Cisco CCNP Enterprise ENARSI (300-410)

Question 1

An engineer configures AAA on a router with the following: 'aaa new-model', 'aaa authentication login default group tacacs+', and a TACACS+ server that is fully reachable. After saving, remote SSH logins work correctly using TACACS+ credentials, but the engineer notices that when logging in through the physical console port, the router still prompts for and accepts credentials against the TACACS+ server rather than allowing local-only access. The console line has no 'login authentication' command applied. Why is the console being authenticated against TACACS+?

Accepted Answer

The 'default' method list is automatically applied to all lines, including the console, unless a named method list is explicitly applied to the console line

Answer

Console authentication always falls back to local by default and cannot use TACACS+ without a AAA server group defined on the line

Answer

The console line uses TACACS+ only because 'aaa authorization console' is enabled, which forces the console to inherit the default group

Answer

Enabling 'aaa new-model' disables all console authentication until 'login authentication default' is manually applied to line con 0

Question 2

A network engineer configures AAA on a router with the command 'aaa authentication login VTY-ACCESS group tacacs+ none' and applies it to the VTY lines. During a security audit, the auditor notes that when the TACACS+ servers were temporarily unreachable during maintenance, administrators were able to log in without providing any credentials. The engineer intended for local authentication to serve as the backup. Which change correctly resolves the security concern while preserving login access during a TACACS+ outage?

Accepted Answer

Change the method list to 'aaa authentication login VTY-ACCESS group tacacs+ local' and ensure a local username is configured

Answer

Change the method list to 'aaa authentication login VTY-ACCESS none group tacacs+' so local is tried first

Answer

Add 'aaa authentication login VTY-ACCESS enable none' to require the enable secret as a fallback

Answer

Keep the 'none' keyword but add 'login authentication default' to the console line only

Question 3

A network engineer configures a router to authenticate administrative logins against a RADIUS server. Users can log in successfully with their RADIUS credentials, but every user lands at privilege level 1 and cannot enter privileged EXEC mode even though the RADIUS server is configured to return a cisco-av-pair of 'shell:priv-lvl=15'. The relevant configuration includes 'aaa authentication login default group radius local' and 'line vty 0 4 / login authentication default'. Which configuration change will allow the returned privilege level to be applied automatically at login?

Accepted Answer

Add 'aaa authorization exec default group radius local' to the configuration

Answer

Add 'aaa authentication enable default group radius enable' to the configuration

Answer

Configure 'privilege level 15' under 'line vty 0 4'

Answer

Change the transport to TACACS+ because RADIUS cannot carry privilege-level attributes

Question 4

A network engineer configures AAA on a router with the commands 'aaa authentication login default group tacacs+' and points to a single TACACS+ server. During a maintenance window the TACACS+ server becomes unreachable, and all administrators are now locked out of the device even though local usernames exist. What change will allow login using the local database when the TACACS+ server is down, without weakening security while the server is reachable?

Accepted Answer

Change the method list to 'aaa authentication login default group tacacs+ local' so local is used only when the server group is unreachable

Answer

Add 'aaa authentication login default local group tacacs+' so the local database is always checked first

Answer

Add 'aaa authentication login default group tacacs+ none' so login succeeds automatically if TACACS+ is unreachable

Answer

Configure 'aaa authentication login default enable' to fall back to the enable secret password

Question 5

A network engineer configures a router to authenticate administrative logins against a TACACS+ server reachable only through the management VRF via Loopback0. Local logins work as a fallback, but every attempt to authenticate to the TACACS+ server times out. Debugging shows the packets are being sourced from the outbound physical interface IP, which is not permitted on the ACL protecting the TACACS+ server. Which configuration will resolve the authentication failures?

Accepted Answer

ip tacacs source-interface Loopback0 (with the appropriate vrf keyword in the server-group)

Answer

aaa authentication login default group tacacs+ local

Answer

tacacs-server directed-request restricted

Answer

aaa accounting exec default start-stop group tacacs+

Question 6

A network engineer configures BFD on a Layer 3 point-to-point link between R1 and R2 to speed up EIGRP convergence. The interface commands 'bfd interval 300 min_rx 300 multiplier 3' are applied on both routers, and the interface is up. However, when the link fails on an intermediate transport device, EIGRP still waits for its hold timer to expire before removing the neighbor. Running 'show bfd neighbors' on R1 shows no BFD sessions established. Which action will most likely enable BFD-triggered fast failover for EIGRP?

Accepted Answer

Enable BFD for EIGRP under the EIGRP process with the 'bfd interface <name>' or 'bfd all-interfaces' command so EIGRP registers as a BFD client

Answer

Increase the BFD multiplier to 5 on both routers to allow the session enough time to negotiate

Answer

Configure 'ip hello-interval eigrp <as> 1' on the interface to force EIGRP to detect the failure faster

Answer

Change the BFD interval to 50 ms so it falls below the EIGRP hold timer threshold

Question 7

An engineer configures a route map on R1 to tag routes learned from a customer eBGP peer with community 65000:100 so an upstream provider can filter them. After applying the policy, the neighbor R2 (the upstream) reports that none of the received prefixes carry the community. The relevant configuration on R1 is:

route-map SET-COMM permit 10
 match ip address prefix-list CUST-NETS
 set community 65000:100
!
router bgp 65000
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-map SET-COMM out

The prefixes are being advertised to R2 correctly, but without the community value. What is the most likely cause?

Accepted Answer

The 'neighbor 10.1.1.2 send-community' command is missing, so R1 does not transmit community attributes to R2.

Answer

The route map is missing an 'additive' keyword, so the community is silently discarded before transmission.

Answer

The prefix-list CUST-NETS must be applied inbound before communities can be set outbound.

Answer

eBGP peers strip all community attributes by default unless 'no bgp default community-strip' is configured.

Question 8

Two routers, R1 and R2, connect an EIGRP domain (AS 100) to an OSPF domain. Both routers perform mutual redistribution between EIGRP and OSPF. Network 10.50.0.0/24 originates natively in EIGRP. Users report intermittent reachability to 10.50.0.0/24 from the OSPF domain, and R2's routing table shows 10.50.0.0/24 pointing back into OSPF instead of via its native EIGRP path. The redistribution is configured with default settings and no route tagging or filtering is applied. What is the MOST likely cause?

Accepted Answer

The route was redistributed into OSPF as an external (O E2) route on R1, and because external OSPF (AD 110) is preferred over EIGRP external (AD 170) on R2, R2 installs the OSPF path, creating a feedback loop.

Answer

OSPF external E2 routes carry a metric of 20 by default, which is lower than the EIGRP composite metric, so R2 always prefers the OSPF path regardless of administrative distance.

Answer

EIGRP auto-summary is enabled, causing 10.50.0.0/24 to be summarized to 10.0.0.0/8 and suppressing the more specific route on R2.

Answer

Split horizon on the EIGRP interface between R1 and R2 prevents R2 from learning 10.50.0.0/24 via EIGRP, forcing it to use the OSPF path.

Question 9

A network engineer configures mutual redistribution between BGP (AS 65100) and EIGRP (AS 10) on two border routers, R1 and R2, that both connect to the same BGP and EIGRP domains. External EIGRP routes learned from BGP on R1 are being redistributed back into BGP on R2, then re-advertised and reinjected into EIGRP, causing intermittent routing loops. The engineer wants to prevent routes that originated in BGP from being redistributed back into BGP. Which configuration on both routers best prevents this loop?

Accepted Answer

Apply a route map on redistribution from EIGRP into BGP that matches and denies routes tagged when they were redistributed from BGP into EIGRP, and set that tag during the BGP-to-EIGRP redistribution.

Answer

Increase the administrative distance of external EIGRP routes to 255 on both routers so they are not installed in the routing table.

Answer

Enable auto-summary in the EIGRP process so that the more specific BGP-origin routes are suppressed before redistribution.

Answer

Configure split horizon on the EIGRP interfaces facing the BGP border so the routes are not advertised back out.

Question 10

A network engineer redistributes BGP-learned routes into OSPF on an ASBR using the command 'redistribute bgp 65001 subnets'. Users report that when there are two ASBRs advertising the same external prefixes with different internal path costs to reach them, traffic does not always take the path with the lowest total cost to the ASBR. The engineer confirms both ASBRs are advertising the routes. What is the MOST likely reason the internal cost to the ASBR is being ignored in path selection?

Accepted Answer

OSPF redistributes external routes as E2 by default, so only the external metric is considered and the internal cost to the ASBR is used only as a tiebreaker.

Answer

The 'subnets' keyword forces all redistributed routes to become E1, which sums internal and external cost incorrectly.

Answer

BGP routes cannot be redistributed into OSPF without a route map, so the metric is set to infinity.

Answer

OSPF external routes always use the internal cost only, so the issue must be a duplicate router ID on the two ASBRs.

Question 11

A network engineer configures policy-based routing on R2 to forward all HTTP traffic sourced from 10.1.1.0/24 out a backup ISP link. The route-map is applied inbound on the LAN interface and contains: 'match ip address HTTP_ACL' and 'set ip next-hop 203.0.113.5'. The primary default route via 198.51.100.1 remains active. After applying the policy, 'show route-map' shows zero policy matches even though users on 10.1.1.0/24 are actively browsing HTTP sites. The ACL correctly permits tcp any eq 80. What is the most likely reason PBR is not matching the traffic?

Accepted Answer

The ACL matches destination port 80 with 'eq 80' in the source position, so return traffic is matched instead of client requests, which arrive with a random source port and destination port 80

Answer

PBR only processes traffic that would otherwise be dropped, so packets with an existing default route bypass the route-map entirely

Answer

The 'set ip next-hop' address 203.0.113.5 must be directly connected; otherwise PBR silently ignores the route-map with no match counter increment

Answer

Route-maps applied inbound only evaluate routing-protocol updates, not data-plane packets, so 'ip policy route-map' must be used instead

Question 12

A network engineer uses Cisco Catalyst Center Assurance to investigate user complaints in a warehouse. The wireless Client Health dashboard shows several clients with a poor health score, and the client 360 view flags them during the 'Onboarding' phase with the RF metric indicating a high noise floor of -78 dBm on the 2.4 GHz band. AP and WLC device health scores are all green, and RADIUS authentication times are normal. Which conclusion is best supported by this Assurance data?

Accepted Answer

The clients are experiencing RF interference, and the onboarding delay is caused by association/DHCP issues aggravated by the poor signal-to-noise environment, not by infrastructure device or authentication failures

Answer

The WLC is overloaded, since a poor client health score always indicates a device health problem on the controller

Answer

The RADIUS server is dropping requests, because onboarding-phase failures are exclusively caused by AAA timeouts

Answer

The AP firmware is corrupted, as Assurance only reports a high noise floor when an AP radio driver has crashed

Question 13

A network engineer is troubleshooting an intermittent connectivity issue on a busy WAN router. Traffic from a single host (10.1.1.50) to a remote server needs to be examined, but running 'debug ip packet detail' floods the console and spikes CPU because of the high traffic volume. The engineer wants to limit the debug output to only packets to/from that one host without impacting other traffic. Which action correctly restricts the debug output?

Accepted Answer

Configure an access list matching host 10.1.1.50, then run 'debug ip packet detail <acl-number>' to filter the debug to matching packets

Answer

Enter 'debug condition interface' for the WAN interface before enabling 'debug ip packet detail'

Answer

Enable 'debug ip packet detail' and rely on 'logging buffered' with a severity of 7 to capture only host 10.1.1.50 traffic

Answer

Configure 'debug condition ip 10.1.1.50' which will automatically filter all subsequent debugs to that host's IPv4 traffic

Question 14

After applying a CoPP policy to a distribution router, network engineers report that EIGRP adjacencies over the LAN segments repeatedly drop and re-form. The CoPP configuration includes a class 'CLASS-ROUTING' matched with ACL 'ACL-ROUTING' that permits 'ip host 224.0.0.5 any' and a police rate that is generous. All other classes drop. SSH, SNMP, and BGP work fine. Which change to the ACL will restore stable EIGRP adjacencies?

Accepted Answer

Add 'permit ip any host 224.0.0.10' to match EIGRP multicast Hello traffic

Answer

Add 'permit eigrp any host 224.0.0.5' to match OSPF and EIGRP together

Answer

Change the entry to 'permit tcp any any eq 88' to allow EIGRP over TCP

Answer

Add 'permit udp any any eq 88' to permit EIGRP Hello packets

Question 15

After applying a new CoPP policy on a core router, users report that large file transfers through the router intermittently stall, while small pings and normal browsing work fine. Investigation shows the router must generate ICMP 'fragmentation-needed' (Type 3, Code 4) messages for a path with a smaller MTU, but Path MTU Discovery is failing end-to-end. The CoPP policy includes a class matching ICMP that is police-limited to a very low rate with 'exceed-action drop'. Which action best resolves the issue?

Accepted Answer

Create a dedicated CoPP class that matches ICMP unreachable/fragmentation-needed traffic and allow it at an adequate rate rather than lumping it into a tightly policed generic ICMP class

Answer

Remove the ICMP class entirely so all ICMP is placed in class-default and forwarded without policing

Answer

Increase the interface MTU on the transit link so fragmentation is never required

Answer

Change the exceed-action from drop to transmit on the existing generic ICMP class only during peak hours

Question 16

After deploying a new CoPP policy on an enterprise core router, network operations reports that OSPF adjacencies on several interfaces repeatedly drop and re-establish, while SSH and SNMP management continue to work normally. The relevant policy configuration is: class-map match-any CP-ROUTING matching access-list 120, which permits 'ip ospf any any'; a policy-map CP-POLICY with class CP-ROUTING configured with 'police 8000 conform-action transmit exceed-action drop'; and 'control-plane service-policy input CP-POLICY'. The router runs OSPF over broadcast segments with many neighbors. Which action MOST likely resolves the adjacency instability?

Accepted Answer

Increase the policed rate for the CP-ROUTING class, since 8000 bps is too low to accommodate OSPF hello and LSA traffic bursts and legitimate packets are being dropped by exceed-action

Answer

Change the ACL to match protocol 88 (EIGRP) instead of OSPF because CoPP cannot classify OSPF control traffic

Answer

Apply the service-policy in the output direction of the control plane rather than the input direction

Answer

Remove the conform-action transmit statement so OSPF packets are no longer rate-limited on the control plane

Question 17

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, users report that transit traffic passing through the router is unaffected, but a newly added deny-all class at the end of the policy-map (applied to catch unclassified traffic to the router itself) is dropping legitimate SSH sessions to the device from a management subnet. The management subnet was intentionally omitted from the permit ACLs. Which characteristic of CoPP explains why only the router-destined SSH traffic is impacted and not the transit traffic?

Accepted Answer

CoPP applied to the control-plane only inspects traffic destined to the router itself (punted to the control plane), so transit traffic bypasses the policy entirely.

Answer

CoPP is applied bidirectionally on all data interfaces, so transit traffic is exempt only because it uses hardware forwarding.

Answer

CoPP evaluates transit traffic first and only applies drop actions after the routing table lookup completes for locally destined packets.

Answer

CoPP uses a separate transit sub-interface policy that must be explicitly enabled with the 'service-policy transit' command to affect forwarded traffic.

Question 18

A network engineer configures CoPP on an edge router to rate-limit management traffic. The NMS uses SNMPv2c to poll the router. After deployment, the NMS reports intermittent timeouts and gaps in interface statistics graphs. The engineer runs 'show policy-map control-plane' and sees the SNMP class matching only a small number of packets while a large and increasing conform/exceed drop count appears under the 'class-default' policer, which is configured with a low 8 kbps rate. Which action most likely resolves the SNMP polling problem?

Accepted Answer

Correct the ACL referenced by the SNMP class so that it matches UDP port 161 traffic sourced from the NMS, ensuring the packets hit the SNMP class instead of class-default

Answer

Increase the police rate of the SNMP class to a higher value such as 64 kbps

Answer

Remove the class-default policer entirely so no control-plane traffic is ever dropped

Answer

Change the SNMP class to match TCP port 162 instead of UDP, since SNMP notifications require TCP

Question 19

A network engineer configures CoPP on an ISR to protect the router. A policy-map named CONTROL-PLANE-POLICY classifies and polices SNMP, SSH, and OSPF traffic and is applied with 'service-policy input CONTROL-PLANE-POLICY' under control-plane. Users report that the router is no longer sending SNMP traps to the NMS, although SNMP GET polling from the NMS still works and traps were confirmed working before CoPP was applied. What is the MOST likely cause?

Accepted Answer

SNMP traps are router-generated (egress) traffic and are not evaluated by an input CoPP policy; another feature or ACL is dropping them.

Answer

The SNMP class in the input CoPP policy is policing the outbound traps below the required rate, causing them to be dropped.

Answer

Traps require the policy to be applied with 'service-policy output' on the control plane, which was omitted.

Answer

The class map matching UDP 161 does not include UDP 162, so the input policy silently drops all trap packets.

Question 20

A network monitoring server performs SNMP GETBULK walks against a core router every 5 minutes. Recently, the NMS reports intermittent timeouts and partial MIB tables, but pings and SSH to the router remain stable. On the router, 'show policy-map control-plane' shows the SNMP class with a growing number of dropped packets under 'exceed', while the 'conform' counter also increases. The class matches ACL traffic to UDP 161. What is the MOST likely cause of the intermittent SNMP failures?

Accepted Answer

The CoPP policer's CIR for the SNMP class is set too low, so bursts of GETBULK response processing exceed the rate and packets are dropped by the exceed action

Answer

The CoPP class ACL is matching UDP 161 instead of UDP 162, so trap traffic is being policed incorrectly

Answer

SSH and ICMP share the same policer class as SNMP, causing contention that only affects SNMP

Answer

The control-plane policy is applied in the output direction, so inbound SNMP polling is never evaluated by CoPP

Question 21

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, administrators report intermittent SSH session timeouts to the router, while ping and OSPF adjacencies remain stable. The relevant configuration is:

class-map match-all COPP-MGMT
 match access-group name SSH-ACL
!
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

The SSH-ACL correctly matches TCP port 22 to the router loopback. The command 'show policy-map control-plane' shows a steadily increasing number of exceeded (dropped) packets in class COPP-MGMT. What is the most likely cause?

Accepted Answer

The police rate of 8000 bps is too low for SSH traffic, causing legitimate management packets to exceed the policer and be dropped.

Answer

CoPP policies cannot be applied in the input direction and must use the output direction to permit SSH.

Answer

The class-map uses match-all, which prevents any SSH packets from matching a single ACL.

Answer

SSH traffic is process-switched and therefore bypasses the control-plane policy entirely.

Question 22

A network engineer configures CoPP on a core router to rate-limit management traffic. After applying the policy, administrators report they can no longer reach the router via HTTPS for the web GUI, but SSH still works fine. The relevant configuration is shown below:

ip access-list extended MGMT-TRAFFIC
 permit tcp any any eq 22
 permit tcp any any eq 80
class-map match-all MGMT
 match access-group name MGMT-TRAFFIC
policy-map COPP-POLICY
 class MGMT
  police 8000 conform-action transmit exceed-action transmit
 class class-default
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP-POLICY

What is the most likely cause of the HTTPS connectivity failure?

Accepted Answer

The ACL matches TCP port 80 (HTTP) but not TCP port 443 (HTTPS), so HTTPS traffic falls into class-default and is subject to the exceed-action drop.

Answer

The police rate of 8000 bps is too low for HTTPS sessions, causing the TLS handshake packets to be dropped in the MGMT class.

Answer

CoPP does not support HTTPS traffic and requires a separate management-plane policy using the control-plane host subinterface.

Answer

The service-policy must be applied in the output direction for HTTPS return traffic to be permitted.

Question 23

A network engineer configures CoPP on a core router to protect the control plane. After applying the policy, routine management traffic works, but scheduled firmware pushes to the router via TFTP now fail intermittently, and 'show policy-map control-plane' shows a rising drop counter in class-default. The engineer's policy has explicit classes for SSH, SNMP, and OSPF with generous rates, plus a class-default with 'police rate 8000 pps conform-action transmit exceed-action drop'. Which action best resolves the TFTP failures without weakening protection for other traffic?

Accepted Answer

Create a dedicated class matching the TFTP traffic (UDP/69) with an appropriate policed rate and place it before class-default in the policy-map.

Answer

Change the class-default exceed-action to transmit so no control-plane traffic is ever dropped.

Answer

Increase the OSPF class police rate, since firmware transfers rely on the routing protocol classes.

Answer

Remove the SNMP class so its bandwidth can be reused by TFTP in class-default.

Question 24

A branch router's WAN-facing interface is configured with 'ip address dhcp' to obtain an address from the ISP. After a reload, the interface remains up/up but never obtains an IP address. Debugging with 'debug dhcp detail' shows the router sending DHCPDISCOVER messages repeatedly but never receiving a DHCPOFFER. The ISP confirms their DHCP server is operational and that other customers on the same segment obtain leases normally. A packet capture on the router's interface shows the outbound DISCOVER packets but no inbound traffic from the server at all. What is the MOST likely cause?

Accepted Answer

An inbound access list on the interface is permitting the outbound DISCOVER but denying the returning broadcast/unicast DHCPOFFER from the server

Answer

The 'ip helper-address' command is missing, so the DHCPOFFER cannot be relayed back to the client interface

Answer

The DHCP client requires 'service dhcp' to be disabled before it can accept offers on a client interface

Answer

The interface MTU is set below 576 bytes, preventing the DHCPOFFER from being received

Question 25

IP phones in VLAN 20 obtain IP addresses from the IOS DHCP server but fail to download their configuration and firmware from the TFTP server at 10.10.50.5. Data PCs in the same subnet get addresses and reach the network normally. The phone DHCP pool is configured with default-router and dns-server statements only. Which action will allow the phones to locate the TFTP server?

Accepted Answer

Add 'option 150 ip 10.10.50.5' to the DHCP pool so phones learn the TFTP server address

Answer

Add 'option 66 ascii 10.10.50.5' as the only supported option for Cisco IP phones

Answer

Configure 'option 43 hex' to point the phones to the TFTP server

Answer

Add a second 'default-router 10.10.50.5' entry so the phones route to the TFTP server

Question 26

A three-tier campus network uses a Layer 3 distribution switch as a DHCP relay agent. Access switches insert DHCP Option 82 (relay information) as packets pass through them. When clients on VLAN 30 request addresses, the central IOS DHCP server logs show the requests arriving, but no DHCPOFFER reaches the clients. Debugging on the relay shows: 'DHCPD: relay information option exists, but giaddr is zero' followed by the packet being dropped. The relay agent has 'ip helper-address' configured correctly on the VLAN 30 SVI. What is the most likely cause?

Accepted Answer

The relay agent needs 'ip dhcp relay information trust-all' or per-interface 'ip dhcp relay information trusted' to accept the pre-inserted Option 82 with giaddr 0

Answer

The relay agent's default 'ip dhcp relay information policy replace' behavior is discarding packets that already contain Option 82 from an untrusted downstream device with a zero giaddr

Answer

The DHCP server pool is missing the 'network' statement for the VLAN 30 subnet

Answer

The access switch is not configured as a DHCP snooping trusted port toward the relay

Question 27

A branch router is configured as an IOS DHCP server for VLAN 20 using the network 192.168.20.0/24. Users report that only the first few devices each morning receive addresses, then new clients fail to get an IP. The 'show ip dhcp pool' output shows 'Leased addresses : 250' and 'Total addresses : 253'. The administrator confirms the DHCP scope is correct and the relay is not involved (clients are on the same segment). What is the MOST likely cause of the address shortage?

Accepted Answer

The lease time is set too long, so previously assigned addresses are not being reclaimed before new clients request them

Answer

The 'ip dhcp excluded-address' command was never configured, so the server is handing out the gateway address to clients

Answer

DHCP snooping on the switch is rate-limiting DISCOVER packets and dropping later requests

Answer

Option 82 insertion is corrupting the giaddr field, causing the server to reject requests

Question 28

You are deploying a single-hub DMVPN. All spokes have formed their GRE tunnels but none of the spokes can register with the hub, and 'show ip nhrp' on the hub shows no dynamic mappings. The tunnel interfaces are up/up and ping to the hub's tunnel address fails. On a spoke you run 'debug nhrp' and see the message 'NHRP: Receive Registration Reply' is never generated, while the hub logs 'NHRP: Rejecting authentication error'. What is the most likely cause?

Accepted Answer

The 'ip nhrp authentication' string configured on the tunnel interfaces does not match between hub and spokes

Answer

The 'ip nhrp network-id' value is different on the hub and the spokes

Answer

The tunnel source interface on the spokes is administratively down

Answer

The 'ip nhrp map multicast dynamic' command is missing on the hub

Question 29

A network engineer has configured a single-hub DMVPN with two spokes. Spoke-to-spoke tunnels form correctly, but the engineer notices that after a spoke reboots, its dynamic NHRP mapping remains on the hub for far longer than expected, causing the hub to attempt forwarding traffic to an unreachable spoke before purging the entry. On the hub tunnel interface, the current configuration includes 'ip nhrp holdtime 7200'. Which action best resolves the delayed purging of stale spoke registrations?

Accepted Answer

Lower the 'ip nhrp holdtime' value on the hub and spokes so registrations and cached mappings expire and refresh more frequently

Answer

Increase the tunnel key value to force spokes to re-register immediately after reboot

Answer

Configure 'ip nhrp registration no-unique' on the hub to allow overlapping registrations

Answer

Add 'ip nhrp map multicast dynamic' on the hub to speed up mapping timeout

Question 30

You configured a single-hub DMVPN Phase 1 network. All spokes register successfully with the hub (show ip nhrp shows valid entries on the hub, and spokes list the hub NHS as 'up'). However, EIGRP over the tunnel fails to form neighbor adjacencies between the hub and any spoke. Static neighbor definitions are not used. Which hub tunnel configuration omission best explains the failure?

Accepted Answer

The hub is missing 'ip nhrp map multicast dynamic' on the tunnel interface

Answer

The hub is missing 'ip nhrp shortcut' on the tunnel interface

Answer

The hub is missing 'tunnel protection ipsec profile' on the tunnel interface

Answer

The hub is missing 'no ip split-horizon eigrp' on the tunnel interface

Question 31

A network engineer is configuring a single-hub DMVPN. The hub tunnel interface is up, but a newly added spoke shows no NHRP registration on the hub (show ip nhrp lists no entries for the spoke). The spoke's tunnel interface is up/up and the underlying physical path to the hub NBMA address is reachable via ping. On the spoke, the relevant configuration is:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1

The hub uses 'ip nhrp map multicast dynamic' and 'ip nhrp network-id 100'. What is the most likely cause the spoke fails to register with the hub?

Accepted Answer

The spoke is missing the 'ip nhrp map 10.0.0.1 <hub-NBMA-address>' statement, so it cannot resolve where to send the NHRP registration request.

Answer

The hub must also configure 'ip nhrp nhs' pointing back at each spoke tunnel address before registration can complete.

Answer

The spoke tunnel must use 'tunnel mode gre' (point-to-point) instead of multipoint to register with a single hub.

Answer

The network-id values must be globally unique per router, so the spoke should use 'ip nhrp network-id 200'.

Question 32

You manage a single-hub DMVPN deployment with EIGRP running over the mGRE tunnels. Spokes register successfully with the hub, and spoke-to-hub and hub-to-spoke traffic works fine. However, you want spoke-to-spoke traffic to be forwarded directly between spokes instead of always transiting the hub, while keeping the hub's routing table summarized. Traffic between two spokes currently always passes through the hub. Which combination of NHRP configuration commands enables the desired direct spoke-to-spoke forwarding in this Phase 3 design?

Accepted Answer

Configure 'ip nhrp redirect' on the hub tunnel interface and 'ip nhrp shortcut' on the spoke tunnel interfaces

Answer

Configure 'ip nhrp shortcut' on the hub tunnel interface and 'ip nhrp redirect' on the spoke tunnel interfaces

Answer

Configure 'ip nhrp map multicast dynamic' on the hub and 'ip nhrp nhs' on the spokes only

Answer

Configure 'no ip split-horizon eigrp' on the hub and 'ip nhrp redirect' on all spokes

Question 33

A network engineer configures a single-hub DMVPN with mGRE only on the hub. Each spoke uses a point-to-point GRE tunnel to the hub and runs EIGRP over the overlay. Users report that traffic between two spokes works, but a packet capture shows all spoke-to-spoke traffic transiting the hub router rather than flowing directly between spokes. The engineer wants dynamic direct spoke-to-spoke tunnels. Which change is required to achieve this?

Accepted Answer

Reconfigure the spokes with mGRE interfaces and configure NHRP so spokes can resolve each other's NBMA addresses (migrate to DMVPN Phase 2 or 3)

Answer

Disable EIGRP split horizon on the hub tunnel interface so spoke routes are advertised back to other spokes

Answer

Configure the hub as an NHRP next-hop-server and leave the spokes as point-to-point GRE, which enables direct tunnels automatically

Answer

Increase the NHRP hold time on the hub and enable IP redirects on the hub tunnel interface

Question 34

A network engineer deploys a Phase 2 DMVPN with a single hub and several spokes using EIGRP as the routing protocol. Spoke-to-spoke traffic is functional in some cases but fails in others. On a spoke, 'show ip route' displays remote spoke LAN subnets with the hub's tunnel IP as the next hop rather than the destination spoke's tunnel IP. What must be configured on the HUB tunnel interface to allow spokes to build direct spoke-to-spoke tunnels in this Phase 2 design?

Accepted Answer

Disable EIGRP next-hop-self with 'no ip next-hop-self eigrp <AS>' on the hub tunnel interface

Answer

Enable 'ip nhrp redirect' on the hub tunnel interface

Answer

Configure 'ip nhrp shortcut' on the hub tunnel interface

Answer

Disable EIGRP split horizon with 'no ip split-horizon eigrp <AS>' on the hub tunnel interface

Question 35

A network engineer configures a single-hub DMVPN over the Internet with IPsec protection. Small pings across the tunnel succeed, and NHRP registration is up, but users report that large HTTP transfers and some application sessions hang or fail intermittently. A packet capture shows large TCP segments with the DF bit set being dropped along the path. Which configuration on the tunnel interface most directly resolves this issue?

Accepted Answer

ip tcp adjust-mss 1360 (along with an appropriate ip mtu on the tunnel)

Answer

tunnel key 100 to match the NHRP network-id on all peers

Answer

ip nhrp holdtime 300 to keep mappings cached longer

Answer

tunnel protection ipsec profile DMVPN shared to reuse the IPsec SA

Question 36

A network engineer configures a single-hub DMVPN. On a spoke router, the tunnel interface uses 'tunnel source GigabitEthernet0/1' and 'ip nhrp nhs 172.16.0.1'. The spoke's tunnel line protocol is up, but 'show ip nhrp' on the hub shows no dynamic entry for this spoke, and 'show dmvpn' on the spoke lists the NHS state as 'NHRP'. The physical WAN interface Gi0/1 has connectivity to the hub's public address, and IPsec is not configured. What is the most likely cause of the failed registration?

Accepted Answer

The spoke's 'ip nhrp map' statement for the hub is missing, so the spoke cannot resolve the hub's NBMA address to send registration requests

Answer

The hub must be configured with 'ip nhrp nhs' pointing back to each spoke for bidirectional registration

Answer

The tunnel mode is set to 'tunnel mode gre multipoint' on the spoke, which prevents Phase 1 registration

Answer

The spoke and hub tunnel interfaces are in different IP subnets, which is required for DMVPN registration

Question 37

A dual-homed enterprise router learns the prefix 172.20.50.0/24 from three sources simultaneously: an eBGP peer at a partner site, an internal OSPF neighbor, and an EIGRP-learned route redistributed from a branch. All three routes have identical prefix length and are valid. After troubleshooting a traffic path complaint, you notice the router installs the eBGP-learned route in the RIB even though the OSPF path is topologically shorter. Assuming default administrative distances, why does the router prefer the eBGP route?

Accepted Answer

eBGP has an administrative distance of 20, which is lower than OSPF (110) and EIGRP internal (90), so it wins route selection.

Answer

BGP always has the lowest administrative distance of any routing protocol, so both eBGP and iBGP routes are preferred over IGPs.

Answer

OSPF metric is higher than the eBGP MED, and the router compares metrics across protocols to select the best path.

Answer

EIGRP internal routes have an administrative distance of 170, which is worse than eBGP, so eBGP is installed by default.

Question 38

A network engineer reports that R3 is missing several specific subnets of 172.16.0.0/16 learned via EIGRP AS 100. The topology uses discontiguous subnets of 172.16.0.0/16 separated by a 10.0.0.0/8 backbone. On R1 and R2, 'show ip protocols' shows 'auto-summary' is in effect. Both R1 and R2 advertise the classful summary 172.16.0.0/16 toward each other across the 10.x backbone. What is the most likely cause of R3's missing routes, and what corrects it?

Accepted Answer

Auto-summarization on R1 and R2 causes both routers to advertise 172.16.0.0/16, creating an ambiguous classful summary; disable it with 'no auto-summary' under the EIGRP process on all routers.

Answer

Split horizon is dropping the specific subnets on the backbone interfaces; disable split horizon with 'no ip split-horizon eigrp 100' on the WAN interfaces.

Answer

The EIGRP administrative distance for internal routes is too high; lower it with 'distance eigrp 90 170' under the process.

Answer

A route map is filtering the specific subnets inbound; remove the distribute-list referencing the route map on R3.

Question 39

A network engineer is troubleshooting an EIGRP adjacency failure between R1 and R2 in AS 100. Both routers have matching AS numbers and are directly connected on the same subnet. The engineer runs 'show logging' on R1 and sees the message: '%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.1.1.2 (GigabitEthernet0/0) is down: K-value mismatch'. Interfaces are up and pings succeed. What is the most likely cause?

Accepted Answer

The metric weights (K1–K5) configured under EIGRP on R1 and R2 do not match

Answer

The hello and hold timers are mismatched between R1 and R2

Answer

R1 and R2 are configured with different EIGRP router IDs

Answer

Authentication key-chain strings differ between the two routers

Question 40

A network engineer migrates R1 from EIGRP classic mode to EIGRP named mode. After the migration, R1 forms a stable adjacency with R2 (still in classic mode) but the neighbor relationship with R3 (also classic mode) repeatedly flaps with the log message '%DUAL-5-NBRCHANGE: ... K-value mismatch'. On R1 named mode, the engineer configured 'metric weights 0 1 1 0 0 0 0' under the address-family topology base. R2 and R3 both use default K-values except R3, which was previously configured with 'metric weights 0 1 0 0 0 0 0'. What is the root cause of the flapping adjacency between R1 and R3?

Accepted Answer

R1's named-mode K-values (K1=1, K3=1) do not match R3's classic-mode K-values (K1=1, K3=0), and EIGRP requires K-values to match for an adjacency to remain up.

Answer

Named-mode EIGRP is incompatible with classic-mode EIGRP, so R1 cannot form any stable neighbor relationships with classic routers.

Answer

The autonomous system numbers differ because named mode uses a different AS numbering scheme than classic mode.

Answer

R1 and R3 have mismatched hello and hold timers introduced by the named-mode migration defaults.

Question 41

A network engineer converts an EIGRP classic configuration to EIGRP named mode on a distribution switch. After the migration, the switch no longer forms an adjacency with a neighbor on GigabitEthernet1/0/1, though the interface is up/up and IP connectivity to the neighbor's interface is confirmed via ping. The relevant configuration is:

router eigrp CORP
  address-family ipv4 unicast autonomous-system 100
    af-interface default
      passive-interface
    exit-af-interface
    af-interface GigabitEthernet1/0/2
      no passive-interface
    exit-af-interface
    network 10.0.0.0
  exit-address-family

What is the most likely cause of the missing adjacency on Gi1/0/1?

Accepted Answer

The 'af-interface default' passive-interface command marks all interfaces passive, and only Gi1/0/2 was explicitly re-enabled, so Gi1/0/1 remains passive and suppresses hellos.

Answer

Named mode requires a separate 'network' statement per interface, and Gi1/0/1 is not covered by the 10.0.0.0 network command.

Answer

The autonomous-system number under the address-family must match the interface bandwidth, causing an AS mismatch on Gi1/0/1.

Answer

Named mode disables split horizon by default, which prevents hellos from being sent out Gi1/0/1.

Question 42

You are troubleshooting an EIGRP named-mode deployment. R1 runs a legacy classic-mode EIGRP configuration for autonomous system 100, while its neighbor R2 has recently been migrated to EIGRP named mode using the same AS. The two routers form an adjacency and exchange routes, but you notice that the metrics for the same destinations differ significantly between the two routers, and traffic engineering based on delay is not behaving as expected. The link between them is a 10 Gbps interface. Which explanation best accounts for the metric discrepancy?

Accepted Answer

Named mode uses 64-bit wide metrics by default, so R2 scales the composite metric differently than R1's classic 32-bit metric for high-bandwidth interfaces

Answer

The adjacency should not have formed at all because classic and named mode routers cannot become neighbors within the same AS

Answer

R2 in named mode automatically disables auto-summary while R1 leaves it enabled, causing the metrics to be recalculated

Answer

Named mode changes the default K-values to K1=1, K2=1, K3=1, K4=1, K5=1, which changes the composite metric calculation

Question 43

Two routers, R1 and R2, both redistribute routes bidirectionally between OSPF and EIGRP at different points in the network. After the change, users report intermittent connectivity to the 172.16.50.0/24 network, and traceroutes show traffic occasionally looping between R1 and R2. You confirm the route originated in OSPF. Which configuration approach at the redistribution points will BEST prevent routes from being re-injected back into their protocol of origin?

Accepted Answer

Tag routes with a route map as they are redistributed from OSPF into EIGRP, then deny routes carrying that tag when redistributing from EIGRP back into OSPF

Answer

Increase the administrative distance of external EIGRP routes to 255 on both R1 and R2

Answer

Enable split horizon on the EIGRP interfaces between R1 and R2 to stop the routes from being advertised back

Answer

Configure manual summarization of 172.16.50.0/24 on both redistribution points to hide the specific route

Question 44

A network engineer manages a DMVPN Phase 1 hub-and-spoke topology running EIGRP over the multipoint tunnel interface Tunnel0 on the hub. Each spoke forms an EIGRP adjacency with the hub and advertises its LAN prefix successfully. However, the engineer notices that no spoke learns the LAN prefixes of any other spoke, even though the hub shows all spoke routes in its topology and routing table. The hub's Tunnel0 has no distribute-lists or route-maps applied. What is the most likely cause?

Accepted Answer

EIGRP split horizon is enabled by default on the hub's multipoint tunnel interface, preventing routes learned on Tunnel0 from being re-advertised out the same interface.

Answer

The hub is missing the 'no ip next-hop-self eigrp' command, so spoke routes are being suppressed by route poisoning.

Answer

Auto-summarization on the hub is collapsing the spoke prefixes into a single classful route that the spokes reject.

Answer

The spokes have a higher administrative distance configured for EIGRP, causing them to discard the hub-advertised routes.

Question 45

R1 has a primary EIGRP-learned route to 10.20.0.0/16 (internal EIGRP AD 90) via its WAN link. An engineer configures a static backup route, 'ip route 10.20.0.0 255.255.0.0 192.168.100.2', intending it to be used ONLY if EIGRP fails. After committing the change, users report that traffic to 10.20.0.0/16 is now flowing over the backup path even though the EIGRP neighbor is fully adjacent and the route is present in the EIGRP topology table. What is the cause and the correct fix?

Accepted Answer

The static route has a default AD of 1, which is lower than EIGRP internal (90), so it is installed in the RIB; configure the static route with a higher administrative distance (e.g., 'ip route 10.20.0.0 255.255.0.0 192.168.100.2 200').

Answer

The static route is more specific than the EIGRP route; change the static route mask to /24 so EIGRP remains preferred.

Answer

EIGRP internal routes have an AD of 170, which is higher than the static route; lower the EIGRP AD with 'distance eigrp 90 90'.

Answer

The static route must be redistributed into EIGRP before it can act as a backup; add 'redistribute static' under the EIGRP process.

Question 46

R1 is an EIGRP border router advertising a manual summary route of 10.10.0.0/16 out its interface toward R2. The summary covers subnets 10.10.1.0/24 through 10.10.8.0/24, all of which are reachable via R1. A network engineer notices that when R2 sends traffic destined to 10.10.20.5 (an address inside the summary range but with no matching specific subnet on R1), the packets are silently dropped at R1 instead of being forwarded elsewhere. Why does R1 drop this traffic?

Accepted Answer

When a manual summary is configured, EIGRP installs a route to Null0 for the summary prefix, so traffic matching the summary but no more-specific route is discarded.

Answer

R1's administrative distance for the summary (5) is lower than the connected routes, causing a routing loop that drops the packet.

Answer

The summary route must be advertised with a leak-map; without one, EIGRP blocks all traffic inside the summarized range.

Answer

Split horizon on R1 prevents the summary from being installed in the local routing table, so R1 has no route to 10.10.20.5.

Question 47

An engineer wants R1 to load-balance traffic to the 10.50.0.0/16 network across two EIGRP paths. The primary path via R2 has a feasible distance of 3072000, and the alternate path via R3 has a computed metric of 5120000 with a reported distance of 2560000. The engineer configures 'variance 2' under the EIGRP process, but the path through R3 is still not installed in the routing table. What is the reason R3's path is excluded?

Accepted Answer

R3's reported distance (2560000) is less than R1's feasible distance (3072000), making it a feasible successor, and 5120000 is within 2 x 3072000; the path should install, so the omission points to a 'traffic-share' or 'maximum-paths' limitation rather than variance.

Answer

R3's path is not a feasible successor because its reported distance (2560000) is not less than the feasible distance (3072000)... wait, it is less, so variance must be increased to at least 2.

Answer

R3's advertised metric (5120000) exceeds the feasible distance (3072000) multiplied by the variance value (2 x 3072000 = 6144000), so it should be installed; the real issue is the path fails the feasibility condition check.

Answer

R3's path does not meet the feasibility condition because although 5120000 is within variance range, EIGRP still requires the alternate path to be a feasible successor, and R3's reported distance meets that requirement, so it should install.

Question 48

A network engineer configured EIGRP named mode for VRF CUSTOMER_A on two PE routers connected back-to-back over a physical link. The EIGRP adjacency in the VRF forms successfully, and both routers show each other as neighbors under 'show eigrp address-family ipv4 vrf CUSTOMER_A neighbors'. However, routes learned from the remote PE do not appear in 'show ip route vrf CUSTOMER_A'. The interfaces belong to the correct VRF, and the autonomous-system number matches. What is the MOST likely cause?

Accepted Answer

A distribute-list or route-map inbound under the VRF address-family is filtering the received routes

Answer

The 'autonomous-system' number under the address-family does not match, preventing route exchange

Answer

The VRF route distinguisher (RD) differs between the two PE routers, so EIGRP drops the routes

Answer

BFD is enabled on the interface, which suppresses EIGRP route installation until echo packets are validated

Question 49

A network engineer configures Flexible NetFlow on a Catalyst router to export traffic statistics to a collector. The flow exporter and a flow record named APP-RECORD are created, and the command 'ip flow monitor APP-MON input' is applied to GigabitEthernet0/1. However, 'show flow monitor APP-MON statistics' returns 'Flow Monitor APP-MON: is not associated with any interface' error and no flows are captured. What is the most likely cause?

Accepted Answer

The flow monitor APP-MON was not configured to reference the flow record and exporter, so it failed to be applied to the interface.

Answer

The flow record APP-RECORD is missing a 'match' field, which is required before any exporter can be associated.

Answer

Flexible NetFlow requires the direction keyword 'ingress' rather than 'input' on Catalyst platforms.

Answer

The exporter transport must be changed from UDP to TCP for the monitor to bind to the interface.

Question 50

A network engineer configures an IP SLA HTTP GET operation on a branch router to monitor availability of an internal web server referenced by hostname (intranet.corp.local). The operation consistently reports a return code indicating failure, and 'show ip sla statistics' shows the DNS RTT is high or timing out while the TCP connect portion never runs. Pinging the server's IP address directly from the router succeeds. What is the most likely cause?

Accepted Answer

The router has no reachable DNS name-server configured (or 'ip domain-lookup' is disabled), so the HTTP operation cannot resolve the hostname before connecting

Answer

The IP SLA responder is not enabled on the web server, so the HTTP operation cannot complete

Answer

The HTTP operation requires a UDP jitter codec to be specified before it will resolve names

Answer

The control protocol on port 1967 is being blocked between the router and the web server

Question 51

A network engineer configures IP SLA to track reachability of a primary WAN next-hop (10.1.1.2) and float a backup static route when it fails. The relevant configuration is:

ip sla 1
 icmp-echo 10.1.1.2
 frequency 5
 threshold 3000
 timeout 2000
track 1 ip sla 1 reachability

Users report that even during brief periods of high latency (round-trip around 2500 ms) on the primary link, the tracked object goes down and traffic fails over unnecessarily, then flaps back. The link itself never actually loses connectivity. Which change corrects this unnecessary failover behavior?

Accepted Answer

Increase the timeout value to a value greater than the observed round-trip latency (e.g., timeout 3000) so echoes are not declared lost during latency spikes.

Answer

Change the track statement to 'track 1 ip sla 1 state' so the delay threshold is used instead of reachability.

Answer

Lower the threshold to 1000 ms so the operation completes faster and stops timing out.

Answer

Increase the frequency to 30 seconds so the probe runs less often and avoids transient latency.

Question 52

A network engineer configures an IP SLA UDP jitter operation between two routers to measure one-way delay for a VoIP path. The UDP responder is configured on the destination and the operation completes successfully, reporting round-trip jitter and packet loss statistics. However, the 'show ip sla statistics' output shows all one-way delay (SD and DS) values as 0 ms, even though round-trip time is clearly non-zero. What is the most likely cause?

Accepted Answer

The source and destination router clocks are not synchronized with NTP, so one-way delay measurements cannot be calculated

Answer

The IP SLA responder is missing the 'ip sla responder udp-echo' command for the jitter port

Answer

The operation was configured with a packet interval that is too large for one-way measurements

Answer

Control protocol is disabled, so the responder cannot allocate the dynamic port for the operation

Question 53

A network engineer configures an IP SLA UDP jitter operation on R1 to measure latency and jitter to R2 across a WAN link. The operation is scheduled and active, but 'show ip sla statistics' on R1 shows a 'Return Code' of 'No connection' and no jitter or latency data is collected. ICMP echo operations to the same R2 address succeed normally. What is the most likely cause?

Accepted Answer

The IP SLA responder is not configured on R2 with the 'ip sla responder' command

Answer

The tracking object referencing the operation has not been created on R1

Answer

The UDP jitter operation requires an access list permitting ICMP on R2

Answer

The operation's frequency value is set lower than the timeout value on R1

Question 54

An engineer configures an IP SLA UDP jitter operation between two routers to measure one-way delay across a WAN link. The operation runs successfully and reports round-trip jitter and latency, but the 'show ip sla statistics' output shows the one-way (source-to-destination and destination-to-source) latency values as 0. Two-way statistics are accurate. What is the most likely cause?

Accepted Answer

The clocks on the source and responder are not synchronized via NTP

Answer

The IP SLA responder is not configured on the destination router

Answer

The UDP control protocol port is being blocked by an ACL on the path

Answer

The operation frequency is set lower than the timeout value

Question 55

A network engineer configures an IP SLA ICMP echo operation with a tracked object to control a floating static route for automatic failover. The primary path occasionally experiences brief microbursts that cause 2-3 dropped probes lasting about 4 seconds, after which connectivity fully recovers. Each brief outage causes the tracked object to go down and the backup route to be installed, resulting in unnecessary route flapping. The engineer wants the tracked object to wait 10 seconds before transitioning to the down state so transient losses do not trigger failover. Which configuration achieves this?

Accepted Answer

track 1 ip sla 1 reachability, then delay down 10

Answer

ip sla 1 with frequency 10 under the ICMP echo operation

Answer

track 1 ip sla 1 reachability, then delay up 10

Answer

ip sla schedule 1 life forever start-time now ageout 10

Question 56

A network engineer configures an IP SLA UDP jitter operation between R1 (sender) and R2 (responder) to monitor a VoIP path. The operation runs successfully and reports jitter and round-trip-time values, but the 'show ip sla statistics' output on R1 consistently shows 'Number of successes: 60, Number of failures: 0' while the one-way latency (Latency one-way (SD)) fields all display 0 ms. The engineer needs accurate one-way delay measurements for SLA reporting. What is the most likely cause?

Accepted Answer

The clocks on R1 and R2 are not synchronized with NTP, so one-way delay cannot be reliably computed.

Answer

The IP SLA responder is not configured on R2, so only round-trip metrics can be calculated.

Answer

The UDP jitter operation frequency is set too low, preventing enough samples for one-way calculations.

Answer

The 'precision microseconds' option is missing, so one-way delay defaults to zero.

Question 57

A branch router is configured as an IOS DHCP server for VLAN 20 (10.20.0.0/24). Users report that obtaining an address takes noticeably long, and 'show ip dhcp conflict' lists several addresses in the pool. The network team confirms no rogue DHCP server exists, but several static hosts were manually assigned addresses inside the DHCP pool range without exclusions. Which action will BOTH stop new conflicts from being recorded and eliminate the lease-assignment delay caused by the server's conflict-detection behavior?

Accepted Answer

Exclude the statically assigned addresses with 'ip dhcp excluded-address' and clear existing conflicts with 'clear ip dhcp conflict *'

Answer

Disable ARP-based conflict detection by removing 'ip dhcp ping packets 0' so the server stops probing addresses

Answer

Increase the lease time in the pool so clients renew less frequently and the server performs fewer conflict checks

Answer

Configure 'ip dhcp conflict resolution' to automatically reassign conflicted addresses to new clients

Question 58

On an access switch, users on VLAN 40 report they are not receiving IPv6 addresses from the stateful DHCPv6 server, which resides upstream through interface GigabitEthernet1/0/24. You have configured IPv6 DHCP guard globally with a policy attached to all access ports and the uplink. The relevant configuration shows:

ipv6 dhcp guard policy CLIENT_POLICY
  device-role client
!
interface range GigabitEthernet1/0/1 - 23
  ipv6 dhcp guard attach-policy CLIENT_POLICY
interface GigabitEthernet1/0/24
  ipv6 dhcp guard attach-policy CLIENT_POLICY

DHCPv6 SOLICIT messages leave the clients, but DHCPv6 ADVERTISE/REPLY messages never reach them. What is the cause?

Accepted Answer

The uplink GigabitEthernet1/0/24 has a client-role policy attached, so it drops the server-sourced DHCPv6 ADVERTISE/REPLY messages arriving from the DHCP server.

Answer

IPv6 DHCP guard requires an IPv6 binding table entry for the server before it will forward REPLY messages, and none exists yet.

Answer

The device-role client setting causes the switch to drop client-originated SOLICIT messages, preventing the exchange from starting.

Answer

DHCP guard cannot inspect stateful DHCPv6 and must be replaced with RA guard on the uplink to permit server replies.

Question 59

A branch router acts as a DHCPv6 relay for clients on interface GigabitEthernet0/1. The centralized DHCPv6 server sits at 2001:DB8:100::10, reachable via a WAN link. Clients send SOLICIT messages (verified with debug), but they never receive an ADVERTISE. On the relay you see the config: 'ipv6 dhcp relay destination FE80::1'. The WAN interface toward the server is GigabitEthernet0/0. What is the most likely cause of the failure?

Accepted Answer

The relay destination is a link-local address configured without specifying the outgoing interface, so the relay cannot forward the RELAY-FORWARD message toward the remote server

Answer

DHCPv6 relay requires the 'ipv6 dhcp relay destination' command to reference the client-facing interface, not the server address

Answer

The clients must be configured with 'ipv6 address dhcp' before the relay will process SOLICIT messages

Answer

DHCPv6 relay uses the all-DHCP-servers multicast address FF05::1:3 automatically, so no destination command should be present

Question 60

An access switch is configured with IPv6 ND inspection on VLAN 30. After enabling the feature, several legitimate hosts on VLAN 30 that use manually configured static IPv6 addresses lose connectivity, while hosts using SLAAC and DHCPv6 work fine. The binding table shows entries only for the SLAAC and DHCPv6 hosts. Which explanation best accounts for this behavior?

Accepted Answer

ND inspection validates neighbor discovery messages against the binding table; statically addressed hosts have no learned binding entry, so their NA/NS messages are dropped and neighbor resolution fails.

Answer

ND inspection only functions on trunk ports, so the statically addressed hosts connected to access ports are automatically blocked.

Answer

ND inspection requires RA guard to be enabled first; without it, all statically configured addresses are treated as spoofed and dropped.

Answer

ND inspection disables ICMPv6 entirely on the VLAN, which prevents static hosts from performing duplicate address detection.

Question 61

A network engineer is deploying IPv6 First Hop Security on an access switch. IPv6 Source Guard is configured on the host-facing ports, but legitimate hosts are being dropped even though they are using valid autoconfigured addresses. The engineer confirms that RA Guard and DHCP Guard are working correctly, but 'show ipv6 neighbor binding' returns an empty table for the affected ports. Which additional feature must be enabled to populate the binding table so Source Guard permits these hosts?

Accepted Answer

IPv6 ND inspection (device-tracking / IPv6 snooping) on the host-facing ports

Answer

IPv6 DHCP relay to forward Neighbor Solicitations to the DHCP server

Answer

IPv6 unicast-routing globally so the switch can build a routing table

Answer

IPv6 RA Guard in policy mode to record advertised prefixes

Question 62

An engineer enabled IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After deployment, clients on VLAN 30 no longer receive default gateway information, and 'show ipv6 nd raguard policy HOST_POLICY' shows the policy is applied to all VLAN 30 access ports. The legitimate router is connected to GigabitEthernet1/0/48, which is also configured with the HOST_POLICY. What is the most likely cause and correct remediation?

Accepted Answer

The uplink port to the legitimate router has a host-role RA Guard policy that drops all RAs; apply a policy with 'device-role router' (or trust) on Gi1/0/48.

Answer

RA Guard requires an IPv6 binding table entry for the router; enable IPv6 DHCP snooping on VLAN 30 to populate the table before RAs are permitted.

Answer

RA Guard only inspects DHCPv6 Advertise messages, so the switch is dropping SLAAC RAs; disable SLAAC on the router and use stateful DHCPv6 instead.

Answer

The RA Guard policy is missing a maximum hop-limit value; configure 'hop-limit maximum 255' in HOST_POLICY to allow the router's RAs through.

Question 63

A network engineer enables IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After applying a policy to all edge ports, the engineer notices that the legitimate upstream router connected to GigabitEthernet1/0/24 is no longer being learned as a default gateway by hosts, and no RAs are seen on downstream ports. The RA Guard policy configured is: 'ipv6 nd raguard policy CLIENT' with 'device-role host', applied on every access port including Gi1/0/24. Which action correctly resolves the issue while keeping RA Guard protection on the client ports?

Accepted Answer

Create a separate policy with 'device-role router' and apply it to Gi1/0/24, leaving the host policy on the client-facing ports

Answer

Remove RA Guard from Gi1/0/24 and rely on DHCPv6 Guard alone to validate the upstream router

Answer

Change the CLIENT policy to 'device-role monitor' so it logs but does not block RAs on any port

Answer

Add 'trusted-port' to the CLIENT policy so RAs are permitted on all ports where it is applied

Question 64

A network engineer is securing an access-layer switch that connects to end-user workstations in an IPv6 environment. Recently, a misconfigured user laptop began advertising itself as a default gateway, causing traffic blackholing for other hosts on the VLAN. The engineer needs the most direct First Hop Security feature to prevent unauthorized devices on these host-facing ports from acting as IPv6 routers. Which feature should be applied?

Accepted Answer

IPv6 RA Guard configured with a device-role of host on the access ports

Answer

IPv6 Source Guard bound to the switch's DHCPv6 snooping binding table

Answer

IPv6 DHCP Guard applied with a server access-list on the access ports

Answer

IPv6 ND Inspection to validate neighbor discovery source addresses

Exam domain	Exam weight	Practice
Layer 3 Technologies	35%	Practice this topic
VPN Technologies	20%	Practice this topic
Infrastructure Security	20%	Practice this topic
Infrastructure Services	25%	Practice this topic

Cisco CCNP Enterprise ENARSI (300-410) (300-410) practice exam & study guide

Start studying 300-410

All 300-410 study resources

300-410 exam domains

Sample 300-410 questions

Key 300-410 terms

300-410 frequently asked questions

Layer 3 Technologies (35%)

VPN Technologies (20%)

Infrastructure Security (20%)

Infrastructure Services (25%)