Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1126–1200

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 15

Page 16 of 27

Page 17
1126
MCQmedium

A network engineer runs the following command on Router R1: R1# show bfd neighbors detail IPv4 Sessions NeighborAddr LD/RD Int State Holdown(mult) Intf 10.1.1.2 1/3 Gi0/0 Up 3000(3) Gi0/0 Session state is UP and using echo function. OurAddr: 10.1.1.1 Handle: 1 Local Diag: 0, Demand mode: 0, Poll bit: 0 MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3 Received MinRxInt: 1000000, Received Multiplier: 3 Holddown (hits): 3000(0) Rx Count: 150, Tx Count: 150 Echo function: Active Based on this output, which statement is correct?

A.The BFD session is using echo mode, which reduces the load on the control plane because echo packets are processed in hardware.
B.The BFD session is using echo mode, but the holddown timer is incorrect because echo mode should halve the timer.
C.The BFD session is up, but the echo function is not working because Rx and Tx counts are equal.
D.The BFD session is up and using echo function, but the neighbor must also have echo mode enabled for it to work.
AnswerA

Echo mode offloads detection to the data plane, reducing control plane processing.

Why this answer

The output shows that the BFD session is up and using echo function. The echo function allows faster failure detection by sending echo packets that are looped back by the neighbor. The holddown timer is 3000 ms, which is consistent with MinRxInt * Multiplier = 3000 ms.

The Rx and Tx counts are equal, indicating bidirectional communication.

Full explanation →
1127
MCQmedium

Router R4 has the following configuration: !--- R4 configuration route-map SETTAG permit 10 match tag 100 set tag 200 ! route-map SETTAG permit 20 ! router bgp 65100 neighbor 10.0.0.1 route-map SETTAG in ! What is the effect of this configuration?

A.All routes from neighbor 10.0.0.1 are permitted; routes with tag 100 have their tag changed to 200.
B.Routes with tag 100 are denied; all other routes are permitted.
C.Only routes with tag 100 are permitted; all other routes are denied.
D.The route-map is misconfigured because sequence 20 has no match statement; it should have a match any statement.
AnswerA

Correct. Sequence 10 changes the tag for routes with tag 100; sequence 20 permits all others.

Why this answer

The route-map SETTAG has two permit sequences. Sequence 10 matches routes with tag 100 and sets the tag to 200. Sequence 20 is a catch-all permit with no match or set statements.

Routes from neighbor 10.0.0.1 that have tag 100 will have their tag changed to 200; all other routes are permitted unchanged. No routes are filtered.

Full explanation →
1128
MCQeasy

A network engineer runs the following command on Router R1: R1# show route-map TEST route-map TEST, permit, sequence 10 Match clauses: ip address (access-lists): 10 Set clauses: metric 50 route-map TEST, deny, sequence 20 Match clauses: ip address (access-lists): 20 Set clauses: Based on this output, what is the effect of this route-map when applied to a redistribution command?

A.All routes are redistributed with metric 50.
B.Routes matching ACL 10 are redistributed with metric 50; routes matching ACL 20 are denied; all other routes are also denied.
C.Routes matching ACL 20 are redistributed with default metric.
D.The route-map has no effect because set clauses are missing in sequence 20.
AnswerB

This matches the route-map logic.

Why this answer

Route-map TEST processes sequences in order. Sequence 10 permits routes matching ACL 10 and sets their metric to 50. Sequence 20 denies routes matching ACL 20.

Since there is no explicit permit for other routes, the implicit deny at the end of the route-map denies all unmatched routes. Thus, only routes matching ACL 10 are redistributed with metric 50.

Exam trap

Cisco often tests the implicit deny at the end of a route-map, leading candidates to forget that unmatched routes are denied, not permitted with default values.

How to eliminate wrong answers

Option A is wrong because not all routes are redistributed with metric 50; only routes matching ACL 10 are permitted and get metric 50, while routes matching ACL 20 are denied and all other routes are implicitly denied. Option C is wrong because routes matching ACL 20 are denied (sequence 20 is deny), not redistributed with any metric. Option D is wrong because a missing set clause in a deny sequence does not affect the route-map's operation; the deny action is still applied, and the implicit deny at the end handles unmatched routes.

Full explanation →
1129
Multi-Selectmedium

Which TWO configuration steps are required to enable EIGRP authentication between two directly connected routers? (Choose TWO.)

Select 2 answers
A.Configure a key chain with a key string on both routers.
B.Apply the authentication mode and key chain under the EIGRP router process.
C.Use the 'ip authentication mode eigrp <as> md5' command on the connecting interfaces.
D.Set the same autonomous system number in the key chain configuration.
E.Ensure the key chain name is different on each router to prevent conflicts.
AnswersA, C

The key chain defines the authentication key; it must be created globally with at least one key and a key string.

Why this answer

EIGRP authentication requires a key chain to be configured on both routers, which defines the key string (the actual password) used for authentication. Without a matching key string in the key chain, the authentication process will fail, as the routers cannot validate each other's EIGRP packets.

Exam trap

Cisco often tests the misconception that EIGRP authentication is configured under the router process (like OSPF) rather than on the interface, leading candidates to incorrectly select Option B.

Full explanation →
1130
MCQhard

What is the default number of packets sent per IP SLA UDP Jitter operation?

A.1
B.10
C.20
D.100
AnswerB

Correct. The default is 10 packets per operation.

Why this answer

The default number of packets per UDP Jitter operation is 10. This is the number of UDP packets sent in each probe interval to measure jitter and packet loss.

Full explanation →
1131
MCQmedium

A network engineer runs the following command on Router R1: R1# show crypto ipsec sa peer 10.1.1.2 interface: Tunnel0 Crypto map tag: VPN-MAP, local addr 10.1.1.1 protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0 Based on this output, what is the problem?

A.The tunnel is working correctly; all packets are being encrypted and decrypted.
B.The remote peer is not sending traffic back; check routing on the remote router.
C.The local crypto ACL is misconfigured; it is not matching traffic.
D.The IPsec SA is not established; the tunnel is down.
AnswerB

Outbound packets are being sent but none received; the remote side may not have a route back or the crypto ACL is misconfigured.

Why this answer

The outbound packet count (encaps) is 100, but inbound (decaps) is 0. This suggests that traffic is being sent through the tunnel but no responses are being received, possibly due to a routing issue on the remote side or a firewall blocking return traffic.

Full explanation →
1132
MCQhard

A network engineer runs the following command on Router R1: R1# show ip bgp neighbors 10.1.1.1 advertised-routes BGP table version is 10, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/8 0.0.0.0 0 32768 i *> 10.1.0.0/16 0.0.0.0 0 32768 i *> 10.1.1.0/24 0.0.0.0 0 32768 i *> 10.1.2.0/24 0.0.0.0 0 32768 i Based on this output, what is a problem with the BGP advertisements?

A.The router is not advertising any routes.
B.The router is advertising overlapping prefixes, including both summary and specific routes.
C.The router is only advertising the summary route.
D.The router is using incorrect next-hop.
AnswerB

The presence of 10.0.0.0/8 and more specific prefixes like 10.1.1.0/24 indicates overlapping advertisements, which is inefficient.

Why this answer

The router is advertising both a summary route (10.0.0.0/8) and more specific routes (10.1.0.0/16, 10.1.1.0/24, etc.), which defeats the purpose of summarization and can cause routing loops or suboptimal routing.

Full explanation →
1133
MCQmedium

A network engineer is troubleshooting MPLS LDP where the LDP session between two directly connected routers is not forming. The engineer runs show mpls ldp discovery and sees that LDP hellos are being sent and received on the link. However, show mpls ldp neighbor shows no neighbors. What is the most likely cause?

A.The LDP router-id is not reachable via the IGP.
B.The mpls label protocol ldp command is missing globally.
C.The interface is configured with mpls ldp igp sync.
D.The LDP session is using a non-default transport address.
AnswerA

Correct because LDP uses TCP to establish the session, and the router-id must be reachable; if the IGP does not have a route to the peer's LDP router-id, the TCP connection fails.

Why this answer

LDP hellos are exchanged, but the session does not form, indicating a problem with the transport connection. The most common cause is that the routers cannot establish a TCP connection to the LDP transport address, often due to a missing route to the LDP router-id or an ACL blocking TCP port 646.

Full explanation →
1134
MCQmedium

A network engineer runs the following command to troubleshoot a Flexible NetFlow issue: R1# show flow monitor FLOW-MONITOR-1 cache format table Cache type: Normal Cache size: 1000 Current entries: 25 High Watermark: 50 Flows added: 1234 Flows aged: 1209 - Active timeout ( 1800 secs): 100 - Inactive timeout ( 15 secs): 1100 - Event aged: 9 - Watermark aged: 0 - Emergency aged: 0 What does the output indicate?

A.The cache is experiencing watermark aging, indicating memory pressure.
B.Most flows are being aged due to the active timeout, suggesting long-lived flows.
C.The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.
D.Emergency aging is occurring, which means the cache is full.
AnswerC

1100 out of 1209 aged flows are due to inactive timeout, which is typical for short-lived traffic like DNS or web requests.

Why this answer

The output shows the current state of the Flexible NetFlow cache. The high number of flows aged due to inactive timeout (1100 out of 1209) indicates that most flows are short-lived. The cache is not full (25 out of 1000 entries used), and no watermark or emergency aging has occurred.

This is normal for traffic with many brief connections.

Full explanation →
1135
MCQeasy

What is the default OSPF hello interval on a point-to-point serial interface?

A.10 seconds
B.30 seconds
C.40 seconds
D.20 seconds
AnswerA

Correct. Point-to-point and broadcast networks use a 10-second hello interval.

Why this answer

OSPF hello interval defaults are based on the network type. For point-to-point and broadcast networks, the default hello interval is 10 seconds. For NBMA and point-to-multipoint, it is 30 seconds.

Full explanation →
1136
MCQmedium

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

A.Check the EEM applet's script for errors.
B.Use the 'show event manager statistics' command to see how often the applet is triggered.
C.Temporarily disable the EEM applet and monitor the packet loss.
D.Increase the logging level to debug to see more details.
AnswerC

Correct because disabling the applet and observing if packet loss stops confirms the applet as the cause.

Why this answer

To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Full explanation →
1137
Drag & Drophard

Drag and drop the steps to troubleshoot VRF-Lite adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Start by checking if the VRF is defined correctly with show vrf. Then verify interface assignment to the correct VRF. Next, confirm that the IP address on the interface is in the VRF context.

After that, test basic connectivity with ping using the VRF keyword. Finally, examine routing protocol adjacency status within the VRF.

Full explanation →
1138
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nhrp traffic NHRP Traffic Statistics Sent: 100 requests, 50 replies Received: 50 requests, 100 replies Based on this output, what is the problem?

A.There is a mismatch between sent requests and received replies, indicating packet loss.
B.The router is receiving more replies than requests.
C.The NHRP process is functioning normally.
D.The router is configured as a hub.
AnswerA

100 requests sent vs 50 replies received shows loss.

Why this answer

The output shows NHRP traffic statistics. The router sent 100 requests but received only 50 replies, indicating that half of the requests are not being answered. This could be due to network issues, misconfiguration, or packet loss.

Full explanation →
1139
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 nd raguard policy Interface Policy Role State Gi0/0/0 RA_GUARD router ACTIVE Gi0/0/1 RA_GUARD host ACTIVE Gi0/0/2 (default) host ACTIVE Based on this output, which statement is correct?

A.Interface Gi0/0/0 is allowed to send Router Advertisements.
B.Interface Gi0/0/1 is allowed to send Router Advertisements.
C.Interface Gi0/0/2 is allowed to send Router Advertisements.
D.All interfaces are blocked from sending Router Advertisements.
AnswerA

Role 'router' under RA guard permits sending RAs.

Why this answer

The 'show ipv6 nd raguard policy' output shows that interface Gi0/0/0 is configured with the RA_GUARD policy in the 'router' role and is ACTIVE. In IPv6 RA Guard, a port in the 'router' role is explicitly permitted to send Router Advertisements (RAs), while ports in the 'host' role are blocked from sending RAs. Therefore, only Gi0/0/0 is allowed to send RAs, making option A correct.

Exam trap

Cisco often tests the misconception that all interfaces with an active RA Guard policy are blocked, but the key differentiator is the 'role' (router vs. host), not just the policy being active.

How to eliminate wrong answers

Option B is wrong because interface Gi0/0/1 has the RA_GUARD policy with the 'host' role, which blocks it from sending Router Advertisements. Option C is wrong because interface Gi0/0/2 uses the default policy with the 'host' role, which also blocks it from sending Router Advertisements. Option D is wrong because interface Gi0/0/0 is in the 'router' role and is allowed to send Router Advertisements, so not all interfaces are blocked.

Full explanation →
1140
MCQeasy

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto isakmp sa detail IPv4 Crypto ISAKMP SA C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap. 1001 192.168.1.1 192.168.2.2 ACTIVE des sha pre 2 23:59:21 1002 192.168.1.1 192.168.2.2 ACTIVE 3des sha pre 2 23:58:15 IPv6 Crypto ISAKMP SA What does this output indicate?

A.The IPsec VPN is functioning correctly with two redundant ISAKMP SAs.
B.There are two active ISAKMP SAs between the peers, which suggests a configuration error such as multiple ISAKMP policies or aggressive mode issues.
C.The ISAKMP SA is using DES encryption, which is weak and should be upgraded.
D.The ISAKMP SA lifetime is about 24 hours, which is the default.
AnswerB

Having two SAs is abnormal; it often results from misconfigured policies or aggressive mode causing duplicate SAs.

Why this answer

The output shows two active ISAKMP SAs between the same peers (192.168.1.1 and 192.168.2.2) with different encryption algorithms (DES and 3DES). Under normal operation, only one ISAKMP SA should exist per peer pair. Having multiple SAs indicates a configuration error, such as multiple ISAKMP policies that both match, or aggressive mode causing duplicate SAs.

This is not a sign of redundancy; ISAKMP SAs are not redundant by design.

Exam trap

Cisco often tests the misconception that multiple active ISAKMP SAs between the same peers are normal or provide redundancy, when in fact they indicate a configuration error that can break the VPN tunnel.

How to eliminate wrong answers

Option A is wrong because ISAKMP SAs are not designed for redundancy; having two active SAs between the same peers indicates a misconfiguration, not a functional redundancy feature. Option C is wrong because while DES is indeed weak, the output shows both DES and 3DES SAs, and the question asks what the output indicates—the core issue is the duplicate SAs, not the encryption strength. Option D is wrong because the lifetimes shown (23:59:21 and 23:58:15) are close to 24 hours, which is the default for ISAKMP, but this is not the key finding; the presence of two SAs is the abnormal condition.

Full explanation →
1141
MCQmedium

A network engineer runs the following command on Router R1: R1# show bgp summary BGP router identifier 10.1.1.1, local AS number 65001 BGP table version is 15, main routing table version 15 2 network entries using 288 bytes of memory 2 path entries using 160 bytes of memory 2/1 BGP path/bestpath attribute entries using 288 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 736 total bytes of memory BGP activity 4/2 prefixes, 4/2 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.12.2 4 65002 1023 1047 15 0 0 00:12:34 0 192.168.1.2 4 65003 0 0 0 0 0 never Active Based on this output, what is the problem with the BGP session to 192.168.1.2?

A.The neighbor 192.168.1.2 is not reachable.
B.The neighbor 192.168.1.2 is in Idle state due to a misconfigured AS number.
C.The BGP session to 192.168.1.2 has never been established and is in Active state, likely due to a lack of TCP connectivity.
D.The BGP session to 192.168.1.2 is established but not exchanging prefixes.
AnswerC

Active state with 'never' uptime indicates the session has never come up, and R1 is actively trying to initiate the TCP connection.

Why this answer

The neighbor 192.168.1.2 is in Active state, meaning R1 is trying to establish a TCP connection but is not receiving a response. This could be due to reachability issues, incorrect AS number, or ACL blocking. The session has never been up (Up/Down: never).

Full explanation →
1142
MCQmedium

Which OSPF LSA type is used to advertise external routes and is flooded throughout the entire OSPF domain?

A.Type 1 (Router LSA)
B.Type 3 (Summary LSA)
C.Type 4 (ASBR Summary LSA)
D.Type 5 (AS-external LSA)
AnswerD

Correct. Type 5 LSAs are flooded throughout the entire OSPF domain (except stub areas) and advertise external routes.

Why this answer

Type 5 (AS-external LSA) is correct because it is originated by an ASBR to advertise external routes redistributed into OSPF from another routing domain. These LSAs are flooded throughout the entire OSPF domain, including all areas, and their flooding scope is AS-wide, as defined in RFC 2328.

Exam trap

Cisco often tests the distinction between Type 3 and Type 5 LSAs, where candidates mistakenly think Type 3 LSAs carry external routes because they are also 'summary' LSAs, but Type 3 LSAs only carry inter-area routes, not external routes.

How to eliminate wrong answers

Option A is wrong because Type 1 (Router LSA) describes the state and cost of a router's interfaces within a single area and is flooded only within that area, not the entire OSPF domain. Option B is wrong because Type 3 (Summary LSA) is generated by an ABR to advertise inter-area routes and is flooded only within a single area, not the entire domain. Option C is wrong because Type 4 (ASBR Summary LSA) is also generated by an ABR to advertise the location of an ASBR to other areas, but its flooding scope is limited to a single area, not the entire OSPF domain.

Full explanation →
1143
MCQhard

A service provider is using 6rd (IPv6 Rapid Deployment) tunnels to provide IPv6 to customers. Customer router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel mode ipv6ip 6rd ipv6 6rd prefix 2001:DB8::/32 6rd-br 198.51.100.1. Router R2 (BR) shows: R2# show ipv6 route 2001:DB8:1::/64 % Route not found. What is the root cause?

A.The 6rd prefix on R1 should match the BR's configured 6rd prefix, and the BR must have a route for the customer's delegated prefix.
B.The tunnel mode should be ipv6ip 6rd on both ends, but the BR is missing the 6rd configuration.
C.The customer's IPv4 address is not reachable from the BR.
D.The 6rd prefix length should be /64 instead of /32.
AnswerA

The BR must have a route for the customer's IPv6 prefix, which is derived from the 6rd prefix and the customer's IPv4 address.

Why this answer

The 6rd (IPv6 Rapid Deployment) tunnel requires both the customer router (R1) and the border relay (BR, R2) to agree on the same 6rd prefix. R1 is configured with prefix 2001:DB8::/32, but the BR has no route for the delegated prefix 2001:DB8:1::/64, which is derived from R1's IPv4 address (192.0.2.1) and the 6rd prefix. Without this route in the BR's IPv6 routing table, the BR cannot forward traffic to the customer's 6rd tunnel, causing the 'Route not found' error.

Exam trap

Cisco often tests the misconception that 6rd requires matching tunnel configurations on both ends, when in reality the BR only needs a route for the delegated prefix and does not run a 6rd tunnel interface itself.

How to eliminate wrong answers

Option B is wrong because the tunnel mode 'ipv6ip 6rd' is correctly configured on R1, and the BR does not need the same tunnel interface or 6rd configuration; it only needs a route for the delegated prefix and the ability to decapsulate 6rd packets. Option C is wrong because the issue is not IPv4 reachability between R1 (192.0.2.1) and the BR (198.51.100.1); the BR can reach R1's IPv4 address, but it lacks the specific IPv6 route for the delegated prefix. Option D is wrong because the 6rd prefix length is /32, which is correct for aggregating customer prefixes; the delegated prefix length (e.g., /64) is derived from the IPv4 address and is separate from the 6rd prefix length.

Full explanation →
1144
MCQmedium

A network engineer is troubleshooting a BGP session that is dropping intermittently. The routers are connected via a Layer 2 switch. BFD is configured for the BGP session. The engineer notices that the BFD session goes down briefly, causing the BGP session to reset. The BFD timers are set to 100 ms interval with a multiplier of 3. The switch is not configured for BFD. What is the most likely cause?

A.The BFD timers are too aggressive for the switch's processing capabilities, causing BFD packets to be dropped during high traffic.
B.The BGP session is not configured with the 'bfd' command under the neighbor statement.
C.The switch is running Spanning Tree Protocol (STP) and causing delays.
D.One router has 'bfd slow-timers' configured, causing a mismatch.
AnswerA

Aggressive BFD timers (100 ms) can overwhelm a switch that is not optimized for fast packet forwarding, leading to intermittent BFD failures.

Why this answer

BFD sessions can be affected by congestion or processing delays in the Layer 2 switch, especially with aggressive timers. The switch not supporting BFD does not inherently cause issues, but high CPU or buffer drops can cause BFD packets to be dropped.

Full explanation →
1145
Multi-Selecthard

Which TWO configuration steps are required to change the administrative distance for routes learned from a specific neighbor in EIGRP? (Choose TWO.)

Select 2 answers
A.Configure a prefix list to match the routes from the neighbor.
B.Use the distance eigrp command in router configuration mode.
C.Use the distance command with the neighbor IP address and prefix list.
D.Configure an access list to permit the routes from the neighbor.
E.Use the redistribute command to change the administrative distance.
AnswersA, C

The prefix list is used to identify which routes to match for the distance override.

Why this answer

To change the AD for routes from a specific EIGRP neighbor, you must first configure a prefix list to match the routes, then apply it using the distance command in EIGRP router configuration mode. The distance command can specify a different AD for routes matching a prefix list from a specific neighbor.

Full explanation →
1146
MCQmedium

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1: R1# debug ipv6 dhcp relay Output: IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0 What does this output indicate?

A.The DHCPv6 relay agent is not functioning because messages are not being forwarded.
B.The DHCPv6 relay agent is successfully forwarding messages between the client and server.
C.The DHCPv6 server is unreachable because no REPLY is received.
D.The DHCPv6 client is using a global unicast address as its link-local address.
AnswerB

The relay receives client messages, forwards them to the server, and forwards server responses back to the client.

Why this answer

The debug output shows a complete DHCPv6 four-message exchange (SOLICIT-ADVERTISE-REQUEST-REPLY) being relayed between the client (FE80::1) and the server (2001:DB8:2::1). Each message is received on one interface and forwarded out the other, confirming the relay agent is functioning correctly. Therefore, option B is correct.

Exam trap

Cisco often tests the ability to interpret debug output by showing a successful message flow, leading candidates to incorrectly assume a failure because they expect an error message or because they misread the link-local address as a global address.

How to eliminate wrong answers

Option A is wrong because the debug output clearly shows messages being forwarded in both directions, proving the relay agent is functioning. Option C is wrong because the output includes a REPLY message from the server, indicating the server is reachable and responding. Option D is wrong because FE80::1 is a link-local address (fe80::/10), not a global unicast address, and the client correctly uses it as its link-local address for DHCPv6 communication.

Full explanation →
1147
Drag & Drophard

Drag and drop the troubleshooting steps for DMVPN adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting DMVPN connectivity starts with verifying physical and IP reachability to the hub. Next, check NHRP registration status on the spoke. Then verify mGRE tunnel interface parameters and IPsec phase 1 (IKE) status.

Finally, examine NHRP resolution between spokes to isolate the failure point.

Full explanation →
1148
MCQhard

What is the default value of the 'hold-down' timer in IPv6 FHS's ND Snooping feature on Cisco IOS-XE?

A.5 seconds
B.10 seconds
C.15 seconds
D.20 seconds
AnswerB

Correct. The default hold-down timer is 10 seconds.

Why this answer

The default hold-down timer for IPv6 First Hop Security's Neighbor Discovery (ND) Snooping feature on Cisco IOS-XE is 10 seconds. This timer defines how long the device maintains a binding entry in the ND snooping database after the last valid advertisement is received, preventing rapid flapping and ensuring stability in the binding table.

Exam trap

Cisco often tests the default hold-down timer value by making candidates confuse it with the default reachable time (30 seconds) or the default binding lifetime (300 seconds), leading them to pick a larger number like 15 or 20 seconds.

How to eliminate wrong answers

Option A is wrong because 5 seconds is not the default hold-down timer; it is too short to provide sufficient stability against transient ND messages. Option C is wrong because 15 seconds is not the default; this value might be used in other FHS features like DHCPv6 guard but not for ND snooping hold-down. Option D is wrong because 20 seconds is also not the default; it would unnecessarily delay the removal of stale bindings, potentially causing resource exhaustion in dynamic environments.

Full explanation →
1149
MCQhard

An engineer configures a BGP route reflector with a route map that sets a higher local preference on routes received from a client. The route map is applied to the neighbor statement for the client. Unexpectedly, the route reflector does not reflect the modified local preference to other clients. Which is the most likely explanation?

A.The route map is applied outbound, not inbound, so the local preference is set after the route is reflected.
B.Route reflectors do not modify local preference; only the route reflector itself can set local preference.
C.The route map must be applied to the route reflector's cluster list, not the neighbor.
D.The local preference is overridden by the next-hop-self command.
AnswerA

Outbound route maps affect routes sent to the neighbor, not routes received; reflection happens before outbound processing.

Why this answer

When a route map is applied to a BGP neighbor inbound, it modifies the route before it is installed in the BGP table. However, route reflectors reflect routes based on the best path selection, and if the local preference is set, it should be reflected. The issue is that the route map is applied outbound instead of inbound, or the route map does not explicitly set the local preference before the route is processed.

The most common edge case is that the route map is applied outbound, which does not affect the route before reflection.

Full explanation →
1150
MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, the router's CPU spikes and routes start flapping. Which is the most likely explanation?

A.The redistribution is creating a routing loop because there is no route tagging or filtering to prevent re-redistribution.
B.The seed metric is not configured, so the routes are not redistributed.
C.The administrative distance is set too low, causing the router to prefer the wrong route.
D.The OSPF process ID is the same on both routers.
AnswerA

Correct. Without tagging, routes can loop between protocols.

Why this answer

Mutual redistribution without route tagging or filtering causes the redistributed routes to be re-injected back into the original routing protocol, creating a routing loop. This loop leads to continuous route updates, CPU spikes, and route flapping as the router repeatedly processes and advertises the same prefixes.

Exam trap

Cisco often tests the concept that mutual redistribution inherently causes loops unless explicit filtering or tagging is applied, and candidates mistakenly focus on missing metrics or administrative distance instead of the re-redirection loop.

How to eliminate wrong answers

Option B is wrong because a missing seed metric would prevent redistribution from EIGRP into OSPF (OSPF requires a metric), but it would not cause a routing loop or flapping; the routes simply would not be redistributed. Option C is wrong because setting administrative distance too low could cause route preference issues but does not directly create the feedback loop of mutual redistribution; the core problem is re-redistribution, not AD. Option D is wrong because the OSPF process ID is locally significant and does not need to match between routers; mismatched process IDs do not cause redistribution loops or flapping.

Full explanation →
1151
MCQhard

An engineer configures IPsec site-to-site VPN between two routers. The tunnel is established, but no traffic is encrypted. The engineer checks the crypto map and access-list and confirms they match the interesting traffic. What is the most likely explanation?

A.The crypto map is applied to the wrong interface, and traffic is not being matched.
B.The 'transform-set' is configured with ESP-NULL, which provides no encryption.
C.The 'crypto isakmp key' is mismatched between the two routers.
D.The 'crypto map' is not applied globally, so it does not affect traffic.
AnswerA

If the crypto map is applied to a different interface than the one carrying the interesting traffic, the traffic will not be encrypted even if the tunnel is up. The tunnel establishment only requires the crypto map to be present on the interface, but encryption only occurs for traffic matching the access-list on that specific interface.

Why this answer

A common edge case is that the crypto map is applied to the wrong interface or the access-list is not correctly referencing the traffic. However, if the tunnel is established, the issue may be that the crypto map is applied to a subinterface but the traffic is flowing through the main interface, or the 'crypto map' command is missing the 'local-address' option for multiple crypto maps. Another possibility is that the 'set peer' command is missing or the peer address is incorrect.

Full explanation →
1152
MCQmedium

A network engineer runs the following command to troubleshoot an EIGRP issue: R1# show ip eigrp neighbors detail IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.2.2 Gi0/0 13 00:12:34 12 200 0 145 Version 12.4/1.2, Retrans: 0, Retries: 0, Prefixes: 5 Topology-ids from peer - 0 Stub Peer Advertising (CONNECTED STATIC) Routes Suppressing queries What does this output indicate?

A.The neighbor is a stub router that only advertises connected and static routes, and it does not participate in query propagation.
B.The neighbor is a normal EIGRP peer that forwards all routes and queries.
C.The neighbor is not forming an adjacency due to a version mismatch.
D.The neighbor is using a different autonomous system number.
AnswerA

The output shows 'Stub Peer Advertising (CONNECTED STATIC) Routes' and 'Suppressing queries', confirming stub behavior.

Why this answer

The output shows 'Stub Peer Advertising (CONNECTED STATIC) Routes' and 'Suppressing queries', which indicates the neighbor is configured as an EIGRP stub router. A stub router advertises only connected and static routes (as specified) and does not participate in query propagation, meaning it will not forward queries from other routers, reducing the query domain and improving convergence.

Exam trap

Cisco often tests the distinction between a normal EIGRP peer and a stub peer by hiding the 'Suppressing queries' line in the output, leading candidates to overlook the stub behavior and incorrectly assume the peer is a normal router forwarding all routes.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Suppressing queries' and 'Stub Peer Advertising', which means the neighbor is not a normal EIGRP peer that forwards all routes and queries; normal peers do not suppress queries. Option C is wrong because the output shows 'Version 12.4/1.2', indicating a successful version match between the peers; a version mismatch would prevent adjacency formation and would not show neighbor details. Option D is wrong because the output shows 'IP-EIGRP neighbors for process 100', confirming both routers are using the same autonomous system number (100); a different AS would prevent adjacency.

Full explanation →
1153
MCQhard

An engineer configures MPLS on a router with OSPF as the IGP. The OSPF neighbor is stuck in EXSTART state. The engineer verifies that both routers have matching MTU values on the connecting interfaces. What is the most likely cause of this issue?

A.The OSPF network type is mismatched between the two routers.
B.The OSPF hello and dead intervals are mismatched.
C.The router ID is duplicated on one of the routers.
D.The interface is configured with 'ip ospf mtu-ignore' on one side only.
AnswerA

A mismatch in OSPF network type (e.g., broadcast vs point-to-point) can cause the neighbor to remain in EXSTART because the DD packet exchange process differs between network types, even if MTU is consistent.

Why this answer

In OSPF, a neighbor stuck in EXSTART is often due to MTU mismatch, but if MTU is confirmed matching, the issue may be a mismatch in OSPF network type (e.g., one side broadcast, the other point-to-point). This causes different behavior in the Database Description (DD) packet exchange, leading to the stuck state even with matching MTU.

Full explanation →
1154
MCQhard

An engineer configures EIGRP named mode on two routers in the same AS. One router uses classic mode configuration. The routers fail to form an adjacency. Which is the most likely explanation?

A.Named mode and classic mode are incompatible and cannot form an adjacency under any circumstances.
B.The K values must match exactly, but named mode defaults to different K values than classic mode.
C.Named mode requires authentication, while classic mode does not.
D.The routers must be in the same autonomous system number, but named mode uses a different AS number format.
AnswerA

EIGRP named mode and classic mode use different packet structures and metric computation; they are not interoperable for adjacency formation.

Why this answer

EIGRP named mode and classic mode use different packet formats and TLVs, making them incompatible at the protocol level. Even though both operate within the same autonomous system, the routers cannot form an adjacency because the hello packets are not recognized by the other mode. This incompatibility is fundamental and cannot be overcome by configuration adjustments.

Exam trap

The trap here is that candidates often assume named mode and classic mode can interoperate because they share the same protocol number and AS number, but Cisco specifically designed them to be incompatible to enforce a clean migration path.

How to eliminate wrong answers

Option B is wrong because both named mode and classic mode default to the same K values (K1=1, K2=0, K3=1, K4=0, K5=0), so K value mismatch is not the issue. Option C is wrong because authentication is optional in both named mode and classic mode; named mode does not require authentication by default. Option D is wrong because both modes use the same 16-bit autonomous system number format; named mode does not introduce a different AS number format.

Full explanation →
1155
MCQhard

Router R8 is configured with SNMP and IP SLA. The IP SLA operation sends SNMP traps to the NMS when a threshold is crossed. The configuration includes: ip sla 1, icmp-echo 192.168.1.1, threshold 100, timeout 1000, frequency 10, ip sla schedule 1 life forever start-time now, snmp-server enable traps ip sla. However, the NMS receives no traps when the threshold is crossed. The IP SLA operation shows 'Over threshold' in show ip sla statistics. What is the root cause?

A.The IP SLA operation is missing the 'ip sla reaction-configuration' command to trigger SNMP traps when the threshold is exceeded.
B.The NMS is not configured to receive IP SLA traps.
C.The SNMP community string is incorrect for trap sending.
D.The IP SLA operation is not scheduled correctly.
AnswerA

IP SLA traps require a reaction configuration that specifies the threshold and action (e.g., 'ip sla reaction-configuration 1 react timeout threshold 100 action trapOnly'). Without it, no traps are sent.

Why this answer

The 'ip sla reaction-configuration' command is required to define the condition (e.g., threshold violation) that triggers an SNMP trap. Without this command, the IP SLA operation can detect and report 'Over threshold' in statistics, but it has no mechanism to generate an SNMP trap to the NMS. The 'snmp-server enable traps ip sla' command only enables the router to send IP SLA traps globally; it does not link a specific reaction to the threshold event.

Exam trap

Cisco often tests the distinction between enabling SNMP traps globally ('snmp-server enable traps ip sla') and configuring the specific reaction that triggers those traps ('ip sla reaction-configuration'), leading candidates to overlook the missing reaction command.

How to eliminate wrong answers

Option B is wrong because the NMS's ability to receive traps is not configured on the router; the router's SNMP trap configuration (destination, community) is independent of the NMS's readiness. Option C is wrong because the SNMP community string for trap sending is not mentioned in the scenario, and the issue is specifically about the missing reaction-configuration, not authentication. Option D is wrong because the IP SLA operation is scheduled correctly with 'ip sla schedule 1 life forever start-time now', and the statistics show it is running and detecting the threshold crossing.

Full explanation →
1156
MCQmedium

Consider the following partial configuration on router R4: interface GigabitEthernet0/0 ip address 192.168.2.1 255.255.255.0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 1 area 0 ! interface GigabitEthernet0/1 ip address 10.0.0.1 255.255.255.0 ipv6 address 2001:db8:2::1/64 ipv6 ospf 1 area 0 ! ipv6 router ospf 1 router-id 4.4.4.4 What is the effect of this configuration?

A.OSPFv3 will not form adjacencies because the router-id must be an IPv6 address.
B.OSPFv3 will only form adjacency on GigabitEthernet0/0 because the router-id is not configured under the interface.
C.OSPFv3 will form adjacencies on both interfaces as intended because the router-id is correctly set and OSPFv3 is enabled on each interface.
D.OSPFv3 will not form any adjacency because the network type is not specified.
AnswerC

The configuration is correct: router-id is set, interfaces are enabled for OSPFv3 in area 0. OSPFv3 will operate normally.

Why this answer

OSPFv3 (OSPF for IPv6) uses a 32-bit router-id, which can be an IPv4 address (like 4.4.4.4) or any arbitrary 32-bit value, and does not require an IPv6 address. The configuration enables OSPFv3 process 1 under the global 'ipv6 router ospf 1' command, sets the router-id, and activates OSPFv3 on both interfaces with 'ipv6 ospf 1 area 0', allowing adjacencies to form normally on both GigabitEthernet0/0 and GigabitEthernet0/1.

Exam trap

Cisco often tests the misconception that OSPFv3 requires an IPv6 router-id, when in fact it uses a 32-bit router-id (like an IPv4 address), and candidates may also incorrectly assume that OSPFv3 needs per-interface router-id configuration or explicit network type statements.

How to eliminate wrong answers

Option A is wrong because OSPFv3 does not require the router-id to be an IPv6 address; it uses a 32-bit router-id (typically an IPv4 address or a custom value), as defined in RFC 5340. Option B is wrong because the router-id is configured globally under the OSPFv3 process and does not need to be configured per interface; both interfaces will form adjacencies as long as OSPFv3 is enabled on them. Option D is wrong because OSPFv3 defaults to the broadcast network type on Ethernet interfaces, and no explicit network type specification is required for adjacency formation.

Full explanation →
1157
MCQmedium

An engineer is troubleshooting why the NMS is not receiving SNMP traps for interface up/down events on router R4. The configuration includes 'snmp-server enable traps snmp linkdown linkup' and 'snmp-server host 10.1.1.200 version 2c public'. The NMS can receive other traps from R4. What is the most likely cause?

A.The engineer combined 'linkdown' and 'linkup' in a single command; they must be configured as separate 'snmp-server enable traps' commands.
B.The NMS is configured to filter out link up/down traps, so they are not displayed.
C.The router needs the 'snmp-server trap-source' command to specify the loopback interface for traps.
D.The 'snmp-server host' command must include the 'udp-port' option to specify port 162.
AnswerA

Correct because the IOS syntax requires separate commands for each trap type; combining them is invalid.

Why this answer

Cisco IOS requires that 'linkdown' and 'linkup' be configured in separate 'snmp-server enable traps' commands when using the 'snmp-server enable traps snmp' syntax. Combining them in a single command is syntactically invalid; the router will not enable either trap type, which explains why the NMS receives other traps but not link up/down events.

Exam trap

Cisco often tests the misconception that multiple trap keywords can be combined in a single 'snmp-server enable traps' command, when in fact each specific trap (like 'linkdown' and 'linkup') requires its own separate command to be enabled.

How to eliminate wrong answers

Option B is wrong because the NMS can receive other traps from R4, indicating it is not filtering traps globally; if it were filtering link up/down specifically, the engineer would need to verify NMS configuration, but the question states the NMS receives other traps, making this unlikely. Option C is wrong because the 'snmp-server trap-source' command is used to set the source IP address for traps, but the NMS already receives other traps from R4, so the source is reachable and not the issue. Option D is wrong because the default UDP port for SNMP traps is 162, and the 'udp-port' option is only needed if a non-standard port is used; the NMS already receives other traps on the default port, so this is not the cause.

Full explanation →
1158
Multi-Selecthard

Which THREE commands can be used to verify VRF-Lite configuration and operation on a Cisco IOS-XE router? (Choose THREE.)

Select 3 answers
A.show vrf
B.show ip route vrf BLUE
C.show ip interface vrf BLUE
D.show vrf interfaces
E.show vrf detail
AnswersA, B, C

Correct. This command lists all VRFs, their route distinguishers (RD), and interfaces.

Why this answer

Common verification commands for VRF-Lite include: 'show vrf' to list VRFs and their RD/RT, 'show ip route vrf <name>' to display the VRF-specific routing table, and 'show ip interface vrf <name>' to show interfaces assigned to a VRF. Option A is correct. Option B is correct.

Option C is correct. Option D is incorrect because 'show ip vrf interfaces' is the correct command, not 'show vrf interfaces'. Option E is incorrect because 'show vrf detail' is not a valid command; the correct command is 'show vrf' or 'show vrf <name>'.

Full explanation →
1159
Multi-Selecthard

Which THREE symptoms indicate a BGP route dampening issue that is causing routes to be suppressed? (Choose THREE.)

Select 3 answers
A.The BGP neighbor state flaps between Established and Idle.
B.The show ip bgp command displays the route with a 'd' status code.
C.The route is present in the BGP table but missing from the IP routing table.
D.The show ip bgp dampened-paths command shows the suppressed routes.
E.The show ip prefix-list command indicates that routes are being filtered.
AnswersB, C, D

The 'd' status code indicates the route is dampened.

Why this answer

Route dampening suppresses routes that flap frequently. Symptoms include routes showing as 'dampened' in the BGP table, routes being absent from the routing table despite being in the BGP table, and the show ip bgp dampened-paths command listing those routes. Option A is incorrect because dampening does not affect the neighbor state.

Option E is incorrect because the prefix-list is not directly related to dampening.

Full explanation →
1160
MCQeasy

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show ip route summary And sees the following output: Route Source Networks Subnets Replicates Overhead Memory (bytes) connected 2 0 0 0 512 static 1 0 0 0 256 ospf 1 5 0 0 0 1280 eigrp 100 3 0 0 0 768 bgp 65000 2 0 0 0 512 internal 1 0 0 0 256 Total 14 0 0 0 3584 What does this output indicate?

A.The router has 14 routes total, with OSPF contributing the most routes.
B.The router is not redistributing any routes because the counts are low.
C.BGP is the only protocol with external routes.
D.EIGRP has 3 routes, all of which are redistributed from OSPF.
AnswerA

The output shows OSPF has 5 routes, which is the highest count. This indicates OSPF is learning many routes, possibly via redistribution.

Why this answer

The show ip route summary output provides a count of routes from each source. It shows that OSPF has 5 routes, EIGRP has 3, BGP has 2, and static has 1. This can help identify if redistribution is working by comparing expected routes.

Full explanation →
1161
Multi-Selecthard

Which TWO statements about the 'logging rate-limit' command and its effects are correct? (Choose TWO.)

Select 2 answers
A.The command 'logging rate-limit 200 all' limits all syslog messages to 200 messages per second.
B.By default, Cisco IOS applies a rate limit of 100 messages per second to all logging destinations.
C.The 'logging rate-limit' command can be applied on a per-interface basis using interface configuration mode.
D.The 'logging rate-limit' command only affects messages sent to the console port.
E.The 'show logging rate-limit' command displays the current rate-limit configuration.
AnswersA, C

Correct. The 'all' keyword applies the rate limit to every syslog message, regardless of severity.

Why this answer

The 'logging rate-limit' command limits the number of syslog messages per second to prevent CPU overload. It can be applied globally or per interface. The 'all' option applies the limit to all messages, while 'except' allows certain severities to bypass the limit.

The default rate is not unlimited; it depends on the IOS version but typically no rate limit is applied by default. The command does not affect console logging rate by default; it primarily affects logging to buffer and remote servers. The 'show logging' command displays the current rate-limit configuration.

Full explanation →
1162
MCQhard

An engineer configures EIGRP named mode on two routers in an MPLS L3VPN. The routers are directly connected and can ping each other. The engineer notices that the EIGRP adjacency forms but then the neighbor relationship goes down and the routers become stuck-in-active (SIA) for certain routes. The engineer checks the logs and sees no errors. What is the most likely explanation?

A.The 'metric weights' (k-values) are mismatched between the two routers, causing query propagation to fail.
B.The 'auto-summary' command is enabled on one router, causing route summarization to break the adjacency.
C.The 'passive-interface' command is applied to the interface, preventing the adjacency from forming.
D.The 'bandwidth' setting on the interface is set to a very low value, causing the EIGRP metric to be too high for the route to be installed.
AnswerA

Correct. EIGRP requires matching k-values between neighbors. If they differ, the adjacency may form but queries can be dropped, leading to SIA.

Why this answer

In EIGRP named mode, the default hello interval and hold time are different from classic mode. Named mode uses a default hello interval of 5 seconds and hold time of 15 seconds, while classic mode uses 5 and 15 as well, but the key difference is that named mode uses a different metric calculation (wide metrics) by default. However, the most common edge case causing SIA in named mode is that the 'metric weights' or 'k-values' must match between neighbors.

If one router is using named mode with default k-values (1,0,1,0,0) and the other is using classic mode with different k-values (e.g., 1,0,1,0,0), the adjacency will form but queries may not be processed correctly, leading to SIA. Additionally, named mode requires the 'address-family' configuration to be consistent. A more specific edge case is that named mode uses a different 'graceful-restart' mechanism by default, which can cause issues if not supported on both sides.

Full explanation →
1163
Drag & Dropmedium

Drag and drop the steps to configure OSPF inter-area summarization on an ABR into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, enter OSPF configuration mode for the process. Then, configure the area where the routes originate. Next, apply the range command to summarize prefixes into that area.

After that, verify the summary route is present in the routing table. Finally, check that the summary is advertised to neighboring areas.

Full explanation →
1164
MCQhard

An engineer configures a route reflector cluster with two route reflectors in the same cluster ID. After convergence, some iBGP routes are missing on clients, and 'show ip bgp' shows the path with 'r' flag. What is the most likely explanation?

A.The cluster ID is misconfigured and should be unique per route reflector.
B.The route reflectors have different BGP AS numbers, causing the 'r' flag to indicate a routing loop.
C.The clients have 'no bgp default route-reflector-client' configured, preventing them from receiving reflected routes.
D.The route reflectors have 'bgp cluster-id' set to 0.0.0.0, which disables cluster-based loop prevention.
AnswerA

Route reflectors with the same cluster ID will reject routes from each other to prevent loops, leading to missing routes on clients.

Why this answer

When two route reflectors share the same cluster ID, they treat each other's updates as if from the same cluster. The route reflector loop prevention mechanism drops routes learned from another RR in the same cluster, causing route loss if the clients are not fully meshed.

Full explanation →
1165
Multi-Selecthard

Which TWO statements about IPv6 manual tunnels (IPv6-in-IPv4) are true? (Choose TWO.)

Select 2 answers
A.The tunnel mode must be configured as tunnel mode ipv6ip.
B.The tunnel interface requires both an IPv4 address and an IPv6 address.
C.Manual tunnels support multicast traffic natively.
D.The tunnel destination can be a multicast IPv4 address.
E.The IPv4 address of the tunnel source is automatically embedded in the IPv6 prefix.
AnswersA, B

Correct. Manual IPv6-in-IPv4 tunnels use tunnel mode ipv6ip.

Why this answer

The `tunnel mode ipv6ip` command explicitly configures the tunnel interface for IPv6-in-IPv4 manual tunneling. This mode encapsulates IPv6 packets directly into IPv4 packets using protocol type 41, as defined in RFC 4213. Without this mode, the tunnel interface would not properly handle the encapsulation and decapsulation of IPv6 traffic over an IPv4 infrastructure.

Exam trap

Cisco often tests the distinction between manual tunnels and automatic 6to4 tunnels, where candidates mistakenly think the IPv4 source address is embedded in the IPv6 prefix (true for 6to4) or that multicast destinations are allowed (true for GRE tunnels, not manual IPv6-in-IPv4).

Full explanation →
1166
MCQmedium

Given this configuration: ``` interface GigabitEthernet0/4 ip access-group BLOCK_FTP in ! ip access-list extended BLOCK_FTP deny tcp any any eq 21 deny tcp any any eq 20 permit ip any any ``` What is the effect of this ACL when applied inbound on GigabitEthernet0/4?

A.It blocks all FTP traffic entering the interface, but permits all other IP traffic.
B.It blocks all FTP traffic leaving the interface.
C.It permits FTP traffic and blocks all other IP traffic.
D.It has no effect because the ACL is missing a sequence number.
AnswerA

Correct. The ACL denies FTP ports and permits everything else.

Why this answer

The ACL is applied inbound on GigabitEthernet0/4, meaning it filters traffic as it enters the interface. The first two deny statements block TCP traffic destined for ports 21 (FTP control) and 20 (FTP data), which are the standard ports for FTP. The final permit ip any any allows all other IP traffic.

Thus, only FTP traffic is blocked, and all other IP traffic is permitted.

Exam trap

Cisco often tests the distinction between inbound and outbound ACL application, and the trap here is that candidates may confuse the direction (in vs out) and incorrectly think the ACL blocks outbound traffic, or they may overlook that the explicit permit ip any any is required to allow other traffic after the deny statements.

How to eliminate wrong answers

Option B is wrong because the ACL is applied inbound (ip access-group BLOCK_FTP in), so it filters traffic entering the interface, not leaving it; outbound filtering would require the out keyword. Option C is wrong because the ACL explicitly denies FTP traffic (ports 20 and 21) and permits all other IP traffic, so it blocks FTP, not permits it. Option D is wrong because Cisco IOS extended ACLs do not require sequence numbers; sequence numbers are optional and used for editing, not for the ACL to function.

Full explanation →
1167
MCQeasy

Which RFC defines the IPv6 Neighbor Discovery Protocol that is the basis for many First Hop Security features?

A.RFC 4861
B.RFC 2460
C.RFC 4291
D.RFC 4443
AnswerA

RFC 4861 is the standard for IPv6 Neighbor Discovery.

Why this answer

RFC 4861 defines the IPv6 Neighbor Discovery Protocol (NDP), which is the foundation for IPv6 First Hop Security (FHS) features. NDP replaces ARP in IPv6 and provides address resolution, router discovery, neighbor unreachability detection, and redirect functions, all of which are leveraged by FHS mechanisms like RA Guard, DHCPv6 Guard, and Source Address Validation Improvement (SAVI).

Exam trap

Cisco often tests the distinction between the RFC that defines the protocol itself (RFC 4861 for NDP) versus RFCs that define supporting technologies like ICMPv6 (RFC 4443) or addressing (RFC 4291), leading candidates to confuse the foundational RFC with related but separate standards.

How to eliminate wrong answers

Option B is wrong because RFC 2460 defines the IPv6 base protocol specification (header format, extension headers, etc.), not Neighbor Discovery. Option C is wrong because RFC 4291 defines the IPv6 addressing architecture, including address types and scopes, not NDP. Option D is wrong because RFC 4443 defines ICMPv6 for IPv6, which is used by NDP for messaging but is not the defining RFC for the Neighbor Discovery Protocol itself.

Full explanation →
1168
MCQmedium

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

A.The destination port is not in the same VLAN as the source port.
B.The destination port is configured as a trunk port.
C.The destination port is in a blocking state due to Spanning Tree Protocol.
D.The source interface is not in the same VLAN as the destination interface.
AnswerC

Correct because SPAN destination ports are not expected to participate in STP; they should be configured with 'spanning-tree portfast' to avoid blocking.

Why this answer

SPAN destination ports must be configured with the 'spanning-tree portfast' command to avoid being blocked by Spanning Tree Protocol (STP). Without this, the destination port may remain in a blocking state.

Full explanation →
1169
MCQhard

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

A.The flow record does not include any VLAN match fields.
B.The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.
C.The flow monitor is applied only to the physical interface, not the subinterfaces.
D.The collector does not support VLAN fields.
AnswerA

Without 'match dot1q vlan' in the flow record, VLAN information is not captured, so all flows appear with the same (or zero) VLAN ID.

Why this answer

To capture VLAN information in Flexible NetFlow, the flow record must include 'match dot1q vlan' or 'match vlan' fields. Without these, the VLAN ID is not recorded, and the collector may show a default or incorrect value.

Full explanation →
1170
Multi-Selectmedium

Which TWO commands would a network engineer use to verify the NHRP registration status of a spoke router in a DMVPN Phase 2 network? (Choose TWO.)

Select 2 answers
A.show dmvpn
B.show ip nhrp
C.show crypto isakmp sa
D.show ip route
E.show ip eigrp neighbors
AnswersA, B

This command shows the DMVPN tunnel status, including the NHRP registration state (e.g., 'UP/UP' with registration status).

Why this answer

The 'show dmvpn' command displays the current DMVPN tunnel status, including the NHRP registration state of each peer. The 'show ip nhrp' command shows the NHRP cache entries, which include the registration status and mapping information. The other commands either do not show NHRP registration details or are for different purposes.

Full explanation →
1171
Multi-Selectmedium

Which TWO statements are true regarding the use of VRF-Lite in a Cisco Enterprise network? (Choose TWO.)

Select 2 answers
A.VRF-Lite enables multiple virtual routing tables on a single router, providing traffic separation without MPLS.
B.VRF-Lite supports dynamic routing protocols such as OSPF and EIGRP within each VRF.
C.VRF-Lite requires MPLS to exchange VPNv4 routes between routers.
D.VRF-Lite can automatically encrypt traffic between VRFs using IPsec.
E.VRF-Lite can only be used with static routing.
AnswersA, B

VRF-Lite creates separate routing tables per VRF, isolating traffic at Layer 3 without needing MPLS.

Why this answer

VRF-Lite allows multiple routing tables on a single router, enabling traffic separation without MPLS. It relies on static routes or dynamic routing protocols like OSPF, EIGRP, or BGP within each VRF. The incorrect options: MPLS is not required for VRF-Lite; VRF-Lite does not support MPLS VPNv4 route exchange (that requires MPLS); and VRF-Lite does not inherently provide encryption.

Full explanation →
1172
MCQhard

A network engineer runs the following command to troubleshoot a Route Redistribution issue: R1# show ip bgp vpnv4 vrf CUSTOMER routes And sees the following output: Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:1 (default for vrf CUSTOMER) *> 192.168.10.0/24 10.1.1.2 0 100 0 65001 i *> 192.168.20.0/24 10.1.1.2 0 100 0 65001 i What does this output indicate?

A.The VRF CUSTOMER has two routes learned via BGP from AS 65001.
B.The routes are redistributed from OSPF into BGP within the VRF.
C.The VRF is not receiving any routes because of a redistribution issue.
D.The routes are locally originated within the VRF.
AnswerA

The output shows two routes with next hop 10.1.1.2 and AS path 65001.

Why this answer

The show ip bgp vpnv4 vrf output shows routes in a VRF. The routes are learned from neighbor 10.1.1.2 with AS path 65001. This indicates that the VRF is receiving routes via BGP, possibly from a PE router.

If redistribution is expected from another protocol into BGP within the VRF, these routes may be the result.

Full explanation →
1173
MCQeasy

Which statement about PBR and the 'set ip precedence' command is correct?

A.It sets the DSCP value.
B.It can only be used with 'set ip next-hop'.
C.It modifies the IP header of the packet.
D.It is used for load-balancing.
AnswerC

The command changes the ToS field in the IP header.

Why this answer

The 'set ip precedence' command sets the IP precedence bits in the Type of Service (ToS) field of the IP header, which can be used for QoS classification.

Full explanation →
1174
MCQeasy

Which of the following is true about the SPAN source interface configuration?

A.By default, both ingress and egress traffic are monitored.
B.By default, only ingress traffic is monitored.
C.By default, only egress traffic is monitored.
D.The direction must always be specified; there is no default.
AnswerB

When configuring a SPAN source interface without specifying direction, only ingress traffic is mirrored.

Why this answer

A SPAN source interface can be configured to monitor both ingress and egress traffic, or either direction. By default, only ingress traffic is monitored if no direction is specified.

Full explanation →
1175
MCQmedium

A network engineer runs the following command on Router R3: R3# show ip route 172.16.1.0 Routing entry for 172.16.1.0/24 Known via "bgp 65000", distance 20, metric 0 Redistributing via bgp 65000 Last update from 192.168.1.1 00:00:15 ago Routing Descriptor Blocks: * 192.168.1.1, from 192.168.1.1, 00:00:15 ago Route metric is 0, traffic share count is 1 Based on this output, what can be concluded about the administrative distance?

A.The route is an iBGP route with a manually configured distance of 20.
B.The route is an eBGP route, as the distance 20 is the default for eBGP.
C.The route is redistributed from OSPF into BGP.
D.The administrative distance of 20 is non-standard and must have been changed.
AnswerB

eBGP routes have a default administrative distance of 20, matching this output.

Why this answer

The default administrative distance for BGP is 20 for eBGP routes and 200 for iBGP routes. A distance of 20 indicates this is an eBGP route. The metric of 0 is typical for eBGP routes.

Full explanation →
1176
MCQhard

In a VRF-Lite environment running EIGRP, what is the default hello timer value on a Frame Relay multipoint interface?

A.5 seconds
B.10 seconds
C.60 seconds
D.30 seconds
AnswerC

EIGRP defaults to a 60-second hello timer on low-speed NBMA interfaces (e.g., Frame Relay multipoint with bandwidth < T1).

Why this answer

By default, EIGRP uses a hello timer of 60 seconds on NBMA networks with bandwidth less than T1, including Frame Relay multipoint interfaces, and 5 seconds on high-speed NBMA links.

Full explanation →
1177
MCQhard

A company uses IP SLA to track a route to a remote network via a DMVPN tunnel. Router R1 (hub) has: ip sla 5 icmp-echo 172.16.0.1 source-ip 10.0.0.1 frequency 10 ip sla schedule 5 life forever start-time now track 5 ip sla 5 reachability ip route 192.168.1.0 255.255.255.0 Tunnel0 track 5 Tunnel0 is a DMVPN tunnel to spoke R2. The tunnel is up, but the route is intermittently removed. Show output on R1: show ip route 192.168.1.0 % Subnet not in table show track 5 Track 5 IP SLA 5 reachability Reachability is Down 2 changes, last change 00:00:05 What is the root cause?

A.The source IP of the IP SLA probe is not the tunnel source, so the probe is sent out the physical interface and does not reach the destination.
B.The DMVPN tunnel is down because the spoke is not reachable.
C.The IP SLA frequency is too low, causing the track to go down after 10 seconds of no response.
D.The route is removed because the track is down, but the track is down due to a routing loop in the DMVPN network.
AnswerA

The probe should be sourced from the tunnel source IP to ensure it goes through the tunnel; otherwise, it may be dropped or not reach the target.

Why this answer

The IP SLA probe is sent to 172.16.0.1, which is the tunnel IP of R2. However, the DMVPN tunnel might be using a different encapsulation (e.g., mGRE) and the probe might be sent over the physical interface instead of the tunnel, or the tunnel might be in a VRF. The correct answer is that the IP SLA probe is sourced from 10.0.0.1, which is not the tunnel source, so the probe goes out the physical interface and may not reach 172.16.0.1, causing the track to go down.

Full explanation →
1178
MCQhard

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

A.The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.
B.The ACL is blocking the multicast traffic because the source address is not permitted.
C.The multicast routing is not enabled globally.
D.The downstream receivers are not in the multicast group.
AnswerA

Correct because multicast uRPF requires the source address to be reachable via the receiving interface; otherwise, the packet is dropped to prevent spoofing.

Why this answer

With uRPF strict mode enabled, the router checks that the source address of the incoming packet is reachable via the same interface on which the packet was received. Since the route to 2001:db8:1::1 points out a different interface, the uRPF check fails and the packet is dropped before any multicast forwarding can occur. This explains why the multicast traffic is not forwarded to downstream receivers despite the ACL permitting the group address.

Exam trap

The trap here is that candidates often focus on the ACL or multicast configuration and overlook the uRPF strict mode check, which silently drops packets before multicast forwarding logic is applied.

How to eliminate wrong answers

Option B is wrong because the ACL permits the group address FF1E::1, and IPv6 multicast ACLs filter on the destination (group) address, not the source address; the source address 2001:db8:1::1 is irrelevant to the ACL match. Option C is wrong because if multicast routing were not enabled globally, the router would not be receiving multicast traffic at all, and the engineer would likely see no multicast routes or PIM neighbors. Option D is wrong because the downstream receivers' membership in the multicast group is irrelevant to the forwarding failure; the issue is that the router drops the packet due to uRPF before it can even consult the multicast forwarding table.

Full explanation →
1179
MCQmedium

What is the default timeout value for a NAT translation entry that is not using Port Address Translation (PAT) in Cisco IOS?

A.60 seconds
B.300 seconds
C.86400 seconds
D.3600 seconds
AnswerC

Correct. Basic NAT translations default to 24 hours (86400 seconds) in Cisco IOS.

Why this answer

The default timeout for a NAT translation entry without Port Address Translation (PAT) in Cisco IOS is 86400 seconds (24 hours). This is because a one-to-one NAT mapping is expected to remain stable for extended periods, unlike PAT entries which time out quickly (e.g., 60 seconds for UDP, 86400 seconds for TCP) due to port reuse. The 86400-second value ensures that the translation persists for long-lived sessions without unnecessary churn.

Exam trap

Cisco often tests the distinction between PAT and non-PAT timeout defaults, trapping candidates who confuse the 86400-second timeout for TCP PAT entries with the non-PAT timeout, or who mistakenly recall the 60-second UDP PAT timeout as the default for all translations.

How to eliminate wrong answers

Option A is wrong because 60 seconds is the default timeout for UDP NAT entries when using PAT, not for non-PAT translations. Option B is wrong because 300 seconds (5 minutes) is the default timeout for DNS or other short-lived NAT entries, not for static-like non-PAT mappings. Option D is wrong because 3600 seconds (1 hour) is a common timeout for TCP NAT entries with PAT, but the non-PAT default is significantly longer at 86400 seconds.

Full explanation →
1180
MCQeasy

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

A.The ACE defaults to 'permit ipv6'.
B.The ACE is invalid and ignored.
C.The ACE defaults to 'deny ipv6'.
D.The ACE matches all IPv6 traffic.
AnswerB

Cisco IOS requires a protocol in each IPv6 ACL entry; without it, the entry is invalid.

Why this answer

In IPv6, an access-list entry (ACE) that does not specify a protocol is considered invalid and is ignored by the router. This is because the IPv6 access-list syntax requires a protocol keyword (e.g., tcp, udp, icmp, or a protocol number) to define the match criteria; without it, the ACE cannot be parsed correctly and is treated as a configuration error, not a default permit or deny.

Exam trap

Cisco often tests the misconception that an ACE without a protocol defaults to 'permit ipv6' or 'deny ipv6', similar to how IPv4 ACLs handle missing protocol fields, but in IPv6 the entry is simply invalid and ignored.

How to eliminate wrong answers

Option A is wrong because an ACE without a protocol does not default to 'permit ipv6'; IPv6 ACLs require an explicit protocol keyword, and omitting it results in an invalid entry, not a default permit. Option C is wrong because the ACE does not default to 'deny ipv6'; the implicit deny at the end of the ACL is separate, but a malformed ACE without a protocol is ignored entirely, not treated as a deny. Option D is wrong because the ACE does not match all IPv6 traffic; matching all traffic requires the 'ipv6' keyword explicitly, and omitting the protocol makes the ACE syntactically invalid, not a catch-all.

Full explanation →
1181
Multi-Selectmedium

Which TWO commands verify the operational status and packet statistics of a Control Plane Policing (CoPP) policy on a Cisco IOS-XE device? (Choose TWO.)

Select 2 answers
A.show policy-map control-plane
B.show control-plane host open-ports
C.show ip interface brief
D.show access-lists
E.show running-config | section policy-map
AnswersA, B

This command displays the CoPP policy applied to the control plane and per-class packet counters, essential for verifying CoPP operation.

Why this answer

The 'show policy-map control-plane' command displays the applied CoPP policy, including per-class match counters and action statistics (e.g., number of packets dropped or forwarded). This directly verifies that the policy is active and processing traffic as configured.

Exam trap

Cisco often tests the distinction between configuration verification ('show running-config') and operational verification ('show policy-map control-plane'), trapping candidates who think viewing the config is sufficient to confirm live packet statistics.

Full explanation →
1182
MCQmedium

A network engineer runs the following command on switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source Ports : RX Only : Gi0/6 Destination Ports : Gi0/7 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A.The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.
B.The session is an ERSPAN destination session because it uses RX only.
C.The session is a local SPAN session with source port Gi0/6.
D.The session is misconfigured because the destination port has ingress disabled.
AnswerA

The type 'Remote Destination Session' confirms RSPAN destination, with Gi0/6 as source and Gi0/7 as destination.

Why this answer

This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.

Full explanation →
1183
Multi-Selecthard

Which TWO statements about IPv6 First Hop Security (FHS) Device Tracking are true? (Choose TWO.)

Select 2 answers
A.Device Tracking uses Neighbor Discovery (ND) probes to determine if a host is still reachable.
B.Device Tracking relies on DHCPv6 lease expiration to remove stale bindings.
C.Device Tracking creates binding entries for hosts that are discovered via ND.
D.Device Tracking can be enabled on a per-interface basis using the 'ipv6 device-track' command.
E.Device Tracking only supports IPv6 hosts.
AnswersA, D

Correct. Device Tracking sends ND probes to verify host reachability and updates the binding table accordingly.

Why this answer

Device Tracking uses Neighbor Discovery (ND) probes (e.g., Neighbor Solicitations) to actively verify whether a host is still reachable on the link. This mechanism allows the switch to detect host movement or disconnection and update its binding table accordingly, ensuring that security features like RA Guard and DHCP Guard apply to the correct host state.

Exam trap

Cisco often tests the misconception that Device Tracking only works with IPv6, when in fact it supports both IPv6 and IPv4 hosts, and the 'ipv6 device-track' command is simply the interface-level enablement for IPv6 tracking.

Full explanation →
1184
MCQmedium

Examine the following CoPP configuration on a Cisco IOS-XE router: !--- ACL to match traffic access-list 100 permit tcp any any eq 22 access-list 100 permit tcp any any eq 23 access-list 100 permit icmp any any echo ! !--- Class-map class-map match-all COPP-MGMT match access-group 100 ! !--- Policy-map policy-map COPP-POLICY class COPP-MGMT police 8000 conform-action transmit exceed-action drop class class-default police 64000 conform-action transmit exceed-action drop ! !--- Apply to control-plane control-plane service-policy input COPP-POLICY What is the effect of this configuration?

A.SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.
B.Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.
C.All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.
D.The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.
AnswerA

Correct. The class COPP-MGMT matches the ACL traffic and applies a 8000 bps policer. The class-default applies a 64000 bps policer to all other traffic.

Why this answer

The CoPP configuration matches SSH (TCP/22), Telnet (TCP/23), and ICMP echo (ping) traffic via ACL 100 and class-map COPP-MGMT, then applies a police rate of 8000 bps to that class. All other control-plane traffic falls into class-default and is policed at 64000 bps. The 'conform-action transmit exceed-action drop' statements enforce rate-limiting, not blocking, so the correct effect is that SSH, Telnet, and ICMP echo are rate-limited to 8000 bps, while all other control-plane traffic is rate-limited to 64000 bps.

Exam trap

Cisco often tests the misconception that ICMP echo is not matched by ACL 100 because it uses the 'echo' keyword rather than a port number, but 'echo' is a valid ICMP type that matches ping requests, so candidates may incorrectly assume only TCP traffic is affected.

How to eliminate wrong answers

Option B is wrong because ICMP echo is explicitly matched by ACL 100 (permit icmp any any echo) and falls into the COPP-MGMT class, so it is rate-limited to 8000 bps, not unaffected. Option C is wrong because class-default does not override the COPP-MGMT class; CoPP processes packets sequentially through the policy-map, matching the first class first, so COPP-MGMT traffic is policed at 8000 bps before class-default is considered. Option D is wrong because there is no requirement that a class-map be named 'COPP-CLASS'; the class-map name 'COPP-MGMT' is arbitrary and valid as long as it matches the name used in the policy-map.

Full explanation →
1185
MCQhard

In Cisco IOS, what is the default IKEv1 phase 1 authentication method when using a pre-shared key and no explicit authentication is configured?

A.RSA encrypted nonces
B.Pre-shared key
C.Digital signatures (RSA-SIG)
D.No default; authentication must be explicitly set
AnswerB

IOS defaults to pre-shared key authentication when not specified.

Why this answer

When no explicit authentication method is configured for IKEv1 phase 1 and a pre-shared key is used, Cisco IOS defaults to 'pre-shared key' authentication. This is because the pre-shared key itself defines the authentication mechanism; the router automatically selects the appropriate authentication method based on the configured key material.

Exam trap

Cisco often tests the misconception that authentication must always be explicitly configured, leading candidates to choose 'No default' when in fact the default is pre-shared key for pre-shared key configurations.

How to eliminate wrong answers

Option A is wrong because RSA encrypted nonces is a distinct IKEv1 authentication method that requires explicit configuration using the 'authentication rsa-encr' command; it is not the default when a pre-shared key is used. Option C is wrong because digital signatures (RSA-SIG) require a PKI certificate and the 'authentication rsa-sig' command; it is never the default for pre-shared key configurations. Option D is wrong because Cisco IOS does have a default authentication method for IKEv1 when a pre-shared key is configured; the default is pre-shared key, so authentication does not need to be explicitly set.

Full explanation →
1186
MCQeasy

Which of the following is a mandatory field in a Flexible NetFlow flow record for IPv4 traffic?

A.Destination port
B.Protocol type
C.Source IP address
D.TCP flags
AnswerC

Correct. The source IP address is mandatory for IPv4 flow records.

Why this answer

The source IP address is a mandatory field in any IPv4 flow record; other fields like destination port are optional.

Full explanation →
1187
Multi-Selecthard

Which TWO configuration changes are required to enable inter-VRF route leaking between VRF A and VRF B using static routes? (Choose TWO.)

Select 2 answers
A.Configure a static route in VRF B with the 'vrf A' keyword to specify the source VRF for the next-hop.
B.Use the 'ip route vrf B <prefix> <mask> <next-hop> source-vrf A' command syntax.
C.The next-hop IP address must be the interface address of the destination VRF.
D.The next-hop IP address must be reachable in the source VRF (VRF A).
E.A dynamic routing protocol must be configured in both VRFs to redistribute the leaked routes.
AnswersA, D

Correct. Example: 'ip route vrf B 10.1.2.0 255.255.255.0 10.1.1.1 vrf A' leaks the route from VRF A to VRF B.

Why this answer

Route leaking between VRFs can be done using static routes with the 'global' or 'vrf' keywords. To leak a route from VRF A to VRF B, you configure a static route in VRF B pointing to the next-hop in VRF A, and use the 'vrf' keyword to specify the source VRF. Option A is correct because the static route must specify the source VRF.

Option D is correct because the next-hop must be reachable in the source VRF. Option B is incorrect because the 'ip route' command does not use 'source-vrf'; it uses 'vrf'. Option C is incorrect because the destination network is the one being leaked, not the next-hop.

Option E is incorrect because route leaking does not require a routing protocol; static routes are sufficient.

Full explanation →
1188
MCQmedium

Examine this configuration snippet: ``` router rip distance 120 ``` Which statement is true about the effect of this command?

A.It changes the administrative distance for RIP routes to 120, which is the same as the default, so no change occurs.
B.It changes the administrative distance for RIP routes to 120, which is lower than the default of 130.
C.It changes the administrative distance for RIP routes to 120, but only for routes learned from RIP neighbors.
D.It changes the administrative distance for RIP routes to 120, but only for routes with a hop count greater than 1.
AnswerA

RIP default AD is 120, so setting it to 120 has no effect.

Why this answer

The `distance` command under RIP sets the administrative distance for all RIP routes to 120, overriding the default of 120? Actually default is 120, so this command would have no effect if set to the same value.

Full explanation →
1189
MCQhard

An engineer configures mutual redistribution between OSPF and EIGRP without route tagging. After convergence, some routes oscillate between the two protocols. What is the most likely explanation?

A.Routes redistributed from OSPF into EIGRP are re-redistributed back into OSPF, and the OSPF route is preferred over the original due to administrative distance, causing a loop.
B.The seed metric for EIGRP is not set, so redistributed routes are dropped.
C.OSPF has a higher administrative distance than EIGRP, so OSPF routes are always preferred.
D.The 'redistribute ospf' command under EIGRP automatically sets a tag, preventing loops.
AnswerA

Without tagging, the router cannot distinguish between the original and redistributed route, leading to feedback loops.

Why this answer

Without route tagging, redistributed routes can be re-injected back into the original protocol, creating a routing loop. The administrative distance comparison can cause the route to be preferred from the wrong protocol, leading to oscillation.

Full explanation →
1190
Multi-Selecthard

Which TWO statements correctly describe the behavior of Control Plane Policing (CoPP) when applied to a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.CoPP policies are applied using the Modular QoS CLI (MQC) and can be attached to the control-plane interface with the 'service-policy input' command.
B.CoPP can be applied to the aggregate control plane or separately to the IPv4, IPv6, and MPLS control plane subinterfaces.
C.CoPP policies are applied using the 'policy-map' command under the interface configuration mode for each physical interface.
D.CoPP polices all traffic that enters the router, including traffic that is process-switched after being forwarded.
E.CoPP uses the 'class-map' command to match traffic based on ACLs, NBAR, or DSCP values, and the 'police' command to enforce rate limits.
AnswersA, B

Correct. CoPP uses MQC class-maps and policy-maps, and is applied under the control-plane configuration with 'service-policy input'.

Why this answer

CoPP uses the Modular QoS CLI (MQC) framework, where a policy-map is created with class-maps and actions, and then applied to the control-plane interface using the 'service-policy input' command. This attaches the policy to the control plane, filtering traffic destined to the router's CPU before it is process-switched.

Exam trap

Cisco often tests the distinction between CoPP applying to the control plane (CPU-bound traffic) versus applying to all traffic entering the router, and the trap here is that candidates mistakenly think CoPP polices all forwarded traffic, when it only polices traffic destined to the control plane.

Full explanation →
1191
MCQeasy

Which statement about PBR and the 'match ip address' command is correct?

A.It can only match on source IP addresses.
B.It can reference a named or numbered ACL.
C.It can match on MAC addresses.
D.It matches packets before routing table lookup.
AnswerB

Both named and numbered ACLs are supported.

Why this answer

The 'match ip address' command references an access-list (standard or extended) to match packets based on source/destination IP addresses.

Full explanation →
1192
MCQmedium

Which statement about the SPAN destination port behavior is correct?

A.The SPAN destination port operates in full-duplex mode by default.
B.The SPAN destination port can participate in Spanning Tree Protocol (STP) if configured.
C.The SPAN destination port is automatically placed in a forwarding state and does not run STP.
D.The SPAN destination port can be used as a normal switch port after removing the SPAN configuration.
AnswerC

The destination port is put into a forwarding state and STP is disabled to avoid loops; it only transmits mirrored traffic.

Why this answer

By default, a SPAN destination port does not participate in any Layer 2 protocols (like STP, CDP, DTP) and does not forward or receive normal traffic; it only transmits mirrored packets.

Full explanation →
1193
MCQhard

A network engineer runs the following command on Router R1: R1# show flow monitor FLOW-MONITOR-1 cache format table Cache type: Normal Cache size: 1000 Current entries: 0 High Watermark: 0 Flows added: 0 Flows aged: 0 - Active timeout (1800 secs) 0 - Inactive timeout (15 secs) 0 - Event aged 0 - Watermark aged 0 - Emergency aged 0 R1# show flow interface GigabitEthernet0/1 Interface GigabitEthernet0/1 FNF: monitor Monitor: FLOW-MONITOR-1 direction: Input traffic-statistics: enabled Based on both outputs, what is the most likely problem?

A.The flow monitor is attached, but no traffic is flowing through the interface.
B.The flow monitor is not attached to the interface.
C.The cache size is too small.
D.The flow exporter is misconfigured.
AnswerA

The monitor is correctly applied, but 0 flows added indicates no packets are being processed, likely due to no traffic.

Why this answer

The flow monitor is attached to the interface, but the cache shows 0 flows added. This suggests that no traffic is being received on that interface, or the flow record does not match any packets (e.g., record type mismatch).

Full explanation →
1194
Multi-Selecthard

Which TWO statements about IPsec transform sets and security associations (SAs) are true? (Choose TWO.)

Select 2 answers
A.A transform set can specify ESP encryption and ESP authentication simultaneously.
B.In tunnel mode, the original IP header is preserved and a new IP header is added.
C.Transport mode adds a new IP header to the packet.
D.The command 'crypto ipsec security-association lifetime' sets the IKE SA lifetime.
E.A single IPsec SA provides bidirectional secure communication.
AnswersA, B

Correct. For example, 'transform-set myset esp-aes esp-sha-hmac' provides both.

Why this answer

An IPsec transform set can specify both ESP encryption (e.g., AES) and ESP authentication (e.g., HMAC-SHA256) simultaneously. This is a standard configuration where ESP provides both confidentiality and integrity/authentication in a single transform set, as defined in RFC 4303.

Exam trap

Cisco often tests the misconception that a single SA is bidirectional, but in reality, IPsec SAs are unidirectional and must be paired for two-way communication.

Full explanation →
1195
MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show ip eigrp topology 10.0.0.0/16 IP-EIGRP topology entry for 10.0.0.0/16 State is Passive, Query origin flag is 1, 1 Successor(s), FD is 128576 Routing Descriptor Blocks: 10.1.1.2 (Serial0/0/0), from 10.1.1.2, Send flag is 0x0 Composite metric is (128576/156160), Route is Internal Vector metric: Minimum bandwidth is 10000 Kbit Total delay is 2000 microseconds Reliability is 255/255 Load is 1/255 Minimum MTU is 1500 Hop count is 2 What does this output indicate?

A.The summary route 10.0.0.0/16 is installed in the routing table and reachable via 10.1.1.2.
B.The summary route is in active state, indicating a query is in progress.
C.The summary route is not being advertised because the FD is too high.
D.The summary route is learned via redistribution, not summarization.
AnswerA

The output shows a valid successor and passive state, confirming the route is installed and reachable.

Why this answer

This output shows the EIGRP topology table entry for the summary route 10.0.0.0/16. The state is Passive, meaning the route is stable and reachable. The presence of a successor and the metric details indicate that the summary route is being advertised and learned via EIGRP.

Full explanation →
1196
MCQmedium

A network engineer runs the following command to verify DMVPN tunnel status: R1# show ip nhrp detail 10.0.0.2/32 via Tunnel0 Created: 00:10:15, Expire: 01:49:45 Type: dynamic, Flags: unique registered NBMA: 192.168.1.2 (no socket) What does this output indicate?

A.The spoke 10.0.0.2 has registered with the hub and its NBMA address is 192.168.1.2.
B.The spoke 10.0.0.2 is using a static NBMA mapping.
C.The NHRP entry is about to expire and needs re-registration.
D.The spoke has not registered; the entry is incomplete.
AnswerA

Correct: The entry is dynamic, unique, registered, and shows the NBMA address.

Why this answer

The output shows a dynamic NHRP cache entry for a spoke (10.0.0.2) with NBMA address 192.168.1.2, indicating the spoke has registered and the entry is valid.

Full explanation →
1197
MCQhard

An engineer configures an EEM applet to monitor DMVPN tunnel events using the event syslog pattern 'NHRP-3-REGISTRATION'. The applet is supposed to send an email when a spoke registers with the NHS. The DMVPN network uses Phase 2 with spoke-to-spoke tunnels. A spoke registers successfully, but the EEM applet does not trigger. Which is the most likely explanation?

A.Successful NHRP registration generates a syslog message with severity 6 (informational), not severity 3 (error).
B.The EEM applet must be configured with 'event nhrp' to capture NHRP events.
C.The DMVPN Phase 2 does not generate syslog messages for spoke registration.
D.The NHS must be configured with 'ip nhrp registration no-syslog' to suppress messages.
AnswerA

Correct. The pattern 'NHRP-3-REGISTRATION' is for errors; successful registration uses 'NHRP-6-REGISTRATION'.

Why this answer

In DMVPN Phase 2, spoke-to-spoke tunnels are established dynamically, but the NHRP registration event generates a syslog message only when the spoke registers with the NHS. However, the syslog pattern 'NHRP-3-REGISTRATION' is for error-level messages, while successful registration generates an informational message (NHRP-6-REGISTRATION). The EEM applet is looking for severity level 3, but the actual syslog is severity level 6, so the pattern does not match.

Full explanation →
1198
MCQmedium

A network engineer runs the following command to troubleshoot DHCPv6 address assignment on router R1: R1# show ipv6 dhcp binding Output: Client: FE80::21A:2BFF:FE3C:4D01 DUID: 0003000121A2B3C4D5E6 Username: unassigned VRF: default IA NA: IA ID 0x00040001, T1 302400, T2 483840 Address: 2001:DB8:1::100 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 01 2025 12:00 PM (2592000 seconds) IA PD: IA ID 0x00040002, T1 302400, T2 483840 Prefix: 2001:DB8:1::/48 Preferred lifetime 604800, valid lifetime 2592000 Expires at Mar 01 2025 12:00 PM (2592000 seconds) What does this output indicate?

A.The DHCPv6 server has assigned only an IPv6 address to the client.
B.The DHCPv6 server has assigned both an IPv6 address and a prefix delegation to the client.
C.The DHCPv6 client is using stateless autoconfiguration (SLAAC) because no address is shown.
D.The DHCPv6 server has a pool with only one prefix available.
AnswerB

The IA NA section shows an address assignment, and the IA PD section shows a prefix delegation, both with lifetimes.

Why this answer

The output shows both an IA_NA (Identity Association for Non-temporary Address) with an IPv6 address (2001:DB8:1::100) and an IA_PD (Identity Association for Prefix Delegation) with a prefix (2001:DB8:1::/48). This confirms that the DHCPv6 server has assigned both a global unicast address and a delegated prefix to the client, making option B correct.

Exam trap

Cisco often tests the distinction between IA_NA (address assignment) and IA_PD (prefix delegation), and candidates may overlook the IA_PD section, assuming only an address was assigned.

How to eliminate wrong answers

Option A is wrong because the output clearly includes an IA_PD section with a delegated prefix, not just an IPv6 address. Option C is wrong because SLAAC does not use DHCPv6 binding entries; the output shows DHCPv6-assigned addresses and prefixes, not stateless autoconfiguration. Option D is wrong because the output shows only one prefix assigned to this client, but it does not indicate the total number of prefixes available in the pool; the pool could have many prefixes.

Full explanation →
1199
MCQmedium

What is the default behavior of an IPv4 ACL regarding the order of evaluation when multiple entries match a packet?

A.The most specific entry is used regardless of order.
B.The first matching entry in the list is applied.
C.All matching entries are evaluated and the most permissive action is taken.
D.The last matching entry in the list overrides earlier ones.
AnswerB

Cisco ACLs process entries in order; the first match wins.

Why this answer

Cisco IOS processes IPv4 ACL entries in sequential order, from top to bottom. When a packet matches an entry, the associated permit or deny action is applied immediately, and no further entries are evaluated. This first-match rule is fundamental to ACL design and troubleshooting.

Exam trap

Cisco often tests the misconception that ACLs use longest-prefix matching like routing tables, but ACLs strictly use first-match order, not specificity.

How to eliminate wrong answers

Option A is wrong because ACLs do not use longest-prefix or most-specific matching; they use first-match logic, regardless of specificity. Option C is wrong because ACL evaluation stops at the first match; it does not continue to evaluate all entries or combine actions. Option D is wrong because the first matching entry is applied, not the last; later entries are never reached if a match occurs earlier.

Full explanation →
1200
MCQhard

What is the default retransmission timeout for SNMP informs on a Cisco IOS device?

A.5 seconds
B.30 seconds
C.60 seconds
D.10 seconds
AnswerB

Cisco IOS defaults to a 30-second timeout for inform acknowledgments.

Why this answer

The default retransmission timeout for SNMP informs on Cisco IOS devices is 30 seconds, as specified by the Cisco SNMP configuration. This timeout controls how long the device waits for an acknowledgment (inform response) before retransmitting the inform request. Option B is correct because Cisco IOS uses a default timeout of 30 seconds for inform operations, which is distinct from the 5-second default for SNMP get/set requests.

Exam trap

Cisco often tests the distinction between default timeouts for SNMP informs (30 seconds) versus SNMP get/set requests (5 seconds), leading candidates to mistakenly choose 5 seconds.

How to eliminate wrong answers

Option A is wrong because 5 seconds is the default timeout for SNMP get and set requests, not for informs. Option C is wrong because 60 seconds is not a default SNMP timeout value on Cisco IOS; it may be a user-configured value but is not the default. Option D is wrong because 10 seconds is not the default retransmission timeout for SNMP informs; it is sometimes used for other SNMP operations like traps or for specific vendor implementations, but not for Cisco IOS informs.

Full explanation →
Page 15

Page 16 of 27

Page 17

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →