Exam Bundle

That observation verifies vty login local in a different situation, such as when local user accounts exist but remote SSH sessions fail at password prompts because the VTY line uses incompatible login settings. For the reported console versus vty recovery incident at a financial services WAN in Toronto, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That observation verifies ssh rsa key prerequisites in a different situation, such as when a router cannot start the SSH service because it lacks an appropriate host key and required IOS SSH configuration. For the reported console versus vty recovery incident at a financial services WAN in Toronto, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That observation verifies ssh transport restriction in a different situation, such as when a VTY line allows Telnet login even though the management policy requires encrypted CLI access. For the reported console versus vty recovery incident at a financial services WAN in Toronto, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That approach is relevant to ipv6 nd spoofing, such as when an attacker injects forged Neighbor Advertisements to redirect local IPv6 traffic. That is a different root cause from the ipv6 source guard fault observed at a regulated enterprise in London. Applying that approach alone would not establish the required result: Packets with unapproved source-port bindings are dropped while valid hosts forward normally.

That approach is relevant to dhcpv6 rogue server, such as when a malicious access client sends DHCPv6 server responses that assign incorrect network parameters to hosts. That is a different root cause from the ipv6 source guard fault observed at a regulated enterprise in London. Applying that approach alone would not establish the required result: Packets with unapproved source-port bindings are dropped while valid hosts forward normally.

That approach is relevant to ipv6 rogue router advertisements, such as when an untrusted access port sends IPv6 Router Advertisements and changes hosts' default gateway. That is a different root cause from the ipv6 source guard fault observed at a regulated enterprise in London. Applying that approach alone would not establish the required result: Packets with unapproved source-port bindings are dropped while valid hosts forward normally.

That observation verifies ipv6 binding table role in a different situation, such as when iPv6 first-hop validation features reject legitimate clients because the switch has no binding data for valid addresses. For the reported ipv6 source guard incident at a regulated enterprise in London, the required acceptance evidence is: Packets with unapproved source-port bindings are dropped while valid hosts forward normally. This other result does not test that condition directly.

That observation verifies ipv6 rogue router advertisements in a different situation, such as when an untrusted access port sends IPv6 Router Advertisements and changes hosts' default gateway. For the reported ipv6 source guard incident at a regulated enterprise in London, the required acceptance evidence is: Packets with unapproved source-port bindings are dropped while valid hosts forward normally. This other result does not test that condition directly.

That observation verifies ipv6 nd trust validation in a different situation, such as when a first-hop protection policy is copied from a different VLAN and treats all access ports as trusted for neighbor discovery. For the reported ipv6 source guard incident at a regulated enterprise in London, the required acceptance evidence is: Packets with unapproved source-port bindings are dropped while valid hosts forward normally. This other result does not test that condition directly.

That approach is relevant to spoke nhrp registration age, such as when a hub stops forwarding for one spoke because its NHRP registration repeatedly expires. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at an MPLS service provider in Paris. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That approach is relevant to phase 2 next-hop-self, such as when in phase 2 DMVPN, hub EIGRP changes the next hop to its own tunnel IP, preventing a direct spoke shortcut. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at an MPLS service provider in Paris. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That approach is relevant to hub dynamic multicast mappings, such as when a DMVPN hub sees NHRP registrations but no EIGRP neighbors because tunneled multicast control packets cannot reach newly joined spokes. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at an MPLS service provider in Paris. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That observation verifies phase 2 next-hop-self in a different situation, such as when in phase 2 DMVPN, hub EIGRP changes the next hop to its own tunnel IP, preventing a direct spoke shortcut. For the reported phase 3 nhrp redirect shortcut incident at an MPLS service provider in Paris, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.

That observation verifies static hub mapping at spoke in a different situation, such as when a spoke cannot send initial NHRP requests because it has no mapping from the hub's tunnel address to the reachable NBMA address. For the reported phase 3 nhrp redirect shortcut incident at an MPLS service provider in Paris, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.

That observation verifies dmvpn nhrp network id mismatch in a different situation, such as when the hub and spoke use different NHRP network identifiers despite otherwise consistent tunnel addressing. For the reported phase 3 nhrp redirect shortcut incident at an MPLS service provider in Paris, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.

That approach is relevant to longest prefix before ad, such as when a host matches an OSPF /24 and a lower-AD static /16; operations assumes the static summary must forward the packet. That is a different root cause from the prefix-list exact-length filter fault observed at a cloud interconnect team in Toronto. Applying that approach alone would not establish the required result: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions.

That approach is relevant to route-map attachment direction, such as when a prefix policy meant to constrain inbound BGP routes is applied only outbound to the peer. That is a different root cause from the prefix-list exact-length filter fault observed at a cloud interconnect team in Toronto. Applying that approach alone would not establish the required result: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions.

That approach is relevant to route-map sequence numbering, such as when a new permit route-map entry is added after a broad permit any; its more-specific set action never runs. That is a different root cause from the prefix-list exact-length filter fault observed at a cloud interconnect team in Toronto. Applying that approach alone would not establish the required result: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions.

That observation verifies ospf external summarization in a different situation, such as when an ASBR redistributing several adjacent external routes tries to use an ABR area range to summarize them. For the reported prefix-list exact-length filter incident at a cloud interconnect team in Toronto, the required acceptance evidence is: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions. This other result does not test that condition directly.

That observation verifies redistribution route-map omission in a different situation, such as when a router leaks sensitive static prefixes into OSPF because redistribute static has no route policy. For the reported prefix-list exact-length filter incident at a cloud interconnect team in Toronto, the required acceptance evidence is: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions. This other result does not test that condition directly.

That observation verifies bgp network statement exact match in a different situation, such as when a BGP network statement for a /24 originates nothing because only a /16 exists in the local RIB. For the reported prefix-list exact-length filter incident at a cloud interconnect team in Toronto, the required acceptance evidence is: Both the approved aggregate and the designated more-specific prefixes meet the configured match conditions. This other result does not test that condition directly.

That approach is relevant to ssh transport restriction, such as when a VTY line allows Telnet login even though the management policy requires encrypted CLI access. That is a different root cause from the console versus vty recovery fault observed at a university IT network in Edinburgh. Applying that approach alone would not establish the required result: Administrative access remains available during an in-band network outage.

That approach is relevant to vty login local, such as when local user accounts exist but remote SSH sessions fail at password prompts because the VTY line uses incompatible login settings. That is a different root cause from the console versus vty recovery fault observed at a university IT network in Edinburgh. Applying that approach alone would not establish the required result: Administrative access remains available during an in-band network outage.

That approach is relevant to scp file transfer enablement, such as when an operator tries to securely copy router files using SCP but the device is configured only for unencrypted TFTP. That is a different root cause from the console versus vty recovery fault observed at a university IT network in Edinburgh. Applying that approach alone would not establish the required result: Administrative access remains available during an in-band network outage.

That observation verifies ssh rsa key prerequisites in a different situation, such as when a router cannot start the SSH service because it lacks an appropriate host key and required IOS SSH configuration. For the reported console versus vty recovery incident at a university IT network in Edinburgh, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That observation verifies ssh transport restriction in a different situation, such as when a VTY line allows Telnet login even though the management policy requires encrypted CLI access. For the reported console versus vty recovery incident at a university IT network in Edinburgh, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That observation verifies vty login local in a different situation, such as when local user accounts exist but remote SSH sessions fail at password prompts because the VTY line uses incompatible login settings. For the reported console versus vty recovery incident at a university IT network in Edinburgh, the required acceptance evidence is: Administrative access remains available during an in-band network outage. This other result does not test that condition directly.

That approach is relevant to spoke nhrp registration age, such as when a hub stops forwarding for one spoke because its NHRP registration repeatedly expires. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at a logistics hub in Berlin. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That approach is relevant to hub dynamic multicast mappings, such as when a DMVPN hub sees NHRP registrations but no EIGRP neighbors because tunneled multicast control packets cannot reach newly joined spokes. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at a logistics hub in Berlin. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That approach is relevant to phase 2 next-hop-self, such as when in phase 2 DMVPN, hub EIGRP changes the next hop to its own tunnel IP, preventing a direct spoke shortcut. That is a different root cause from the phase 3 nhrp redirect shortcut fault observed at a logistics hub in Berlin. Applying that approach alone would not establish the required result: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut.

That observation verifies dmvpn nhrp network id mismatch in a different situation, such as when the hub and spoke use different NHRP network identifiers despite otherwise consistent tunnel addressing. For the reported phase 3 nhrp redirect shortcut incident at a logistics hub in Berlin, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.

That observation verifies phase 2 next-hop-self in a different situation, such as when in phase 2 DMVPN, hub EIGRP changes the next hop to its own tunnel IP, preventing a direct spoke shortcut. For the reported phase 3 nhrp redirect shortcut incident at a logistics hub in Berlin, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.

That observation verifies static hub mapping at spoke in a different situation, such as when a spoke cannot send initial NHRP requests because it has no mapping from the hub's tunnel address to the reachable NBMA address. For the reported phase 3 nhrp redirect shortcut incident at a logistics hub in Berlin, the required acceptance evidence is: An initial hub-transited flow triggers a direct spoke-to-spoke forwarding shortcut. This other result does not test that condition directly.