300-410 Practice Test 1 — 10 Questions

Question 1

Drag and drop the steps to establish a DMVPN Phase 2 spoke-to-spoke tunnel into the correct order, from first to last.

Accepted Answer

Configure NHRP and mGRE on hub and spokes. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. First, the spoke must have a valid NHRP registration to the hub. When traffic from one spoke to another triggers an NHRP resolution request, the hub forwards it to the target spoke, which replies. The spoke then initiates a direct mGRE tunnel, and finally, the spoke-to-spoke IPsec session is established.

Question 2

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.3.3.0/24      10.1.1.2                 0    100      0 i

Total number of prefixes 1

What does this output indicate?

Accepted Answer

BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.. The output shows a single BGP prefix (10.3.3.0/24) received from neighbor 10.1.1.2, with the route marked as valid (*) and best (>). This confirms that BGP is successfully receiving and processing the update, and the route is eligible for installation in the routing table. Since the route appears in the received-routes output, CoPP is not dropping the inbound BGP update packets, as CoPP would prevent the packets from reaching the BGP process entirely.

Answer

BGP is not receiving any routes due to CoPP dropping updates.

Answer

BGP is receiving routes but not installing them in the routing table due to CoPP.

Answer

BGP session is flapping due to CoPP.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)
                       Xmit Queue   Mean   Pacing Time   Multicast    Pending
Interface        Peers  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0              1       0/0       12       0/10         50           0
Gi0/1              1       0/0       15       0/10         50           0
Gi0/2              1       0/0       18       0/10         50           0
Gi0/3              1       0/0       20       0/10         50           0
Gi0/4              0       0/0        0       0/10         50           0

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/4 has no EIGRP neighbor, which may indicate a configuration issue or lack of connectivity.. The output shows that interface Gi0/4 has 0 peers, while all other interfaces have 1 peer. In EIGRP, a peer count of 0 indicates that no neighbor adjacency has been formed on that interface. This could be due to a configuration mismatch (e.g., different AS numbers, passive interface, or authentication) or a Layer 1/2 connectivity issue. Therefore, option A is correct.

Answer

All interfaces have at least one EIGRP neighbor.

Answer

The mean SRTT on Gi0/2 is 18 ms, which is too high and indicates a problem.

Answer

The pending routes count of 0 on all interfaces indicates a routing loop.

Question 4

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Accepted Answer

The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.. When the RSPAN VLAN is also configured as the native VLAN on a trunk, mirrored frames are sent untagged on that trunk. Intermediate switches may treat untagged frames as belonging to the native VLAN rather than the RSPAN VLAN, causing them to be forwarded incorrectly or dropped, resulting in intermittent traffic at the destination.

Answer

VTP transparent mode prevents RSPAN from working correctly.

Answer

The source VLAN 50 is not allowed on the trunk ports.

Answer

The monitor session 2 is missing the 'no shutdown' command.

Question 5

Which of the following is a mandatory condition for a route to be considered a feasible successor in EIGRP?

Accepted Answer

The reported distance must be less than the feasible distance.. In EIGRP, a feasible successor is a backup route that can be used immediately if the successor fails. The mandatory condition for a route to be considered a feasible successor is that its reported distance (RD) must be less than the feasible distance (FD) of the current successor. This ensures the backup route is loop-free, as per the Diffusing Update Algorithm (DUAL).

Answer

The metric must be equal to the successor's metric.

Answer

The next-hop router must be directly connected.

Answer

The route must be learned from the same AS.

Question 6

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 7

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows 'BFD enabled, BFD state: UP', indicating that BFD is operational for this LDP session, which allows faster failure detection than LDP hello timers alone.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 8

A network administrator is configuring a Cisco IOS router to authenticate administrative logins using TACACS+ with a fallback to local authentication. The TACACS+ server is reachable, but the administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used. The router currently has the following configuration:

aaa new-model
aaa authentication login default group tacacs+ local

tacacs server TAC1
 address ipv4 10.1.1.1
 key cisco

What additional configuration is required to ensure that the router falls back to local authentication when the TACACS+ server does not respond?

Accepted Answer

No additional configuration is required; the existing configuration already provides fallback to local authentication.. The AAA authentication method list specifies the order of authentication methods. When 'group tacacs+' is followed by 'local', the router tries TACACS+ first. If the TACACS+ server does not respond (e.g., timeout), the router proceeds to the next method, local authentication. Thus, the existing configuration already ensures fallback. The other options either do not enable fallback or are redundant.

Answer

Configure aaa authentication login default group tacacs+ local

Answer

Configure tacacs server TAC1 with the timeout 5 command

Answer

Configure aaa authentication login default group tacacs+ local-case

Question 9

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Option A is correct because static NAT is created with the global configuration command ip nat inside source static

, which permanently maps one inside local address to one inside global address. Option B is correct because the router must know which interface is the internal side, and that is done by entering the interface configuration and issuing the ip nat inside command on the interface facing the internal network. Option C is wrong because ip nat outside must be applied to the external-facing interface, not the internal one. Option D is wrong because an access list is used for dynamic NAT or PAT with the pool/overload syntax, not for a static one-to-one mapping. Option E is wrong because there is no global ip nat service command required to activate NAT on Cisco IOS; NAT is enabled by the inside/outside interface designations and the translation statements themselves.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 10

What is the default administrative distance for OSPF routes on a Cisco IOS-XE router?

Accepted Answer

110. The default administrative distance for OSPF is 110.

Answer

90

Answer

100

Answer

120