CCNP Enterprise: Advanced Routing v9 Course Final Exam Answers (ENARSI v9)
1. Refer to the exhibit.
R1# show ip route D 192.168.10.0/24 [90/2170112] via 10.1.1.2, 00:05:23, GigabitEthernet0/0 O 192.168.10.0/24 [110/20] via 10.1.1.3, 00:10:45, GigabitEthernet0/1
A network administrator notices that traffic destined for 192.168.10.0/24 is being forwarded via GigabitEthernet0/0 instead of GigabitEthernet0/1. What is the reason for this behavior?
- The OSPF route was learned more recently
- EIGRP has a lower administrative distance than OSPF
- OSPF has a higher metric than EIGRP
- GigabitEthernet0/0 has higher bandwidth
2. A network engineer is troubleshooting a routing loop that occurs after mutual redistribution between OSPF and EIGRP. Which two techniques can prevent this routing loop? (Choose two.)
- Configure route tagging and filtering based on tags
- Configure BFD between all neighbors
- Increase the OSPF reference bandwidth
- Use distribute lists to filter redistributed routes
- Enable EIGRP stub routing on all routers
3. Refer to the exhibit.
R1# show ip eigrp topology 10.10.10.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(1.1.1.1) for 10.10.10.0/24
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 2816
Descriptor Blocks:
10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag is 0x0
Composite metric is (2816/2560), route is Internal
Vector metric:
Minimum bandwidth is 1000000 Kbit
Total delay is 110 microseconds
10.1.1.3 (GigabitEthernet0/1), from 10.1.1.3, Send flag is 0x0
Composite metric is (3072/2560), route is Internal
Vector metric:
Minimum bandwidth is 1000000 Kbit
Total delay is 120 microsecondsBased on the output, which statement is true regarding the route via 10.1.1.3?
- It is stuck in active state
- It is the successor route
- It cannot be a feasible successor because its composite metric is higher
- It is a feasible successor because its RD (2560) is less than the FD (2816) of the successor
4. Which command configures EIGRP to perform unequal-cost load balancing for routes with a metric up to 2 times the successor metric?
- metric weights 0 1 0 1 0 0 2
- variance 2
- traffic-share balanced
- maximum-paths 2
5. Refer to the exhibit.
R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 2.2.2.2 1 EXSTART/DR 00:00:38 10.1.1.2 GigabitEthernet0/0
Two OSPF routers are stuck in the EXSTART state. What is the most likely cause?
- Hello timer mismatch
- Authentication failure
- Area ID mismatch
- MTU mismatch
6. An engineer needs to configure OSPF virtual link between Area 2 and Area 0. Area 1 is between them. Which two parameters must match on both ABRs? (Choose two.)
- Hello and dead intervals
- Transit area ID
- Cost value
- Router priority
- Interface IP addresses
7. Refer to the exhibit.
R1# show ip bgp summary BGP router identifier 1.1.1.1, local AS number 65001 BGP table version is 5, main routing table version 5 4 network entries using 576 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.1.1.2 4 65001 15 18 5 0 0 00:10:23 0 192.168.1.2 4 65002 22 25 5 0 0 00:15:45 3
Which statement is true about the BGP neighbors shown?
- 10.1.1.2 is an IBGP peer and 192.168.1.2 is an EBGP peer
- The session with 192.168.1.2 is in Idle state
- 10.1.1.2 is not receiving any routes due to authentication failure
- Both neighbors are EBGP peers
8. Which BGP attribute is used to prevent routing loops within an IBGP full mesh?
- AS_PATH
- MED
- LOCAL_PREF
- IBGP split-horizon rule
9. A network administrator wants to influence outbound traffic from AS 65001 to prefer a specific exit point. Which BGP attribute should be configured?
- MED
- Weight
- AS_PATH prepending
- LOCAL_PREF
10. Refer to the exhibit.
R1# show ip bgp 10.10.10.0/24
BGP routing table entry for 10.10.10.0/24, version 12
Paths: (2 available, best #1, table default)
Advertised to update-groups:
1
65002, (received & used)
192.168.1.2 from 192.168.1.2 (2.2.2.2)
Origin IGP, metric 0, localpref 100, valid, external, best
rx pathid: 0, tx pathid: 0x0
65002, (received & used)
192.168.2.2 from 192.168.2.2 (3.3.3.3)
Origin IGP, metric 0, localpref 100, valid, external
rx pathid: 0, tx pathid: 0Both paths have identical attributes. What is the next tiebreaker BGP will use to select the best path?
- Shortest cluster list
- Lowest router ID
- Oldest EBGP path
- Lowest neighbor IP address
11. Which two statements are true regarding BGP route reflectors? (Choose two.)
- Routes learned from clients are reflected to all clients and non-clients
- Routes learned from EBGP peers are reflected to clients only
- All routers in the AS must be route reflector clients
- Route reflectors eliminate the need for a full IBGP mesh
- The cluster-list attribute prevents loops in EBGP
12. Refer to the exhibit.
R1# show ip route vrf CUSTOMER_A
Routing Table: CUSTOMER_A
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.1.1.0/24 is directly connected, GigabitEthernet0/0
L 10.1.1.1/32 is directly connected, GigabitEthernet0/0
B 10.2.2.0/24 [200/0] via 192.168.1.2, 00:05:23
B 10.3.3.0/24 [200/0] via 192.168.1.2, 00:05:23What does this output indicate about the router configuration?
- The router is configured as a PE router with VRF-Lite
- The router is a P router in an MPLS network
- The routes are learned via OSPF
- The router is running standard BGP without VRF support
13. An engineer is configuring policy-based routing. Which command correctly applies a route-map to incoming traffic on an interface?
- ip route-map PBR_MAP
- set ip policy PBR_MAP
- ip policy route-map PBR_MAP
- route-map PBR_MAP in
14. Refer to the exhibit.
route-map PBR permit 10 match ip address 101 set ip next-hop verify-availability 10.1.1.2 10 track 1 ! ip sla 1 icmp-echo 10.1.1.2 frequency 5 ip sla schedule 1 life forever start-time now ! track 1 ip sla 1 reachability
If the tracked object goes down, what happens to packets matching access-list 101?
- Packets are forwarded using the routing table
- Packets are held in queue until tracking recovers
- Packets are sent to an alternate next-hop
- Packets are dropped
15. Which statement correctly describes Bidirectional Forwarding Detection (BFD)?
- BFD is only supported with OSPF and BGP
- BFD provides fast failure detection independent of routing protocols
- BFD requires hardware support and cannot run in software
- BFD replaces routing protocol hello mechanisms completely
16. Refer to the exhibit.
R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.1.2 Gi0/0 11 00:25:33 12 100 0 45
1 10.1.1.3 Gi0/1 13 00:25:30 8 100 0 42
R1# debug eigrp packets
EIGRP: Gi0/1: ignored packet from 10.1.1.4, opcode = 5 (invalid authentication)What is the cause of the authentication failure with neighbor 10.1.1.4?
- The authentication key string does not match
- The hello interval is misconfigured
- The K-values do not match
- The EIGRP AS number does not match
17. Refer to the exhibit.
R1# show ip protocols
*** IP Routing is NSF aware ***
Routing Protocol is "ospf 1"
Outgoing update filter list for all interfaces is not set
Incoming update filter list for all interfaces is not set
Router ID 1.1.1.1
It is an area border router
Number of areas in this router is 2. 2 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.0.0.0 0.255.255.255 area 0
172.16.0.0 0.0.255.255 area 1
Routing Information Sources:
Gateway Distance Last Update
2.2.2.2 110 00:00:45
Distance: (default is 110)External routes from another routing domain are not appearing in Area 1. What could be the cause?
- Area 1 should be configured as NSSA
- Area 1 is configured as a stub area
- The router is not configured as an ASBR
- The ASBR is not generating Type 5 LSAs
18. Which command configures OSPF to advertise a summary route for networks 10.1.0.0/24 through 10.1.255.0/24 from Area 1 to Area 0?
- area 0 range 10.1.0.0 255.255.0.0
- summary-address 10.1.0.0 255.255.0.0
- area 1 range 10.1.0.0 255.255.0.0
- ip summary-address ospf 1 10.1.0.0 255.255.0.0
19. Refer to the exhibit.
R1# show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 10.1.1.0/24 0 Gi0/0 10.2.2.2 17 18 10.3.3.0/24 0 Gi0/0 10.2.2.2 18 Pop Label 10.4.4.0/24 0 Gi0/1 10.5.5.2
What does "Pop Label" indicate in the LFIB output?
- The label should be removed and the packet forwarded based on the next label or IP lookup
- The label should be removed and the packet dropped
- The packet is destined for the local router
- A new label should be pushed onto the stack
20. In an MPLS L3 VPN architecture, which component makes the VPNv4 prefix globally unique?
- MPLS transport label
- Route Distinguisher (RD)
- Route Target (RT)
- VPN label
21. Refer to the exhibit.
PE1# show ip vrf Name Default RD Interfaces CUSTOMER_A 65000:100 Gi0/0 CUSTOMER_B 65000:200 Gi0/1
Which protocol is used to exchange VPNv4 routes between PE routers?
- LDP
- MP-BGP
- EIGRP with address-family configuration
- OSPF with VRF extensions
22. A packet traversing an MPLS L3 VPN network has two labels in its stack. What do these labels represent?
- Inner label for QoS, outer label for routing
- Inner label for VPN identification, outer label for LSP transport
- Inner label for source PE, outer label for destination PE
- Both labels are for transport redundancy
23. Which DMVPN component provides dynamic tunnel endpoint resolution?
- GRE
- IPsec
- IKE
- NHRP
24. Refer to the exhibit.
interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 ip nhrp map multicast dynamic tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel protection ipsec profile DMVPN_PROFILE
This configuration is for which DMVPN device role?
- Spoke router
- Hub router
- CE router
- P router
25. Which command verifies that IPsec is protecting DMVPN tunnel traffic?
- show dmvpn
- show interface tunnel
- show ip nhrp
- show crypto ipsec sa
26. In VRF-Lite, which statement is true?
- VPN labels identify customer routes
- MPLS labels are required for packet forwarding
- VRFs are configured without MP-BGP or MPLS transport
- P routers are required in the network
27. Refer to the exhibit.
PE1# show ip bgp vpnv4 all
BGP table version is 15, local router ID is 1.1.1.1
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:100 (default for vrf CUSTOMER_A)
*> 10.1.1.0/24 0.0.0.0 0 32768 ?
*>i 10.2.2.0/24 2.2.2.2 0 100 0 ?What does the "i" indicator mean for the 10.2.2.0/24 route?
- The route was learned via IBGP
- The route is incomplete
- The route is locally originated
- The route is invalid
28. Which two components are part of the MPLS data plane? (Choose two.)
- LFIB
- FIB
- LDP
- RIB
- LIB
29. Refer to the exhibit.
R1# show running-config | section aaa aaa new-model aaa authentication login default group tacacs+ local aaa authorization exec default group tacacs+ local aaa accounting exec default start-stop group tacacs+ tacacs server TACACS_SERVER address ipv4 192.168.1.100 key 7 094F471A1A0A
If the TACACS+ server is unreachable, what happens when a user attempts to log in?
- The router waits indefinitely for the server
- The login attempt fails immediately
- The router uses the local database for authentication
- The user is granted access without authentication
30. Which two protocols can be used for AAA server communication? (Choose two.)
- RADIUS
- TACACS+
- SSH
- LDAP
- Kerberos
31. Refer to the exhibit.
R1# show access-lists
Extended IP access list 101
10 permit tcp 192.168.10.0 0.0.0.255 any eq 22 (150 matches)
20 permit tcp 192.168.10.0 0.0.0.255 any eq 23 (0 matches)
30 deny ip any any (500 matches)Based on the output, which statement is true?
- All traffic is being denied
- SSH traffic from 192.168.10.0/24 is being permitted
- The ACL is not applied to any interface
- Telnet traffic from 192.168.10.0/24 is being permitted
32. Which Control Plane Policing (CoPP) component defines the traffic classification?
- Policy map
- Class map
- Access list
- Service policy
33. Refer to the exhibit.
policy-map COPP_POLICY class MANAGEMENT police 500000 conform-action transmit exceed-action drop class ROUTING police 1000000 conform-action transmit exceed-action drop class class-default police 100000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP_POLICY
What is the purpose of this configuration?
- To prioritize routing protocol traffic over management traffic
- To encrypt control plane communications
- To rate-limit traffic destined to the router's control plane
- To filter traffic between interfaces
34. Which IPv6 First Hop Security feature prevents rogue DHCPv6 servers from assigning addresses?
- DHCPv6 Guard
- ND Inspection
- RA Guard
- Source Guard
35. Refer to the exhibit.
R1# show ipv6 snooping policies Policy SNOOP_POLICY: Security-level guard Device-role node Gleaning from DHCP Gleaning from ND NOT Gleaning from ARP probe limit address-count 5
What does this IPv6 snooping policy accomplish?
- It only allows 5 DHCPv6 servers on the network
- It blocks all ND messages
- It requires manual address configuration
- It limits each port to 5 IPv6 addresses
36. Which command configures an IPv6 traffic filter on a router interface?
- ipv6 access-group FILTER in
- ipv6 filter FILTER in
- ipv6 access-class FILTER in
- ipv6 traffic-filter FILTER in
37. Which uRPF mode allows packets to pass if any route exists to the source, regardless of interface?
- VRF mode
- Loose mode
- Strict mode
- Feasible-paths mode
38. Which IPv6 First Hop Security feature prevents hosts from spoofing the default gateway using Neighbor Advertisement messages?
- RA Guard
- DHCPv6 Guard
- ND Inspection
- Destination Guard
39. Which SNMPv3 security level provides authentication and encryption?
- AuthPriv
- AuthNoPriv
- noAuthNoPriv
- PrivAuth
40. Refer to the exhibit.
R1# show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type
Hardware address/
User name
192.168.10.10 0100.1111.2222.33 Jan 22 2026 10:30 AM Automatic
192.168.10.11 0100.1111.2222.44 Jan 22 2026 10:35 AM AutomaticWhat does the Client-ID represent in this output?
- The DHCP pool name
- The client's MAC address with a prefix
- The client's IP address
- The VLAN ID
41. Which command excludes IP address 10.1.1.1 from being assigned by a DHCP pool?
- ip dhcp excluded-host 10.1.1.1
- ip dhcp excluded-address 10.1.1.1
- ip dhcp pool exclude 10.1.1.1
- exclude-address 10.1.1.1
42. Refer to the exhibit.
R1# show ip sla statistics 1
IPSLAs Latest Operation Statistics
IPSLA operation id: 1
Latest RTT: 45 milliseconds
Latest operation start time: 10:30:00 UTC Thu Jan 22 2026
Latest operation return code: OK
Number of successes: 100
Number of failures: 2
Operation time to live: ForeverWhat type of information does IP SLA operation 1 provide?
- Bandwidth measurements
- Packet loss percentage only
- Round-trip time and reachability
- CPU utilization
43. Refer to the exhibit.
R1# show flow monitor MONITOR_1 cache Cache type: Normal Cache size: 4096 Current entries: 156 IPV4 SOURCE ADDRESS IPV4 DESTINATION ADDRESS TRNS SRC PORT TRNS DST PORT IP PROTOCOL bytes 10.1.1.10 192.168.1.100 49152 443 6 125000 10.1.1.11 192.168.1.100 49153 443 6 89000 10.1.1.12 192.168.1.200 49154 80 6 45000
Based on the Flexible NetFlow cache, which application is generating the most traffic?
- HTTP to 192.168.1.200
- HTTPS to 192.168.1.100 from 10.1.1.11
- HTTPS to 192.168.1.100 from 10.1.1.10
- Cannot be determined from this output
44. Which command enables conditional debugging based on an access list?
- debug condition interface
- debug ip packet detail
- debug ip packet 101
- debug ip packet
45. Refer to the exhibit.
R1# show ip dhcp server statistics Memory usage 42856 Address pools 2 Database agents 0 Automatic bindings 45 Manual bindings 3 Expired bindings 5 Malformed messages 0 Secure arp entries 0 Message Received BOOTREQUEST 0 DHCPDISCOVER 52 DHCPREQUEST 48 DHCPDECLINE 2 DHCPRELEASE 3 DHCPINFORM 0 Message Sent BOOTREPLY 0 DHCPOFFER 52 DHCPACK 45 DHCPNAK 3
Why are there fewer DHCPACKs than DHCPOFFERs?
- DHCP snooping is blocking requests
- The DHCP pool is exhausted
- Some clients received offers from multiple DHCP servers
- The server is rate-limiting responses
46. Which Cisco DNA Center Assurance feature provides root cause analysis for network issues?
- Client 360
- Device 360
- Path Trace
- Issue Dashboard
47. Refer to the exhibit.
R1# show snmp group groupname: ADMIN security model:v3 priv contextname: storage-type: nonvolatile readview : v1default writeview: v1default notifyview: row status: active
What security features are enabled for the SNMPv3 group ADMIN?
- No authentication or encryption
- Authentication only
- Encryption only
- Authentication and encryption
48. Which two DHCP options are commonly used for IP phone configuration? (Choose two.)
- Option 3
- Option 82
- Option 43
- Option 150
- Option 66
49. Refer to the exhibit.
R1# show track 1
Track 1
IP SLA 1 reachability
Reachability is Down
2 changes, last change 00:05:23
Latest operation return code: Timeout
Latest RTT (millisec) 0
Tracked by:
STATIC-IP-ROUTING 0What does this output indicate about the tracking object?
- The tracked destination is unreachable
- The tracking object has never been active
- IP SLA is not configured
- The tracked IP SLA operation is succeeding
50. Refer to the exhibit.
R1# show running-config | section flow flow record CUSTOM_RECORD match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect counter bytes collect counter packets ! flow exporter EXPORTER_1 destination 10.1.1.100 source GigabitEthernet0/0 transport udp 9996 ! flow monitor MONITOR_1 record CUSTOM_RECORD exporter EXPORTER_1
What is missing from this Flexible NetFlow configuration to begin collecting data?
- The transport protocol should be TCP
- The flow record does not match any traffic
- The exporter destination is incorrect
- The flow monitor is not applied to an interface
51. Refer to the exhibit.
R1# show ip protocols
*** IP Routing is NSF aware ***
Routing Protocol is "eigrp 100"
Outgoing update filter list for all interfaces is not set
Incoming update filter list for all interfaces is 10
Redistributing: eigrp 100
EIGRP-IPv4 Protocol for AS(100)
Metric weight K1=1, K2=0, K3=1, K4=0, K5=0An administrator configured a distribute list but EIGRP neighbors are still receiving all routes. What is the most likely cause?
- EIGRP does not support distribute lists
- The access list 10 is not configured correctly
- The distribute list is filtering inbound, not outbound
- The EIGRP AS number is incorrect
52. Which OSPF LSA type is generated by an ASBR to advertise external routes within an NSSA area?
- Type 5
- Type 3
- Type 4
- Type 7
53. Refer to the exhibit.
R1# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
Internet Address 10.1.1.1/24, Area 0, Attached via Network Statement
Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
Topology-MTID Cost Disabled Shutdown Topology Name
0 1 no no Base
Transmit Delay is 1 sec, State DR, Priority 1
Designated Router (ID) 1.1.1.1, Interface address 10.1.1.1
No backup designated router on this network
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5The OSPF cost shown is 1 for a Gigabit Ethernet interface. What does this indicate about the router configuration?
- The interface bandwidth is configured incorrectly
- OSPF is using the default reference bandwidth of 100 Mbps
- The auto-cost reference-bandwidth has been modified
- The cost has been manually configured on the interface
54. Which MPLS component is responsible for distributing labels between LSRs?
- LDP
- RIB
- FIB
- CEF
55. Which two statements are true about DMVPN Phase 3? (Choose two.)
- NHRP redirect messages enable direct spoke-to-spoke communication
- All traffic must pass through the hub router
- Spokes cannot learn routes from other spokes
- Spoke-to-spoke tunnels require hub intervention for initial setup
- mGRE interfaces are not supported
56. Which ACL type should be used to filter traffic based on source and destination IP addresses plus port numbers?
- Time-based ACL
- Reflexive ACL
- Standard ACL
- Extended ACL
57. Refer to the exhibit.
R1# show ip interface GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up Internet address is 10.1.1.1/24 IP verify source reachable-via RX
What security feature is enabled on this interface?
- Unicast Reverse Path Forwarding (uRPF)
- IP Source Guard
- DHCP snooping
- Port security
58. Refer to the exhibit.
R1# show running-config | section line vty line vty 0 4 access-class 10 in transport input ssh login authentication VTY_AUTH
What security features are configured for VTY access? (Choose three.)
- Telnet access is enabled
- SSH-only access
- ACL filtering for incoming connections
- AAA authentication
- Encryption of management traffic
59. Refer to the exhibit.
*Oct 17 19:52:36.231: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to down
What severity level is indicated by this syslog message?
- Notification (5)
- Error (3)
- Warning (4)
- Critical (2)
60. Which NetFlow component is responsible for sending flow data to a collector?
- Flow record
- Flow sampler
- Flow exporter
- Flow monitor
61. Which two solutions reduce EIGRP DUAL computations in a network? (Choose two.)
- Reducing hello intervals
- Configuring equal-cost load balancing
- Configuring EIGRP stub routing
- Implementing route summarization
- Enabling EIGRP authentication
62. Refer to the exhibit.
Hub# show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
T1 - Route Installed, T2 - Nexthop-override
C - CTS Capable
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1 203.0.113.10 10.0.0.2 UP 00:15:23 D
2 203.0.113.20 10.0.0.3 UP 00:12:45 DWhat does the "D" in the Attrb column indicate?
- The peer is directly connected
- The tunnel is in a down state
- The mapping was learned dynamically via NHRP
- The tunnel uses default encryption
63. Which command configures a router as an NTP server using its local clock as the reference?
- ntp server local
- ntp master
- ntp source local
- ntp clock master
