Exam Bundle

That observation verifies pe core versus customer forwarding in a different situation, such as when a P router in the MPLS core is expected to contain every customer IPv4 prefix to forward VPN traffic. For the reported vpn service inner label incident at a provider edge operations team in Singapore, the required acceptance evidence is: The remote PE uses the VPN service label to select the intended tenant forwarding context. This other result does not test that condition directly.

That observation verifies no unsolicited inter-vrf communication in a different situation, such as when two VRFs on one PE have valid routes but customer staff expect automatic communication across them. For the reported vpn service inner label incident at a provider edge operations team in Singapore, the required acceptance evidence is: The remote PE uses the VPN service label to select the intended tenant forwarding context. This other result does not test that condition directly.

That observation verifies vpnv4 bgp family in a different situation, such as when pE loopback BGP peers are Established for ordinary IPv4 unicast but customer VPN prefixes are absent. For the reported vpn service inner label incident at a provider edge operations team in Singapore, the required acceptance evidence is: The remote PE uses the VPN service label to select the intended tenant forwarding context. This other result does not test that condition directly.

That approach is relevant to aaa accounting records, such as when management logins succeed but the audit system has no connection or command records. That is a different root cause from the aaa login authentication omitted fault observed at a multi-tenant facility in Dublin. Applying that approach alone would not establish the required result: Remote login succeeds through the documented AAA methods without bypassing authentication.

That approach is relevant to aaa server unavailable versus reject, such as when a router is configured TACACS+ then local, but an explicit reject from the active TACACS+ server is expected to trigger local fallback. That is a different root cause from the aaa login authentication omitted fault observed at a multi-tenant facility in Dublin. Applying that approach alone would not establish the required result: Remote login succeeds through the documented AAA methods without bypassing authentication.

That approach is relevant to aaa server group order, such as when a local database is used first even when the desired policy requires TACACS+ primary authentication with local fallback only on error. That is a different root cause from the aaa login authentication omitted fault observed at a multi-tenant facility in Dublin. Applying that approach alone would not establish the required result: Remote login succeeds through the documented AAA methods without bypassing authentication.

That observation verifies aaa method list not applied in a different situation, such as when the intended named login method list exists but VTY access continues to use another authentication path. For the reported aaa login authentication omitted incident at a multi-tenant facility in Dublin, the required acceptance evidence is: Remote login succeeds through the documented AAA methods without bypassing authentication. This other result does not test that condition directly.

That observation verifies aaa source interface mismatch in a different situation, such as when aAA requests leave from an unexpected source IP that the policy server does not recognize as an authorized network device. For the reported aaa login authentication omitted incident at a multi-tenant facility in Dublin, the required acceptance evidence is: Remote login succeeds through the documented AAA methods without bypassing authentication. This other result does not test that condition directly.

That observation verifies tacacs+ transport port in a different situation, such as when a firewall allows RADIUS UDP but TACACS+ management logins still fail because its dedicated transport is blocked. For the reported aaa login authentication omitted incident at a multi-tenant facility in Dublin, the required acceptance evidence is: Remote login succeeds through the documented AAA methods without bypassing authentication. This other result does not test that condition directly.

That approach is relevant to route-map attachment direction, such as when a prefix policy meant to constrain inbound BGP routes is applied only outbound to the peer. That is a different root cause from the longest prefix before ad fault observed at a manufacturing campus in Austin. Applying that approach alone would not establish the required result: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary.

That approach is relevant to pbr on wrong interface, such as when a policy-based route-map is created but traffic entering the branch router continues to follow destination RIB lookup. That is a different root cause from the longest prefix before ad fault observed at a manufacturing campus in Austin. Applying that approach alone would not establish the required result: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary.

That approach is relevant to same-prefix administrative distance, such as when an internal EIGRP route and an OSPF route advertise the identical IPv4 prefix, but the engineer expects OSPF to win solely because its interface cost is lower. That is a different root cause from the longest prefix before ad fault observed at a manufacturing campus in Austin. Applying that approach alone would not establish the required result: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary.

That observation verifies pbr on wrong interface in a different situation, such as when a policy-based route-map is created but traffic entering the branch router continues to follow destination RIB lookup. For the reported longest prefix before ad incident at a manufacturing campus in Austin, the required acceptance evidence is: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary. This other result does not test that condition directly.

That observation verifies route-map sequence numbering in a different situation, such as when a new permit route-map entry is added after a broad permit any; its more-specific set action never runs. For the reported longest prefix before ad incident at a manufacturing campus in Austin, the required acceptance evidence is: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary. This other result does not test that condition directly.

That observation verifies pbr set next-hop and packet selection in a different situation, such as when a route-map modifies packets from an unintended subnet because its ACL permits every source. For the reported longest prefix before ad incident at a manufacturing campus in Austin, the required acceptance evidence is: A route lookup for an address inside the /24 selects its next hop, while other /16 addresses follow the summary. This other result does not test that condition directly.

That approach is relevant to dhcp relay udp filtering, such as when router helpers are correctly configured but remote clients time out because DHCP request/response UDP transport is blocked between relay and server. That is a different root cause from the dhcp default router option fault observed at a public utility network in Calgary. Applying that approach alone would not establish the required result: Client leases contain the intended gateway and clients reach off-subnet destinations.

That approach is relevant to dhcpv6 relay missing, such as when iPv6 clients on a remote link cannot contact the centralized stateful DHCPv6 server through their local router. That is a different root cause from the dhcp default router option fault observed at a public utility network in Calgary. Applying that approach alone would not establish the required result: Client leases contain the intended gateway and clients reach off-subnet destinations.

That approach is relevant to dhcp relay helper address, such as when broadcast DHCPDISCOVER packets from remote VLAN clients never reach the central DHCP server. That is a different root cause from the dhcp default router option fault observed at a public utility network in Calgary. Applying that approach alone would not establish the required result: Client leases contain the intended gateway and clients reach off-subnet destinations.

That observation verifies dhcpv6 duid identity in a different situation, such as when an administrator assumes DHCPv6 reservations use only a client MAC address and the intended client consistently misses its reserved lease. For the reported dhcp default router option incident at a public utility network in Calgary, the required acceptance evidence is: Client leases contain the intended gateway and clients reach off-subnet destinations. This other result does not test that condition directly.

That observation verifies dhcp duplicate leased ip in a different situation, such as when the DHCP server offers an IPv4 address already in use and hosts report duplicate-address alerts. For the reported dhcp default router option incident at a public utility network in Calgary, the required acceptance evidence is: Client leases contain the intended gateway and clients reach off-subnet destinations. This other result does not test that condition directly.

That observation verifies dhcp relay udp filtering in a different situation, such as when router helpers are correctly configured but remote clients time out because DHCP request/response UDP transport is blocked between relay and server. For the reported dhcp default router option incident at a public utility network in Calgary, the required acceptance evidence is: Client leases contain the intended gateway and clients reach off-subnet destinations. This other result does not test that condition directly.

That approach is relevant to ipv6 rogue router advertisements, such as when an untrusted access port sends IPv6 Router Advertisements and changes hosts' default gateway. That is a different root cause from the ipv6 nd spoofing fault observed at an e-commerce backbone in Amsterdam. Applying that approach alone would not establish the required result: Forged neighbor mappings are rejected and genuine host neighbors remain reachable.

That approach is relevant to ipv6 source guard, such as when a client spoofs an IPv6 source address not associated with its access port and evades ordinary destination filtering. That is a different root cause from the ipv6 nd spoofing fault observed at an e-commerce backbone in Amsterdam. Applying that approach alone would not establish the required result: Forged neighbor mappings are rejected and genuine host neighbors remain reachable.

That approach is relevant to ipv6 nd trust validation, such as when a first-hop protection policy is copied from a different VLAN and treats all access ports as trusted for neighbor discovery. That is a different root cause from the ipv6 nd spoofing fault observed at an e-commerce backbone in Amsterdam. Applying that approach alone would not establish the required result: Forged neighbor mappings are rejected and genuine host neighbors remain reachable.

That observation verifies dhcpv6 rogue server in a different situation, such as when a malicious access client sends DHCPv6 server responses that assign incorrect network parameters to hosts. For the reported ipv6 nd spoofing incident at an e-commerce backbone in Amsterdam, the required acceptance evidence is: Forged neighbor mappings are rejected and genuine host neighbors remain reachable. This other result does not test that condition directly.

That observation verifies ndp duplicate address detect in a different situation, such as when a client cannot configure a valid IPv6 address because duplicate-address-detection Neighbor Solicitation is filtered. For the reported ipv6 nd spoofing incident at an e-commerce backbone in Amsterdam, the required acceptance evidence is: Forged neighbor mappings are rejected and genuine host neighbors remain reachable. This other result does not test that condition directly.

That observation verifies ra guard trusted boundary in a different situation, such as when rA Guard is deployed only on the legitimate router-facing port instead of the untrusted host-facing ports. For the reported ipv6 nd spoofing incident at an e-commerce backbone in Amsterdam, the required acceptance evidence is: Forged neighbor mappings are rejected and genuine host neighbors remain reachable. This other result does not test that condition directly.

That approach is relevant to mpls interface activation, such as when an IGP core forwards ordinary IP packets but labeled traffic fails because MPLS forwarding is absent on a core-facing interface. That is a different root cause from the mpls ldp binding mismatch fault observed at a multisite enterprise WAN in Houston. Applying that approach alone would not establish the required result: LFIB next hop and outgoing label align with the valid underlying IGP path.

That approach is relevant to label stack for vpn, such as when an MPLS VPN packet arrives with an outer transport label and inner service label; an operator interprets both labels as unrelated IP headers. That is a different root cause from the mpls ldp binding mismatch fault observed at a multisite enterprise WAN in Houston. Applying that approach alone would not establish the required result: LFIB next hop and outgoing label align with the valid underlying IGP path.

That approach is relevant to provider core label loss, such as when core IGP routes are stable but the ingress PE has no remote label for the required egress PE FEC. That is a different root cause from the mpls ldp binding mismatch fault observed at a multisite enterprise WAN in Houston. Applying that approach alone would not establish the required result: LFIB next hop and outgoing label align with the valid underlying IGP path.

That observation verifies mpls interface activation in a different situation, such as when an IGP core forwards ordinary IP packets but labeled traffic fails because MPLS forwarding is absent on a core-facing interface. For the reported mpls ldp binding mismatch incident at a multisite enterprise WAN in Houston, the required acceptance evidence is: LFIB next hop and outgoing label align with the valid underlying IGP path. This other result does not test that condition directly.

That observation verifies provider core label loss in a different situation, such as when core IGP routes are stable but the ingress PE has no remote label for the required egress PE FEC. For the reported mpls ldp binding mismatch incident at a multisite enterprise WAN in Houston, the required acceptance evidence is: LFIB next hop and outgoing label align with the valid underlying IGP path. This other result does not test that condition directly.

That observation verifies mpls label swapping in a different situation, such as when a core operator assumes each transit router forwards solely on the customer destination IP rather than the incoming MPLS label. For the reported mpls ldp binding mismatch incident at a multisite enterprise WAN in Houston, the required acceptance evidence is: LFIB next hop and outgoing label align with the valid underlying IGP path. This other result does not test that condition directly.