Troubleshooting Scenario Questions

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Question 3mediumdrag order

Full question →

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Question 4harddrag order

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Question 5mediummultiple choice

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

A
The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.
Correct because ICMPv6 echo replies are sourced from the destination address (R2) and must be permitted inbound on R1 for the ping to succeed.
B
The ACL is applied outbound on R1 and blocks the echo request.
Why wrong: Incorrect because the ACL is applied inbound, not outbound.
C
IPv6 unicast-routing is not enabled on R1.
Why wrong: Incorrect because R1 can ping its own address, indicating IPv6 is operational; unicast-routing is not required for direct link pings.
D
The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.
Why wrong: Incorrect because ND messages are needed for address resolution, but the symptom is a ping failure after ND has likely succeeded (R1 can ping its own address, implying layer 2 is up).

Question 6harddrag order

Read the full DHCP explanation →

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Question 7harddrag order

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Question 8mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

A
The NAT pool is not configured with overload.
Why wrong: Incorrect because overload is configured, as seen by the many translations sharing the same IP.
B
The outside interface is flapping, causing translations to be cleared.
Why wrong: Incorrect because if the interface flapped, translations would be cleared, not accumulated.
C
The router has run out of available port numbers for PAT.
Correct because PAT uses a limited port range (usually 1024-65535), and with many sessions, ports can be exhausted, preventing new translations.
D
The access list is denying some inside hosts.
Why wrong: Incorrect because if the ACL were denying hosts, those hosts would never get translations; the issue is that translations exist but new ones fail.

Read the full NAT/PAT explanation →

Question 9hardmultiple choice

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

A
The PAT port range is exhausted.
Why wrong: Incorrect because calls fail after 30 seconds, not immediately; port exhaustion would prevent new calls, not drop established ones.
B
The router's SIP ALG is disabled, so the private IP in the SDP is not translated.
Correct because without SIP ALG, the router does not inspect and translate the IP addresses inside the SIP messages, causing media to be sent to the private IP.
C
The phone's default gateway is misconfigured.
Why wrong: Incorrect because the phone can register, so it can reach the server; the issue is with media path, not initial connectivity.
D
The outside interface has a firewall blocking UDP ports.
Why wrong: Incorrect because if a firewall were blocking, the call would not even establish; the issue is specific to NAT and SIP payload.

Question 10easymultiple choice

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip interface GigabitEthernet0/1 | include access list

Outgoing access list is 140 Inbound access list is not set

Then the engineer runs:

R1# show ip access-lists 140

Extended IP access list 140

10 deny icmp any any
    
20 permit ip any any

What does this output indicate?

A
ACL 140 is applied outbound on GigabitEthernet0/1, denying ICMP and permitting all other traffic.
The output shows the ACL and its entries.
B
ACL 140 is applied inbound on GigabitEthernet0/1, blocking ICMP.
Why wrong: It says 'Outgoing access list'.
C
ACL 140 is not applied to any interface.
Why wrong: It is applied outbound on GigabitEthernet0/1.
D
ACL 140 is applied both inbound and outbound.
Why wrong: Only outbound is set.

Open the full BGP breakdown →

Question 11mediummultiple choice

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path *> 10.3.3.0/24 10.1.1.2 0 100 0 i

Total number of prefixes 1

What does this output indicate?

A
BGP is not receiving any routes due to CoPP dropping updates.
Why wrong: One route is received, so updates are being processed.
B
BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.
The route is received from neighbor 10.1.1.2 with valid attributes.
C
BGP is receiving routes but not installing them in the routing table due to CoPP.
Why wrong: The output shows received routes, not installation status.
D
BGP session is flapping due to CoPP.
Why wrong: No session flap is indicated; the output is stable.

Question 12harddrag order

Drag and drop the steps to troubleshoot Control Plane Policing (CoPP) adjacency or connectivity failures into the correct order, from first to last.

Question 13mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

A
Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.
Correct because ND snooping creates bindings for static addresses, allowing IPv6 Source Guard to permit traffic.
B
Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.
Why wrong: Incorrect because while DHCPv6 snooping would create a binding, the host is using a static address; changing the host configuration may not be desirable.
C
Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.
Why wrong: Incorrect because the 'ipv6 neighbor' command adds an entry to the switch's neighbor cache, not to the IPv6 Source Guard binding table; the binding table is populated by snooping.
D
Disable IPv6 Source Guard on the port connected to the host.
Why wrong: Incorrect because the question asks to resolve the issue without disabling IPv6 Source Guard.

Question 14hardmultiple choice

An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?

A
Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.
Correct because RA Guard will allow RAs only on ports configured as 'device-role router', blocking rogue RAs on host ports.
B
Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.
Why wrong: Incorrect because DHCPv6 Guard does not block RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not control plane messages like RAs; RA Guard is the appropriate feature.
D
Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.
Why wrong: Incorrect because static neighbor entries do not prevent the switch from processing rogue RAs; RA Guard is needed to drop them.

Question 15mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

A
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
B
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why wrong: Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the secondary router.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not RAs.
D
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why wrong: Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.