113 free Cisco 300-410 ENARSI practice questions from the CertStash pack of 620, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 113 free here, all 620 in the pack, and each step includes the one before it.
Get all 620 questions (US$39) · Download the first 10 as a PDF
Question 1
Which method changes the forwarding decision that a router makes without first changing the routing table or influencing the IP data plane?
Show answer and explanation
Correct answer: C. policy-based routing
Policy-based routing (PBR) allows a router to make forwarding decisions based on policies and criteria other than just the destination IP address, without modifying the routing table itself or the IP data plane routing logic. It intercepts packets and applies match-action rules to redirect them independently of normal routing table lookups.
Why the other options are wrong
- A. Nonbroadcast multiaccess (NBMA) describes a network topology type, not a forwarding decision method.
- B. Packet switching is the general process of forwarding packets, not a method that changes forwarding decisions outside the routing table.
- D. The Forwarding Information Base (FIB) is derived from and depends on the routing table, so changes to forwarding via FIB involve routing table changes.
Question 2
What is a prerequisite for configuring BFD?
Show answer and explanation
Correct answer: C. Cisco Express Forwarding must be enabled on all participating BFD endpoints.
Cisco Express Forwarding (CEF) must be enabled on all participating BFD endpoints because BFD relies on CEF's fast switching and efficient packet handling to detect failures rapidly and accurately. CEF provides the underlying forwarding infrastructure that BFD depends on.
Why the other options are wrong
- A. Jumbo frame support is not a prerequisite for BFD; BFD works with standard frame sizes.
- B. Only the two BFD endpoints need BFD enabled; intermediate routers in the path do not require BFD configuration.
- D. The timers 3 9 command is not a prerequisite; BFD can be configured with BGP using default or custom timers without this specific command being mandatory.
Question 3
Which attribute eliminates LFAs that belong to protected paths in situations where links in a network are connected through a common fiber?
Show answer and explanation
Correct answer: A. shared risk link group-disjoint
Shared Risk Link Group (SRLG) disjoint ensures that the primary path and the loop-free alternate path do not share any common risk, such as links connected through the same fiber bundle or physical infrastructure. This eliminates LFAs that would fail simultaneously with the primary path due to shared physical resources.
Why the other options are wrong
- B. Linecard-disjoint refers to ensuring paths use different linecards, which is less comprehensive than SRLG for handling common fiber dependencies.
- C. Lowest-repair-path-metric is a metric for selecting among LFAs, not an attribute that eliminates LFAs based on shared risks.
- D. Interface-disjoint only ensures different interfaces are used but does not account for common physical infrastructure like shared fiber.
Question 4
Which command displays the IP routing table information that is associated with VRF-Lite?
Show answer and explanation
Correct answer: B. show ip route vrf
The command 'show ip route vrf' displays the IP routing table for a specific VRF instance in VRF-Lite configurations. This command allows viewing routes associated with a particular VRF namespace.
Why the other options are wrong
- A. The 'show ip vrf' command displays VRF configurations and their properties, not the routing table entries.
- C. The 'show run vrf' command displays the running configuration for VRF, not routing table information.
- D. The 'show ip protocols vrf' command displays routing protocol information within a VRF, not the routing table itself.
Question 5
Which configuration adds an IPv4 interface to an OSPFv3 process in OSPFv3 address family configuration?
Show answer and explanation
Correct answer: D. router ospfv3 1 address-family ipv4 unicast
The command 'router ospfv3 1 address-family ipv4 unicast' correctly enters the OSPFv3 address family configuration mode for IPv4 unicast routing. This syntax properly configures OSPFv3 to support IPv4 address families in addition to its native IPv6 support.
Why the other options are wrong
- A. This command enters address family mode but is incomplete; it does not specify the unicast keyword required for proper configuration.
- B. This command uses invalid syntax; 'ospfv3' is a routing process command, not a configuration that belongs at the global level with this structure.
- C. While this appears to enter an interface, this syntax is incorrect for OSPFv3 address family configuration; interfaces must be enabled within the address family context after proper setup.
Question 6
Which configuration enables the VRF that is labeled `Inet` on FastEthernet0/0?
Show answer and explanation
Correct answer: C. R1(config)# ip vrf Inet R1(config-vrf)#interface FastEthernet0/0 R1(config-if)#ip vrf forwarding Inet
The correct sequence is: first create the VRF named 'Inet' with 'ip vrf Inet', then enter the interface configuration mode, and finally bind the interface to the VRF using 'ip vrf forwarding Inet'. This is the proper two-step process for assigning an interface to a VRF.
Why the other options are wrong
- A. The syntax 'ip vrf FastEthernet0/0' is invalid; you cannot assign an interface to a VRF at the VRF configuration level in this way.
- B. This syntax is invalid; the interface name cannot be specified directly in the 'ip vrf' command at the global config level.
- D. This mixes OSPF routing configuration with VRF assignment; 'ip vrf forwarding' does not belong in router OSPF context, and this is not the correct method for interface-to-VRF binding.
Question 7
An engineer configured policy-based routing for a destination IP address that does not exist in the routing table. How is the packet treated through the policy for configuring the set ip default next-hop command?
Show answer and explanation
Correct answer: D. Packets are forwarded to the specific next hop.
When using the 'set ip default next-hop' command in policy-based routing, packets matching the policy are forwarded to the specified next hop regardless of whether the destination IP exists in the routing table. The 'default' next-hop serves as an explicit forwarding target for matched packets.
Why the other options are wrong
- A. Packets are not dropped; the policy explicitly directs them to the specified next hop.
- B. Packets are not forwarded based on the routing table; the policy overrides normal routing table lookup with the default next-hop.
- C. Packets follow the policy-specified next-hop, not a static route; static routes are separate from PBR policy actions.
Question 8
An engineer configured two routers connected to two different service providers using BGP with default attributes. One of the links is presenting high delay, which causes slowness in the network. Which BGP attribute must the engineer configure to avoid using the high-delay ISP link if the second ISP link is up?
Show answer and explanation
Correct answer: D. LOCAL_PREF
LOCAL_PREF (Local Preference) is the appropriate BGP attribute to prefer one ISP link over another within the same AS. By configuring a higher LOCAL_PREF value for the low-delay ISP link, the router will prefer that path and avoid the high-delay link when both routes are available.
Why the other options are wrong
- A. AS-PATH influences route selection based on AS path length, not link quality or delay characteristics.
- B. WEIGHT is a Cisco-specific attribute that works only locally on a single router and is less suitable for multi-router BGP scenarios than LOCAL_PREF.
- C. MED (Multi-Exit Discriminator) is used to influence route selection from external AS perspectives and is primarily for incoming route preferences, not preferred outgoing link selection.
Question 9
When determining if a system is capable of support, what is the minimum time spacing required for a BFD control packet to receive once a control packet is arrived?
Show answer and explanation
Correct answer: C. Required Min RX Interval
The Required Min RX Interval is the minimum time spacing that must be observed between BFD control packets. This parameter defines the minimum interval at which a system can receive BFD packets and is used to determine the detection time for link failures. When a control packet arrives, the next packet must not arrive sooner than the Required Min RX Interval to avoid overwhelming the receiver.
Why the other options are wrong
- A. Desired Min TX Interval specifies how often the system wants to send packets, not the minimum spacing for receiving them.
- B. Detect Mult is a multiplier used to calculate the detection time (Detect Mult × advertised interval), not a minimum time spacing between received packets.
- D. Required Min Echo RX Interval applies to the echo function of BFD, not to regular control packet reception.
Question 10
Which of the following are valid IPv6 Router Advertisement (RA) Guard modes? (Choose two.)
Show answer and explanation
Correct answer: B, C. Host mode; Router mode
IPv6 Router Advertisement Guard has two valid modes: Host mode (restricts devices from sending RAs) and Router mode (permits RAs from legitimate routers). These modes provide protection against rogue RA advertisements.
Why the other options are wrong
- A. Guard mode is not a valid IPv6 RA Guard mode designation.
- D. Open mode is not a valid IPv6 RA Guard mode.
- E. Closed mode is not a valid IPv6 RA Guard mode.
What people say about the full 300-410 pack 5.0 from 4
Cleared my ENARSI exam. The dump is accurate, a lot came out in the real exam. Would not have passed without it. Worth every cent.
Passed the 300-410! This is a tough exam and real exam questions are hard to find. This dump delivers. Went through it a few times and cleared it.
I was unsure at first, but Cert Stash turned out to be a solid choice. The content was accurate and well-organized, definitely worth it.
Question 11
What does the PE router convert the IPv4 prefix to within an MPLS VPN?
Show answer and explanation
Correct answer: D. VPN-IPv4 prefix combined with the 64-bit route distinguisher
PE routers convert standard IPv4 prefixes into VPN-IPv4 prefixes by combining them with a 64-bit route distinguisher (RD). This allows the same IPv4 address space to be used across multiple VPNs while maintaining uniqueness within the MPLS VPN backbone. The RD prepends to the IPv4 prefix, creating a globally unique identifier for VPN routes.
Why the other options are wrong
- A. eBGP path association is not part of IPv4 prefix conversion in MPLS VPNs; PE-CE sessions use standard BGP or static routing.
- B. The prefix does not combine ASN and PE router-id in the way described; the RD is the key differentiator, not these components.
- C. A 48-bit route is incorrect; the route distinguisher is 64 bits, and it combines with the 32-bit IPv4 prefix to create VPN-IPv4.
Question 12
What are two MPLS label characteristics? (Choose two.)
Show answer and explanation
Correct answer: C, D. LDP uses TCP for reliable delivery of information; An MPLS label is a short identifier that identifies a forwarding equivalence class.
Options C and D correctly characterize MPLS labels. LDP uses TCP port 646 for reliable control plane communication, and an MPLS label is a short (20-bit) identifier that identifies a Forwarding Equivalence Class (FEC), determining how packets are forwarded through the network. Option A is wrong, Label Switching Routers (LSRs) swap labels, not LERs. Option B is incorrect, MPLS labels are imposed between Layer 2 and Layer 3 headers (in the label stack), not after the Layer 3 header. Option E is false, multiple labels can be stacked on a single packet.
Why the other options are wrong
- A. Label Edge Routers (LERs) impose/remove labels; Label Switching Routers (LSRs) swap labels
- B. MPLS labels are inserted between the Layer 2 and Layer 3 headers, forming a label stack between them
- E. MPLS supports label stacking with multiple labels imposed on a single packet for various purposes
Question 13
What TCP port is used by LDP to provide for reliable transport connections?
Show answer and explanation
Correct answer: A. 646
LDP uses TCP port 646 for establishing reliable transport connections between LDP peers. This is the well-known port assigned by IANA for LDP's TCP-based session establishment, ensuring ordered and reliable delivery of LDP messages.
Why the other options are wrong
- B. Port 648 is not assigned to LDP.
- C. Port 752 is not assigned to LDP.
- D. Port 712 is not assigned to LDP.
Question 14
Users report issues with reachability between areas as soon as an engineer configured summary routes between areas in a multiple area OSPF autonomous system. Which action resolves the issue?
Show answer and explanation
Correct answer: D. Configure the area range command on the ABR.
The 'area range' command is configured on the ABR (Area Border Router) to create summary routes between OSPF areas. This command aggregates LSAs from one area before advertising them to other areas. If summary routes are causing reachability issues, reconfiguring or adjusting the area range command on the ABR resolves the problem by ensuring proper route advertisement and suppression of more-specific routes.
Why the other options are wrong
- A. The 'area range' command is not used on the ASBR; it is an ABR function.
- B. The 'summary-address' command is used on the ASBR for external route summarization, not for inter-area routes.
- C. The 'summary-address' command applies to external routes redistributed by the ASBR, not to inter-area summarization handled by the ABR.
Question 15
A customer reports to the support desk that they cannot print from their PC to the local printer id:123456789. Which tool must be used to diagnose the issue using Cisco DNA Center Assurance?
Show answer and explanation
Correct answer: C. path trace
Path trace is the correct tool in Cisco DNA Center Assurance to diagnose connectivity issues between network devices and endpoints, such as a PC attempting to print to a network printer. It traces the network path and identifies any routing or connectivity problems.
Why the other options are wrong
- A. Device trace is used for examining device-specific diagnostics and logs, not for analyzing connectivity between endpoints.
- B. ACL trace is specifically for analyzing Access Control List impact on traffic, not general printer connectivity issues.
- D. Application trace is used for analyzing application-layer issues, not the network path needed for basic device-to-device communication.
Question 16
When provisioning a device in Cisco DNA Center, the engineer sees the error message `Cannot select the device. Not compatible with template`. What is the reason for the error?
Show answer and explanation
Correct answer: D. The tag that was used to filter the templates does not match the device tag.
In Cisco DNA Center, templates are assigned to devices based on matching tags. When a template is filtered by specific tags and the device does not have matching tags, the system cannot select the device for that template, resulting in the compatibility error. This is a tag mismatch issue rather than a configuration, versioning, or commit problem.
Why the other options are wrong
- A. An incorrect template configuration would typically produce a different error during compilation or deployment, not a selection incompatibility error.
- B. Software version differences may cause deployment issues, but the error occurs at the selection stage before version checking.
- C. Uncommitted template changes would prevent the template from being available, not cause a selection incompatibility message.
Question 17
A newly installed spoke router is configured for DMVPN with the ip mtu 1400 command. Which configuration allows the spoke to use fragmentation with the maximum negotiated TCP MTU over GRE?
Show answer and explanation
Correct answer: B. ip tcp adjust-mss 1360 crypto ipsec fragmentation after-encryption
To handle fragmentation with maximum negotiated TCP MTU over GRE in a DMVPN environment with ip mtu 1400, the command ip tcp adjust-mss 1360 reduces the TCP MSS to account for GRE and IPsec overhead, while crypto ipsec fragmentation after-encryption performs fragmentation after IPsec encryption is applied. This allows TCP traffic to be properly segmented within the tunnel constraints while avoiding path MTU discovery issues.
Why the other options are wrong
- A. The crypto ipsec fragmentation mtu-discovery option performs fragmentation based on discovered MTU, which conflicts with the need for predetermined fragmentation after encryption in this scenario.
- C. ip tcp payload-mtu is not a standard Cisco command; the correct command is ip tcp adjust-mss.
- D. While payload-mtu sounds relevant, it is not a valid command, and mtu-discovery is not the correct fragmentation method for this use case.
Question 18
Which table is used to map the packets in an MPLS LSP that exit from the same interface, via the same next hop, and have the same queuing policies?
Show answer and explanation
Correct answer: B. FEC
The Forwarding Equivalence Class (FEC) table is used in MPLS to group packets that are forwarded along the same path through an LSP. Packets in the same FEC share the same egress interface, next-hop, and queuing policies, and are therefore assigned the same label for forwarding purposes.
Why the other options are wrong
- A. LDP is the protocol used to distribute labels, not a table for mapping packet forwarding
- C. CEF (Cisco Express Forwarding) is a forwarding mechanism but not specifically for mapping MPLS LSP traffic
- D. RIB (Routing Information Base) contains routing table entries but is not used to map MPLS LSP packets
Question 19
Unicast Reverse Path Forwarding (uRPF) has been configured on a service provider network to protect itself from spoofed based attacks. Which of the following are valid uRPF modes? (Choose two.)
Show answer and explanation
Correct answer: A, E. Strict mode; Loose mode
Unicast Reverse Path Forwarding has two valid modes: Strict mode (verifies that the packet source address is reachable via the interface it arrived on) and Loose mode (verifies that the source address is reachable via any interface). Both provide protection against spoofed attacks.
Why the other options are wrong
- B. Open mode is not a valid uRPF mode.
- C. Closed mode is not a valid uRPF mode.
- D. Block mode is not a valid uRPF mode designation.
Question 20
What is LDP label binding?
Show answer and explanation
Correct answer: A. destination prefix with label
LDP label binding associates a label with a destination prefix (FEC - Forwarding Equivalence Class). This binding maps a unique label to a network prefix, allowing routers to forward packets based on labels rather than traditional destination-based routing lookups.
Why the other options are wrong
- B. Label distribution sessions are the mechanism for exchanging bindings, not the binding itself.
- C. Source prefix is not used in LDP label binding; only destination prefixes are labeled.
- D. Neighboring routers are involved in the process, but the binding itself is prefix-to-label, not router-to-label.
Question 21
The MPLS LDP autoconfiguration feature allows you to enable LDP on every interface that is associated with an IGP instance. Which of the following Interior Gateway Protocols support this? (Choose two.)
Show answer and explanation
Correct answer: A, B. OSPF; IS-IS
MPLS LDP autoconfiguration allows automatic LDP enablement on interfaces associated with an IGP instance. OSPF and IS-IS are the two Interior Gateway Protocols that support this feature for seamless LDP activation.
Why the other options are wrong
- C. BGP is an Exterior Gateway Protocol, not an Interior Gateway Protocol, and does not support LDP autoconfiguration.
- D. RIP is outdated and does not support MPLS LDP autoconfiguration features.
- E. EIGRP, while an IGP, does not support LDP autoconfiguration in the same way as OSPF and IS-IS.
Question 22
Which of the following are valid fields in an MPLS header? (Choose four.)
Show answer and explanation
Correct answer: A, C, D, E. Label; Experimental (Exp); Bottom of Stack (BoS); Time to Live (TTL)
The MPLS header contains four valid fields: Label (20 bits), Experimental/CoS (3 bits), Bottom of Stack flag (1 bit), and Time to Live/TTL (8 bits). These are the standard fields defined in RFC 3032. Sequence Number and Checksum are not part of the MPLS shim header; checksums are handled by underlying protocols.
Why the other options are wrong
- B. Sequence Number is not a field in the MPLS header; it is used in other protocols but not in MPLS.
- F. Checksum is not part of the MPLS header; error detection is delegated to underlying and overlying protocols.
Question 23
Which statement about IPv6 RA Guard is true?
Show answer and explanation
Correct answer: A. It does not offer protection in environments where IPv6 traffic is tunneled.
IPv6 RA Guard has a known limitation in that it does not provide protection when IPv6 traffic is tunneled (such as in 6to4 or Teredo tunnels), because the RA messages are encapsulated and the guard cannot inspect them at Layer 2. This is a documented vulnerability of the feature.
Why the other options are wrong
- B. IPv6 RA Guard can be configured on switch port interfaces in the ingress direction.
- C. Packets dropped by IPv6 RA Guard can be spanned for analysis and troubleshooting.
- D. IPv6 RA Guard is supported in hardware when TCAM is programmed on Cisco switches.
Question 24
An engineer is implementing a coordinated change with a server team. As part of the change, the engineer must configure interface GigabitEthernet2 in an existing VRF "RED" then move the interface to an existing VRF "BLUE" when the server team is ready. The engineer configured interface GigabitEthernet2 in VRF "RED": • interface GigabitEthernet2 • description Migration ID: B410A82D0935G35 • vrf forwarding RED • ip address 10.0.0.0 255.255.255.254 negotiation auto Which configuration completes the change?
Show answer and explanation
Correct answer: A. interface GigabitEthernet2 no vrf forwarding RED vrf forwarding BLUE ip address 10.0.0.0 255.255.255.254
When moving an interface between VRFs, the correct sequence is to remove the current VRF assignment with 'no vrf forwarding RED', then assign it to the new VRF with 'vrf forwarding BLUE', and finally reconfigure the IP address. This approach preserves the interface configuration while properly transitioning it between VRFs without losing the interface down or causing configuration conflicts.
Why the other options are wrong
- B. Removing only the IP address and changing VRF does not restore the IP configuration, leaving the interface without an address.
- C. Removing the VRF and changing to BLUE without reconfiguring the IP address leaves the interface without proper network layer configuration.
- D. This sequence removes the IP address, then re-adds it while changing VRF, which is unnecessarily complex; option A is the standard approach.
Question 25
How are MPLS Layer 3 VPN services deployed?
Show answer and explanation
Correct answer: C. The label switch path must be available between the local and remote PE routers.
For MPLS Layer 3 VPN services to function properly, a label switch path (LSP) must exist between the local and remote PE routers through the MPLS backbone. This LSP carries the encapsulated VPN traffic between PE routers. Without this LSP, PE routers cannot exchange VPN traffic regardless of VRF or RD/RT configuration.
Why the other options are wrong
- A. RD and RT values do not need to match under a single VRF; the RD is unique per VRF, while RT controls import/export policies.
- B. Import and export RT values can differ; a VRF can import different RTs than it exports, allowing flexible VPN connectivity patterns.
- D. RD values do not need to match on remote PE routers; each PE uses its own RD per VRF. Only RT values are compared for import/export decisions.
Question 26
Which protocol is used to determine the NBMA address on the other end of a tunnel when mGRE is used?
Show answer and explanation
Correct answer: A. NHRP
NHRP (Next Hop Resolution Protocol) is the protocol used in DMVPN to dynamically discover and resolve NBMA (Non-Broadcast Multi-Access) addresses of remote tunnel endpoints. It allows spokes to learn the physical addresses of other spokes without contacting the hub each time, enabling direct spoke-to-spoke communication in mGRE deployments.
Why the other options are wrong
- B. IPsec is used for encryption and security of the tunnel traffic, not for address discovery
- C. MP-BGP is used for VPN routing and address family management, not NBMA address resolution
- D. OSPF is a routing protocol that operates over the tunnel, not a protocol for discovering NBMA addresses
Question 27
Router R1 has been configured with a default route like this: R1#(config) ip route 0.0.0.0 0.0.0.0 10.2.3.1 You want to redistribute this route into OSPF but when you configure the redistribute static command under the OSPF process the default route is not present. What will create a default route in the OSPF routing process?
Show answer and explanation
Correct answer: C. Use the default-information originate command under the OSPF process.
The default-information originate command is specifically designed to inject a default route (0.0.0.0/0) into OSPF regardless of whether a default route exists in the routing table. Simply using redistribute static does not automatically advertise the default route; the default-information originate command must be used under the OSPF process.
Why the other options are wrong
- A. The subnets keyword affects subnet redistribution but does not specifically enable default route propagation
- B. Setting a default metric affects all redistributed routes but does not specifically enable default route propagation
- D. Increasing administrative distance would only make the static route less preferred; it would not enable OSPF advertisement
Question 28
An engineer configured a company's multiple area OSPF Head Office router and Site A Cisco routers with VRF lite. Each site router is connected to a PE router of an MPLS backbone: • Head Office & Site A • ip cef ip vrf abc • rd 101:101 ! interface FastEthernet0/0 ip vrf forwarding abc ip address 172.16.16.X 255.255.255.252 ! router ospf 1 vrf abc log-adjacency-changes network 172.16.16.0 0.0.0.255 area 1 After finishing both site router configurations, none of the LSA 3, 4, 5, and 7 are installed at Site A router. Which configuration resolves this issue?
Show answer and explanation
Correct answer: D. configure capability vrf-lite on Head Office and Site A routers under router ospf 1 vrf abc
When using VRF-lite with OSPF across multiple sites connected through MPLS PE routers, the capability vrf-lite command must be configured on the CE routers (Head Office and Site A) under the VRF-specific OSPF process. This enables OSPF to operate within the VRF context and allows proper LSA propagation (including LSA 3, 4, 5, and 7) from the Head Office area to reach Site A through the MPLS backbone.
Why the other options are wrong
- A. Configuring vrf-lite only on Site A is insufficient; both CE routers must have the configuration.
- B. The vrf-lite capability belongs on CE routers, not on PE routers; PE routers handle VPN routing through multi-VRF support.
- C. The command should be under 'router ospf 1 vrf abc' not 'router ospf 1 abc', and must be on both sites, not just Head Office.
Question 29
Which two protocols work in the control plane of P routers across the MPLS cloud? (Choose two.)
Show answer and explanation
Correct answer: B, C. LDP; RSVP
In the MPLS control plane, P (Provider) routers use LDP (Label Distribution Protocol) to distribute labels and learn about forwarding equivalence classes, and RSVP (Resource Reservation Protocol) for traffic engineering and explicit path setup. These protocols enable P routers to coordinate label distribution and path establishment across the MPLS cloud without needing to participate in customer BGP.
Why the other options are wrong
- A. ECMP is a data plane forwarding mechanism, not a control plane protocol.
- D. MPLS OAM operates in the management plane for monitoring and diagnostics, not the control plane for signaling.
- E. LSP (Label Switched Path) is a data structure, not a control plane protocol; it is created by control plane protocols like LDP and RSVP.
Question 30
A new site has been added to an OPSF network using area 2. Area 2 is connected only to area 1 of this OSPF network. Area 1 is used to connect area 1 to the backbone area 0. Should you expect full connectivity to the networks located in area 2 from area 0 in this scenario?
Show answer and explanation
Correct answer: C. No, a virtual link is needed to logically connect area 2 info area 0.
In OSPF, all areas must connect directly to the backbone area (area 0). Area 2 connected only to area 1, with area 1 connecting to area 0, means area 2 is not directly connected to area 0. This violates the OSPF topology requirement. A virtual link must be configured between area 2 and area 0 (through area 1) to logically connect the non-backbone area directly to the backbone, ensuring proper LSA flooding and routing.
Why the other options are wrong
- A. Full connectivity exists only when all areas directly attach to area 0; this topology violates that requirement.
- B. Redistribution is not used in OSPF; all areas use the same routing protocol and LSA flooding mechanism.
- D. Configuring area 2 as a stub does not solve the fundamental connectivity problem of not being directly connected to area 0.
Question 31
In a DMVPN network, the Spoke1 user observed that the voice traffic is coming to Spoke2 users via the hub router. Which command is required on both spoke routers to communicate directly to one another?
Show answer and explanation
Correct answer: B. ip nhrp shortcut
The `ip nhrp shortcut` command enables dynamic creation of shortcut tunnels between spoke routers, allowing them to communicate directly with each other rather than through the hub. This is essential for DMVPN Phase 2 and 3 deployments to optimize traffic paths.
Why the other options are wrong
- A. NHRP multicast is used for NHS discovery and registration, not for spoke-to-spoke direct communication.
- C. NHRP dynamic mapping is a passive mechanism; it doesn't actively create shortcuts between spokes.
- D. NHRP redirect is used to inform hosts to use different paths, not to enable direct spoke communication.
Question 32
An engineer must override the normal routing behavior of a router for Telnet traffic that is destined to 10.10.10.10 from 10.10.1.0/24 via a next hop of 10.4.4.4, which is directly connected to the router that is connected to the 10.1.1.0/24 subnet. Which configuration reroutes traffic according to this requirement?
Show answer and explanation
Correct answer: D. access-list 100 permit tcp 10.10.1.0 0.0.0.255 host 10.10.10.10 eq 23 ! route-map POLICY permit 10 match ip address 100 set ip next-hop recursive 10.4.4.4
The correct configuration uses access-list 100 with permit (not deny) to match Telnet traffic from 10.10.1.0/24 to 10.10.10.10 on port 23, then applies a route-map that sets the next-hop using the recursive keyword. The recursive keyword is essential because 10.4.4.4 is directly connected to a router connected to 10.1.1.0/24 (not directly connected to this router), allowing the recursive lookup to resolve the actual next-hop.
Why the other options are wrong
- A. Uses deny instead of permit in the ACL, which would prevent the traffic from being matched
- B. Missing the recursive keyword, which is needed because the next-hop is not directly connected
- C. Incomplete configuration missing the final route-map permit statement needed for the policy
Question 33
How does an MPLS Layer 3 VPN function?
Show answer and explanation
Correct answer: B. multiple customer sites interconnect through a service provider network using customer edge to provider edge connectivity
An MPLS Layer 3 VPN (MPLS VPN) functions by allowing multiple customer sites to interconnect through a service provider network using customer edge (CE) to provider edge (PE) connectivity. The PE routers handle the VPN routing and MPLS forwarding, while the service provider's core network transparently carries the traffic using MPLS labels. This creates logical separation and security without requiring explicit tunnels at the customer level.
Why the other options are wrong
- A. While customer sites do interconnect, the mechanism is PE-to-PE connectivity with MPLS, not explicit tunnels between CE devices.
- C. MPLS VPNs operate over the service provider network, not the public Internet; they are not Internet-based.
- D. Multiprotocol BGP is used at PE routers for VPN route distribution, not at customer sites for local aggregation.
Question 34
In which two ways does the IPv6 First-Hop Security Binding Table operate? (Choose two.)
Show answer and explanation
Correct answer: B, C. by various IPv6 guard features to validate the data link layer address; by the recovery mechanism to recover the binding table in the event of a device reboot
The IPv6 First-Hop Security Binding Table operates through two key mechanisms: various IPv6 guard features (such as RA Guard, DHCP Guard, and Binding Table Guard) validate data link layer addresses to prevent spoofing, and a recovery mechanism restores the binding table after device reboot to maintain security posture. These two functions work together to secure Layer 2 bindings.
Why the other options are wrong
- A. IPv6 HSRP is a gateway redundancy protocol, not a mechanism for binding table operation.
- D. IPv6 routing protocols require authentication configuration; the binding table does not inherently secure them without authentication.
- E. The binding table stores IPv6 address-to-MAC bindings, not IPsec hashed keys.
Question 35
AS 111 wanted to use AS 200 as the preferred path for 172.20.5.0/24 and AS 100 as the backup. After the configuration, AS 100 is not used for any other routes. Which configuration resolves the issue?
Show answer and explanation
Correct answer: A. route-map SETLP permit 10 match ip address prefix-list PLIST1 set local-preference 99 route-map SETLP permit 20
AS 111 needs to prefer AS 200 for 172.20.5.0/24 while keeping AS 100 as backup. Currently, the configuration applies a local-preference of 90 to traffic matching PLIST1 from AS 100, making it less preferred. To make AS 200 the primary path, the route-map SETLP needs a second permit statement (permit 20) without any match condition that will apply a higher local-preference (or default 100) to all other routes from AS 100, ensuring AS 200 remains preferred for the specific prefix while AS 100 handles other traffic. Option A adds this permit 20 statement, allowing the route-map to function correctly with the existing neighbor configurations already in place.
Why the other options are wrong
- B. Removing the route-map from AS 100 and applying it to AS 200 reverses the preference logic and breaks the intended configuration structure.
- C. Setting local-preference to 110 for the matched prefix would make AS 100 preferred over AS 200 (which receives 100 by default), the opposite of the requirement.
- D. Changing the route-map direction to 'out' on AS 100 applies policy to outbound advertisements rather than inbound received routes, which does not control inbound path preference.
Question 36
An engineer creates a Cisco DNA Center cluster with three nodes, but all the services are running on one host node. Which action resolves this issue?
Show answer and explanation
Correct answer: C. Enable service distribution from the Systems 360 page.
When all services in a DNA Center cluster run on a single node instead of being distributed across the three-node cluster, enabling service distribution from the Systems 360 page redistributes the services across available cluster nodes. This balances the load and ensures high availability by spreading services across the cluster infrastructure.
Why the other options are wrong
- A. While network connectivity is important, restoring a switch link would not directly trigger service rebalancing across cluster nodes.
- B. Upgrading to the latest DNA Center version does not automatically redistribute services across existing cluster nodes.
- D. Manually selecting services to move is a manual workaround; the proper automated solution is enabling service distribution.
Question 37
Which BGP attribute can be used to influence the path that outgoing traffic takes from your AS to other Autonomous Systems? (Choose two.)
Show answer and explanation
Correct answer: C, D. Weight; Local Preference
Outgoing traffic is steered by the attributes your own routers use to choose among the paths they receive. Weight is local to one router (highest wins) and Local Preference is shared across your AS (highest wins), so both control which exit your traffic uses. MED and AS_Path prepending are used to influence how other ASes send traffic into your AS.
Why the other options are wrong
- A. MED is sent to a neighboring AS to suggest which entry point it should use into your AS, so it influences inbound traffic.
- B. AS_Path prepending makes your routes look longer to other ASes, which influences how they send traffic into your AS (inbound), not your outgoing path.
Question 38
In an MPLS network, which of the following describes the role of the Provider (P) router?
Show answer and explanation
Correct answer: B. To connect to PE routers and act as transit routers
Provider (P) routers are core routers in an MPLS network that connect PE (Provider Edge) routers together and act as transit routers, forwarding MPLS-labeled packets based on the label switching table. They do not have direct customer connections or VPN awareness.
Why the other options are wrong
- A. Connecting to CE devices is the role of PE (Provider Edge) routers, not P routers.
- C. While labels are imposed in MPLS networks, this is done by ingress routers (PE routers), not P routers which swap labels.
- D. VPN route filtering is performed at PE routers which maintain VPN routing information, not at P routers.
Question 39
Which protocol does MPLS use to support traffic engineering?
Show answer and explanation
Correct answer: B. RSVP
MPLS uses RSVP-TE (Resource Reservation Protocol with Traffic Engineering extensions) to support traffic engineering. RSVP-TE allows explicit path setup for LSPs based on bandwidth and other constraints, enabling traffic engineering capabilities like load balancing and path optimization across the MPLS network.
Why the other options are wrong
- A. TDP (Tag Distribution Protocol) was a predecessor to LDP but is not used for traffic engineering.
- C. LDP distributes labels based on existing routing but does not support explicit path and constraint-based routing for TE.
- D. BGP is a routing protocol; it does not provide the signaling mechanism for MPLS traffic engineering.
Question 40
What is an advantage of using BFD?
Show answer and explanation
Correct answer: D. It has sub-second failure detection for layer 1 and layer 2 problems.
BFD (Bidirectional Forwarding Detection) provides sub-second failure detection for both Layer 1 (physical link) and Layer 2 (data link) problems. It operates at these lower layers to quickly identify link failures and trigger routing protocol updates. This sub-second detection is one of BFD's primary advantages over relying on routing protocol hello timers alone.
Why the other options are wrong
- A. BFD does not directly update the routing table itself; it triggers routing protocols to update, and it detects layer 1/2 issues, not purely layer 1.
- B. BFD operates at layers 1 and 2, not layer 3, and it detects the failure to allow routing protocols to respond.
- C. BFD detects layer 1 and 2 problems, not layer 1 and 3 problems.
Question 41
An engineer is trying to copy an IOS file from one router to another router by using TFTP. Which two actions are needed to allow the file to copy? (Choose two.)
Show answer and explanation
Correct answer: A, B. Copy the file to the destination router with the copy tftp: flash: command; Enable the TFTP server on the source router with the tftp-server flash: <filename> command
To copy an IOS file via TFTP between routers, two actions are required: enable the TFTP server on the source router using the tftp-server flash command (B) to allow it to serve the file, and use the copy tftp: flash: command on the destination router (A) to retrieve and write the file. TFTP is still supported in modern IOS versions and does not require user authentication.
Why the other options are wrong
- C. TFTP remains supported in recent IOS versions and is a valid method for file transfer.
- D. TFTP uses a simple unauthenticated protocol and does not require username/password configuration.
- E. Standard TFTP does not support authentication configuration; it is an unauthenticated protocol.
Question 42
Which function does LDP provide in an MPLS topology?
Show answer and explanation
Correct answer: B. It provides hop-by-hop forwarding in an MPLS topology for LSRs.
LDP (Label Distribution Protocol) is responsible for distributing labels between Label Switch Routers (LSRs) to enable hop-by-hop forwarding in an MPLS topology. LSRs use LDP to negotiate and exchange label bindings for IP routes, allowing packets to be forwarded based on labels rather than traditional IP lookups at each hop.
Why the other options are wrong
- A. LDP does not connect VPNs to P routers; that is typically the role of BGP in MPLS VPN architectures.
- C. Exchanging routes for MPLS VPNs across different VRFs is handled by BGP, not LDP.
- D. While LDP does exchange label information, it does not directly exchange IP routes; BGP handles route distribution.
Question 43
Which configuration feature should be used to block rogue router advertisements instead of using the IPv6 Router Advertisement Guard feature?
Show answer and explanation
Correct answer: B. PVLANs with promiscuous ports associated to route advertisements and isolated ports for nodes
Private VLANs (PVLANs) with promiscuous ports associated to route advertisements and isolated ports for nodes prevent rogue router advertisements. The promiscuous port handles legitimate RA traffic while isolated ports are restricted from receiving unauthorized RAs, effectively blocking rogue advertisements without using the RA Guard feature.
Why the other options are wrong
- A. VACLs block frames based on MAC addresses but are not the primary mechanism for controlling router advertisements.
- C. Community ports allow inter-community communication, which is not the correct isolation model for blocking rogue RAs.
- D. IPv4 ACLs cannot control IPv6 router advertisements and are the wrong protocol family.
Question 44
Which statement about IPv6 ND inspection is true?
Show answer and explanation
Correct answer: B. It learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables.
IPv6 ND (Neighbor Discovery) inspection learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables. It operates at Layer 2 to validate and protect IPv6 address-to-MAC bindings learned through stateless address autoconfiguration, preventing attacks such as address spoofing.
Why the other options are wrong
- A. ND inspection operates at Layer 2, not Layer 3 neighbor tables.
- C. ND inspection protects stateless autoconfiguration addresses, not stateful ones, and operates at Layer 2.
- D. While Layer 2 is correct, stateful autoconfiguration is not the focus of ND inspection.
Question 45
An engineer must configure a Cisco router to initiate secure connections from the router to other devices in the network but kept failing. Which two actions resolve the issue? (Choose two.)
Show answer and explanation
Correct answer: B, C. Configure a domain name; Configure a crypto key to be generated.
To initiate secure SSH connections from a router, two prerequisites are required: a domain name (needed to generate RSA keys for SSH) and crypto key generation (the actual SSH host keys). Without a configured domain name, the router cannot generate RSA keys, and without crypto keys, SSH cannot function. The transport input ssh command applies to inbound connections, not outbound initiations.
Why the other options are wrong
- A. The 'transport input ssh' command controls inbound SSH connections on the console, not outbound SSH initiations from the router.
- D. SSH uses dynamic source ports for outbound connections; administrators do not manually configure source ports for SSH client initiations.
- E. TACACS+ authentication is optional for SSH functionality and is not required to initiate connections.
Question 46
Which method provides failure detection in BFD?
Show answer and explanation
Correct answer: B. short duration, low overhead
Bidirectional Forwarding Detection (BFD) provides failure detection through short duration, low overhead mechanisms. BFD uses rapid hello packets (configurable to detect failures in subsecond timeframes) with minimal CPU and bandwidth overhead, making it an efficient protocol for detecting link and path failures faster than traditional routing protocol convergence methods.
Why the other options are wrong
- A. Long duration contradicts BFD's design principle of rapid failure detection in subsecond timeframes.
- C. Long duration with high overhead describes traditional routing protocol convergence, not the efficient BFD mechanism.
- D. While BFD uses short duration, high overhead would be inefficient and contrary to BFD's lightweight design.
Question 47
Which mechanism must be chosen to optimize the reconvergence time for OSPF at company location 408817202 that is less CPU-intensive than reducing the hello and dead timers?
Show answer and explanation
Correct answer: B. BFD
BFD (Bidirectional Forwarding Detection) is the optimal mechanism to reduce OSPF reconvergence time with less CPU overhead than lowering hello and dead timers. BFD provides sub-second failure detection at lower protocol layers and notifies OSPF immediately when a link fails, allowing fast reconvergence without increasing the processing burden of frequent hello packet exchanges.
Why the other options are wrong
- A. SSO (Stateful Switchover) is for router redundancy and does not optimize OSPF reconvergence time.
- C. Dead Peer Detection keepalives are used for BGP, not OSPF, and do not provide the same convergence benefits as BFD.
- D. OSPF demand circuit reduces LSA flooding but does not optimize reconvergence time for topology changes.
Question 48
What is the total length of an MPLS header?
Show answer and explanation
Correct answer: D. 32 bits
An MPLS header (also called an MPLS shim header) is exactly 32 bits long. It consists of a 20-bit label field, a 3-bit experimental (CoS) field, a 1-bit bottom of stack flag, and an 8-bit TTL field, totaling 32 bits.
Why the other options are wrong
- A. 16 bits is too small to accommodate all MPLS header fields.
- B. 20 bits is the size of only the label field, not the entire header.
- C. 28 bits does not align with the standard MPLS header structure.
Question 49
The network administrator configured R1 for Control Plane Policing so that the inbound Telnet traffic is policed to 100 kbps. This policy must not apply to traffic coming in from 10.1.1.1/32 and 172.16.1.1/32. The administrator has configured this: access-list 101 permit tcp host 10.1.1.1 any eq 23 access-list 101 permit tcp host 172.16.1.1 any eq 23 ! class-map CoPP-TELNET match access-group 101 ! policy-map PM-CoPP class CoPP-TELNET police 100000 conform transmit exceed drop ! control-plane service-policy input PM-CoPP The network administrator is not getting the desired results. Which set of configurations resolves this issue?
Show answer and explanation
Correct answer: A. no access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any
The current ACL permits traffic from 10.1.1.1 and 172.16.1.1 to be policed, but the requirement is to exempt these sources from policing. The solution inverts the logic with deny statements for these specific hosts followed by a permit-all statement, ensuring that only traffic NOT from these addresses matches the class-map and gets policed.
Why the other options are wrong
- B. Moving the service-policy to an interface instead of control-plane does not protect the CPU from control plane traffic and fails to address the ACL logic issue.
- C. While it includes the correct ACL changes, applying the policy to an interface rather than the control-plane does not protect the router's CPU.
- D. Simply removing and re-adding the same service-policy without changing the ACL logic does not resolve the exemption issue.
Question 50
What are two characteristics of IPv6 Source Guard? (Choose two.)
Show answer and explanation
Correct answer: A, D. requires the user to configure a static binding; requires IPv6 snooping on Layer 2 access or trunk ports
IPv6 Source Guard requires the user to configure a static binding when dynamic binding information is unavailable (A), and it requires IPv6 snooping on Layer 2 access or trunk ports to build and maintain the binding table of legitimate sources (D). These are foundational requirements for the feature to function properly.
Why the other options are wrong
- B. IPv6 Source Guard is a Layer 2 access control feature, not primarily used for service provider DDoS protection.
- C. The validate prefix feature is not a prerequisite for IPv6 Source Guard operation.
- E. IPv6 Source Guard does not independently recover missing binding table entries; it relies on snooping to populate them.
Question 51
Which of the following are control plane protocols used within a service provider MPLS network? (Choose two.)
Show answer and explanation
Correct answer: B, E. RSVP; LDP
LDP (Label Distribution Protocol) and RSVP (Resource Reservation Protocol) are the two primary control plane protocols used in service provider MPLS networks to distribute labels and establish Label Switched Paths. OAM is an operations protocol, Targeted LDP is a variant of LDP, and SNMP is a management protocol, none of which are core control plane protocols for MPLS label distribution.
Why the other options are wrong
- A. OAM is an operations and management protocol, not a control plane protocol for label distribution.
- C. Targeted LDP is a variant/mode of LDP, not a separate control plane protocol.
- D. SNMP is a management protocol used for network management, not for MPLS control plane operations.
Question 52
Router R1 is configured using VRF’s to support customer VPN’s. Some customers are using the same private IP address space. Which of the following is used to ensure that these routes are unique when advertised throughout the VPN?
Show answer and explanation
Correct answer: A. Route Distinguisher
Route Distinguishers (RDs) are 64-bit values prepended to VPN IPv4 or IPv6 addresses to make them globally unique within the MPLS VPN network. This allows multiple customers to use overlapping private IP address spaces because the RD creates a unique identifier for each route, even if the underlying IP prefix is identical across different VRFs.
Why the other options are wrong
- B. Route Targets are used for import/export policies to control which VRF instances receive which routes, not for making routes unique.
- C. MP-BGP (Multiprotocol BGP) is the protocol used to advertise VPN routes, but RD is the mechanism that ensures uniqueness.
- D. LDP (Label Distribution Protocol) is used for label distribution, not for addressing route uniqueness in VPN contexts.
Question 53
While working with software images, an engineer observes that Cisco DNA Center cannot upload its software image directly from the device. Why is the image not uploading?
Show answer and explanation
Correct answer: B. The software image for the device is in install mode.
Cisco DNA Center cannot upload software images directly from devices that are in install mode. Images must be in bundle mode to be uploaded to DNA Center. Install mode is a state where the image is extracted and ready for device installation, whereas bundle mode is the packaged form suitable for upload and distribution.
Why the other options are wrong
- A. Resyncing a device addresses connectivity issues, not image mode compatibility problems.
- C. If connectivity were lost, the error would indicate a connection failure rather than an upload incompatibility issue.
- D. Bundle mode is actually the correct mode for uploading images; install mode is the problematic state.
Question 54
Which two components are required for MPLS Layer 3 VPN configuration? (Choose two.)
Show answer and explanation
Correct answer: C, E. Use a unique RD per customer VRF; Use MP-BGP for customer routes.
MPLS Layer 3 VPNs require two essential components: a unique Route Distinguisher (RD) per customer VRF to ensure different customers can use overlapping address spaces while keeping their routes separate, and MP-BGP (Multiprotocol BGP) to exchange customer routes between Provider Edge routers across the MPLS backbone. These two elements are the fundamental building blocks for Layer 3 VPN operation.
Why the other options are wrong
- A. LDP is used for label distribution in MPLS but is not specifically required for customer route handling in Layer 3 VPNs; MP-BGP is the standard for customer routes.
- B. Pseudowires are Layer 2 technologies used for Ethernet or other data link layer services, not Layer 3 VPN configuration.
- D. OSPF can be used between PE and CE for dynamic routing, but it is not a requirement; static routing or other IGPs are also valid.
Question 55
Which BGP attribute can be used to influence the path that incoming traffic takes into your AS from other Autonomous Systems?
Show answer and explanation
Correct answer: B. AS_Path
AS_Path is used to influence incoming traffic into your AS from other Autonomous Systems. By prepending your AS number to the AS_Path attribute in outbound advertisements, you make your routes appear less desirable via that path, causing external AS neighbors to prefer alternate paths to reach your networks. This is the primary tool for inbound traffic engineering.
Why the other options are wrong
- A. Metric manipulation is an OSPF/EIGRP concept, not a BGP attribute.
- C. Weight is a local BGP attribute used only on the local router to influence outbound traffic, not incoming traffic from other ASes.
- D. Local Preference influences path selection within your own AS, not how external ASes route traffic to you.
Question 56
An engineer configured a Cisco router to send reliable and encrypted notifications for any events to the management server. It was noticed that the notification messages are reliable but not encrypted. Which action resolves the issue?
Show answer and explanation
Correct answer: B. Configure all devices for SNMPv3 informs with priv.
SNMPv3 informs provide reliability through acknowledgment mechanism and require 'priv' (privacy) for encryption. While traps are unreliable, informs are the reliable counterpart. To achieve both reliability and encryption, SNMPv3 informs must be configured with the 'priv' parameter for data encryption.
Why the other options are wrong
- A. Informs with only 'auth' provide reliability and authentication but lack encryption, leaving notifications unencrypted.
- C. Traps are inherently unreliable as they do not require acknowledgment, regardless of authentication level.
- D. Traps with 'priv' would encrypt the notifications but fail to provide the reliability requirement mentioned in the scenario.
Question 57
What are two purposes of using IPv4 and VPNv4 address-family configurations in a Layer 3 MPLS VPN? (Choose two.)
Show answer and explanation
Correct answer: A, B. RD is prepended to the IPv4 route to make it unique; The VPNv4 address consists of a 64-bit route distinguisher that is prepended to the IPv4 prefix.
Options A and B are correct: The Route Distinguisher (RD) is a 64-bit value prepended to IPv4 routes to create unique VPNv4 addresses, allowing overlapping customer address spaces to coexist. The RD makes each customer's identical IPv4 prefix globally unique within the MPLS network. Option C is misleading, overlapping addresses are allowed through VPNv4, not IPv4. Option D is incorrect, MPLS labels are tagged based on FEC (forwarding equivalence class), not IPv4 addresses. Option E is partially correct but less directly addresses the core purpose of the dual address-family configuration.
Why the other options are wrong
- C. While VPNv4 does allow overlapping addresses, the primary purpose of the address families is RD prepending, not just enabling overlap
- D. MPLS labels are determined by the FEC mapping process, not by the IPv4 address itself
- E. While VPNv4 is used to advertise labels, this is covered more directly by option A describing RD prepending
Question 58
You have configured router R1 with multiple VRF’s in order to support multiple customer VPN networks. If you wanted to see the best path for the 10.1.1.0.24 route in VRF Blue, what command would you use?
Show answer and explanation
Correct answer: A. show ip route vrf Blue 10.1.1.0
The correct Cisco IOS command syntax for viewing routing information within a specific VRF is 'show ip route vrf [vrf-name] [route]'. This command displays the best path for the specified route within the Blue VRF's routing table.
Why the other options are wrong
- B. Incorrect command syntax; the vrf parameter comes before the route specification
- C. Not a valid Cisco IOS command for VRF route lookup
- D. Not a valid Cisco IOS command for VRF route lookup
Question 59
When configuring Control Plane Policing on a router to protect it from malicious traffic, an engineer observes that the configured routing protocols start flapping on that device. Which action in the Control Plane Policy prevents this problem in a production environment while achieving the security objective?
Show answer and explanation
Correct answer: B. Set the conform-action and exceed-action to transmit initially to test the ACLs and transmit rates and apply the Control Plane Policy in the input direction.
To safely test Control Plane Policing in production without disrupting routing protocols, the engineer should set both conform-action and exceed-action to 'transmit' initially to validate ACLs and rates without dropping traffic. The policy should be applied in the input direction on the control plane to monitor management traffic. Once validated and rates are confirmed correct, actions can be changed to drop.
Why the other options are wrong
- A. Applying in the output direction is incorrect; input direction is where incoming management and routing protocol traffic should be policed.
- C. Using drop for exceed-action from the start risks disrupting routing protocols before rates are properly validated.
- D. The output direction is not appropriate for control plane policing of incoming management and routing protocol traffic.
Question 60
What is a characteristic of Layer 3 MPLS VPNs?
Show answer and explanation
Correct answer: A. Traffic engineering capabilities provide QoS and SLAs.
Layer 3 MPLS VPNs provide traffic engineering capabilities that enable Quality of Service (QoS) and Service Level Agreements (SLAs). Through MPLS label switching and constraint-based routing, traffic can be engineered along specific paths with guaranteed bandwidth and performance characteristics, meeting SLA requirements.
Why the other options are wrong
- B. Traffic engineering in MPLS typically works with a single IGP instance, not multiple; multiple IGP instances are not a standard TE characteristic.
- C. LSP signaling does not require unnumbered IP links; numbered links are commonly used for MPLS traffic engineering.
- D. Authentication in MPLS VPNs is not primarily performed using digital certificates or preshared keys; BGP authentication and physical security are more common.
Question 61
A network administrator performed a Compact Flash Memory upgrade on a Cisco Catalyst 6509 Switch. Everything is functioning normally except SNMP, which was configured to monitor the bandwidth of key interfaces but the interface indexes are changed. Which global configuration resolves the issue?
Show answer and explanation
Correct answer: A. snmp-server ifindex persist
The snmp-server ifindex persist command preserves SNMP interface index mappings across device reboots and configuration changes, which is essential when hardware upgrades like Compact Flash Memory changes occur. This prevents SNMP monitoring configurations from breaking due to interface index reassignments, allowing bandwidth monitoring to continue functioning with the original configured interface indexes.
Why the other options are wrong
- B. snmp-server ifindex permanent is not a valid Cisco command for this purpose.
- C. snmp ifindex persist lacks the required snmp-server context and is not a valid command syntax.
- D. snmp ifindex permanent is not a valid Cisco configuration command.
Question 62
Which of the following statements are true regarding two EIGRP routers to become neighbors?
Show answer and explanation
Correct answer: D. Must use the same ASN.
EIGRP routers must use the same Autonomous System Number (ASN) to become neighbors. This is a fundamental requirement that establishes they belong to the same routing domain. While hello and dead timers can differ and still allow adjacency, MTU mismatches are detected but don't prevent neighbor formation, the ASN match is absolute and required for EIGRP peering.
Why the other options are wrong
- A. Hello and dead timers can be different between EIGRP neighbors; timer mismatches do not prevent adjacency.
- B. Router IDs are not required to be unique for EIGRP neighbors to form (unlike OSPF); EIGRP uses IP addresses for identification.
- C. MTU mismatches are detected and logged but do not prevent EIGRP neighbors from forming.
Question 63
Which mechanism provides traffic segmentation within a DMVPN network?
Show answer and explanation
Correct answer: C. MPLS
MPLS provides traffic segmentation capabilities within a DMVPN network through label-based forwarding, allowing different traffic classes and flows to be separated and managed independently. This enables Quality of Service (QoS) and security policies to be applied to different traffic types within the same DMVPN overlay.
Why the other options are wrong
- A. BGP is a routing protocol and does not provide traffic segmentation mechanisms within DMVPN.
- B. IPsec provides encryption and authentication but is not the mechanism for traffic segmentation within DMVPN.
- D. RSVP is used for QoS signaling and reservation but is not the primary mechanism for traffic segmentation in DMVPN networks.
Question 64
At which layer of the OSI model is an MPLS label imposed?
Show answer and explanation
Correct answer: C. Between layers 2 and 3
MPLS labels are positioned between Layer 2 (Data Link) and Layer 3 (Network), creating what is sometimes called 'Layer 2.5'. This allows MPLS to operate at the forwarding plane between traditional Data Link and Network layer functions.
Why the other options are wrong
- A. Layer 2 alone does not account for the network-layer awareness that MPLS requires.
- B. Layer 3 alone does not account for the Data Link layer positioning of MPLS labels.
- D. Layers 3 and 4 positioning is incorrect; MPLS operates before the Transport layer.
Question 65
An engineer configured SNMP notifications sent to the management server using authentication and encrypting data with DES. An error in the response PDU is received as "UNKNOWNUSERNAME, WRONGDIGEST". Which action resolves the issue?
Show answer and explanation
Correct answer: B. Configure correct authentication and privacy passwords using SNMPv3 authPriv.
The error 'UNKNOWNUSERNAME, WRONGDIGEST' indicates authentication failure combined with encryption issues. SNMPv3 authPriv mode provides both authentication and privacy (encryption) with passwords. Since DES encryption is already being used, the solution is to configure correct credentials using authPriv mode to ensure both authentication and encryption are properly matched.
Why the other options are wrong
- A. authNoPriv provides only authentication without encryption, but the issue requires encryption (priv) to work with the DES configuration.
- C. authNoPriv still lacks privacy/encryption capabilities needed for the DES encryption that was configured.
- D. This specifies only authentication password, missing the privacy password required for DES encryption to function properly with authPriv.
Question 66
The network administrator configured CoPP so that all HTTP and HTTPS traffic from the administrator device located at 172.16 1.99 toward the router CPU is limited to 500 kbps. Any traffic that exceeds this limit must be dropped. access-list 100 permit ip host 172.16.1.99 any ! class-map CM-ADMIN match access-group 100 ! policy-map PM-COPP class CM-ADMIN police 500000 conform-action transmit ! interface E0/0 service-policy input PM-COPP CoPP failed to capture the desired traffic and the CPU load is getting higher. Which two configurations resolve the issue? (Choose two.)
Show answer and explanation
Correct answer: A, D. interface E0/0 no service-policy input PM-COPP ! control-plane service-policy input PM-COPP; no access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80 access-list 100 permit tcp host 172.16.1.99 any eq 443
Two changes are needed: first, move the service-policy from interface E0/0 to the control-plane (A), since CoPP must be applied at the control-plane level to protect the CPU, not on individual interfaces. Second, the ACL must be more specific to match only HTTP (80) and HTTPS (443) traffic rather than all IP traffic (D), and the police rate should specify the action on exceed (typically drop).
Why the other options are wrong
- B. The police rate of 500 kbps is incorrect; the original 500000 (500 kbps in bits) was correct, and the exceed action must be specified.
- C. The ACL must include both HTTP and HTTPS, not just HTTP, to capture the desired traffic.
Question 67
IPv6 is enabled in the infrastructure to support customers with an IPv6 network over WAN and to connect the head office to branch offices in the local network. One of the customers is already running IPv6 and wants to enable IPv6 over the DMVPN network infrastructure between the headend and branch sites. Which configuration command must be applied to establish an mGRE IPv6 tunnel neighborship?
Show answer and explanation
Correct answer: B. tunnel mode gre multipoint ipv6
To establish an mGRE (multipoint GRE) IPv6 tunnel neighborship, the tunnel mode must be explicitly configured as 'tunnel mode gre multipoint ipv6'. This command enables the tunnel interface to support IPv6 traffic over a multipoint GRE infrastructure, allowing DMVPN to function with IPv6.
Why the other options are wrong
- A. ipv6 nhrp holdtime configures NHRP timers but does not establish the tunnel mode itself.
- C. ipv6 unicast-routing enables IPv6 routing globally but does not configure the specific tunnel mode for mGRE IPv6.
- D. tunnel protection mode ipv6 configures IPsec protection but does not establish the fundamental mGRE IPv6 tunnel mode.
Question 68
What is an MPLS LDP targeted session?
Show answer and explanation
Correct answer: D. label distribution session between non-directly connected neighbors
An MPLS LDP targeted session is a label distribution session established between non-directly connected LSR neighbors using TCP. Unlike standard LDP sessions that use UDP hellos to discover directly connected neighbors, targeted sessions allow LSRs that are not adjacent to establish LDP sessions by explicitly configuring the TCP connection, enabling label distribution across multiple hops.
Why the other options are wrong
- A. Multicast hello packets are used for standard LDP discovery, not targeted sessions
- B. While targeted sessions do use TCP, they are specifically for non-adjacent neighbors, not just any LSR pair
- C. This describes standard LDP discovery, which is limited to directly connected neighbors, not targeted sessions
Question 69
R1 and R2 are configured as eBGP neighbors. R1 is in AS100 and R2 is in AS200. R2 is advertising these networks to R1: 172.16.16.0/20 172.16.3.0/24 172.16.4.0/24 192.168.1.0/24 192.168.2.0/24 172.16.0.0/16 The network administrator on R1 must improve convergence by blocking all subnets of 172.16.0.0/16 major network with a mask lower than 23 from coming in. Which set of configurations accomplishes the task on R1?
Show answer and explanation
Correct answer: B. ip prefix-list PL-1 deny 172.16.0.0/16 le 23 ip prefix-list PL-1 permit 0.0.0.0/0 le 32 ! router bgp 100 neighbor 192.168.100.2 remote-as 200 neighbor 192.168.100.2 prefix-list PL-1 in
The requirement is to block all subnets of 172.16.0.0/16 with a mask lower than /23 (meaning /22, /21, /20, etc.). The prefix-list syntax 'le 23' means 'less than or equal to 23,' which blocks prefixes with mask lengths from /16 up to /23. This correctly denies 172.16.16.0/20, 172.16.3.0/24, 172.16.4.0/24, and 172.16.0.0/16 while allowing other routes. The 'ge 23' in option A means 'greater than or equal to,' which would block /23 and longer (more specific) prefixes, opposite of the requirement.
Why the other options are wrong
- A. Uses 'ge 23' which means greater-than-or-equal, blocking only prefixes /23 or more specific, not less specific subnets
- C. Denies the entire 172.16.0.0/16 without length qualifiers, blocking all subnets including /24 entries that should be permitted
- D. Uses a standard access-list which cannot filter based on prefix length masks; prefix-lists are required for this granular control
Question 70
Two MPLS routers, R1 and R2, are not directly connected and have an established LDP session running between them. What type of LDP session is this?
Show answer and explanation
Correct answer: D. Targeted LDP session
A Targeted LDP session is established between two LDP routers that are not directly connected. The session is created by explicitly configuring each router to establish an LDP session with the other router's IP address, allowing label distribution to occur across non-adjacent routers without requiring a direct link.
Why the other options are wrong
- A. Remote LDP session is not a standard LDP terminology; the correct term is Targeted.
- B. A Direct LDP session (also called link LDP) requires routers to be directly connected on the same link.
- C. Tunneled LDP session is not standard terminology; Targeted LDP is the correct term for non-adjacent routers.
Question 71
A network administrator added a new spoke site with dynamic IP on the DMVPN network. Which configuration command passes traffic on the DMVPN tunnel from the spoke router?
Show answer and explanation
Correct answer: C. ip nhrp registration no-unique
The ip nhrp registration no-unique command allows a spoke router with a dynamic IP address to register with the NHRP server without requiring a unique address. This permits traffic to flow over the DMVPN tunnel even when the spoke's public IP changes, which is essential for spoke sites without static IP addresses.
Why the other options are wrong
- A. ip nhrp registration no-registration would disable NHRP registration entirely, preventing the spoke from functioning in the DMVPN network.
- B. ip nhrp registration dynamic is not the correct command; while it sounds relevant, no-unique is the proper syntax for dynamic IP spokes.
- D. ip nhrp registration ignore would prevent proper NHRP communication and tunnel establishment.
Question 72
Which one of the following statements regarding Bidirectional Forwarding Detection (BFD) is correct?
Show answer and explanation
Correct answer: A. BFD echo mode is the default mode of operation.
BFD echo mode is the default mode of operation. In echo mode, one BFD peer sends echo packets to the remote peer, which returns them without processing them through the BFD state machine. This provides faster failure detection than asynchronous mode and is the default configuration when BFD is enabled.
Why the other options are wrong
- B. BFD is supported for HSRP and can be configured to detect failures faster
- C. CEF does not need to be disabled for BFD to function; BFD operates independently
- D. BFD is supported with static routes and can be used to track static route viability
Question 73
Which statement about MPLS LDP router ID is true?
Show answer and explanation
Correct answer: B. The loopback with the highest IP address is selected as the router ID.
When an MPLS LDP router ID is not explicitly configured, the system automatically selects the loopback interface with the highest IP address as the router ID. This is the standard behavior in MPLS implementations because loopback interfaces are preferred for stability and redundancy over physical interfaces. The loopback with the highest numerical IP address wins the selection process.
Why the other options are wrong
- A. Physical interfaces are not chosen when a loopback is configured; loopback always takes precedence.
- C. The MPLS LDP router ID does not need to match the IGP router ID, though they often do.
- D. The force keyword causes convergence impact by changing the router ID, so the statement about no impact is false.
Question 74
What are two functions of LDP? (Choose two.)
Show answer and explanation
Correct answer: A, B. It advertises labels per Forwarding Equivalence Class; It uses Forwarding Equivalence Class.
LDP's primary functions are (A) advertising labels on a per-FEC (Forwarding Equivalence Class) basis to enable label switching, and (B) using Forwarding Equivalence Class as the basis for grouping packets that receive the same treatment. These are core LDP capabilities. LDP is defined in RFC 5036, not 3038/3039; it operates independently without requiring MPLS TE or RSVP.
Why the other options are wrong
- C. LDP is defined in RFC 5036 (the current standard), not RFC 3038 and 3039.
- D. LDP does not require MPLS Traffic Engineering; it can operate independently for basic label distribution.
- E. LDP does not require RSVP; RSVP is used separately for traffic engineering when needed.
Question 75
An engineer failed to run diagnostic commands on devices using Cisco DNA Center. Which action in Cisco DNA Center resolves the issue?
Show answer and explanation
Correct answer: D. Enable Command Runner.
The Command Runner feature in Cisco DNA Center enables engineers to execute diagnostic and operational commands on network devices. Enabling Command Runner provides the capability to run show commands, ping, traceroute, and other diagnostic utilities directly through the DNA Center interface without manual device access.
Why the other options are wrong
- A. While Secure Shell (SSH) is necessary for device connectivity, enabling it alone does not provide the diagnostic command execution interface within DNA Center.
- B. APIs enable programmatic access to DNA Center but do not directly provide the GUI-based command execution capability.
- C. CDP (Cisco Discovery Protocol) aids in device discovery and topology mapping but does not enable diagnostic command execution.
Question 76
An engineer configured the wrong default gateway for the Cisco DNA Center enterprise interface during the install. Which command must the engineer run to correct the configuration?
Show answer and explanation
Correct answer: A. sudo maglev-config update
The `sudo maglev-config update` command is the correct utility to update Cisco DNA Center configuration parameters after installation, including network settings like the default gateway. This command allows modification of configuration without requiring a full reinstall.
Why the other options are wrong
- B. The syntax 'maglev install config update' is not the correct command structure for configuration updates.
- C. Reinstalling would reset all configurations and is unnecessary when only updating a single parameter.
- D. The command structure 'update config install' does not follow Cisco DNA Center's command syntax.
Question 77
In a typical MPLS VPN, which routers act as the MPLS label imposition and disposition points in the network?
Show answer and explanation
Correct answer: C. PE Router
PE (Provider Edge) routers act as the points where MPLS labels are imposed on ingress traffic entering the MPLS network and where labels are disposed when traffic exits the MPLS network. PE routers connect customer networks (via CE routers) to the service provider's MPLS backbone and handle the label imposition/disposition operations that enable MPLS VPN functionality.
Why the other options are wrong
- A. CE (Customer Edge) routers are outside the MPLS domain and do not handle label operations.
- B. P (Provider) routers are internal to the MPLS network and perform label switching, not imposition/disposition.
- D. Core routers is not a standard MPLS terminology; the correct term is PE for edge label operations.
Question 78
An engineer is configuring a network and needs packets to be forwarded to an interface for any destination address that is not in the routing table. What should be configured to accomplish this task?
Show answer and explanation
Correct answer: B. set ip default next-hop
The 'set ip default next-hop' command is used in route policy or policy routing to forward packets to a specified interface when the destination address is not found in the routing table. This is the standard command for handling packets destined to unknown networks by sending them to a default next hop.
Why the other options are wrong
- A. The 'set ip next-hop' command sets a next hop for specific routes, not for all unmatched destinations.
- C. The 'set ip next-hop recursive' command performs recursive lookups on the next hop, not for default forwarding to unknown destinations.
- D. The 'set ip next-hop verify-availability' command verifies next-hop reachability but does not handle default forwarding for unmatched routes.
Question 79
A customer requested a GRE tunnel through the provider network between two customer sites using loopback to hide internal networks. Which configuration on R2 establishes the tunnel with R1?
Show answer and explanation
Correct answer: B. R2(config)#interface Tunnel1 R2(config-if#ip address 172.20.1.2 255.255.255.0 R2(config-if)#ip mtu 1400 R2(config-if)#ip tcp adjust-mss 1360 R2(config-if)#tunnel source 10.10.2.2 R2(config-if)#tunnel destination 10.10.1.1
Option B correctly establishes a GRE tunnel using loopback addresses (10.10.2.2 on R2 to 10.10.1.1 on R1), which hides internal networks as requested. The tunnel interface is assigned an IP from the 172.20.1.0/24 range, MTU is set to 1400 to accommodate GRE overhead, and tcp adjust-mss 1360 compensates for tunnel encapsulation, ensuring proper operation through the provider network.
Why the other options are wrong
- A. Uses physical interface IPs (192.168.x.x) instead of loopback addresses, which exposes internal network topology rather than hiding it.
- C. Uses loopback addresses correctly but sets MTU to 1500, which is too large for GRE encapsulation and may cause fragmentation issues.
- D. Mixes loopback destination (10.10.1.1) with physical source (192.168.20.1), inconsistently applying the loopback-hiding requirement.
Question 80
What is the function of BFD?
Show answer and explanation
Correct answer: C. It provides uniform failure detection regardless of media type
Bidirectional Forwarding Detection (BFD) provides uniform, media-independent failure detection. It operates consistently across different physical media types (Ethernet, serial, etc.) and offers faster link failure detection than traditional routing protocol mechanisms.
Why the other options are wrong
- A. BFD is lightweight and designed to minimize CPU utilization, not create it.
- B. BFD provides uniform failure detection regardless of media type, not limited to the same media.
- D. BFD does not negotiate versions with neighbors; it uses a simple, version-independent mechanism.
Question 81
An engineer configured a DHCP server for Cisco IP phones to download its configuration from a TFTP server, but the IP phones failed to load the configuration. What must be configured to resolve the issue?
Show answer and explanation
Correct answer: B. DHCP option 66
DHCP option 66 (TFTP Server Name) is the standard option used to provide IP phones with the address of a TFTP server from which they can download their configuration files. This option must be configured on the DHCP server for phones to successfully locate and retrieve their configuration.
Why the other options are wrong
- A. BOOTP port 67 is used for DHCP server communication but does not specify the TFTP server address needed for configuration download.
- C. BOOTP port 68 is used for DHCP client communication and does not configure the TFTP server location.
- D. DHCP option 69 does not exist in the standard DHCP options set; option 66 is the correct option for TFTP server specification.
Question 82
Which transport layer protocol is used to form LDP sessions?
Show answer and explanation
Correct answer: C. TCP
LDP (Label Distribution Protocol) uses TCP as its transport layer protocol to form and maintain reliable sessions between LDP peers. TCP is chosen because it provides reliable, ordered delivery of label information, which is critical for proper MPLS operation. LDP also uses UDP for discovery purposes, but sessions themselves are established over TCP.
Why the other options are wrong
- A. UDP is used for LDP discovery, not for the reliable session establishment itself.
- B. SCTP is not used by LDP; it is used in other protocols but not for label distribution.
- D. RDP is not a standard transport protocol used in modern networking; this is not a valid option.
Question 83
A network administrator is troubleshooting a high utilization issue on the route processor of a router that was reported by NMS. The administrator logged into the router to check the control plane policing and observed that the BGP process is dropping a high number of routing packets and causing thousands of routes to recalculate frequently. Which solution resolves this issue?
Show answer and explanation
Correct answer: D. Police the cir for BGP, conform-action transmit, and exceed action transmit.
To resolve high route processor utilization caused by BGP packet drops, policing (not shaping) should be applied with the CIR (Committed Information Rate) to regulate BGP traffic. Both conform and exceed actions should transmit the packets to allow BGP to function while rate-limiting. This prevents the route processor from being overwhelmed while maintaining BGP adjacencies and route stability.
Why the other options are wrong
- A. Shaping is used for traffic smoothing on output queues, not for control plane protection; PIR is wrong parameter, and the actions are incorrect.
- B. While policing is correct, using PIR instead of CIR is inappropriate for this scenario, and the actions (set-prec-transmit and set-clp-transmit) are incorrect.
- C. Shaping is inappropriate for control plane policing; CIR can be used with shaping but transmitting on both conform and exceed defeats the rate-limiting purpose.
Question 84
What are two functions of MPLS Layer 3 VPNs? (Choose two.)
Show answer and explanation
Correct answer: C, D. Customer traffic is encapsulated in a VPN label when it is forwarded in MPLS network; BGP is used for signaling customer VPNv4 routes between PE nodes.
Options C and D correctly describe MPLS Layer 3 VPN functions. Customer traffic is encapsulated with a VPN label for forwarding across the MPLS backbone, and BGP is used to dynamically signal customer VPNv4 routes between PE nodes, enabling scalability and dynamic route distribution. Option A describes point-to-multipoint Ethernet (not L3 VPN). Option B describes Segment Routing (SR-MPLS), not traditional MPLS L3 VPN. Option E discusses pseudowire signaling mechanisms but is not a primary function of L3 VPN.
Why the other options are wrong
- A. Transparent point-to-multipoint Ethernet connectivity is a Layer 2 VPN function, not Layer 3 VPN
- B. Node segment IDs and shortest path forwarding are characteristics of Segment Routing, not traditional MPLS VPN
- E. While LDP and BGP can signal pseudowires, this is not a defining function of Layer 3 VPN architecture
Question 85
Which of the following OSPF neighbor adjacency states is applicable only to manually configured OSPF neighbors in a Non Broadcast Multi-Access network?
Show answer and explanation
Correct answer: A. Attempt
The Attempt state is applicable only to manually configured OSPF neighbors in Non-Broadcast Multiple Access (NBMA) networks. This state indicates that the router is actively attempting to establish communication with a manually configured neighbor by sending unicast hello packets. In broadcast networks, neighbors transition directly from Down to Init state through multicast hello discovery.
Why the other options are wrong
- B. Init state applies to all OSPF neighbor adjacencies, not just NBMA networks
- C. 2-Way state is part of the standard adjacency process for all network types
- D. Exstart state occurs during the database exchange process for all network types
- E. Exchange state occurs during the database exchange process for all network types
Question 86
Which OSI model is used to insert an MPLS label?
Show answer and explanation
Correct answer: A. between Layer 2 and Layer 3
MPLS labels are inserted between Layer 2 (Data Link) and Layer 3 (Network). This is sometimes referred to as Layer 2.5, as MPLS operates at this boundary, allowing packet forwarding based on labels rather than traditional IP routing lookups. The label is prepended to the packet after Layer 2 framing and before Layer 3 processing.
Why the other options are wrong
- B. Layers 5 and 6 are in the upper layers (Session and Presentation) and have no relevance to MPLS label insertion.
- C. Layer 1 (Physical) is below Layer 2; MPLS does not operate at this level.
- D. Layer 3 and Layer 4 are both above the MPLS insertion point; MPLS operates between Layers 2 and 3.
Question 87
An engineer needs dynamic routing between two routers and is unable to establish OSPF adjacency. The output of the show ip ospf neighbor command shows that the neighbor state is EXSTART/EXCHANGE. Which action should be taken to resolve this issue?
Show answer and explanation
Correct answer: C. match the MTUs
When OSPF neighbors are stuck in EXSTART/EXCHANGE state, it typically indicates a problem with Maximum Transmission Unit (MTU) mismatch. During the exchange of Database Description packets in these states, MTU mismatches cause packets to be dropped or rejected, preventing progression to FULL state. Matching MTU sizes between routers resolves this issue.
Why the other options are wrong
- A. Password mismatches prevent adjacency from forming at all (routers stay in INIT or DOWN state), not causing EXSTART/EXCHANGE state.
- B. Hello timer mismatches prevent initial neighbor discovery but don't cause routers to get stuck in EXSTART/EXCHANGE state.
- D. Network type mismatches affect neighbor discovery and adjacency formation broadly, not specifically cause EXSTART/EXCHANGE state stalling.
Question 88
An engineer configured access list NON-CISCO in a policy to influence routes. What are the two effects of this route map configuration? (Choose two.)
Show answer and explanation
Correct answer: A, E. Packets are forwarded using normal route lookup; Packets are not evaluated by sequence 10.
Sequence 5 of route map PBR is a deny entry that matches the access list NON-CISCO. A packet that matches a deny entry is not policy routed, and no later sequence of the same route map is examined, so it does not reach sequence 10. It is forwarded by the normal routing lookup. The counters show that sequence 5 has matched 0 packets so far, while sequence 10 has policy routed 389362063 packets that did not match sequence 5.
Why the other options are wrong
- B. Packets are not sent to a default gateway by this entry. They use normal route lookup based on the routing table.
- C. A deny entry in a policy route map does not drop packets. It only exempts them from policy routing.
- D. Packets matching the deny in sequence 5 are not evaluated by sequence 10.
Question 89
How does an MPLS Layer 3 VPN differentiate the IP address space used between each VPN?
Show answer and explanation
Correct answer: C. by RD
The Route Distinguisher (RD) is the mechanism that differentiates IP address space between VPNs in Layer 3 MPLS VPNs. The RD is a 64-bit value that prepends to IPv4 prefixes, creating VPN-IPv4 addresses and allowing the same IPv4 address to be used in multiple VPNs without conflict.
Why the other options are wrong
- A. Route Target (RT) controls routing policy and import/export but does not differentiate the address space itself.
- B. Address families (IPv4, IPv6) categorize address types but do not provide VPN-specific differentiation.
- D. MP-BGP is the protocol used to distribute VPN routes but is not the mechanism that differentiates address space; the RD does.
Question 90
While troubleshooting connectivity issues to a router, these details are noticed: • Standard pings to all router interfaces, including loopbacks, are successful. • Data traffic is unaffected. • SNMP connectivity is intermittent. • SSH is either slow or disconnects frequently. Which command must be configured first to troubleshoot this issue?
Show answer and explanation
Correct answer: A. show policy-map control-plane
The symptoms indicate a Control Plane policing issue: pings and data traffic work fine, but management traffic like SNMP and SSH are slow or failing. The 'show policy-map control-plane' command displays the current Control Plane policing configuration and statistics, allowing the engineer to identify if legitimate management traffic is being rate-limited or dropped.
Why the other options are wrong
- B. The generic 'show policy-map' command does not specifically show Control Plane policies.
- C. While interface drops might be relevant, this command wouldn't directly show Control Plane policing issues.
- D. Routing issues are not the cause here, as data traffic and pings are working normally.
Question 91
Which statement about route distinguishers in an MPLS network is true?
Show answer and explanation
Correct answer: C. Route distinguishers make a unique VPNv4 address across the MPLS network.
Route Distinguishers make VPNv4 addresses globally unique across the MPLS network by prepending a 64-bit RD to the 32-bit IPv4 prefix, creating a 96-bit VPNv4 address. This allows different customers to use identical IPv4 address spaces without collision. Option A is incorrect, multiple routing table instances are enabled by VRFs, not RDs themselves. Option B is wrong, label bindings use FEC mapping. Option D confuses RDs with Route Targets, which control import/export policies.
Why the other options are wrong
- A. Multiple routing instances are created by VRF configuration, not by RDs
- B. Label bindings are determined by FEC (Forwarding Equivalence Class) mapping, not by RDs
- D. Import and export filtering are controlled by Route Targets (RT), not Route Distinguishers
Question 92
An engineer configured Reverse Path Forwarding on an interface and noticed that the routes are dropped when a route lookup fails on that interface for a prefix that is available in the routing table. Which interface configuration resolves the issue?
Show answer and explanation
Correct answer: C. ip verify unicast source reachable-via any
When RPF is configured and a route lookup fails on the incoming interface, the 'ip verify unicast source reachable-via any' command allows the packet to be forwarded if the source address is reachable via any interface in the routing table, not just the incoming interface. This resolves the issue where valid prefixes in the routing table were being dropped because they weren't found on the specific incoming interface.
Why the other options are wrong
- A. l2-src option checks reachability via Layer 2 source, which is not the intended behavior for this scenario.
- B. allow-default option permits use of the default route as a fallback, but doesn't check all routing table entries.
- D. rx option performs strict RPF checking on the receiving interface only, which is the original problematic behavior.
Question 93
An engineer notices that R1 does not hold enough log messages to identify the root cause during troubleshooting. Which command resolves this issue?
Show answer and explanation
Correct answer: C. (config)#logging buffered 16000 informational
To increase log message capacity for troubleshooting, the buffer size must be increased. The command `logging buffered 16000 informational` sets a 16000-byte buffer (larger than the 4096-byte default) and uses the informational severity level, which captures more message types than critical. This must be configured in config mode, making option C correct.
Why the other options are wrong
- A. Uses critical severity which filters out most messages, and 4096 bytes is insufficient.
- B. Uses critical severity which filters out informational and debug messages needed for troubleshooting.
- D. Uses only 4096 bytes, which is the default and still insufficient for adequate logging.
Question 94
In an MPLS VPN network, how are customer routes controlled and distributed?
Show answer and explanation
Correct answer: D. It is distributed through the use of route targets
In MPLS VPN networks, customer routes are controlled and distributed through the use of route targets, which are BGP extended communities that determine which VPN routes are imported and exported to specific PE routers and VPN instances.
Why the other options are wrong
- A. GRE tunnels are not the mechanism for controlling customer route distribution in MPLS VPN; they are separate tunneling technologies.
- B. Customer routes are not redistributed into the IGP but rather into BGP with route target attributes.
- C. While routes are redistributed into BGP, the specific control mechanism is through route targets, not just general BGP redistribution.
Question 95
A DMVPN single hub topology is using IPsec + mGRE with OSPF. What should be configured on the hub to ensure it will be the designated router?
Show answer and explanation
Correct answer: D. OSPF priority greater than 1
To ensure the hub becomes the Designated Router in an OSPF topology running over DMVPN, the hub's OSPF priority must be set higher than 1 (the default). OSPF uses priority values (0-255) to elect the DR, with higher values winning. Setting priority greater than 1 guarantees the hub will be elected DR, ensuring it is the central point of OSPF communication in the single-hub topology.
Why the other options are wrong
- A. Route maps set metrics for redistribution or path manipulation, not DR priority
- B. The 'ip nhrp ospf dr' command designates an NHRP server role, not OSPF DR priority
- C. Setting OSPF priority to 0 removes the router from DR election entirely, making it ineligible to be DR
Question 96
A network administrator must optimize the segment size of the TCP packet on the DMVPN IPsec protected tunnel interface, which carries application traffic from the head office to a designated branch. The TCP segment size must not overwhelm the MTU of the outbound link. Which configuration must be applied to the router to improve the application performance?
Show answer and explanation
Correct answer: B. interface tunnel30 ip mtu 1400 ip tcp adjust-mss 1360 ! crypto ipsec fragmentation after-encryption
The correct command is `ip tcp adjust-mss` which adjusts TCP Maximum Segment Size to account for IPsec overhead. Fragmentation must occur `after-encryption` so that the encrypted packets are fragmented if needed, preserving the integrity of the encryption and preventing reassembly issues.
Why the other options are wrong
- A. Uses incorrect command `ip tcp payload-size` and `before-encryption` fragmentation, which would fragment plaintext before encryption.
- C. Uses non-existent command `ip tcp max-segment` instead of the correct `adjust-mss` command.
- D. Uses incorrect command `ip tcp packet-size` and `after-encryption` is correct but the base command is wrong.
Question 97
An engineer is troubleshooting on the console session of a router and turns on multiple debug commands. The console screen is filled with scrolling debug messages that none of the commands can be verified if entered correctly or display any output. Which action allows the engineer to see entered console commands while still continuing the analysis of the debug messages?
Show answer and explanation
Correct answer: C. Configure the logging synchronous command.
The `logging synchronous` command synchronizes console output so that debug messages do not interrupt the display of entered commands. This allows the engineer to see what they type while still viewing the debug output, without requiring level specifications or global configuration.
Why the other options are wrong
- A. The 'term no mon' command is not a standard Cisco IOS command for managing debug output synchronization.
- B. Adding 'level all' to logging synchronous is unnecessary; the base command alone provides the synchronization needed.
- D. Disabling logging to console would eliminate visibility of debug messages entirely, defeating the purpose of the troubleshooting.
Question 98
Routers R1 and R2 have been configured to use Bidirectional Forwarding Detection? What is the advantage of doing this?
Show answer and explanation
Correct answer: D. It is able to discover local link failures at layers 1 and 2 and provides detection for this in less than one second.
BFD provides fast detection of link failures at layers 1 and 2 in less than one second, which is significantly faster than traditional routing protocol hello mechanisms. This rapid detection enables quick failover and rerouting, making BFD valuable for critical network paths. BFD operates independently of routing protocols and detects both physical layer and data-link layer failures.
Why the other options are wrong
- A. This option is incomplete and doesn't mention the sub-one-second detection time.
- B. This option is identical to A and still incomplete regarding detection speed.
- C. BFD detects failures at both layers 1 and 2, not layer 1 only.
Question 99
You have configured policy-based routing on router R1 to force some traffic to go over an alternate link. In order to verify the configuration, which debug command should be used to verify that the specific traffic is taking the intended path?
Show answer and explanation
Correct answer: C. Debug ip policy
The correct debug command for verifying policy-based routing is 'debug ip policy'. This command displays when policy-based routing is applied to packets, showing which route policy matches traffic and whether the policy is directing traffic as intended. This is the standard Cisco IOS command for troubleshooting PBR configurations.
Why the other options are wrong
- A. There is no 'debug policy routing' command; this is not valid IOS syntax.
- B. Debug ip routing shows general routing table operations but not policy-based routing specifically.
- D. Debug policy map is not a valid command for verifying policy-based routing behavior.
Question 100
Which of the following OSPF Link State Advertisements (LSA’s) were created for IPV6 and do not apply to IPv4 OSPF networks? (Choose two.)
Show answer and explanation
Correct answer: A, D. Link LSA (Type 8); Intra-Area Prefix LSA (Type 9)
OSPFv3 (IPv6 OSPF) introduced new LSA types that do not exist in IPv4 OSPF. Link LSA (Type 8) is used in OSPFv3 to advertise link-local information and prefixes on a link. Intra-Area Prefix LSA (Type 9) is used to advertise intra-area prefixes in OSPFv3. These two LSA types were created specifically for IPv6 and have no equivalent in IPv4 OSPF.
Why the other options are wrong
- B. Summary LSA (Type 3) exists in both IPv4 and IPv6 OSPF
- C. Router LSA (Type 2) exists in both IPv4 and IPv6 OSPF
- E. Opaque LSA (Type 9) designation is incorrect; Type 9 is Intra-Area Prefix LSA in OSPFv3, and Opaque LSAs (Types 10-12) exist in both IPv4 and IPv6
Question 101
Which list defines the contents of an MPLS label?
Show answer and explanation
Correct answer: A. 20-bit label; 3-bit traffic class; 1-bit bottom stack; 8-bit TTL
An MPLS label consists of four components in a 32-bit field: a 20-bit label value, a 3-bit traffic class (formerly called CoS), a 1-bit bottom-of-stack indicator, and an 8-bit TTL (Time To Live). This structure is defined in RFC 3031 and is the standard MPLS label format used across all implementations.
Why the other options are wrong
- B. While 32-bit total is correct, the label field itself is 20 bits, not the entire structure being 32-bit labeled as a single field.
- C. MPLS uses traffic class, not flow label, and TTL not hop limit; flow label and hop limit are IPv6 concepts.
- D. MPLS uses traffic class and TTL, not flow label and hop limit which are IPv6-specific fields.
Question 102
With Internal BGP, there is a requirement for all peers to be logically fully meshed, where all IBGP routers must peer with all other IBGP routers. For scaling purposes, there are two mechanisms that were developed to bypass this requirement. What are they? (Choose two.)
Show answer and explanation
Correct answer: A, D. Confederations; Route reflectors.
IBGP requires full mesh connectivity, but two mechanisms bypass this requirement. Route Reflectors allow a central router to reflect routes to clients, reducing peering requirements from n(n-1)/2 to linear scaling. Confederations divide a large AS into smaller sub-ASes that peer externally while maintaining logical AS unity, allowing hierarchical structure without full mesh. Both are standard BGP scaling solutions defined in RFC specifications.
Why the other options are wrong
- B. IBGP to EBGP route redistribution is not a mechanism for solving the full-mesh requirement; it mixes routing protocols and creates operational complexity.
- C. BGP peer filtering restricts which peers exchange routes but does not eliminate the requirement for full-mesh connectivity to exist logically.
Question 103
A network engineer is investigating a flapping (up/down) interface issue on a core switch that is synchronized to an NTP server. Log output currently does not show the time of the flap. Which command allows the logging on the switch to show the time of the flap according to the clock on the device?
Show answer and explanation
Correct answer: C. service timestamps log datetime localtime show-timezone
The command 'service timestamps log datetime localtime show-timezone' enables the router to include the current date and time with timezone information in log messages. This uses the router's clock (synchronized via NTP) to display when events like interface flaps occur, providing precise timestamp information in logs.
Why the other options are wrong
- A. service timestamps log uptime shows only the device uptime since last reboot, not the actual time of the event.
- B. The clock summer-time command configures daylight saving time transitions but does not enable timestamp logging.
- D. clock calendar-valid is a status command used to verify clock validity, not to enable timestamp logging.
Question 104
What is a function of IPv6 Source Guard?
Show answer and explanation
Correct answer: B. It works with address glean or ND to find existing addresses.
IPv6 Source Guard works with address glean or Neighbor Discovery (ND) protocol to discover and identify existing addresses on the network. It uses these mechanisms to build a binding table of legitimate source addresses and interfaces, which it then uses to filter unauthorized traffic.
Why the other options are wrong
- A. While Source Guard does use ND and DHCP information, its primary function is working with address discovery rather than building bindings from packet inspection.
- C. Source Guard does not notify ND protocol; it operates independently to filter traffic.
- D. Source Guard denies traffic from unknown or unauthorized sources, not from known sources.
Question 105
Which IGPs are supported by the MPLS LDP autoconfiguration feature?
Show answer and explanation
Correct answer: D. OSPF and IS-IS
MPLS LDP autoconfiguration is supported by OSPF and IS-IS. These two IGPs can automatically trigger LDP session establishment on interfaces where they are running, enabling dynamic MPLS label distribution. This feature is not supported by RIPv2 or EIGRP.
Why the other options are wrong
- A. IS-IS is correct, but RIPv2 does not support LDP autoconfiguration.
- B. RIPv2 does not support LDP autoconfiguration; OSPF does, but RIPv2 is not a supported protocol for this feature.
- C. OSPF is correct, but EIGRP does not support LDP autoconfiguration.
Question 106
In order to connect between disparate OSPF and EIGRP portions of a network, mutual route redistribution has been configured. What are two disadvantages of doing this? (Choose two.)
Show answer and explanation
Correct answer: A, B. Prone to routing loops if not done correctly; Differing metrics between the routing protocols could result in sub-optimal routing.
Route redistribution between OSPF and EIGRP creates two significant problems. First, routing loops can occur if redistribution is not carefully configured with proper route filtering and metrics, as packets could loop between the two routing domains. Second, the fundamental metric systems differ greatly, OSPF uses cost while EIGRP uses composite metrics, so incorrectly assigned metrics lead to suboptimal path selection and inefficient traffic flow.
Why the other options are wrong
- C. Route redistribution is fully supported on Cisco router platforms; this is a standard feature.
- D. While redistribution may affect convergence, increased convergence times are not a primary disadvantage compared to loops and suboptimal routing.
Question 107
Which of the following statements are true regarding the e IPv6 RA Guard feature?
Show answer and explanation
Correct answer: B. This feature is supported on private VLANs
IPv6 RA Guard is supported on private VLANs, allowing protection of isolated VLAN communities. This enables service providers to implement RA Guard in segmented network architectures.
Why the other options are wrong
- A. IPv6 RA Guard is not supported on LAG (Link Aggregation Group) bundle interfaces.
- C. Packets dropped by IPv6 RA Guard can be spanned for monitoring and troubleshooting purposes.
- D. IPv6 RA Guard does not provide protection in networks where IPv6 traffic is tunneled, as tunneling encapsulates the packets.
Question 108
Which of the following statements are true regarding two OSPF routers to become neighbors? (Choose two.)
Show answer and explanation
Correct answer: B, C. Must have identical hello and dead timers; Must have matching MTU’s on the physical network links that connect the routers.
OSPF routers must have identical hello and dead timers to establish neighbor adjacency; mismatches prevent the two-way state from being reached. Additionally, routers must have matching MTU sizes on the connecting interface; MTU mismatches prevent the exchange of database description packets and block adjacency formation. These are critical OSPF adjacency requirements.
Why the other options are wrong
- A. OSPF does not use ASN; it is not AS-aware. OSPF operates within an AS and does not require matching ASNs.
- D. OSPF routers must be on the same subnet (or configured with network statements that place them in the same area with proper subnet masks); they cannot be on different subnets and become neighbors.
Question 109
What are two functions of IPv6 Source Guard? (Choose two.)
Show answer and explanation
Correct answer: B, C. It denies traffic from unknown sources or unallocated addresses; It uses the populated binding table to allow legitimate traffic.
IPv6 Source Guard has two primary functions: it denies traffic from unknown sources or unallocated addresses (B) and uses the populated binding table generated from IPv6 Neighbor Discovery and DHCP snooping to allow legitimate traffic (C). It works in conjunction with these protocols to validate source legitimacy.
Why the other options are wrong
- A. IPv6 Source Guard depends on information from IPv6 Neighbor Discovery and DHCP snooping, not independent of them.
- D. While it uses ND information, it does not work by inspecting packets for specific patterns; it uses binding tables.
- E. IPv6 Source Guard relies on both DHCP and ND snooping, not DHCP inspection alone.
Question 110
An administrator attempts to download the .pack NBAR2 file using TFTP from the CPE router to another device over the Gi0/0 interface. The CPE is configured as below: hostname CPE ! ip access-list extended WAN <`¦> remark => All UDP rules below for WAN ID: S421T18E58F90 permit udp any eq domain any permit udp any any eq tftp deny udp any any ! interface GigabitEthernet0/0 <`¦> ip access-group WAN in <`¦> ! tftp-server flash:pp-adv-csr1000v-1612.1a-37-53.0.0.pack The transfer fails. Which action resolves this issue?
Show answer and explanation
Correct answer: C. Change the WAN ACL to permit the entire UDP destination port range
The ACL has `permit udp any eq tftp any` which matches source port tftp (69), but TFTP uses UDP port 69. The issue is that the ACL is checking source port equality instead of destination port. Changing to `permit udp any any eq 69` or permitting the entire UDP port range allows TFTP traffic destined for port 69 to pass through.
Why the other options are wrong
- A. ACL order matters, but moving the entry won't fix the port specification issue.
- B. TFTP file naming convention is not the cause; the ACL is blocking the traffic.
- D. While port 69 is correct, the existing rule already references tftp (which equals port 69); the real issue is the source/destination port direction in the ACL logic.
Question 111
How is VPN routing information distributed in an MPLS network?
Show answer and explanation
Correct answer: D. It is controlled using of VPN target communities.
VPN routing information in MPLS networks is controlled and distributed using VPN target communities (also called Route Targets or RT). These extended BGP communities determine which routes are imported into and exported from specific VRFs, controlling which customer sites can reach each other and maintaining VPN isolation.
Why the other options are wrong
- A. The top level of customer data packets contains labels, not routing information; routing is determined before encapsulation.
- B. VPN IPsec peers are not the mechanism for distributing VPN routing information; IPsec is an encryption protocol, not a routing control mechanism.
- C. RD (Route Distinguisher) differentiates address space but does not control routing distribution; RT controls which routes are imported/exported.
Question 112
Which feature minimizes DoS attacks on an IPv6 network?
Show answer and explanation
Correct answer: B. IPv6 Router Advertisement Guard
IPv6 Router Advertisement Guard (RA Guard) prevents rogue Router Advertisement messages, which are commonly exploited in DoS attacks to redirect traffic or degrade network performance. RA Guard validates RA messages and blocks unauthorized ones at Layer 2.
Why the other options are wrong
- A. IPv6 Binding Security Table is not a standard DoS mitigation feature for IPv6.
- C. IPv6 Prefix Guard is not a recognized IPv6 security feature for DoS protection.
- D. IPv6 Destination Guard does not specifically minimize DoS attacks on IPv6 networks.
Question 113
Which command allows traffic to load-balance in an MPLS Layer 3 VPN configuration?
Show answer and explanation
Correct answer: C. maximum-paths ibgp 2
The 'maximum-paths ibgp' command configures load-balancing for iBGP routes within an MPLS Layer 3 VPN. Since PE routers receive VPNv4 routes from other PEs via iBGP, this command allows traffic to load-balance across multiple equal-cost BGP paths. The 'ibgp' keyword specifically handles BGP internal routes, which is necessary for VPN environments where routes are learned via internal BGP.
Why the other options are wrong
- A. The command syntax 'multi-paths eibgp' is not valid Cisco IOS configuration
- B. 'maximum-paths' without the 'ibgp' keyword applies to eBGP, not the internal BGP routes used in MPLS VPN
- D. 'multi-paths' is not a valid IOS command; the correct command is 'maximum-paths'
That was 113 of 620.
The full Cisco 300-410 ENARSI pack has all 620 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 310 free as one PDF by email. Get the Half Pack →