300-410 Practice Test 12 — 15 Questions

Question 1

An engineer configures an IPv4 ACL on a router's interface to permit only HTTP traffic (TCP port 80) from a specific subnet. The ACL is applied inbound. After applying, the router's web interface (HTTPS) becomes unreachable from the same subnet. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL denies HTTPS traffic because it is not explicitly permitted.. The ACL is applied inbound on the router interface and only permits TCP port 80 (HTTP). HTTPS uses TCP port 443, which is not explicitly permitted. Since IPv4 ACLs end with an implicit deny any, all traffic not matching a permit statement, including HTTPS, is denied. This causes the router's web interface (HTTPS) to become unreachable from the subnet.

Answer

The ACL is applied outbound, filtering traffic to the web server.

Answer

The router's web server uses HTTP, not HTTPS.

Answer

The ACL is blocking TCP port 80 due to a typo.

Question 2

In an MPLS LDP network, routers R1 and R2 are directly connected via GigabitEthernet0/0. R1 shows 'show mpls ldp neighbor' output: 'Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0, TCP connection: 10.0.0.2.646 - 10.0.0.1.646, State: OPERATIONAL' but 'show mpls forwarding-table' for prefix 192.168.1.0/24 shows 'No label'. R2 has the same prefix in its routing table. What is the root cause?

Accepted Answer

R2 does not have MPLS enabled on the interface facing the prefix's origin; LDP only labels routes learned via MPLS-enabled interfaces.. LDP neighbors are operational, but label binding may fail if the IGP (e.g., OSPF) has a route to the prefix but LDP does not advertise a label for it. This can occur if the prefix is a connected route on R2 but R2's LDP is not configured to advertise labels for connected routes (e.g., 'no mpls ldp advertise-labels' or route filtering). Alternatively, R2 may have the prefix via a different interface not running MPLS.

Answer

R1 has an ACL blocking LDP label advertisement for prefix 192.168.1.0/24.

Answer

The MTU mismatch between R1 and R2 causes label distribution failure.

Answer

R1's MPLS forwarding table is full; no room for new labels.

Question 3

Consider the following configuration on a PE router:

ip vrf CUSTOMER-B
 rd 100:1
 route-target export 100:1
 route-target import 100:2
!
interface GigabitEthernet0/2
 ip vrf forwarding CUSTOMER-B
 ip address 192.168.2.1 255.255.255.252

What is the effect of this configuration?

Accepted Answer

The PE will export routes from VRF CUSTOMER-B with RT 100:1 and import routes with RT 100:2.. The VRF has a route distinguisher and route-targets. The export RT is 100:1, meaning routes from this VRF are exported with that RT. The import RT is 100:2, so only routes with RT 100:2 are imported. This is a common setup for hub-and-spoke or inter-AS options.

Answer

The PE will export routes with RT 100:2 and import routes with RT 100:1.

Answer

The VRF will not work because the RD and RT must be identical.

Answer

The VRF will not work because route-target import and export must be configured under the BGP VRF address-family.

Question 4

A network engineer runs the following command to verify DHCPv4 server bindings on router R1:

R1# show ip dhcp binding

Output:
 Bindings from all pools not associated with VRF:
 IP address       Client-ID/              Lease expiration        Type
                   Hardware address/
                   User name
 192.168.1.10     0050.7966.6800           Mar 01 2025 12:00 PM   Automatic
 192.168.1.11     0063.6973.636f.2d30      Mar 01 2025 01:00 PM   Automatic
 192.168.1.12     0100.1a.2b.3c.4d.5e     Mar 01 2025 02:00 PM   Automatic

What does this output indicate?

Accepted Answer

The DHCP server has dynamically assigned three IP addresses to clients.. The output shows three DHCP bindings with a 'Type' of 'Automatic', which indicates that the IP addresses were dynamically assigned by the DHCP server based on the pool configuration. The 'Client-ID' field contains the MAC address or client identifier provided by the client during the DORA process, confirming dynamic allocation rather than static mapping.

Answer

The DHCP server has three static bindings configured.

Answer

The DHCP server is out of IP addresses because all bindings are in use.

Answer

The DHCP server is using relay agents because the client IDs are long hexadecimal strings.

Question 5

Drag and drop the steps to configure IPv6 RA Guard on a switch into the correct order, from first to last.

Accepted Answer

Enable IPv6 snooping globally. First, globally enable IPv6 snooping. Then define an RA Guard policy with the trusted or untrusted role. Apply the policy to the desired interface. Verify the configuration with show commands. Finally, test the RA Guard operation by sending RAs from unauthorized ports.

Question 6

Examine the following partial configuration:

ip access-list extended MGMT_ACCESS
 permit tcp 10.0.0.0 0.255.255.255 any eq 22
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any
!
line vty 0 4
 access-class MGMT_ACCESS in
 transport input ssh
 login local

What is the effect of the 'access-class' command?

Accepted Answer

Only SSH and HTTPS connections from the 10.0.0.0/8 network are allowed to the VTY lines.. The `access-class` command applied to VTY lines with the `in` keyword filters inbound Telnet/SSH sessions to the router. The ACL `MGMT_ACCESS` permits TCP ports 22 (SSH) and 443 (HTTPS) from source network 10.0.0.0/8, and denies all other traffic. This restricts management access to only SSH and HTTPS connections originating from the 10.0.0.0/8 network.

Answer

The ACL filters traffic leaving the VTY lines, allowing SSH and HTTPS from any source.

Answer

All traffic from the 10.0.0.0/8 network is permitted to the router.

Answer

The configuration is missing 'permit ip any any' to allow other management protocols.

Question 7

A network engineer runs the following command to troubleshoot DMVPN NHRP:

R1# debug nhrp
NHRP: Registration request sent to 10.0.0.1 via GigabitEthernet0/0
NHRP: Registration reply received from 10.0.0.1
  Holding time: 3600 sec
  Flags: 0x0000
NHRP: Cache added 10.1.1.1/32 via 10.0.0.1, non-caching

What does this output indicate?

Accepted Answer

NHRP registration to the hub is successful.. The debug output shows that the spoke sent a registration request to the hub at 10.0.0.1 and received a registration reply with a holding time of 3600 seconds and flags set to 0x0000. The flags value of 0x0000 indicates that the hub accepted the registration without any errors or special conditions, and the subsequent cache addition confirms successful NHRP registration. Therefore, option A is correct.

Answer

NHRP registration failed because no reply was received.

Answer

NHRP registration is pending due to authentication failure.

Answer

NHRP registration is rejected by the hub.

Question 8

Drag and drop the steps to verify and validate IPv6 First Hop Security operational state into the correct order, from first to last.

Accepted Answer

Show ipv6 snooping global status. Start by checking global IPv6 snooping status. Then display the binding table for learned entries. Verify interface-specific FHS policies. Check the RA Guard policy counters for drops. Finally, validate the neighbor cache for correct MAC-to-IPv6 mappings.

Question 9

A large enterprise network is experiencing intermittent reachability to a critical server (10.10.10.10). Router R1 has the following relevant configuration:

ip sla 1
 icmp-echo 10.10.10.10 source-ip 192.168.1.1
 frequency 10
ip sla schedule 1 life forever start-time now

track 1 ip sla 1 reachability
 delay down 5 up 5

ip route 0.0.0.0 0.0.0.0 192.168.1.2 track 1

Router R2 (the next-hop) shows:

show ip route | include 10.10.10.10
S 10.10.10.0/24 [1/0] via 10.0.0.1

What is the root cause?

Accepted Answer

The IP SLA probe uses a source IP that is not reachable from the server, causing the probe to fail and the tracked route to be removed unnecessarily.. The IP SLA probes are sourced from 192.168.1.1, but the server 10.10.10.10 is in a different subnet. The return path from the server might not reach 192.168.1.1 due to route summarization or asymmetric routing. However, the key issue is that the tracked default route is removed when the probe fails, but the probe failure could be due to the server's response not being routed back correctly, not because the next-hop is unreachable. The correct answer is that the source IP of the probe is not routable from the server's perspective, causing false negatives.

Answer

The frequency of the IP SLA is too high, causing the router to overload and drop the tracked route.

Answer

The delay down 5 up 5 is too short, causing flapping of the tracked route.

Answer

The server 10.10.10.10 is not responding to ICMP echo requests due to a firewall.

Question 10

Which TWO actions will prevent IPv6 traffic with a spoofed source address from being forwarded in a network where BGP is used for routing? (Choose TWO.)

Accepted Answer

Apply uRPF loose mode on the customer-facing interface.. URPF (Unicast Reverse Path Forwarding) loose mode checks the source address of incoming IPv6 traffic against the routing table to ensure a route exists back to that source, without requiring the exact interface. This prevents spoofed source addresses from being forwarded when no route exists for the claimed source. Option B is correct because an inbound IPv6 ACL on the edge interface can explicitly deny traffic from reserved prefixes (e.g., RFC 6890) or internal prefixes that should never appear as source addresses from outside, effectively blocking spoofed traffic at the ingress point.

Answer

Use the 'ipv6 verify unicast source reachable-via any allow-default' command to allow traffic with default route.

Answer

Apply an outbound IPv6 ACL on the BGP neighbor interface to filter spoofed source addresses.

Answer

Disable BGP prefix filtering to allow all prefixes, then rely on uRPF only.

Question 11

Which EIGRP packet type is used to confirm receipt of an update during reliable transport?

Accepted Answer

ACK. C is correct because EIGRP uses a reliable transport protocol (RTP) to ensure delivery of certain packets like Updates, Queries, and Replies. The ACK packet is a lightweight, unreliable packet sent to explicitly acknowledge receipt of a reliable packet, confirming that the update was received without needing a full retransmission.

Answer

Hello

Answer

Update

Answer

Query

Question 12

Which TWO statements correctly describe the behavior of Policy-Based Routing (PBR) when using the 'set ip next-hop' and 'set ip default next-hop' commands? (Choose TWO.)

Accepted Answer

The 'set ip next-hop' command overrides the routing table only when the next-hop address is reachable; if unreachable, the packet is dropped unless a default route exists.. PBR uses route maps to override the routing table. The 'set ip next-hop' command is applied only if the packet matches the match criteria; if the next hop is unreachable, the packet is dropped (unless a default route exists). The 'set ip default next-hop' command is used only when the routing table has no explicit route for the destination. The 'set ip next-hop verify-availability' option tracks reachability using CEF. The 'set interface' command does not require a next-hop IP but can be used for directly connected networks.

Answer

The 'set ip default next-hop' command is used to forward packets that match the route-map permit statement, regardless of whether a route exists in the routing table.

Answer

The 'set ip next-hop verify-availability' feature uses ICMP echo requests to verify next-hop reachability before applying PBR.

Answer

If a route map with 'set ip next-hop' is applied inbound on an interface, PBR processes only the first packet of a flow; subsequent packets use the routing table.

Question 13

A network engineer runs the following command on Router R1:

R1# show bfd neighbors detail

IPv4 Sessions
NeighborAddr      LD/RD         Int        State         Holdown(mult)  Intf
10.1.1.2          1/3           Gi0/0      Up            3000(3)        Gi0/0

Session state is UP and not using echo function.
OurAddr: 10.1.1.1
Handle: 1
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 3000(0)
Rx Count: 100, Tx Count: 100

Based on this output, what is the BFD session's negotiated transmit interval?

Accepted Answer

The negotiated transmit interval is 1000 ms.. The negotiated transmit interval is the maximum of the local MinTxInt and the received MinRxInt. Local MinTxInt is 1000000 microseconds, received MinRxInt is 1000000 microseconds. The maximum is 1000000 microseconds, which is 1000 ms. The BFD session will transmit control packets every 1000 ms.

Answer

The negotiated transmit interval is 500 ms.

Answer

The negotiated transmit interval is 3000 ms.

Answer

The negotiated transmit interval is 100 ms.

Question 14

An enterprise is using IPv6-to-IPv4 translation tunneling (NAT64) but users report that they cannot reach IPv6-only servers. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 nat64 enable. Router R2 shows: R2# show nat64 translations % No translations. R2# debug nat64 all NAT64: No mapping found for packet. What is the root cause?

Accepted Answer

The NAT64 prefix is not configured under the tunnel interface.. NAT64 requires a NAT64 prefix to be explicitly configured under the tunnel interface using the 'nat64 prefix' command. Without this prefix, the router cannot construct the IPv6 representation of IPv4 destinations, so no translation mappings are created, and packets are dropped. The debug output confirms 'No mapping found for packet', which directly points to the missing prefix configuration.

Answer

The tunnel mode should be ipv6ip for NAT64 to work.

Answer

The IPv4 address of the destination server is not reachable.

Answer

NAT64 is not supported on tunnel interfaces.

Question 15

What is the problem with this NAT configuration?

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

Accepted Answer

The interface GigabitEthernet0/1 is missing the 'ip nat outside' command.. The configuration is missing the 'ip nat outside' command on interface GigabitEthernet0/1. For NAT to function, Cisco IOS requires that the inside interface be marked with 'ip nat inside' and the outside interface with 'ip nat outside'. Without this, the router does not know which interface is the external (outside) interface, and the NAT translation will not be applied to outgoing packets.

Answer

The ACL is too permissive; it should only permit specific hosts.

Answer

The 'overload' keyword is unnecessary for this configuration.

Answer

The inside interface should be GigabitEthernet0/1.