Two routers receive the same prefix 203.0.113.0/24 via eBGP. Router A learns it with LOCAL_PREF 100, AS_PATH length 2, MED 50; Router B learns it with LOCAL_PREF 100, AS_PATH length 3, MED 10. Both paths have identical weight (0) and no route-map sets weight. Which path is installed and why?
- A. Router B's path, because its MED of 10 is lower and MED is compared before AS_PATH
- B. Router A's path, because AS_PATH length 2 is shorter and AS_PATH is compared before MED ✓
- C. Router B's path, because a shorter MED always overrides a longer AS_PATH in eBGP
- D. Neither; BGP load-balances because LOCAL_PREF is tied
Correct answer: B. In the best-path algorithm AS_PATH length is evaluated well before MED, so the shorter AS_PATH (Router A) wins regardless of the lower MED.
A GRE-over-IPsec tunnel carries traffic fine for SSH and ping, but large HTTPS file downloads stall intermittently and TCP sessions hang. The physical path MTU is 1500 and ICMP 'fragmentation needed' messages are being dropped by an intermediate firewall. What is the most surgical fix on the tunnel routers?
- A. Set 'ip tcp adjust-mss 1360' on the tunnel interfaces so the TCP handshake negotiates a smaller MSS ✓
- B. Increase the tunnel interface MTU to 1500 to match the physical path
- C. Enable 'ip route-cache' fast switching on the tunnel to speed up fragmentation
- D. Disable PMTUD globally with 'no ip pmtu' so hosts stop sending DF-bit packets
Correct answer: A. Clamping MSS forces endpoints to negotiate a segment size that fits the reduced tunnel MTU, sidestepping the PMTUD black hole caused by the firewall dropping ICMP.
In an OSPF network you configure an area as totally stubby (area 10 stub no-summary on the ABR). A device inside area 10 needs to reach an external route redistributed from BGP elsewhere in the domain. How does routing to that external destination work from inside area 10?
- A. It fails because totally stubby areas drop all traffic to external destinations
- B. The ABR floods the Type 5 LSA into the area so the internal router has a specific route
- C. The internal router follows the single default route (Type 3) injected by the ABR toward the ABR ✓
- D. The internal router uses a Type 7 LSA translated into a Type 5 by the ABR
Correct answer: C. Totally stubby areas block Type 3, 4, and 5 LSAs and instead inject a single default route, so internal routers reach any external destination via that default toward the ABR.
During mutual redistribution between OSPF and EIGRP at two boundary routers, a route native to OSPF is redistributed into EIGRP at Router X, then re-redistributed back into OSPF at Router Y with a better metric than the original. What is the classic consequence and the standard prevention?
- A. A routing loop or suboptimal path forms; prevent it by tagging routes on redistribution and filtering tagged routes from being redistributed back ✓
- B. BGP synchronization kicks in; prevent it by disabling synchronization
- C. OSPF SPF fails to converge; prevent it by raising the OSPF reference bandwidth
- D. EIGRP goes stuck-in-active; prevent it by enabling stub routing on Router Y
Correct answer: A. Re-injecting a route back into its origin protocol with an artificially attractive metric creates loops/suboptimal paths, and route tags plus filtering are the canonical guard.
A BGP prefix is present in 'show ip bgp' marked valid but is NOT installed in the RIB and not advertised to peers. LOCAL_PREF and AS_PATH look fine. The most likely single cause is:
- A. The prefix has a lower weight than a competing static route
- B. The BGP next-hop is not reachable in the IGP/RIB, so the path is not marked best ✓
- C. The neighbor is configured as a route reflector client
- D. MED is set higher than the neighbor's advertised MED
Correct answer: B. BGP requires a resolvable next-hop; if next-hop reachability fails the path stays valid-but-not-best and is neither installed nor advertised.
Two data centers run an EVPN-VXLAN fabric with iBGP EVPN peering to route reflectors. A VM moves from leaf-1 to leaf-3. Which EVPN route type and mechanism ensures remote VTEPs update their forwarding for the moved MAC quickly?
- A. Type 5 (IP prefix) route withdrawal triggers underlay reconvergence
- B. Type 2 (MAC/IP advertisement) route with a higher MAC Mobility sequence number supersedes the old advertisement ✓
- C. Type 3 (inclusive multicast) route re-election of the designated forwarder
- D. Type 4 (Ethernet segment) route re-runs the DF election for the ESI
Correct answer: B. MAC mobility is signaled by a new Type 2 route carrying an incremented MAC Mobility Extended Community sequence number, which remote VTEPs prefer over the stale entry.
A stateful firewall sits between two routed segments. Users report that some flows work and others reset randomly. You discover the forward path traverses the firewall but the return path takes a different link that bypasses it, due to redistribution creating an equal-cost alternate. This is asymmetric routing. The cleanest structural fix is:
- A. Enable the firewall's asymmetric-routing/loose-state mode and call it done
- B. Lower the TCP keepalive timers on end hosts to survive the resets
- C. Adjust routing (via metrics, filtering, or summarization) so forward and return traffic are symmetric through the firewall ✓
- D. Disable connection tracking on the firewall so it forwards statelessly
Correct answer: C. Stateful inspection requires both directions to pass the same firewall, so the structural fix is to engineer symmetric routing rather than weaken the firewall's state enforcement.
You run 'show spanning-tree' and see a port in a designated-blocking state flapping under load, with intermittent unicast flooding of established flows. CAM/MAC aging is 300s but the STP topology-change-driven fast-aging (15s) keeps firing. What root cause best explains the flooding?
- A. IGMP snooping is disabled, flooding multicast to all ports
- B. Frequent STP topology changes shorten MAC aging so entries expire before refresh, causing unknown-unicast flooding ✓
- C. The port is misconfigured as an access port in the wrong VLAN
- D. LACP hashing is sending both directions of a flow down different member links
Correct answer: B. TCN-driven fast aging (15s) purges MAC entries faster than bidirectional traffic refreshes them, so the switch floods unknown unicast until it relearns.
In EIGRP DUAL, a router loses its successor for a route. It has a feasible successor whose reported distance is LESS than the router's current feasible distance. What happens?
- A. The router sends a query to all neighbors and goes active on the route
- B. The router installs the feasible successor immediately without going active, achieving fast local convergence ✓
- C. The route goes stuck-in-active because the feasibility condition failed
- D. DUAL recomputes the entire topology table via a full diffusing computation
Correct answer: B. A feasible successor satisfies the feasibility condition (RD < FD), so DUAL promotes it locally without a diffusing computation, avoiding the active state.
An MPLS L3VPN customer at two sites should reach each other but NOT a third site in the same VPN. All PEs import/export route-target 100:1. What is the correct way to enforce the hub-and-spoke-style isolation without new VRFs on the CE side?
- A. Change the route distinguishers so the prefixes look unique
- B. Assign distinct import/export route-target policies per VRF so only intended sites import each other's routes ✓
- C. Filter with an outbound prefix-list on the PE-CE eBGP session only
- D. Disable penultimate-hop popping on the P routers between the sites
Correct answer: B. Route targets (not RDs) govern which VRFs import which VPN routes, so tailoring import/export RT policy is how you build selective connectivity like hub-and-spoke.
In Cisco BGP best-path selection, immediately after Local Preference, the next tiebreaker considered is:
- A. AS_PATH length
- B. Prefer the route originated by the local router (network/redistribute/aggregate) ✓
- C. MED
- D. Origin code
Correct answer: B. Cisco's order is Weight, Local Preference, then prefer locally originated routes, and only then AS_PATH length.
A /31 prefix (RFC 3021) is intended for:
- A. Broadcast domains with 30 hosts
- B. Point-to-point links using both addresses with no network/broadcast reservation ✓
- C. Loopback interfaces only
- D. Multicast group ranges
Correct answer: B. RFC 3021 lets a /31 use both addresses on a point-to-point link, eliminating the wasted network/broadcast pair.
On a broadcast OSPF network, non-DR/BDR routers (DROTHERs) remain in which adjacency state with one another?
- A. FULL
- B. 2-WAY ✓
- C. EXSTART
- D. INIT
Correct answer: B. DROTHERs stay in 2-WAY with each other and only reach FULL with the DR and BDR.
The TCP window scaling option (RFC 7323) exists primarily to:
- A. Encrypt the TCP payload
- B. Allow window sizes beyond 65,535 bytes on high bandwidth-delay-product links ✓
- C. Reduce the negotiated MSS
- D. Disable congestion control
Correct answer: B. Window scaling extends the 16-bit window field so throughput can scale on high bandwidth-delay paths.
Asymmetric routing can break stateful firewalls mainly because:
- A. TTL expires prematurely
- B. Return traffic takes a different path and bypasses the firewall holding the session state ✓
- C. MTU changes mid-path
- D. ARP tables overflow
Correct answer: B. If return traffic misses the firewall that built the session state, the stateful device drops it as unsolicited.
Large packets are silently dropped when ICMP 'fragmentation needed' messages are filtered. This condition is called:
- A. TCP global synchronization
- B. A Path MTU Discovery black hole ✓
- C. Split-horizon failure
- D. ARP cache poisoning
Correct answer: B. Blocking the needed ICMP messages breaks PMTUD, causing oversized packets to be black-holed.
In MPLS, when the second-to-last router removes the label so the egress LSR only does an IP lookup, this is:
- A. Label stacking
- B. Penultimate Hop Popping (PHP) ✓
- C. Label swapping
- D. Route reflection
Correct answer: B. PHP pops the outer label at the penultimate hop so the egress LER avoids a double lookup.
VXLAN extends Layer 2 over Layer 3 using a 24-bit VNI. This yields how many segments and uses which encapsulation port?
- A. 4094 segments, TCP 179
- B. About 16 million segments, UDP 4789 ✓
- C. 65,535 segments, UDP 500
- D. 1024 segments, GRE
Correct answer: B. A 24-bit VNI gives ~16 million segments, and VXLAN encapsulates in UDP with default destination port 4789.
Which distance-vector loop-prevention mechanism stops a router from advertising a route back out the interface on which it was learned?
- A. Route summarization
- B. Split horizon ✓
- C. Route reflection
- D. Equal-cost multipath
Correct answer: B. Split horizon suppresses advertising a route back toward the neighbor it was learned from.
TCP incast throughput collapse in data centers occurs when:
- A. A single flow saturates a WAN link
- B. Many synchronized senders overflow a shallow switch buffer toward one receiver, collapsing throughput ✓
- C. BGP sessions flap repeatedly
- D. DNS resolution becomes slow
Correct answer: B. Incast happens when many synchronized senders overrun a shallow buffer to one receiver, triggering drops, retransmit timeouts, and throughput collapse.
On an OSPF broadcast segment, the DR/BDR election is decided by?
- A. Highest OSPF interface priority, tie-broken by highest Router ID ✓
- B. Lowest MAC address on the segment
- C. Highest IP TTL value
- D. Lowest interface bandwidth
Correct answer: A. OSPF picks the DR by highest priority; a priority of 0 opts out, and ties break on highest Router ID.
In STP, the root bridge is elected based on?
- A. Lowest Bridge ID (priority plus MAC address) ✓
- B. Highest MAC address
- C. Fastest uplink port
- D. Lowest management IP address
Correct answer: A. The switch with the lowest Bridge ID (priority then MAC) becomes the root bridge.
In Cisco BGP best-path selection, which attribute is evaluated FIRST?
- A. Weight (highest preferred) ✓
- B. MED (lowest preferred)
- C. AS-path (shortest preferred)
- D. Origin code
Correct answer: A. Cisco's algorithm checks Weight first (highest wins), before Local Preference and AS-path.
IPv4 fragmentation occurs when?
- A. A packet exceeds the egress link MTU and the Don't-Fragment bit is not set ✓
- B. The TTL reaches zero
- C. The header checksum fails
- D. An ARP entry times out
Correct answer: A. A router fragments a too-large packet if it exceeds the outgoing MTU and DF is clear; otherwise it drops it.
IPv6 SLAAC relies on which mechanism to learn the network prefix?
- A. ICMPv6 Router Advertisement messages ✓
- B. DHCPv4 offers
- C. ARP requests
- D. OSPFv2 LSAs
Correct answer: A. In SLAAC, hosts learn the prefix from ICMPv6 Router Advertisements and self-generate the address.
HSRP and VRRP both provide?
- A. First-hop (default-gateway) redundancy ✓
- B. Encrypted routing updates
- C. Latency-based DNS resolution
- D. VLAN trunk negotiation
Correct answer: A. Both are first-hop redundancy protocols presenting a virtual gateway IP for failover.
The TCP window scaling option is used to?
- A. Allow receive windows larger than 65,535 bytes for high bandwidth-delay links ✓
- B. Dynamically shrink the MTU
- C. Encrypt the TCP payload
- D. Disable fragmentation
Correct answer: A. Window scaling multiplies the 16-bit window field, enabling large windows needed on high-BDP paths.
In an MPLS network, forwarding decisions inside the core are based on?
- A. Labels rather than a destination IP lookup ✓
- B. The source MAC address
- C. The TTL value only
- D. DNS records
Correct answer: A. MPLS routers (LSRs) swap labels and forward by label, avoiding full IP route lookups per hop.
Route summarization primarily reduces?
- A. The size of routing tables and routing update overhead ✓
- B. End-to-end latency to zero
- C. The number of broadcast domains
- D. The switch MAC address table size
Correct answer: A. Aggregating contiguous prefixes shrinks routing tables and cuts update churn.
The DSCP field used for QoS marking resides in?
- A. The IP header (the ToS/DS byte) ✓
- B. The Ethernet frame trailer
- C. The TCP header
- D. The MAC header
Correct answer: A. DSCP occupies the upper 6 bits of the IP header's Differentiated Services (ToS) byte.