300-410 Practice Test 16 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit ip 10.0.0.0 0.255.255.255 any (500 matches)
    20 deny ip any any (100 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic not from 10.0.0.0/8 is denied.. The ACL 150 has a permit entry for source 10.0.0.0/8 (wildcard 0.255.255.255) followed by a deny any any. Traffic matching the permit (from 10.0.0.0/8) is allowed, while all other traffic is denied by the implicit deny or the explicit deny entry. Thus, traffic not from the 10.0.0.0/8 network is denied, making option B correct.

Answer

Traffic from 10.0.0.0/8 is denied.

Answer

All traffic is permitted.

Answer

The ACL has no effect.

Question 2

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec using a crypto map. The tunnel works for unicast traffic, but OSPFv3 over the tunnel fails to form adjacency. The engineer checks the crypto map and sees that it only matches traffic with a specific access-list. What is the most likely explanation?

Accepted Answer

The crypto map access-list must include IPv6 protocol 89 (OSPF) to encrypt OSPFv3 packets; otherwise, they are sent in the clear and may be dropped.. OSPFv3 uses IPv6 protocol number 89 for its packets. When a crypto map is applied with an access-list that only matches specific traffic (e.g., unicast data), OSPFv3 packets (protocol 89) are not matched and are sent unencrypted. If the IPsec peer is configured to drop unencrypted traffic or if the GRE tunnel requires all traffic to be encrypted, OSPFv3 adjacency fails. Adding protocol 89 to the access-list ensures OSPFv3 packets are encrypted and processed correctly.

Answer

OSPFv3 cannot be encrypted with IPsec; it requires a separate encryption mechanism.

Answer

The GRE tunnel interface must be configured with 'tunnel protection ipsec' instead of a crypto map.

Answer

The crypto map is applied to the physical interface instead of the tunnel interface.

Question 3

A network engineer is troubleshooting a router that has been running for 200 days. The router experiences a sudden reboot, and after reload, the configuration is missing. 'show startup-config' returns 'startup-config is not present'. The engineer checks the boot variable: 'boot system flash:ios-image.bin'. What is the most likely cause of the configuration loss?

Accepted Answer

The engineer did not execute 'copy running-config startup-config' before the reboot.. The router's startup configuration is stored in NVRAM, and if the engineer never executed 'copy running-config startup-config' (or equivalent 'write memory'), the running configuration exists only in RAM. Upon reboot, the router loads the IOS image from flash as specified by the 'boot system flash:ios-image.bin' variable, but NVRAM contains no saved startup configuration, resulting in 'startup-config is not present'. This is a classic operational oversight where changes are made to the running configuration but not saved to NVRAM.

Answer

The router's NVRAM has a hardware failure and lost the configuration.

Answer

The 'boot system' command points to a TFTP server that also contains a configuration file, overwriting the local startup-config.

Answer

The router's configuration register is set to 0x2142, ignoring startup-config.

Question 4

A network engineer configures SNMP traps on router R3 to monitor BGP events. R3 is an iBGP route reflector with multiple clients. The configuration includes: snmp-server enable traps bgp, snmp-server host 192.168.1.100 version 2c public. However, the NMS receives no BGP traps. R3's show snmp pending shows no pending traps. show snmp statistics shows TrapsSent: 0. The NMS can poll R3 successfully via SNMP. What is the root cause?

Accepted Answer

The BGP process is not configured to send traps to the SNMP agent; the command 'snmp-server enable traps bgp' is insufficient on some IOS versions without also enabling 'bgp snmp trap' under the BGP router configuration.. On many Cisco IOS versions, the command `snmp-server enable traps bgp` only enables the SNMP agent to send BGP traps, but the BGP process itself must be explicitly configured to generate those traps using the `bgp snmp trap` command under the BGP router configuration. Without this, the BGP process never sends trap notifications to the SNMP agent, resulting in zero traps sent despite the SNMP trap configuration being otherwise correct.

Answer

The NMS is using SNMPv3 but the router is configured for v2c, causing trap rejection.

Answer

An ACL on the NMS is blocking UDP port 162 from the router.

Answer

The router's SNMP trap queue is full, causing traps to be dropped.

Question 5

Given the following partial configuration on router R1:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 network 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/2
 ip address 172.16.1.1 255.255.255.0

What is the effect of this configuration?

Accepted Answer

EIGRP will only advertise the 10.1.1.0/24 and 192.168.1.0/24 networks; the 172.16.1.0/24 network will not be advertised and no EIGRP adjacency will be formed on that interface.. EIGRP uses the network command with a wildcard mask to determine which interfaces to enable EIGRP on. The network 10.0.0.0 0.255.255.255 matches interfaces with an IP address in the 10.x.x.x range, enabling EIGRP on GigabitEthernet0/0 (10.1.1.1). The network 192.168.1.0 0.0.0.255 matches the 192.168.1.0/24 subnet, enabling EIGRP on GigabitEthernet0/1 (192.168.1.1). The 172.16.1.0/24 network is not matched by any network statement, so EIGRP is not enabled on GigabitEthernet0/2, and no adjacency is formed there.

Answer

EIGRP will form adjacencies and advertise all three interfaces because the network statements use classful boundaries.

Answer

EIGRP will advertise all three networks because the network 10.0.0.0 command includes all interfaces with an IP starting with 1, 172, or 192.

Answer

EIGRP will not form any adjacencies because the network statements must use exact subnet masks instead of wildcard masks.

Question 6

A network engineer configures mutual redistribution between EIGRP and OSPF on a DMVPN hub router. The EIGRP domain includes the DMVPN tunnel network, and OSPF includes a corporate backbone. Unexpectedly, after a few minutes, the routing table on the hub shows oscillating routes between EIGRP and OSPF for the same prefix, causing intermittent connectivity. Which is the most likely explanation?

Accepted Answer

The mutual redistribution creates a routing loop because the redistributed routes are re-injected into the original protocol without proper filtering, causing the hub to prefer the redistributed route with a lower AD.. Mutual redistribution between EIGRP and OSPF without proper filtering or tag-based loop prevention causes routes to be redistributed back into their original protocol. The hub may then prefer the redistributed route due to a lower administrative distance, creating a feedback loop that manifests as oscillating routes and intermittent connectivity.

Answer

The DMVPN tunnel interface is not included in the OSPF process, causing the redistributed routes to have an incorrect next-hop that points to the tunnel interface.

Answer

The EIGRP and OSPF processes are using different metric styles, causing the redistributed routes to have infinite metrics and be ignored.

Answer

The hub router's routing table is overloaded due to the DMVPN tunnel being a multipoint interface, causing route flapping.

Question 7

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.2.2.0/24
BGP routing table entry for 10.2.2.0/24, version 5
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65002
    10.1.12.2 from 10.1.12.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is a potential issue with this route?

Accepted Answer

The route is not being advertised to any BGP peer, possibly due to outbound filtering.. The output line 'Not advertised to any peer' means R1 is not sending this prefix to any BGP neighbor, which typically indicates outbound route filtering (e.g., a distribute-list, prefix-list, or route-map applied outbound) or a missing network statement advertisement. The route itself is valid, external, and best, so the issue is advertisement, not reachability or installation. This is a common BGP troubleshooting signal.

Answer

The route has a low local preference of 100.

Answer

The next hop 10.1.12.2 is unreachable.

Answer

The route is not installed in the routing table.

Question 8

A network engineer runs the following command on router R2:

R2# show monitor session 4
Session 4
---------
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
    Both : Gi0/0
Destination IP : 192.168.1.10
Origin IP : 10.0.0.2
ERSPAN ID : 100

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.. The output shows an ERSPAN Source Session with Source Port Gi0/0 and Destination IP 192.168.1.10, meaning traffic from Gi0/0 is mirrored to the destination IP using ERSPAN ID 100. ERSPAN encapsulates mirrored traffic in GRE and sends it to a remote destination IP, which matches this output.

Answer

The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.

Answer

The ERSPAN session is using RSPAN encapsulation.

Answer

The ERSPAN session is disabled because the status is 'Admin Enabled'.

Question 9

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla monitor statistics 10

Round Trip Time (RTT) for Index 10
   Latest RTT: 12 ms
   Latest RTT (milliseconds): 12
   Latest RTT (microseconds): 12000
   Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021
   Last operation return code: OK
   Number of successes: 100
   Number of failures: 0
   Operation time to live: Forever

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is functioning correctly with no failures.. The output shows 'Number of successes: 100' and 'Number of failures: 0', with a latest RTT of 12 ms and return code 'OK'. This indicates the IP SLA operation is functioning correctly and meeting its objectives. The return code 'OK' means the operation completed successfully, not that it failed.

Answer

The IP SLA monitor operation has failed because the return code is 'OK'.

Answer

The IP SLA monitor operation is not configured for index 10.

Answer

The IP SLA monitor operation has a timeout of 12 ms.

Question 10

An engineer configures Control Plane Policing (CoPP) on a router running OSPF. After applying the policy, OSPF neighbors intermittently drop and recover. The CoPP policy includes a class-map matching OSPF traffic with a police rate of 64000 bps. The router has multiple OSPF neighbors and the link utilization is normal. Which is the most likely explanation?

Accepted Answer

The police rate is in bits per second, but OSPF hello packets are small; the packet-per-second rate is exceeded, causing drops.. OSPF hello packets are small (typically 44–64 bytes), so a police rate of 64000 bps translates to a very low packet-per-second (pps) allowance. When multiple OSPF neighbors send hellos and other OSPF packets, the pps limit is easily exceeded, causing CoPP to drop packets and disrupt neighbor adjacencies. This is the most likely cause of intermittent OSPF neighbor drops despite normal link utilization.

Answer

The CoPP policy uses the default class class-default, which drops OSPF packets.

Answer

OSPF uses UDP, and CoPP only filters TCP traffic.

Answer

The CoPP policy is applied to the wrong interface; it should be applied to the management interface.

Question 11

Drag and drop the steps to apply and verify an extended IPv4 ACL on a router interface into the correct order, from first to last.

Accepted Answer

Configure extended ACL with permit and deny entries. The correct order is: first, create the ACL with permit/deny statements; second, verify the ACL syntax with show access-list; third, apply it inbound on the interface; fourth, verify the interface configuration with show ip interface; fifth, test connectivity with ping or traceroute.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 3

Round Trip Time (RTT) for Index 3
   Latest RTT: 150 ms
   Latest RTT (milliseconds): 150
   Latest RTT (microseconds): 150000
   Number of successes: 80
   Number of failures: 20
   Operation time to live: Forever
   Output: OK

R1# show track 1
Track 1
  IP SLA 3 reachability
  Reachability is Up
    2 changes, last change 00:00:10
  Latest operation return code: OK
  Latest RTT (milliseconds): 150
  Tracked by:
    ip route 0.0.0.0 0.0.0.0 192.168.1.1 track 1

Based on this output, which statement is correct?

Accepted Answer

The IP SLA operation is considered reachable, and the tracked static route is active.. The track shows 'Reachability is Up' based on IP SLA 3. The IP SLA statistics show successes and failures, but the latest return code is OK, so the track is up. This means the static route is active. The failures (20) indicate some probes failed, but the track still considers it reachable because the threshold for reachability is likely based on a percentage or consecutive failures.

Answer

The static route is removed because the IP SLA operation has failures.

Answer

The IP SLA operation has a 20% failure rate, so the track should be down.

Answer

The IP SLA operation is using a wrong source address.

Question 13

A network engineer runs the following debug command to troubleshoot a DHCPv4 issue on router R1:

R1# debug ip dhcp server events

Output:
 DHCPD: DHCPDISCOVER received from 0050.7966.6800 on interface GigabitEthernet0/0
 DHCPD: Sending DHCPOFFER to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPREQUEST received from 0050.7966.6800
 DHCPD: No binding found for client 0050.7966.6800
 DHCPD: Adding binding for client 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPINFORM received from 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCP server successfully assigned an IP address to the client, and the client sent a DHCPINFORM to request additional parameters.. The debug output shows the DHCP server receiving a DHCPDISCOVER, sending a DHCPOFFER, receiving a DHCPREQUEST, creating a new binding, and sending a DHCPACK. The subsequent DHCPINFORM from the client is a standard request for additional configuration parameters (like DNS or domain name) after the client already has an IP address. The server responds with a DHCPACK, confirming successful assignment and parameter delivery.

Answer

The DHCP server failed to create a binding for the client.

Answer

The DHCP client is using a relay agent because the DISCOVER was received on a different interface.

Answer

The DHCP server rejected the DHCPREQUEST because no binding was found.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 4

Round Trip Time (RTT) for Index 4
   Latest RTT: 300 ms
   Latest RTT (milliseconds): 300
   Latest RTT (microseconds): 300000
   Number of successes: 45
   Number of failures: 55
   Operation time to live: Forever
   Output: Over threshold

R1# show track 2
Track 2
  IP SLA 4 reachability
  Reachability is Down
    5 changes, last change 00:00:05
  Latest operation return code: Over threshold
  Latest RTT (milliseconds): 300
  Tracked by:
    ip route 0.0.0.0 0.0.0.0 192.168.2.1 track 2

Based on this output, which statement is correct?

Accepted Answer

The IP SLA threshold has been exceeded, causing the track to go down and the static route to be removed.. The track shows 'Down' because the IP SLA return code is 'Over threshold'. This means the threshold was exceeded, and the track has brought down the static route. The failures (55) are high, but the key is that the track is down due to the threshold violation.

Answer

The IP SLA operation is failing because the target is unreachable.

Answer

The tracked static route is active because the IP SLA has successes.

Answer

The IP SLA operation has a 55% failure rate, but the track is still up.

Question 15

Drag and drop the steps to verify and validate NetFlow and Flexible NetFlow operational state into the correct order, from first to last.

Accepted Answer

Check flow monitor status on interface. Verification starts with checking that the flow monitor is active on the interface, then confirming flow records are being generated, then checking exporter statistics for sent packets, then validating the collector receives the data, and finally comparing flow counts to interface counters for accuracy.