CCNP ENARSI 300-410 practice questions, every option explained

Answer: C. The routers reach FULL, but SPF cannot use the link, so no routes cross it. Each router describes the link differently in its router LSA: R1 as a point-to-point link to R2, R2 as a transit link to a DR network. SPF requires both ends to describe the same link (the two-way check), so the databases synchronize but no routes through the link are installed. OSPF never compares network types in the hello, so a point-to-point/broadcast mismatch with equal timers still reaches FULL. The damage shows afterwards: the two router LSAs describe the link in incompatible ways and SPF ignores it. When neighbors are FULL but routes are missing, compare show ip ospf interface on both ends.

Answer: A. PE2 advertises label 0 for its loopback, so P2 swaps the top label to 0 and PE2 still reads the TC bits. Explicit null (label 0 for IPv4) replaces the implicit null PE2 advertised before. P2 now swaps the top label to 0 instead of popping it, so the packet reaches PE2 still labeled, with the TC bits set in the core; PE2 then removes label 0 and continues with the next label or the IP lookup. Label 3 (implicit null) is a signal, never a label on the wire: it tells the penultimate hop to pop. Label 0 (explicit null for IPv4, label 2 for IPv6), advertised after mpls ldp explicit-null, makes the penultimate hop swap to 0 instead, so the egress LER still receives a labeled packet and can use its TC bits before it pops label 0.

Answer: B. The RADIUS username, but nothing inside the TACACS+ packet bodies. RADIUS protects only selected attributes such as User-Password, so User-Name, the NAS address and the other attributes are in clear text. TACACS+ XORs the entire body with an MD5-based pad derived from the shared secret; only its 12-byte header (version, type, sequence number, flags, session ID, length) stays readable. TACACS+ (TCP 49) protects the whole payload, so usernames, authorized commands and accounting records are hidden from a capture. RADIUS (UDP 1812/1813) hides only the password and a few other attributes. That, plus TACACS+'s separate handling of authentication, authorization and accounting, is why device administration usually runs on TACACS+ and network access on RADIUS.

Answer: C. Export packets now carry version number 10 and still describe the data with templates, as v9 does. IPFIX was standardized from NetFlow v9: its message header carries version 10, and data sets are still described by template sets that the exporter sends to the collector. NetFlow v5 has a fixed, IPv4-only format; v9 (RFC 3954) introduced templates so that any set of fields can be exported; IPFIX (RFC 7011), with version number 10, standardizes v9 and adds variable-length and enterprise fields. In Flexible NetFlow the record stays the same and only the exporter's export-protocol changes.

Answer: C. TCP is up, R1 accepted the peer's OPEN, sent a KEEPALIVE and waits for one. In OpenConfirm the OPEN exchange is done: R1 checked the peer's OPEN (AS, BGP identifier, hold time) and sent a KEEPALIVE. The peer's KEEPALIVE moves it to Established; a NOTIFICATION or hold-timer expiry sends it back to Idle. BGP states in order: Idle (not trying, or blocked), Connect (TCP being opened), Active (TCP attempt failed, retrying and listening), OpenSent (own OPEN sent, waiting for the peer's), OpenConfirm (OPENs exchanged, waiting for a KEEPALIVE) and Established. A neighbor stuck in Connect or Active has a TCP problem; one that reaches OpenSent and falls back has an OPEN problem, such as a wrong AS.