300-410 Practice Test 12 — 15 Questions

Question 1

Which BGP attribute is considered 'well-known mandatory' and must be present in all BGP update messages?

Accepted Answer

AS_PATH. The AS_PATH attribute is well-known mandatory, meaning it must be included in all BGP updates. Other well-known mandatory attributes include NEXT_HOP and ORIGIN.

Answer

LOCAL_PREF

Answer

MED

Answer

COMMUNITY

Question 2

A network engineer runs the following command to verify BFD operation:

R1# show bfd neighbors detail

IPv4 Sessions
NeighAddr      LD/RD         RH/RS     State     Int
10.1.1.2      1/2           Up        Up        Gi0/0
Session state is UP and not using echo function.
Session type: single-hop
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 0 (0), Hello (hits): 1000/5
Rx Count: 1000, Rx Interval (ms) min/max/avg: 900/1100/1000
Tx Count: 1000, Tx Interval (ms) min/max/avg: 900/1100/1000

What does this output indicate?

Accepted Answer

BFD session is operating with async mode, intervals at 1 second.. The output shows a BFD session in UP state with consistent transmit and receive intervals around 1000 ms, no echo function, and a multiplier of 3. The session is healthy.

Answer

BFD session is using echo mode for fast failure detection.

Answer

BFD session is down and not sending hellos.

Answer

BFD session has a holddown timer of 3 seconds.

Question 3

A network engineer runs the following command to troubleshoot a VRF-Lite CoPP issue:

R1# show policy-map control-plane input class CoPP-ACL vrf CUSTOMER_I

Output:
  Class-map: CoPP-ACL (match-all)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: access-group 100
    police:
        cir 8000 bps, bc 1500 bytes, be 1500 bytes
      conformed 0 packets, 0 bytes; actions:
        transmit
      exceeded 0 packets, 0 bytes; actions:
        drop
      violated 0 packets, 0 bytes; actions:
        drop

What does this output indicate?

Accepted Answer

The CoPP policy is rate-limiting traffic to 8000 bps, but no traffic has matched the class yet.. The output shows '0 packets, 0 bytes' matched and a 5-minute offered rate of 0 bps, meaning no traffic has hit the class-map yet. The police stanza confirms the policy is configured to rate-limit matching traffic to a CIR of 8000 bps with a 1500-byte burst, but since no packets have matched access-group 100, no conform/exceed/violate counters have incremented. This indicates the CoPP policy is armed and applied, but simply idle.

Answer

The CoPP policy is dropping all packets that match access-group 100.

Answer

The CoPP policy has matched many packets and is dropping them due to exceeding the rate.

Answer

The CoPP policy is not applied to the control plane for this VRF.

Question 4

A network engineer runs the following command to verify Flexible NetFlow record configuration:

R1# show flow record FLOW-RECORD-1

flow record FLOW-RECORD-1
    match ipv4 source address
    match ipv4 destination address
    match ip protocol
    collect counter bytes
    collect counter packets
    collect timestamp sys-uptime first
    collect timestamp sys-uptime last

What does this output indicate?

Accepted Answer

The record matches on source and destination IP addresses and protocol, and collects byte/packet counters and timestamps.. The output shows the definition of a Flexible NetFlow record. It matches on source IP, destination IP, and protocol, and collects byte and packet counters along with timestamps for the first and last packet of the flow.

Answer

The record collects only packet counts, not byte counts.

Answer

The record does not include any timestamp information.

Answer

The record matches on TCP flags.

Question 5

Which of the following is a valid 'set' action in a PBR route-map?

Accepted Answer

set ip next-hop 10.0.0.1. In Cisco PBR (Policy-Based Routing) route-maps, 'set ip next-hop 10.0.0.1' is a valid set action that specifies the next-hop IP address for matching packets, overriding the normal routing table lookup. This is one of the most commonly used PBR set commands and is supported in route-map configuration mode.

Answer

set metric 100

Answer

set tag 5

Answer

set community 100:100

Question 6

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify ACL application on interface and direction. Start by confirming the ACL is applied to the correct interface and direction; then check for implicit deny blocking traffic; verify sequence numbers and order; examine log entries for hits; finally, adjust ACL by inserting a permit statement before the deny.

Question 7

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      500 packets, 30000 bytes
      5 minute offered rate 1000 bps, drop rate 500 bps
      Match: access-group 120
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 300 packets, 18000 bytes; actions:
          transmit
        exceeded 100 packets, 6000 bytes; actions:
          drop
        violated 100 packets, 6000 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

BGP traffic is being rate-limited and some packets are being dropped.. The output shows that under the CoPP-BGP class, the police command has a committed information rate (CIR) of 8000 bps. The counters indicate 100 packets exceeded and 100 packets violated, both with a drop action, while only 300 packets conformed and were transmitted. This confirms that BGP traffic is being rate-limited and some packets are being dropped, making option B correct.

Answer

All BGP packets are being transmitted without any drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching BGP traffic.

Question 8

What is missing from this RSPAN configuration on a switch?

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination remote vlan 100

Assume VLAN 100 exists but is not configured as an RSPAN VLAN.

Accepted Answer

The 'remote-span' command under VLAN 100.. For RSPAN to work, the VLAN used as the destination remote VLAN must be configured with the 'remote-span' command. Without it, the session will not function correctly.

Answer

An IP address on the destination interface.

Answer

A destination interface on the source switch.

Answer

The 'no shutdown' command on VLAN 100.

Question 9

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Flap
3    00:01:32 UTC Mar 1  syslog              EIGRP_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Accepted Answer

The router is experiencing network instability causing repeated neighbor state changes.. The 'show event manager history events' command shows the last triggered events. The output shows repeated syslog events for EIGRP neighbor down and OSPF neighbor flap within a short timeframe, indicating a flapping condition. The correct answer is that the router is experiencing network instability causing repeated neighbor state changes.

Answer

The EEM policies are not configured correctly.

Answer

The EEM applet policies are disabled.

Answer

The syslog server is not reachable.

Question 10

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, the router becomes unreachable via SSH and SNMP. The engineer checks the policy and confirms that the class-map for SSH and SNMP traffic is set to 'permit'. What is the most likely explanation?

Accepted Answer

The class-default is set to 'drop', causing all unmatched traffic to be dropped, including SSH and SNMP if they are not correctly classified.. In CoPP, the class-default class defines the action for traffic that does not match any of the defined classes. If class-default is set to 'drop', then any traffic not explicitly matched by a permit class will be dropped. Even though the class-map for SSH and SNMP is set to 'permit', if the traffic is not correctly classified (e.g., due to an incorrect ACL or match condition), it falls into class-default and is dropped. This would cause SSH and SNMP to become unreachable.

Answer

The 'rate-limit' is configured in bps instead of pps, causing excessive policing.

Answer

The 'service-policy' is applied to the control-plane input direction, but SSH and SNMP are output traffic.

Answer

The class-map for SSH and SNMP uses a 'match-all' condition, but the access-list has multiple entries that are ORed.

Question 11

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip access-lists 130
Extended IP access list 130
    10 deny ip host 10.1.1.1 host 10.2.2.2
    20 permit ip any any

Then the engineer runs:
R1# debug ip packet 130
IP packet debugging is on for access list 130
*Mar  1 00:20:10.123: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto ICMP, access list 130: matched line 10 deny ip host 10.1.1.1 host 10.2.2.2

What does this output indicate?

Accepted Answer

ICMP traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 130.. The debug output explicitly shows that the packet with source 10.1.1.1 and destination 10.2.2.2 matched line 10 of ACL 130, which is a deny statement. Since the ACL is evaluated sequentially and the first match is a deny, the ICMP traffic is denied. The debug message confirms the match, so option A is correct.

Answer

ICMP traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 130.

Answer

ACL 130 is applied outbound on GigabitEthernet0/0.

Answer

ACL 130 is not matching any packets.

Question 12

A network engineer runs the following command on Router P1:

P1# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.48632
        State: Oper, Msgs sent/rcvd: 120/118, Downstream
        Up time: 00:12:34
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.1.1.2
        Addresses bound to peer LDP Ident:
          10.0.0.2         192.168.1.1

Based on this output, which statement is correct?

Accepted Answer

The LDP session is up and functioning correctly.. The output shows 'State: Oper', which indicates the LDP session is in the Operational state — the normal, fully-established state for an LDP session. The TCP connection is present (10.0.0.2.646 - 10.0.0.1.48632), messages are being exchanged (120 sent / 118 received), and the uptime of 00:12:34 confirms the session has been stable. All of these indicators confirm the LDP session is up and functioning correctly.

Answer

The LDP session is down.

Answer

The router is not receiving label bindings from the neighbor.

Answer

The LDP router ID is misconfigured.

Question 13

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip local policy
Interface   Route-map
local       PBR-LOCAL

What does this output indicate?

Accepted Answer

Local PBR is enabled for packets originated by the router.. The 'show ip local policy' command specifically displays the route-map applied to locally generated traffic (packets originated by the router itself, such as pings, SNMP, syslog, or management traffic). The output shows 'local' in the Interface column with route-map PBR-LOCAL, confirming that Local PBR is active and will be evaluated against any packets the router sources. This is distinct from interface PBR, which is applied with 'ip policy route-map' under an interface and affects transit traffic.

Answer

PBR is applied to all incoming interfaces.

Answer

The route-map PBR-LOCAL is not configured.

Answer

PBR is applied to all outgoing interfaces.

Question 14

Which TWO configuration steps are required to implement Control Plane Policing (CoPP) on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

Create a policy map that defines a police action for the classified traffic.. A policy map is required to define the police action (e.g., 'police rate 10000 conform-action transmit exceed-action drop') that enforces rate limiting on the classified traffic. Without a policy map specifying the policing parameters, CoPP cannot apply any QoS action to the control plane traffic. Option C is correct because a class map is necessary to classify the specific traffic types (e.g., SSH, BGP, ICMP) that should be subjected to policing, using match statements based on access lists or protocol headers.

Answer

Apply the policy map to a physical interface using the 'service-policy input' command.

Answer

Configure a 'shape average' command in the policy map to limit traffic rate.

Answer

Apply the policy map to the control plane using the 'service-policy input' command under the interface configuration mode.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology 10.10.10.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(192.168.1.1) for 10.10.10.0/24
  State: Passive, Reply status: 0, Originating router: 192.168.1.1
  Routing Descriptor Blocks:
  0.0.0.0 (Null0) from 0.0.0.0, Send flag: 0x0
      Composite metric: (2560000000/0), Route is Internal
      Vector metric:
        Minimum bandwidth: 100000 Kbit
        Total delay: 100 microseconds
        Reliability: 255/255
        Load: 1/255
        Minimum MTU: 1500
        Hop count: 0

Based on this output, what is the problem?

Accepted Answer

The route is a local summary route pointing to Null0, which is normal for EIGRP summarization.. The output shows a Null0 summary route in EIGRP, which is normal when manual summarization is configured. The route is in Passive state with a composite metric of 2560000000/0, indicating it is a local summary route installed to prevent routing loops. This is expected behavior, not a problem.

Answer

The route has a metric of 2560000000, indicating a network failure.

Answer

The hop count of 0 means the route is not reachable.

Answer

The route is in Active state, indicating a problem.