Both departments are redirected because a broad ACL match was used in the route map is a symptom of a different control gap that calls for narrow the PBR ACL source and destination match to the authorized finance flows. Policy routing acts only on packets matched by the route map ACL semantics. The proposed safeguard in this question instead deals with a route map modifies every learned BGP prefix because its match statement was missing; the alternative is not the most specific justification for match the exact permitted community and then set local preference only for that class.

The peers send hellos but their connected subnet masks leave no mutually reachable addresses is a symptom of a different control gap that calls for correct L3 addressing and EIGRP interface participation before changing metrics. EIGRP neighbors must share usable L3 link connectivity to exchange update packets. The proposed safeguard in this question instead deals with a route map modifies every learned BGP prefix because its match statement was missing; the alternative is not the most specific justification for match the exact permitted community and then set local preference only for that class.

Packets destined to a removed subnet bounce between the summary origin and an alternate upstream router is a symptom of a different control gap that calls for validate summary ownership and add precise exception routes or fail-closed discard behavior as designed. Summaries can conceal loss of component routes and may create loops if downstream specifics disappear. The proposed safeguard in this question instead deals with a route map modifies every learned BGP prefix because its match statement was missing; the alternative is not the most specific justification for match the exact permitted community and then set local preference only for that class.

Use passive-interface on nontransit segments while retaining network advertisement addresses a different situation, such as a loopback should be advertised into EIGRP without forming neighbor sessions on access VLANs. A passive EIGRP interface suppresses hello-neighbor behavior but can still contribute connected reachability. In this question the relevant situation is the regional peer receives dozens of /24s after an interface-level EIGRP summary was removed; the alternative changes another control and would not establish that the regional neighbor sees the intended aggregate rather than all covered component routes. The specific remedy here concerns configure a correctly scoped EIGRP interface summary and verify component coverage.

Apply inbound prefix filter to specific neighbor address family addresses a different situation, such as edge router must refuse a BGP default from ISP while still accepting customer routes. Import policy controls what the local router accepts from a particular BGP peer. In this question the relevant situation is the regional peer receives dozens of /24s after an interface-level EIGRP summary was removed; the alternative changes another control and would not establish that the regional neighbor sees the intended aggregate rather than all covered component routes. The specific remedy here concerns configure a correctly scoped EIGRP interface summary and verify component coverage.

Configure suitable EIGRP stub advertisement and summarization at designed query boundaries addresses a different situation, such as a remote stub should not become transit for arbitrary EIGRP queries during branch failure. Stub behavior and summarization reduce diffusion of route queries across nontransit portions. In this question the relevant situation is the regional peer receives dozens of /24s after an interface-level EIGRP summary was removed; the alternative changes another control and would not establish that the regional neighbor sees the intended aggregate rather than all covered component routes. The specific remedy here concerns configure a correctly scoped EIGRP interface summary and verify component coverage.

Evaluate E1 route type or explicit policy when total internal path cost should influence exit addresses a different situation, such as two external OSPF exits advertise identical E2 cost but site wants closer internal path. OSPF E2 primarily compares external cost whereas E1 adds internal cost to ASBR. In this question the relevant situation is permitted networks remain while all routes not matching any policy statement are lost; the alternative changes another control and would not establish that both the specific exclusion and remaining allowed routes match a documented acceptance matrix. The specific remedy here concerns add explicit intended permits after selective denies and verify the implicit deny boundary.

Implement minimal supported static or policy route leaking for the approved shared-service prefix addresses a different situation, such as application services in RED must reach a shared DNS service in BLUE without general tenant connectivity. Cross-VRF reachability needs explicit import policy rather than automatic mutual routing. In this question the relevant situation is permitted networks remain while all routes not matching any policy statement are lost; the alternative changes another control and would not establish that both the specific exclusion and remaining allowed routes match a documented acceptance matrix. The specific remedy here concerns add explicit intended permits after selective denies and verify the implicit deny boundary.

Provide reachable next-hop advertisement or configure next-hop-self at the edge addresses a different situation, such as iBGP speakers learn internet prefixes from an edge but cannot install them. BGP path usability depends on routing to the advertised next hop. In this question the relevant situation is permitted networks remain while all routes not matching any policy statement are lost; the alternative changes another control and would not establish that both the specific exclusion and remaining allowed routes match a documented acceptance matrix. The specific remedy here concerns add explicit intended permits after selective denies and verify the implicit deny boundary.

Move DHCP relay/helper to correct client-side L3 interface addresses a different situation, such as only one SVI serves clients but helper was placed on server-facing uplink. Relay listens for DHCP broadcast on client segment where initial request enters. In this question the relevant situation is monitoring only average ping RTT misses one-way delay variation affecting RTP quality; the alternative changes another control and would not establish that statistics show jitter and packet loss correlated with voice quality incident. The specific remedy here concerns use platform-supported IP SLA UDP jitter operations and examine jitter/loss results.

Advertise appropriate O flag and configure stateless DHCPv6 information service addresses a different situation, such as hosts use SLAAC address but need DNS server information from DHCPv6. Stateless DHCPv6 can deliver ancillary data while SLAAC supplies IPv6 addresses. In this question the relevant situation is monitoring only average ping RTT misses one-way delay variation affecting RTP quality; the alternative changes another control and would not establish that statistics show jitter and packet loss correlated with voice quality incident. The specific remedy here concerns use platform-supported IP SLA UDP jitter operations and examine jitter/loss results.

Enable suitable log/debug timestamps and synchronize NTP before reproduction addresses a different situation, such as engineers need to correlate EIGRP neighbor resets with optical alarms across devices. Event ordering and correlation need accurate clocks and timestamp precision. In this question the relevant situation is monitoring only average ping RTT misses one-way delay variation affecting RTP quality; the alternative changes another control and would not establish that statistics show jitter and packet loss correlated with voice quality incident. The specific remedy here concerns use platform-supported IP SLA UDP jitter operations and examine jitter/loss results.

OSPF hellos are policed by wrong class after blanket ACL changes is a symptom of a different control gap that calls for correct ACL/class-map identification for OSPF protocol traffic to CPU. OSPF is IP protocol 89 and must be classified accurately in control plane policy. The proposed safeguard in this question instead deals with aAA server drops requests because packets originate from newly changed WAN source; the alternative is not the most specific justification for set supported AAA source-interface or VRF-aware server binding to expected management address.

An ACL has a permit-looking remark but packet counters still hit implicit deny is a symptom of a different control gap that calls for add an actual matching permit ACE; treat remarks only as documentation. ACL remarks do not perform packet match or forwarding action. The proposed safeguard in this question instead deals with aAA server drops requests because packets originate from newly changed WAN source; the alternative is not the most specific justification for set supported AAA source-interface or VRF-aware server binding to expected management address.

A blanket aggressive control-plane policer drops legitimate BGP keepalives during load is a symptom of a different control gap that calls for separate routing-protocol control traffic into classes with sufficient protected rate limits. CoPP classifies punted control traffic and protects route processor without indiscriminate blocking. The proposed safeguard in this question instead deals with aAA server drops requests because packets originate from newly changed WAN source; the alternative is not the most specific justification for set supported AAA source-interface or VRF-aware server binding to expected management address.

RA Guard blocks the real router's RA because its uplink is marked untrusted is a symptom of a different control gap that calls for assign trust to approved router/server ports and enforcement to untrusted edge ports. First-hop guard policies must reflect which port legitimately originates infrastructure control messages. The proposed safeguard in this question instead deals with return TCP packets pass but new allowed connections and non-TCP traffic behave inconsistently; the alternative is not the most specific justification for use appropriate directional ACL or stateful enforcement rather than treating TCP established as universal session state.

A blanket aggressive control-plane policer drops legitimate BGP keepalives during load is a symptom of a different control gap that calls for separate routing-protocol control traffic into classes with sufficient protected rate limits. CoPP classifies punted control traffic and protects route processor without indiscriminate blocking. The proposed safeguard in this question instead deals with return TCP packets pass but new allowed connections and non-TCP traffic behave inconsistently; the alternative is not the most specific justification for use appropriate directional ACL or stateful enforcement rather than treating TCP established as universal session state.

Console authentication succeeds centrally but VTY uses a legacy default method and permits unintended access is a symptom of a different control gap that calls for apply the intended named AAA authentication method list to VTY lines. Different lines can use different AAA lists even on the same device. The proposed safeguard in this question instead deals with return TCP packets pass but new allowed connections and non-TCP traffic behave inconsistently; the alternative is not the most specific justification for use appropriate directional ACL or stateful enforcement rather than treating TCP established as universal session state.

Engineer tests only the route table and misses a policy route map attached to wrong interface is a symptom of a different control gap that calls for verify PBR attachment, matching packets, and real flow next-hop rather than RIB alone. Policy-selected forwarding can differ from destination RIB and needs packet-level verification. The proposed safeguard in this question instead deals with security policy matches on destination only and cannot tell imported branches from internal prefixes; the alternative is not the most specific justification for stamp route tags during EIGRP-to-OSPF redistribution and match them on downstream policy.

An aggregate is expected but no component route exists in the BGP table is a symptom of a different control gap that calls for verify qualifying component BGP prefixes and aggregate-address options before forcing an advertisement. BGP aggregation normally depends on an eligible more-specific BGP route. The proposed safeguard in this question instead deals with security policy matches on destination only and cannot tell imported branches from internal prefixes; the alternative is not the most specific justification for stamp route tags during EIGRP-to-OSPF redistribution and match them on downstream policy.

A route unexpectedly passes because a later permit clause was assumed to cancel an earlier matching permit is a symptom of a different control gap that calls for review route-map sequence ordering and first matching permit or deny result for the test prefix. Route-map clauses are evaluated in order and the first matching action determines that policy decision. The proposed safeguard in this question instead deals with security policy matches on destination only and cannot tell imported branches from internal prefixes; the alternative is not the most specific justification for stamp route tags during EIGRP-to-OSPF redistribution and match them on downstream policy.

Valid client address transmits; forged unbound source is blocked would validate the different intervention to apply IPv6 source guard backed by accurate per-port binding or trusted policy for a scenario such as router ACL does not distinguish source spoofing within large guest /64. It does not test the present fault—operators paste IPv4 wildcard ACL syntax into IPv6 traffic-filter configuration and receive errors—or show that the proposed remedy is working. The discriminating observation here is that show ipv6 access-list counters reflect authorized and blocked IPv6 flows.

Login during primary outage reaches secondary server and auditable policy applies would validate the different intervention to check AAA server-group members, deadtime and availability behavior before raising login timers for a scenario such as first server is down but router never attempts second server in intended method group. It does not test the present fault—operators paste IPv4 wildcard ACL syntax into IPv6 traffic-filter configuration and receive errors—or show that the proposed remedy is working. The discriminating observation here is that show ipv6 access-list counters reflect authorized and blocked IPv6 flows.

TACACS authorization logs permit show commands and deny forbidden configuration operations would validate the different intervention to configure and test per-command or exec authorization in the intended AAA policy for a scenario such as user authenticates via TACACS+ and still receives privileged EXEC commands outside assigned role. It does not test the present fault—operators paste IPv4 wildcard ACL syntax into IPv6 traffic-filter configuration and receive errors—or show that the proposed remedy is working. The discriminating observation here is that show ipv6 access-list counters reflect authorized and blocked IPv6 flows.

Show policy-map control-plane displays active class packet counters during tests would validate the different intervention to attach verified control-plane service policy in supported direction for a scenario such as coPP show commands indicate no policy on control-plane input and CPU still saturates. It does not test the present fault—transit data ACL permits routed packets but management access to control plane remains open—or show that the proposed remedy is working. The discriminating observation here is that unauthorized SSH cannot open a router VTY while legitimate transit data remains unaffected.

Table contains active client source/MAC/port mappings and legitimate traffic passes would validate the different intervention to validate supported SAVI/ND snooping/binding learning for chosen address method before enforcing source guard for a scenario such as strict port enforcement blocks authorized IPv6 clients because binding source is not learned. It does not test the present fault—transit data ACL permits routed packets but management access to control plane remains open—or show that the proposed remedy is working. The discriminating observation here is that unauthorized SSH cannot open a router VTY while legitimate transit data remains unaffected.

Approved management login remains available under simulated untrusted SSH load would validate the different intervention to classify approved management SSH and police unauthorized to-device traffic by policy for a scenario such as unclassified inbound TCP/22 consumes excessive CPU and management sessions time out. It does not test the present fault—transit data ACL permits routed packets but management access to control plane remains open—or show that the proposed remedy is working. The discriminating observation here is that unauthorized SSH cannot open a router VTY while legitimate transit data remains unaffected.

Enable suitable log/debug timestamps and synchronize NTP before reproduction addresses a different situation, such as engineers need to correlate EIGRP neighbor resets with optical alarms across devices. Event ordering and correlation need accurate clocks and timestamp precision. In this question the relevant situation is network management must protect both polling identity and confidentiality; the alternative changes another control and would not establish that authorized SNMPv3 secure walk succeeds and capture does not expose cleartext community. The specific remedy here concerns migrate managed router and collector to compatible SNMPv3 authPriv configuration.

Apply scoped VTY source ACL access-class in correct address family addresses a different situation, such as network devices should accept administrative sessions only from authorized jump subnet. VTY access-class restricts who may attempt router management session. In this question the relevant situation is network management must protect both polling identity and confidentiality; the alternative changes another control and would not establish that authorized SNMPv3 secure walk succeeds and capture does not expose cleartext community. The specific remedy here concerns migrate managed router and collector to compatible SNMPv3 authPriv configuration.

Refresh discovery, inventory and topology correlation for changed network state addresses a different situation, such as after a campus move, reported topology does not match physical cabling. Accurate assurance conclusions depend on current discovered device/link data. In this question the relevant situation is network management must protect both polling identity and confidentiality; the alternative changes another control and would not establish that authorized SNMPv3 secure walk succeeds and capture does not expose cleartext community. The specific remedy here concerns migrate managed router and collector to compatible SNMPv3 authPriv configuration.

Restrict SNMP community or group access with source ACL and upgrade to v3 where feasible addresses a different situation, such as a router should accept SNMP requests only from dedicated telemetry collector. SNMP credentials alone should not define the full reachability boundary. In this question the relevant situation is primary link repeatedly rejoins forwarding for seconds before failing again; the alternative changes another control and would not establish that route changes occur only after sustained failure or recovery beyond configured thresholds. The specific remedy here concerns apply suitable tracking delay or hold-down and stable probe thresholds.

Verify NTP synchronization, time zone display, and event log timestamp source addresses a different situation, such as two routers report contradictory failure timelines because one clock is minutes ahead. Cross-device fault correlation is unreliable when clocks differ materially. In this question the relevant situation is primary link repeatedly rejoins forwarding for seconds before failing again; the alternative changes another control and would not establish that route changes occur only after sustained failure or recovery beyond configured thresholds. The specific remedy here concerns apply suitable tracking delay or hold-down and stable probe thresholds.

Test console authentication and authorized local break-glass workflow without exposing unprotected bypass addresses a different situation, such as router remote AAA could fail during disaster yet a protected console path must remain available. Console lines can have distinct AAA controls and must be evaluated for secure recovery. In this question the relevant situation is primary link repeatedly rejoins forwarding for seconds before failing again; the alternative changes another control and would not establish that route changes occur only after sustained failure or recovery beyond configured thresholds. The specific remedy here concerns apply suitable tracking delay or hold-down and stable probe thresholds.