300-410 Practice Test 10 — 10 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show snmp user

User name: monitor
Engine ID: 800000090300001122334455
storage-type: nonvolatile
Authentication Protocol: MD5
Privacy Protocol: DES
Group-name: readonly

User name: admin
Engine ID: 800000090300AABBCCDDEEFF
storage-type: nonvolatile
Authentication Protocol: SHA
Privacy Protocol: AES256
Group-name: admin

Based on this output, which statement is correct?

Accepted Answer

The 'monitor' user uses deprecated authentication and privacy protocols.. The 'monitor' user is configured with MD5 for authentication and DES for privacy. Both MD5 and DES are considered deprecated in SNMPv3 due to known security vulnerabilities; RFC 3414 defines MD5 as a weaker authentication protocol, and DES (56-bit key) is no longer recommended for encryption. The output confirms these protocols are in use, making option A correct.

Answer

The 'admin' user can only read MIB objects.

Answer

Both users use the same engine ID.

Answer

The 'monitor' user cannot authenticate because MD5 is not supported.

Question 2

A network engineer runs the following command on Router PE2:

PE2# show ip bgp vpnv4 vrf CUSTOMER_A 10.10.10.0 24
BGP routing table entry for 10.10.10.0/24, version 15
Paths: (1 available, best #1, table CUSTOMER_A)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  Local, imported path from 10.10.10.0/24
    10.1.1.1 (metric 20) from 10.1.1.1 (10.1.1.1)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:100:100
      mpls labels in/out 18/19

Based on this output, what is the problem?

Accepted Answer

The route is functioning correctly with no issues.. The output shows a VPNv4 route for VRF CUSTOMER_A. The route is marked as 'imported path from 10.10.10.0/24', which indicates it was imported from the global table or another VRF. The route is valid and best, with labels assigned. No problem is indicated; the route is functioning correctly.

Answer

The route is not being advertised to any BGP peer.

Answer

The route is missing the required Route Target community.

Answer

The route has an incorrect label binding.

Question 3

An engineer must enable BFD for an OSPF single-hop session between two directly connected routers. Which TWO configuration changes are required on each router? (Choose TWO.)

Accepted Answer

Configure the bfd interval command under the interface.. To enable BFD for OSPF, you must first enable BFD on the interface (bfd interval) and then enable BFD support under the OSPF routing process or interface (ip ospf bfd). The bfd neighbor command is for static BFD sessions, not OSPF. The router ospf command alone does not enable BFD. The bfd all-interfaces command enables BFD on all OSPF interfaces but still requires interface-level BFD configuration.

Answer

Configure the bfd neighbor command under global configuration.

Answer

Configure the router ospf command and then use the bfd all-interfaces command.

Answer

Configure the bfd slow-timers command under the interface.

Question 4

A network engineer runs the following command to debug IPv6 uRPF:

R1# debug ipv6 verify
IPv6 verify debugging is on

*Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0
*Mar 1 00:02:34.567:   no route to source

What does this output indicate?

Accepted Answer

The packet will be dropped because uRPF cannot find a route to the source address.. The debug output shows that uRPF (unicast Reverse Path Forwarding) checked the source address 2001:DB8:4::1 on the incoming interface GigabitEthernet0/0 and found no route to that source in the IPv6 routing table. When uRPF is enabled and a packet arrives on an interface, the router performs a reverse path lookup: it checks whether the best return route to the source address points back to the same interface. If no route exists at all, the lookup fails, and uRPF considers the source as unreachable, causing the packet to be dropped. This is a strict-mode uRPF behavior, and the debug message 'no route to source' confirms the packet will be discarded.

Answer

The packet will be forwarded because uRPF only checks the destination.

Answer

The packet will be forwarded because the source is on the same interface.

Answer

The router will add a route to the source address.

Question 5

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode

Based on this output, which statement is true?

Accepted Answer

uRPF is enabled in strict mode. The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 6

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Accepted Answer

IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.. IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.

Answer

IPv6 uRPF checks the destination address of incoming packets.

Answer

IPv6 uRPF is used to filter multicast traffic.

Question 7

A network engineer runs the following command to verify NetFlow export destination:

R1# show ip flow export

Flow export v9 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Destination(1)  192.168.1.100 (2055)
  Source IP         10.0.0.1
  Origin AS         65000
  Peer AS           65001
  Mask for source   255.255.255.255
  Mask for destination 255.255.255.255
  Version 9 flow records
  1234 flows exported in 567 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

What does this output indicate?

Accepted Answer

NetFlow export is successful with 1234 flows exported and no errors.. The output shows that NetFlow export is working correctly. It is exporting version 9 flows to destination 192.168.1.100 on port 2055, using source IP 10.0.0.1. There are no failures or drops, indicating successful export.

Answer

NetFlow export is failing due to adjacency issues.

Answer

NetFlow is using version 5 export.

Answer

The export destination is not configured.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip dhcp pool POOL1
Pool POOL1 :
  Utilization mark (high/low)    : 100 / 0
  Subnet size (first/next)       : 0 / 0
  Total addresses                : 10
  Leased addresses               : 10
  Pending event                  : none
  1 subnet is currently in the pool :
  Current index        IP address range                    Leased addresses
  192.168.1.11         192.168.1.10    - 192.168.1.19       10

Based on this output, which statement is correct?

Accepted Answer

The DHCP pool is fully utilized; no more addresses are available.. The output shows that all 10 addresses in the pool (192.168.1.10–192.168.1.19) are leased, and the current index is 192.168.1.11, which is beyond the first address. This means no free addresses remain, so the pool is fully utilized. Option B correctly states this condition.

Answer

The DHCP pool has available addresses for new clients.

Answer

The DHCP pool is configured with a /24 subnet.

Answer

The DHCP server has a pending event causing address allocation to fail.

Question 9

Which TWO commands can be used to verify the operational status of a manually configured IPv6 tunnel on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show interfaces tunnel 0. The 'show interfaces tunnel 0' command displays the operational status, line protocol state, and encapsulation details of the tunnel interface, which directly verifies whether the manually configured IPv6 tunnel is up/up. The 'show ipv6 interface tunnel 0' command shows IPv6-specific information such as the IPv6 address, link-local address, and whether IPv6 is enabled on the tunnel interface, confirming that IPv6 traffic can be processed. Both commands provide essential operational verification for a manually configured IPv6 tunnel, such as a 6in4 or GRE tunnel carrying IPv6.

Answer

show ipv6 route

Answer

show ipv6 tunnel 0

Answer

show running-config interface tunnel 0

Question 10

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Accepted Answer

'show crypto session' displays the IKEv2 SA status and the IPsec SA status.. The 'show crypto session' command provides a concise summary of both IKEv2 SA (phase 1) and IPsec SA (phase 2) status, including the state (UP-ACTIVE) and peer IP. This makes it a quick troubleshooting tool for verifying that both security associations are established without needing separate commands for each phase.

Answer

'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

Answer

The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.

Answer

'show crypto map' displays the current packet count for each IPsec SA.