300-410 Practice Test 11 — 15 Questions

Question 1

A network engineer is troubleshooting a BGP route-map that is supposed to set a community value on routes from a specific neighbor. The engineer configures a route-map with 'set community 100:100' and applies it inbound to the neighbor. After the configuration, the engineer checks the BGP table on the local router and sees that the routes do not have the community set. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The neighbor is missing the 'send-community' command under the BGP neighbor configuration.. By default, BGP does not send or receive communities unless the 'neighbor send-community' command is configured. Even if the route-map sets the community, the router will not attach it to the routes unless the neighbor is configured to send communities.

Answer

The route-map is applied outbound instead of inbound.

Answer

The community value 100:100 is reserved and cannot be used.

Answer

The route-map has a 'match community' statement that is filtering the routes before the set command.

Question 2

An engineer configures iBGP between two routers in the same AS. The BGP table shows the prefix, but it is not installed in the routing table. The next-hop is reachable via an IGP route. Which is the most likely explanation?

Accepted Answer

BGP synchronization is enabled, and the prefix is not present in the IGP.. When BGP synchronization is enabled, the router will not install an iBGP-learned prefix into the routing table unless the same prefix is also present in the IGP (e.g., OSPF or EIGRP). Since the next-hop is reachable via IGP but the prefix itself is not in the IGP, the synchronization rule blocks the route from being installed. This is a classic scenario where the BGP table shows the prefix, but it is missing from the routing table.

Answer

The next-hop-self command is missing on the iBGP peer.

Answer

The prefix is filtered by an inbound route-map.

Answer

The maximum-paths limit is exceeded.

Question 3

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla monitor statistics 10

Round Trip Time (RTT) for Index 10
   Latest RTT: 12 ms
   Latest RTT (milliseconds): 12
   Latest RTT (microseconds): 12000
   Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021
   Last operation return code: OK
   Number of successes: 100
   Number of failures: 0
   Operation time to live: Forever

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is functioning correctly with no failures.. This output is from the older 'ip sla monitor' command, which is equivalent to 'ip sla'. It shows the same statistics: 100 successes, 0 failures, and a return code of OK, indicating the probe is working.

Answer

The IP SLA monitor operation has failed because the return code is 'OK'.

Answer

The IP SLA monitor operation is not configured for index 10.

Answer

The IP SLA monitor operation has a timeout of 12 ms.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip ospf interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.12.1/24, Area 0
  Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 10.1.1.2, Interface address 192.168.12.2
  Backup Designated router (ID) 10.1.1.1, Interface address 192.168.12.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.1.1.2  (Designated Router)
  Suppress hello for 0 neighbor(s)

Based on this output, which statement is correct?

Accepted Answer

The dead timer is set to 40 seconds and is functioning correctly.. The interface is in state BDR, meaning Router R1 is the backup designated router. The DR is 10.1.1.2. The output shows one neighbor, which is the DR, and the adjacency is full.

Answer

Router R1 is the Designated Router on this segment.

Answer

Router R1 has a priority of 0, preventing it from becoming DR.

Answer

Router R1 is not receiving hello packets from the DR.

Question 5

CoPP rate-limit is impacting legitimate traffic due to route summarization. Router R1 has:
access-list 100 permit ip 10.0.0.0 0.0.3.255 any
!
class-map match-all COPP-CLASS
 match access-group 100
!
policy-map COPP-POLICY
 class COPP-CLASS
  police 10000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY
!
router eigrp 100
 network 10.0.0.0
!
interface GigabitEthernet0/0
 ip summary-address eigrp 100 10.0.0.0 255.255.252.0
!
R2 (10.0.1.1) sends EIGRP packets to R1, but they are being dropped. What is the root cause?

Accepted Answer

The CoPP policy matches EIGRP traffic from the summarized range and polices it, causing EIGRP packets to be dropped.. The CoPP policy matches traffic from 10.0.0.0/22 and polices it to 10 kbps. EIGRP packets from R2 (10.0.1.1) are within this range and are subject to policing. If the EIGRP traffic rate exceeds 10 kbps, packets are dropped, causing neighbor flapping. The summary route itself does not cause the drop, but the CoPP policy inadvertently includes EIGRP traffic. The fix is to create a separate class for EIGRP or adjust the ACL.

Answer

The summary route causes EIGRP to send packets to the control plane at a high rate, exceeding the policer.

Answer

EIGRP is not enabled on the interface, so packets are dropped.

Answer

The control-plane policy is applied in the wrong direction.

Question 6

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# debug ip sla monitor trace

IP SLAs Monitor trace debugging is on

*Mar  1 12:34:56.789: IP SLAs Monitor: Starting operation 10
*Mar  1 12:34:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs Monitor: RTT = 12 ms
*Mar  1 12:34:56.790: IP SLAs Monitor: Operation 10 completed successfully
*Mar  1 12:35:56.789: IP SLAs Monitor: Starting operation 10
*Mar  1 12:35:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs Monitor: RTT = 14 ms
*Mar  1 12:35:56.790: IP SLAs Monitor: Operation 10 completed successfully

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is successfully sending and receiving ICMP echo probes.. This debug output shows the IP SLA monitor trace for operation 10. Each cycle shows a successful ICMP echo request/reply with RTT values, indicating the probe is working correctly.

Answer

The IP SLA monitor operation is failing because the RTT values are increasing.

Answer

The IP SLA monitor operation is not configured because no configuration is shown.

Answer

The IP SLA monitor operation is timing out because no reply is received.

Question 7

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show ip interface brief | include Gi0/0
GigabitEthernet0/0           10.1.1.1       YES NVRAM  up                    up

R1# show monitor session 7 detail
Session 7
---------
Type                   : ERSPAN Source Session
Source Ports           : 
    Both               : Gi0/1
Destination IP         : 10.1.1.2
ERSPAN ID              : 300

What does this output indicate?

Accepted Answer

The ERSPAN session is correctly configured and the destination IP is reachable.. The output shows that interface Gi0/0 has IP address 10.1.1.1 and is up/up, and ERSPAN session 7 has destination IP 10.1.1.2. This indicates that the ERSPAN source session is configured to send traffic to 10.1.1.2, which is reachable via Gi0/0.

Answer

The ERSPAN session is misconfigured because the source port must have an IP address.

Answer

The ERSPAN session is misconfigured because the destination IP must be on the same subnet as the source.

Answer

The ERSPAN session is misconfigured because the ERSPAN ID must be unique across all sessions.

Question 8

An OSPF network is experiencing routing loops between two routers. R1 has the following configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip ospf network point-to-point. R2 has: interface GigabitEthernet0/0 ip address 10.1.1.2 255.255.255.0 ip ospf network broadcast. Both routers are in area 0. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR, but R2 shows R1 as FULL/DROTHER. Traffic between two subnets behind each router is looping. What is the root cause?

Accepted Answer

The OSPF network type mismatch causes both routers to become DR/BDR, leading to incorrect LSA generation and routing loops.. OSPF network type mismatch on a multi-access link can cause adjacency issues. R1 is configured as point-to-point, which does not participate in DR/BDR election and expects a point-to-point link. R2 is configured as broadcast, which expects a DR/BDR election. This mismatch can cause both routers to form an adjacency (since OSPF still works), but they have different views of the network. R1 thinks the link is point-to-point and does not expect a DR, so it may advertise the link as a stub network or with different metrics. R2 thinks it is the DR (since R1 is not participating in election), and it advertises the link as a transit network. This inconsistency can cause routing loops because R1 may advertise a route via R2, and R2 may advertise the same route via R1, creating a loop. The correct fix is to match the network type on both ends.

Answer

The IP addresses are on the same subnet, but the OSPF cost is set differently, causing unequal cost load balancing.

Answer

The OSPF hello and dead intervals are mismatched due to the network type, causing the adjacency to flap.

Answer

The OSPF area is misconfigured; one router is in a different area.

Question 9

A network engineer configures the following on a router:
```
router eigrp 100
 distance 150 10.0.0.0 0.255.255.255
```
What is the intended effect?

Accepted Answer

It sets the administrative distance to 150 for routes learned from any neighbor whose source IP matches the wildcard mask 0.255.255.255.. The `distance` command with an access-list qualifier sets AD for routes matching the ACL. Here, routes from the 10.0.0.0/8 range will have AD 150.

Answer

It sets the administrative distance for all EIGRP routes to 150.

Answer

It sets the administrative distance to 150 for all routes in the routing table with destination 10.0.0.0/8.

Answer

It sets the administrative distance to 150 for EIGRP external routes only.

Question 10

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify IP connectivity between redistribution points. Troubleshooting connectivity failures due to redistribution starts with checking basic Layer 3 reachability, then verifying routing protocol adjacencies, followed by examining the redistribution configuration, then checking for route filtering issues, and finally testing end-to-end connectivity. This order isolates the problem systematically.

Question 11

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The traffic has a source IP that belongs to the customer's prefix, which is reachable via a different interface on the router. Which is the most likely explanation?

Accepted Answer

The customer traffic is arriving on an interface where the return path to the source is via a different interface, violating strict uRPF.. Strict uRPF checks that the source IP of incoming packets has a route back out the same interface. If the best path to the source IP is via a different interface (asymmetric routing), the packet is dropped. This is a classic edge case with strict uRPF in asymmetric routing scenarios.

Answer

The 'ip verify unicast source reachable-via any' command was used instead of 'rx'.

Answer

The router has a default route pointing out the same interface, causing uRPF to pass all traffic.

Answer

The 'ip urpf allow-default' command is missing, causing default routes to be ignored.

Question 12

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

Accepted Answer

The router drops the packet silently.. RFC 2460 specifies that an IPv6 router must silently drop any packet with a multicast source address, as multicast addresses are only valid as destination addresses. This behavior prevents loops and misuse of multicast addressing in the network layer.

Answer

The router forwards the packet normally.

Answer

The router sends an ICMPv6 error message back to the source.

Answer

The router rewrites the source address to the link-local address of the interface.

Question 13

What is the default uRPF mode when 'ipv6 verify unicast source reachable-via' is configured without any keyword?

Accepted Answer

Strict mode (rx). When 'ipv6 verify unicast source reachable-via' is configured without any keyword, the default mode is strict (rx). In strict mode, the router checks that the source address of an incoming IPv6 packet is reachable via the exact interface on which the packet was received, using the FIB. This prevents source address spoofing by ensuring the return path matches the ingress interface.

Answer

Loose mode (any)

Answer

No uRPF is applied

Answer

Only default routes are allowed

Question 14

An engineer configures an IPv4 ACL on a router's interface to permit only HTTP traffic (TCP port 80) from a specific subnet. The ACL is applied inbound. After applying, the router's web interface (HTTPS) becomes unreachable from the same subnet. What is the most likely explanation?

Accepted Answer

The ACL denies HTTPS traffic because it is not explicitly permitted.. The ACL is applied inbound on the router interface and only permits TCP port 80 (HTTP). HTTPS uses TCP port 443, which is not explicitly permitted. Since IPv4 ACLs end with an implicit deny any, all traffic not matching a permit statement, including HTTPS, is denied. This causes the router's web interface (HTTPS) to become unreachable from the subnet.

Answer

The ACL is applied outbound, filtering traffic to the web server.

Answer

The router's web server uses HTTP, not HTTPS.

Answer

The ACL is blocking TCP port 80 due to a typo.

Question 15

In an MPLS LDP network, routers R1 and R2 are directly connected via GigabitEthernet0/0. R1 shows 'show mpls ldp neighbor' output: 'Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0, TCP connection: 10.0.0.2.646 - 10.0.0.1.646, State: OPERATIONAL' but 'show mpls forwarding-table' for prefix 192.168.1.0/24 shows 'No label'. R2 has the same prefix in its routing table. What is the root cause?

Accepted Answer

R2 does not have MPLS enabled on the interface facing the prefix's origin; LDP only labels routes learned via MPLS-enabled interfaces.. LDP neighbors are operational, but label binding may fail if the IGP (e.g., OSPF) has a route to the prefix but LDP does not advertise a label for it. This can occur if the prefix is a connected route on R2 but R2's LDP is not configured to advertise labels for connected routes (e.g., 'no mpls ldp advertise-labels' or route filtering). Alternatively, R2 may have the prefix via a different interface not running MPLS.

Answer

R1 has an ACL blocking LDP label advertisement for prefix 192.168.1.0/24.

Answer

The MTU mismatch between R1 and R2 causes label distribution failure.

Answer

R1's MPLS forwarding table is full; no room for new labels.