediummultiple choice

Review the full OSPF breakdown →

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Trap 1: OSPF will use a 30-second hello interval and elect a DR/BDR.

Incorrect. The point-to-point network type uses a 10-second hello interval, not 30, and does not elect DR/BDR.

Trap 2: OSPF will use a 10-second hello interval but still elect a DR/BDR.

Incorrect. Point-to-point network type disables DR/BDR election.

Trap 3: OSPF will use a 30-second hello interval and suppress DR/BDR…

Incorrect. The hello interval is 10 seconds, not 30, for point-to-point.

Study all WAN Technologies common traps →

A
OSPF will use a 10-second hello interval and suppress DR/BDR election.
Correct. The point-to-point network type eliminates DR/BDR and uses a 10-second hello interval by default; the explicit command is redundant but confirms the behavior.
B
OSPF will use a 30-second hello interval and elect a DR/BDR.
Why wrong: Incorrect. The point-to-point network type uses a 10-second hello interval, not 30, and does not elect DR/BDR.
C
OSPF will use a 10-second hello interval but still elect a DR/BDR.
Why wrong: Incorrect. Point-to-point network type disables DR/BDR election.
D
OSPF will use a 30-second hello interval and suppress DR/BDR election.
Why wrong: Incorrect. The hello interval is 10 seconds, not 30, for point-to-point.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full VPN explanation →

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 tunnel mode ipsec ipv4 !

crypto isakmp policy 10

authentication pre-share encryption aes 256 hash sha group 14 lifetime 86400 !

crypto isakmp key cisco123 address 203.0.113.2

crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac

mode tunnel !

crypto map CMAP 10 ipsec-isakmp

set peer 203.0.113.2 set transform-set TSET match address 100 !

interface GigabitEthernet0/0
 crypto map CMAP

access-list 100 permit ip 10.0.0.0 0.0.0.3 10.0.0.4 0.0.0.3

What is the effect of this configuration?

Trap 1: The configuration will fail because the crypto map must be applied…

Incorrect. For IPsec VTI, the crypto map is applied to the physical interface to protect the tunnel.

Trap 2: The configuration will only encrypt traffic from 10.0.0.0/30 to…

Incorrect. The ACL is symmetric and will match traffic in both directions.

Trap 3: The configuration uses IKEv2 because of the transform-set and…

Incorrect. The crypto isakmp policy indicates IKEv1; IKEv2 uses 'crypto ikev2' commands.

Study all WAN Technologies common traps →

A
The configuration creates an IPsec VTI that encrypts traffic between the two tunnel endpoints.
Correct. The tunnel mode ipsec ipv4 and crypto map create a secure tunnel, and the ACL matches the tunnel subnets.
B
The configuration will fail because the crypto map must be applied to the tunnel interface, not the physical interface.
Why wrong: Incorrect. For IPsec VTI, the crypto map is applied to the physical interface to protect the tunnel.
C
The configuration will only encrypt traffic from 10.0.0.0/30 to 10.0.0.4/30, but not the reverse.
Why wrong: Incorrect. The ACL is symmetric and will match traffic in both directions.
D
The configuration uses IKEv2 because of the transform-set and crypto map.
Why wrong: Incorrect. The crypto isakmp policy indicates IKEv1; IKEv2 uses 'crypto ikev2' commands.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused WAN Technologies sessions

Start a WAN Technologies only practice session

Every question in these sessions is drawn from the WAN Technologies domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all WAN Technologies questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about WAN Technologies?: WAN Technologies questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just WAN Technologies questions in a focused session?: Yes — the session launcher on this page draws every question from the WAN Technologies domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

WAN Technologies only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions WAN Technologies domain overview 350-401 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

WAN Technologies practice questions

What to know about WAN Technologies

Common WAN Technologies exam traps

WAN Technologies questions

Track your progress over time

Start a WAN Technologies only practice session

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid