300-410 Practice Test 16 — 15 Questions

Question 1

An engineer configures OSPFv3 with a filter-list on an ABR to filter prefixes. After configuration, the routes are still being advertised. Which is the most likely explanation?

Accepted Answer

The filter-list only filters inter-area prefixes, not external routes.. In OSPFv3, prefix filtering is done using the 'prefix-list' or 'filter-list' command under the area. However, the filter-list in OSPFv3 filters type 3 LSAs (inter-area prefixes) but not type 5 LSAs (external routes). If the routes being advertised are external, the filter-list will not affect them.

Answer

The filter-list is applied to the wrong area.

Answer

The filter-list uses an incorrect prefix-list.

Answer

The OSPFv3 process needs to be restarted.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 10
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, what is the problem?

Accepted Answer

NAT translations exist but no packets are being translated (0 hits), indicating a possible routing or ACL issue.. The output shows two dynamic NAT translations (192.0.2.10→10.0.0.10 and 192.0.2.11→10.0.0.11) but zero hits, meaning no packets have been translated. The misses counter is 10, indicating that packets arrived but failed to match the translation. This typically occurs when the access control list (ACL1) does not permit the source traffic, or the routing path does not direct traffic through the NAT inside interface, preventing the translation from being used.

Answer

The NAT pool is exhausted.

Answer

PAT is enabled but not working.

Answer

The inside and outside interfaces are reversed.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          203.0.113.5        203.0.113.5
--- 192.0.2.11         10.0.0.11          203.0.113.5        203.0.113.5

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 20  Misses: 0
CEF Translated packets: 20, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, which statement is correct?

Accepted Answer

NAT is configured without PAT; each inside host uses a unique global address.. The output shows two dynamic NAT translations, each with a unique inside global address (192.0.2.10 and 192.0.2.11) mapped to different inside local addresses (10.0.0.10 and 10.0.0.11). The absence of any port numbers in the 'Pro' column indicates that Port Address Translation (PAT) is not used; instead, each inside host receives a one-to-one mapping to a unique public IP from the pool. This confirms standard dynamic NAT without PAT.

Answer

PAT is enabled, but only two translations are active.

Answer

The pool is exhausted because two addresses are used.

Answer

Static NAT is configured for both hosts.

Question 4

An engineer configures an IPsec site-to-site VPN. The tunnel comes up, but no traffic passes. The engineer checks the crypto map and access-lists. Which is the most likely explanation?

Accepted Answer

The access-list defining interesting traffic is missing the 'permit' statement for the actual traffic flow.. The access-list defining interesting traffic for the crypto map must explicitly include a 'permit' statement for the traffic that should be encrypted. Without this permit, the router will not classify the traffic as interesting, so IPsec will not attempt to encrypt it, and the traffic will be dropped or sent in clear depending on the crypto map configuration. The tunnel can still come up because IKE and IPsec SA negotiation is triggered by interesting traffic, but if the access-list is missing the permit, no traffic triggers the SA establishment, and existing SAs may remain idle.

Answer

The crypto map is applied to the wrong interface, causing the traffic to bypass encryption.

Answer

The IPsec transform set uses ESP with no encryption, so traffic is sent in clear.

Answer

The IKE phase 1 policy uses aggressive mode, which is incompatible with the crypto map.

Question 5

What is the default DHCPv4 client lease time on a Cisco IOS-XE router configured as a DHCP client?

Accepted Answer

86400 seconds (1 day). When a Cisco IOS-XE router is configured as a DHCPv4 client (e.g., using the 'ip address dhcp' command on an interface), the default lease time requested by the client is 86400 seconds (1 day). This value is defined in the Cisco DHCP client implementation and is the default lease time sent in the DHCPDISCOVER message, though the actual lease assigned depends on the DHCP server's configuration.

Answer

3600 seconds (1 hour)

Answer

43200 seconds (12 hours)

Answer

1800 seconds (30 minutes)

Question 6

Which EIGRP packet type is used to confirm receipt of a reliable update?

Accepted Answer

ACK. EIGRP uses reliable transport for updates, queries, and replies. The receiver sends an ACK packet (a Hello packet with no data) to confirm receipt.

Answer

Hello

Answer

Update

Answer

Reply

Question 7

What is the default EIGRP hold time multiplier relative to the hello interval?

Accepted Answer

Hold time is three times the hello interval. By default, EIGRP sets the hold time to three times the hello interval. This ensures that a few missed hellos do not immediately cause neighbor loss.

Answer

Hold time equals hello interval

Answer

Hold time is twice the hello interval

Answer

Hold time is four times the hello interval

Question 8

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Accepted Answer

The 'logging on' command is not configured.. The 'show logging' output clearly states that syslog logging is disabled. The most common cause is that the global 'logging on' command is missing from the configuration. Without this command, no syslog messages are generated or sent to any destination.

Answer

The logging buffer is full and needs to be cleared.

Answer

The router has run out of memory to generate syslog messages.

Answer

The 'logging host' command is missing, so no destination is configured.

Question 9

What is the default CoPP policer action for packets that exceed the committed information rate (CIR)?

Accepted Answer

Drop. The default action for a Control Plane Policing (CoPP) policy-map class when traffic exceeds the committed information rate (CIR) is to drop the excess packets. This is because CoPP uses a single-rate, two-color policer by default, where packets conforming to the CIR are marked as 'conform' and transmitted, while packets exceeding the CIR are marked as 'exceed' and dropped. No default 'violate' action exists unless explicitly configured.

Answer

Transmit with best-effort

Answer

Set DSCP to 0

Answer

Queue for later transmission

Question 10

An engineer must implement CoPP to protect the control plane of a Cisco IOS router from a DoS attack targeting SSH and SNMP. Which TWO configuration changes are required? (Choose TWO.)

Accepted Answer

Create an extended ACL that matches TCP port 22 (SSH) and UDP port 161 (SNMP).. CoPP uses an extended ACL to classify traffic for the control plane. SSH uses TCP port 22 and SNMP uses UDP port 161, so an extended ACL matching these protocols and ports is required to identify the DoS attack traffic. This ACL is then referenced by a class-map to define the traffic class for the CoPP policy.

Answer

Apply the CoPP policy under the interface configuration mode using 'service-policy input'.

Answer

Apply the CoPP policy under the control-plane configuration using 'service-policy output'.

Answer

Use the 'police' command with 'conform-action drop' to drop all SSH and SNMP traffic.

Question 11

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Accepted Answer

The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.. Private VLAN (PVLAN) on VLAN 20 isolates ports within the same VLAN, preventing direct communication between hosts on isolated ports. Even though the hosts share the same VLAN, PVLAN restricts traffic so that isolated ports can only communicate with a promiscuous port (e.g., a router uplink), not with each other. This directly explains why IPv6 hosts on VLAN 20 cannot ping each other.

Answer

IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.

Answer

RA Guard is blocking Neighbor Advertisements between hosts.

Answer

DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Question 12

Two routers are configured with EIGRP using `network 0.0.0.0 0.0.0.0` to enable EIGRP on all interfaces. One router has a loopback interface with IP 10.1.1.1/32. The other router learns 10.1.1.1/32 via EIGRP. An engineer then configures `distribute-list prefix FILTER out` under the EIGRP process on the first router, where FILTER denies 10.1.1.1/32. Unexpectedly, the second router still receives the route. Which is the most likely explanation?

Accepted Answer

The distribute-list out does not filter routes that are directly connected and enabled via the `network` command; it only filters redistributed routes.. In EIGRP, distribute-lists applied under the router process (classic mode) affect only routes that are redistributed or injected via `network` commands. However, if the route is directly connected and the interface is enabled for EIGRP via the `network` command, the distribute-list out does not filter connected routes advertised by the network statement. To filter such routes, the distribute-list must be applied under the interface configuration or use a prefix-list that matches the interface.

Answer

The distribute-list must be applied inbound on the second router to block the route.

Answer

The prefix-list FILTER is misconfigured; it should deny 10.1.1.1/32 with a ge/le condition.

Answer

The distribute-list command is not supported in classic mode; it must be used in named mode.

Question 13

An engineer configures mutual redistribution between EIGRP and OSPF on a router. EIGRP routes are redistributed into OSPF with a route-map that sets metric-type type-1, and OSPF routes are redistributed into EIGRP with default metric 10000 100 255 1 1500. Unexpectedly, the router starts flapping routes between the two protocols, causing instability. Which is the most likely explanation?

Accepted Answer

The redistribution is not using route tags, so routes are being re-redistributed back and forth, causing route flapping.. Without route tagging, mutual redistribution can cause a routing loop where a route redistributed from EIGRP into OSPF is then redistributed back into EIGRP with a different metric, creating a feedback loop. The router sees the same prefix from both protocols and may prefer one over the other, causing continuous updates. The solution is to use route tags to prevent re-redistribution.

Answer

The OSPF metric-type type-1 is incompatible with EIGRP, causing the route to be rejected.

Answer

The EIGRP default metric is missing the reliability and load values, so redistribution fails.

Answer

The router must have `redistribute connected` under both protocols to avoid flapping.

Question 14

Which of the following statements about BFD echo mode is true?

Accepted Answer

Echo mode allows the local router to detect failures without requiring the remote router to send BFD control packets.. BFD echo mode is an optional mode where the local router sends echo packets to the remote router, which loops them back. This reduces the processing load on the remote router because it does not need to generate BFD control packets. Echo mode is enabled by default on Cisco IOS-XE.

Answer

Echo mode increases the load on the remote router because it must process echo packets.

Answer

Echo mode is disabled by default and must be explicitly enabled.

Answer

Echo mode uses the same timer values as the BFD control packets.

Question 15

A network engineer runs the following command on Router R9:

R9# show logging | include %DMVPN-5-ADJCHG

*Mar  1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN
*Mar  1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The DMVPN tunnel is flapping due to an unstable IPsec SA.. The output shows NHRP peer flapping on Tunnel0, indicating that the DMVPN tunnel is unstable. This is often due to a flaking physical interface, IPsec SA expiration, or routing issues. The peer 10.0.0.1 is going up and down repeatedly.

Answer

The NHRP hold time is set too high.

Answer

The router has a mismatched DMVPN phase configuration.

Answer

The tunnel interface is administratively down.