300-410 Practice Test 14 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a route filtering issue:

R1# debug ip bgp updates
BGP(0): 10.1.1.2 rcvd UPDATE w/ attr: nexthop 10.1.1.2, origin i, metric 0, path 65001 65002
BGP(0): 10.1.1.2 rcvd UPDATE about 192.168.100.0/24 -- DENIED due to: community no-export;

What does this output indicate?

Accepted Answer

The prefix 192.168.100.0/24 is denied because of the no-export community.. The debug output shows that BGP received an update for prefix 192.168.100.0/24 from neighbor 10.1.1.2, but the update was denied because the prefix has the community 'no-export'. This indicates that an inbound route-map or filter is configured to deny routes with the no-export community.

Answer

The prefix 192.168.100.0/24 is being accepted and installed in the BGP table.

Answer

The prefix 192.168.100.0/24 is denied because of an AS_PATH filter.

Answer

The prefix 192.168.100.0/24 is accepted but not advertised to any neighbor.

Question 2

An engineer applies an IPv6 ACL to filter traffic between two VLANs on a switch using a router-on-a-stick configuration. The ACL is applied inbound on the subinterface. Traffic from VLAN 10 to VLAN 20 is permitted, but return traffic from VLAN 20 to VLAN 10 is dropped. Which is the most likely explanation?

Accepted Answer

The ACL on the VLAN 20 subinterface is missing a permit entry for the return traffic, or the ACL is applied outbound on VLAN 10, which does not affect incoming return traffic.. In a router-on-a-stick configuration, traffic from VLAN 10 to VLAN 20 is permitted by the inbound ACL on the VLAN 10 subinterface. However, return traffic from VLAN 20 to VLAN 10 must traverse the VLAN 20 subinterface inbound (or the VLAN 10 subinterface outbound). If the ACL is applied inbound only on the VLAN 10 subinterface, return traffic from VLAN 20 is not inspected unless an ACL is also applied inbound on the VLAN 20 subinterface or outbound on the VLAN 10 subinterface. The most likely cause is that the ACL on the VLAN 20 subinterface is missing a permit entry for the return traffic, or the ACL is applied outbound on VLAN 10, which does not affect incoming return traffic.

Answer

The ACL is applied only on the VLAN 10 subinterface, so return traffic from VLAN 20 is not filtered but the ACL on VLAN 10 drops it because the source address matches a deny entry.

Answer

The router has 'ipv6 unicast-routing' disabled, preventing inter-VLAN routing.

Answer

The ACL uses 'deny ipv6 any any' which blocks all traffic, but the permit statement for VLAN 10 to VLAN 20 is placed after the deny, causing it to be ignored.

Question 3

What is the default administrative distance for routes redistributed into EIGRP from another protocol?

Accepted Answer

170. The default administrative distance for routes redistributed into EIGRP from another protocol is 170. This value applies to external EIGRP routes, distinguishing them from internal EIGRP routes (AD 90). It ensures that internal EIGRP routes are preferred over redistributed ones.

Answer

90

Answer

110

Answer

200

Question 4

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure hostname and domain name. First, a hostname and domain name must be set to generate the RSA key pair. Then the RSA key pair is generated with the crypto key generate rsa command. Next, local AAA authentication is enabled with aaa new-model and aaa authentication login default local. The VTY lines are then configured to use SSH transport and the local login authentication. Finally, the SSH version is set to 2 for enhanced security.

Question 5

An engineer configures mutual redistribution between OSPF and EIGRP. After a few minutes, routing loops occur. The engineer did not use route tagging. Which is the most likely explanation?

Accepted Answer

Without route tagging, OSPF redistributes EIGRP routes back into OSPF, and EIGRP redistributes OSPF routes back into EIGRP, creating a cycle.. Mutual redistribution without route tagging creates a feedback loop: OSPF redistributes EIGRP-learned routes back into OSPF, and EIGRP redistributes OSPF-learned routes back into EIGRP. Each protocol re-advertises the other's routes, causing them to be learned and re-injected repeatedly, which leads to routing loops. Route tagging (e.g., using a route-map to set a tag) is the standard method to prevent such cycles by filtering redistributed routes that already originated from the other protocol.

Answer

Routes redistributed from OSPF into EIGRP have a higher administrative distance than the original OSPF routes, causing them to be preferred.

Answer

Redistributed routes retain their original metric, which can cause them to be preferred over the original route.

Answer

The seed metric for redistribution is not set, causing the redistributed routes to be rejected.

Question 6

An engineer configures DHCPv4 on a router with multiple pools for different subnets. Clients in subnet A receive addresses correctly, but clients in subnet B receive addresses from subnet A's pool. The router has 'ip dhcp relay' configured. Which is the most likely explanation?

Accepted Answer

The DHCP server selects the pool based on the giaddr; if the relay agent does not set the giaddr correctly, the server may use the first matching pool.. When a DHCP relay agent forwards a client's request to the server, it inserts its own IP address (the interface address on the client's subnet) into the giaddr (gateway IP address) field. The DHCP server uses this giaddr to select the appropriate pool. If the relay agent fails to set the giaddr correctly—for example, due to misconfiguration or the relay interface not being on the correct subnet—the server may receive a giaddr of 0.0.0.0 or an incorrect address, causing it to fall back to the first configured pool that matches, which in this case is subnet A's pool.

Answer

The pools are configured in the wrong order; the server uses the first pool that matches the client's MAC address.

Answer

The router has 'ip dhcp smart-relay' enabled, which overrides pool selection.

Answer

The DHCP server is configured with 'network' statements that overlap.

Question 7

A network engineer runs the following command to troubleshoot Flexible NetFlow cache usage:

R1# show flow monitor FLOW-MONITOR-1 statistics

Cache type:                               Normal
  Cache size:                                 1000
  Current entries:                             900
  High Watermark:                              950
  Flows added:                               50000
  Flows aged:                                49100
  - Active timeout (  1800 secs):           40000
  - Inactive timeout (   15 secs):           9000
  - Event aged:                               100
  - Watermark aged:                             0
  - Emergency aged:                             0

What does this output indicate?

Accepted Answer

The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.. The output shows Current entries at 900 out of a Cache size of 1000 (90% full), with a High Watermark of 950, indicating the cache is nearly full. Active timeout aging accounts for 40,000 of the 49,100 aged flows, meaning many flows are long-lived and hitting the 1800-second active timeout. Watermark aged and Emergency aged are both 0, confirming no watermark or emergency aging has occurred yet.

Answer

The cache is mostly empty and flows are aging normally.

Answer

Emergency aging is occurring because the cache is full.

Answer

Watermark aging has occurred, indicating the cache size needs to be increased.

Question 8

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::A8BB:CCFF:FE00:1
  No global unicast address is configured
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1
  MTU is 1480 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 0 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfiguration for addresses.

Based on this output, what is a likely problem?

Accepted Answer

The tunnel is not configured with a global IPv6 address, which may prevent routing of IPv6 traffic.. The output shows that the tunnel interface has no global unicast address configured, only a link-local address. Without a global IPv6 address, the router cannot route IPv6 traffic beyond the local link, as global reachability requires a globally routable address. This is a common misconfiguration in IPv6 tunneling scenarios where the tunnel source and destination are set but the interface itself lacks a global IPv6 address.

Answer

The tunnel interface is down.

Answer

The MTU is too small for IPv6.

Answer

IPv6 is not enabled on the tunnel.

Question 9

A network engineer runs the following command to troubleshoot SNMP statistics:

R1# show snmp statistics
0 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
0 Number of requested variables
0 Number of altered variables
0 Get-request PDUs
0 Get-next PDUs
0 Set-request PDUs
0 Input queue drops
0 SNMP packets output
0 Too big errors
0 No such name errors
0 Bad values errors
0 General errors
0 Get-response PDUs
0 SNMP trap PDUs

What does this output indicate?

Accepted Answer

No SNMP traffic has been processed, which may indicate a configuration or connectivity issue.. The output shows all counters at zero, including SNMP packets input and output, which means the router has not processed any SNMP traffic. This typically indicates that SNMP is either not configured, the community strings are mismatched, or there is a network connectivity issue preventing SNMP messages from reaching the router. A correctly functioning SNMP agent would show non-zero counters for received requests or sent responses.

Answer

SNMP is working correctly with many successful requests.

Answer

The router is sending many SNMP traps.

Answer

There are errors due to bad community names.

Question 10

Which TWO actions will prevent a BGP route from being installed in the routing table (RIB) while still being present in the BGP table? (Choose TWO.)

Accepted Answer

The route is suppressed due to an aggregate-address command.. A route is present in the BGP table but not installed in the RIB when it is suppressed by an aggregate-address command (option A), when the BGP next hop is unreachable (option B), or when it is dampened due to BGP flap dampening (option E). Dampened routes remain in the BGP table but are marked damped and are not installed. Option C is incorrect because local preference influences best-path selection but does not by itself prevent RIB installation. Option D is incorrect because soft-reconfiguration inbound stores received updates but does not affect RIB installation.

Answer

The route is received with a higher local preference than the best path.

Answer

The neighbor is configured with 'soft-reconfiguration inbound'.

Question 11

A network engineer is troubleshooting a route redistribution issue between EIGRP and OSPF. Routers R1 (EIGRP) and R2 (OSPF) are redistributing routes. The engineer notices that some EIGRP external routes (redistributed into EIGRP from another protocol) are not appearing in the OSPF database on R2. The show ip ospf database external command on R2 does not list these prefixes. What is the most likely cause?

Accepted Answer

The redistribute eigrp command under OSPF is missing the subnets keyword.. The most likely cause is that the redistribute eigrp command under OSPF is missing the subnets keyword. Without subnets, OSPF only redistributes classful network routes and drops subnetted prefixes, so EIGRP external routes that are subnetted never appear in the OSPF database as external LSAs.

Answer

The redistribute eigrp command under OSPF is missing the match external keyword.

Answer

EIGRP has a higher administrative distance than OSPF, causing route suppression.

Answer

The OSPF process on R2 has a distribute-list blocking these routes.

Question 12

Consider the following configuration on a router running BGP and OSPF:
```
router bgp 65000
 distance bgp 20 200 200
```
What is the effect of this command?

Accepted Answer

It sets the administrative distance for eBGP routes to 20, iBGP routes to 200, and local BGP routes to 200.. The `distance bgp` command sets AD for BGP routes: external (eBGP) to 20, internal (iBGP) to 200, and local to 200.

Answer

It sets the administrative distance for all BGP routes to 20.

Answer

It sets the administrative distance for eBGP routes to 200 and iBGP routes to 20.

Answer

It sets the administrative distance for BGP routes to 20 for routes learned from AS 65000.

Question 13

A network engineer runs the following command to debug MPLS LDP label advertisements:

R1# debug mpls ldp labels

Output:
*Mar  1 00:01:23.456: LDP: Sent label mapping for 192.168.1.0/24, label 101
*Mar  1 00:01:23.789: LDP: Received label mapping for 192.168.2.0/24, label 201
*Mar  1 00:01:24.012: LDP: Sent label mapping for 10.0.0.0/8, label 102
*Mar  1 00:01:24.345: LDP: Received label mapping for 10.0.0.0/8, label 202

What does this output indicate?

Accepted Answer

LDP label bindings are being exchanged between R1 and its LDP neighbor. The debug output shows R1 sending and receiving label mappings for various prefixes, indicating that LDP label bindings are being exchanged with its LDP neighbor. This is normal LDP operation for establishing label-switched paths.

Answer

R1 is only receiving label mappings, not sending any

Answer

The LDP session is down

Answer

R1 is using implicit null label for 10.0.0.0/8

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      100 packets, 6000 bytes
      5 minute offered rate 500 bps, drop rate 500 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 50 packets, 3000 bytes; actions:
          transmit
        exceeded 25 packets, 1500 bytes; actions:
          drop
        violated 25 packets, 1500 bytes; actions:
          drop

Based on this output, what is the most likely impact on the router?

Accepted Answer

ICMP traffic is being rate-limited, causing some ping requests to fail.. The output shows that ICMP traffic matching access-group 100 is being policed with a CIR of 8000 bps. Out of 100 packets, 50 were conformed (transmitted), 25 exceeded (dropped), and 25 violated (dropped). This results in a 50% packet loss, causing some ping requests to fail. The drop rate equals the offered rate (500 bps) because the policer is dropping half the traffic. Therefore, option B is correct.

Answer

All ICMP packets are being transmitted without drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching ICMP traffic.

Question 15

What is the default BGP hold timer value in an MPLS L3VPN deployment on Cisco IOS-XE?

Accepted Answer

180 seconds. The default BGP hold timer is 180 seconds, meaning a peer is declared dead if no keepalive or update is received within that interval.

Answer

60 seconds

Answer

90 seconds

Answer

120 seconds