300-410 Practice Test 15 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# show bgp neighbors 10.0.0.2 advertised-routes

Output:
BGP table version is 10, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      0.0.0.0                  0         32768 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is advertising two local prefixes to BGP neighbor 10.0.0.2. The command 'show bgp neighbors 10.0.0.2 advertised-routes' displays the routes that R1 is advertising TO neighbor 10.0.0.2, not routes received from it. The output shows two prefixes (10.1.1.0/24 and 10.2.2.0/24) with next hop 0.0.0.0, weight 32768, and origin 'i' (IGP) — these are locally originated routes in R1's BGP table being advertised to the neighbor. The 'Total number of prefixes 2' confirms two routes are being sent.

Answer

R1 is receiving two prefixes from BGP neighbor 10.0.0.2

Answer

R1 has no BGP routes

Answer

R1 is using OSPF to learn these prefixes

Question 2

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Accepted Answer

The EEM policy is registered but not yet triggered because the OSPF neighbor is up.. The output shows the EEM policy 'OSPF_Neighbor_Down' is registered (listed in 'show event manager policy registered'), but the OSPF neighbor table shows the neighbor 10.1.1.2 in FULL/DR state with a Dead Time of 36 seconds, meaning the neighbor is up and stable. Therefore, the EEM policy has not been triggered because its triggering condition (OSPF neighbor down) has not occurred. The policy is simply waiting for the event.

Answer

The OSPF neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 3

An engineer configures AS path prepending on an eBGP route to influence inbound traffic. However, traffic from a specific iBGP neighbor still prefers the prepended path. What is the most likely explanation?

Accepted Answer

The iBGP neighbor has 'bgp bestpath as-path ignore' configured, which ignores AS path length entirely.. AS path prepending normally increases the AS path length, and BGP does consider AS path length during best-path selection. However, if the iBGP neighbor has 'bgp bestpath as-path ignore' configured, it skips the AS path length step, so prepending will not be considered and that neighbor may prefer the prepended path based on other attributes such as local preference or IGP metric. Option A is incorrect because iBGP does not ignore AS path length by default.

Answer

AS path prepending only affects eBGP path selection; iBGP routers ignore AS path length when comparing paths from different eBGP routers.

Answer

The prepending was applied with 'set as-path prepend last-as 1', which only prepends the last AS, not the full path.

Answer

The prepending was done on a route reflector, and the client does not see the prepended AS path.

Question 4

A network engineer is troubleshooting an IPv6 connectivity issue between two sites connected via a 6to4 tunnel. The tunnel is configured on both routers and shows as up/up, but the engineer cannot ping the IPv6 address of the remote tunnel endpoint. The engineer checks the routing table and sees no route to the remote IPv6 prefix. What is the most likely cause of this problem?

Accepted Answer

The tunnel source interface is configured with a private IPv4 address, causing the 6to4 prefix to be invalid.. For a 6to4 tunnel, the IPv6 address on the tunnel interface must be derived from the tunnel source's public IPv4 address using the 2002:IPv4-address::/48 prefix format. If the tunnel source interface has a private IPv4 address (e.g., 10.0.0.1), the resulting 6to4 prefix (2002:0a00:0001::/48) is non-routable over the public Internet because private addresses are not globally unique. This causes the remote router to have no route to the invalid prefix, breaking connectivity even though the tunnel interface is up/up.

Answer

The tunnel mode is incorrectly set to ipv6ip instead of 6to4.

Answer

The tunnel destination is misconfigured with the remote router's IPv6 address instead of its IPv4 address.

Answer

The IPv6 address on the tunnel interface is not in the 2002::/16 range.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet address is 10.1.1.1/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is 101
  Inbound access list is not set

Based on this output, which statement is correct?

Accepted Answer

ACL 101 filters traffic leaving the interface.. The command output shows 'Outgoing access list is 101', which indicates that ACL 101 is applied to filter traffic leaving the GigabitEthernet0/1 interface. This is confirmed by the absence of an 'Inbound access list' entry, meaning no ACL is applied to incoming traffic. Therefore, ACL 101 filters traffic leaving the interface.

Answer

ACL 101 filters traffic entering the interface.

Answer

The interface has no ACL applied.

Answer

ACL 101 is applied in both directions.

Question 6

An engineer is troubleshooting a DMVPN phase 2 deployment with IPv6 over mGRE tunnels. The spoke routers can ping the hub's tunnel IPv6 address, but cannot reach IPv6 networks behind other spokes. The engineer verifies that NHRP is configured and that the hub has a route to the spoke's internal networks. What is the most likely cause?

Accepted Answer

The spoke routers are missing a static route for the remote spoke's internal network pointing to the mGRE tunnel interface.. In a DMVPN Phase 2 deployment, spoke routers must have a route to remote spoke networks pointing to the mGRE tunnel interface. Without this static route, the spoke will not know to send traffic for the remote spoke's internal network over the tunnel, even though NHRP resolves the next-hop. The hub has a route to the spoke's internal networks, but that does not enable direct spoke-to-spoke communication without proper routing on the spokes themselves.

Answer

The NHRP authentication key is mismatched between the spokes.

Answer

The tunnel key is not configured on the mGRE interface.

Answer

The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.

Question 7

Examine the following EEM applet configuration:

!---
event manager applet BACKUP_CONFIG
event timer watchdog time 86400
action 1.0 cli command "enable"
action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg"
!---

What is the effect of this configuration?

Accepted Answer

The applet will copy the running configuration to the TFTP server every 24 hours.. The EEM applet uses 'event timer watchdog time 86400', which triggers every 86400 seconds (24 hours) on a recurring basis. The actions enable privileged mode and copy the running-config to the TFTP server, so the effect is a daily backup of the running configuration.

Answer

The applet will copy the startup configuration instead of the running configuration.

Answer

The applet will fail because the TFTP server IP address is not reachable.

Answer

The applet will only trigger once because the watchdog timer is a one-shot timer.

Question 8

A network engineer runs the following command to verify DHCPv4 server bindings on router R1:

R1# show ip dhcp binding

Output:
 Bindings from all pools not associated with VRF:
 IP address       Client-ID/              Lease expiration        Type
                   Hardware address/
                   User name
 192.168.1.10     0050.7966.6800           Mar 01 2025 12:00 PM   Automatic
 192.168.1.11     0063.6973.636f.2d30      Mar 01 2025 01:00 PM   Automatic
 192.168.1.12     0100.1a.2b.3c.4d.5e     Mar 01 2025 02:00 PM   Automatic

What does this output indicate?

Accepted Answer

The DHCP server has dynamically assigned three IP addresses to clients.. The output shows three DHCP bindings with a 'Type' of 'Automatic', which indicates that the IP addresses were dynamically assigned by the DHCP server based on the pool configuration. The 'Client-ID' field contains the MAC address or client identifier provided by the client during the DORA process, confirming dynamic allocation rather than static mapping.

Answer

The DHCP server has three static bindings configured.

Answer

The DHCP server is out of IP addresses because all bindings are in use.

Answer

The DHCP server is using relay agents because the client IDs are long hexadecimal strings.

Question 9

An engineer configures an IPsec site-to-site VPN. The tunnel comes up, but no traffic passes. The engineer checks the crypto map and access-lists. Which is the most likely explanation?

Accepted Answer

The access-list defining interesting traffic is missing the 'permit' statement for the actual traffic flow.. The access-list defining interesting traffic for the crypto map must explicitly include a 'permit' statement for the traffic that should be encrypted. Without this permit, the router will not classify the traffic as interesting, so IPsec will not attempt to encrypt it, and the traffic will be dropped or sent in clear depending on the crypto map configuration. The tunnel can still come up because IKE and IPsec SA negotiation is triggered by interesting traffic, but if the access-list is missing the permit, no traffic triggers the SA establishment, and existing SAs may remain idle.

Answer

The crypto map is applied to the wrong interface, causing the traffic to bypass encryption.

Answer

The IPsec transform set uses ESP with no encryption, so traffic is sent in clear.

Answer

The IKE phase 1 policy uses aggressive mode, which is incompatible with the crypto map.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip route vrf RED 192.168.1.0

Routing entry for 192.168.1.0/24
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Routing Descriptor Blocks:
  * directly connected, via GigabitEthernet0/2
      Route metric is 0, traffic share count is 1

Based on this output, which statement is correct?

Accepted Answer

The route is directly connected via GigabitEthernet0/2.. The output shows 'Known via "connected", distance 0, metric 0 (connected, via interface)' and 'directly connected, via GigabitEthernet0/2', which unambiguously identifies a directly connected route in the VRF RED routing table. Connected routes have an administrative distance of 0 and a metric of 0, and are installed when an interface with an IP address in that subnet is up.

Answer

The route is learned via OSPF.

Answer

The route is a static route.

Answer

The route has a metric of 1.

Question 11

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is also being used for other VLAN traffic due to misconfiguration.. The RSPAN VLAN (200) is a dedicated transport VLAN that must not carry any regular user or broadcast traffic. If VLAN 200 is also assigned to access ports or allowed on trunks carrying other VLANs, the destination monitor port will receive that unrelated traffic instead of only the mirrored source VLAN 30 traffic. The symptom described — destination port forwarding broadcast traffic from other VLANs — is the classic sign that the RSPAN VLAN is being shared with production traffic.

Answer

The source VLAN is not configured correctly on the source switch.

Answer

The destination port is in the wrong VLAN.

Answer

The trunk is not pruning VLAN 200 correctly.

Question 12

An engineer configures a DMVPN Phase 2 network with IPsec protection. Spoke-to-spoke tunnels form, but traffic between spokes is not being forwarded directly; it still goes through the hub. The engineer verifies that NHRP registrations are successful and that the spoke-to-spoke IPsec sessions are established. What is the most likely explanation?

Accepted Answer

The hub router is not configured with the 'no ip split-horizon' command for EIGRP or the 'neighbor' command for OSPF, preventing spoke-to-spoke route propagation.. In a DMVPN Phase 2 network, spoke-to-spoke traffic requires that each spoke learns the remote spoke's prefix via the hub. For EIGRP, the hub must disable split horizon with 'no ip split-horizon eigrp <as>' to propagate routes learned from one spoke to other spokes. Without this, the hub advertises only its own routes, so spokes lack the necessary routing information to forward traffic directly, causing it to be sent through the hub despite working NHRP and IPsec.

Answer

The IPsec transform set on the spokes uses different encryption algorithms, preventing the spoke-to-spoke tunnel from passing traffic.

Answer

The NHRP authentication string is mismatched between spokes, causing NHRP resolution to fail.

Answer

The spoke routers have a static default route pointing to the hub, overriding the dynamic routes.

Question 13

A large enterprise network is experiencing intermittent SNMP polling failures from the NMS to router R2. R1 and R2 are connected via a serial link running OSPF. R1 has the following relevant configuration: snmp-server community public RO, snmp-server community private RW, snmp-server trap-source Loopback0, snmp-server enable traps ospf. R2 shows: debug ip packet shows packets from NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. No ACL is applied to any interface on R2. What is the root cause?

Accepted Answer

An ACL is applied to the SNMP community string that does not permit the NMS IP address.. The debug output on R2 shows packets from the NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. Since no ACL is applied to any interface on R2, the only remaining ACL that could cause this is an SNMP community ACL. The SNMP community string 'public' or 'private' can have an optional ACL applied via the 'snmp-server community [view ] [ro|rw] [acl-number]' command. If that ACL does not permit the NMS IP address (10.1.1.100), the router will silently drop SNMP packets from that source, even though no interface ACL exists. This matches the symptom exactly.

Answer

OSPF network type mismatch between R1 and R2 causes routing blackhole.

Answer

The NMS is using SNMPv3 with incorrect credentials, causing authentication failure.

Answer

R2's loopback interface is not advertised into OSPF, making it unreachable.

Question 14

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration uses an ACL (access-list 1) to match traffic from the 192.168.1.0/24 subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command translates all matching source IP addresses to the single IP address 203.0.113.1 (the outside interface IP) using Port Address Translation (PAT). This is a classic dynamic NAT overload configuration, where multiple internal hosts share one public IP by multiplexing on source ports.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 15

In a standard IPv4 ACL, what is the range of valid numbers for the access-list number?

Accepted Answer

1-99 and 1300-1999. Standard IPv4 ACLs use access-list numbers 1-99 and 1300-1999 to filter traffic based solely on source IP address. The expanded range 1300-1999 was introduced to provide additional standard ACL identifiers beyond the original 1-99, allowing more granular control without overlapping with extended ACL ranges.

Answer

100-199 and 2000-2699

Answer

1-99 only

Answer

1-199