Hard Difficulty Questions

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Question 3harddrag order

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Question 4hardmultiple choice

A network engineer runs the following command to debug IPv6 uRPF with detailed information:

R1# debug ipv6 verify detail

IPv6 verify debugging is on (detail)

*Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0
*Mar 1 00:03:45.678:   route to source via GigabitEthernet0/1, not same as input interface

What does this output indicate?

A
The packet will be dropped because strict uRPF requires the return path to be through the same interface.
Correct. Strict uRPF checks that the best route to the source uses the same interface as the packet arrived on.
B
The packet will be forwarded because a route exists.
Why wrong: Incorrect. Strict uRPF also checks the interface.
C
The packet will be forwarded because uRPF is loose.
Why wrong: Incorrect. The debug does not specify loose; strict is implied by interface check.
D
The router will change the route to use GigabitEthernet0/0.
Why wrong: Incorrect. uRPF does not modify routing.

Question 5harddrag order

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Question 6hardmultiple choice

An engineer configures IPv6 uRPF loose mode on an interface that connects to a DMVPN spoke. The spoke router uses NHRP to register with the hub and establishes a tunnel. Traffic from the spoke to destinations behind the hub is dropped. Which is the most likely explanation?

A
The spoke's tunnel IPv6 address is not in the global routing table because it is only known via NHRP, causing uRPF loose mode to drop packets sourced from that address.
Correct. uRPF loose mode requires that the source address be present in the routing table (any interface). If the address is only in NHRP cache, not in the routing table, packets are dropped.
B
The hub has uRPF strict mode configured, which breaks the DMVPN tunnel because of asymmetric routing.
Why wrong: Incorrect. The question specifies uRPF loose mode on the spoke interface, not strict mode on the hub.
C
The spoke's NHRP registration packets are filtered by the uRPF check because they use multicast destination.
Why wrong: Incorrect. NHRP uses unicast or multicast; uRPF checks source address, not destination.
D
The tunnel interface has an IPv6 ACL that denies traffic from the spoke's tunnel address, overriding uRPF.
Why wrong: Incorrect. There is no mention of an ACL; the issue is uRPF behavior.

Question 7hardmultiple choice

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

A
The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.
Correct. ND uses ICMPv6 types 133-137; denying them breaks IPv6 connectivity.
B
The ACL must be applied outbound, not inbound, to allow ND packets to be sent.
Why wrong: Incorrect. ND packets are both sent and received; inbound ACL filters incoming packets, which include ND solicitations and advertisements.
C
The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.
Why wrong: Incorrect. There is no such command; ND packets are subject to ACL filtering unless explicitly permitted.
D
The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.
Why wrong: Incorrect. Even if 'permit ipv6 any any' is placed, it would permit all traffic, including ND, but the question states the ACL permits only ICMPv6 echo types, so ND is still denied.

Question 8harddrag order

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Question 9hardmulti select

Which TWO statements about DHCPv6 prefix delegation are true? (Choose TWO.)

A
The requesting router uses the IA_NA option to request a prefix.
Why wrong: Incorrect. The requesting router uses the IA_PD (Identity Association for Prefix Delegation) option, not IA_NA (non-temporary address).
B
The delegating router must have a DHCPv6 pool configured with a prefix-delegation statement.
Correct. The delegating router uses a DHCPv6 pool with the 'prefix-delegation' command to define the prefix to be delegated.
C
The requesting router uses the 'ipv6 dhcp client pd' command on its upstream interface to request a prefix.
Correct. This command enables the requesting router to act as a DHCPv6 prefix delegation client on that interface.
D
The delegating router must be configured with 'ipv6 dhcp server' under the downstream interface facing the requesting router.
Why wrong: Incorrect. The 'ipv6 dhcp server' command is used on the delegating router's interface facing the requesting router, but the statement is misleading because the delegating router enables DHCPv6 server functionality on the interface connected to the requesting router, not 'downstream' in the sense of LAN clients.
E
The requesting router can only use the delegated prefix on the interface that received it.
Why wrong: Incorrect. The requesting router can sub-delegate the prefix to downstream interfaces, typically using the 'ipv6 address prefix-from-provider' or similar command to assign /64 subnets from the delegated prefix.

Open the full VLAN trunking answer →

Question 10hardmultiple choice

A network engineer configures a DHCP snooping trusted port on a switch to allow a legitimate DHCP server. However, clients connected to untrusted ports on the same VLAN cannot obtain IP addresses. The DHCP server is reachable and the switch shows no DHCP snooping drops. Which is the most likely explanation?

A
The DHCP server is not configured to trust the relay agent information option (option 82), causing it to discard the requests.
Correct: By default, DHCP snooping inserts option 82. Many servers reject packets with option 82 unless configured to trust it.
B
The trusted port is in the wrong VLAN; DHCP snooping only works when the trusted port is in the same VLAN as the clients.
Why wrong: Incorrect: The trusted port can be in any VLAN; DHCP snooping operates per VLAN.
C
The switch has 'ip dhcp snooping verify mac-address' enabled, causing MAC address mismatches.
Why wrong: Incorrect: This feature checks the source MAC in the DHCP packet against the Ethernet header, but the issue is about option 82.
D
The DHCP server is not configured with the correct subnet for the client VLAN.
Why wrong: Incorrect: This would cause server-side issues, but the symptom is that no clients get addresses, and the server is reachable.

Question 11hardmultiple choice

An engineer configures a DHCP server on a Cisco router to assign IP addresses from a pool. Clients receive addresses, but when the engineer checks 'show ip dhcp binding', no bindings are displayed. Which is the most likely explanation?

A
The DHCP pool is configured with 'lease infinite', causing bindings to be stored in a different database.
Why wrong: Incorrect: Infinite lease still creates bindings; they should appear.
B
The 'ip dhcp excluded-address' command includes the entire pool range, so no addresses are assigned and no bindings are created.
Correct: If the excluded address range covers the pool, the server will not assign any addresses, and no bindings are created.
C
The router's DHCP server is configured in 'database' mode, which stores bindings externally.
Why wrong: Incorrect: The database command stores bindings in a file, but they still appear in 'show ip dhcp binding'.
D
The clients are using DHCPv6, not DHCPv4.
Why wrong: Incorrect: The command 'show ip dhcp binding' is for IPv4; DHCPv6 uses different commands.

Question 12hardmultiple choice

An engineer configures DHCPv4 on a router with multiple pools for different subnets. Clients in subnet A receive addresses correctly, but clients in subnet B receive addresses from subnet A's pool. The router has 'ip dhcp relay' configured. Which is the most likely explanation?

A
The DHCP server selects the pool based on the giaddr; if the relay agent does not set the giaddr correctly, the server may use the first matching pool.
Correct: The giaddr is critical for pool selection. If it is not set (e.g., due to missing 'ip helper-address' on the correct interface), the server may assign from a different pool.
B
The pools are configured in the wrong order; the server uses the first pool that matches the client's MAC address.
Why wrong: Incorrect: Pool selection is based on giaddr, not MAC address, unless using manual bindings.
C
The router has 'ip dhcp smart-relay' enabled, which overrides pool selection.
Why wrong: Incorrect: Smart relay is a feature that helps with giaddr, but it does not cause wrong pool selection.
D
The DHCP server is configured with 'network' statements that overlap.
Why wrong: Incorrect: Overlapping networks would cause conflicts, but the symptom is specific to subnet B getting addresses from subnet A.

Question 13hardmultiple choice

An engineer configures DHCPv6 prefix delegation on a router with multiple requesting interfaces. The router receives a /48 prefix from the server, but only one interface gets a /64 sub-prefix. Which is the most likely explanation?

A
Only one interface is configured with 'ipv6 address prefix-name ::1:0:0:0:1/64' using the delegated prefix; other interfaces lack this configuration.
Correct: The delegated prefix must be explicitly used on each interface with the appropriate 'ipv6 address' command referencing the prefix name.
B
The DHCPv6 server only delegates a single /64 prefix, not a /48.
Why wrong: Incorrect: The question states a /48 is received.
C
The router's 'ipv6 dhcp client pd' command is missing the 'rapid-commit' option.
Why wrong: Incorrect: Rapid commit speeds up the process but does not affect the number of interfaces.
D
The router has 'ipv6 dhcp client information refresh' set to a high value, delaying updates.
Why wrong: Incorrect: This affects lease renewal, not the initial assignment.

Read the full NAT/PAT explanation →

Question 14hardmultiple choice

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

A
The PAT port range is exhausted.
Why wrong: Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.
B
The router's SIP ALG is disabled, so the private IP in the SDP is not translated.
Correct because without SIP ALG, the router does not inspect and translate the IP addresses inside the SIP messages, causing media to be sent to the private IP.
C
The phone's default gateway is misconfigured.
Why wrong: Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.
D
The outside interface has a firewall blocking UDP ports.
Why wrong: Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.

Study the full EIGRP explanation →

Question 15hardmultiple choice

An engineer configures EIGRP named mode on a router. The neighbor adjacency forms, but the router does not install any routes from the neighbor. The engineer checks and confirms that the neighbor is not configured as a stub. What is the most likely explanation?

A
The 'default-information' is not allowed in named mode by default, so default routes are not accepted.
Why wrong: This is not the primary issue; the question states no routes are installed, not just default routes. Named mode does not block all routes by default.
B
The 'af-interface' has 'split-horizon' enabled by default, preventing the neighbor from advertising routes learned from the same interface.
In EIGRP named mode, split horizon is enabled by default on the af-interface. If the neighbor is reachable via the same interface that the router uses to send updates, split horizon can block the neighbor from advertising routes back, causing no routes to be installed.
C
The 'metric weights' are mismatched between the two routers.
Why wrong: A mismatch in metric weights (K values) prevents the neighbor adjacency from forming entirely, not just route installation.
D
The 'log-neighbor-changes' command is missing, causing route installation to be suppressed.
Why wrong: The 'log-neighbor-changes' command is only for logging and does not affect route installation.

Question 16hardmultiple choice

Which statement about CoPP and IPv6 control plane traffic is correct?

A
CoPP does not support IPv6 traffic
Why wrong: CoPP fully supports IPv6 control plane traffic.
B
IPv6 traffic is automatically classified as critical
Why wrong: Classification depends on the ACL or class-map configuration, not on the IP version.
C
CoPP can police IPv6 traffic using the same policy-map as IPv4
CoPP uses a single policy-map that can match both IPv4 and IPv6 traffic via ACLs or class-maps.
D
IPv6 control plane traffic is not subject to CoPP
Why wrong: IPv6 traffic is subject to CoPP just like IPv4 traffic.

Question 17hardmultiple choice

Which CoPP feature allows the control plane to process packets from a specific source IP address without rate limiting?

A
CoPP aggregate policer
Why wrong: The aggregate policer applies to all traffic in the class, not per-source exceptions.
B
Control Plane Protection (CPPr) exception
CPPr allows defining exceptions to bypass CoPP for trusted sources, such as management stations or routing peers.
C
QoS pre-classify
Why wrong: QoS pre-classify is used for VPN traffic classification, not for CoPP exceptions.
D
Policy-map 'set' action
Why wrong: The 'set' action modifies packet markings, but does not create exceptions to policing.

Question 18harddrag order

Drag and drop the steps to troubleshoot Control Plane Policing (CoPP) adjacency or connectivity failures into the correct order, from first to last.

Question 19hardmulti select

Which TWO actions will prevent a CoPP policy from inadvertently dropping legitimate routing protocol packets during a traffic spike? (Choose TWO.)

A
Create a class-map that matches routing protocol packets (e.g., OSPF, EIGRP, BGP) and assign a police rate with conform-action transmit and exceed-action drop.
Why wrong: Incorrect. Using exceed-action drop will drop legitimate routing packets during spikes, which can cause routing instability.
B
Create a class-map that matches routing protocol packets and assign a police rate with conform-action transmit and violate-action transmit.
Correct. Using transmit for both conform and violate actions ensures routing protocol packets are never dropped, even during spikes.
C
Place routing protocol traffic into a class with a 'drop' action to prevent it from overwhelming the control plane.
Why wrong: Incorrect. Dropping routing protocol traffic would cause loss of routing adjacencies and network instability.
D
Use the 'police' command with a high committed information rate (CIR) and burst size, and apply 'conform-action transmit' and 'exceed-action set-dscp cs6'.
Correct. Setting a high CIR and using set-dscp (instead of drop) for exceeding traffic ensures that routing packets are re-marked but not dropped, preserving protocol stability.
E
Apply the CoPP policy only to the 'control-plane host' subinterface, which processes all routing protocol packets.
Why wrong: Incorrect. The 'control-plane host' subinterface handles packets destined to the router itself, including routing protocols, but applying CoPP only there does not prevent drops; the policy actions still apply.

Question 20hardmulti select

Full question →

Which TWO statements about the 'show policy-map control-plane' command output are true? (Choose TWO.)

A
The output displays the number of packets that matched each class in the CoPP policy.
Correct. The command shows per-class packet and byte counters for matched traffic.
B
The output includes the number of packets dropped by each class due to policing.
Correct. The command displays drop counters for each class where a police or drop action is configured.
C
The output shows the routing table entries that are affected by the CoPP policy.
Why wrong: Incorrect. The command does not display routing table information; it only shows CoPP policy statistics.
D
The output displays the CoPP policy applied to each physical interface.
Why wrong: Incorrect. CoPP is applied to the control plane, not physical interfaces. 'show policy-map interface' shows per-interface policies.
E
The output includes the ARP cache entries that are protected by CoPP.
Why wrong: Incorrect. ARP cache is not displayed by this command; it shows only CoPP policy statistics.