Cisco CCNP Enterprise 350-401 ENCOR Direct eBGP and Policy-Based Routing Practice Test

 

Topic 09 covers direct ebgp and policy-based routing for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

R1 is in AS 65010 and R2 is in AS 65020 on 192.0.2.0/30. R1 has `neighbor 192.0.2.2 remote-as 65020`; R2 has `neighbor 192.0.2.1 remote-as 65030`. IP connectivity works, but the BGP session never establishes. What is the most direct correction?

65010. Change R2 remote-as to 65010.
65011. Change R1 remote-as to 65010.
65012. Add a static route to 192.0.2.0/30.
65013. Increase the BGP keepalive timer.
65014. Change R2 local AS to 65030.

Correct Answer: A

 

Correct Answer

Answer A is correct because R2 must identify the AS of its configured neighbor, which is R1 AS 65010.

Incorrect Answers

Answer B is incorrect because that would tell R1 the neighbor is in its own AS, contrary to the stated R2 AS 65020.

Answer C is incorrect because the link is already directly connected and IP connectivity is confirmed.

Answer D is incorrect because timer tuning does not resolve a remote-AS mismatch during session establishment.

Answer E is incorrect because the stated design places R2 in 65020; changing the local AS would alter the intended topology rather than fix the neighbor expectation.

 

Question 2

R1 and R2 are directly connected on 198.51.100.8/30. R1 is 198.51.100.9 and R2 is 198.51.100.10. R1 is configured with `neighbor 198.51.100.11 remote-as 65100`, while R2 correctly points to 198.51.100.9. Which defect prevents the intended direct peering?

1. Direct eBGP requires loopback addresses only.
2. Both routers need the broadcast address as the neighbor.
3. R1 references the wrong neighbor address.
4. The /30 prefix is too small for eBGP.
5. R2 must use the subnet address 198.51.100.8 as its neighbor.

Correct Answer: C

 

Correct Answer

Answer C is correct because 198.51.100.11 is not the stated R2 interface address; the peer should be 198.51.100.10.

Incorrect Answers

Answer A is incorrect because direct interface addresses can be used for eBGP peering.

Answer B is incorrect because the broadcast address is not a peer endpoint.

Answer D is incorrect because a /30 provides two usable addresses and is common for point-to-point peering.

Answer E is incorrect because BGP neighbors are configured to peer addresses, not the subnet identifier.

 

Question 3

A ping from R1 to the directly connected R2 peer address succeeds, but `show bgp ipv4 unicast summary` shows the neighbor in Active and TCP/179 connection attempts reset. Which conclusion is best?

1. BGP cannot use a directly connected interface if ICMP is enabled.
2. The only remaining cause is an AS-path loop.
3. IP reachability works, but BGP session establishment still fails.
4. The route to every advertised prefix is therefore valid.
5. The BGP session must already be Established because ping succeeds.

Correct Answer: C

 

Correct Answer

Answer C is correct because ICMP success proves some IP connectivity, not successful TCP/179 establishment or correct BGP parameters.

Incorrect Answers

Answer A is incorrect because ICMP operation does not prohibit direct eBGP. It does not satisfy the stem’s governing point: Separate IP reachability from successful BGP TCP session establishment.

Answer B is incorrect because many transport and peer configuration causes remain possible before the session is established.

Answer D is incorrect because peer-address reachability does not establish route advertisement or best-path eligibility.

Answer E is incorrect because ICMP reachability and a BGP TCP session are separate conditions.

 

Question 4

The two directly connected eBGP routers have matching AS numbers and neighbor addresses. `show running-config | section router bgp` shows the neighbor statement, but under `address-family ipv4` the neighbor is explicitly `shutdown`. What should be changed first?

1. Configure PBR on the peering interface.
2. Change the link to a trunk.
3. Enable route reflection.
4. Remove the IPv4 neighbor shutdown.
5. Raise local preference to 200.

Correct Answer: D

 

Correct Answer

Answer D is correct because an administratively shut neighbor cannot establish or exchange IPv4 routes in that address family.

Incorrect Answers

Answer A is incorrect because PBR is unrelated to activating a BGP neighbor.

Answer B is incorrect because BGP requires IP connectivity, not a Layer 2 trunk by definition.

Answer C is incorrect because route reflection addresses iBGP scaling and does not activate a direct eBGP neighbor.

Answer E is incorrect because local preference affects best-path choice after routes are learned, not an administratively disabled neighbor.

 

Question 5

A direct eBGP peer is not exchanging routes. Which TWO observations best separate a transport/session problem from an established session with no accepted prefixes? Choose TWO.

1. A TCP connection to destination port 179 cannot be completed and the neighbor remains Active/Connect.
2. The BGP router ID is numerically high.
3. The BGP summary state shows `Established` with an uptime value.
4. The local routing table contains a default route.
5. The local preference is 100.
6. The peer interface uses a /30 mask.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because this points to transport/session establishment rather than route policy after establishment.

Answer C is correct because Established indicates the TCP/BGP session completed and shifts the investigation toward policy/advertisement if prefixes are missing.

Incorrect Answers

Answer B is incorrect because router-ID magnitude is not the primary distinction between transport failure and an established-but-empty session.

Answer D is incorrect because a default route does not by itself distinguish BGP session state from route-policy behavior.

Answer E is incorrect because default local preference does not tell whether the session has established.

Answer F is incorrect because that addressing choice is compatible with direct peering and does not identify the failure class.

 

Question 6

R1 has `network 10.50.0.0 mask 255.255.0.0` under BGP, but its routing table contains only 10.50.1.0/24 and 10.50.2.0/24. No 10.50.0.0/16 route exists. Why is the /16 not originated by that network statement?

10. The exact 10.50.0.0/16 route is missing.
11. The router must first configure PBR for 10.50.0.0/16.
12. A network statement can advertise only directly connected routes.
13. The two /24 routes automatically prevent any /16 advertisement.
14. BGP cannot advertise private address space.

Correct Answer: A

 

Correct Answer

Answer A is correct because the BGP network statement requires a matching route for the specified prefix and mask.

Incorrect Answers

Answer B is incorrect because PBR is not a prerequisite for BGP network origination.

Answer C is incorrect because the matching route can come from other valid local routing sources; it need not be directly connected.

Answer D is incorrect because more-specific routes do not inherently block a valid exact /16 if that /16 also exists.

Answer E is incorrect because BGP can carry private prefixes inside an enterprise; policy determines whether they should be propagated externally.

 

Question 7

R1 is Established with an eBGP peer. `show bgp ipv4 unicast 203.0.113.0/24` shows a valid locally originated route, and outbound policy permits it. The peer still does not show the prefix. Which verification most directly confirms whether R1 is actually advertising it to that neighbor?

203. Check `show ip arp` for every host in 203.0.113.0/24.
204. Inspect the neighbor advertised-routes/output-policy view for that peer.
205. Run `show spanning-tree` for the routed peer link.
206. Check the peer interface duplex setting only.
207. Change the prefix to /25 and see whether it appears.

Correct Answer: B

 

Correct Answer

Answer B is correct because neighbor-specific advertised-route evidence directly answers whether the prefix is being sent after policy.

Incorrect Answers

Answer A is incorrect because host ARP entries do not prove a BGP UPDATE was advertised.

Answer C is incorrect because spanning-tree information does not directly show BGP advertisements.

Answer D is incorrect because a healthy Established session makes route advertisement policy/state more direct evidence than generic link settings.

Answer E is incorrect because changing the route alters the test and does not verify the current advertisement.

 

Question 8

The BGP session is Established. R1 receives no IPv4 prefixes from R2. On R2, the neighbor exists globally, but under `address-family ipv4 unicast` the neighbor is not activated on a platform/configuration that requires explicit AF activation. Which fix addresses the stated condition?

1. Increase R2 weight for the neighbor.
2. Change the BGP router ID to match R1.
3. Activate the neighbor under IPv4 unicast.
4. Convert the session to iBGP.
5. Configure an HSRP virtual address on the peer link.

Correct Answer: C

 

Correct Answer

Answer C is correct because route exchange for that AF requires the neighbor to be active in the address family.

Incorrect Answers

Answer A is incorrect because weight affects local best-path selection, not whether the AF sends routes.

Answer B is incorrect because router IDs should be unique; matching them is not the remedy.

Answer D is incorrect because the intended peers are in different ASes and the missing AF activation is already identified.

Answer E is incorrect because HSRP is unrelated to BGP AF activation. It does not satisfy the stem’s governing point: A configured neighbor can still fail to exchange an address family if that AF is not activated as required.

 

Question 9

R1 receives 198.18.10.0/24 from an eBGP neighbor and displays it in the BGP table, but the path is not installed in the IP routing table because its BGP next hop is unreachable. Which statement is correct?

1. The AS path must be empty for an eBGP route to enter the RIB.
2. Every received BGP prefix must be installed in the routing table.
3. The route is rejected because 198.18.0.0/15 is reserved for benchmarking.
4. The prefix can be installed only after PBR is applied.
5. The path is received but invalid because its next hop is unreachable.

Correct Answer: E

 

Correct Answer

Answer E is correct because BGP can retain a received path that is not eligible for best-path installation when its next hop cannot be resolved.

Incorrect Answers

Answer A is incorrect because eBGP-learned routes normally contain AS-path information. It does not satisfy the stem’s governing point: A received BGP path must be valid and have a reachable next hop before it can become usable in the RIB.

Answer B is incorrect because BGP path validity and best-path selection determine installation.

Answer C is incorrect because address purpose may matter operationally, but the stem explicitly identifies next-hop reachability as the installation issue.

Answer D is incorrect because PBR is not a prerequisite for normal BGP route installation.

 

Question 10

R1 learns a BGP path whose next hop is 192.0.2.6. The routing table has no route covering 192.0.2.6, although the BGP peer itself is reachable at 198.51.100.2. What should the engineer address first if that path is expected to become usable?

1. Disable CEF so BGP can bypass the routing table.
2. Apply an inbound PBR policy.
3. Lower the MED on the path.
4. Make BGP next hop 192.0.2.6 reachable.
5. Change the peer AS number to the local AS.

Correct Answer: D

 

Correct Answer

Answer D is correct because BGP path eligibility depends on recursive reachability of the path next hop, which can differ from the peer address.

Incorrect Answers

Answer A is incorrect because BGP next-hop resolution requires routing information; disabling forwarding optimization is not the fix.

Answer B is incorrect because PBR on data packets does not create control-plane reachability to a BGP next hop.

Answer C is incorrect because MED is not evaluated usefully if the path is invalid due to an unreachable next hop.

Answer E is incorrect because that would change the session type and does not solve the explicitly unreachable route next hop.

 

Question 11

A Cisco router has two otherwise equal valid BGP paths to the same prefix. Path A has weight 200 and Path B has weight 50. Which path is selected on this router?

1. Path B, because lower weight is preferred.
2. The path with the lower neighbor IP regardless of weight.
3. The path with the longer AS path.
4. Both, because weight is ignored for eBGP.
5. Path A; higher Cisco weight is preferred.

Correct Answer: E

 

Correct Answer

Answer E is correct because weight is evaluated early and higher is preferred locally on the router.

Incorrect Answers

Answer A is incorrect because Cisco BGP prefers the higher weight value. It does not satisfy the stem’s governing point: When other validity conditions are met, higher Cisco weight is preferred locally.

Answer B is incorrect because neighbor address is a much later tie-breaker after weight.

Answer C is incorrect because AS-path length is considered after earlier attributes tie and shorter is normally preferred.

Answer D is incorrect because weight can influence local best-path selection for BGP paths.

 

Question 12

Two valid paths have equal weight and are otherwise eligible. Path A has LOCAL_PREF 150; Path B has LOCAL_PREF 100. Which path is preferred?

1. The path with more communities automatically wins.
2. Path B, because lower local preference is preferred.
3. Both are tied until MED is compared first.
4. Path B because it came from the neighbor with the lower IP.
5. Path A, because higher local preference is preferred after weight ties.

Correct Answer: E

 

Correct Answer

Answer E is correct because local preference expresses the AS-wide preference for outbound path selection and higher wins.

Incorrect Answers

Answer A is incorrect because community count is not a generic best-path criterion.

Answer B is incorrect because BGP prefers the higher local preference. It does not satisfy the stem’s governing point: With equal weight, higher local preference is preferred before later attributes.

Answer C is incorrect because local preference is considered before MED. It does not satisfy the stem’s governing point: With equal weight, higher local preference is preferred before later attributes.

Answer D is incorrect because neighbor IP is a later tie-breaker. It does not satisfy the stem’s governing point: With equal weight, higher local preference is preferred before later attributes.

 

Question 13

Two valid eBGP paths tie on weight, local preference, and local-origination status. Path A has AS path `65100 65200`; Path B has `65300 65400 65500`. No feature changes AS-path handling. Which path is preferred at the AS-path step?

1. Both because only the first AS is compared.
2. Path B because more AS numbers indicate more redundancy.
3. Path A only if its MED is larger.
4. Path B because the numerically largest AS wins.
5. Path A; it has the shorter AS path.

Correct Answer: E

 

Correct Answer

Answer E is correct because after earlier attributes tie, the shorter AS-path length is normally preferred.

Incorrect Answers

Answer A is incorrect because the path length considers the sequence of AS hops under the normal rule.

Answer B is incorrect because BGP best-path selection normally prefers the shorter AS path, not the longer one.

Answer C is incorrect because MED is evaluated later under applicable comparison rules, after AS-path length.

Answer D is incorrect because the numeric magnitude of an AS number is not the AS-path preference rule.

 

Question 14

Two paths tie through AS-path length. Path A has origin IGP (`i`), while Path B has origin incomplete (`?`). Which path is preferred at the origin step?

1. Both; origin is informational only.
2. The path from the higher router ID wins before origin.
3. Path B, because incomplete is treated as most specific.
4. Path A, because IGP origin is preferred over incomplete.
5. Path B because `?` sorts before `i`.

Correct Answer: D

 

Correct Answer

Answer D is correct because the normal origin preference is IGP before EGP before incomplete.

Incorrect Answers

Answer A is incorrect because origin can participate in best-path selection after earlier attributes tie.

Answer B is incorrect because router ID is a later tie-breaker. It does not satisfy the stem’s governing point: BGP origin type can break a tie after earlier attributes, with IGP preferred over incomplete.

Answer C is incorrect because origin code is not prefix specificity and incomplete is less preferred.

Answer E is incorrect because lexical character ordering is not how BGP origin is compared.

 

Question 15

Two candidate routes to the same prefix tie through origin. Both were received from different peers in the same neighboring AS 65200. Path A MED is 50; Path B MED is 120. Default comparison behavior is assumed. Which path is preferred at the MED step?

1. Path B because higher MED indicates a better exit.
2. Both must be multipathed because the neighboring AS is the same.
3. Path B because MED is compared before local preference.
4. MED is always ignored for eBGP paths.
5. Path A; lower MED wins under the stated comparison conditions.

Correct Answer: E

 

Correct Answer

Answer E is correct because under the stated same-neighboring-AS condition, lower MED is the preferred value.

Incorrect Answers

Answer A is incorrect because MED is normally lower-is-better. It does not satisfy the stem’s governing point: Compare MED only when the stated comparison conditions apply; lower MED is preferred.

Answer B is incorrect because equal-cost multipath requires additional configuration and matching conditions; differing MED values prevent a simple tie here.

Answer C is incorrect because local preference is evaluated earlier. It does not satisfy the stem’s governing point: Compare MED only when the stated comparison conditions apply; lower MED is preferred.

Answer D is incorrect because MED can influence BGP best path, subject to comparison rules.

 

Question 16

R1 has two BGP paths to 203.0.113.0/24. Path A has higher weight, but its next hop is unreachable. Path B has lower weight and a reachable next hop. Which path can participate in best-path selection?

1. Both must be installed regardless of validity.
2. Path A, because weight overrides next-hop reachability.
3. The router must choose the path with the higher neighbor IP.
4. Path B; Path A is invalid because its next hop is unreachable.
5. Neither, because two candidate paths are not allowed.

Correct Answer: D

 

Correct Answer

Answer D is correct because path validity is checked before comparing normal preference attributes.

Incorrect Answers

Answer A is incorrect because invalid paths are not installed as usable best paths.

Answer B is incorrect because weight is compared among valid paths; it does not make an unreachable next hop valid.

Answer C is incorrect because neighbor IP is a late tie-breaker among valid paths.

Answer E is incorrect because BGP is designed to compare multiple candidate paths.

 

Question 17

A Cisco router compares two otherwise equal BGP paths. Path A is locally originated by a `network` statement; Path B is learned from an eBGP neighbor. Weight and local preference tie. Which path is preferred at the local-origination step?

1. The route with the lower interface cost always wins first.
2. Path B if its AS path has one hop.
3. Both because network statements do not affect best path.
4. Path B, because eBGP is always preferred before local origination.
5. Path A; it is locally originated.

Correct Answer: E

 

Correct Answer

Answer E is correct because local origination is considered before AS-path length when earlier attributes tie.

Incorrect Answers

Answer A is incorrect because IGP cost to BGP next hop is evaluated later in the decision process.

Answer B is incorrect because the local-origination comparison occurs before AS-path length under the stated tie.

Answer C is incorrect because local origination is a recognized preference step. It does not satisfy the stem’s governing point: Local origination is a best-path preference considered before several later attributes.

Answer D is incorrect because the eBGP-over-iBGP criterion is later; local origination is considered earlier.

 

Question 18

Two eBGP paths remain tied through the preceding criteria in the stated platform algorithm. They were received from peers with router IDs 10.0.0.9 and 10.0.0.5, and no route-reflector attributes apply. Which peer wins at the router-ID tie-break?

10. The path from router ID 10.0.0.5.
11. The path with the higher AS number, regardless of router ID.
12. The path from router ID 10.0.0.9.
13. Both because router ID affects only OSPF.
14. The path received last.

Correct Answer: A

 

Correct Answer

Answer A is correct because when the decision reaches the router-ID tie-break, the lower router ID is preferred.

Incorrect Answers

Answer B is incorrect because AS numeric magnitude is not a late tie-break rule.

Answer C is incorrect because the normal tie-break favors the lower, not higher, router ID.

Answer D is incorrect because BGP also uses router ID in late tie-breaking.

Answer E is incorrect because arrival order is not the specified tie-break in this scenario.

 

Question 19

R1 has two equal BGP paths after all normal best-path criteria relevant to the pair. Only one route is installed. The engineer expected both links to forward traffic. What distinction should be checked?

1. Check BGP multipath configuration and path eligibility.
2. Whether the routes have different prefix lengths.
3. Whether both interfaces are members of the same EtherChannel.
4. Whether HSRP is preempting one peer.
5. Whether both peers have different AS numbers; different ASes always force multipath.

Correct Answer: A

 

Correct Answer

Answer A is correct because a tied best-path comparison does not automatically mean multiple paths are installed for forwarding.

Incorrect Answers

Answer B is incorrect because they are candidates for the same prefix, so prefix length does not explain single-path installation.

Answer C is incorrect because BGP ECMP does not require physical links to be bundled.

Answer D is incorrect because HSRP gateway election is unrelated to BGP multipath installation.

Answer E is incorrect because different AS numbers do not automatically enable multiple-path installation.

 

Question 20

R1 has two direct eBGP peers advertising the same prefix. The current best path is through Peer A. Peer A link fails; Peer B session remains Established and its path is valid. What should the engineer verify first after convergence?

1. That both paths keep the same weight even though Peer A is gone.
2. That PBR redirects all traffic to the failed link.
3. That the peer AS numbers are changed during failover.
4. That Peer A still appears Established despite the link failure.
5. Verify Peer B becomes the installed forwarding path.

Correct Answer: E

 

Correct Answer

Answer E is correct because the surviving valid path should become eligible, but verification should confirm control-plane and forwarding installation.

Incorrect Answers

Answer A is incorrect because the operational requirement is surviving route selection, not preserving an attribute for a withdrawn path.

Answer B is incorrect because that would oppose convergence to the surviving peer.

Answer C is incorrect because AS identity should not be dynamically changed to perform ordinary path failover.

Answer D is incorrect because a failed direct link should not be expected to retain the same established session.

 

Question 21

A router normally sends all internet traffic to ISP-A. Finance clients in 10.20.20.0/24 must instead use ISP-B for outbound traffic while all other sources follow normal routing. Which feature most directly expresses this requirement on the ingress interface?

10. A BGP network statement for 10.20.20.0/24.
11. HSRP preemption on the Finance gateway.
12. A lower OSPF cost on the Finance VLAN.
13. An EtherChannel hash change.
14. Use PBR to match Finance sources and set ISP-B.

Correct Answer: E

 

Correct Answer

Answer E is correct because PBR can choose forwarding based on source/policy criteria rather than only the destination route.

Incorrect Answers

Answer A is incorrect because advertising the source prefix does not make transit packets use a different next hop.

Answer B is incorrect because gateway redundancy does not provide source-sensitive upstream forwarding by itself.

Answer C is incorrect because OSPF cost changes destination routing and does not directly select a path based on packet source subnet.

Answer D is incorrect because link-bundle hashing does not select a distinct routed next hop based on policy.

 

Question 22

A branch has two WAN exits. Traffic from a backup server source address must use the high-bandwidth circuit, while interactive users continue using the routing table best path. What PBR design element is decisive?

1. Use VRRP priority to identify backup packets.
2. Advertise the backup server with a longer subnet mask to the WAN.
3. Match the backup server source and set the high-bandwidth next hop.
4. Change every internet destination route metric only during backups.
5. Configure NAT without a route map.

Correct Answer: C

 

Correct Answer

Answer C is correct because source-sensitive route-map matching expresses the stated policy without changing all destination routes.

Incorrect Answers

Answer A is incorrect because VRRP priority elects a gateway and does not classify transit traffic by source.

Answer B is incorrect because source prefix advertisement does not directly select an egress path for its outbound packets.

Answer D is incorrect because that affects all traffic rather than only the stated source class.

Answer E is incorrect because address translation does not by itself choose the required WAN path.

 

Question 23

An ingress interface has PBR route-map `BRANCH permit 10` matching ACL 110. ACL 110 permits source 10.30.0.0/16 to destination any. The route-map sets next-hop 192.0.2.1. A packet from 10.30.5.10 to 8.8.8.8 arrives on that interface. Which behavior is expected if the next hop is usable?

10. The route-map advertises 10.30.0.0/16 to BGP.
11. The packet matches the route-map and is policy-forwarded toward 192.0.2.1.
12. The packet changes its source address to 192.0.2.1.
13. The packet ignores PBR because its destination is outside 10.30.0.0/16.
14. The packet is dropped because `permit` in the ACL means deny in PBR.

Correct Answer: B

 

Correct Answer

Answer B is correct because the ACL match selects the packet and the set action supplies the PBR next hop.

Incorrect Answers

Answer A is incorrect because PBR route maps applied to interfaces control forwarding, not BGP advertisement by themselves.

Answer C is incorrect because set ip next-hop changes forwarding, not the packet source address.

Answer D is incorrect because the ACL matches the source 10.30.0.0/16 with destination any.

Answer E is incorrect because a permit match in the referenced ACL selects traffic for the route-map statement.

 

Question 24

A PBR route map is correctly defined but is applied with `ip policy route-map BRANCH` on Gi0/2. The target client traffic enters the router on Gi0/1 and exits Gi0/2. Why is the traffic not policy-routed?

1. The policy is attached to the wrong ingress interface.
2. PBR applies only after the packet leaves the router.
3. PBR is supported only on egress interfaces.
4. The policy must be attached to every interface in the router.
5. The route map should be configured under BGP instead.

Correct Answer: A

 

Correct Answer

Answer A is correct because the route map must be applied on the interface where the target transit packets enter.

Incorrect Answers

Answer B is incorrect because the forwarding decision must occur before egress. It does not satisfy the stem’s governing point: Apply interface PBR where the target transit traffic enters the router.

Answer C is incorrect because interface PBR is applied to arriving traffic. It does not satisfy the stem’s governing point: Apply interface PBR where the target transit traffic enters the router.

Answer D is incorrect because only the relevant ingress interface needs the policy for those transit packets.

Answer E is incorrect because this is a packet-forwarding policy, not a BGP route policy.

 

Question 25

Which TWO statements correctly distinguish PBR from BGP route advertisement? Choose TWO.

1. PBR requires every destination to be learned through BGP.
2. BGP cannot influence forwarding decisions.
3. BGP UPDATE policy controls which routes or attributes are advertised to peers, not the next hop chosen by each matching transit packet in the same way as interface PBR.
4. Changing BGP local preference rewrites the source IP address of each packet.
5. PBR can alter the next hop used by selected packets arriving on an interface.
6. PBR automatically advertises its route-map match prefixes to every BGP neighbor.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because BGP route policy and packet-by-packet PBR operate at different control/forwarding scopes.

Answer E is correct because PBR is a forwarding-policy mechanism for matched traffic.

Incorrect Answers

Answer A is incorrect because PBR can coexist with routes from many sources and does not require BGP.

Answer B is incorrect because BGP-selected routes can absolutely influence normal destination-based forwarding.

Answer D is incorrect because local preference is a route-selection attribute, not source NAT.

Answer F is incorrect because an interface PBR route map does not become a BGP advertisement policy automatically.

 

Question 26

An interface PBR route map has one permit sequence matching source 10.10.0.0/16. A packet from 10.20.5.5 does not match any route-map sequence. What normally happens to that unmatched transit packet?

1. It is always dropped by an implicit deny.
2. It is advertised to the BGP peer.
3. It is converted into locally generated traffic.
4. It follows normal destination-based routing.
5. It is sent to the first next hop configured anywhere in the route map.

Correct Answer: D

 

Correct Answer

Answer D is correct because traffic not policy-routed by the route map proceeds through the normal routing decision.

Incorrect Answers

Answer A is incorrect because the route-map nonmatch in interface PBR does not mean the packet is automatically discarded; it falls back to normal routing.

Answer B is incorrect because packet forwarding and route advertisement are separate. It does not satisfy the stem’s governing point: Unmatched interface-PBR traffic normally continues with the ordinary routing table.

Answer C is incorrect because nonmatching transit traffic remains transit traffic. It does not satisfy the stem’s governing point: Unmatched interface-PBR traffic normally continues with the ordinary routing table.

Answer E is incorrect because set actions apply only to matching permit policy entries.

 

Question 27

A route map uses `set ip next-hop 192.0.2.9`. The next hop is currently unusable and there is a valid normal route to the destination. Which statement is safest for an exam scenario?

192. PBR guarantees delivery to 192.0.2.9 even if no forwarding path to that next hop exists.
193. An unusable PBR next hop does not create reachability.
194. BGP changes the remote AS to make the PBR next hop reachable.
195. The router automatically turns 192.0.2.9 into a connected address.
196. The router must withdraw all normal destination routes.

Correct Answer: B

 

Correct Answer

Answer B is correct because PBR next-hop actions still depend on usable forwarding resolution and exact set-command semantics; the route map does not manufacture a working adjacency.

Incorrect Answers

Answer A is incorrect because a configured address does not make an unusable next hop forwardable.

Answer C is incorrect because BGP AS configuration is unrelated to automatic PBR next-hop repair.

Answer D is incorrect because PBR does not create interface addressing. It does not satisfy the stem’s governing point: A PBR set action does not create underlying next-hop reachability; interpret fallback according to the actual command/platform behavior.

Answer E is incorrect because normal routing information remains present even when PBR is configured.

 

Question 28

A router has `ip policy route-map BRANCH` on an ingress LAN interface. A locally generated ping sourced by the router itself does not follow the policy even though its source address matches the route-map ACL. Why?

1. The ping needs an HSRP group number.
2. Router-originated traffic needs local PBR, not only interface PBR.
3. Local packets always use BGP regardless of the routing table.
4. The ACL must match only destination addresses for PBR.
5. The router cannot policy-route ICMP under any condition.

Correct Answer: B

 

Correct Answer

Answer B is correct because local-origin packets do not enter through the interface policy path and use `ip local policy route-map` when local PBR is required.

Incorrect Answers

Answer A is incorrect because HSRP is unrelated to local PBR. It does not satisfy the stem’s governing point: Interface PBR and local PBR apply to different packet origins.

Answer C is incorrect because locally generated packets use the routing/forwarding system and are not inherently forced to BGP.

Answer D is incorrect because PBR ACLs can classify source and destination information.

Answer E is incorrect because PBR can influence IP traffic; the issue is local generation versus interface ingress.

 

Question 29

PBR sends outbound traffic from an application subnet over ISP-B, but return traffic from the internet continues entering through ISP-A because external routing was not changed. A stateful firewall on each edge rejects many sessions. What design issue does this illustrate?

1. PBR automatically changes inbound BGP advertisements to preserve symmetry.
2. The only possible cause is duplicate IP addressing.
3. A stateful firewall never cares about path symmetry.
4. PBR can create asymmetric paths through separate stateful devices.
5. The fix is to disable all routing protocols.

Correct Answer: D

 

Correct Answer

Answer D is correct because the outbound policy does not automatically control how remote networks return traffic.

Incorrect Answers

Answer A is incorrect because interface PBR does not rewrite external BGP policy by itself.

Answer B is incorrect because the stem directly describes asymmetric edge selection. It does not satisfy the stem’s governing point: Evaluate reverse-path and stateful-flow consequences when PBR deliberately overrides normal outbound routing.

Answer C is incorrect because stateful inspection can be affected when opposite directions traverse different state tables.

Answer E is incorrect because removing routing does not solve the policy/return-path design problem.

 

Question 30

A branch uses PBR to send selected traffic to WAN Router B. Router B has no route toward the ultimate destination network. Which statement is correct?

1. The packet succeeds because the branch selected a next hop.
2. PBR cannot create Router B’s missing downstream route.
3. BGP is disabled whenever PBR is present.
4. The route map copies the branch routing table into Router B.
5. PBR automatically tunnels the packet to the final destination.

Correct Answer: B

 

Correct Answer

Answer B is correct because PBR selects a next hop for matched packets but does not install end-to-end routes on other routers.

Incorrect Answers

Answer A is incorrect because a next-hop decision is only one stage; the downstream router must continue forwarding.

Answer C is incorrect because PBR and routing protocols can operate together. It does not satisfy the stem’s governing point: Policy routing chooses a forwarding next hop but does not replace downstream routing reachability.

Answer D is incorrect because PBR does not distribute routes. It does not satisfy the stem’s governing point: Policy routing chooses a forwarding next hop but does not replace downstream routing reachability.

Answer E is incorrect because ordinary PBR is not an overlay tunnel mechanism.