Sample questions
Cisco CCNP ENARSI 300-410 practice questions
Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.
Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.
Drag and drop the steps to verify and validate the operational state of an IPsec site-to-site VPN into the correct order, from first to last.
Consider the following configuration snippet:
ip cef
!
interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252
mpls ip !
interface GigabitEthernet0/1 ip address 10.0.1.1 255.255.255.252
mpls ip !
router ospf 1 network 10.0.0.0 0.0.0.3 area 0 network 10.0.1.0 0.0.0.3 area 0
! mpls ldp router-id Loopback0 force !
interface Loopback0 ip address 192.168.0.1 255.255.255.255
What will happen when this router attempts to establish an LDP session with a neighbor on GigabitEthernet0/0?
Trap 1: LDP will use the IP address of GigabitEthernet0/0 as the transport…
Loopback0 is advertised via OSPF because the network command includes 10.0.0.0/0.0.0.3, but the loopback is 192.168.0.1/32, which is not covered. Actually, the loopback is not in OSPF, so the neighbor may not have a route to it, causing LDP session failure. This is a subtle issue.
Trap 2: LDP will not use Loopback0 because the interface is not configured…
The LDP router ID does not require 'mpls ip' on the loopback; it is only a transport address.
Trap 3: LDP will use the IP address of GigabitEthernet0/1 because it has…
The 'force' keyword overrides automatic selection; LDP will use Loopback0 regardless.
- A
LDP will use the IP address of GigabitEthernet0/0 as the transport address because Loopback0 is not in OSPF.
Why wrong: Loopback0 is advertised via OSPF because the network command includes 10.0.0.0/0.0.0.3, but the loopback is 192.168.0.1/32, which is not covered. Actually, the loopback is not in OSPF, so the neighbor may not have a route to it, causing LDP session failure. This is a subtle issue.
- B
LDP will use Loopback0 (192.168.0.1) as the transport address, but the neighbor must have a route to 192.168.0.1 for the session to establish.
The 'force' keyword sets the LDP router ID to Loopback0. However, the loopback is not included in the OSPF network statements, so the neighbor may not have reachability to 192.168.0.1, causing LDP session failure. This is a common misconfiguration.
- C
LDP will not use Loopback0 because the interface is not configured with 'mpls ip'.
Why wrong: The LDP router ID does not require 'mpls ip' on the loopback; it is only a transport address.
- D
LDP will use the IP address of GigabitEthernet0/1 because it has the highest IP among MPLS-enabled interfaces.
Why wrong: The 'force' keyword overrides automatic selection; LDP will use Loopback0 regardless.
A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?
Trap 1: The syslog server is dropping severity 6 messages due to its own…
Incorrect because the question states the router is not sending them; the server cannot drop what it never receives.
Trap 2: The 'logging console' command is overriding the remote logging…
Incorrect because 'logging console' controls console output, not remote syslog.
Trap 3: The router's clock is not synchronized, causing timestamp issues.
Incorrect because clock synchronization affects timestamps but does not filter messages by severity.
- A
The 'logging trap' command is set to 5 (notice) rather than 6 (informational).
Correct because if the trap level is 5, only messages severity 0-5 are sent; severity 6 messages are excluded.
- B
The syslog server is dropping severity 6 messages due to its own configuration.
Why wrong: Incorrect because the question states the router is not sending them; the server cannot drop what it never receives.
- C
The 'logging console' command is overriding the remote logging level.
Why wrong: Incorrect because 'logging console' controls console output, not remote syslog.
- D
The router's clock is not synchronized, causing timestamp issues.
Why wrong: Incorrect because clock synchronization affects timestamps but does not filter messages by severity.
Drag and drop the steps to configure a GRE tunnel for IPv6 over IPv4 into the correct order, from first to last.
Trap 1: Configure tunnel mode as 'tunnel mode gre ipv6'
This option is incorrect. The proper command to encapsulate IPv6 over IPv4 is 'tunnel mode gre ip', not 'tunnel mode gre ipv6'.
- E
Configure tunnel mode as 'tunnel mode gre ipv6'
Why wrong: This option is incorrect. The proper command to encapsulate IPv6 over IPv4 is 'tunnel mode gre ip', not 'tunnel mode gre ipv6'.
Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.
Drag and drop the steps to verify and validate the operational state of an IPv6 tunneling technique into the correct order, from first to last.
Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.
Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.
Drag and drop the steps to verify and validate Device Access Control operational state into the correct order, from first to last.
Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.
Drag and drop the steps to apply and verify an extended IPv4 ACL on a router interface into the correct order, from first to last.
Drag and drop the steps to verify and validate the operational state of IPv4 ACLs into the correct order, from first to last.
A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?
Trap 1: The ACL is applied outbound on R1 and blocks the echo request.
Incorrect because the ACL is applied inbound, not outbound.
Trap 2: IPv6 unicast-routing is not enabled on R1.
Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.
Trap 3: The ACL is missing a permit statement for IPv6 neighbor discovery…
Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).
- A
The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.
Correct because ICMPv6 echo replies are sourced from the destination address (R2) and must be permitted inbound on R1 for the ping to succeed.
- B
The ACL is applied outbound on R1 and blocks the echo request.
Why wrong: Incorrect because the ACL is applied inbound, not outbound.
- C
IPv6 unicast-routing is not enabled on R1.
Why wrong: Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.
- D
The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.
Why wrong: Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).
A network engineer runs the following command to verify DHCPv4 server statistics on router R1:
R1# show ip dhcp server statistics
Output: Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 150 Manual bindings: 5 Expired bindings: 10 Malformed messages: 0
Message Received
BOOTREQUEST 0
DHCPDISCOVER 200 DHCPREQUEST 180 DHCPDECLINE 2 DHCPRELEASE 5 DHCPINFORM 10
What does this output indicate?
Trap 1: The DHCP server has received 200 DHCPREQUEST messages.
The output shows 180 DHCPREQUEST messages received, not 200.
Trap 2: The DHCP server has 10 malformed messages, indicating a…
Malformed messages are 0, so no malformed messages were received.
Trap 3: The DHCP server has 2 database agents configured.
Database agents are 0, meaning no external database is used for lease storage.
- A
The DHCP server has 150 active automatic bindings and 5 manual bindings.
The output shows 'Automatic bindings: 150' and 'Manual bindings: 5', indicating the number of active leases.
- B
The DHCP server has received 200 DHCPREQUEST messages.
Why wrong: The output shows 180 DHCPREQUEST messages received, not 200.
- C
The DHCP server has 10 malformed messages, indicating a configuration issue.
Why wrong: Malformed messages are 0, so no malformed messages were received.
- D
The DHCP server has 2 database agents configured.
Why wrong: Database agents are 0, meaning no external database is used for lease storage.
A network engineer runs the following command to verify IPv6 uRPF operation:
R1# show ipv6 interface GigabitEthernet0/0 | include verify
IPv6 verify source: strict
What does this output indicate?
Trap 1: Strict uRPF is enabled, but it only checks if the source address is…
Incorrect. Strict uRPF checks both the route and the interface; loose uRPF only checks the route.
Trap 2: Loose uRPF is enabled, which only checks if the source address is…
Incorrect. The output explicitly says 'strict'.
Trap 3: uRPF is disabled on this interface.
Incorrect. The output shows it is enabled with strict mode.
- A
Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.
Correct. Strict uRPF requires both a matching route and that the interface used to reach the source is the same as the receiving interface.
- B
Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.
Why wrong: Incorrect. Strict uRPF checks both the route and the interface; loose uRPF only checks the route.
- C
Loose uRPF is enabled, which only checks if the source address is in the routing table.
Why wrong: Incorrect. The output explicitly says 'strict'.
- D
uRPF is disabled on this interface.
Why wrong: Incorrect. The output shows it is enabled with strict mode.
A network engineer runs the following command to debug IPv6 uRPF with detailed information:
R1# debug ipv6 verify detail
IPv6 verify debugging is on (detail)
*Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0 *Mar 1 00:03:45.678: route to source via GigabitEthernet0/1, not same as input interface
What does this output indicate?
Trap 1: The packet will be forwarded because a route exists.
Incorrect. Strict uRPF also checks the interface.
Trap 2: The packet will be forwarded because uRPF is loose.
Incorrect. The debug does not specify loose; strict is implied by interface check.
Trap 3: The router will change the route to use GigabitEthernet0/0.
Incorrect. uRPF does not modify routing.
- A
The packet will be dropped because strict uRPF requires the return path to be through the same interface.
Correct. Strict uRPF checks that the best route to the source uses the same interface as the packet arrived on.
- B
The packet will be forwarded because a route exists.
Why wrong: Incorrect. Strict uRPF also checks the interface.
- C
The packet will be forwarded because uRPF is loose.
Why wrong: Incorrect. The debug does not specify loose; strict is implied by interface check.
- D
The router will change the route to use GigabitEthernet0/0.
Why wrong: Incorrect. uRPF does not modify routing.
What is the default administrative distance for IPv6 static routes in Cisco IOS-XE?
Trap 1: 0
0 is reserved for directly connected routes.
Trap 2: 5
5 is not a standard AD for static routes.
Trap 3: 20
20 is the default AD for EIGRP.
- A
0
Why wrong: 0 is reserved for directly connected routes.
- B
1
IPv6 static routes have a default AD of 1.
- C
5
Why wrong: 5 is not a standard AD for static routes.
- D
20
Why wrong: 20 is the default AD for EIGRP.
Drag and drop the steps to configure uRPF in strict mode on an edge router into the correct order, from first to last.
What is the default hello interval for OSPFv3 on a broadcast network type in Cisco IOS-XE?
Trap 1: 30 seconds
30 seconds is the default for EIGRP.
Trap 2: 40 seconds
40 seconds is the default dead interval for OSPF on broadcast networks.
Trap 3: 5 seconds
5 seconds is not a default OSPF timer.
- A
10 seconds
Default hello interval for OSPFv3 on broadcast networks is 10 seconds.
- B
30 seconds
Why wrong: 30 seconds is the default for EIGRP.
- C
40 seconds
Why wrong: 40 seconds is the default dead interval for OSPF on broadcast networks.
- D
5 seconds
Why wrong: 5 seconds is not a default OSPF timer.
Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?
Trap 1: deny ipv6 2001:db8:1::/48 any
This denies traffic from the specified source to any destination, which is the opposite of what is asked.
Trap 2: deny ipv6 any host 2001:db8:1::1
This denies traffic to a single host, not the /48 prefix.
Trap 3: deny ipv6 2001:db8:1::/48 2001:db8:1::/48
This denies traffic from the prefix to itself, which is not the intended behavior.
- A
deny ipv6 any 2001:db8:1::/48
This correctly denies all IPv6 traffic from any source to the specified destination prefix.
- B
deny ipv6 2001:db8:1::/48 any
Why wrong: This denies traffic from the specified source to any destination, which is the opposite of what is asked.
- C
deny ipv6 any host 2001:db8:1::1
Why wrong: This denies traffic to a single host, not the /48 prefix.
- D
deny ipv6 2001:db8:1::/48 2001:db8:1::/48
Why wrong: This denies traffic from the prefix to itself, which is not the intended behavior.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.