300-410 Practice Test 15 — 15 Questions

Question 1

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer confirms that the route for the customer subnet exists in the routing table and points to the correct interface. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing is in use, and the return route for the source IP points to a different interface.. Strict uRPF checks that the source IP address of an incoming packet has a route in the routing table that points back to the same interface. If the customer network uses asymmetric routing (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the traffic. The edge case is that even if the route exists, if it does not point to the incoming interface, the packet is dropped.

Answer

The 'allow-default' option is not enabled, so default routes are not considered.

Answer

The 'ip verify unicast source reachable-via any' command was used instead of 'rx'

Answer

The customer subnet is a summary route, and the more specific route is missing.

Question 2

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

Accepted Answer

ND Snooping. C is correct because ND Snooping (Neighbor Discovery Snooping) is the IPv6 First Hop Security feature that prevents duplicate address detection (DAD) attacks by inspecting Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. It builds a binding table of valid IPv6-to-MAC address mappings and drops any NS messages that attempt to claim an address already in use by another device, thereby blocking DAD-based spoofing attacks.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

Source Guard

Question 3

An engineer configures IPsec with a transform set that includes ESP-SHA-HMAC and ESP-AES-256. The VPN tunnel fails to establish, and debug shows 'transform set mismatch'. What is the most likely explanation?

Accepted Answer

The peer has the transform set with the same protocols but in a different order (ESP-AES-256 then ESP-SHA-HMAC), which is considered a mismatch.. The transform set must match exactly on both peers, including the order of protocols. ESP-SHA-HMAC is an authentication protocol, and ESP-AES-256 is encryption. If the peer has them in a different order or uses a different combination, the negotiation fails.

Answer

The peer uses ESP-AES-256 with a different key length, such as 128-bit.

Answer

The peer has 'crypto ipsec transform-set' with 'esp-sha-hmac' and 'esp-aes 256' but also includes 'comp-lzs'.

Answer

The peer uses 'esp-sha-hmac' as authentication and 'esp-aes 256' as encryption, but the mode is set to transport instead of tunnel.

Question 4

A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?

Accepted Answer

The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.. The CoPP policy polices traffic from the management station to 100,000 bps. SNMP polls typically consist of multiple small UDP packets (e.g., get-request, get-response), but the aggregate rate of these polls can exceed 100 kbps if the polling interval is aggressive or multiple OIDs are queried. The dropped packets in the CoPP class statistics confirm that the policer is throttling the SNMP traffic, causing timeouts. Therefore, the police rate is too low for the actual SNMP traffic volume.

Answer

The SNMP community string is incorrect on the management station.

Answer

The CoPP class-map is matching the wrong source IP address.

Answer

The SNMP agent on the router is not responding due to high CPU.

Question 5

Consider this configuration on Router R5:
```
interface Tunnel0
 ipv6 address 2001:DB8:7::1/64
 tunnel source 192.168.10.1
 tunnel destination 192.168.20.2
 tunnel mode ipv6ip
 tunnel ttl 64
```
What is the effect?

Accepted Answer

The tunnel will work, and the TTL field in the outer IPv4 header will be set to 64.. The configuration creates an IPv6-over-IPv4 manual tunnel (tunnel mode ipv6ip). The tunnel source is specified as an IP address, which is valid; the router uses that address as the source of the outer IPv4 header. The 'tunnel ttl 64' command explicitly sets the Time-to-Live field in the outer IPv4 header to 64, overriding the default value.

Answer

The tunnel will not work because the tunnel source is an IP address, not an interface.

Answer

The tunnel mode should be 'gre ip' for IPv6 over IPv4.

Answer

The tunnel will use the IPv6 TTL for the outer header.

Question 6

A network engineer configures CoPP on a router to limit PIM-SM control plane traffic. The policy includes a class-map matching PIM packets and polices them to 10000 bps. After the policy is applied, the engineer notices that multicast traffic is not being forwarded correctly, and PIM neighbors are not forming. The router is a PIM-SM rendezvous point (RP). What is the most likely issue?

Accepted Answer

The CoPP policy is dropping PIM register messages because the police rate is too low for the burst of register traffic.. When a router is configured as a PIM-SM rendezvous point (RP), it receives PIM register messages from first-hop routers. These messages are encapsulated unicast packets that can arrive in bursts, especially when multiple sources register simultaneously. If the CoPP police rate is set too low (10000 bps), the router may drop these register messages, preventing the RP from learning about new multicast sources and causing PIM neighbors to fail to form.

Answer

The CoPP class-map is not matching PIM packets because it uses the wrong protocol number.

Answer

The PIM hello interval is set too high, causing the router to miss hello packets from neighbors.

Answer

The CoPP policy is applied to the wrong control plane, such as the IPv6 control plane.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TRACK

R1# show route-map PBR-TRACK
route-map PBR-TRACK, permit, sequence 10
  Match clauses:
    ip address (access-lists): 170
  Set clauses:
    ip next-hop verify-availability 10.0.0.2 10 track 2
  Policy routing matches: 100 packets, 8000 bytes

R1# show track 2
Track 2
  IP SLA 2 reachability
  Reachability is Up
    2 changes, last change 00:01:30
  Latest operation return code: ok
  Tracked by:
    ROUTE-MAP 0

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely behavior for packets matching ACL 170?

Accepted Answer

Packets are forwarded to 10.0.0.2.. The route map uses 'ip next-hop verify-availability' with track 2. Track 2 is Up (IP SLA 2 reachability is ok). Therefore, the next-hop 10.0.0.2 is considered available, and packets matching ACL 170 are forwarded to 10.0.0.2.

Answer

Packets are forwarded using the routing table because the next-hop is not reachable.

Answer

Packets are dropped because the track object is not configured correctly.

Answer

Packets are load-balanced between the next-hop and the routing table.

Question 8

A network engineer configures CoPP on a router that is a DMVPN hub. The policy includes a class-map to match NHRP traffic and police it. After deployment, spoke-to-spoke tunnels fail to establish, although spoke-to-hub tunnels work. Which is the most likely explanation?

Accepted Answer

The CoPP policy polices NHRP traffic, causing NHRP redirect packets from the hub to be dropped, so spokes cannot learn each other's addresses.. In a DMVPN hub-and-spoke topology, spoke-to-spoke tunnels rely on NHRP redirect messages from the hub to learn each other's public addresses. If CoPP polices NHRP traffic too aggressively, the hub may drop NHRP redirect packets before they reach the spokes. Without these redirects, spokes cannot initiate direct tunnels, even though spoke-to-hub communication (which uses the hub as a relay) remains functional.

Answer

The CoPP policy drops IPsec packets, which are used for spoke-to-spoke encryption.

Answer

The CoPP policy is applied to the tunnel interface, not the control plane.

Answer

The CoPP policy uses the default class class-default, which blocks NHRP.

Question 9

Which DHCPv4 message type does a client send to request a specific IP address previously offered?

Accepted Answer

DHCPREQUEST. The DHCPREQUEST message is used by the client to formally request the specific IP address that was previously offered by the DHCP server in a DHCPOFFER. This occurs during the DHCP lease selection phase, where the client broadcasts or unicasts a DHCPREQUEST to accept the offered IP address and bind the lease.

Answer

DHCPDISCOVER

Answer

DHCPOFFER

Answer

DHCPACK

Question 10

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 10.2.2.2 advertised-routes
BGP table version is 10, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      0.0.0.0                  0         32768 i

Total number of prefixes 2

Based on this output, what is the problem?

Accepted Answer

The routes are correctly advertised with next hop 0.0.0.0, which is normal for locally originated routes.. The output shows that R1 is advertising two routes to the BGP neighbor 10.2.2.2. Both routes have a next hop of 0.0.0.0, which is normal for locally originated routes (e.g., via network statement or redistribution). When advertising to an eBGP peer, the router automatically changes the next hop to its own interface IP address if the next hop is not reachable via the eBGP neighbor. However, the 'show ip bgp neighbors advertised-routes' command displays the routes as they are in the BGP table, not the actual advertisement sent. The next hop 0.0.0.0 indicates the route is local, and BGP will update it appropriately when sending to an eBGP peer. Therefore, there is no problem; the routes are being advertised correctly.

Answer

The routes are not being advertised to eBGP peers because the next hop is 0.0.0.0, which is invalid for eBGP.

Answer

The routes are being advertised to iBGP peers only, as indicated by the next hop 0.0.0.0.

Answer

The routes are redistributed from an IGP into BGP, and the next hop is correctly set to 0.0.0.0.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip ospf database

OSPF Router with ID (10.1.1.1) (Process ID 1)

Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        120         0x80000002 0x00A1B2 3
10.1.1.2        10.1.1.2        200         0x80000001 0x00B2C3 2
10.1.1.3        10.1.1.3        150         0x80000003 0x00C3D4 4

Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.12.2    10.1.1.2        180         0x80000001 0x00D4E5

Based on this output, what can be concluded?

Accepted Answer

Router 10.1.1.2 is the DR on the segment 192.168.12.0/24.. The database shows router link states for three routers and one net link state. The net link state is advertised by 10.1.1.2, indicating it is the DR on the segment 192.168.12.0/24. The absence of other net link states suggests only one broadcast segment exists.

Answer

Router R1 is the DR on the segment 192.168.12.0/24.

Answer

Router 10.1.1.3 has the highest router ID.

Answer

There is a network LSA for every broadcast segment in area 0.

Question 12

Drag and drop the steps to configure SNMPv3 with auth-priv and verify traps into the correct order, from first to last.

Accepted Answer

Configure SNMPv3 group with auth-priv security level. First, define the SNMPv3 group with security model and privacy settings. Next, create the user with authentication and privacy passwords. Then, enable SNMP traps globally. After that, specify the trap receiver host with the correct security parameters. Finally, verify the configuration using show snmp user and show snmp host.

Question 13

Drag and drop the steps to troubleshoot SNMP adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping the SNMP manager to verify IP connectivity. Start by checking basic IP connectivity using ping to the SNMP manager. Next, verify that the SNMP agent is enabled and listening on the correct port. Then, review ACLs and firewall rules that might block SNMP traffic. After that, examine SNMP community strings or security credentials for mismatches. Finally, enable debug snmp packets to capture and analyze packet exchanges.

Question 14

An engineer configures OSPFv3 with a filter-list on an ABR to filter prefixes. After configuration, the routes are still being advertised. Which is the most likely explanation?

Accepted Answer

The filter-list only filters inter-area prefixes, not external routes.. In OSPFv3, prefix filtering is done using the 'prefix-list' or 'filter-list' command under the area. However, the filter-list in OSPFv3 filters type 3 LSAs (inter-area prefixes) but not type 5 LSAs (external routes). If the routes being advertised are external, the filter-list will not affect them.

Answer

The filter-list is applied to the wrong area.

Answer

The filter-list uses an incorrect prefix-list.

Answer

The OSPFv3 process needs to be restarted.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 10
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, what is the problem?

Accepted Answer

NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.. The output shows two dynamic NAT translations (192.0.2.10→10.0.0.10 and 192.0.2.11→10.0.0.11) but zero hits, meaning no packets have been translated. The misses counter is 10, indicating that packets arrived but failed to match the translation. This typically occurs when the access control list (ACL1) does not permit the source traffic, or the routing path does not direct traffic through the NAT inside interface, preventing the translation from being used.

Answer

The NAT pool is exhausted.

Answer

PAT is enabled but not working.

Answer

The inside and outside interfaces are reversed.