+ 3 Drag and Drop Questions
+ Some Multiple Choice Questions
+ 13/14 Troubleshooting Tickets (check them at the right-side menu)

Below is a summary of 14 Tickets you will see in the exam:

Notice that in the exam, the tickets are randomly given so the best way to troubleshooting is to try pinging to all the devices from nearest to farthest from the client until you don’t receive the replies.

In each ticket you will have to answers three types of questions:

+ Which device causes problem
+ Which technology is used
+ How to fix it

One more thing to remember: you can only use “show” commands to find out the problems and you are not allowed to make any changes in the configuration. In fact, in the exam you can not enter the global configuration mode!

Screenshots for your reference:

(Please visit http://www.networktut.com/tshoot-share-your-experience for bigger images)

Question 1

FCAPS 
Fault Management ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ F
Configuration Management ‐‐‐‐‐‐‐ C
Accounting Management ‐‐‐‐‐‐‐‐‐‐ A

Question 2

FCAPS–model defined by the International Organization for Standardization (ISO).
ITIL– framework for it prof
TNM–network management model is the Telecommunications Standardization Sector’s (ITU-T)
Cisco lifecycle–model is often referred to as the PPDIOO model

Question 3

EEM ‐‐‐‐‐‐‐‐‐‐‐‐‐‐ CLI based for Management and Monitoring
SDM ‐‐‐‐‐‐‐‐‐‐‐‐‐‐ provide a GUI for Administration
FTP ‐‐‐‐‐‐‐‐‐‐‐‐‐‐ Used for Backup and restore

1)FCAPS is a network maintenance model defined by ISO. What does it stand for?

A – Action Management
B – Fault Management
C – Configuration Management
D – Protocol Management
E – Security Management

Answer: B C E (Fault, Configuration & Security Management) Notice that A stands for Accounting, not Action.

2) Which alerts will be seen on the console when running the command: logging console warnings.

A – warnings only
B – warnings, notifications, error, debugging, informational
C – warnings, errors, critical, alerts, emergencies
D – notifications, warnings, errors
E – warnings, errors, critical, alerts

Answer: C  (warning, critical, alert, emergencies)

Explanation

The Message Logging is divided into 8 levels as listed below

The highest level is level 0 (emergencies). The lowest level is level 7. If you specify a level with the “logging console level” command, that level and all the higher levels will be displayed. For example, by using the “logging console warnings” command, all the logging of emergencies, alerts, critical, errors, warnings will be displayed.

In this question, E is also correct but it is less information -> C is the best answer.

3) You have 2 commands used for ftp:
ip ftp username xxxxxx
ip ftp password yyyyyy

Which two commands will be used when switching from ftp to http?

Answer:
ip http client username xxxxxx
ip http client password yyyyyy

4) Which two of the following options are categories of Network Maintenance tasks?

A – Firefighting
B – Interrupt-driven
C – Policy-based
D – Structured
E – Foundational

Answer: B D

5) The following commands are issued on a Cisco router:

Router(config)#access-list 199 permit tcp host 10.1.1.1 host 172.16.1.1
Router(config)#access-list 199 permit tcp host 172.16.1.1 host 10.1.1.1
Router#debug ip packet 199

What would be the output shown on the console?

A – All IP packets passing through the router
B – Only IP packets with the source address of 10.1.1.1
C – All IP packets from 10.1.1.1 to 172.16.1.1
D – All IP packets between 10.1.1.1 to 172.16.1.1

Answer: D

Only communication between host 10.1.1.1 and host 172.16.1.1

6) You have two NTP servers 10.1.1.1 & 10.1.1.2 and want to configure a router to use 10.1.1.2 as its NTP server before falling back to 10.1.1.1. Which command will you use?

Answer:

ntp server 10.1.1.1
ntp server 10.1.1.2 prefer

(notice the answer with the word “prefer”)

7) The interface is up and protocol is up. What level of logging is enabled when you get these messages?

%LINEPROTO‐5‐UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
%LINKDOWN‐3‐SERIAL:

A -alerts
B – errors
C – critical
D – notifications

Answer: D

8) Two Cisco routers are connected to each other and are enabled CDP. Serial line is up,protocol is also up but cdp neighbor not working. What layer of the OSI model does the problem most likely exist?

Answer:

Data link layer.

Problem was disable authentification on R1, check where authentication is not given under router ospf of R1. (use ipv4 Layer 3)

Configuration on R1 was:

interface Serial0/0/0/0.12 point-to-point
ip address 10.1.1.1 255.255.255.252
ip nat inside
ip ospf message-digest-key 1 md5 TSHOOT
!
router ospf 1
log-adjacency-changes
network 10.1.1.0 0.0.0.3 area 12
default-information originate always

Configuration on R2 was:
interface Serial0/0/0/0.12 point-to-point
ip address 10.1.1.2 255.255.255.252
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 TSHOOT
!
router ospf 1
log-adjacency-changes
network 10.1.1.0 0.0.0.3 area 12

Answer: on R1 need command in router mode
area 12 authentication message-digest

Ans1) R1
Ans2) OSPF
Ans3) ip ospf authentication message-digest command must be given on s0/0/0/0.12

Configuration on DSW1:

track 1 ip route 10.1.21.128 255.255.0.0 metric threshold
threshold metric up 1 down 2
!
track 10 ip route 10.2.21.128 255.255.255.0 metric threshold
threshold metric up 63 down 64
!

interface Vlan10
ip address 10.2.1.1 255.255.255.0
standby 10 ip 10.2.1.254
standby 10 priority 200
standby 10 preempt
standby 10 track 1 decrement 60

Answer: (use IPv4 Layer 3 Topology)

On dsw 1 interface vlan 10 mode run:
no standby 10 track 1 decrement 60
standby 10 track 10 decrement 60
(ip for track command not exact for real exam)

Ans1) DSW1
Ans2) HSRP
Ans3) delete the command with track 1 and enter the command with track 10 (standby 10 track 10 decrement 60).

Configuration on R1:
router bgp 65001
no synchronization
bgp log-neighbor-changes
network 209.65.200.224 mask 255.255.255.252
neighbor 209.56.200.226 remote-as 65002
no auto-summary

check bgp neighborship. **** show ip bgp sum****
The neighbor’s address in the neighbor command is wrong under router BGP. (use ipv4 Layer 3)

Answer: need change on router mode on R1 neighbor 209.65.200.226

Ans1) R1
Ans2) BGP
Ans3) delete the wrong neighbor statement and enter the correct neighbor address in the neighbor command (change “neighbor 209.56.200.226 remote-as 65002″ to “neighbor 209.65.200.226 remote-as 65002″)

NAT problem. (use ipv4 Layer 3)
problem on R1 Nat acl

Configuration on R1
ip nat inside source list nat_pool interface s0/0/0/1 overload

ip access-list standard nat_pool
permit 10.1.0.0
!
interface serial0/0/0/1
ip address 209.65.200.225 255.255.255.252
ip nat outside
!
interface Serial0/0/0/0.12
ip address 10.1.1.1 255.255.255.252
ip nat inside
ip ospf message-digest-key 1 md5 TSHOOT
ip ospf authentication message-digest

Answer:add to acl 1 permit ip 10.2.1.0 0.0.0.255

Ans1) R1
Ans2) NAT
Ans3) Add the command permit 10.2.0.0 in the nat_pool access-list

Problem:on R1 acl blocking ip
Configuration on R1

router bgp 65001
no synchronization
bgp log-neighbor-changes
network 209.65.200.224 mask 255.255.255.252

neighbor 209.65.200.226 remote-as 65002
no auto-summary
!
access-list 30 permit host 209.65.200.241
access-list 30 deny 10.1.0.0 0.0.255.255
access-list 30 deny 10.2.0.0 0.0.255.255
!
interface Serial0/0/0/1
ip address 209.65.200.224 255.255.255.252
ip nat outside

ip access-group 30 in

Answer: add permit 209.65.200.224 0.0.0.3 command to R1′s ACL

Ans1) R1
Ans2) IP Access list
Ans3) Add permit 209.65.200.224 0.0.0.3 to R1′s ACL

Vlan Access map is applied on DSW1 blocking the ip address of client 10.2.1.3
Configuration on DSW1
vlan access-map test1 10
drop
match ip address 10
!
vlan filter test1 vlan-list 10
!
ip access-list standard 10
permit 10.2.0.0 0.0.255.255
!
interface VLAN10
ip address 10.2.1.1 255.255.255.0

Ans1) DSW1 (but in the exam maybe you have to choose ASW1)
Ans2) Vlan access map
Ans3)Remove vlan filter test1 from DSW1

Note: There was a bug in this ticket but now it has been fixed  so you can select DSW1 device, next page you have to scroll down to find the VLAN Access List/PACL option.

On ASW1 port-security mac 0000.0000.0001, interface in err-disable state

Configuration of ASW1
interface fa1/0/1
switchport mode access
switchport port-security
switchport port-security mac-address 0000.0000.0001

Answer:on asw1 delele portsecurity & do on interfaces shutdown, no shutdown

Ans1)ASW1
Ans2)Port security
Ans3)issue “no switchport port-security mac-address 0000.0000.0001 command followed by shutdown & no shutdown commands on port fa1/0/1 on ASW1

Situation: in port channel configuration of ASW1 vlan 10 is not allowed. (Use L2 Diagram)
Configuration of ASW1
interface FastEthernet1/0/1
switchport mode access
switchport access vlan 1
!
interface FastEthernet1/0/2
switchport mode access
switchport access vlan 1

On ASW1, on interfaces fa0/1, fa0/2 switchport access vlan 1

Answer: on ASW1 change switchport access vlan 1 to switchport access vlan 10

Ans1)ASW1
Ans2)Vlan
Ans3)give command: interface range fa1/0/1-/2 & switchport access vlan 10

Answer: on port channel 13, 23 disables all vlans and give switchport trunk allowed vlan 10,200

Ans1)ASW1
Ans2)Switch to switch connectivity
Ans3)int range portchannel13,portchannel23
switchport trunk allowed vlan none
switchport trunk allowed vlan 10,200

Check ip eigrp neighbors from DSW1 you will not see R4 as neighbor.(use ipv4 Layer 3)
‘Show ip route’ on DSW1 you will not see any 10.x.x.x network route.

On DSW1 & DWS2 the EIGRP AS number is 10 (router eigrp 10) but on R4 it is 1 (router eigrp 1)

Answer: change router AS on R4 from 1 to 10

Ans1) R4
Ans2) EIGRP
Ans3) Change EIGRP AS number from 1 to 10

On R4 in router eigrp:
router eigrp 10
network 10.1.4.5 0.0.0.0
no auto-summary
redistribute ospf 1 metric 100 10 255 1 1500 route-map EIGRP_to_OSPF
!
router ospf 1
network 10.1.1.8 0.0.0.0 area 34
redistribute eigrp 10 subnets
!

route-map EIGRP->OSPF
match ip address 1

Answer:change in router eigrp router-map name

Ans1) R4
Ans2) Route redistribution
Ans3) Change the name of the route-map under the router EIGRP or router OSPF process from ‘EIGRP_to_OSPF’ to ‘EIGRP->OSPF’.

Configuration of R2
ipv6 router ospf 6
router-id 2.2.2.2
!
interface s0/0/0/0.23
ipv6 address 2026::1:1/122

Configuration of R3
ipv6 router ospf 6
router-id 3.3.3.3
!
interface s0/0/0/0.23
ipv6 address 2026::1:2/122
ipv6 ospf 6 area 0

Answer:

In interface configuration mode of s0/0/0/0.23 on R2:
ipv6 ospf 6 area 12

Ans1) R2
Ans2) OSPFv3
Ans3) on the serial interface of R2, enter the command ipv6 ospf 6 area 0 (notice that it is “area 0″, not “area 12″)

Configuration on R4 was:

!
ip dhcp exclude 10.2.1.1-10.2.1.253
!

Ans1) R4
Ans2) DHCP
Ans3) on R4 delete ip dhcp exclude 10.2.1.1-10.2.1.253 and apply ip dhcp-excluded 10.2.1.1-10.2.1.2

Answer 1) R4
Answer 2) IPv4 EIGRP Routing
Answer 3) Remove “Passive interface” under EIGRP 10 (or in Interface f0/1 and f0/0, something like this)

1. How much does the TSHOOT Exam 642-832 cost? And the passing score of TSHOOT?

It now costs $200.

The passing score of TSHOOT is 790/1000

2. Please tell me how many questions in the real TSHOOT exam, and how much time to answer them?

Unlike other Cisco exams, the TSHOOT exam tests your ability to troubleshoot the problem so in this exam you have to solve 3 multiple choice questions (or 2 multiple choice questions and 1 drag and drop question) and troubleshooting 13 “tickets”. Each ticket is a problem about a specific technology used in Cisco routers or switches.

You will have 135 minutes to answer them. If your native language is not English, Cisco allows you a 30-minute exam time extension (165 minutes in total).

3. Am I allowed to study the topology used in the real exam and where can I find it ?

Yes, you are! Because the purpose of this exam is testing a candidate’s ability to troubleshoot issues, not to understand a complex topology so Cisco publicizes the topology used in the real TSHOOT exam. You can find the topologies at http://www.networktut.com/tshoot-share-your-experience.

To save time on the exam, and to better understand the topology used in all of the trouble tickets, you should spend time familiarizing yourself with the topology used in the exam.

4. Where can I find the demo of this exam?

There is a very good demo of TSHOOT exam published by Cisco and you can find it at http://www.cisco.com/web/learning/le3/le2/le37/le10/tshoot_demo.html. But notice that the topology in this link is not the topology used in the real exam.

5. During the exam, we must only identify the problem or we must also make the correct configuration?

We only need to identify each problem without having to make the correct configuration. But you have to answer three types of questions:

+ Which device causes problem
+ Which technology is used
+ How to fix it

6. Can someone please tell me in the real exam it gives the ticket names just like in this site (for example “Ticket 1 – OSPF Authentication “) or is it going to say ticket 1 , ticket 2 only?

It only says ticket 1, ticket 2 only. In most cases you have to use the “show running-config” command to find out the wrong configuration.

7. Please give me some guideline when using the TSHOOT simulator.

Below is some guideline when using the TSHOOT simulator in the exam

7. Can I go back in the TSHOOT exam?

As shown in the above question, you can press “Previous Question” to go back to previous questions in the same ticket only. If you press “Done” button then you can’t come back to this ticket anymore. By pressing “Abort” button to can re-visit this ticket any time.

8. Can we take TSHOOT exam before the ROUTE or SWITCH exam?

Yes, you can. There is no order to take these exams. But the TSHOOT exam tests your skills to troubleshoot router & switch errors so I highly recommend you take the ROUTE and SWITCH exam first. The TSHOOT exam is very good to review your knowledge of what you learned in ROUTE & SWITCH.

9. Can I solve the tickets in any order I want?

Yes, you can solve them in any order until you click Done button. After clicking Done you cannot go back to this ticket again.

10. As I see there are 3 topologies in the exam. My question is to how to find which topology to use when doing a trouble ticket. Does it clearly state in exam whether to use this topology (layer 2 or layer 3, for example)?

In the exam, it doesn’t say clearly which topology you need to use. But a reader on networktut.com has shared this tip:

“There is no really best way to choose which topology to use.
This is my style:
Most of the time I was using the ipv4 topology as it contains most of the nodes with ip addresses and in the cause of your troubleshooting and you discovered that you need more details on the ASW1 & 2 switches that is when I used the Layer 2 topology except for the ipv6 topology.
Any node on IPV4 topology that is in Layer 2 topology have same configuration irrespective of where you click on the nodes.
Study all tickets here and use the following elimination style below:
List out all the trouble ticket on the white little board you will be giving and tick each ticket as you answer them because this will let you know which tickets are remaining to look out for.”

If you have any questions about the TSHOOT exam, please don’t hesitate to ask. All of us will help you!

Your posts are warmly welcome!

Some information I have gathered so far:

The exam is very different with other Cisco exams. You have 3 hours for this exam.

Exam’s Structure:

+ About 3 Multichoice questions
+ 2 Drag and Drop Questions
+ 13 lab-sim Questions with the same network topology (13 troubleshooting tickets or you can call it one “big” question). Each lab-sim is called a ticket and you can solve them in any order you like.

Topics of the lab-sims:

1- IPv6
2- OSPF
3- OSPFv3
4- Frame Relay
5- GRE
6- EtherChannel
7- RIPng
8- EIGRP
9- Redistribution
10- NTP
11- NAT
12- BGP
13- HSRP
14- STP
15- DHCP

The problems are rather simple. For example wrong IP assignment, disable or enable a command, authentication…

In each tickets you will have to answers three types of questions:

+ Which device causes problem
+ Which technology is used
+ How to fix it

When you press Done to finish each case, you can’t go back.

A demo of the TSHOOT Exam can be found at: http://www.cisco.com/web/learning/le3/le2/le37/le10/tshoot_demo.html

Note: We have gathered many questions about TSHOOT exam and posted them at TSHOOT FAQs & Tips, surely you will find useful information about the TSHOOT exam there!

In short, unlike other Cisco exams, we can go backward in this exam. That means we can choose a Troubleshooting Ticket,  browse all the configurations and hit “Abort” to ignore that Ticket. We can come back to that Ticket any time.

Below are the topologies of the real TSHOOT exam, you are allowed to study these topologies before taking the exam. It surely saves you some invaluable time when sitting in the exam room (Thanks rrg for sharing this).

IPv4 Layer 3 Topology

IPv6 Layer 3 Topology

Layer 2-3 Topology

Luckily we have a link to download this lab (open it with Packet Tracer v.5.3+) (Thanks Ali and many people for sharing this)

http://www.networktut.com/download/TSHOOT_LAB.zip

Below is the screenshot of this file

A newer version of the TSHOOT exam has been added on Nov-20-2011 (Thanks zero point zero for sharing this)

http://www.networktut.com/download/TSHOOT_Exam.zip

If you have any new information about this exam, please share with us!

Below is the strategy that has been used by many candidates to pass TSHOOT. Thanks to ENA for posting this.

* Note: The bug has been fixed recently so you can select DSW1 device, next page you have to scroll down and you will find the VLAN Access List/PACL option.

Best wishes to those who are going to take this exam!