300-410 Practice Test 13 — 15 Questions

Question 1

Interface GigabitEthernet0/1 is configured as shown:

interface GigabitEthernet0/1
 ipv6 address 2001:db8:1::1/64
 ipv6 nd raguard
 ipv6 nd prefix default no-autoconfig

What is the effect of this configuration?

Accepted Answer

The interface drops all incoming Router Advertisements from other routers.. The `ipv6 nd raguard` command enables Router Advertisement (RA) guard on the interface, which drops all incoming RAs from other routers to prevent rogue RA attacks. The `ipv6 nd prefix default no-autoconfig` command suppresses the autonomous flag in sent RAs, but the RA guard is the active security feature that blocks incoming RAs, making option A correct.

Answer

The interface sends RAs with the autonomous flag set to allow SLAAC.

Answer

The interface only allows RAs from a specific authorized router.

Answer

The interface drops all Neighbor Solicitations.

Question 2

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# debug mpls ldp transport

Output:
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is accepted
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is established
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is up

What does this output indicate?

Accepted Answer

LDP session is being established between 10.0.0.1 and 10.0.0.2. The debug output shows the LDP transport connection progressing through states: received, accepted, established, and up. This sequence confirms that a TCP-based LDP session is being successfully established between the LSRs at 10.0.0.1 and 10.0.0.2. The port numbers (646 for LDP, 1025 as the ephemeral source port) and the 'up' state indicate the session is operational.

Answer

LDP session is being torn down between 10.0.0.1 and 10.0.0.2

Answer

LDP is using UDP for transport

Answer

LDP label bindings are being exchanged

Question 3

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Accepted Answer

The EIGRP neighbor down event has occurred once.. The 'show event manager history events' output lists exactly one syslog event matching the EIGRP_Neighbor_Down policy, indicating the event fired once. The registered policy confirms the applet exists and is active, so the single history entry means the trigger has occurred one time.

Answer

The EIGRP neighbor is currently down.

Answer

The EEM policy is disabled.

Answer

The EIGRP neighbor is flapping.

Question 4

A network engineer is troubleshooting a DHCPv4 issue where a router configured as a DHCP server is not assigning addresses to clients on a subnet that is reachable via a different router (relay). The relay router (R2) has 'ip helper-address 10.1.1.1' on its client-facing interface, and the DHCP server is at 10.1.1.1 (R1). The engineer sees that R2 is sending DHCP DISCOVER messages with giaddr set to the client-facing interface IP, but R1 is not responding. R1 has a DHCP pool for the client subnet. The engineer pings 10.1.1.1 from R2 successfully. What is the most likely cause?

Accepted Answer

The DHCP server does not have a route to the client subnet (the giaddr subnet).. For DHCP relay to work, the DHCP server must have a route back to the giaddr subnet (the client subnet) so it can send the DHCP OFFER to the relay agent. Since R1 has no route to the client subnet, it drops the request and never responds.

Answer

The relay agent R2 is missing the 'ip dhcp relay information option' command.

Answer

The DHCP pool on R1 is missing the 'default-router' command.

Answer

The 'ip helper-address' on R2 should point to the server's loopback address, not the interface IP.

Question 5

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Accepted Answer

The 'logging on' command is not configured.. The 'show logging' output explicitly states 'Syslog logging: disabled', which means the global logging process itself is turned off. In Cisco IOS, syslog logging is enabled by default, but it can be disabled with 'no logging on'. Re-enabling it with 'logging on' restores the generation of syslog messages to all configured destinations (console, buffer, hosts). Without this command, no messages are produced regardless of destination configuration.

Answer

The logging buffer is full and needs to be cleared.

Answer

The router has run out of memory to generate syslog messages.

Answer

The 'logging host' command is missing, so no destination is configured.

Question 6

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.0.0.2
  BGP state = Idle
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Accepted Answer

The BGP neighbor is down, and the EEM policy may have been triggered.. The BGP neighbor 192.168.1.2 shows 'BGP state = Idle', which means the session is not established and the neighbor is down. The registered EEM applet named BGP_Neighbor_Down strongly suggests an event manager policy was configured to react to this exact condition, so it may have been triggered. The combination of Idle state plus a matching EEM policy name points to a down neighbor with automation in play.

Answer

The BGP neighbor is up and running.

Answer

The EEM policy is not registered.

Answer

The BGP session is established.

Question 7

Drag and drop the steps to verify and validate the operational state of an IPv6 tunneling technique into the correct order, from first to last.

Accepted Answer

Check tunnel interface status with 'show interfaces tunnel0'. Validation follows a systematic approach: start with checking the tunnel interface status and counters, then verify IPv6 connectivity across the tunnel using ping, examine routing protocol adjacency over the tunnel, validate end-to-end IPv6 reachability to remote networks, and finally confirm traffic flow with traceroute or debug commands.

Question 8

Which TWO configuration steps are required to enable IPv6 RA Guard on a Cisco switch interface? (Choose TWO.)

Accepted Answer

Create an RA Guard policy using the 'ipv6 nd raguard policy POLICY_NAME' command.. Option A is correct because RA Guard on Cisco switches requires first defining a policy in global configuration mode with the 'ipv6 nd raguard policy POLICY_NAME' command, which creates the policy container where device-role and other parameters are set. Option B is correct because the policy must then be bound to the specific Layer 2 switch interface using the interface-level command 'ipv6 nd raguard attach-policy POLICY_NAME' for the filtering to take effect. Option C is not required because RA Guard is a Layer 2 security feature that filters ICMPv6 Router Advertisement messages at the switch port and does not depend on the switch having IPv6 unicast routing enabled. Option D is incorrect because there is no direct interface command 'ipv6 nd raguard' that enables the feature without an associated policy. Option E is incorrect because DHCPv6 Guard is a separate feature that filters DHCPv6 server/client messages and is not a prerequisite for RA Guard.

Answer

Enable IPv6 routing globally with 'ipv6 unicast-routing'.

Answer

Configure 'ipv6 nd raguard' directly on the interface without a policy.

Answer

Enable DHCPv6 Guard on the same interface to complement RA Guard.

Question 9

Router R4 has the following configuration:

!--- R4 configuration
route-map SETTAG permit 10
 match tag 100
 set tag 200
!
route-map SETTAG permit 20
!
router bgp 65100
 neighbor 10.0.0.1 route-map SETTAG in
!

What is the effect of this configuration?

Accepted Answer

All routes from neighbor 10.0.0.1 are permitted; routes with tag 100 have their tag changed to 200.. The route-map SETTAG has two sequences: sequence 10 matches tag 100 and sets tag 200, while sequence 20 has no match statement, which acts as a permit any. Therefore, all routes from neighbor 10.0.0.1 are permitted, and routes with tag 100 have their tag changed to 200.

Answer

Routes with tag 100 are denied; all other routes are permitted.

Answer

Only routes with tag 100 are permitted; all other routes are denied.

Answer

The route-map is misconfigured because sequence 20 has no match statement; it should have a match any statement.

Question 10

Which protocol should be used to dynamically distribute encryption keys for a GET VPN deployment?

Accepted Answer

GDOI. GET VPN uses the Group Domain of Interpretation (GDOI) protocol for group key management. The key server uses GDOI to distribute encryption keys, rekey messages, and security policies to all group members. This allows members to encrypt traffic to each other without establishing point-to-point tunnels, preserving the any-to-any nature of the underlying network.

Answer

IKEv2

Answer

ISAKMP

Answer

IPsec

Question 11

A network engineer runs the following command to troubleshoot a Flexible NetFlow issue:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
  Cache size:                                 1000
  Current entries:                              25
  High Watermark:                               50

Flows added:                                1234
  Flows aged:                                 1209
  - Active timeout (  1800 secs):             100
  - Inactive timeout (   15 secs):           1100
  - Event aged:                                 9
  - Watermark aged:                             0
  - Emergency aged:                            0

What does the output indicate?

Accepted Answer

The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.. The output shows the current state of the Flexible NetFlow cache. The high number of flows aged due to inactive timeout (1100 out of 1209) indicates that most flows are short-lived. The cache is not full (25 out of 1000 entries used), and no watermark or emergency aging has occurred. This is normal for traffic with many brief connections.

Answer

The cache is experiencing watermark aging, indicating memory pressure.

Answer

Most flows are being aged due to the active timeout, suggesting long-lived flows.

Answer

Emergency aging is occurring, which means the cache is full.

Question 12

A network engineer runs the following command to troubleshoot SNMP access:

R1# show snmp community
Community name: public
Community Index: public
Storage-Type: nonvolatile
Access: read-only
View: v1default

Community name: private
Community Index: private
Storage-Type: nonvolatile
Access: read-write
View: v1default

What does this output indicate?

Accepted Answer

The router has two SNMP communities: 'public' for read-only and 'private' for read-write access.. The output shows two SNMP community strings configured on the router: 'public' with read-only access and 'private' with read-write access. This is a standard SNMPv1/v2c configuration where the community string acts as a password for access control, and the 'Access' field explicitly defines the permissions. Therefore, option A correctly interprets the output.

Answer

The router only allows SNMP writes with the 'public' community.

Answer

The router is not configured for SNMP because no community strings are shown.

Answer

The router uses SNMPv3 and these communities are for backward compatibility.

Question 13

A large enterprise network uses EIGRP with route summarization. Router R1 has the following configuration: interface GigabitEthernet0/0, ip summary-address eigrp 100 10.0.0.0 255.255.252.0. Router R2 shows: show ip route eigrp includes 10.0.0.0/22 but not 10.0.3.0/24. What is the root cause?

Accepted Answer

The EIGRP summary address suppresses more specific routes within its range.. The EIGRP `ip summary-address` command on R1 creates a summary route (10.0.0.0/22) that is advertised to R2, and by default EIGRP suppresses the advertisement of all more specific routes that fall within the summary range (10.0.0.0/22 includes 10.0.3.0/24). This is the intended behavior of EIGRP route summarization: the summary route replaces the component routes to reduce routing table size and update overhead.

Answer

The summary address is misconfigured; it should be 10.0.0.0/24.

Answer

R2 has a route filter blocking 10.0.3.0/24.

Answer

R1's interface is down, preventing route advertisement.

Question 14

An engineer configures Control Plane Policing (CoPP) on a router. After applying the policy, OSPF neighbors go down. The engineer checks the policy and sees that OSPF packets are not explicitly matched. Which is the most likely explanation?

Accepted Answer

The class-default is set to 'drop', and OSPF packets fall into class-default because they are not matched by any other class.. When Control Plane Policing (CoPP) is configured, traffic is classified into classes based on match criteria. If OSPF packets are not explicitly matched by any configured class, they fall into the default class (class-default). If the policy-map sets class-default to 'drop', all unmatched traffic, including OSPF hello packets (which use IP protocol 89), will be dropped. This causes OSPF neighbors to go down because the router stops receiving or sending OSPF control packets.

Answer

The CoPP policy uses 'police' in bps, but OSPF packets are small and exceed the rate limit.

Answer

The CoPP policy is applied to the input direction, but OSPF packets are processed in the output direction.

Answer

The CoPP policy uses 'police' in pps, but OSPF hello packets are sent every 10 seconds, so they are not rate-limited.

Question 15

Router R8 is configured with SNMP and IP SLA. The IP SLA operation sends SNMP traps to the NMS when a threshold is crossed. The configuration includes: ip sla 1, icmp-echo 192.168.1.1, threshold 100, timeout 1000, frequency 10, ip sla schedule 1 life forever start-time now, snmp-server enable traps ip sla. However, the NMS receives no traps when the threshold is crossed. The IP SLA operation shows 'Over threshold' in show ip sla statistics. What is the root cause?

Accepted Answer

The IP SLA operation is missing the 'ip sla reaction-configuration' command to trigger SNMP traps when the threshold is exceeded.. The 'ip sla reaction-configuration' command is required to define the condition (e.g., threshold violation) that triggers an SNMP trap. Without this command, the IP SLA operation can detect and report 'Over threshold' in statistics, but it has no mechanism to generate an SNMP trap to the NMS. The 'snmp-server enable traps ip sla' command only enables the router to send IP SLA traps globally; it does not link a specific reaction to the threshold event.

Answer

The NMS is not configured to receive IP SLA traps.

Answer

The SNMP community string is incorrect for trap sending.

Answer

The IP SLA operation is not scheduled correctly.