CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP

How to work these questions

1. Identify the group members: same interface subnet, same group number, same virtual IP. If any of those differ, the routers are not peers and you are looking at a misconfiguration, not an election.
2. Decide who is active today: highest priority wins (default 100), and only on a tie does the highest interface IP address decide. If one router was up alone first, it is active regardless of priority unless the other router preempts.
3. Check the P column in show standby brief. No P means no preemption: that router will not take the active role from a working active router, no matter how high its priority is.
4. Walk through the failure: when the active router stops sending hellos for the hold time (10 seconds by default), the standby becomes active and keeps the same virtual IP and virtual MAC, so hosts notice nothing.
5. Walk through the recovery: the returning router joins as standby and stays there unless it has preempt configured and a higher priority than the current active router.
6. Apply tracking last: a tracked interface going down lowers the priority by 10 unless a decrement is given. Failover only happens if the new priority is below the standby's and the standby preempts.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Exhibit

   A PC in VLAN 30 uses 10.20.30.1 as its default gateway. R-North runs HSRP version 1. Based on the exhibit, which destination MAC address does the PC place on frames sent to its gateway?

   R-North# show standby brief
                        P indicates configured to preempt.
                        |
   Interface   Grp  Pri P State   Active          Standby         Virtual IP
   Gi0/1.30    10   110 P Active  local           10.20.30.3      10.20.30.1

   1. 0000.0c07.ac10
   2. 0000.0c9f.f00a
   3. 0000.0c07.ac0a
   4. 0000.5e00.010a
   Show the answer

   Answer: C

   Hosts never learn the real MAC of the active router; they ARP for the virtual IP and receive the virtual MAC. In HSRP v1 that is 0000.0c07.ac plus the group number in hex, so group 10 gives 0000.0c07.ac0a. Because the standby inherits the same MAC on failover, hosts keep working without flushing their ARP caches.

   • A. This would be the virtual MAC of group 16 (0x10). The last byte carries the group number in hexadecimal, and decimal 10 is 0x0a.
   • B. The 0000.0c9f.fXXX prefix belongs to HSRP version 2. R-North runs version 1, so the 0000.0c07.acXX format applies.
   • C. HSRP v1 builds the virtual MAC as 0000.0c07.ac followed by the group number in hex, and group 10 is 0x0a. The PC ARPs for 10.20.30.1 and the active router answers with this address.
   • D. 0000.5e00.01XX is the VRRP virtual MAC format, where XX is the VRID. HSRP never uses this prefix.

2. Question 2 of 10Exhibit

   R-A and R-B share VLAN 20. R-A loses power at 09:00 and is back online with its saved configuration at 09:10. Based on the exhibit taken before the outage, which statement describes the HSRP roles at 09:15?

   R-A# show standby brief
                        P indicates configured to preempt.
                        |
   Interface   Grp  Pri P State   Active          Standby         Virtual IP
   Gi0/0       20   120   Active  local           172.16.20.3     172.16.20.1
   
   R-B# show standby brief
                        P indicates configured to preempt.
                        |
   Interface   Grp  Pri P State   Active          Standby         Virtual IP
   Gi0/0       20   100   Standby 172.16.20.2     local           172.16.20.1

   1. R-B is active and R-A is standby, because neither router is configured to preempt.
   2. R-A is active again, because a priority of 120 always beats 100 once both routers are up.
   3. R-A is active again, because the router that owns the virtual IP returns to active after a reload.
   4. Both routers are active, because R-B does not give up the role and R-A restarts with it.
   Show the answer

   Answer: A

   Without preempt, the first router to become active keeps the role until it fails, whatever the priorities say. R-B became active during the outage and stays active after R-A returns. If you want R-A back in charge after recovery, you need standby 20 preempt on R-A, which would show as a P in the brief output.

   • A. The P column is empty on both routers, so preemption is off. R-B took over when R-A stopped sending hellos and keeps the active role; R-A rejoins the group as standby and waits.
   • B. Priority decides the election only when the active role is not already taken. A working active router is not replaced by a higher-priority router unless that router has preempt configured.
   • C. No router owns the virtual IP in HSRP; 172.16.20.1 belongs to the group. R-A comes back as a new member, hears R-B's hellos and learns that the role is taken.
   • D. HSRP routers exchange hellos on the segment, so R-A hears R-B and does not claim the role. Two active routers point to a configuration mismatch, not to a normal recovery.

3. Question 3 of 10Exhibit

   Hosts in 10.40.8.0/24 report intermittent loss of connectivity to their gateway 10.40.8.1. Both routers show State Active in show standby brief. Based on the exhibit, what is the cause?

   R-East
   interface GigabitEthernet0/2
    ip address 10.40.8.2 255.255.255.0
    standby 5 ip 10.40.8.1
    standby 5 priority 150
    standby 5 preempt
   
   R-West
   interface GigabitEthernet0/2
    ip address 10.40.8.3 255.255.255.0
    standby 6 ip 10.40.8.1
    standby 6 priority 100

   1. R-West lacks the preempt command, so it never settles into the standby role.
   2. Different group numbers make each router run a separate group for the same virtual IP.
   3. R-West's priority of 100 is too low for it to join the group created by R-East.
   4. R-East has preempt enabled while R-West does not, which causes a role flap after each hello.
   Show the answer

   Answer: B

   Two routers that are both Active for the same virtual IP are not peers of each other. Check the group number, the subnet and the virtual IP before you look at priorities. Here the group numbers differ, so each router runs its own group and the hosts see a duplicate gateway that answers with two different MAC addresses.

   • A. Preempt only controls whether a router takes the active role back from a lower-priority peer. A router without it still becomes standby as soon as it hears an active router in its group.
   • B. HSRP peers must share the group number. Group 5 on R-East and group 6 on R-West never see each other as peers, so each becomes active for 10.40.8.1 and two routers answer ARP for the same address with different virtual MACs.
   • C. A lower priority simply makes the router standby. Any priority from 0 to 255 lets a router participate in the group.
   • D. Preempt on one side is a normal design; the higher-priority router takes over once and the roles then stay stable. It does not cause flapping on every hello.

4. Question 4 of 10Config

   R-Core1 and R-Core2 both connect to 192.168.50.0/24. R-Core2 already runs HSRP group 1 with the default priority. You want R-Core1 to be the gateway 192.168.50.1 for the hosts and to take the active role back after it recovers from a failure. Which configuration on R-Core1's LAN interface meets both requirements?

   1. standby 1 ip 192.168.50.1 / standby 1 priority 150 / standby 1 track GigabitEthernet0/0
   2. standby ip 192.168.50.1 / standby 1 priority 150 / standby 1 preempt
   3. standby 1 ip 192.168.50.1 / standby 1 priority 50 / standby 1 preempt
   4. standby 1 ip 192.168.50.1 / standby 1 priority 150 / standby 1 preempt
   Show the answer

   Answer: D

   Being preferred and getting the role back are two separate requirements. Priority above the peer's 100 covers the first; standby 1 preempt covers the second. Keep every command on the same group number, because standby ip without a group silently configures group 0.

   • A. Priority 150 wins the first election, but without preempt R-Core1 stays standby after it recovers. Tracking adjusts priority; it does not restore the active role by itself.
   • B. standby ip without a group number configures group 0, while the priority and preempt apply to group 1. The virtual IP ends up in a different group than the settings meant for it.
   • C. Priority 50 is lower than R-Core2's default of 100, so R-Core1 loses the election and preempt has nothing to take back.
   • D. Priority 150 beats R-Core2's default 100, and preempt lets R-Core1 reclaim the active role when it comes back. All three commands reference the same group.

5. Question 5 of 10Scenario

   R-Edge1 (priority 110) is active and R-Edge2 (priority 105) is standby for HSRP group 3 on the LAN. Both routers have preempt enabled. R-Edge1 is configured with standby 3 track GigabitEthernet0/0, where Gi0/0 is its WAN link. The WAN link on R-Edge1 goes down. What happens?

   1. R-Edge1 stays active; tracking only logs the event unless a decrement value is set.
   2. R-Edge1's priority drops to 100 and R-Edge2 preempts, becoming active.
   3. R-Edge1's priority drops to 0 and it leaves the group until Gi0/0 recovers.
   4. R-Edge2 becomes active only if R-Edge1's LAN interface also goes down.
   Show the answer

   Answer: B

   Interface tracking lowers the priority by 10 by default when the tracked interface goes down. Failover then depends on two things: the new priority must be below the standby's, and the standby must have preempt. Here 110 - 10 = 100 is below 105 and R-Edge2 preempts, so the design works. With priorities 110 and 95, the same failure would change nothing.

   • A. The track command decrements priority by 10 when no value is given. There is no log-only mode for interface tracking.
   • B. The default decrement is 10, so 110 becomes 100, which is below R-Edge2's 105. Because R-Edge2 has preempt, it takes the active role and hosts keep a gateway with a working WAN path.
   • C. Priority 0 would require an explicit decrement of 110. The router stays in the group with a reduced priority; it does not withdraw.
   • D. Tracking exists precisely so that a failure elsewhere on the router can hand over the gateway role while the LAN interface is still up.

6. Question 6 of 10Scenario

   R-Blue (10.70.1.2) and R-Green (10.70.1.3) are configured for HSRP group 7 with virtual IP 10.70.1.1. Neither router has a priority or preempt command. After a power cut, R-Blue boots and has been active for two minutes when R-Green finishes booting. Which router is active once both are up?

   1. R-Blue, because it was already active and R-Green does not preempt.
   2. R-Green, because with equal priority the higher IP address wins.
   3. R-Green, because it has the higher IP and HSRP preempts by default.
   4. Neither, because an election cannot complete without a priority set.
   Show the answer

   Answer: A

   The highest-IP tiebreaker is real, but it applies to an election, not to a running group. A router that boots alone becomes active, and a later router with equal priority and no preempt stays standby. On the exam, read the boot order as carefully as the priorities.

   • A. Both routers have the default priority 100 and no preempt. R-Blue was alone, became active, and R-Green joins as standby because a non-preempting router never challenges an existing active router.
   • B. The higher IP address breaks a priority tie only during an election, when both routers are up at the same time and no router is active yet. Here the role was already taken.
   • C. Preemption is off by default in HSRP. The higher IP would matter only if R-Green had been configured with standby 7 preempt.
   • D. Priority defaults to 100, so the election works without any priority command. A router with no peer simply becomes active after its timers expire.

7. Question 7 of 10Scenario

   Two routers run HSRP group 1 on VLAN 60. Each LAN interface has an inbound ACL that permits traffic to 10.60.4.0/24 and permits UDP to 224.0.0.2 port 1985, denying everything else. During a change window both routers were configured with standby version 2. Afterwards both show State Active. What is the most likely cause?

   1. Version 2 requires the group number to be 256 or higher, so group 1 is no longer valid.
   2. Version 2 changes the virtual MAC, and the switches still forward hellos to the old address.
   3. Version 2 turns off preemption, so the routers can no longer agree on a single active router.
   4. Hellos now go to 224.0.0.102, which the ACL drops, so neither router hears the other.
   Show the answer

   Answer: D

   Two routers that are both Active usually means they cannot hear each other's hellos. After a version change, the first thing to check is the multicast address: v1 uses 224.0.0.2 and v2 uses 224.0.0.102. Any ACL or filter written for v1 must be updated, or the group splits in two.

   • A. Version 2 extends the group range to 0-4095; it does not remove the low numbers. Group 1 is valid in both versions.
   • B. The virtual MAC does change to 0000.0c9f.f001, but hellos are IP multicast sent from the real interface address. Switches flood them regardless of the HSRP MAC.
   • C. The version command does not touch preemption. Preemption is off by default in both versions unless it is configured.
   • D. HSRP v1 uses 224.0.0.2 and v2 uses 224.0.0.102, both on UDP 1985. The ACL still permits only the v1 address, so hellos are dropped and each router believes it is alone.

8. Question 8 of 10Concept

   Which statement correctly describes a difference between VRRP and HSRP?

   1. VRRP is Cisco-proprietary, while HSRP is defined in an open RFC that any vendor can implement.
   2. VRRP uses active and standby roles, while HSRP uses master and backup roles.
   3. VRRP preempts by default and can use a real interface address as the virtual IP, unlike HSRP.
   4. VRRP builds its virtual MAC as 0000.0c07.acXX, while HSRP uses 0000.5e00.01XX.
   Show the answer

   Answer: C

   HSRP and VRRP solve the same problem with different vocabulary and different defaults. VRRP is the open standard, uses master/backup, preempts by default and may reuse a real interface IP as the virtual address. HSRP is Cisco-proprietary, uses active/standby, does not preempt by default and requires a dedicated virtual IP.

   • A. It is the other way around: HSRP is Cisco-proprietary and VRRP is the open standard, currently RFC 5798.
   • B. The names are swapped. HSRP speaks of active and standby routers; VRRP speaks of master and backup routers.
   • C. VRRP enables preemption by default and allows the virtual IP to be the master's own interface address, in which case that router runs with priority 255. HSRP has preemption off by default and needs a separate virtual IP.
   • D. The formats are swapped. 0000.0c07.acXX is the HSRP version 1 virtual MAC; 0000.5e00.01XX is VRRP, with XX being the VRID.

9. Question 9 of 10Concept

   Which two statements about first-hop redundancy protocols are true? (Choose two.)

   1. GLBP allows several routers to forward traffic for one virtual IP at the same time.
   2. GLBP is an open standard, so routers from different vendors can share one group.
   3. In HSRP and VRRP, only one router per group forwards traffic for the virtual IP.
   4. VRRP backup routers forward a share of the traffic while the master handles ARP.
   5. HSRP version 2 and VRRP use the same virtual MAC address format, 0000.5e00.01XX.
   Show the answer

   Answer: A and C

   HSRP and VRRP give you redundancy with one forwarding router per group; GLBP adds load balancing inside a single group through the AVG and its AVFs. Of the three, only VRRP is an open standard. Keep the three virtual MAC prefixes apart: 0000.0c07.acXX for HSRP v1, 0000.0c9f.fXXX for HSRP v2 and 0000.5e00.01XX for VRRP.

   • A. The active virtual gateway (AVG) answers ARP for the virtual IP with different virtual MACs, so hosts are spread across up to four active virtual forwarders (AVFs) that all pass traffic at once.
   • B. GLBP is Cisco-proprietary, like HSRP. VRRP is the open standard among the three.
   • C. The active router in HSRP or the master in VRRP owns the virtual MAC and does all the forwarding; the others wait to take over. Sharing load across routers needs multiple groups.
   • D. VRRP backups do not forward for the virtual IP while the master is up. Spreading traffic across routers within one group is what GLBP adds.
   • E. HSRP v2 uses 0000.0c9f.fXXX and VRRP uses 0000.5e00.01XX. Each protocol has its own reserved prefix.

10. Question 10 of 10Config

    Your design standard assigns HSRP group numbers that match the VLAN ID. VLAN 300 needs the virtual gateway 10.30.0.1 on R-Agg1. Which configuration is accepted by IOS and follows the standard?

    1. interface Vlan300 / standby 300 ip 10.30.0.1 / standby 300 priority 110
    2. interface Vlan300 / standby version 2 / standby 300 ip 10.30.0.1
    3. interface Vlan300 / standby 300 version 2 / standby 300 ip 10.30.0.1
    4. interface Vlan300 / standby 44 ip 10.30.0.1 / standby 44 name VLAN300
    Show the answer

    Answer: B

    HSRP v1 stops at group 255. Any design that maps group numbers to VLAN IDs above 255 needs standby version 2 on the interface first, which also moves hellos to 224.0.0.102 and the virtual MAC to 0000.0c9f.fXXX. Both routers in the group must run the same version.

    • A. HSRP version 1 only allows groups 0-255, so IOS rejects group 300 as out of range until version 2 is enabled on the interface.
    • B. standby version 2 raises the group range to 0-4095 and must be entered before the group command. Group 300 then matches the VLAN and the virtual IP is set.
    • C. The version is set per interface, not per group, so standby 300 version 2 is not valid syntax. Without a valid version 2 command, group 300 stays out of range.
    • D. This configuration is accepted, but group 44 breaks the rule that the group number matches the VLAN. The name string is a label and does not change the group number.

Common mistakes

• Assuming the original active router takes its role back when it recovers. HSRP does not preempt by default; the recovered router becomes standby.
• Writing the group number in decimal inside the virtual MAC. Group 10 gives 0000.0c07.ac0a in HSRP v1, not 0000.0c07.ac10.
• Expecting tracking to cause a failover on its own. The default decrement of 10 must push the priority below the standby's value, and the standby needs preempt.
• Mixing up the multicast addresses and group ranges of the two HSRP versions: v1 uses 224.0.0.2 and groups 0-255; v2 uses 224.0.0.102 and groups 0-4095.
• Swapping the role names and defaults of HSRP and VRRP. HSRP is active/standby with preempt off; VRRP is master/backup with preempt on and is the open standard.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains