5 hours ago
Not sure if this is the best way to do this, or if I should have used the comment feature. Sorry if it's against the rules to bundle these together like this, the forum rules are down lol.
Anyway, I think I've gone through all the questions. I've been noting down the ones I think are wrong:
### AR528 ###
Not sure why this answer was changed. You can see from the traceroute that the loop occurs because R3 is receiving the route from R1 for 172.16.0.0/16. So we need to stop R1 from advertising 172.16.0.0/16 when OSPF is redistributed into EIGRP.
Original answer was correct:
router eigrp 100
redistribute ospf 1 metric 1 1 1 1 1 route-map LOOPFILT
!
route-map LOOPFILT deny 10
match ip address 15
!
route-map LOOPFILT permit 20
!
access-list 15 permit 172.16.0.0 0.0.255.255
### AR126 ###
The question isn't asking about how the matched traffic is treated, it's asking about the effects of the route-map. Anything not matched by the access-list will go on to sequence 10.
Answers should be:
Packets are forwarded using normal route lookup.
Packets are evaluated by sequence 10.
### AR303 ###
Correct answer should be in the in direction for area 20 on router R2
This prevents area 5 from being advertised IN to area 20, while still being advertised to other internal areas.
Current answer of out direction for area 20 would target advertisements FROM area 20 going into areas 0 and 10.
### AR301 ###
Split horizon is synonymous with reverse poisoning, so it's implied that split horizon is already enabled.
Correct answer: Configure route filtering.
### AR515 ###
Based on the output md5 authentication has been enabled under the interface and not under the ospf process.
That's why it shows "Cryptographic authentication enabled" under "show ip ospf int gig 2".
This information is not displayed under the interface if authentication is enabled under the ospf process.
Answer should be:
key chain ospf
key 1
key-string 7 02050D480809
cryptographic-algorithm hmac-sha-1
!
int GigabitEthernet2
ip ospf message-digest-key 1 md5 Cisco
ip ospf authentication message-digest
### AR471 ####
R5 has a log message saying that "10.0.0.17 is not update-source Loopback0's address (10.10.10.5)", meaning that it current has Loopback0 as its update-source.
R6 has the P2P address of 10.0.0.17 as the neighbor address for R5, so changing the update source on R5 is the best solution.
Answer should be:
R5(config)# router bgp 65101
R5(config-router)# no neighbor 10.0.0.18 update-source Loopback0
### AR398 ###
Given answer stops the routing loop, the question is asking which one CAUSES a routing loop lol
Correct answer should be:
router ospf 1
distribute-list route-map deny_tag20 in
router ospf 1
redistribute rip subnets tag 20
!
route-map deny_tag20 permit 10
match tag 20
route-map deny tag20 permit 20
### AR380 ###
Given answer is wrong, destination guard utilizes the binding table.
Answer should be: IPv6 Prefix Guard
The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic
originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are
delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers
ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.
To determine which prefixes should be allowed and which prefixes should be blocked, IPv6 prefix guard uses
the following:
• Prefix glean in Router Advertisements (RAs)
• Prefix glean in DHCP prefix delegation
• Static configuration
Source: https://www.cisco.com/c/en/us/td/docs/io...-guard.pdf
### AR597 ###
Answer should be:
VPN route target communities
VPN route distinguisher
An Multiprotocol Label Switching (MPLS)-based virtual private network (VPN) has three major components:
- VPN route target communities—A VPN route target community is a list of all members of a VPN community. VPN route targets need to be configured for each VPN community member.
- Multiprotocol BGP (MP-BGP) peering of VPN community provider edge (PE) devices—MP-BGP propagates virtual routing and forwarding (VRF) reachability information to all members of a VPN community. MP-BGP peering must be configured on all PE devices within a VPN community.
- MPLS forwarding—MPLS transports all traffic between all VPN community members across a VPN service-provider network.
https://www.cisco.com/c/en/us/td/docs/sw...vl_scy_f1b
### AR640 ###
Given answer is wrong - IPv6 Router Advertisement (RA) Guard does not inherently require or use the binding table to block rogue router advertisements, as it relies primarily on port-based policies and interface trust states.
Source: https://oneuptime.com/blog/post/2026-03-...urity/view
Correct answer should be: captures any type of user traffic to create a binding table
IPv6 Snooping learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables
and analyzes ND messages in order to build a trusted binding table.
Source: https://www.cisco.com/c/en/us/td/docs/ro...ing-xe.pdf
I could be wrong on some of these. Please share your thoughts!
Anyway, I think I've gone through all the questions. I've been noting down the ones I think are wrong:
### AR528 ###
Not sure why this answer was changed. You can see from the traceroute that the loop occurs because R3 is receiving the route from R1 for 172.16.0.0/16. So we need to stop R1 from advertising 172.16.0.0/16 when OSPF is redistributed into EIGRP.
Original answer was correct:
router eigrp 100
redistribute ospf 1 metric 1 1 1 1 1 route-map LOOPFILT
!
route-map LOOPFILT deny 10
match ip address 15
!
route-map LOOPFILT permit 20
!
access-list 15 permit 172.16.0.0 0.0.255.255
### AR126 ###
The question isn't asking about how the matched traffic is treated, it's asking about the effects of the route-map. Anything not matched by the access-list will go on to sequence 10.
Answers should be:
Packets are forwarded using normal route lookup.
Packets are evaluated by sequence 10.
### AR303 ###
Correct answer should be in the in direction for area 20 on router R2
This prevents area 5 from being advertised IN to area 20, while still being advertised to other internal areas.
Current answer of out direction for area 20 would target advertisements FROM area 20 going into areas 0 and 10.
### AR301 ###
Split horizon is synonymous with reverse poisoning, so it's implied that split horizon is already enabled.
Correct answer: Configure route filtering.
### AR515 ###
Based on the output md5 authentication has been enabled under the interface and not under the ospf process.
That's why it shows "Cryptographic authentication enabled" under "show ip ospf int gig 2".
This information is not displayed under the interface if authentication is enabled under the ospf process.
Answer should be:
key chain ospf
key 1
key-string 7 02050D480809
cryptographic-algorithm hmac-sha-1
!
int GigabitEthernet2
ip ospf message-digest-key 1 md5 Cisco
ip ospf authentication message-digest
### AR471 ####
R5 has a log message saying that "10.0.0.17 is not update-source Loopback0's address (10.10.10.5)", meaning that it current has Loopback0 as its update-source.
R6 has the P2P address of 10.0.0.17 as the neighbor address for R5, so changing the update source on R5 is the best solution.
Answer should be:
R5(config)# router bgp 65101
R5(config-router)# no neighbor 10.0.0.18 update-source Loopback0
### AR398 ###
Given answer stops the routing loop, the question is asking which one CAUSES a routing loop lol
Correct answer should be:
router ospf 1
distribute-list route-map deny_tag20 in
router ospf 1
redistribute rip subnets tag 20
!
route-map deny_tag20 permit 10
match tag 20
route-map deny tag20 permit 20
### AR380 ###
Given answer is wrong, destination guard utilizes the binding table.
Answer should be: IPv6 Prefix Guard
The IPv6 Prefix Guard feature works within the IPv6 Source Guard feature, enabling the device to deny traffic
originated from nontopologically correct addresses. IPv6 prefix guard is often used when IPv6 prefixes are
delegated to devices (for example, home gateways) using DHCP prefix delegation. The feature discovers
ranges of addresses assigned to the link and blocks any traffic sourced with an address outside this range.
To determine which prefixes should be allowed and which prefixes should be blocked, IPv6 prefix guard uses
the following:
• Prefix glean in Router Advertisements (RAs)
• Prefix glean in DHCP prefix delegation
• Static configuration
Source: https://www.cisco.com/c/en/us/td/docs/io...-guard.pdf
### AR597 ###
Answer should be:
VPN route target communities
VPN route distinguisher
An Multiprotocol Label Switching (MPLS)-based virtual private network (VPN) has three major components:
- VPN route target communities—A VPN route target community is a list of all members of a VPN community. VPN route targets need to be configured for each VPN community member.
- Multiprotocol BGP (MP-BGP) peering of VPN community provider edge (PE) devices—MP-BGP propagates virtual routing and forwarding (VRF) reachability information to all members of a VPN community. MP-BGP peering must be configured on all PE devices within a VPN community.
- MPLS forwarding—MPLS transports all traffic between all VPN community members across a VPN service-provider network.
https://www.cisco.com/c/en/us/td/docs/sw...vl_scy_f1b
### AR640 ###
Given answer is wrong - IPv6 Router Advertisement (RA) Guard does not inherently require or use the binding table to block rogue router advertisements, as it relies primarily on port-based policies and interface trust states.
Source: https://oneuptime.com/blog/post/2026-03-...urity/view
Correct answer should be: captures any type of user traffic to create a binding table
IPv6 Snooping learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables
and analyzes ND messages in order to build a trusted binding table.
Source: https://www.cisco.com/c/en/us/td/docs/ro...ing-xe.pdf
I could be wrong on some of these. Please share your thoughts!