Knowledge + Practice

Cisco CCNP ENARSI 300-410 (300-410) — Questions 2101–2152

2152 questions total · 29pages · All types, answers revealed

Take a mock exam Exam hub

Page 29 of 29

2101

MCQmedium

A network engineer runs the following command to troubleshoot a Route Summarization issue: R1# show mpls ldp bindings 10.0.0.0/16 tib entry: 10.0.0.0/16, rev 1 local binding: label: 16 remote binding: lsr: 2.2.2.2:0, label: 17 What does this output indicate?

A.The summary route 10.0.0.0/16 has both a local and remote label binding, indicating MPLS LDP is operational for this prefix.

B.The summary route is not label-switched because no local binding exists.

C.The remote binding indicates that the route is not being summarized.

D.The label bindings are for the more specific /24 routes, not the summary.

AnswerA

The presence of both local and remote bindings confirms LDP is working for the summary route.

Why this answer

This output shows MPLS LDP label bindings for the prefix 10.0.0.0/16. There is a local label (16) and a remote label (17) from LSR 2.2.2.2. This indicates that the summary route is label-switched, and LDP has successfully assigned labels for it.

Full explanation →

2102

Multi-Selectmedium

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Select 2 answers

A.IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.

B.IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

C.The implicit deny at the end of an IPv6 ACL also blocks ICMPv6 neighbor discovery messages.

D.IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

E.IPv6 ACLs support the remark keyword for documentation.

AnswersA, C

Correct: The command is 'ipv6 traffic-filter' in interface configuration mode.

Why this answer

Option A is correct because the `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Exam trap

The trap here is that candidates often assume IPv6 ACLs behave like IPv4 ACLs in supporting wildcard masks and remarks, or that they automatically permit essential control-plane traffic like ICMPv6 neighbor discovery, leading to incorrect selections of options B, D, or E.

Full explanation →

2103

MCQmedium

Examine this IP SLA configuration on router R5: ip sla 50 icmp-echo 10.20.20.1 source-ip 192.168.10.1 frequency 10 ip sla schedule 50 life forever start-time now What is the effect of this configuration?

A.It will continuously monitor reachability to 10.20.20.1 from source 192.168.10.1.

B.It will stop after 10 successful replies.

C.It will measure jitter between the two IPs.

D.It will only work if 10.20.20.1 is directly connected.

AnswerA

This is the standard behavior of icmp-echo IP SLA.

Why this answer

The configuration creates an IP SLA operation that sends ICMP echo probes to 10.20.20.1 every 10 seconds, using source IP 192.168.10.1. It starts immediately and runs forever.

Full explanation →

2104

MCQmedium

In EIGRP, which metric component is disabled by default and must be explicitly enabled using the 'metric weights' command?

A.Reliability and load

B.Bandwidth and delay

C.MTU

D.Hop count

AnswerA

Reliability and load are disabled by default because their K-values (K4 for reliability and K2 for load) are set to 0. They must be explicitly enabled using the 'metric weights' command.

Why this answer

In EIGRP, the composite metric is calculated by default using bandwidth (K1) and delay (K3). Reliability (K4) and load (K2) are disabled by default (their K-values are set to 0). To enable them, you must use the 'metric weights' command to adjust the K-values (e.g., K2 for load and K4 for reliability).

Exam trap

Cisco often tests the misconception that all five K-values are active by default, when in fact only bandwidth and delay are used, and reliability and load require explicit configuration.

How to eliminate wrong answers

Option B is wrong because bandwidth and delay are the default metric components enabled in EIGRP, not disabled. Option C is wrong because MTU is never a component of the EIGRP metric; it is only used for path selection in certain routing protocols like OSPF. Option D is wrong because hop count is not a metric component in EIGRP; it is used in RIP.

Full explanation →

2105

MCQhard

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

A.The local enable password is not configured.

B.The RADIUS server is not configured to provide the enable password.

C.The 'aaa authentication enable default' command is missing the 'local' keyword.

D.The router's enable secret is set to a different password.

AnswerA

Correct because the enable authentication method list includes 'enable' as a fallback; if no local enable password is set, the fallback fails.

Why this answer

The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password.

If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Exam trap

Cisco often tests the distinction between the 'local' method (which uses the local username/password database) and the 'enable' method (which uses the enable password/secret), leading candidates to incorrectly assume that 'local' is needed as a fallback for enable authentication.

How to eliminate wrong answers

Option B is wrong because the RADIUS server being reachable does not guarantee it is configured to provide the enable password; however, the command explicitly includes 'group radius' as the primary method, so if the RADIUS server does not respond with success, the router falls back to the 'enable' method, not to local authentication. Option C is wrong because the 'enable' method in 'aaa authentication enable default' already implies using the local enable password (or enable secret), so adding 'local' is not valid syntax; the correct fallback method is 'enable', not 'local'. Option D is wrong because the 'enable secret' and 'enable password' are both local enable passwords; if either is set, the 'enable' method would use it, so the issue is that neither is configured, not that they are different.

Full explanation →

2106

MCQmedium

A network engineer is troubleshooting an MPLS L3VPN where CE1 (192.168.1.0/24) cannot reach CE2 (192.168.2.0/24). The PE routers are running OSPF with the CEs. On PE1, the VRF configuration includes route-target import and export 100:100. The show ip vrf detail command on PE1 shows the VRF is active, but the CE1 loopback is not present in the VRF routing table. The show ip route vrf CUSTOMER command on PE1 shows only directly connected interfaces. What is the most likely cause?

A.The route-target import on PE1 is misconfigured.

B.The OSPF process on PE1 is not configured under the VRF.

C.The CE1 interface is not in the VRF.

D.The MP-BGP session between PE1 and PE2 is down.

AnswerB

Correct: OSPF must be configured with 'router ospf <pid> vrf CUSTOMER' to populate the VRF routing table.

Why this answer

The CE routes are not being learned via OSPF into the VRF because OSPF process is not associated with the VRF. Without the 'router ospf <pid> vrf <name>' command, OSPF runs in the global routing table and does not populate the VRF.

Full explanation →

2107

MCQhard

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

A.iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors

B.The next-hop-self command is required for iBGP

C.The BGP synchronization rule is enabled

D.The routes are not valid because the next-hop is not reachable

AnswerA

Correct. iBGP does not advertise routes learned from one iBGP neighbor to another iBGP neighbor by default.

Why this answer

By default, iBGP routers do not advertise routes learned from one iBGP neighbor to another iBGP neighbor because of the split-horizon rule. This is a fundamental behavior to prevent routing loops, but it often catches engineers who expect iBGP to behave like eBGP. To overcome this, a route reflector or confederation must be used.

Full explanation →

2108

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 dhcp binding Client: FE80::1 DUID: 0003000100AABBCCDDEE Username: unknown IA NA: IA ID 0x00010001, T1 302400, T2 483840 Address: 2001:DB8:1::100/128 Preferred lifetime 604800, valid lifetime 2592000 Expires at Sep 15 2024 12:00 PM (2592000 seconds) Based on this output, which statement is correct?

A.The client has been assigned an IPv6 address via DHCPv6.

B.The client is using SLAAC instead of DHCPv6.

C.The client's lease has expired.

D.The client is not authorized.

AnswerA

The binding shows an IA NA with an assigned address.

Why this answer

The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Exam trap

Cisco often tests the distinction between stateful DHCPv6 and SLAAC by showing a DHCPv6 binding output, leading candidates to mistakenly think SLAAC is in use when the presence of an IA NA and assigned address clearly indicates DHCPv6.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows a DHCPv6 binding with an IA NA and assigned address, which is not present in SLAAC (Stateless Address Autoconfiguration) where addresses are derived from router advertisements and no DHCPv6 binding exists. Option C is wrong because the lease has not expired; the output shows a valid lifetime of 2592000 seconds with an expiration date of Sep 15 2024, indicating the lease is still active. Option D is wrong because the binding entry exists with an assigned address, meaning the client is authorized; an unauthorized client would not have a binding entry or would show a different status.

Full explanation →

2109

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip sla statistics 1 Round Trip Time (RTT) for Index 1 Latest RTT: 200 ms Latest RTT (milliseconds): 200 Latest RTT (microseconds): 200000 Number of successes: 50 Number of failures: 10 Operation time to live: Forever Output: Over threshold Based on this output, which statement is correct?

A.The IP SLA operation has failed due to a timeout.

B.The latest RTT has exceeded the configured threshold value.

C.The IP SLA operation is not reachable and has been disabled.

D.The IP SLA responder is not configured on the target device.

AnswerB

'Output: Over threshold' directly means the measured RTT was above the threshold set in the IP SLA configuration.

Why this answer

The 'Output: Over threshold' line indicates that the latest RTT exceeded the configured threshold. The number of failures (10) suggests some probes failed, but the key clue is the threshold violation. This does not necessarily mean the operation is down; it means a threshold event occurred.

Full explanation →

2110

MCQmedium

A network engineer runs the following command to verify NetFlow export destination: R1# show ip flow export Flow export v9 is enabled for main cache Export source and destination details : VRF ID : Default Destination(1) 192.168.1.100 (2055) Source IP 10.0.0.1 Origin AS 65000 Peer AS 65001 Mask for source 255.255.255.255 Mask for destination 255.255.255.255 Version 9 flow records 1234 flows exported in 567 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures What does this output indicate?

A.NetFlow export is failing due to adjacency issues.

B.NetFlow export is successful with 1234 flows exported and no errors.

C.NetFlow is using version 5 export.

D.The export destination is not configured.

AnswerB

All drop counters are zero, and 1234 flows have been successfully exported.

Why this answer

The output shows that NetFlow export is working correctly. It is exporting version 9 flows to destination 192.168.1.100 on port 2055, using source IP 10.0.0.1. There are no failures or drops, indicating successful export.

Full explanation →

2111

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- R1# show ip nat statistics Total active translations: 1 (0 static, 1 dynamic; 0 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 0 Misses: 0 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: -- Inside Source [Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240 refcount 1 map-id 1 [Id] ip nat inside source list ACL1 pool POOL1 refcount 1 Based on this output, what is the problem?

A.The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.

B.The NAT pool is exhausted.

C.PAT is misconfigured.

D.The inside and outside interfaces are reversed.

AnswerA

The translation is present but no packets have been processed. This could be a stale entry or lack of traffic.

Why this answer

The output shows a single dynamic NAT translation with zero hits and zero misses, meaning no traffic has attempted to traverse the NAT process. This indicates the translation entry exists (likely from a previous or idle session) but no packets have matched the access list or triggered translation since the counters were cleared. The problem is that the NAT configuration is in place but not actively translating any traffic.

Exam trap

Cisco often tests the misconception that a static translation entry in the NAT table implies active traffic flow, but the 'Hits: 0' counter reveals no packets have been translated, indicating the translation is idle or the ACL is not matching traffic.

How to eliminate wrong answers

Option B is wrong because the NAT pool (192.0.2.10–192.0.2.20) has 15 usable addresses, and only one translation is active (refcount 1), so the pool is far from exhausted. Option C is wrong because PAT (Port Address Translation) is not misconfigured; the output shows no extended translations (0 extended), and the pool uses standard dynamic NAT without overload, so PAT is not even configured here. Option D is wrong because the interfaces are correctly assigned: GigabitEthernet0/1 is the outside interface and GigabitEthernet0/0 is the inside interface, as shown in the statistics output, and the translation mapping (inside local 10.0.0.10 to inside global 192.0.2.10) is consistent with that orientation.

Full explanation →

2112

MCQhard

A network engineer is troubleshooting IPv6 DMVPN phase 2 spoke-to-spoke tunnel failures. Spoke routers are able to communicate with the hub, but direct spoke-to-spoke traffic is not working. Router R1 (spoke) has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ipv6 nhrp network-id 1 ipv6 nhrp nhs 2001:DB8:1::2 ipv6 nhrp map multicast dynamic ! Router R2 (hub) shows: show ipv6 nhrp brief output indicates that both spokes are registered. What is the root cause?

A.The tunnel mode is multipoint, but the spokes need to be configured with 'tunnel mode gre ip' for direct communication.

B.The hub is missing the 'ipv6 nhrp redirect' command, and the spokes are missing 'ipv6 nhrp shortcut'.

C.The spokes have different NHRP network IDs, preventing registration.

D.The IPv6 addresses on the tunnel interfaces are in different subnets.

AnswerB

Without redirect and shortcut, spokes do not learn each other's NHRP mappings and send traffic through the hub.

Why this answer

In DMVPN Phase 2, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to use NHRP shortcuts. Without 'ipv6 nhrp redirect' on the hub and 'ipv6 nhrp shortcut' on the spokes, the spokes will forward all inter-spoke traffic through the hub instead of establishing a direct tunnel. The hub's NHRP brief shows both spokes are registered, confirming NHRP registration works, but the missing redirect/shortcut mechanism prevents direct spoke-to-spoke communication.

Exam trap

Cisco often tests the distinction between DMVPN phases, and the trap here is that candidates assume NHRP registration alone enables spoke-to-spoke communication, overlooking the mandatory redirect/shortcut commands for Phase 2.

How to eliminate wrong answers

Option A is wrong because 'tunnel mode gre multipoint' is correct for DMVPN Phase 2 spokes; changing to 'tunnel mode gre ip' would disable multipoint and prevent dynamic spoke-to-spoke tunnels. Option B is correct as explained. Option C is wrong because the spokes are registered with the hub, which requires matching NHRP network IDs; different network IDs would prevent registration entirely.

Option D is wrong because the tunnel interfaces share the same /64 subnet (2001:DB8:1::/64), and IPv6 addressing is not the issue since spoke-to-hub communication works.

Full explanation →

2113

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip eigrp topology all-links EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.10.10.0/24, 1 successors, FD is 28160, Qos: 0 via 10.1.1.2 (28160/28160), GigabitEthernet0/0 via 10.2.2.2 (28672/28160), GigabitEthernet0/1 P 10.20.20.0/24, 1 successors, FD is 28160, Qos: 0 via 10.2.2.2 (28160/28160), GigabitEthernet0/1 via 10.3.3.2 (28672/28160), GigabitEthernet0/2 Based on this output, which statement is correct?

A.The network has redundant paths with feasible successors for both routes.

B.The route to 10.20.20.0/24 has no feasible successor.

C.The FD for 10.10.10.0/24 is 28672.

D.The route to 10.10.10.0/24 is in Active state.

AnswerB

This is correct. The feasibility condition requires RD < FD. For 10.20.20.0/24, both paths have RD = 28160 equal to FD, so they are not feasible successors. Thus there is no feasible successor.

Why this answer

Option B is correct. The EIGRP feasibility condition requires the reported distance (RD) to be strictly less than the feasible distance (FD) for a path to be a feasible successor. In the output, for route 10.20.20.0/24, the FD is 28160, and both paths have an RD of 28160, which equals the FD, not less.

Therefore, no feasible successor exists for this route. Option A is incorrect because neither route has a feasible successor. Option C is incorrect because the FD for 10.10.10.0/24 is 28160, not 28672.

Option D is incorrect because the route is marked 'Passive', not 'Active'.

Exam trap

Cisco often tests the distinction between the feasible distance (FD) and the metric of alternate paths, leading candidates to confuse the FD value with the composite metric of a non-successor route.

How to eliminate wrong answers

Option B is wrong because the route to 10.20.20.0/24 has a feasible successor via 10.3.3.2 (reported distance 28160 is less than the FD of 28160, satisfying the feasibility condition). Option C is wrong because the FD for 10.10.10.0/24 is 28160, not 28672 (the 28672 value is the composite metric of the second path, not the FD). Option D is wrong because the route to 10.10.10.0/24 is marked with 'P' (Passive), not 'A' (Active), indicating it is in a stable state, not performing route recomputation.

Full explanation →

2114

MCQhard

Router R1 is performing NAT for internal users to access the internet. The configuration includes: ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal hosts cannot reach a specific external server at 203.0.113.50. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 10.1.1.1 192.168.1.1 203.0.113.50 203.0.113.50. Debug ip nat shows 'NAT: translation failed (no buffer)'. What is the root cause?

A.The NAT translation table is full; clear the table with clear ip nat translation *.

B.The access-list 100 is misconfigured and blocking the server's IP.

C.The interface GigabitEthernet0/1 is down.

D.The external server is unreachable due to routing issues.

AnswerB

Correct. The ACL 100 is used to define which inside hosts are translated. If it does not permit the source IP 192.168.1.1, the NAT translation fails, and the debug shows 'no buffer'. Review and correct the ACL configuration.

Why this answer

The debug message 'NAT: translation failed (no buffer)' typically indicates a full NAT translation table, but the show ip nat translations output reveals only a single entry, contradicting that diagnosis. The most likely cause is that access-list 100 is misconfigured, as it is used to match inside local addresses for translation. If the ACL does not permit the inside host's source IP (192.168.1.1), the router will not create a translation and may generate a generic 'no buffer' error.

Therefore, the root cause is a misconfigured ACL.

Exam trap

Cisco's 'no buffer' debug message is often associated with NAT table exhaustion, but candidates must verify the number of active translations. In this scenario, the single entry in the translation table indicates the table is not full, pointing to an ACL configuration issue instead.

How to eliminate wrong answers

Option B is wrong because the access-list 100 is used to match internal traffic for NAT, not to block specific servers; a misconfigured ACL would cause no translation at all or match wrong traffic, not a 'no buffer' error. Option C is wrong because if GigabitEthernet0/1 were down, NAT translations would not be created at all, and the debug would show 'interface down' or no translation attempts, not a buffer error. Option D is wrong because routing issues would manifest as 'destination unreachable' or timeouts, not a NAT-specific 'no buffer' failure; the debug explicitly points to NAT resource exhaustion.

Full explanation →

2115

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 100 Redistributing via ospf 1 Last update from 10.1.1.2 on GigabitEthernet0/1, 00:00:05 ago Routing Descriptor Blocks: * 10.1.1.2, from 10.1.1.2, 00:00:05 ago, via GigabitEthernet0/1 Route metric is 20, traffic share count is 1 Based on this output, what is the problem?

A.The route is an external OSPF route with metric 20, which is the default for Type 2 external routes.

B.The route is being redistributed back into OSPF, which could cause a routing loop if not filtered.

C.The forward metric is 100, which is the metric to the ASBR.

D.The route is learned from neighbor 10.1.1.2, which is the next hop.

AnswerB

Redistributing a route learned from OSPF back into OSPF without filtering can cause loops.

Why this answer

The output shows a route learned via OSPF with type extern 2 and metric 20. The route is also 'Redistributing via ospf 1', meaning this router is redistributing this route back into OSPF. This could cause a routing loop if the route is redistributed back into the same OSPF process from which it was learned.

The problem is that the route is being redistributed without filtering, potentially causing loops.

Full explanation →

2116

MCQmedium

Examine this IP SLA configuration on router R2: ip sla 20 udp-jitter 203.0.113.10 16384 source-ip 198.51.100.1 source-port 16384 frequency 30 ip sla schedule 20 life forever start-time now Which statement is true?

A.It measures one-way delay and jitter using UDP packets.

B.It measures only packet loss, not delay or jitter.

C.It uses TCP to measure round-trip time.

D.It sends ICMP echo requests to test connectivity.

AnswerA

UDP jitter operation measures delay, jitter, and packet loss.

Why this answer

The configuration measures UDP jitter by sending UDP packets to destination 203.0.113.10 on port 16384, sourced from 198.51.100.1 with source port 16384, every 30 seconds.

Full explanation →

2117

MCQhard

What is the default CoPP aggregate policer rate for control plane traffic on a Cisco IOS-XE device?

A.32000 bps

B.75000 bps

C.No default rate; CoPP is disabled by default

D.128000 bps

AnswerC

CoPP is not enabled by default on Cisco IOS-XE; the administrator must configure a policy-map and apply it to the control plane.

Why this answer

Cisco IOS-XE does not enable Control Plane Policing (CoPP) by default; it must be explicitly configured using the 'control-plane' command followed by 'service-policy' to attach a policy map. The absence of a default aggregate policer rate means that without CoPP configuration, the control plane is unprotected from traffic storms or DoS attacks. Options A, B, and D are incorrect because they suggest predefined rates that do not exist as defaults in Cisco IOS-XE.

Exam trap

Cisco often tests the misconception that CoPP has a built-in default policer rate, leading candidates to confuse it with the default hardware rate limits for control plane queues (e.g., on Catalyst switches) or with default values from other QoS features.

How to eliminate wrong answers

Option A is wrong because 32000 bps is not a default CoPP aggregate policer rate; CoPP has no default rate, and this value might be confused with a typical low-rate policer used in custom configurations. Option B is wrong because 75000 bps is not a default CoPP aggregate policer rate; this value is often associated with the default CoPP rate on some Cisco IOS (non-XE) platforms, but not on IOS-XE. Option D is wrong because 128000 bps is not a default CoPP aggregate policer rate; this value might be mistaken for the default hardware rate limit for certain control plane queues on some Catalyst switches, but it is not a CoPP default.

Full explanation →

2118

MCQmedium

A network engineer runs the following command on router R2: R2# show monitor session 4 Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100 Based on this output, which statement is correct?

A.The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.

B.The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.

C.The ERSPAN session is using RSPAN encapsulation.

D.The ERSPAN session is disabled because the status is 'Admin Enabled'.

AnswerA

The output clearly shows source port Gi0/0, destination IP 192.168.1.10, and ERSPAN ID 100.

Why this answer

This is an ERSPAN source session. It mirrors traffic from source port Gi0/0 and encapsulates it with an ERSPAN header, sending it to destination IP 192.168.1.10 with origin IP 10.0.0.2 and ERSPAN ID 100. The session is administratively enabled.

Full explanation →

2119

MCQmedium

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue: R1# show policy-map control-plane input class class-default Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit violated 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps, violated 0 bps What does this output indicate?

A.The CoPP policy is dropping all traffic due to a misconfigured CIR.

B.The CoPP policy is not matching any traffic, indicating a possible ACL or class-map misconfiguration.

C.The CoPP policy is working correctly and policing traffic at 1 Mbps.

D.The CoPP policy is only applied to the output direction.

AnswerB

The class-default matches all traffic, but zero packets have been seen, suggesting the policy may not be applied correctly or the interface is idle.

Why this answer

The output shows zero packets matched in class-default, meaning no traffic is being classified by the CoPP policy. This indicates a possible misconfiguration in the ACL or class-map that defines the traffic to be policed, causing the policy to be effectively inactive. A correctly configured CoPP policy would show non-zero packet counts for matched traffic.

Exam trap

Cisco often tests the misconception that zero packet counts in a CoPP policy indicate the policy is working correctly (e.g., no traffic is being dropped), when in fact it indicates a classification failure, such as a missing ACL or incorrect class-map configuration.

How to eliminate wrong answers

Option A is wrong because the CIR is configured at 1 Mbps and the policy is not dropping any traffic (violated 0 packets), so there is no evidence of a misconfigured CIR causing drops. Option C is wrong because the policy is not policing any traffic at all (0 packets matched), so it is not working correctly. Option D is wrong because the command 'show policy-map control-plane input' explicitly shows the input direction, and the output does not indicate any application to the output direction.

Full explanation →

2120

MCQhard

An enterprise uses EIGRP for IPv6 with route redistribution from a static route. R1 has a static route 2001:db8:0::/32 via Null0 redistributed into EIGRP. R2 receives this route and has a more specific route 2001:db8:1::/32 via a different interface. R2 has an IPv6 ACL applied inbound on the interface facing R1 that permits only EIGRP and denies all other traffic. R2's uRPF is configured in loose mode. Traffic from R2 to 2001:db8:2::1 fails. R2 shows 'show ipv6 route' has both routes, but 'show ipv6 cef' shows the summary route for 2001:db8:2::1 pointing to R1. What is the root cause?

A.The summary route 2001:db8:0::/32 on R1 points to Null0, causing traffic to be dropped at R1.

B.The ACL on R2 blocks the return traffic from R1, causing asymmetric routing.

C.uRPF loose mode drops the packet because the source address is not in the FIB.

D.EIGRP redistribution of the static route creates a routing loop between R1 and R2.

AnswerA

R2 forwards traffic to R1 based on the summary route, but R1's static route to Null0 drops it. The ACL is irrelevant to this failure.

Why this answer

The correct answer is A because R1's static route 2001:db8:0::/32 via Null0 is redistributed into EIGRP, and R2 learns this summary route. When R2 sends traffic to 2001:db8:2::1, the CEF table (show ipv6 cef) shows the longest prefix match for 2001:db8:2::1 is the summary 2001:db8:0::/32 pointing to R1, not the more specific 2001:db8:1::/32. R1 then forwards the packet to Null0 (a virtual interface that drops traffic), causing the failure.

The more specific route 2001:db8:1::/32 on R2 is not used because 2001:db8:2::1 does not fall within that prefix.

Exam trap

Cisco often tests the distinction between the routing table (RIB) and CEF (FIB), where candidates assume that a more specific route in the RIB will be used for forwarding, but CEF may use a different prefix if the destination does not match the more specific prefix exactly.

How to eliminate wrong answers

Option B is wrong because the ACL on R2 permits only EIGRP inbound from R1, but return traffic from R1 to R2 would be outbound from R1's perspective and inbound on R2's interface facing R1; however, the ACL is applied inbound on R2's interface facing R1, so it would filter traffic arriving from R1, but the issue is not about blocking return traffic—it's about CEF forwarding the packet to R1 due to the summary route. Option C is wrong because uRPF loose mode checks that the source address of the incoming packet is reachable in the FIB (i.e., has a route back to the source), but it does not drop packets if the source address is not in the FIB; loose mode only requires that the source address exists in the routing table, not that it uses the same interface. Option D is wrong because EIGRP redistribution of a static route to Null0 does not inherently create a routing loop; a loop would require R2 to re-advertise the route back to R1, but the summary route 2001:db8:0::/32 is not more specific than R1's own route, and R1's Null0 route prevents forwarding loops.

Full explanation →

2121

MCQmedium

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

A.The flow exporter is configured with the wrong destination IP address.

B.The flow monitor is not associated with any flow exporter.

C.The flow exporter is missing the 'source' interface command.

D.The flow cache is full, preventing new exports.

AnswerB

The monitor must be linked to an exporter using the 'exporter' command under the flow monitor configuration. Without it, no export occurs.

Why this answer

A flow exporter must be associated with the flow monitor. If the monitor does not reference the exporter, no data is exported even if flows are cached.

Full explanation →

2122

MCQeasy

A network engineer runs the following command on Router R1: R1# show bgp neighbors 10.1.12.2 received-routes BGP table version is 15, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.2.2.0/24 10.1.12.2 0 0 65002 i Total number of prefixes 1 Based on this output, what can be inferred about the BGP session?

A.The BGP session is not established.

B.The BGP session is established and the neighbor is advertising one prefix.

C.The BGP session is in Active state.

D.The BGP session is in Idle state.

AnswerB

The presence of a received route indicates the session is up and the neighbor is sending prefixes.

Why this answer

The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Full explanation →

2123

MCQhard

CoPP rate-limit is impacting legitimate traffic due to route summarization. Router R1 has: access-list 100 permit ip 10.0.0.0 0.0.3.255 any ! class-map match-all COPP-CLASS match access-group 100 ! policy-map COPP-POLICY class COPP-CLASS police 10000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY ! router eigrp 100 network 10.0.0.0 ! interface GigabitEthernet0/0 ip summary-address eigrp 100 10.0.0.0 255.255.252.0 ! R2 (10.0.1.1) sends EIGRP packets to R1, but they are being dropped. What is the root cause?

A.The CoPP policy matches EIGRP traffic from the summarized range and polices it, causing EIGRP packets to be dropped.

B.The summary route causes EIGRP to send packets to the control plane at a high rate, exceeding the policer.

C.EIGRP is not enabled on the interface, so packets are dropped.

D.The control-plane policy is applied in the wrong direction.

AnswerA

EIGRP packets are within the ACL range and are rate-limited.

Why this answer

The CoPP policy matches traffic from 10.0.0.0/22 and polices it to 10 kbps. EIGRP packets from R2 (10.0.1.1) are within this range and are subject to policing. If the EIGRP traffic rate exceeds 10 kbps, packets are dropped, causing neighbor flapping.

The summary route itself does not cause the drop, but the CoPP policy inadvertently includes EIGRP traffic. The fix is to create a separate class for EIGRP or adjust the ACL.

Full explanation →

2124

MCQmedium

Router R6 has the following configuration: ``` interface GigabitEthernet0/7 ip address 10.6.6.6 255.255.255.0 ! route-map PBR-MISS permit 10 match ip address 104 set ip next-hop 192.168.4.1 ! access-list 104 permit ip 10.6.6.0 0.0.0.255 192.168.0.0 0.0.255.255 ``` What is missing in this configuration?

A.The interface is missing the 'ip policy route-map PBR-MISS' command.

B.The route-map is missing a 'set interface' command.

C.The ACL is missing a 'deny any any' statement.

D.The route-map sequence number must be 1.

AnswerA

The interface already has the 'ip policy route-map PBR-MISS' command, so this is not missing.

Why this answer

The configuration shown includes the 'ip policy route-map PBR-MISS' command on the interface, making the policy routing active. The route-map and ACL are correctly configured. Therefore, no missing configuration element exists among the options.

Full explanation →

2125

MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 interface gigabitethernet 0/0 | include uRPF IPv6 uRPF: strict mode Based on this output, which statement is true?

A.uRPF is disabled

B.uRPF is enabled in strict mode

C.uRPF is enabled in loose mode

D.uRPF is enabled but only for multicast

AnswerB

The output confirms strict mode uRPF.

Why this answer

The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Exam trap

Cisco often tests the distinction between strict and loose uRPF modes, and the trap here is that candidates might confuse the 'strict mode' output with 'loose mode' or assume uRPF is disabled when the output line is present.

How to eliminate wrong answers

Option A is wrong because the output clearly states 'strict mode', which indicates uRPF is enabled, not disabled. Option C is wrong because the output specifies 'strict mode', not 'loose mode'; loose mode only checks that a route exists for the source address, regardless of the incoming interface. Option D is wrong because uRPF applies to unicast traffic, not multicast; multicast uses Reverse Path Forwarding (RPF) as part of protocols like PIM, but uRPF is specifically for unicast source address verification.

Full explanation →

2126

MCQeasy

In IPsec site-to-site VPN, what is the default IPsec SA lifetime in Cisco IOS?

A.86400 seconds and 256000 kilobytes

B.3600 seconds and 4608000 kilobytes

C.28800 seconds and 1000000 kilobytes

D.1800 seconds and 256000 kilobytes

AnswerB

This is the standard Cisco default for IPsec SA lifetime.

Why this answer

Option B is correct because the default IPsec Security Association (SA) lifetime in Cisco IOS for site-to-site VPNs is 3600 seconds (1 hour) and 4,608,000 kilobytes (4.5 GB). These values are defined in the IPsec transform set configuration and control when the SA expires, triggering a rekey via IKEv1 or IKEv2 to maintain secure communication.

Exam trap

Cisco often tests the distinction between the default IKE SA lifetime (86400 seconds) and the default IPsec SA lifetime (3600 seconds), causing candidates to confuse the two and select option A.

How to eliminate wrong answers

Option A is wrong because 86400 seconds (24 hours) is the default IKE (ISAKMP) SA lifetime, not the IPsec SA lifetime; the 256,000 kilobyte value is also incorrect for the default IPsec SA lifetime. Option C is wrong because 28800 seconds (8 hours) and 1,000,000 kilobytes are not default values; these might be seen in custom configurations or other vendors. Option D is wrong because 1800 seconds (30 minutes) is too short for the default IPsec SA lifetime, and 256,000 kilobytes is not the default traffic-based lifetime.

Full explanation →

2127

Multi-Selecthard

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Select 3 answers

A.IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.

B.IPv6 uRPF can be configured in strict mode or loose mode.

C.IPv6 uRPF is configured on a per-interface basis.

D.IPv6 uRPF checks the destination address of incoming packets.

E.IPv6 uRPF is used to filter multicast traffic.

AnswersA, B, C

Correct: uRPF checks the FIB to see if the source address is reachable via the incoming interface.

Why this answer

Option A is correct because IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.

Exam trap

Cisco often tests the distinction between source and destination address checking, leading candidates to incorrectly select that uRPF checks the destination address, when in fact it always validates the source address against the FIB.

Full explanation →

2128

MCQmedium

A network engineer runs the following command to troubleshoot an OSPF adjacency issue: R1# debug ip ospf adj *Mar 1 00:12:34.567: OSPF-1 ADJ RtrA: Interface GigabitEthernet0/0 going Up *Mar 1 00:12:34.568: OSPF-1 ADJ RtrA: 2 Way Communication to 10.1.1.2 on GigabitEthernet0/0, state 2WAY *Mar 1 00:12:34.570: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Our router ID 1.1.1.1, his router ID 2.2.2.2 *Mar 1 00:12:34.571: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Neighbor is not DR, state 2WAY *Mar 1 00:12:34.572: OSPF-1 ADJ RtrA: NBR 10.1.1.2: DR is 10.1.1.2, BDR is 10.1.1.1 *Mar 1 00:12:34.573: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Build the Start DBD *Mar 1 00:12:34.574: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Master/Slave negotiation done *Mar 1 00:12:34.576: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Exchange done, loading started *Mar 1 00:12:34.578: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Loading done *Mar 1 00:12:34.580: OSPF-1 ADJ RtrA: NBR 10.1.1.2: Full What does this output indicate?

A.The adjacency failed due to a mismatch in the DR election.

B.The adjacency formed successfully, and the neighbor is in Full state.

C.The adjacency is stuck in Exstart state due to MTU mismatch.

D.The neighbor is not the DR, so the adjacency will not form.

AnswerB

The sequence of messages shows all OSPF adjacency steps completing, ending with 'Full'.

Why this answer

The debug output shows the complete OSPF adjacency formation process from Down to Full state, indicating a successful adjacency.

Full explanation →

2129

MCQmedium

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

A.The 'logging on' command is not configured globally.

B.The syslog server is using UDP port 514, but the router is sending over TCP.

C.The 'logging source-interface' is set to a loopback that is not advertised in the routing table.

D.The 'logging buffered' command is overriding the remote logging configuration.

AnswerA

Correct because 'logging on' must be enabled to allow any syslog messages to be sent to a remote server. Without it, all syslog output is suppressed.

Why this answer

The 'logging on' command is required globally to enable syslog message generation on Cisco IOS-XE devices. Without it, the router will not send any log messages to any destination, including the configured syslog server at 10.1.1.100, even though the 'logging host' and 'logging trap debugging' commands are present. The successful ping confirms IP connectivity, so the issue is that logging is disabled at the global level.

Exam trap

Cisco often tests the 'logging on' command as a hidden prerequisite that candidates overlook, assuming that configuring 'logging host' alone is sufficient to start sending syslog messages.

How to eliminate wrong answers

Option B is wrong because by default Cisco routers send syslog messages over UDP port 514, and the 'logging host' command uses UDP unless 'logging host transport tcp' is explicitly configured; the scenario does not mention TCP configuration, so a port/protocol mismatch is unlikely. Option C is wrong because if the 'logging source-interface' were set to a loopback not advertised, the router would still attempt to send syslog packets using the best available source IP (usually the egress interface IP), and the ping to 10.1.1.100 succeeds, indicating routing is functional; a missing source-interface would not block all syslog messages. Option D is wrong because 'logging buffered' stores messages locally in a buffer and does not override or disable remote logging; both local and remote logging can coexist independently.

Full explanation →

2130

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf interface GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet Address 192.168.12.1/24, Area 0 Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State BDR, Priority 1 Designated Router (ID) 10.1.1.2, Interface address 192.168.12.2 Backup Designated router (ID) 10.1.1.1, Interface address 192.168.12.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:03 Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 10.1.1.2 (Designated Router) Suppress hello for 0 neighbor(s) Based on this output, which statement is correct?

A.Router R1 is the Designated Router on this segment.

B.Router R1 has a priority of 0, preventing it from becoming DR.

C.The dead timer is set to 40 seconds and is functioning correctly.

D.Router R1 is not receiving hello packets from the DR.

AnswerC

The dead interval is 40 seconds, and the hello timer is 10 seconds, which is standard. The adjacency is up, so timers are working.

Why this answer

The interface is in state BDR, meaning Router R1 is the backup designated router. The DR is 10.1.1.2. The output shows one neighbor, which is the DR, and the adjacency is full.

Full explanation →

2131

MCQmedium

Given the following configuration on a router: ``` router ospf 1 distance 150 ``` What is the effect of this configuration?

A.It sets the administrative distance for OSPF routes to 150, but only for intra-area routes.

B.It sets the administrative distance for OSPF routes to 150, overriding the default of 110.

C.It sets the administrative distance for OSPF external routes to 150.

D.It sets the administrative distance for OSPF routes to 150, but only for routes learned from a specific neighbor.

AnswerB

The default AD for OSPF is 110; this command changes it to 150.

Why this answer

This command sets the administrative distance for all OSPF routes to 150, overriding the default of 110.

Full explanation →

2132

MCQeasy

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla monitor statistics 10 Round Trip Time (RTT) for Index 10 Latest RTT: 12 ms Latest RTT (milliseconds): 12 Latest RTT (microseconds): 12000 Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021 Last operation return code: OK Number of successes: 100 Number of failures: 0 Operation time to live: Forever What does this output indicate?

A.The IP SLA monitor operation has failed because the return code is 'OK'.

B.The IP SLA monitor operation is functioning correctly with no failures.

C.The IP SLA monitor operation is not configured for index 10.

D.The IP SLA monitor operation has a timeout of 12 ms.

AnswerB

Zero failures and 'OK' return code confirm success.

Why this answer

This output is from the older 'ip sla monitor' command, which is equivalent to 'ip sla'. It shows the same statistics: 100 successes, 0 failures, and a return code of OK, indicating the probe is working.

Full explanation →

2133

MCQhard

A large enterprise network is experiencing intermittent reachability to a critical server (10.10.10.10). Router R1 has the following relevant configuration: ip sla 1 icmp-echo 10.10.10.10 source-ip 192.168.1.1 frequency 10 ip sla schedule 1 life forever start-time now track 1 ip sla 1 reachability delay down 5 up 5 ip route 0.0.0.0 0.0.0.0 192.168.1.2 track 1 Router R2 (the next-hop) shows: show ip route | include 10.10.10.10 S 10.10.10.0/24 [1/0] via 10.0.0.1 What is the root cause?

A.The IP SLA probe uses a source IP that is not reachable from the server, causing the probe to fail and the tracked route to be removed unnecessarily.

B.The frequency of the IP SLA is too high, causing the router to overload and drop the tracked route.

C.The delay down 5 up 5 is too short, causing flapping of the tracked route.

D.The server 10.10.10.10 is not responding to ICMP echo requests due to a firewall.

AnswerA

The source IP 192.168.1.1 may not be in the routing table of the server or intermediate routers, so echo replies never return, causing the track to go down.

Why this answer

The IP SLA probes are sourced from 192.168.1.1, but the server 10.10.10.10 is in a different subnet. The return path from the server might not reach 192.168.1.1 due to route summarization or asymmetric routing. However, the key issue is that the tracked default route is removed when the probe fails, but the probe failure could be due to the server's response not being routed back correctly, not because the next-hop is unreachable.

The correct answer is that the source IP of the probe is not routable from the server's perspective, causing false negatives.

Full explanation →

2134

MCQhard

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show ip interface brief | include Gi0/0 GigabitEthernet0/0 10.1.1.1 YES NVRAM up up R1# show monitor session 7 detail Session 7 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/1 Destination IP : 10.1.1.2 ERSPAN ID : 300 What does this output indicate?

A.The ERSPAN session is correctly configured and the destination IP is reachable.

B.The ERSPAN session is misconfigured because the source port must have an IP address.

C.The ERSPAN session is misconfigured because the destination IP must be on the same subnet as the source.

D.The ERSPAN session is misconfigured because the ERSPAN ID must be unique across all sessions.

AnswerA

The interface is up and the destination IP is likely reachable.

Why this answer

The output shows that interface Gi0/0 has IP address 10.1.1.1 and is up/up, and ERSPAN session 7 has destination IP 10.1.1.2. This indicates that the ERSPAN source session is configured to send traffic to 10.1.1.2, which is reachable via Gi0/0.

Full explanation →

2135

MCQmedium

Which LSA type is used by OSPF to advertise prefixes from other routing protocols (redistribution) and has a default metric of 20?

A.Type 1 LSA (Router LSA)

B.Type 3 LSA (Summary LSA)

C.Type 4 LSA (ASBR Summary LSA)

D.Type 5 LSA (AS-external LSA)

AnswerD

Correct. Type 5 LSAs carry external routes with a default metric of 20.

Why this answer

Type 5 AS-external LSAs are used to advertise external routes redistributed into OSPF. The default metric for these LSAs is 20, as defined by Cisco IOS.

Full explanation →

2136

MCQmedium

A network engineer configures a DMVPN spoke with OSPF as the routing protocol: interface Tunnel0 ip address 10.0.0.2 255.255.255.0 ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp map 10.0.0.1 192.168.1.1 ip nhrp map multicast 192.168.1.1 ! router ospf 1 network 10.0.0.0 0.0.0.255 area 0 ! What is a common issue with OSPF in this DMVPN Phase 2 configuration?

A.OSPF will elect a DR/BDR on the hub, which can cause suboptimal routing and adjacency issues.

B.OSPF will not form adjacencies because of NHRP authentication.

C.OSPF will use point-to-point network type by default.

D.OSPF will automatically adjust to the DMVPN environment.

AnswerA

By default, OSPF over a multipoint interface uses broadcast network type, leading to DR/BDR elections that may not work well with DMVPN.

Why this answer

OSPF over DMVPN Phase 2 requires the hub to be configured as an OSPF point-to-multipoint network type to avoid issues with DR/BDR elections and to allow spoke-to-spoke adjacencies.

Full explanation →

2137

MCQmedium

A network engineer runs the following command to troubleshoot DMVPN NHRP: R1# debug nhrp NHRP: Registration request sent to 10.0.0.1 via GigabitEthernet0/0 NHRP: Registration reply received from 10.0.0.1 Holding time: 3600 sec Flags: 0x0000 NHRP: Cache added 10.1.1.1/32 via 10.0.0.1, non-caching What does this output indicate?

A.NHRP registration to the hub is successful.

B.NHRP registration failed because no reply was received.

C.NHRP registration is pending due to authentication failure.

D.NHRP registration is rejected by the hub.

AnswerA

Registration request sent and reply received, with a cache entry added.

Why this answer

The debug output shows that the spoke sent a registration request to the hub at 10.0.0.1 and received a registration reply with a holding time of 3600 seconds and flags set to 0x0000. The flags value of 0x0000 indicates that the hub accepted the registration without any errors or special conditions, and the subsequent cache addition confirms successful NHRP registration. Therefore, option A is correct.

Exam trap

Cisco often tests the interpretation of NHRP flags, where candidates mistakenly assume that any reply indicates success, but the flags field (e.g., 0x0000 vs. 0x8000) is the actual indicator of acceptance or rejection.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Registration reply received from 10.0.0.1', indicating a reply was received, not that it failed. Option C is wrong because there is no indication of authentication failure; authentication issues would typically result in a reply with flags indicating rejection or no reply at all, and the flags are 0x0000 (no errors). Option D is wrong because the flags value of 0x0000 means the registration was accepted, not rejected; a rejection would show flags like 0x8000 or similar error codes.

Full explanation →

2138

MCQhard

A network engineer runs the following command on Router R1: R1# show ip sla statistics 4 Round Trip Time (RTT) for Index 4 Latest RTT: 300 ms Latest RTT (milliseconds): 300 Latest RTT (microseconds): 300000 Number of successes: 45 Number of failures: 55 Operation time to live: Forever Output: Over threshold R1# show track 2 Track 2 IP SLA 4 reachability Reachability is Down 5 changes, last change 00:00:05 Latest operation return code: Over threshold Latest RTT (milliseconds): 300 Tracked by: ip route 0.0.0.0 0.0.0.0 192.168.2.1 track 2 Based on this output, which statement is correct?

A.The IP SLA operation is failing because the target is unreachable.

B.The tracked static route is active because the IP SLA has successes.

C.The IP SLA threshold has been exceeded, causing the track to go down and the static route to be removed.

D.The IP SLA operation has a 55% failure rate, but the track is still up.

AnswerC

The track is down due to 'Over threshold', which means the static route is no longer installed.

Why this answer

The track shows 'Down' because the IP SLA return code is 'Over threshold'. This means the threshold was exceeded, and the track has brought down the static route. The failures (55) are high, but the key is that the track is down due to the threshold violation.

Full explanation →

2139

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip vrf detail RED VRF RED (VRF Id = 1); default RD <not set> Interfaces: GigabitEthernet0/2 Loopback1 Address family IPV4 (Table ID = 1): No Export VPN route-target communities No Import VPN route-target communities No import route-map No export route-map VRF label distribution protocol: not configured Address family IPV6 (Table ID = 0x1E000001): No Export VPN route-target communities No Import VPN route-target communities No import route-map No export route-map VRF label distribution protocol: not configured Based on this output, which statement is correct?

A.The VRF RED has a Route Distinguisher configured.

B.The VRF RED includes two interfaces: GigabitEthernet0/2 and Loopback1.

C.The VRF RED has an export route-map configured.

D.The VRF RED is configured for MPLS label distribution.

AnswerB

The output lists these two interfaces under VRF RED.

Why this answer

The 'show ip vrf detail RED' command shows detailed VRF information. It lists interfaces GigabitEthernet0/2 and Loopback1. The RD is not set, which is common for VRF-Lite (no MPLS).

There are no route-target communities, which is expected for VRF-Lite.

Full explanation →

2140

MCQhard

In OSPF, what is the default behavior for auto-summary on Cisco IOS-XE?

A.Auto-summary is enabled by default

B.Auto-summary is disabled by default

C.Auto-summary is only enabled for external routes

D.Auto-summary is enabled only for inter-area routes

AnswerB

Correct. Auto-summary is disabled by default for OSPF in Cisco IOS-XE.

Why this answer

Cisco IOS-XE has auto-summary disabled by default for OSPF, meaning that redistributed routes are not summarized to their classful boundaries unless explicitly configured.

Full explanation →

2141

MCQhard

How does BFD prevent loops in a network where multiple BFD sessions might exist between the same pair of routers?

A.By using TTL values to limit packet propagation

B.By requiring authentication in all BFD packets

C.By matching the Your Discriminator field against the local discriminator

D.By using sequence numbers in BFD Control packets

AnswerC

The Your Discriminator field must match the receiver's local discriminator for the packet to be accepted, preventing loops from misrouted packets.

Why this answer

BFD uses a mandatory Your Discriminator field in Control packets; a router will only accept a BFD Control packet if the Your Discriminator matches its own local discriminator, preventing misdirected packets from creating loops.

Full explanation →

2142

MCQhard

An engineer is troubleshooting a network where R1 and R2 are running EIGRP, and R2 redistributes a static route for 192.168.1.0/24 into EIGRP. R1 also learns the same prefix via OSPF from R3 with an AD of 110. The engineer observes that R1 prefers the EIGRP external route (AD 170) over the OSPF route. What configuration change would cause this behavior?

A.The OSPF route is a type 5 LSA, which has a higher AD than type 3 LSAs.

B.The engineer applied the distance eigrp 90 100 command under EIGRP, lowering the AD for external routes to 100.

C.The OSPF route has a metric of 20, while the EIGRP route has a metric of 2560.

D.The static route was redistributed with a route-map that sets the EIGRP metric to 1.

AnswerB

This sets the AD for EIGRP internal routes to 90 and external to 100, making the external route (AD 100) preferred over OSPF (AD 110).

Why this answer

By default, EIGRP external routes have an AD of 170, and OSPF has AD 110, so OSPF should be preferred. If the EIGRP external route is preferred, the AD must have been lowered, likely via the distance command under EIGRP.

Full explanation →

2143

MCQmedium

Consider the following EEM applet configuration: !--- event manager applet CHECK_OSPF event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected." !--- What is the effect of this configuration?

A.The applet will send an email to the administrator whenever an OSPF adjacency change occurs.

B.The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.

C.The applet will fail because the 'event syslog pattern' must be configured with a regular expression.

D.The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.

AnswerA

Correct. The applet triggers on the OSPF adjacency change syslog message and sends an email with the specified details.

Why this answer

The EEM applet triggers on a syslog message matching the pattern "OSPF-5-ADJCHG". When triggered, it sends an email notification to the administrator. The 'cli command' actions are executed but their output is not used; the email is sent regardless.

The applet does not require any additional configuration to send the email, provided the mail server is reachable.

Full explanation →

2144

MCQmedium

A network engineer runs the following command to troubleshoot redistribution with route-maps: R1# show ip route summary IP routing table name: Default-IP-Routing-Table(0) IP routing table maximum-paths: 32 Route Source Networks Subnets Replicates Overhead Memory (bytes) connected 0 3 0 0 480 static 0 0 0 0 0 ospf 1 2 5 0 0 1280 eigrp 100 1 2 0 0 640 bgp 65000 0 0 0 0 0 internal 2 Total 3 10 0 0 2400 What does this output indicate?

A.BGP is not receiving any routes, possibly due to filtering.

B.EIGRP is redistributing routes into OSPF.

C.OSPF has more routes than EIGRP.

D.The router has a total of 13 routes.

AnswerA, C

Correct. BGP shows 0 networks and 0 subnets, meaning no routes are being received, likely due to filtering.

Why this answer

The output shows that BGP has zero routes, indicating BGP is not receiving any routes, possibly due to filtering. This is the most significant finding for troubleshooting redistribution. While OSPF does have more routes than EIGRP numerically, that is not directly indicative of redistribution issues and is not the primary takeaway.

Full explanation →

2145

MCQmedium

A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 4 detail Session 4 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi0/2 Encapsulation : Native Ingress : Disabled What does this output indicate?

A.The session is correctly configured as an RSPAN destination session.

B.The session is misconfigured because the source must be a port, not a VLAN.

C.The session is misconfigured because the destination port must have ingress enabled.

D.The session is misconfigured because the RSPAN VLAN must be the same as the source VLAN.

AnswerA

The output confirms an RSPAN destination session with a source RSPAN VLAN and destination port.

Why this answer

The output shows an RSPAN destination session with source RSPAN VLAN 100 and destination port Gi0/2. This is the destination side of an RSPAN configuration.

Full explanation →

2146

MCQhard

A network engineer runs the following command to troubleshoot an EEM issue: R1# debug event manager action cli EEM Action CLI debugging is on R1# Mar 1 00:10:15.123: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli command: 'show ip int brief' executed Mar 1 00:10:15.456: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli output: 'Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES NVRAM up up GigabitEthernet0/1 10.0.0.1 YES NVRAM up up Loopback0 1.1.1.1 YES NVRAM up up' What does this output indicate?

A.The EEM applet 'TRACK-INTERFACE' executed the command 'show ip int brief' and the output was displayed.

B.The EEM applet 'TRACK-INTERFACE' failed to execute the command 'show ip int brief'.

C.The debug output shows the EEM applet configuration for 'TRACK-INTERFACE'.

D.The command 'show ip int brief' was executed manually by the engineer.

AnswerA

Correct. The debug output shows the applet executing the command and the resulting output.

Why this answer

The debug output shows the execution of CLI actions within an EEM applet. It displays the applet name, the CLI command being executed, and the output of that command. This is useful for verifying that CLI actions are working correctly and seeing the exact output returned.

Full explanation →

2147

MCQmedium

What is the default DHCPv4 renewal time (T1) as a percentage of the lease time?

A.25%

B.50%

C.75%

D.87.5%

AnswerB

T1 is 50% of the lease time per RFC 2131.

Why this answer

The correct answer is B (50%) because RFC 2131 defines the DHCPv4 renewal time (T1) as 50% of the lease duration. When the T1 timer expires, the client attempts to renew its lease by sending a unicast DHCPREQUEST to the server that originally granted the lease.

Exam trap

Cisco often tests the distinction between T1 (renewal at 50%) and T2 (rebinding at 87.5%), and the trap here is that candidates confuse the two percentages or assume the renewal time is a higher value like 75%.

How to eliminate wrong answers

Option A (25%) is wrong because 25% is not defined as any DHCP timer in RFC 2131; it is a common distractor that might be confused with the rebinding time (T2), which defaults to 87.5%. Option C (75%) is wrong because 75% is not a standard DHCP timer value; it is often mistakenly thought to be the renewal time due to a misunderstanding of the rebinding percentage. Option D (87.5%) is wrong because 87.5% is the default rebinding time (T2), not the renewal time (T1); T2 is the point at which the client broadcasts to any available DHCP server if renewal with the original server fails.

Full explanation →

2148

MCQeasy

In MPLS L3VPN, what is the purpose of the Route Distinguisher (RD)?

A.To make IPv4 prefixes unique across different VRFs in the MPLS network.

B.To control which VRFs import routes from other PEs.

C.To specify the VPN label that is used for forwarding.

D.To identify the VRF on the local PE router.

AnswerA

The RD creates a globally unique VPNv4 prefix by combining with the IPv4 address, preventing route ambiguity.

Why this answer

The RD is an 8-byte value prepended to an IPv4 prefix to create a unique VPNv4 prefix. This allows overlapping IPv4 addresses from different VRFs to be carried in the same BGP table without conflict.

Full explanation →

2149

MCQhard

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

A.The 'logging source-interface' is configured to an interface that is administratively down.

B.The 'logging on' command is missing from the configuration.

C.The syslog server is using TCP, but the router is configured for UDP.

D.The logging buffer is full, preventing new messages from being generated.

AnswerA

Correct because if the source interface is down, the router cannot use its IP address, and the syslog server may drop messages from an unexpected source IP or the packets may be routed incorrectly.

Why this answer

The 'show logging' output shows that syslog is enabled but no messages are being sent. A common reason is that the 'logging source-interface' is set to an interface that is down or not reachable, causing the router to use an incorrect source IP that the server may filter or that routing may not support. Alternatively, the server may be configured to accept messages only from specific source IPs.

Full explanation →

2150

MCQeasy

In OSPF, what is the default hello interval on a point-to-point network type?

A.10 seconds

B.30 seconds

C.40 seconds

D.20 seconds

AnswerA

This is the standard default for point-to-point and broadcast networks.

Why this answer

The default hello interval for OSPF on point-to-point networks is 10 seconds, as per RFC 2328.

Full explanation →

2151

MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type Hardware address/ User name 192.168.1.10 0063.6973.636f.2e30. Mar 01 2020 12:00 AM Automatic 3030.3030.2e30.3030 312e.3130.3030.2e30 3030.312d.4574.682d 302f.31 192.168.1.11 0063.6973.636f.2e30. Mar 01 2020 12:00 AM Automatic 3030.3030.2e30.3030 312e.3130.3030.2e30 3030.312d.4574.682d 302f.31 Based on this output, which statement is correct?

A.The DHCP server is functioning correctly with two unique bindings.

B.The DHCP server has a duplicate client-id issue, likely caused by two clients using the same client identifier.

C.The DHCP server has run out of addresses in the pool.

D.The DHCP server is not assigning addresses because the lease time is set to 0.

AnswerB

The hex client-id is identical for both bindings, indicating a duplicate.

Why this answer

The output shows two DHCP bindings with identical client identifiers (the long hexadecimal string). This indicates that two clients are using the same client-ID, which violates RFC 2131 and causes the DHCP server to treat them as the same client, leading to duplicate address assignments or conflicts. Option B correctly identifies this duplicate client-id issue.

Exam trap

Cisco often tests the distinction between a duplicate client-ID and a normal DHCP binding, where candidates mistakenly assume two different IP addresses mean two unique clients, ignoring the identical client-ID field in the output.

How to eliminate wrong answers

Option A is wrong because the DHCP server is not functioning correctly; it has two bindings with the same client-ID, which indicates a misconfiguration or duplicate client identifier, not a healthy state. Option C is wrong because there is no evidence of address exhaustion; the pool still has addresses available (only two bindings are shown, and no 'out of addresses' message appears). Option D is wrong because the lease expiration is set to 'Mar 01 2020 12:00 AM', which is a valid date, not a lease time of 0; a lease time of 0 would show 'Infinite' or '0' explicitly, not a specific date.

Full explanation →

2152

MCQmedium

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

A.RA Guard

B.DHCPv6 Guard

C.ND Snooping

D.Source Guard

AnswerC

Correct. ND Snooping monitors ND messages to prevent DAD attacks and other ND-based threats.

Why this answer

C is correct because ND Snooping (Neighbor Discovery Snooping) is the IPv6 First Hop Security feature that prevents duplicate address detection (DAD) attacks by inspecting Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. It builds a binding table of valid IPv6-to-MAC address mappings and drops any NS messages that attempt to claim an address already in use by another device, thereby blocking DAD-based spoofing attacks.

Exam trap

The trap here is that candidates often confuse ND Snooping with RA Guard or DHCPv6 Guard, thinking any 'Guard' feature handles DAD attacks, but only ND Snooping directly inspects Neighbor Discovery messages used in the DAD process.

How to eliminate wrong answers

Option A is wrong because RA Guard (Router Advertisement Guard) is designed to block unauthorized Router Advertisement messages to prevent rogue router attacks, not to prevent DAD attacks. Option B is wrong because DHCPv6 Guard filters DHCPv6 server messages to prevent rogue DHCPv6 servers, and does not inspect Neighbor Discovery messages for DAD protection. Option D is wrong because Source Guard (IPv6 Source Guard) filters traffic based on the source IPv6 address against the ND Snooping binding table, but it does not directly prevent DAD attacks; it prevents source address spoofing after the binding is established.

Full explanation →

Page 29 of 29

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

Cisco CCNP ENARSI 300-410 300-410 Questions 2101–2152 | Page 29/29 | Courseiva