Exam Bundle

That observation verifies aaa login authentication omitted in a different situation, such as when remote access fails after AAA configuration because no supported authentication method list is bound to the relevant VTY lines. For the reported aaa source interface mismatch incident at a health system WAN in Toronto, the required acceptance evidence is: Server logs show the registered network-device source and authentication succeeds. This other result does not test that condition directly.

That observation verifies aaa method list not applied in a different situation, such as when the intended named login method list exists but VTY access continues to use another authentication path. For the reported aaa source interface mismatch incident at a health system WAN in Toronto, the required acceptance evidence is: Server logs show the registered network-device source and authentication succeeds. This other result does not test that condition directly.

That observation verifies aaa server group order in a different situation, such as when a local database is used first even when the desired policy requires TACACS+ primary authentication with local fallback only on error. For the reported aaa source interface mismatch incident at a health system WAN in Toronto, the required acceptance evidence is: Server logs show the registered network-device source and authentication succeeds. This other result does not test that condition directly.

That approach is relevant to ospf area mismatch, such as when two OSPF routers on one link receive hellos but use different area identifiers, preventing adjacency. That is a different root cause from the ospf inter-area summarization fault observed at an enterprise WAN hub in Singapore. Applying that approach alone would not establish the required result: The other area receives the intended inter-area summary rather than each qualifying component.

That approach is relevant to ospf stub flag mismatch, such as when an OSPF adjacency fails because one side is configured stub and the other side treats the area as normal. That is a different root cause from the ospf inter-area summarization fault observed at an enterprise WAN hub in Singapore. Applying that approach alone would not establish the required result: The other area receives the intended inter-area summary rather than each qualifying component.

That approach is relevant to ibgp loopback update-source, such as when an iBGP session configured to peer loopback-to-loopback remains Idle because the local source defaults to the physical interface. That is a different root cause from the ospf inter-area summarization fault observed at an enterprise WAN hub in Singapore. Applying that approach alone would not establish the required result: The other area receives the intended inter-area summary rather than each qualifying component.

That observation verifies eigrp interface summary in a different situation, such as when an EIGRP hub advertises several component prefixes to remote peers despite a policy requiring one regional aggregate. For the reported ospf inter-area summarization incident at an enterprise WAN hub in Singapore, the required acceptance evidence is: The other area receives the intended inter-area summary rather than each qualifying component. This other result does not test that condition directly.

That observation verifies ospf cost path choice in a different situation, such as when an engineer expects OSPF to choose the highest interface speed but configured interface cost forces a different path. For the reported ospf inter-area summarization incident at an enterprise WAN hub in Singapore, the required acceptance evidence is: The other area receives the intended inter-area summary rather than each qualifying component. This other result does not test that condition directly.

That observation verifies ospf authentication mismatch in a different situation, such as when an OSPF neighbor receives hellos but rejects authenticated packets because key or mode differs across the link. For the reported ospf inter-area summarization incident at an enterprise WAN hub in Singapore, the required acceptance evidence is: The other area receives the intended inter-area summary rather than each qualifying component. This other result does not test that condition directly.

That approach is relevant to ssh rsa key prerequisites, such as when a router cannot start the SSH service because it lacks an appropriate host key and required IOS SSH configuration. That is a different root cause from the ssh version legacy fault observed at an industrial site operations group in Munich. Applying that approach alone would not establish the required result: Remote sessions negotiate the intended modern SSH protocol version.

That approach is relevant to ssh source interface routing, such as when management SSH works from one site but not another because replies leave through an unintended VRF or source path. That is a different root cause from the ssh version legacy fault observed at an industrial site operations group in Munich. Applying that approach alone would not establish the required result: Remote sessions negotiate the intended modern SSH protocol version.

That approach is relevant to ssh transport restriction, such as when a VTY line allows Telnet login even though the management policy requires encrypted CLI access. That is a different root cause from the ssh version legacy fault observed at an industrial site operations group in Munich. Applying that approach alone would not establish the required result: Remote sessions negotiate the intended modern SSH protocol version.

That observation verifies vty access-class management acl in a different situation, such as when untrusted subnets can open the router's SSH port even though the routing interfaces have unrelated ACLs. For the reported ssh version legacy incident at an industrial site operations group in Munich, the required acceptance evidence is: Remote sessions negotiate the intended modern SSH protocol version. This other result does not test that condition directly.

That observation verifies ssh transport restriction in a different situation, such as when a VTY line allows Telnet login even though the management policy requires encrypted CLI access. For the reported ssh version legacy incident at an industrial site operations group in Munich, the required acceptance evidence is: Remote sessions negotiate the intended modern SSH protocol version. This other result does not test that condition directly.

That observation verifies ssh source interface routing in a different situation, such as when management SSH works from one site but not another because replies leave through an unintended VRF or source path. For the reported ssh version legacy incident at an industrial site operations group in Munich, the required acceptance evidence is: Remote sessions negotiate the intended modern SSH protocol version. This other result does not test that condition directly.

That approach is relevant to pe core versus customer forwarding, such as when a P router in the MPLS core is expected to contain every customer IPv4 prefix to forward VPN traffic. That is a different root cause from the pe-to-ce route exchange fault observed at an airline WAN in London. Applying that approach alone would not establish the required result: Customer prefixes appear in the local VRF RIB and can be exported by policy.

That approach is relevant to vrf ingress binding on pe, such as when a PE-facing customer interface is accidentally placed in the global routing table, exposing routes to the wrong context. That is a different root cause from the pe-to-ce route exchange fault observed at an airline WAN in London. Applying that approach alone would not establish the required result: Customer prefixes appear in the local VRF RIB and can be exported by policy.

That approach is relevant to route distinguisher overlapping tenants, such as when two customers both advertise 10.10.0.0/16 and the operator assumes ordinary IPv4 BGP can carry them without unique VPN identity. That is a different root cause from the pe-to-ce route exchange fault observed at an airline WAN in London. Applying that approach alone would not establish the required result: Customer prefixes appear in the local VRF RIB and can be exported by policy.

That observation verifies no unsolicited inter-vrf communication in a different situation, such as when two VRFs on one PE have valid routes but customer staff expect automatic communication across them. For the reported pe-to-ce route exchange incident at an airline WAN in London, the required acceptance evidence is: Customer prefixes appear in the local VRF RIB and can be exported by policy. This other result does not test that condition directly.

That observation verifies vrf ingress binding on pe in a different situation, such as when a PE-facing customer interface is accidentally placed in the global routing table, exposing routes to the wrong context. For the reported pe-to-ce route exchange incident at an airline WAN in London, the required acceptance evidence is: Customer prefixes appear in the local VRF RIB and can be exported by policy. This other result does not test that condition directly.

That observation verifies route-target import missing in a different situation, such as when the remote PE receives a VPNv4 route but the destination tenant VRF does not import it because RT values do not match. For the reported pe-to-ce route exchange incident at an airline WAN in London, the required acceptance evidence is: Customer prefixes appear in the local VRF RIB and can be exported by policy. This other result does not test that condition directly.

That approach is relevant to ipv6 rogue router advertisements, such as when an untrusted access port sends IPv6 Router Advertisements and changes hosts' default gateway. That is a different root cause from the ipv6 binding table role fault observed at a telecommunications branch in Oslo. Applying that approach alone would not establish the required result: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic.

That approach is relevant to ipv6 nd spoofing, such as when an attacker injects forged Neighbor Advertisements to redirect local IPv6 traffic. That is a different root cause from the ipv6 binding table role fault observed at a telecommunications branch in Oslo. Applying that approach alone would not establish the required result: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic.

That approach is relevant to ipv6 source guard, such as when a client spoofs an IPv6 source address not associated with its access port and evades ordinary destination filtering. That is a different root cause from the ipv6 binding table role fault observed at a telecommunications branch in Oslo. Applying that approach alone would not establish the required result: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic.

That observation verifies ipv6 nd trust validation in a different situation, such as when a first-hop protection policy is copied from a different VLAN and treats all access ports as trusted for neighbor discovery. For the reported ipv6 binding table role incident at a telecommunications branch in Oslo, the required acceptance evidence is: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic. This other result does not test that condition directly.

That observation verifies ipv6 source guard in a different situation, such as when a client spoofs an IPv6 source address not associated with its access port and evades ordinary destination filtering. For the reported ipv6 binding table role incident at a telecommunications branch in Oslo, the required acceptance evidence is: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic. This other result does not test that condition directly.

That observation verifies ra guard trusted boundary in a different situation, such as when rA Guard is deployed only on the legitimate router-facing port instead of the untrusted host-facing ports. For the reported ipv6 binding table role incident at a telecommunications branch in Oslo, the required acceptance evidence is: Legitimate bindings are present and source/neighbor validation no longer drops valid traffic. This other result does not test that condition directly.

That approach is relevant to pbr next-hop failure, such as when an ingress policy forces traffic toward an unavailable next hop instead of failing over by design. That is a different root cause from the bfd transport filtering fault observed at a managed services backbone in Amsterdam. Applying that approach alone would not establish the required result: The BFD peer session comes up and reports Up independently of protocol hello reception.

That approach is relevant to ospf dr bdr network type, such as when a point-to-point link is configured with an OSPF broadcast network type and displays an unnecessary DR election. That is a different root cause from the bfd transport filtering fault observed at a managed services backbone in Amsterdam. Applying that approach alone would not establish the required result: The BFD peer session comes up and reports Up independently of protocol hello reception.

That approach is relevant to bfd fast failure detection, such as when oSPF does not withdraw a failed routed path quickly because only long routing hello timers detect loss. That is a different root cause from the bfd transport filtering fault observed at a managed services backbone in Amsterdam. Applying that approach alone would not establish the required result: The BFD peer session comes up and reports Up independently of protocol hello reception.

That observation verifies eigrp passive-interface in a different situation, such as when an EIGRP-enabled link never forms a neighbor relationship because it is configured as passive. For the reported bfd transport filtering incident at a managed services backbone in Amsterdam, the required acceptance evidence is: The BFD peer session comes up and reports Up independently of protocol hello reception. This other result does not test that condition directly.

That observation verifies bgp rib failure in a different situation, such as when a prefix is visible as valid and best in BGP but cannot install into the RIB because another protocol has a preferable route. For the reported bfd transport filtering incident at a managed services backbone in Amsterdam, the required acceptance evidence is: The BFD peer session comes up and reports Up independently of protocol hello reception. This other result does not test that condition directly.

That observation verifies ebgp nonconnected loopback in a different situation, such as when bGP TCP connectivity over loopbacks fails because a multihop eBGP peer relies on a default one-hop TTL. For the reported bfd transport filtering incident at a managed services backbone in Amsterdam, the required acceptance evidence is: The BFD peer session comes up and reports Up independently of protocol hello reception. This other result does not test that condition directly.