Cisco CCNP Enterprise 350-401 ENCOR Time Services NAT and Gateway Redundancy Practice Test

 

Topic 10 covers time services, nat and gateway redundancy for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

A router has `ntp server 10.10.10.10` and `ntp peer 10.10.10.20`. Which interpretation is correct?

1. Both commands configure PTP rather than NTP.
2. 10.10.10.10 is a server association; 10.10.10.20 is a peer association.
3. The peer command disables synchronization with 10.10.10.20.
4. The server command makes this router authoritative for 10.10.10.10.
5. Both addresses are configured only as passive servers.

Correct Answer: B

 

Correct Answer

Answer B is correct because the server and peer commands create different association roles as explicitly shown by the configuration.

Incorrect Answers

Answer A is incorrect because these are NTP configuration commands. It does not satisfy the stem’s governing point: Read NTP server and peer association roles from the supplied configuration.

Answer C is incorrect because peer mode can exchange synchronization with another system; it is not a disable operation.

Answer D is incorrect because the local router is selecting that remote system as a server association.

Answer E is incorrect because the peer command creates a peer association rather than the same role as ntp server.

 

Question 2

`show ntp associations` marks one configured source with `*` and reports the local clock as synchronized. Another source is reachable but not selected. Which conclusion is best?

1. The unstarred source must be down.
2. The router is unsynchronized because more than one source exists.
3. Every reachable NTP source must be marked `*`.
4. The starred association is the current synchronization source.
5. The star means the source is configured as an NTP client of this router.

Correct Answer: D

 

Correct Answer

Answer D is correct because NTP selects a system peer/source while retaining other associations as candidates.

Incorrect Answers

Answer A is incorrect because an association can be reachable and still not be selected.

Answer B is incorrect because multiple associations are normal; synchronization state depends on the selected source and quality.

Answer C is incorrect because the star identifies the selected synchronization association, not every reachable peer.

Answer E is incorrect because the marker indicates selection state rather than reversing the configured role.

 

Question 3

Two devices report NTP stratum 2 and stratum 4 respectively. An engineer claims the stratum-2 device is guaranteed to have smaller absolute clock error at this moment. What is the best correction?

1. Stratum applies only to PTP, not NTP.
2. Stratum is the number of milliseconds of error.
3. Lower stratum means fewer hierarchy steps, not guaranteed absolute accuracy.
4. Stratum 2 cannot synchronize to any upstream source.
5. Higher stratum always means a more accurate oscillator.

Correct Answer: C

 

Correct Answer

Answer C is correct because stratum is a hierarchy metric and does not by itself quantify instantaneous absolute error under all network/clock conditions.

Incorrect Answers

Answer A is incorrect because NTP uses stratum as part of its time hierarchy.

Answer B is incorrect because stratum is not a direct millisecond error value.

Answer D is incorrect because stratum values are derived through synchronization relationships and do not prohibit upstream association in that way.

Answer E is incorrect because stratum generally represents distance from reference and higher is not inherently more accurate.

 

Question 4

An NTP server at 192.0.2.10 permits requests only from 198.51.100.5. The router can reach the server, but its NTP packets leave with source 203.0.113.9 because no source interface is configured. Which change most directly aligns the packets with the server policy?

198. Configure NTP to source from the interface/address 198.51.100.5, assuming that path is valid.
199. Change the server to an NTP peer on the router without addressing source selection.
200. Increase the NTP stratum on the router.
201. Configure HSRP on the NTP server.
202. Enable PAT for all NTP packets regardless of policy.

Correct Answer: A

 

Correct Answer

Answer A is correct because the server ACL is keyed to that source, so using the intended source interface addresses the stated mismatch.

Incorrect Answers

Answer B is incorrect because association role does not inherently make packets use the permitted source address.

Answer C is incorrect because stratum does not change the packet source address.

Answer D is incorrect because gateway redundancy does not fix the source-address policy mismatch.

Answer E is incorrect because unnecessary translation changes the design rather than using the intended source interface.

 

Question 5

Two routers are configured for authenticated NTP. R1 trusts key 7 with one secret; R2 uses key 7 with a different secret. IP reachability is good, but authenticated synchronization fails. What should be corrected?

1. Use a different native VLAN on each side.
2. Make the NTP key secret/trust settings consistent.
3. Disable IP routing between the devices.
4. Configure both devices with the same router ID.
5. Change the NTP server to stratum 16.

Correct Answer: B

 

Correct Answer

Answer B is correct because matching key identifiers alone are insufficient if the authentication secrets do not match.

Incorrect Answers

Answer A is incorrect because Layer 2 native VLAN mismatch is unrelated to the explicit NTP key mismatch.

Answer C is incorrect because that would remove required reachability. It does not satisfy the stem’s governing point: Authenticated NTP requires compatible key configuration, not merely reachability.

Answer D is incorrect because router ID is unrelated to NTP authentication. It does not satisfy the stem’s governing point: Authenticated NTP requires compatible key configuration, not merely reachability.

Answer E is incorrect because stratum 16 represents unsynchronized state and would not repair authentication.

 

Question 6

A PTP network has a highly accurate GPS-referenced clock selected as the primary time source for the domain. Which PTP role does that device serve?

1. Transparent clock.
2. Grandmaster clock.
3. IGMP querier.
4. NTP stratum server by definition.
5. Boundary clock only.

Correct Answer: B

 

Correct Answer

Answer B is correct because the grandmaster is the primary source of time in a PTP domain.

Incorrect Answers

Answer A is incorrect because a transparent clock accounts for forwarding residence delay rather than serving as the domain time source.

Answer C is incorrect because IGMP is a multicast membership function, not the PTP time-source role.

Answer D is incorrect because PTP grandmaster role is independent of whether NTP is also configured.

Answer E is incorrect because a boundary clock participates between upstream and downstream PTP segments; the stated role is the domain primary source.

 

Question 7

A switch synchronizes one PTP port to the selected upstream master, then acts as a master toward downstream PTP devices on other ports. It participates in best-master selection. Which clock type is this?

1. Transparent clock.
2. Boundary clock.
3. Ordinary clock with one port.
4. NTP peer.
5. Rendezvous point.

Correct Answer: B

 

Correct Answer

Answer B is correct because a boundary clock terminates/processes PTP on multiple ports, synchronizes upstream, and serves downstream ports.

Incorrect Answers

Answer A is incorrect because a transparent clock primarily corrects for residence/link delay without acting as the described upstream-client/downstream-master boundary.

Answer C is incorrect because the device has multiple PTP-facing ports and relays time as a boundary function.

Answer D is incorrect because the behavior is PTP, not NTP peer association.

Answer E is incorrect because an RP is a multicast-routing concept. It does not satisfy the stem’s governing point: A PTP boundary clock participates in master selection and regenerates timing toward downstream ports.

 

Question 8

A PTP-capable switch is configured as an end-to-end transparent clock. What is its primary timing function?

1. Convert every PTP message into NTP.
2. Run BGP best-path selection for clock traffic.
3. Become the grandmaster whenever it sees PTP packets.
4. Assign IP addresses to clients.
5. Update PTP correction information for the switch residence delay.

Correct Answer: E

 

Correct Answer

Answer E is correct because transparent clocks compensate for the forwarding delay they introduce instead of acting as a normal boundary-clock master/slave termination.

Incorrect Answers

Answer A is incorrect because PTP forwarding delay correction is not protocol translation to NTP.

Answer B is incorrect because BGP is not the PTP timing algorithm. It does not satisfy the stem’s governing point: Transparent clocks compensate for device forwarding delay rather than simply relaying uncorrected timing.

Answer C is incorrect because transparent mode does not imply grandmaster election ownership.

Answer D is incorrect because address assignment is unrelated to PTP timing. It does not satisfy the stem’s governing point: Transparent clocks compensate for device forwarding delay rather than simply relaying uncorrected timing.

 

Question 9

Two PTP segments use incompatible profiles and message expectations. The clocks are physically connected, but they do not form the intended timing relationship. What should be checked before tuning clock quality values?

1. Verify compatible PTP profile, domain, and transport settings.
2. Whether the switches have the same STP root priority.
3. Whether NAT overload is enabled.
4. Whether NTP stratum values match.
5. Whether the devices use identical IP addresses.

Correct Answer: A

 

Correct Answer

Answer A is correct because profile incompatibility can prevent interoperability regardless of clock accuracy.

Incorrect Answers

Answer B is incorrect because STP priority does not establish PTP profile compatibility.

Answer C is incorrect because PAT is unrelated to direct PTP profile compatibility.

Answer D is incorrect because PTP profile interoperability is not determined by NTP stratum.

Answer E is incorrect because unique addressing is expected; identical addresses would create a different problem.

 

Question 10

A power utility needs sub-microsecond synchronization between devices on a controlled LAN, and the switches support hardware timestamping and PTP. Which protocol is the better fit than ordinary NTP for that precision requirement?

1. VRRP, because an address owner is a clock master.
2. HSRP, because gateway preemption synchronizes clocks.
3. PTP, given the stated high-precision requirement and supported hardware.
4. BGP, because its keepalive timer is precise.
5. NTP solely because lower stratum always guarantees sub-microsecond error.

Correct Answer: C

 

Correct Answer

Answer C is correct because PTP with suitable hardware/network support targets precision beyond ordinary packet-network NTP use cases.

Incorrect Answers

Answer A is incorrect because VRRP gateway ownership is unrelated to time synchronization.

Answer B is incorrect because HSRP is a first-hop redundancy protocol. It does not satisfy the stem’s governing point: Choose PTP when the stated requirement is precision that ordinary NTP is not designed to guarantee.

Answer D is incorrect because BGP timers do not provide clock synchronization. It does not satisfy the stem’s governing point: Choose PTP when the stated requirement is precision that ordinary NTP is not designed to guarantee.

Answer E is incorrect because stratum does not guarantee that precision, and ordinary NTP is not chosen solely from stratum.

 

Question 11

Inside host 10.1.1.25 is statically translated to public address 198.51.100.25. From the NAT router perspective, which pair is the inside local and inside global address?

10. Inside local 10.1.1.25; inside global 198.51.100.25.
11. Both are outside global addresses.
12. Both addresses are inside local.
13. Inside local 198.51.100.25; inside global 10.1.1.25.
14. The roles cannot be identified because no port numbers are shown.

Correct Answer: A

 

Correct Answer

Answer A is correct because inside local is the inside host address as seen internally, while inside global is the translated address representing it externally.

Incorrect Answers

Answer B is incorrect because they represent an inside host, not the external destination.

Answer C is incorrect because the public translated representation is the inside global address.

Answer D is incorrect because that reverses the local/global roles. It does not satisfy the stem’s governing point: Distinguish inside local from inside global using the pre- and post-translation representation of the inside host.

Answer E is incorrect because address-role terminology can be determined without PAT port information.

 

Question 12

A NAT translation shows an external server as outside global 203.0.113.80. The enterprise does not translate that server address on the inside. What address would normally also appear as the outside local representation?

198. 198.51.100.25, because that is always the outside local address.
199. 203.0.113.80; no outside-address translation is occurring.
200. The NAT router loopback address.
201. 10.1.1.25, because every outside local address is an inside private address.
202. 0.0.0.0, because outside local cannot be routed.

Correct Answer: B

 

Correct Answer

Answer B is correct because when the outside address is not translated, its local and global representations can be the same.

Incorrect Answers

Answer A is incorrect because that address could represent an inside translation in another example; it is not inherently outside local.

Answer C is incorrect because the loopback is not automatically the outside host representation.

Answer D is incorrect because inside and outside address roles refer to different hosts and do not automatically swap.

Answer E is incorrect because outside local is a valid NAT role and need not be zero.

 

Question 13

Gi0/0 faces the private LAN and Gi0/1 faces the public WAN. Static and dynamic translations are correct, but no traffic is translated because the NAT roles were configured backward. Which interface role assignment is correct?

1. Both interfaces should be inside.
2. Both should be outside.
3. Gi0/0 is NAT inside; Gi0/1 is NAT outside.
4. Gi0/0 outside; Gi0/1 inside.
5. NAT roles are configured only under BGP, not interfaces.

Correct Answer: C

 

Correct Answer

Answer C is correct because inside is the interface toward inside-local hosts and outside is toward the external network.

Incorrect Answers

Answer A is incorrect because NAT needs a coherent inside/outside boundary for this translation design.

Answer B is incorrect because that would not identify the inside domain. It does not satisfy the stem’s governing point: Correct NAT behavior depends on identifying the inside and outside domains consistently.

Answer D is incorrect because that is the reversed assignment described as the defect.

Answer E is incorrect because IOS NAT uses interface or equivalent domain designation in addition to translation rules.

 

Question 14

`ip nat inside source list 10 pool PUBLIC` references ACL 10. ACL 10 permits 10.1.0.0/16. An engineer assumes ACL 10 is a firewall rule that blocks all other traffic from leaving. What is the best correction?

1. The ACL advertises the public pool to BGP.
2. The ACL makes all matching hosts use static NAT.
3. The ACL selects NAT-eligible sources; it is not an interface firewall by itself.
4. The ACL changes destination routes for 10.1.0.0/16.
5. A NAT ACL always discards every packet it does not permit.

Correct Answer: C

 

Correct Answer

Answer C is correct because translation classification and security filtering are distinct functions even though both can reference ACL syntax.

Incorrect Answers

Answer A is incorrect because route advertisement requires separate routing configuration. It does not satisfy the stem’s governing point: An ACL used to select NAT traffic is not the same thing as an interface security ACL.

Answer B is incorrect because the referenced pool rule is dynamic, not automatically one-to-one static translation.

Answer D is incorrect because the NAT ACL classification does not replace routing.

Answer E is incorrect because a NAT match ACL defines translation eligibility for that rule rather than acting as an interface filter by itself.

 

Question 15

Host 10.0.0.7 opens a TCP connection to an internet server. PAT changes the packet source to 198.51.100.5:41001. Which address is the inside global representation for that flow?

1. The internet server address.
2. 198.51.100.5.
3. 10.0.0.7.
4. 41001.
5. The default gateway address.

Correct Answer: B

 

Correct Answer

Answer B is correct because that public translated address represents the inside host to the outside network; the port distinguishes the PAT session.

Incorrect Answers

Answer A is incorrect because that represents the outside host, not the inside global identity.

Answer C is incorrect because that is the inside local address before translation.

Answer D is incorrect because that is a Layer 4 port, not an IP address role.

Answer E is incorrect because the gateway is not automatically the translated inside global address.

 

Question 16

An internal server 10.10.10.50 must always be reachable from outside as 198.51.100.50, with all ports translated one-to-one. Which configuration concept fits?

1. PBR matching the server.
2. A dynamic pool without reservations.
3. PAT overload on the WAN interface only.
4. HSRP virtual IP translation.
5. Use a static one-to-one address translation.

Correct Answer: E

 

Correct Answer

Answer E is correct because a fixed one-to-one mapping preserves a consistent external address for the inside server.

Incorrect Answers

Answer A is incorrect because PBR selects forwarding paths rather than creating address translation.

Answer B is incorrect because dynamic allocation does not guarantee the same public address for the server.

Answer C is incorrect because PAT is designed to share addresses/ports and does not by itself create the stated all-port one-to-one mapping.

Answer D is incorrect because HSRP provides gateway redundancy, not a static NAT mapping.

 

Question 17

A pool contains public addresses 198.51.100.100 through 198.51.100.109. Dynamic NAT is configured without overload. At one instant, 10 inside hosts already have active translations and an eleventh new host initiates traffic. What is the likely limitation?

1. The dynamic NAT pool is exhausted.
2. NAT disables existing translations to make room immediately.
3. The router doubles the pool using private addresses.
4. The host becomes the HSRP active router.
5. The eleventh host automatically shares the first address by PAT.

Correct Answer: A

 

Correct Answer

Answer A is correct because ten addresses support ten concurrent one-to-one dynamic mappings when overload is not used.

Incorrect Answers

Answer B is incorrect because active mappings are not arbitrarily destroyed simply because demand exceeds the pool.

Answer C is incorrect because the configured public pool bounds the dynamic translations.

Answer D is incorrect because NAT pool exhaustion is unrelated to FHRP election.

Answer E is incorrect because address sharing requires overload/PAT configuration. It does not satisfy the stem’s governing point: Without overload, dynamic NAT pool size limits the number of simultaneous inside address mappings.

 

Question 18

Hundreds of office clients need outbound internet access, but only one public IPv4 address is available on the WAN interface. Which translation method is designed for this?

1. One-to-one static NAT for every client.
2. VRRP address ownership.
3. Use PAT/NAT overload on the shared public address.
4. PIM sparse mode.
5. Dynamic NAT without overload.

Correct Answer: C

 

Correct Answer

Answer C is correct because PAT multiplexes multiple inside local sessions through one or a few inside global addresses using Layer 4 identifiers.

Incorrect Answers

Answer A is incorrect because one public address cannot provide a unique one-to-one static mapping for hundreds of simultaneous clients.

Answer B is incorrect because VRRP does not translate client addresses. It does not satisfy the stem’s governing point: PAT is the address-conservation method for many clients sharing limited public IPv4 addresses.

Answer D is incorrect because multicast routing is unrelated to outbound address conservation.

Answer E is incorrect because without overload one address supports only one active inside address mapping at a time.

 

Question 19

An internal HTTPS service 10.10.20.20:443 must be reachable externally as 198.51.100.20:8443 while other ports on the public address are not mapped to that server. What translation type is appropriate?

443. Use static port translation from TCP 8443 to TCP 443.
444. Static whole-address translation of every port.
445. Dynamic NAT from a pool.
446. PAT for outbound clients only with no static entry.
447. NTP peer mode.

Correct Answer: A

 

Correct Answer

Answer A is correct because the requirement fixes both the external port and the internal service port for a specific service.

Incorrect Answers

Answer B is incorrect because that exposes a one-to-one address mapping beyond the stated single service.

Answer C is incorrect because dynamic allocation does not create a stable inbound service port mapping.

Answer D is incorrect because outbound PAT does not by itself publish the stated inbound service.

Answer E is incorrect because time synchronization is unrelated to service translation. It does not satisfy the stem’s governing point: Use static port translation when a specific outside address/port must map to a specific inside service.

 

Question 20

A NAT pool is configured as 203.0.113.64 through 203.0.113.95 with netmask 255.255.255.240 (/28). The routed public block is actually 203.0.113.64/27. What is wrong?

1. A /28 is larger than a /27 and therefore includes too many addresses.
2. The first address must be 203.0.113.0 for any NAT pool.
3. The pool must use a /32 mask for every public address.
4. NAT pools never use a netmask.
5. The pool range matches /27, not the configured /28.

Correct Answer: E

 

Correct Answer

Answer E is correct because 203.0.113.64/27 spans .64-.95; using /28 does not describe that whole pool as one subnet.

Incorrect Answers

Answer A is incorrect because /28 is smaller, not larger, than /27. It does not satisfy the stem’s governing point: Validate that NAT pool address range and configured mask match the routed public prefix.

Answer B is incorrect because pools can use addresses from the actual routed public block.

Answer C is incorrect because the stem specifies a routed /27 block and the mask should be consistent with that design.

Answer D is incorrect because IOS dynamic NAT pool definitions can include a netmask or prefix-length.

 

Question 21

A dynamic NAT pool has 20 addresses and `show ip nat translations` shows all 20 assigned to active inside hosts. New matching hosts fail to obtain translations until old entries expire. What is the most direct diagnosis?

1. NTP authentication failure.
2. HSRP priority tie.
3. BGP AS-path loop.
4. IGMP membership timeout.
5. Dynamic pool exhaustion.

Correct Answer: E

 

Correct Answer

Answer E is correct because all addresses are currently allocated and no overload is stated, so new translations cannot be created until capacity returns.

Incorrect Answers

Answer A is incorrect because time synchronization is unrelated to translation allocation. It does not satisfy the stem’s governing point: Use active translation count versus pool capacity to identify dynamic NAT exhaustion.

Answer B is incorrect because gateway election does not explain a full NAT address pool.

Answer C is incorrect because BGP control-plane path rejection is unrelated to the stated NAT table evidence.

Answer D is incorrect because multicast receiver state is irrelevant to unicast NAT pool capacity.

 

Question 22

ACL 10 permits only 10.10.0.0/16 for dynamic NAT. Host 10.20.5.5 reaches the NAT router and has a valid internet route, but no translation is created. Which condition should be checked first?

1. The host must join a multicast group.
2. The host needs a higher HSRP priority.
3. The NAT pool needs a lower stratum.
4. The source does not match the NAT selection ACL.
5. The public interface must be an EtherChannel.

Correct Answer: D

 

Correct Answer

Answer D is correct because 10.20.5.5 is outside 10.10.0.0/16, so it is not eligible for this translation rule.

Incorrect Answers

Answer A is incorrect because IGMP membership is irrelevant to unicast NAT eligibility.

Answer B is incorrect because HSRP priority does not determine NAT ACL matching.

Answer C is incorrect because stratum is an NTP concept. It does not satisfy the stem’s governing point: If no translation appears, verify that the actual packet matches the NAT selection rule before changing pool behavior.

Answer E is incorrect because NAT does not require link aggregation. It does not satisfy the stem’s governing point: If no translation appears, verify that the actual packet matches the NAT selection rule before changing pool behavior.

 

Question 23

A NAT table shows a correct translation for an inside client. Outbound packets leave the WAN, but replies never arrive. The upstream ISP has no route to the public NAT pool except a different aggregate sent elsewhere. Which conclusion is best?

1. Delete the translation because any missing reply proves the mapping is wrong.
2. Investigate return routing to the inside-global block.
3. Change the inside local address to match the public pool.
4. Disable the routing table and rely on NAT.
5. Enable PTP on the WAN interface.

Correct Answer: B

 

Correct Answer

Answer B is correct because a correct translation does not guarantee that external networks route replies back to the NAT device.

Incorrect Answers

Answer A is incorrect because the stem explicitly says the translation is correct; return routing is the missing condition.

Answer C is incorrect because NAT exists precisely to allow different inside-local and inside-global addressing.

Answer D is incorrect because NAT still depends on IP routing for delivery.

Answer E is incorrect because clock synchronization does not restore a missing route.

 

Question 24

Two inside clients share 198.51.100.5 through PAT. The translation table shows TCP 10.1.1.10:50000 -> 198.51.100.5:41000 and TCP 10.1.1.11:50000 -> 198.51.100.5:41001. Why can both sessions coexist?

1. The clients use different HSRP group numbers.
2. The public address secretly becomes two different IP addresses.
3. The sessions can coexist only if the destinations are multicast.
4. PAT assigns distinct translated ports to the two sessions.
5. TCP ignores IP addresses when NAT is enabled.

Correct Answer: D

 

Correct Answer

Answer D is correct because the combination of protocol/address/port lets the device distinguish the two flows.

Incorrect Answers

Answer A is incorrect because FHRP group numbers are unrelated to PAT session uniqueness.

Answer B is incorrect because the same public IP is being shared with different translated ports.

Answer C is incorrect because PAT works for ordinary unicast TCP sessions. It does not satisfy the stem’s governing point: PAT multiplexes sessions through a shared address by maintaining distinct protocol/port mappings.

Answer E is incorrect because TCP sessions still depend on address and port tuples; NAT rewrites selected fields.

 

Question 25

A router has correct NAT inside/outside roles on Gi0/0 and Gi0/1. A new default route sends internet traffic out Gi0/2, but Gi0/2 is not configured as a NAT outside interface. Matching clients stop translating on the new path. What should be corrected?

1. Make the NAT outside boundary match the actual egress path.
2. Increase the HSRP hello interval.
3. Lower NTP stratum.
4. Make Gi0/2 an access port only.
5. Change the clients to multicast addresses.

Correct Answer: A

 

Correct Answer

Answer A is correct because traffic now exits through a path outside the configured NAT boundary, so the translation setup no longer matches forwarding.

Incorrect Answers

Answer B is incorrect because FHRP timers do not define NAT inside/outside processing.

Answer C is incorrect because time hierarchy is unrelated. It does not satisfy the stem’s governing point: NAT domain/interface placement must match the real traffic path after routing changes.

Answer D is incorrect because the issue is Layer 3 NAT path alignment, not Layer 2 access mode.

Answer E is incorrect because multicast addressing does not fix the NAT boundary.

 

Question 26

R1 and R2 are in the same HSRP group. R1 priority is 120, R2 priority is 100, and both are participating before any active router is chosen. Which router is favored to become active?

1. The router with lower NTP stratum.
2. Both, because priority matters only after failure.
3. The router with the lower IP address regardless of priority.
4. R2, because lower priority is preferred.
5. R1, because higher HSRP priority is preferred.

Correct Answer: E

 

Correct Answer

Answer E is correct because HSRP election uses the higher configured priority before the IP-address tie-break.

Incorrect Answers

Answer A is incorrect because NTP state is unrelated to HSRP election. It does not satisfy the stem’s governing point: HSRP chooses the higher priority when selecting the active router, subject to the current state and preemption behavior.

Answer B is incorrect because priority participates in active-router selection. It does not satisfy the stem’s governing point: HSRP chooses the higher priority when selecting the active router, subject to the current state and preemption behavior.

Answer C is incorrect because IP address is a tie-breaker when priorities tie, not a replacement for priority.

Answer D is incorrect because HSRP prefers higher priority. It does not satisfy the stem’s governing point: HSRP chooses the higher priority when selecting the active router, subject to the current state and preemption behavior.

 

Question 27

R1 priority 120 was active, then failed. R2 priority 100 became active. R1 recovers with priority 120 but has no `standby preempt`. What is expected?

1. R1 immediately becomes active solely because its priority is higher.
2. R1 becomes standby only after lowering its priority below zero.
3. NAT must select the active HSRP router.
4. R2 can remain active because R1 lacks preemption.
5. Both become active permanently by design.

Correct Answer: D

 

Correct Answer

Answer D is correct because HSRP preemption must be enabled for the returning higher-priority router to displace the current active router.

Incorrect Answers

Answer A is incorrect because without preempt, higher priority alone does not force takeover from an existing active router.

Answer B is incorrect because no such step is required; it can participate as nonactive at its configured priority.

Answer C is incorrect because NAT is not the HSRP election mechanism. It does not satisfy the stem’s governing point: HSRP priority and preemption are separate: a recovered higher-priority router needs preemption to retake active state.

Answer E is incorrect because healthy members in one HSRP group should not remain dual-active as the normal state.

 

Question 28

R1 HSRP priority is 120 and tracks an uplink with decrement 30. R2 priority is 105. Preemption is enabled where needed. The tracked uplink on R1 fails. What is R1 effective priority and which router is favored?

1. R2 becomes 75 because the decrement applies to every router.
2. R1 becomes 150 and remains active.
3. R1 priority remains 120 because tracking affects only NAT.
4. R1 becomes 100 and ties R2.
5. R1 becomes 90, so R2 at 105 is favored.

Correct Answer: E

 

Correct Answer

Answer E is correct because tracking subtracts 30 from 120, yielding 90; R2 then has the higher priority.

Incorrect Answers

Answer A is incorrect because the stated tracking object/decrement is on R1 only.

Answer B is incorrect because the track decrement lowers rather than raises priority.

Answer C is incorrect because HSRP tracking can adjust the group priority. It does not satisfy the stem’s governing point: Calculate HSRP tracking decrements and compare the resulting priority.

Answer D is incorrect because 120 – 30 is 90, not 100. It does not satisfy the stem’s governing point: Calculate HSRP tracking decrements and compare the resulting priority.

 

Question 29

R1 and R2 are configured for HSRP group 10 on VLAN 100. R1 uses virtual IP 10.100.0.1/24; R2 is mistakenly configured with virtual IP 10.101.0.1 while both physical interfaces are in 10.100.0.0/24. What is the key defect?

10. Group 10 requires VLAN 10.
11. Virtual IP addresses can only be IPv6.
12. The peers disagree on the HSRP virtual gateway address/subnet.
13. The physical interfaces should be in different subnets.
14. HSRP requires the virtual IP to equal one physical interface IP.

Correct Answer: C

 

Correct Answer

Answer C is correct because members of the same redundancy group must present the same virtual gateway identity to hosts.

Incorrect Answers

Answer A is incorrect because HSRP group number is not required to match VLAN ID.

Answer B is incorrect because HSRP supports IPv4 virtual gateways as shown. It does not satisfy the stem’s governing point: All HSRP participants in a group must agree on the virtual gateway address appropriate to the shared subnet.

Answer D is incorrect because they need common LAN reachability for the same HSRP segment.

Answer E is incorrect because the virtual gateway is a shared address distinct from the normal physical identities in a typical design.

 

Question 30

Hosts use 10.20.0.1 as their HSRP default gateway. R1 physical address is 10.20.0.2 and R2 physical address is 10.20.0.3. R1 is active. Which TWO statements are correct? Choose TWO.

1. The standby router cannot have any IP address while waiting.
2. Hosts should continue using the virtual address 10.20.0.1 rather than a specific router physical address.
3. Hosts must alternate their configured gateway between .2 and .3 every hello interval.
4. The active router must change its physical address to 10.20.0.1.
5. The active router forwards traffic for the virtual IP/MAC, while the standby is prepared to assume that role after failure.
6. The virtual IP can exist only while both routers are healthy.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because the virtual gateway identity is the point of FHRP redundancy.

Answer E is correct because HSRP presents a shared virtual router with an active and standby role.

Incorrect Answers

Answer A is incorrect because each participant normally has its own physical interface address.

Answer C is incorrect because hosts keep the virtual gateway; HSRP changes which router owns the virtual forwarding role.

Answer D is incorrect because the virtual address is separate from the routers physical addresses.

Answer F is incorrect because the purpose is to preserve gateway service when one router fails.

 

Question 31

Two VRRP routers run a version in which one router is the configured IPv4 address owner for the virtual address. The other router has a normal configured priority of 200. Which router is favored as master while the address owner is healthy?

1. The router with the lower physical IP always wins.
2. The router with priority 200, because any configured priority overrides ownership.
3. Both become master because the priorities differ.
4. The VRRP address owner is favored while healthy.
5. The router with HSRP preempt enabled.

Correct Answer: D

 

Correct Answer

Answer D is correct because the router owning the virtual IP has priority semantics that make it master when available.

Incorrect Answers

Answer A is incorrect because priority/ownership precede IP tie-breaking. It does not satisfy the stem’s governing point: In VRRP, explicit address ownership has special election behavior; state the version/ownership conditions rather than assuming generic priority alone.

Answer B is incorrect because the address owner has special election behavior and is not treated as an ordinary 100-range backup.

Answer C is incorrect because VRRP elects one master for the virtual router under healthy communication.

Answer E is incorrect because HSRP configuration does not control VRRP master election.

 

Question 32

A VRRPv3 group has Router A priority 150 and Router B priority 100. Neither is the address owner. Both use the same virtual address and the current master fails. Which router is preferred to become master?

1. The router with the lower interface bandwidth.
2. Both remain backup until an HSRP hello arrives.
3. The router with the higher NTP stratum.
4. Router B with priority 100.
5. Router A with priority 150.

Correct Answer: E

 

Correct Answer

Answer E is correct because higher VRRP priority is preferred when ownership is not the differentiator.

Incorrect Answers

Answer A is incorrect because bandwidth is not the stated election criterion. It does not satisfy the stem’s governing point: For non-owner VRRP candidates, higher configured priority is preferred under the stated version.

Answer B is incorrect because VRRP operates independently of HSRP. It does not satisfy the stem’s governing point: For non-owner VRRP candidates, higher configured priority is preferred under the stated version.

Answer C is incorrect because NTP has no role in VRRP election. It does not satisfy the stem’s governing point: For non-owner VRRP candidates, higher configured priority is preferred under the stated version.

Answer D is incorrect because lower priority is not preferred. It does not satisfy the stem’s governing point: For non-owner VRRP candidates, higher configured priority is preferred under the stated version.

 

Question 33

Router A and Router B are intended to form the same VRRP group. A uses group 20 with virtual IP 10.30.0.1; B uses group 21 with virtual IP 10.30.0.1. Both become master-like for their separate groups. What should be corrected?

1. Give both physical interfaces the same IP address.
2. Disable preemption on both routers and keep different group IDs.
3. Change the virtual IP on B to a different subnet.
4. Use the same VRRP group identity and virtual address on both peers.
5. Enable BGP multipath.

Correct Answer: D

 

Correct Answer

Answer D is correct because different group IDs define different virtual-router instances even if the address text is similar.

Incorrect Answers

Answer A is incorrect because that would create an address conflict and is not how VRRP redundancy is formed.

Answer B is incorrect because preemption cannot merge two different VRRP groups. It does not satisfy the stem’s governing point: VRRP peers must agree on the virtual-router group and address configuration for one redundancy instance.

Answer C is incorrect because the requirement is one shared default gateway, so divergence would not fix the intended group.

Answer E is incorrect because BGP multipath is unrelated to VRRP group formation.

 

Question 34

Hosts use a VRRP virtual address as their default gateway. The current master fails completely, but a healthy backup remains on the LAN. What service is VRRP designed to preserve?

1. BGP route advertisement to every ISP automatically.
2. Clock synchronization between hosts.
3. Preserve the shared default gateway by moving the virtual-router role.
4. NAT translation state on unrelated devices.
5. The exact TCP session state of every firewall in the network.

Correct Answer: C

 

Correct Answer

Answer C is correct because VRRP allows another router to assume the shared virtual gateway role.

Incorrect Answers

Answer A is incorrect because external routing policy is separate from the first-hop virtual gateway role.

Answer B is incorrect because time synchronization is outside VRRP scope. It does not satisfy the stem’s governing point: VRRP preserves a shared first-hop gateway identity when the active/master router fails.

Answer D is incorrect because stateful NAT replication is not inherently provided by VRRP itself.

Answer E is incorrect because VRRP provides gateway redundancy, not generic application/firewall session replication.

 

Question 35

A mixed-vendor LAN requires an open-standard first-hop redundancy protocol. Both platforms support VRRPv3; only the Cisco devices support HSRP. Which choice best fits the stated interoperability constraint?

1. Use VRRPv3 for the shared gateway group.
2. Use HSRP because higher priority always wins across vendors.
3. Use NAT overload to elect the default gateway.
4. Run HSRP on one vendor and VRRP on the other with the same virtual IP and expect them to coordinate.
5. Use NTP peer mode for gateway election.

Correct Answer: A

 

Correct Answer

Answer A is correct because VRRP is the supported common protocol across the stated vendors.

Incorrect Answers

Answer B is incorrect because the non-Cisco platform is stated not to support HSRP.

Answer C is incorrect because NAT is not an FHRP. It does not satisfy the stem’s governing point: Protocol selection should follow the actual platform interoperability requirement; VRRP is the stated common choice.

Answer D is incorrect because different FHRPs do not form one coordinated redundancy group merely because an address matches.

Answer E is incorrect because NTP does not provide first-hop redundancy. It does not satisfy the stem’s governing point: Protocol selection should follow the actual platform interoperability requirement; VRRP is the stated common choice.