300-410 Mock Exam 106 — 25 Questions

Question 1

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# debug eigrp packets hello

*Mar  1 00:05:23.123: EIGRP: received packet with MD5 authentication, key id = 1
*Mar  1 00:05:23.123: EIGRP: int GigabitEthernet0/0, src 10.1.1.2 dst 224.0.0.10, seq 0, ttl 1, opcode = 1 (Hello)
*Mar  1 00:05:23.123: EIGRP: authentication failed for packet from 10.1.1.2, key id = 1, integrity check failed

What does this output indicate?

Accepted Answer

The MD5 key ID or key string does not match between R1 and 10.1.1.2, preventing neighbor formation.. The debug output shows an EIGRP packet with MD5 authentication was received from 10.1.1.2, but the integrity check failed. This indicates that the MD5 key ID or key string configured on R1 does not match the one on the neighbor, which prevents the neighbor relationship from forming. The 'integrity check failed' message is a definitive sign of an authentication mismatch, not an intermittent issue.

Answer

The EIGRP neighbor relationship is up, but authentication is failing intermittently.

Answer

EIGRP is using plain-text authentication and the key is incorrect.

Answer

The neighbor 10.1.1.2 is not configured for EIGRP authentication.

Question 2

Which TWO statements about DHCPv6 stateless autoconfiguration (SLAAC) are true? (Choose TWO.)

Accepted Answer

SLAAC requires the 'A' flag to be set in Router Advertisements.. SLAAC (Stateless Address Autoconfiguration) requires the 'A' (Autonomous) flag to be set in Router Advertisements (RAs). This flag tells hosts to generate their own IPv6 address using the prefix in the RA and an interface identifier (e.g., EUI-64 or privacy extension). Without the 'A' flag, hosts will not perform address autoconfiguration via SLAAC.

Answer

The 'M' flag in Router Advertisements must be set for SLAAC to operate.

Answer

The command 'ipv6 nd other-config-flag' sets the 'M' flag in Router Advertisements.

Answer

SLAAC can only be used on Ethernet interfaces.

Question 3

Which EIGRP packet type is used to acknowledge receipt of a reliable packet?

Accepted Answer

Ack. D is correct because the EIGRP Ack (Acknowledgement) packet is a special packet used exclusively to confirm the reliable delivery of EIGRP packets such as Update, Query, and Reply. Ack packets are sent as unicast to the source router and contain no data, serving only as a delivery confirmation. This mechanism ensures that EIGRP's Reliable Transport Protocol (RTP) can guarantee ordered and guaranteed delivery of critical routing information.

Answer

Hello

Answer

Update

Answer

Reply

Question 4

An engineer is troubleshooting why the NMS is not receiving SNMP traps from router R2. The configuration includes 'snmp-server enable traps', 'snmp-server host 10.1.1.100 version 2c public', and an extended ACL 100 that permits UDP port 162 from 10.1.1.100. The NMS can ping R2. What is the most likely cause?

Accepted Answer

The ACL is applied inbound on the interface, but it should be applied outbound to allow trap packets to leave the router.. The most likely cause is that the ACL is applied inbound on the interface, but it should be applied outbound to allow trap packets to leave the router. SNMP traps are UDP packets sourced from the router (typically from a random high port) and destined to the NMS at UDP port 162. An inbound ACL filters traffic entering the interface, not leaving it, so it would not affect outgoing trap packets. Applying the ACL outbound would permit the trap traffic to exit the router and reach the NMS.

Answer

The 'snmp-server host' command is missing the 'trap' keyword, causing the router to send informs instead.

Answer

The community string 'public' is case-sensitive; the NMS is using 'Public' with a capital P.

Answer

The router needs the 'snmp-server trap-source' command to specify the source interface for traps.

Question 5

Which BGP attribute is used as the first tie-breaker when selecting the best path in a VRF-Lite environment?

Accepted Answer

Weight. BGP selects the path with the highest weight (Cisco proprietary) as the first tie-breaker, followed by local preference.

Answer

Local preference

Answer

AS path length

Answer

MED

Question 6

An EIGRP network is experiencing frequent stuck-in-active (SIA) events. Router R1 shows: 'show ip eigrp topology' includes routes in active state for several minutes. R1's configuration: router eigrp 100 timers active-time 3. R2, a neighbor, is reachable but has a large number of routes. What is the root cause?

Accepted Answer

The active-time timer is set too low (3 minutes), causing queries to time out before R2 can reply.. The 'timers active-time 3' command sets the active-time timer to 3 minutes, which is the default value. In a network where R2 has a large number of routes, the query and reply process can take longer than 3 minutes, causing R1 to declare the route as stuck-in-active (SIA) and reset the neighbor relationship. This is a common misconfiguration where the active-time timer is not increased to accommodate slow query propagation or large route tables.

Answer

R2 has a stuck-in-active condition due to a routing loop.

Answer

R1 has a misconfigured distribute-list that blocks query replies from R2.

Answer

The network has a high latency link that delays query propagation.

Question 7

A network engineer runs the following command on Router R1:

R1# show snmp trap

SNMP Trap: enabled

Trap receiver: 192.168.1.100
    Community: PUBLIC
    Version: 2c
    UDP port: 162
    Enable traps: snmp, interface, bgp

Trap receiver: 192.168.1.200
    Community: PRIVATE
    Version: 2c
    UDP port: 162
    Enable traps: snmp, ospf

Based on this output, which statement is correct?

Accepted Answer

BGP traps will be sent to 192.168.1.100 but not to 192.168.1.200.. The output shows that traps are configured per receiver. The first receiver (192.168.1.100) has 'Enable traps: snmp, interface, bgp', while the second receiver (192.168.1.200) has 'Enable traps: snmp, ospf'. Since BGP is not listed for the second receiver, BGP traps will only be sent to 192.168.1.100, making option A correct.

Answer

Both receivers will receive OSPF traps.

Answer

The traps are sent using SNMPv3.

Answer

Interface traps are sent to 192.168.1.200.

Question 8

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# show bgp neighbors 10.0.0.2 advertised-routes

Output:
BGP table version is 10, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      0.0.0.0                  0         32768 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is advertising two local prefixes to BGP neighbor 10.0.0.2. The show bgp neighbors advertised-routes command displays routes that the router is advertising to the specified neighbor. Here, R1 is advertising two prefixes (10.1.1.0/24 and 10.2.2.0/24) to neighbor 10.0.0.2. Both are locally originated (next hop 0.0.0.0) with origin IGP.

Answer

R1 is receiving two prefixes from BGP neighbor 10.0.0.2

Answer

R1 has no BGP routes

Answer

R1 is using OSPF to learn these prefixes

Question 9

A network engineer runs the following command to verify DHCPv4 server statistics on router R1:

R1# show ip dhcp server statistics

Output:
 Memory usage: 12345
 Address pools: 2
 Database agents: 0
 Automatic bindings: 150
 Manual bindings: 5
 Expired bindings: 10
 Malformed messages: 0

Message    Received
 BOOTREQUEST    0
 DHCPDISCOVER   200
 DHCPREQUEST    180
 DHCPDECLINE    2
 DHCPRELEASE    5
 DHCPINFORM     10

What does this output indicate?

Accepted Answer

The DHCP server has 150 active automatic bindings and 5 manual bindings.. The 'Automatic bindings: 150' and 'Manual bindings: 5' fields directly indicate the number of active leases assigned dynamically (via DHCP) and statically (via manual configuration), respectively. These represent the current active bindings on the DHCP server, with no other interpretation needed.

Answer

The DHCP server has received 200 DHCPREQUEST messages.

Answer

The DHCP server has 10 malformed messages, indicating a configuration issue.

Answer

The DHCP server has 2 database agents configured.

Question 10

An engineer is troubleshooting an EIGRP issue where a router is not learning any routes from a neighbor, but the neighbor adjacency is up. The engineer checks the EIGRP topology table on the local router and sees that the neighbor is listed, but no routes from that neighbor are present. The engineer also verifies that the neighbor has routes to advertise. What is the most likely cause?

Accepted Answer

The neighbor is configured as an EIGRP stub router.. When an EIGRP neighbor adjacency is up but no routes are received from the neighbor, the most likely cause is that the neighbor is configured as an EIGRP stub router. A stub router advertises only a default route or its directly connected and summary routes, depending on the stub setting, and does not advertise all learned routes. Since the engineer confirmed the neighbor has routes to advertise, the stub configuration on the neighbor would prevent those routes from being sent, even though the adjacency remains established.

Answer

The local router has a distribute-list out applied to the neighbor.

Answer

The EIGRP metric weights are different on the two routers.

Answer

The local router has a route-map applied to the EIGRP process that is filtering all routes.

Question 11

Which TWO statements about the 'show policy-map control-plane' command output are true? (Choose TWO.)

Accepted Answer

The output displays the number of packets that matched each class in the CoPP policy.. The 'show policy-map control-plane' command output displays per-class packet statistics, including the number of packets that matched each class in the Control Plane Policing (CoPP) policy. This allows administrators to verify which traffic types are being classified and how much traffic is hitting the control plane.

Answer

The output shows the routing table entries that are affected by the CoPP policy.

Answer

The output displays the CoPP policy applied to each physical interface.

Answer

The output includes the ARP cache entries that are protected by CoPP.

Question 12

Router R6 has the following DHCPv6 configuration:

ipv6 dhcp pool DHCP6_POOL3
 address prefix 2001:db8:3::/64 lifetime 3600 600
 dns-server 2001:db8::1
!
interface GigabitEthernet0/2
 ipv6 address 2001:db8:3::1/64
 ipv6 dhcp server DHCP6_POOL3
 ipv6 nd managed-config-flag
 no shutdown

What is the effect of the lifetime parameters 3600 and 600?

Accepted Answer

The preferred lifetime is 3600 seconds and the valid lifetime is 600 seconds, which is invalid because the valid lifetime must be greater than or equal to the preferred lifetime.. In the `ipv6 dhcp pool` configuration, the `lifetime` command specifies the preferred lifetime first (3600 seconds) and the valid lifetime second (600 seconds). According to RFC 4862, the valid lifetime must be greater than or equal to the preferred lifetime; otherwise, the configuration is invalid and will be rejected by the router. This mismatch causes the DHCPv6 pool to fail to apply the prefix.

Answer

The preferred lifetime is 600 seconds and the valid lifetime is 3600 seconds, which is a typical configuration.

Answer

The lifetimes are applied to the DNS server address, not the address prefix.

Answer

The configuration is valid and will work as expected.

Question 13

An engineer enables 'ipv6 destination guard' on a switch to prevent IPv6 address spoofing. After configuration, a legitimate host on a port is unable to receive traffic from the network, although it can send traffic. The host has a global unicast address. The switch logs show that destination guard is dropping packets destined to that host. What is the most likely cause?

Accepted Answer

The host uses IPv6 privacy extensions and changes its address frequently, but the binding table only has the original address.. IPv6 destination guard relies on the IPv6 neighbor discovery (ND) binding table to validate destination addresses. If the host uses IPv6 privacy extensions (RFC 4941), it generates temporary addresses that change frequently. The binding table only contains the original address learned from the initial ND exchange, so packets destined to the new temporary address are dropped as spoofed, even though the traffic is legitimate.

Answer

Destination Guard blocks all global unicast addresses by default.

Answer

The switch port is not configured as 'trusted' for destination guard.

Answer

The host is using a link-local address, which destination guard does not support.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 192.168.1.2
BGP neighbor is 192.168.1.2,  remote AS 65001, external link
  BGP version 4, remote router ID 10.2.2.2
  BGP state = Established, up for 00:15:00
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is multisession capable
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN: advertised and received
    Address family IPv4 Unicast: advertised and received
    Enhanced Refresh: advertised
  Message statistics:
    InQ depth is 0
    OutQ depth is 0
                         Sent       Rcvd
    Opens:                  1          1
    Notifications:          0          0
    Updates:               10          5
    Keepalives:            15         15
    Route Refresh:          0          0
    Total:                 26         21
  Default minimum time between advertisement runs is 30 seconds

For address family: IPv4 Unicast
  Session: 192.168.1.2
  BGP table version 14, neighbor version 14/0
  Output queue size : 0
  Index 1, Advertise bit 0
  1 update-group member
  Incoming update prefix filter list: FILTER_IN
  Outgoing update prefix filter list: FILTER_OUT
                                   Sent       Rcvd
  Prefixes:                           2          2
  Updates:                           10          5

Based on this output, what is the effect of the prefix lists?

Accepted Answer

The prefix lists FILTER_IN and FILTER_OUT are allowing only 2 prefixes in each direction.. The output shows that incoming and outgoing prefix filters (FILTER_IN and FILTER_OUT) are applied. The prefixes sent and received are both 2, indicating that the filters are allowing exactly 2 prefixes in each direction. The correct answer is that the prefix lists are filtering routes to only 2 prefixes.

Answer

The prefix lists are blocking all prefixes.

Answer

The prefix lists are not applied because the session is established.

Answer

The prefix lists are misconfigured and causing route flapping.

Question 15

A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?

Accepted Answer

Configure 'logging trap errors' under the logging host configuration to limit remote messages to severity 3 and above.. The 'logging trap errors' command limits the severity of syslog messages sent to the remote syslog server (10.1.1.100) to level 3 (errors) and above, reducing the volume of remote messages while leaving the local 'logging buffered 4096 debugging' unchanged to capture critical alerts locally. This directly addresses the requirement to reduce remote syslog traffic without affecting local logging of critical alerts.

Answer

Change 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' to reduce local messages.

Answer

Remove the 'logging buffered' command to stop all local logging.

Answer

Add 'logging rate-limit 10' to limit the number of messages per second.

Question 16

What is the default SNMPv3 engine ID format on a Cisco IOS device?

Accepted Answer

The MAC address of the lowest-numbered interface. The default SNMPv3 engine ID on a Cisco IOS device is derived from the MAC address of the lowest-numbered interface (e.g., GigabitEthernet0/0). This ensures a unique identifier for the SNMP engine, as required by RFC 3411, without requiring manual configuration. The engine ID is constructed by concatenating a 12-character hex string representing the MAC address with a fixed enterprise-specific prefix.

Answer

A random 32-bit integer

Answer

The IP address of the management interface

Answer

A manually configured string; no default exists

Question 17

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Accepted Answer

The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.. EEM applets execute actions sequentially. If a 'set' action modifies a variable, that new value is used in any subsequent 'if' condition that references the same variable. Variables are not pre-evaluated; they are evaluated at the time the action is executed.

Answer

The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

Answer

The 'set' action cannot modify a variable that is used in an 'if' condition.

Answer

The applet will fail if a variable is modified after being used in an 'if' condition.

Question 18

Which TWO statements about the behavior of administrative distance in Cisco IOS are correct? (Choose TWO.)

Accepted Answer

The default administrative distance for an EIGRP summary route is 5.. Administrative distance (AD) is a trustworthiness metric used to select the best route among multiple routing protocols. A lower AD is preferred. The default AD for EIGRP summary routes is 5, which is lower than the default AD for OSPF (110). The distance command can be applied to a routing process to change the AD for all routes learned via that protocol, but it does not affect connected or static routes unless explicitly configured. The show ip route command displays the AD of each route, and the AD value is used to break ties when multiple protocols provide routes to the same destination.

Answer

The default administrative distance for OSPF is 90.

Answer

The distance command applied under a routing protocol can modify the AD for all routes, including connected and static routes, learned via that protocol.

Answer

When two different routing protocols provide routes to the same destination, the route with the higher administrative distance is installed in the routing table.

Question 19

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 130
    10 deny ip 192.168.1.0 0.0.0.255 any (0 matches)
    20 permit ip any any (1000 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic from 192.168.1.0/24 is being permitted.. The ACL processes packets sequentially: line 10 denies traffic from 192.168.1.0/24 but has 0 matches, meaning no packets from that source have been evaluated. Line 20 permits all other traffic and has 1000 matches, so traffic from 192.168.1.0/24 is implicitly permitted by the permit any any statement since it is never denied.

Answer

Traffic from 192.168.1.0/24 is being denied.

Answer

The ACL is blocking all traffic.

Answer

The ACL is misconfigured because line 10 is not needed.

Question 20

A network engineer runs the following command to troubleshoot BFD session flapping:

R1# debug bfd packet

*Mar  1 00:15:23.456: BFD: [R1-to-R3] received async packet from 10.5.5.2, state UP, diag 0
*Mar  1 00:15:23.457: BFD: [R1-to-R3] sending async packet, state UP
*Mar  1 00:15:23.458: BFD: [R1-to-R3] received echo packet from 10.5.5.2, state UP
*Mar  1 00:15:23.459: BFD: [R1-to-R3] echo packet lost, no echo received for 300 ms
*Mar  1 00:15:23.460: BFD: [R1-to-R3] state UP -> DOWN (echo failure)

What does this output indicate?

Accepted Answer

BFD session went DOWN because of echo timeout, indicating possible path issue.. The debug output shows that BFD detected an echo failure (no echo packets received for 300 ms), causing the session to go DOWN. This indicates a connectivity issue or misconfiguration affecting echo mode.

Answer

BFD session is UP and stable.

Answer

BFD async packets are failing, causing session down.

Answer

BFD session is flapping due to misconfigured multiplier.