ENARSI practice questions
Cisco · 300-410 · 200 questions
Original practice questions for the Cisco ENARSI 300-410 exam, covering advanced enterprise Layer 3 routing (EIGRP, OSPF, BGP, redistribution, PBR, VRF-Lite), VPN technologies (MPLS awareness and single-hub DMVPN), infrastructure security (AAA, ACLs, uRPF, CoPP, IPv6 First Hop Security), and infrastructure services (device management, SNMP, logging, DHCP, IP SLA, NetFlow, DNA Center assurance).
This course contains the use of artificial intelligence.
About the 300-410 exam
- Time allowed
- 1 hour 30 minutes
- Languages
- English, Japanese
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Layer 3 Technologies · 105 questions
- A housing authority edge router learns the same parks subnet from a manually configured static route and from OSPF. By default, which path does the router install in the RIB?
- A library consortium edge learns the same court VLAN prefix as an internal EIGRP route and as an eBGP route. Which source wins by default administrative distance?
- A county courts team adds a floating static toward a backup MPLS circuit while OSPF remains the primary path to the justice complex. How should the floating static’s administrative distance be chosen?
- A city clerk’s office sees both an external EIGRP route and an OSPF route for the same water-SCADA prefix. Which path does IOS prefer by default, and why?
- A parks department wants a known-good OSPF path to city hall to remain preferred over an iBGP-learned copy of the same prefix. What AD relationship makes that outcome correct by default?
- During a sanitation-department migration drill, a lab router learns the same township prefix via RIP and via OSPF. Which protocol’s route is installed by default?
- An emergency-management office redistributes library prefixes into the core and wants those routes marked so later filters can recognize them. Which route-map action best tags the redistributed prefixes for that policy?
- A school-district WAN team must stop advertising only police-camera prefixes outbound while leaving other OSPF routes intact. Which route-map approach achieves that selective filter?
- A fire-district IT team redistributes static routes for fire-station WANs into EIGRP and must assign a controlled composite metric. Which route-map capability provides that metric during redistribution?
- A police records bureau wants inbound BGP updates for citizen-portal prefixes from ISP-A preferred over ISP-B inside the AS. Which route-map set action on the ISP-A neighbor best expresses that preference?
- An assessor’s office needs redistributed transit routes that match a prefix-list to receive both a new metric and a route tag in one policy pass. How should the route-map be built?
- A building-permits office must block redistribution of an incorrect summary while still allowing more-specific civic prefixes into the target protocol. Which route-map logic is correct?
- A public-health department earlier tagged guest Wi-Fi routes at the edge. Core routers must now drop those tagged prefixes during redistribution. Which match is the right tool?
- A wastewater treatment plant applies a redistribute route-map that permits only a few matched clauses and has no final explicit deny. Why do unexpected prefixes still fail to redistribute?
- A municipal 911 PSAP sees routing loops after mutual redistribution between OSPF and EIGRP at two borders with no route tags. What is the most direct loop-prevention fix using tagging?
- A county elections office runs a hub-and-spoke radio WAN for sanitation sites and relies on split horizon. What does split horizon prevent by default?
- A civic data center withdraws a failed parks summary and uses route poisoning so remote sites stop using the bad path quickly. What is the core idea of route poisoning?
- A regional planning commission wants to stop a BGP↔OSPF redistribution feedback loop toward city hall without depending only on tags. Which mechanism directly supports that loop-prevention goal?
- A municipal fiber consortium removes redistribution route tags that previously blocked feedback between campuses and soon sees loop-like instability return. What does that symptom most strongly indicate?
- A city traffic-operations center must stop the same 911 subnet from feeding back between OSPF and EIGRP. When is a prefix-list deny a better primary control than tag-based policy alone?
- A county jail facilities team redistributes selected OSPF civic prefixes into BGP so the Internet edge can advertise public services. Which verification cue best confirms those OSPF routes were successfully injected into BGP?
- A public-library branch network injects a static null0 summary into OSPF so remote counties learn an aggregate for the city supernet. Why is redistributing that discard static useful?
- After a department merger, a municipal hospital campus mutually redistributes EIGRP and OSPF at a single border. What seed-metric consideration is most important to avoid unusable or surprising external paths?
- A city IT team must advertise VRF-connected court case-management subnets into BGP for a cloud handoff. Which redistribution pattern correctly injects those connected prefixes?
- A county network team redistributes a classless routing source into OSPF but only classful-looking major networks appear. What missing keyword commonly causes that symptom?
- A township public works team redistributes OSPF into EIGRP for parks and roads VLANs and must set a seed metric so operators are not surprised by unequal-cost candidates. Which action correctly supplies the EIGRP composite seed metric on redistribution?
- A municipal water utility redistributes selected BGP SaaS prefixes used by the permits office into OSPF on the edge ASBR. How do those redistributed BGP prefixes typically appear inside OSPF?
- A transit authority wants only utility-SCADA prefixes that already carry a specific route tag to enter the global routing table when redistributing from a SCADA VRF IGP. Which approach enforces that conditional redistribution?
- A port authority redistributes the same static civic prefix at two border routers without filtering and operators report duplicate or unstable paths. What is the most appropriate remediation at ENARSI depth?
- An airport authority needs to confirm that a redistributed parks prefix is actually owned by the intended protocol in the routing table after a change window. Which verification approach best proves RIB ownership versus merely seeing the prefix in a protocol database?
- A housing authority manually summarizes many /24 library-branch networks into a /16 at an ABR to shrink the core LSDB. What behavior should operators expect for that OSPF area range summarization?
- A library consortium briefly enables EIGRP auto-summary in a lab that uses non-contiguous civic addressing across branches. What is the primary risk of that auto-summary behavior?
- A county courts network team advertises a BGP aggregate for public civic services while still leaking more-specific prefixes for a dual-homed PSAP. Which design element supports that pattern?
- A city clerk’s office summarizes a parks address range, but some component subnets were never present and users to those holes are blackholed. What mechanism most directly explains that symptom?
- A parks department advertises an OSPF summary toward a partner county and must stop the individual component routes from also being advertised into that area. What is the expected summarization behavior?
- A sanitation department runs EIGRP named mode across township hubs with non-uniform addressing and must choose a summarization approach. When is manual summarization safer than EIGRP auto-summary?
- An emergency-management office wants guest Wi-Fi Internet traffic to exit a cheaper circuit while staff applications keep using the primary MPLS path based on the normal routing table. Which feature implements that selective override?
- A school district WAN team applies PBR with set ip next-hop for selected student-portal traffic on an IOS XE border. What should verification focus on?
- A fire-district IT team must send backup-camera streams to a forensic collector without changing how other traffic to the same destination prefixes is routed in the global table. Which approach fits?
- A police records bureau configures PBR on a border router’s ingress interface so only ACL-permitted packets are policy-routed to an alternate next hop. Which combination is required?
- An assessor’s office uses PBR with set ip next-hop toward a preferred exit. When that next hop becomes unreachable, what is the typical default behavior for matched packets?
- A building-permits office wants citizen-portal traffic steered by PBR to fail over when the preferred exit dies. Which design combines resilience with PBR?
- A public-health department must keep utility SCADA routing separate from corporate office routing on the same edge router without deploying MPLS. Which technology fits that ENARSI requirement?
- A wastewater treatment plant places SCADA and office interfaces into different VRFs on one IOS XE router. What must operators remember when finishing that VRF-Lite build?
- A municipal 911 PSAP needs a shared DNS prefix reachable from two VRF-Lite instances without merging the entire tables. What approach matches controlled leaking at VRF-Lite depth?
- A county elections office runs OSPF for courts inside a VRF while city-hall networks remain in the global table on the same chassis. How should OSPF be applied for the courts VRF?
- A civic data center engineer troubleshoots missing SCADA routes and used only show ip route without a VRF name on a VRF-Lite edge. What was most likely wrong with that verification method?
- A regional planning commission co-locates two agencies that both use overlapping RFC1918 space on shared WAN routers. Which VRF-Lite outcome is the design trying to achieve?
- A municipal fiber consortium needs much faster detection of a dark-fiber failure between campuses than IGP hello timers alone provide. What is BFD’s primary role in that design?
- A city traffic-operations center wants OSPF adjacency to drop quickly when a link fails silently between signal-ops routers. How does BFD integrate with OSPF for that outcome?
- A county jail facilities IT team wants faster failure detection on a latency-sensitive 911 backhaul than default EIGRP hellos provide. Why prefer enabling BFD for the EIGRP neighbors over simply lowering EIGRP hello and hold timers aggressively?
- A public-library branch network is dual-homed at regional hubs and staff ask how BFD echo mode differs from asynchronous mode at a describe level. Which statement is accurate?
- A municipal hospital campus WAN is migrating from classic EIGRP to named mode so township hubs share a consistent address-family configuration model. What is the primary operational difference named mode introduces?
- A city IT team enables EIGRP for dual-stack parks cameras and must keep IPv4 and IPv6 routing logically separate inside the same named process. Which approach matches EIGRP address-family behavior?
- After a change window, a county network team finds EIGRP adjacencies down between two civic hubs. Show commands reveal mismatched K-values. What is the expected result?
- A township public-works department configures EIGRP authentication with a key chain on WAN interfaces so a rogue device plugged into a spare circuit cannot join the AS. What symptom typically appears when authentication fails between two otherwise valid neighbors?
- A municipal water utility explains backup path selection for a court VLAN. When does EIGRP install a neighbor’s path as a feasible successor?
- A transit authority sees Stuck-in-Active after a summary flap on the civic WAN. What does SIA indicate for operators?
- A port authority configures EIGRP stub routing at remote fire stations. What primary problem does the stub feature address?
- An airport authority has two circuits toward a landfill site with unequal EIGRP metrics and wants both paths to carry traffic. Which feature enables that unequal-cost load balancing?
- A housing authority has two identical MetroE links into city hall running EIGRP with matching metrics. What behavior provides equal-cost multipath?
- A library consortium wants traffic to prefer one WAN exit by influencing the EIGRP composite metric on an interface. Which inputs most directly feed that classic composite metric?
- A county courts network runs EIGRP for SCADA inside a VRF while a separate global EIGRP process serves office VLANs on the same router. What does this separation provide?
- A city clerk’s office cannot form an EIGRP neighbor on the WAN link to a partner county. Investigation shows passive-interface was left enabled on that WAN interface. What is the impact?
- Before a planned fiber cut, a parks department reviews the EIGRP topology table for a critical prefix. How should operators distinguish the successor from a feasible successor?
- A sanitation department configures a remote site as an EIGRP stub but still needs that site to advertise one critical local prefix upstream. Which concept addresses that need?
- An emergency-management office configures EIGRP on two civic hubs but adjacency never forms. The hubs use different autonomous-system numbers. What is the correct conclusion?
- After migrating to EIGRP named mode, a school-district WAN team notices metric values in show outputs look different from classic scaled metrics. What should troubleshooters understand?
- A fire-district IT team sees two feasible successors for a prefix, yet only one path is installed in the routing table. Variance is still at the default of 1. What explains this?
- A police records bureau plans a weekend EIGRP authentication key rollover across library WAN edges. What practice best preserves adjacency continuity during the rollover?
- An assessor’s office enables OSPFv3 for IPv6 campus edges while continuing OSPFv2 for IPv4. Which statement correctly describes their roles?
- A building-permits office sees OSPF neighbors stuck in 2-Way on a broadcast Ethernet segment that already has a DR and BDR. What is the correct interpretation for non-DR/BDR routers?
- A public-health department’s OSPF adjacency to a PSAP link drops after a MetroE change. Which mismatch is a classic cause that prevents neighbors from forming?
- A wastewater treatment plant enables OSPF authentication with MD5 keys so unauthorized routers cannot inject LSAs into the plant area. What is the typical symptom when authentication fails?
- A municipal 911 PSAP configures an Ethernet WAN between two civic hubs and wants to avoid DR/BDR election on that link. Which OSPF network type choice achieves that?
- A county elections office runs OSPF over a hub-and-spoke radio WAN to landfill sites where spoke-to-spoke multicast is unreliable. Which OSPF network type best fits that design and what must the engineers plan for?
- A civic data center designs OSPF with area 0 at the core, normal areas for city departments, and stub areas for remote libraries. What roles do those area types play?
- A regional planning commission converts a remote fire-district OSPF area to totally stubby so the LSDB stays tiny. What routes should routers in that area keep after the ABR is configured correctly?
- A municipal fiber consortium needs a remote area that can still inject a limited set of external routes while blocking most Type-5 flooding from the core. Which OSPF area type should they choose and why?
- A city traffic-operations center must identify which OSPF router is summarizing inter-area prefixes versus which one is redistributing an external routing source at the civic core. Which role mapping is correct?
- A county jail facilities team temporarily loses a contiguous path to area 0 while fiber work isolates a new OSPF area. What is the purpose of configuring an OSPF virtual link in that situation?
- A public-library branch network wants OSPF to prefer one dual-data-center uplink over the other without changing bandwidth references globally. Which mechanism is the primary way to influence that path preference?
- A municipal hospital campus WAN learns the same external prefix as both OSPF External Type-1 and Type-2 toward a cloud breakout. Which preference rule should the engineers expect?
- A city IT team sees an OSPF adjacency stall in ExStart/Exchange between two civic core routers after a WAN circuit change. Which mismatch is the classic cause of that symptom?
- A county network team troubleshoots OSPF on a multipoint tunnel-style segment where they want no DR election and treat the cloud as a collection of point-to-point adjacencies. Which network type behavior matches that goal?
- A township public works LAN connects several agency routers on a multi-access Ethernet transit segment running OSPF broadcast. How is the Designated Router chosen?
- A municipal water utility configures Type-3 filtering at an ABR so guest Wi-Fi prefixes stay local to one OSPF area and do not appear as inter-area routes elsewhere. What is the expected result?
- A transit authority runs OSPF inside a courts VRF-Lite instance while a separate global OSPF process serves parks networks on the same edge router. What operational reality should the team verify?
- A port authority learns the same permit-portal prefix as an intra-area OSPF route, an inter-area route, and an external route. Which preference order should guide troubleshooting?
- An airport authority clones a router template and later sees odd OSPF adjacency and LSA behavior across civic edge devices. Which requirement was most likely violated?
- A housing authority dual-homes citizen-facing prefixes to two ISPs with eBGP while keeping iBGP among civic core routers. What roles do those BGP peering types play?
- A library consortium needs BGP to carry dual-stack public services: IPv6 for modern portals and IPv4 for legacy catalog systems. How should that be structured on the BGP speakers?
- A county courts border router must form eBGP to an ISP using loopback endpoints rather than the directly connected interface addresses. Which feature enables that peering?
- A city clerk's office wants to stop a rogue device from successfully establishing BGP and injecting routes into the city ASN. Which control directly protects the TCP session between legitimate peers?
- A parks department uses private AS numbers internally but must advertise civic prefixes to the public Internet without leaking those private ASNs in the AS path. Which action addresses that requirement on the eBGP edge?
- A sanitation department applies a new inbound BGP filter toward an ISP and needs the policy to take effect without bouncing the TCP session. Which capability supports that approach?
- An emergency-management office peers with two similar ISP transit routers and wants identical outbound policies without duplicating every neighbor statement detail. Which BGP construct helps?
- A school district WAN team sees a BGP session fail to stay up toward an ISP and must interpret neighbor state while troubleshooting. Which statement best matches common state meaning?
- A fire-district IT team wants outbound traffic to prefer ISP-A and wants return traffic from the Internet to prefer the ISP-B path for the same civic prefixes. Which attribute pairing matches those goals?
- A police records bureau compares multiple BGP paths to a SaaS exit and must recall the classic best-path decision order at ENARSI depth. Which early sequence is correct?
- An assessor's office deploys a single BGP route reflector in the civic core so many edge routers no longer need a full iBGP mesh. What primary purpose does that route reflector serve?
- A building-permits office wants to accept only the provider-assigned blocks from its ISP and drop unexpected Internet prefixes. Which inbound BGP policy approach best matches that goal?
- A public-health department advertises eBGP-learned defaults into iBGP toward internal civic routers, but those routers cannot reach the ISP next-hop address. Which BGP neighbor setting on the border router most directly fixes that reachability gap?
- A wastewater treatment plant shares one edge router among multiple agencies and needs separate BGP routing contexts without provider MPLS. Which enterprise pattern fits that requirement at ENARSI depth?
- A municipal 911 PSAP must peer with a modern ISP whose autonomous system number no longer fits in the classic 2-byte ASN space. What capability must the PSAP's BGP implementation support?
VPN Technologies · 60 questions
- A school district WAN team describes a Label Switching Router in the middle of a provider-managed MPLS path toward city hall. What is that mid-path LSR's primary job along the LSP?
- A fire-district IT team needs to explain how neighboring LSRs learn which MPLS labels to use for IGP-reachable prefixes. Which protocol fulfills that label-distribution role in classic MPLS operations?
- A police records bureau traces a civic packet that enters the provider edge as plain IP, crosses the core labeled, and leaves unlabeled toward the far CE. Which describe-level sequence best matches that MPLS behavior?
- An assessor's office defines how labeled packets traverse the provider cloud toward a remote township. What does an LSP represent in that MPLS model?
- A building-permits office contrasts hop-by-hop IP routing with MPLS on its leased civic WAN. Why does MPLS label switching differ from pure IP routing at describe depth?
- A public-health department identifies where customer IP traffic from a library VRF first receives an MPLS label on a managed provider path. Which role performs that ingress label imposition?
- A wastewater treatment plant identifies which device removes MPLS labels before delivering traffic to a township CE. Which role performs that egress disposition?
- A municipal 911 PSAP studies penultimate-hop popping on the provider path into its PE. What does PHP mean at ENARSI describe depth?
- A county elections office expects MPLS LSPs for civic prefixes to track the same forwarding path the IGP prefers. What describe-level relationship supports that expectation?
- A civic data center sees an LDP session down between P routers that still have IGP adjacency. What is the most likely describe-level impact on MPLS forwarding?
- A regional planning commission maps roles on a managed MPLS service that connects county sites. Which distinction is correct at describe depth?
- A municipal fiber consortium explains how one provider MPLS core can carry separated tables for multiple civic customers. What capability is MPLS enabling at that describe level?
- A city traffic-operations center notes both a VPN label and an IGP/transport label on PE-to-P links for L3VPN traffic. What does that two-label stack represent at describe depth?
- A county jail facilities team assumes a managed MPLS path inherently encrypts inmate-records traffic between sites. What is the accurate describe-level statement?
- A public-library branch verifies describe-level behavior of LSPs for traffic to HQ and back. What implication follows from LSPs being unidirectional?
- A municipal hospital campus WAN uses a provider MPLS L3VPN so courts and parks keep separate routing tables on shared PE routers. What PE construct primarily enforces that customer separation?
- A city IT team needs the control-plane mechanism that carries VPNv4 prefixes between PE routers for multi-site agency L3VPNs. Which technology fills that role?
- A county network team sees two townships using identical RFC1918 prefixes that must both appear uniquely in MP-BGP. Which MPLS L3VPN element makes those overlapping prefixes unique in the VPN address family?
- A township public-works department needs PE VRF policy that controls which VPN routes are installed into a given VRF. Which MPLS L3VPN construct provides that import/export membership control?
- A municipal water utility describes how a housing-authority CE can exchange routes with the provider PE on an MPLS L3VPN attachment. Which statement is accurate at describe depth?
- A transit authority separates agency routing tables on a single civic edge router with VRF-Lite and no provider MPLS core. How does that differ from a managed MPLS Layer 3 VPN service connecting those agencies across many sites?
- A port authority wants library branches, the main port HQ, and a remote annex to reach each other any-to-any inside one managed MPLS L3VPN. Which route-target design best supports that full-mesh reachability?
- An airport authority wants branch fire-station sites to reach HQ services through a hub PE, not each other directly, in a managed MPLS L3VPN. Which RT patterning describes that hub-and-spoke VPN?
- A housing authority engineer traces a VPN packet from a PE toward the P core. Besides the VPN (inner) label that identifies the customer VRF, what outer label does the PE typically impose for transport across the provider backbone?
- A library consortium connects simple CE routers to a provider PE for a managed MPLS L3VPN. What is typically true about MPLS awareness on those customer CE devices?
- Two merged county agencies keep identical RFC1918 plans for courts and parks after consolidation. How can an MPLS L3VPN still isolate those overlapping addresses across the provider network?
- A city clerk’s office asks how a managed MPLS L3VPN separates control-plane signaling from packet forwarding for multi-site agency VRFs. Which description is accurate?
- A parks department compares a carrier-managed MPLS L3VPN for dense campus sites against building DIY DMVPN over the Internet for a few sparse trailhead offices. When is the managed L3VPN service the more appropriate describe-level choice?
- A sanitation department needs a shared-services VPN (DNS, logging) reachable from multiple agency VRFs without merging those agencies into one flat table. Which MPLS L3VPN concept applies?
- An emergency-management office reviews a managed MPLS L3VPN diagram and asks whether core P routers must hold each agency’s customer VRF routing tables. What is the describe-level answer?
- A school district wants remote library branches to reach HQ over Internet circuits with dynamic tunnels and minimal per-spoke static crypto endpoints. Which single-hub design matches that ENARSI use case?
- A fire-district IT team configures the HQ DMVPN hub so one tunnel interface can terminate tunnels from many remote stations. Which tunnel mode property enables that multipoint behavior?
- A police records bureau is building single-hub DMVPN. What role do GRE/mGRE encapsulations play before IPsec protection is applied?
- An assessor’s office brings a new spoke online in a single-hub DMVPN. What does NHRP registration accomplish for that spoke?
- A building-permits office wants two branch spokes to exchange traffic directly after the first packets hairpin via HQ. Which NHRP behavior enables those dynamic spoke-to-spoke NBMA mappings?
- A public-health department runs DMVPN over Internet underlays carrying citizen health records between clinics and HQ. Why is IPsec commonly bound to the DMVPN tunnels?
- A wastewater treatment plant adds new fire-station spokes to an existing single-hub DMVPN without provisioning a unique static tunnel destination on the hub for each station. What DMVPN capability enables that?
- A municipal 911 PSAP checks whether inter-branch video is using a direct spoke-to-spoke DMVPN shortcut instead of hairpinning through HQ. Which verification cue best indicates the shortcut formed?
- A county elections office finds that DMVPN spokes can reach the hub but never form direct spoke-to-spoke paths, so inter-branch traffic keeps hairpinning. Which cause fits that symptom at ENARSI depth?
- A civic data center designs single-hub DMVPN for township offices that use DHCP public addresses from local ISPs. How should NBMA addressing typically be planned for the hub versus the spokes?
- A regional planning commission needs township prefixes to converge over a single-hub DMVPN overlay after tunnels are up. Which approach fits ENARSI config/verify practice?
- A municipal fiber consortium sees a spoke that cannot pass overlay traffic. Before blaming NHRP mappings, what protected-DMVPN prerequisite should the engineer confirm?
- A city traffic-operations center wants IPsec to encrypt traffic on its DMVPN mGRE interfaces without a separate crypto map per spoke peer. Which binding approach is the usual DMVPN pattern?
- A county jail facilities team verifies spoke NHRP configuration for single-hub DMVPN. What must spokes typically point to as their Next Hop Server?
- A public-library branch renumbers its ISP public address. Afterward, DMVPN peers still show an old NBMA mapping for that spoke and tunnels misbehave. What NHRP troubleshooting focus fits?
- A municipal hospital campus WAN sees broken large transfers across DMVPN after enabling GRE with IPsec. What adjustment best addresses encapsulation overhead on those civic VPN links?
- A city IT team documents risks of a single-hub DMVPN connecting remote libraries. What scaling limitation should they acknowledge at ENARSI single-hub depth?
- A county network team finds a new township spoke never appears in DMVPN mappings. Which misconfiguration most directly prevents NHRP registration with the hub?
- A township public works engineer secures DMVPN with IPsec but tunnels stay down. What selector requirement must the crypto profile allow between peers?
- A municipal water utility must prove dynamic DMVPN tunnels are healthy before a council network demo. Which verification approach best confirms overlay state?
- A transit authority designs DMVPN so bus-yard routers keep public Internet reachability separate from tunnel overlay addressing. What separation must operators maintain?
- A port authority wants marine-ops spokes to build direct tunnels after initial hub contact. Which NHRP behaviors enable that spoke-to-spoke shortcut path?
- An airport authority exposes a DMVPN hub to the Internet and wants to reduce fake mapping risk. What is the purpose of NHRP authentication in that design?
- A housing authority wants remote site routers to prefer simple summary or default routing via the DMVPN hub instead of carrying every remote prefix. What hub-side routing practice supports that scalability goal?
- A library consortium sees intermittent IPsec failures to one DMVPN spoke after the spoke ISP introduced asymmetric return paths. What underlay issue most likely undermines the protected tunnel?
- A county courts network team adds a new remote courthouse spoke to an existing single-hub DMVPN. What operational benefit does dynamic neighbor registration provide versus static per-spoke GRE tunnels on the hub?
- A city clerk's office streams site-to-site video between two DMVPN spokes and wants to avoid hairpinning through HQ. What benefit does a direct spoke-to-spoke IPsec path provide?
- A parks department contrasts classic hub-and-spoke forwarding with NHRP shortcut behavior on their single-hub DMVPN. What understanding matches ENARSI single-hub depth without escalating to dual-hub Phase-3 lab designs?
- A sanitation department standardizes remote-yard connectivity on DMVPN. Which approach stays inside common single-hub config-and-verify patterns expected for ENARSI?
- An emergency-management office scopes WAN VPN training to ENARSI Domain 2.3. Which boundary correctly keeps focus on DMVPN rather than FlexVPN concentration?
Infrastructure Security · 35 questions
- A municipal 911 PSAP wants per-operator command authorization on border routers so junior techs cannot change routing without approval. Which AAA choice best supports that admin control?
- A county elections office needs centralized login authentication and accounting on routers but not granular per-command authorization. When is RADIUS a reasonable fit versus TACACS+ for that device-admin need?
- A civic data center loses reachability to its TACACS+ servers during a WAN outage. How should AAA method lists preserve admin access on the routers?
- A regional planning commission sees routers reject AAA login even though usernames exist on the TACACS+ server. Which cause commonly produces that failure pattern?
- A municipal fiber consortium configures IOS AAA for VTY access and must keep authentication, authorization, and accounting roles clear. What distinction should engineers apply?
- A city traffic-operations center enables TACACS+ command authorization and then sees privileged commands fail for valid network engineers. What dependency should they verify on the AAA server?
- A county jail facilities team wants an audit trail of configuration changes on border routers. Which AAA capability best records those administrative actions?
- A public-library branch network uses centralized TACACS+ for VTY access but must survive total AAA-server loss at the console. What local safeguard should remain?
- A municipal hospital campus WAN places RADIUS in a management VRF, but routers never reach the AAA host. Which troubleshooting focus is most appropriate first?
- A city IT team lists only one TACACS+ server for router administration and sees intermittent login failures when that host flaps. What change improves AAA resilience?
- A county network team configures IOS AAA on the same civic border router for both 802.1X-style network access ideas and VTY device administration. For ENARSI infrastructure-security troubleshooting, which AAA context is the primary focus when operators cannot enter privileged EXEC on the router?
- A township public works department migrates civic WAN routers to named AAA method lists, yet the lists appear ignored until a prerequisite is fixed. What must be enabled for modern AAA method lists to take effect?
- A municipal water utility wants console break-glass logins to use the local database while remote VTY admins authenticate to TACACS+. How should AAA method lists be applied to achieve that split?
- A transit authority reviews AAA debugs after failed civic-router logins. How should an explicit reject from the AAA server be treated differently from a timeout with no reply?
- A port authority sees repeated admin login failures to edge routers that use RADIUS in a management VRF. What should operators verify before concluding that user passwords are wrong?
- An airport authority wants an IPv4 ACL that permits management access only from a /24 jump-host subnet and denies other sources, matching solely on source address. Which ACL type fits that requirement?
- A housing authority needs an IPv4 ACL that allows HTTPS to a civic portal VIP from guest networks while denying other TCP to that VIP. Which ACL capability is required?
- A library consortium wants contractor laptops to reach lab routers only during posted business hours. Which IPv4 ACL feature directly supports that schedule?
- A county courts Internet edge should drop packets arriving from the outside that claim source addresses from the court's internal civic address space. What is an appropriate ACL anti-spoof approach?
- A city clerk's office ACL that should block inbound Internet probes never matches interesting traffic. Engineers confirm the entries are correct. What common application mistake explains the miss?
- A parks department permits outbound HTTPS to a permits portal but forgets return or established considerations and wonders why related traffic dies. What ACL behavior should they remember?
- A sanitation department dual-stacks civic border routers and needs to restrict IPv6 management-plane access similarly to IPv4 ACLs. Which feature family addresses that on IOS?
- An emergency-management office applies an IPv6 traffic filter on camera subnets after a dual-stack cutover, but some ICMPv6 neighbor-discovery traffic breaks unexpectedly. What troubleshooting awareness is most appropriate?
- A school district WAN edge should drop inbound packets whose source addresses are not reachable via the receiving interface's FIB path under symmetric routing. Which uRPF mode enforces that check?
- A fire-district IT team dual-homes civic routers to two ISPs with asymmetric return paths and finds strict uRPF dropping legitimate traffic. Which adjustment matches ENARSI uRPF guidance for that topology?
- A police records bureau enables uRPF on an edge and wants visibility into dropped spoof attempts for forensic review. What operational approach supports that visibility?
- An assessor's office adds a new deny ACE to a civic edge ACL and needs proof the entry is matching production traffic. Which verification cue is most direct?
- A building-permits office drafts an extended ACL to allow SSH from a jump host to a router address while denying other TCP. Which match criteria set correctly expresses that intent without relying on object-group shortcuts in the stem?
- A public-health department must block SMB from the Internet to civic file servers while still allowing administrative SSH from approved jump hosts. Which extended ACL design approach is appropriate?
- A wastewater treatment plant renumbers interfaces after a dual-stack redesign and finds an IPv6 traffic filter no longer affects camera traffic. What should engineers verify first about the filter?
- A municipal 911 PSAP wants both header-based policy and reverse-path checks on the Internet edge. How do ACLs and uRPF complement each other?
- A county elections office uses a time-based ACL for contractors but still sees after-hours access because a broader entry matches first. What ACL principle explains the failure?
- A civic data center prefers readable ACL names such as BLOCK-GUEST-SMB on WAN routers instead of only numeric lists. What is the main operational trade-off highlighted by named extended ACLs?
- A regional planning commission hardens SNMP access on civic routers with SNMPv3 and wants a companion control that limits which management stations can send SNMP to the box. How can an IPv4 ACL help?
- A municipal fiber consortium reviews router security features for an ENARSI study guide aligned to official domain 3.2. Which feature set stays inside that objective rather than substituting zone-based firewall as the primary answer?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.