How2pass.com Forums - CCNP ENARSI 300-410 Forum

Several Questions with Incorrect Answers

Mon, 07 Sep 2026 06:09:46 +0000

Not sure if this is the best way to do this, or if I should have used the comment feature. Sorry if it's against the rules to bundle these together like this, the forum rules are down lol.
Anyway, I think I've gone through all the questions. I've been noting down the ones I think are wrong:

### AR528 ###
Not sure why this answer was changed. You can see from the traceroute that the loop occurs because R3 is receiving the route from R1 for 172.16.0.0/16. So we need to stop R1 from advertising 172.16.0.0/16 when OSPF is redistributed into EIGRP.
Original answer was correct:
router eigrp 100
redistribute ospf 1 metric 1 1 1 1 1 route-map LOOPFILT
!
route-map LOOPFILT deny 10
match ip address 15
!
route-map LOOPFILT permit 20
!
access-list 15 permit 172.16.0.0 0.0.255.255

### AR126 ###
The question isn't asking about how the matched traffic is treated, it's asking about the effects of the route-map. Anything not matched by the access-list will go on to sequence 10.

Answers should be:
Packets are forwarded using normal route lookup.
Packets are evaluated by sequence 10.

### AR303 ###
Correct answer should be in the in direction for area 20 on router R2
This prevents area 5 from being advertised IN to area 20, while still being advertised to other internal areas.
Current answer of out direction for area 20 would target advertisements FROM area 20 going into areas 0 and 10.

### AR301 ###
Split horizon is synonymous with reverse poisoning, so it's implied that split horizon is already enabled.
Correct answer: Configure route filtering.

### AR515 ###
Based on the output md5 authentication has been enabled under the interface and not under the ospf process.
That's why it shows "Cryptographic authentication enabled" under "show ip ospf int gig 2".
This information is not displayed under the interface if authentication is enabled under the ospf process.

Answer should be:
key chain ospf
key 1
key-string 7 02050D480809
cryptographic-algorithm hmac-sha-1
!
int GigabitEthernet2
ip ospf message-digest-key 1 md5 Cisco
ip ospf authentication message-digest

### AR471 ####
R5 has a log message saying that "10.0.0.17 is not update-source Loopback0's address (10.10.10.5)", meaning that it current has Loopback0 as its update-source.
R6 has the P2P address of 10.0.0.17 as the neighbor address for R5, so changing the update source on R5 is the best solution.

Answer should be:
R5(config)# router bgp 65101
R5(config-router)# no neighbor 10.0.0.18 update-source Loopback0

### AR398 ###
Given answer stops the routing loop, the question is asking which one CAUSES a routing loop lol
Correct answer should be:
router ospf 1
distribute-list route-map deny_tag20 in

router ospf 1
redistribute rip subnets tag 20
!
route-map deny_tag20 permit 10
match tag 20
route-map deny tag20 permit 20

### AR380 ###
Given answer is wrong, destination guard utilizes the binding table.
Answer should be: IPv6 Prefix Guard

The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic
originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are
delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers
ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.
To determine which prefixes should be allowed and which prefixes should be blocked, IPv6 prefix guard uses
the following:
• Prefix glean in Router Advertisements (RAs)
• Prefix glean in DHCP prefix delegation
• Static configuration
Source: https://www.cisco.com/c/en/us/td/docs/io...-guard.pdf

### AR597 ###
Answer should be:
VPN route target communities
MP-BGP peering of VPN community PE devices

An Multiprotocol Label Switching (MPLS)-based virtual private network (VPN) has three major components:

- VPN route target communities—A VPN route target community is a list of all members of a VPN community. VPN route targets need to be configured for each VPN community member.

- Multiprotocol BGP (MP-BGP) peering of VPN community provider edge (PE) devices—MP-BGP propagates virtual routing and forwarding (VRF) reachability information to all members of a VPN community. MP-BGP peering must be configured on all PE devices within a VPN community.

- MPLS forwarding—MPLS transports all traffic between all VPN community members across a VPN service-provider network.

https://www.cisco.com/c/en/us/td/docs/sw...vl_scy_f1b

### AR640 ###
Given answer is wrong - IPv6 Router Advertisement (RA) Guard does not inherently require or use the binding table to block rogue router advertisements, as it relies primarily on port-based policies and interface trust states.
Source: https://oneuptime.com/blog/post/2026-03-...urity/view

Correct answer should be: captures any type of user traffic to create a binding table
IPv6 Snooping learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables
and analyzes ND messages in order to build a trusted binding table.
Source: https://www.cisco.com/c/en/us/td/docs/ro...ing-xe.pdf

I could be wrong on some of these. Please share your thoughts!

QID:AR253 - Incorrect answer given

Fri, 04 Sep 2026 02:45:56 +0000

ipv6 address autoconfig is given as the correct answer but this command is used for ipv6 address assignment using SLAAC (not via a DHCP Server).

Please review and provide feedback.

Adil

QID : AR433 - Prepend BGP

Tue, 25 Aug 2026 12:14:00 +0000

It seems the right answer is to prepend the AS 200 and put the route-map on OUT, not IN.
Please fix it, maybe i'm wrong, but I think AS PREPEND is always used on OUT.

Any feedback would be great.

QID: AR403 Given Answer Incorrect

Thu, 20 Aug 2026 20:43:29 +0000

Hello,

The correct answer should be:

A permit 20 statement should be added before completing the ACL with the required prefixes, and then the permit 20 statement can be removed.

Adil

Login successful but unable to purchase ENARSI 59$

Sun, 09 Aug 2026 20:25:03 +0000

Hi folks, first of all sorry for my broke english.
And long live to this incredible website.

Here's the thing. I would like to pass my ENARSI. And I want to purchase the product ENARSI on How2pass.
I can login into this great forum BUT I just dont understand why I cannot login in order to purchase the product.
It says that my login/password are incorrect but right now i'm login and i'm writting to you !

Maybe something went wrong I don't know.
Thks for your helps.

QID: AR075 - What is advantage of using BFD

Tue, 04 Aug 2026 15:07:19 +0000

The correct answer should be:

It has sub-second failure detection for layer 1 and layer 2 problems.

See this info from cisco's website to substantiate my above opinion above:

https://www.cisco.com/en/US/technologies...44005.html
CONCLUSION
Bidirectional Forwarding Detection provides a method for network administrators to configure sub-second Layer 2 failure detection between adjacent network nodes. Furthermore, they can configure their routing protocols to respond to BFD notifications, and begin Layer 3 route convergence almost immediately.

QID: AR267 One of the Answers is wrong

Fri, 31 Jul 2026 13:48:22 +0000

Hello,

The correct two answers should be:

Remove the ACL entry 80.
Permit ICMPv6 neighbor discovery traffic in the ACL.

Please correct this question's answers.

Adil

QID: AR564 answer is wrong

Fri, 24 Jul 2026 15:19:01 +0000

The correct answer should be "Delete and configure the ip sla 6500 command with R3 e0/1 IP address." because once an IP SLA is configured and running it cannot be modified. It must be deleted then reconfigured.

Please review my note above and provide feedback.

Adil

AR085 Seem Wrong

Mon, 13 Jul 2026 00:11:51 +0000

Reviewing this and it seems wrong.
This looks more correct to me.

route-map link-a-in permit 10
set weight 200
route-map link-a-out permit 10
route-map link-b-in permit 10
set weight 100
route-map link-b-out permit 10
set as-path prepend 64512

Passed! My Notes

Fri, 03 Jul 2026 15:20:47 +0000

Passed this morning. Thought i'd bombed it but low and behold...... PASS
3 sims up front. Got no drag and drops this time. Several of the multiple choice questions were new. Maybe 4 of the 40 questions were ones not seen here.
The sims:

all my sims were very similar to the ones found here but there were drastic changes on some.

VRF & EIGRP Sim:
The IP between R2 and R3 Admin was a 192.168.x.x while all the rest were some form of a 10.x.x.x/30
for this I:
router eig
network 10.0.0.0
and or
network 192.168.0.0
^^^ that popped all the wings into the EIGRP routing

Next step was to fix some bad autosummarization on R6 with its loopback. I wasn't able to get this but i compared this config to the R5 set up since i figured they should be the same and R5 would be working since not mentioned.

DHCP, IP SLA & NetFlow Sim # 2:
The DHCP portion was darn near spot on. Just had to fix the default-router then flip on the interface on the R6 and finally point vlan 20 to the right spot

The change is that they wanted R2, which they called SW2 to use IP SLA tcp-connect down to R5 over tcp 80. The SW was partially set up but the big thing, going down to R5 and flipping on ip sla responder so it'll reply back as needed.

There was no Netflow on this one for me

DMVPN OSPF Sim:
Was pretty spot on. The configs were already basically there. Just had to flip on the entire crypto isakmp and ipsec process for H0 and then apply it to the tunnel. There was a note that the BR1 and 2 needed to establish connection directly to one another. I wasn't able to get this to work and the show dmvpn on the BR1 and 2 only showed the hub but the Routers and Sw were able to ping one another just fine.

Remember: Study and know WHY you are doing what you are doing. Not just rote muscle memory.

QID: AR677 Answer is wrong

Wed, 01 Jul 2026 15:08:42 +0000

Hello,

Please review AR677 as the given correct answer can't be correct because that answer has an incorrect tunnel source in the config. You can't use a tunnel ip as a tunnel source. Please correct.

Thank you,

Adil

Failed Exam 6/17

Fri, 19 Jun 2026 13:12:39 +0000

Labs were

1) VRF EIGRP with the exact same ip address and problems

2) DMVPN OSPF where request was to configure H0, but IPSEC needed to be configure on the BR s, couldnt make it work

3) NEtflow and DHCP: DHCP was working, how netflow has issues in Sw1 instead of R3. R3 had the input and put commands on the e0/0/ interface. Coudlnt make it work

Any help or advise wil be helpful

CoPP Configuraton Simulation

Wed, 10 Jun 2026 01:03:09 +0000

I want How2Pass to check the CoPP Configuration Sim built into the website as I don't think the "check result" is working properly. I completed the lab while following the solution yet the "check solution" keeps telling me that I have completed Task 2 incorrectly.

Please check and advise.

Thanks,

Adil

QID: AR188 - Question/Answer mismatch

Wed, 03 Jun 2026 13:37:36 +0000

Please look at question QID: AR188. It mentions a log error message as part of the explanation of the correct answer which isn't in the exhibit. Also the "correct answer" given fit with the exhibit at all.

Failed

Fri, 29 May 2026 15:27:04 +0000

Took it today. Failed. VPN section hit me the hardest it seems. 25% all others i was over 70%

I got a sims similar to "VRF & EIGRP Sim", "DHCP, IP SLA & NetFlow Sim # 2", and a partially configured IPSEC similar to the ones in "IPSec Config Sim"

the questions were pretty much spot on. I know where i failed. The IPSEC sim asked to disabled EIGRP split horizon where i blanked and also the IP SLA sim i forgot to turn on the icmp-jitter.

There was also a drag and drop not on this list. Setting up key and encryption drag and drops between two routers.