1. Q1. A VyOS router holds 10.0.0.0/8 learned from OSPF and 10.5.0.0/16 learned from iBGP. Both are present in `show ip route`. A packet arrives destined for 10.5.3.9. Which entry forwards it, and why?

   The OSPF /8, because its administrative distance of 110 is lower than the iBGP distance of 200 and distance is compared first The OSPF /8, because iBGP paths at distance 200 stay in the BGP table and are never offered to the kernel forwarding table The iBGP /16, because longest-prefix match runs before anything else and distance only separates routes for the same prefix The iBGP /16, because BGP carries an explicit next-hop while OSPF next-hops are recursive and are resolved after distance

2. Q2. Two 1G links to the same upstream are installed as ECMP next-hops for the same prefix. An engineer runs a single `iperf3` TCP stream across them and measures 940 Mbit/s, then reports that ECMP is broken. What is actually happening?

   One next-hop is administratively preferred, so the second path is a standby that only begins to carry traffic after a link failure The hash is recomputed per packet, so reordering forces TCP into congestion avoidance and caps the stream near one link Both paths are in use but the reply traffic returns over one link only, which limits the measured throughput to 1G Linux hashes per flow, so every packet of one TCP connection takes the same next-hop and one stream can never exceed one link

3. Q3. An IPv6 router that receives a packet larger than the outgoing interface MTU drops it and returns ICMPv6 Packet Too Big rather than fragmenting it.

   True False

4. Q4. An engineer fixes an OSPF cost during an incident by running `vtysh` on the router and issuing the FRR commands directly. Traffic moves, the incident closes. The router is rebooted three weeks later during a maintenance window and the old cost is back. What explains this?

   VyOS renders the FRR configuration from its own tree, so a vtysh change is not represented anywhere the router reloads from FRR wrote the change to its own configuration file but VyOS clears that file at boot before the routing daemons are started The change was applied to the running OSPF process only, because vtysh cannot write to disk while the VyOS commit engine holds its lock OSPF costs are recalculated from interface bandwidth at every reboot, so any manually configured cost is discarded on restart

5. Q5. Booting the VyOS ISO gives a running system, but the configuration is not persistent until the image is installed to disk with `install image`.

   True False

6. Q6. A remote change has broken BGP. The operator, still logged in, runs `configure` then `rollback 1`, sees the previous configuration echoed back, and reports the change reverted. Monitoring still shows the session down twenty minutes later. Why?

   The archive entry selected by `rollback 1` is the configuration that contained the broken change rather than the one committed before it The rollback loaded the archived configuration into the candidate only, and without a `commit` the running configuration never changed A rollback cannot revert a change that has already been written to disk by `save`, so the broken configuration is still authoritative The rollback did commit, but BGP sessions are not re-established by a commit and the neighbour has to be cleared by hand

7. Q7. An operator changes the WAN addressing over SSH using `commit-confirm 10`, is disconnected immediately, and cannot reach the router. Twelve minutes later the router is reachable again on the old address. Which statement describes the guarantee that was and was not provided?

   The timer restored connectivity, and it would also have restored it if the router had crashed and rebooted before the timer expired The timer restored connectivity, and the previous configuration is now also the saved configuration because the rollback rewrote config.boot The timer restored connectivity only because the operator was disconnected; a session that stays open cancels the timer automatically The timer restored connectivity, but it protects against a wrong change only — a crash before `confirm` leaves the change in place

8. Q8. A junior engineer adds a firewall rule, runs `commit`, sees it take effect, then types `exit` and logs out. A planned power event reboots the router that night. What is the state of the rule after the reboot?

   Gone: `commit` changed only the running configuration, and the router boots the unchanged /config/config.boot Present: `exit` from configure mode writes the running configuration to /config/config.boot as part of leaving the session Gone: the rule was left in the candidate configuration because `commit` alone does not promote a rule to the running set Present: the commit archive is replayed at boot, so any committed change is restored even when it was never explicitly saved

9. Q9. Running `commit` writes the new configuration to /config/config.boot, so a separate `save` is only needed when exporting the configuration to another path.

   True False

10. Q10. A VyOS router has `set interfaces ethernet eth1 vif 100 address 10.10.100.1/24` committed. The interface eth1.100 shows up/up, but hosts in VLAN 100 cannot reach the gateway and the router sees no ARP for 10.10.100.1. What is the most likely cause?

    The parent interface eth1 has no IP address, and a VLAN sub-interface cannot pass traffic while its parent is unaddressed The sub-interface number and the 802.1Q tag are independent, so `vif 100` has to be given an explicit tag before it forwards The switch port is an access port, so every frame the router tags with VLAN 100 is discarded by the switch VLAN sub-interfaces inherit the parent MTU, and a tagged frame is four bytes larger, so every frame exceeds the link MTU

11. Q11. Two links go to an access switch that the network team does not manage and that has no port-channel configured. The requirement is that the router survives the loss of either link, with no requirement for extra bandwidth. Which bonding mode fits, and why?

    802.3ad, because LACP negotiates the aggregation with the switch and falls back to a single active link when the switch does not answer balance-rr, because round-robin needs no switch state and the switch simply learns the shared MAC on whichever port a frame arrives balance-xor, because the transmit hash is a local decision and the switch is only required to forward the frames it receives active-backup, because only one slave is active at a time so the switch sees a single MAC on a single port and needs no configuration

12. Q12. An operator lowers the MTU on a transit interface from 1500 to 1400 to work around a downstream problem. Within a minute the OSPF adjacency on that interface drops out of Full. Which explanation fits the evidence?

    OSPF recomputes interface cost from bandwidth, and the lower MTU changed the cost enough to trigger a full SPF and a reset The Database Description packets carry the interface MTU and the far side now rejects them, so the adjacency cannot get past EXSTART Lowering the MTU below 1500 makes the OSPF Hellos exceed the link MTU, so the neighbour stops receiving them and declares the peer down The interface was reinitialised by the MTU change, which cleared the neighbour table and required an authentication renegotiation

13. Q13. A dual-stack LAN needs every host to get an IPv6 address automatically, plus a DNS server, plus a record of which host holds which address for audit. Which combination delivers all three?

    Router Advertisements alone, because the RA carries the prefix, the RDNSS option, and the router builds the address record from Neighbour Discovery Stateless DHCPv6 alone, because it assigns addresses from a pool and supplies DNS while the router advertises only the default gateway Router Advertisements with the managed flag set plus stateful DHCPv6, so addresses come from a server that holds the lease database Static addressing on every host, because neither SLAAC nor DHCPv6 can record an address-to-host mapping in a form suitable for audit

14. Q14. `set protocols static route 172.16.0.0/16 next-hop 10.9.9.1` is committed with no error. `show configuration` shows the route. `show ip route 172.16.0.0/16` shows nothing at all. What is the first thing to check?

    Whether the router has any route that covers 10.9.9.1, because a static route is only installed once its next-hop resolves Whether a route-map is filtering the static route, because static routes pass through outbound policy before installation Whether another protocol holds 172.16.0.0/16 with a lower administrative distance and has therefore suppressed the static route Whether the static route needs an explicit distance, because a static route with no distance is held back until one is configured

15. Q15. A summarising router advertises 192.0.2.0/22 to its upstream but only actually reaches 192.0.2.0/24 and 192.0.3.0/24. Traffic for 192.0.1.100 arrives, misses both specifics, matches the default route, and returns to the upstream, which sends it back. Which change stops the loop?

    Withdraw the aggregate and advertise only the two specifics, because a summary can never be advertised without covering every address in it Add an inbound prefix-list on the upstream session that rejects 192.0.2.0/22, so the router stops learning its own aggregate back Raise the administrative distance of the default route above 200 so that the more specific upstream routes win the lookup instead Configure `set protocols static route 192.0.2.0/22 blackhole` so unmatched traffic inside the aggregate is discarded locally

16. Q16. Policy-based routing was added to send guest-VLAN traffic out the secondary WAN. After the commit, management traffic sourced from the router itself also leaves via the secondary WAN and the monitoring system loses the router. What is the most likely mistake?

    The route-map was bound to the wrong interface, so the rule matches on egress instead of ingress and catches locally generated packets The secondary WAN has a lower metric than the primary, so once a policy table exists the kernel prefers it for every unmatched lookup The rule matched more broadly than intended, and policy rules are consulted in priority order ahead of the main table Policy routing on VyOS applies to the local output path by default and has to be disabled explicitly for router-originated traffic

17. Q17. A tenant VRF is being built with `set vrf name CUST-A table 1001`, `set interfaces ethernet eth3 vrf CUST-A`, and `set interfaces ethernet eth3 address 10.1.0.1/24`. After the commit, pings from the router to 10.1.0.2 fail with "Network is unreachable" even though the interface is up. What is the operator most likely missing?

    The VRF needs a route-target so that the connected prefix is imported into its own table before it can be used for anything locally The connected route is in table 1001, so the ping has to be issued inside the VRF rather than from the default routing table The interface must be removed from the VRF before it can be addressed, because address and VRF membership cannot coexist The VRF table id 1001 collides with a reserved kernel table, so the connected route was silently dropped at commit time

18. Q18. Once an interface is bound to a VRF, prefixes in that VRF become reachable from the default routing table automatically, because both tables live in the same kernel.

    True False

19. Q19. `show ip ospf neighbor` on both routers of a point-to-point link shows the peer present, state EXSTART, dead timer counting normally, router IDs distinct, and both interfaces in area 0. What is the diagnosis?

    An OSPF authentication mismatch, since the Hellos are accepted but the Database Description packets fail the digest check A hello and dead timer mismatch, since the neighbour is visible but the two routers disagree about how long to wait An interface MTU mismatch, since the Database Description packets carry the sending MTU and the larger one is discarded An OSPF network type mismatch, since point-to-point on one side and broadcast on the other prevents master and slave election

20. Q20. A new router is cabled into an existing OSPF segment. Hellos are visible in `tcpdump -ni eth1 proto ospf` in both directions, but `show ip ospf neighbor` on both routers is empty and stays empty. Which family of causes does this evidence point at?

    A mismatch in a Hello-validated parameter — area ID, timers, authentication, area type — so each side discards the Hello An MTU mismatch on the segment, because the Database Description exchange fails before either router can record the neighbour A duplicate router ID, because two routers claiming one ID cannot be entered into a neighbour table by the other at all A missing network statement, because an interface with no area assignment sends Hellos but discards every Hello it receives

21. Q21. Two VyOS routers are the only OSPF speakers on a /30 transit link. The adjacency forms and works, but convergence after a link failure is slower than the operator expects and `show ip ospf interface` reports a DR and a BDR on the segment. What is the appropriate change?

    Set the OSPF priority to 0 on one router so that it cannot become DR and the election resolves faster on the segment Reduce the hello interval to 1 second on both routers so that the DR election can complete within the first second of the outage Leave it alone: DR and BDR election on a two-router segment costs nothing because both routers become fully adjacent anyway Set `set protocols ospf interface eth1 network point-to-point` on both routers, which removes the election and the Type 2 LSA

22. Q22. A LAN-facing interface is inside the OSPF area so its prefix is advertised. A security review objects that OSPF Hellos are being sent to a user segment where no router should exist. What is the correct change?

    Remove the interface from OSPF and redistribute its connected route instead, which advertises the prefix without sending Hellos Make the interface passive, which stops Hellos and adjacency formation while the prefix stays advertised as an internal route Apply an inbound OSPF authentication key on that interface so that Hellos from unauthorised routers are discarded on arrival Put the interface in a stub area, which suppresses Hellos on user-facing links while keeping the prefix inside the area

23. Q23. Area 20 is configured as a stub. A default route reaches routers inside it and inter-area routes are visible, but a prefix redistributed into OSPF from BGP at an ASBR in area 0 never appears. Is this correct behaviour, and why?

    Correct: a stub area does not carry Type 5 external LSAs, and the ABR replaces them with a default route into the area Incorrect: a stub area blocks only Type 4 ASBR summary LSAs, so the external prefix should still arrive as a Type 5 Correct: redistributed prefixes are only flooded within the area of the ASBR, so no area other than area 0 ever receives them Incorrect: the redistribution is missing a metric-type, and without one the external route is originated but never flooded

24. Q24. Two OSPF routers configured with the same router ID can exchange Hellos and reach 2-Way but cannot complete the Database Description exchange.

    True False

25. Q25. Select every mismatch that stops an OSPF neighbour from ever being entered in the neighbour table at all, rather than allowing it to appear and then stall in a later state.

    Different area IDs configured on the two interfaces facing the link Different interface MTUs configured on the two ends of the link Different hello and dead intervals configured on the two interfaces The same OSPF router ID configured on both of the routers One interface in a stub area and the other in a standard area

26. Q26. An iBGP session between two border routers is Established. Routes learned from the external peer on R1 appear on R2 in `show ip bgp` but are never installed. The next-hop shown on R2 is the external peer address, which R2 has no route to. What is the standard fix?

    Redistribute the external transit subnet into the IGP so that the address of the external peer becomes reachable from R2 Add a static route on R2 for the external peer address pointing at R1, so the recursive next-hop lookup resolves Enable `ebgp-multihop` on the external session so that the next-hop is rewritten to a locally reachable address Set `next-hop-self` on the iBGP session on R1, so R1 advertises its own address as the next-hop for external routes

27. Q27. Two eBGP paths for the same prefix arrive: path A has local-preference 200 and an AS path of four hops, path B has local-preference 100 and an AS path of two hops. Everything else is equal. Which path wins and why?

    Path A, because local preference is compared before AS path length and the first step that differs ends the comparison Path B, because AS path length is the shortest-path metric and takes precedence over any locally configured preference Path B, because local preference applies only to iBGP-learned paths and is ignored for paths received from an eBGP peer Neither: the paths differ on two attributes, so both are installed and the traffic is shared across the pair by ECMP

28. Q28. An operator asks an upstream to raise the MED on one of two links so that traffic prefers the other. The change is made and nothing moves. The two links terminate on two different upstream autonomous systems. What explains the result?

    MED is a non-transitive attribute, so it is stripped at the first eBGP hop and never reaches the local router at all MED is evaluated before local preference, so an existing local-preference policy on the sessions has already decided MED is compared only between paths received from the same neighbouring AS unless comparison is explicitly widened MED is only consulted after the IGP cost tie-break, so a difference in IGP cost to the two next-hops decided first

29. Q29. `show ip bgp summary` reports a neighbour cycling between Idle and Active, never reaching OpenSent. The peer address is pingable from the router. What does that combination point at?

    A remote-as mismatch, because the ASN in the OPEN message is rejected and the session restarts from Idle each time A hold-time mismatch, because the two speakers cannot agree a common hold time and the session resets after each attempt An address-family that is configured on one side only, because the capability negotiation fails and both ends drop the session A TCP problem on port 179 — a filter, a wrong update-source, or no route back — because Active means the handshake is failing

30. Q30. A prefix appears in `show ip bgp 198.51.100.0/24` marked `*>` on the local router, but `show ip route 198.51.100.0/24` returns nothing. Which stage of the BGP-to-kernel path has failed, and what is the first check?

    Selected but not installed: the best path exists, so check whether the next-hop address is itself resolvable locally Not received: the peer never advertised it, so check the inbound side with `show ip bgp neighbors <ip> received-routes` Not selected: the best-path algorithm rejected the path, so compare the attributes of each candidate path for the prefix Not advertised: the outbound policy dropped it, so check `show ip bgp neighbors <ip> advertised-routes` on the sending router

31. Q31. An eBGP session between two routers that are not directly connected fails to establish unless multihop or a source-interface arrangement is configured, because eBGP sends its packets with a TTL of 1 by default.

    True False

32. Q32. A customer prefix 203.0.113.0/24 is configured for origination with `set protocols bgp address-family ipv4-unicast network 203.0.113.0/24`. The session is Established but the prefix is never advertised. The router has connected routes for 203.0.113.0/25 and 203.0.113.128/25. What is wrong?

    The two /25 routes are connected, and connected prefixes must be pulled in with `redistribute connected` before origination works The prefix has to be advertised from the address family of the peer rather than from the global address-family stanza The network statement needs an exact match in the routing table, and no route for the /24 itself exists — only its two halves The network statement originates a prefix only when it is also covered by an aggregate-address entry for the same range

33. Q33. An inbound filter should accept 10.0.0.0/8 and any more specific inside it down to a /24, and reject anything longer. Which prefix-list rule expresses that?

    action permit, prefix 10.0.0.0/8, with neither `ge` nor `le`, since a prefix-list entry matches the range beneath it by default action permit, prefix 10.0.0.0/8, `le 24` only, since `le` alone sets the maximum and the minimum defaults to the /8 itself action permit, prefix 10.0.0.0/8, `ge 24` only, since `ge` sets the shortest acceptable length and there is no longer bound action permit, prefix 10.0.0.0/8, `ge 9` and `le 24`, since the pair sets the inclusive length range the entry will match

34. Q34. A peering session carries about 900 prefixes normally. `maximum-prefix 2000` is configured. During an incident the peer briefly announces 40 000 prefixes, the session shuts down, and it is still down two hours later when nobody is on call. Which change addresses that specific outcome?

    Raise the limit to a value the peer cannot exceed, so the safeguard never fires and the session cannot be taken down by a leak Add `restart` with an interval, so the session is shut down on a breach and brought back automatically after that interval Switch the safeguard to `warning-only`, so a breach is logged and the session is never interrupted by a transient leak Lower the limit close to the normal count, so a breach is detected sooner and the session recovers before the leak propagates

35. Q35. With `maximum-prefix` configured and no other options, a peer that exceeds the limit causes a log message while the session stays up.

    True False

36. Q36. An AS has grown to fourteen iBGP speakers and prefixes learned by one border router are missing on several others. The full mesh was never completed after the last three routers were added. Which statement explains the symptom?

    An iBGP speaker may not re-advertise a route learned from another iBGP peer, so it reaches only routers peered with its source iBGP paths carry an administrative distance of 200, so they lose to the IGP on any router that also learns the prefix from OSPF iBGP requires every speaker to share one cluster ID, and routers added later without it are treated as belonging to a separate cluster iBGP advertisements are limited by the AS path loop check, so a route is dropped once it has traversed the local AS number once

37. Q37. A dual-homed enterprise AS has no outbound policy on either transit session. Both upstreams complain that traffic between them is now transiting the enterprise. What is the root cause and the correct remedy?

    The upstreams are sending full tables, so the remedy is to request default-only sessions and drop the received prefixes The two sessions share a local preference, so the remedy is to raise it on one transit so that only one is ever preferred The enterprise is using private AS numbers, so the remedy is to strip them outbound so upstreams stop treating it as transit A router re-advertises to one eBGP peer what it learned from another; the remedy is an outbound prefix filter

38. Q38. A customer-facing eBGP session is being turned up on a production border router. Select every control that belongs on the session before the customer is allowed to announce.

    Leave the outbound filter off until the customer confirms that their registered prefix set is complete An inbound prefix-list permitting only the prefixes the customer is registered to originate Configure `ebgp-multihop 2` so that the session survives a change of path between the two routers A `maximum-prefix` limit sized against the expected announcement, so a leak stops at this router Enable `always-compare-med` so that the customer cannot influence path selection with MED

39. Q39. A transit link fails in a way that keeps the interface up on both ends — a fault inside the carrier transport network. The BGP session over it stays Established and traffic blackholes for three minutes. What is the appropriate production control?

    Reduce the BGP hold time to a few seconds on that session, which is the supported way to detect a silent transport failure Enable BFD on the session so a sub-second detector tears down the peering as soon as the bidirectional path stops working Add a floating static route with a higher distance, so the failure is bypassed as soon as the BGP path stops carrying traffic Enable ECMP across both transit links, so a silent failure on one is absorbed by the hash redistributing to the other one

40. Q40. BFD detects that a peer has stopped forwarding and signals the routing protocol, but it never advertises a route or selects a path itself.

    True False

41. Q41. An estate redistributes OSPF into BGP and BGP into OSPF at two different border routers, with no route-map on either. Prefixes begin appearing with unexpected metrics and a handful oscillate. What is the mechanism, and the standard control?

    Routes cross into the other protocol, return through the second border router, and are redistributed again; tag on injection and filter on the return Redistribution copies the administrative distance with the route, so the copies compete with the originals; set an explicit distance on each direction Two-way redistribution doubles the update rate on both protocols and overloads SPF; rate-limit the redistribution with a timer on each router Redistributed routes are external, so they lose to internal routes everywhere; raise the external metric type so the copies are preferred

42. Q42. Two eBGP paths to the same prefix arrive from two different upstream autonomous systems, both with two-hop AS paths and identical everything else. `maximum-paths 2` is configured and `show ip route` still shows a single next-hop. Why?

    Multipath applies only to iBGP-learned paths, so eBGP paths from different neighbours are never installed as a set Multipath requires the two paths to have the same MED, and MED is not comparable between two different upstream AS numbers Multipath requires identical AS path attributes rather than equal length, so different AS numbers need `multipath-relax` Multipath requires an equal IGP cost to both next-hops, and two external next-hops on different links can never have an equal cost

43. Q43. A DNAT rule forwards TCP 443 from the WAN address to an internal server at 10.0.10.20. A forward-filter rule permitting TCP 443 to the WAN address is committed alongside it. Connections still fail. What is wrong?

    The firewall runs after DNAT, so the rule has to permit traffic to 10.0.10.20 rather than to the WAN address The firewall runs before DNAT, so the rule matches but the packet is discarded again at the post-routing hook The rule is on the wrong hook: inbound traffic to a translated destination is evaluated by the input filter, not the forward filter The DNAT rule needs a matching SNAT rule so that the reply leaves with the WAN address, and without it the firewall drops the reply

44. Q44. A branch router with a DHCP-assigned WAN address uses `set nat source rule 100 translation address 203.0.113.45`. Everything works for weeks, then all outbound traffic stops after an ISP maintenance window. What happened and what is the durable fix?

    The ISP began filtering the source address; request a static assignment from the provider and keep the explicit translation address The WAN lease was renewed with a different address, so the rule now translates to an address the router does not hold; use `masquerade` instead Conntrack entries survived the maintenance and still reference the old address; flush the connection table and the existing rule resumes working The DHCP client replaced the default route, so the rule no longer matches; bind the rule to the outbound interface as well as the address

45. Q45. A ruleset has an accept for established and related traffic at rule 10, an accept for the whole management subnet at rule 20, a drop for a specific compromised host at rule 30, and `default-action drop`. The compromised host is inside the management subnet and its traffic is still being accepted. What is the correct change?

    Change the default action to reject, so that traffic which is not explicitly matched is refused rather than silently dropped Add a drop for the host on the output filter as well, since a rule on one hook cannot stop traffic already accepted on another Renumber the drop so it is evaluated before the subnet accept, because evaluation stops at the first matching rule Add `state new` to the subnet accept, so that established flows from the host are re-evaluated against the later drop rule

46. Q46. Select every statement that correctly describes how the VyOS 1.5 firewall and NAT subsystems process a forwarded packet.

    Source NAT is applied in PREROUTING, so the firewall sees the translated source address A named ruleset takes effect as soon as it is committed, whether or not any hook jumps to it Destination NAT is applied before the routing decision, so the packet is routed on its translated destination The firewall sees the packet after DNAT and before SNAT, so an inbound rule must match the internal address Rules inside a ruleset are evaluated in descending rule number, so the highest number is matched first

47. Q47. A stateful firewall handles asymmetric routing correctly, because the connection tracking table is consulted independently of which interface a packet arrives on.

    True False

48. Q48. A multi-WAN failover uses a ping health check against the ISP handoff address on the far side of the WAN link. The ISP suffers an upstream outage: the handoff still answers, nothing else does. What does the design do, and what should it have done?

    It fails over correctly, because losing upstream reachability withdraws the default route and the health check follows it It fails over late, because the probe interval is too long; the target is sound and only the timing needs to be shortened It flaps, because both WANs are probed from the same source address and the health checks interfere with one another It never fails over: the probe target sits inside the failure domain; probe beyond it, from two targets

49. Q49. A VRRP pair fails over. Hosts on the LAN keep their ARP entry for the gateway and traffic resumes within a few seconds, but a monitoring probe on the access switch records the gateway MAC moving ports. What is happening?

    The backup takes the physical MAC of its own interface and the hosts silently relearn it from the first reply they receive The backup uses a MAC derived from its own priority value, so the switch has to age the previous entry before traffic resumes The group owns a virtual MAC that moves with the master role, so host ARP stays valid and only the switch has to relearn the port The virtual IP is re-advertised by ARP from both of the routers during the transition, so the switch sees the MAC on two ports at once

50. Q50. A VRRP pair provides the gateway for a user VLAN. The uplink on the master fails while its LAN interface stays up. The master keeps advertising, the backup stays backup, and the LAN loses all off-network connectivity. What is missing?

    Preemption on the backup, so that it can take over the master role when it detects that traffic has stopped flowing through the pair Tracking on the master, so that losing the uplink lowers its priority and hands the master role to the router that still has one A shorter advertisement interval, so that the backup detects the degraded state of the master inside a single second A second VRRP group on the uplink side, so that the uplink failure is signalled to the LAN group through the shared virtual IP

51. Q51. VRRP failover preserves established NAT translations and firewall sessions, because the backup takes over the same virtual IP that the flows were using.

    True False

52. Q52. A WireGuard site-to-site tunnel shows a recent handshake on both routers and the tunnel interface addresses ping each other. Traffic between the two LANs, 10.10.0.0/16 and 10.20.0.0/16, does not pass in either direction. What is the most likely cause?

    The peer `allowed-ips` lists cover only the tunnel subnet, so neither router routes the LAN prefixes over it The pre-shared key is configured on one side only, so the data packets fail authentication while the handshake still completes The listening port differs between the two peers, so the handshake succeeds outbound but data packets are dropped inbound The tunnel MTU is at its default, so the LAN traffic exceeds the encapsulated size and is discarded before it is encrypted

53. Q53. A site-to-site IPsec deployment currently uses policy-based tunnels with a traffic-selector pair per subnet. The estate is about to add subnets regularly and wants OSPF to run across the tunnel. What should change and why?

    Keep policy-based mode and add a selector pair per subnet as it is created, because selectors are evaluated before the routing table Keep policy-based mode but redistribute connected routes at each end, so new subnets are advertised without new selectors Move to GRE over IPsec, because a routing protocol cannot run over an interface that the kernel does not present as a device Move to route-based IPsec with a virtual tunnel interface, so a new subnet needs only a route and the tunnel behaves normally

54. Q54. Users report that a web application behind a WireGuard tunnel loads its login page but hangs when a large report is requested. Small requests over the same tunnel are fine, and `ping -s 1200` across the tunnel succeeds. What is the appropriate fix on the VyOS router?

    Raise the tunnel MTU to 1500 so that a full-size packet fits without fragmentation and the large transfer completes Disable path MTU discovery on the tunnel interface so that the sender falls back to the IPv4 minimum packet size Clamp the TCP MSS on the tunnel interface with `ip adjust-mss`, sized from the inner MTU rather than the wire MTU Enable fragmentation on the tunnel interface so oversized packets are split before encryption instead of being dropped

55. Q55. VXLAN identifies each overlay network with a 24-bit VNI and carries the encapsulated frames over UDP port 4789, which is why it scales far past the 4094 VLANs of 802.1Q.

    True False

56. Q56. A branch router applies a QoS policy that gives DSCP EF traffic a strict-priority queue on the WAN. Voice quality is fine for a week, then degrades whenever a particular guest-network host is active. What is the design error?

    The priority queue has no bandwidth ceiling, so EF traffic from the voice VLAN starves the remaining classes during a call The DSCP marks arriving from the guest network are trusted rather than rewritten, so any host can mark its own traffic EF The classifier matches on the ECN bits as well as the DSCP bits, so a congested guest flow is classified as expedited forwarding The shaper is applied on ingress rather than egress, so the queue never builds and the priority class is never actually used

57. Q57. A remote site with no local DHCP server relays to a central server. The relay is configured on the router, the server is reachable, and packet captures show DHCPDISCOVER arriving at the server, but no offer is ever returned. What is the first thing to check on the server?

    Whether the server has a subnet declaration matching the giaddr the relay stamped into the request Whether the server accepts option 82, since a relay that inserts it will have its requests rejected by a server that does not Whether the server has a route back to the client subnet, since the offer is unicast directly to the requesting client address Whether the server is listening on the relay interface, since a relayed request arrives as a broadcast on the server segment

58. Q58. Select every step that belongs in a management-plane hardening change on a production VyOS 1.5 router.

    Disable password authentication on the SSH service, so that only key-based logins are accepted Keep a network-reachable root login available, so that there is always a break-glass path in Expose the HTTPS API on every interface with no source restriction, so automation can reach it Bind the SSH daemon to the management address with `set service ssh listen-address 10.99.0.1` Use one shared API key across the whole estate, so that a single rotation covers every router

59. Q59. A firewall change on a transit router added a rule that drops all ICMP toward the internet. Two days later, users report that some HTTPS sites hang after the TLS handshake while everything else works. What is the connection?

    ICMP echo is used by the browser to size the connection window, and without it the window collapses after the handshake Dropping ICMP prevents redirect messages, so traffic keeps taking a suboptimal path and eventually exceeds the session timeout Dropping ICMP removes source-quench messages, so senders never slow down and the resulting congestion stalls large transfers Dropping ICMP unreachable type 3 code 4 breaks path MTU discovery, so senders never learn to reduce below the bottleneck MTU

60. Q60. A firewall policy that blocks ICMP wholesale on a transit path will break path MTU discovery for IPv4 as well as IPv6, so ICMP unreachable and ICMPv6 Packet Too Big must be permitted.

    True False

61. Q61. Select every observation that is consistent with a path MTU problem rather than with some other class of fault.

    A ping with a 1472-byte payload and the do-not-fragment bit set fails, while 1200 bytes succeeds over the same path The interface error counter increments in step with the CRC error counter on the same physical port A TCP session establishes and then hangs as soon as the server sends its first full-size response ICMP echo replies come back with a TTL that is one hop lower than the path length suggests it should be The routing table holds two equal-cost next-hops for the prefix and traffic consistently uses only one of them

62. Q62. A host on 10.10.0.0/24 cannot reach a server on 10.20.0.0/24. Every router on the forward path has the correct route, tcpdump on the server segment shows the request arriving, and the server replies. The reply is never seen at the client. What should be checked next?

    The forward path again, because a reply that is sent but not received means the request was forwarded with a rewritten source The client operating system, because the reply is arriving at the client interface and being discarded above the network layer The return path, hop by hop: the routes back to 10.10.0.0/24, and any stateful firewall on a router the reply traverses The server default gateway, because a reply that leaves the server correctly can only fail if the gateway address is wrong

63. Q63. A redundant pair of VyOS routers carrying a dual-ISP BGP edge is due for a major-version upgrade. Which sequence matches the discipline this course teaches?

    Upgrade both routers in the same window so the pair never runs mixed versions, then verify sessions and traffic once at the end Test in a lab, upgrade the backup router first, verify sessions and traffic, then upgrade the master Upgrade the master first so that any regression is found while the backup is still available to take over the traffic Upgrade both routers at once but keep the previous image in the alternate slot, so a rollback restores the pair together

64. Q64. A replacement router has to be brought up from scratch after the original is destroyed. Select every item that must already exist off the router for that to be possible.

    A copy of the running configuration held in the commit archive on the router itself The saved /config/config.boot copied off the router and held under version control The private keys and pre-shared secrets that the configuration references but does not contain A conntrack table export, so that established sessions can be restored onto the replacement A record of the image version and the interface-to-cable mapping for the replacement hardware

65. Q65. Name three production failure modes that arise from redistributing routes between OSPF and BGP, and state the control that prevents each one.

66. Q66. Explain the difference between the gateway redundancy VRRP provides and stateful session preservation. Why does a VRRP failover break established NAT and firewall sessions, and what would have to be added to keep them?

67. Q67. You have to change the WAN addressing on a router you can only reach over the link you are changing, and there is no console access. Describe the procedure you would follow and the specific VyOS mechanisms you would use at each step.

68. Q68. A host on 10.0.0.0/24 behind R1 cannot reach a server on 10.1.0.0/24 behind R3. R1 reaches 10.1.0.0/24 through a static route via 192.0.2.1 on R2; R2 and R3 run OSPF in area 0. The path worked yesterday. Describe the evidence you would collect, in the order you would collect it, what each piece would rule in or out, and the root causes this topology makes most likely.

    Three VyOS 1.5 routers in a line: R1 — R2 — R3. The source subnet 10.0.0.0/24 is a LAN on R1. The destination subnet 10.1.0.0/24 is a LAN on R3. R1 has a single static route for 10.1.0.0/24 with next-hop 192.0.2.1, which is R2 on the shared transit link. R2 and R3 are OSPF neighbours in area 0. R2 performs no NAT. Each router runs a stateful firewall.

Passing score: 80%. Answers are checked in this browser.