300-410 Practice Test 17 — 15 Questions

Question 1

Given the following partial configuration on a Cisco IOS-XE router:

logging host 10.1.1.1 transport tcp port 514
logging source-interface GigabitEthernet0/1
logging on

What is missing or incorrect in this configuration?

Accepted Answer

The syslog server must support TCP syslog, which is not defined in RFC 3164.. By default, syslog uses UDP port 514. When using TCP transport, the syslog server must be configured to accept TCP connections, and this is not a common configuration. The configuration itself is syntactically correct, but the question tests knowledge that TCP transport for syslog is non-standard and may not work with typical syslog servers.

Answer

The configuration is correct; no changes are needed.

Answer

The 'logging on' command is redundant because logging is enabled by default.

Answer

The port number should be 5140 for TCP syslog.

Question 2

Which TWO statements about syslog message severity levels are true? (Choose TWO.)

Accepted Answer

Severity level 0 (emergencies) is the most critical and indicates system instability.. Syslog severity levels range from 0 (emergencies) to 7 (debugging). Level 0 is the most critical, and level 7 is the least critical. Level 5 is 'notifications', not 'warnings'; warnings are level 4. Level 6 is 'informational'. Level 3 is 'errors'.

Answer

Severity level 5 (warnings) is less severe than level 4 (notifications).

Answer

Severity level 6 (informational) is used for system error messages.

Answer

Severity level 3 (errors) is more critical than level 2 (critical).

Question 3

Given the configuration:

logging buffered 8192 warnings
logging console alerts
logging monitor critical

Which of the following is true?

Accepted Answer

The logging buffer stores messages of severity 0 through 4.. The buffer is set to 8192 bytes with level warnings (0-4). Console is alerts (0-2). Monitor is critical (0-3). Note that the buffer size is in bytes, not messages.

Answer

The console displays messages of severity 0 through 3.

Answer

The monitor receives messages of severity 0 through 4.

Answer

The buffer can store up to 8192 syslog messages.

Question 4

According to RFC 3164, which facility code is used by default for Cisco IOS syslog messages?

Accepted Answer

Local7. RFC 3164 defines facility codes. Cisco IOS uses local7 (facility 23) as the default for syslog messages, though this can be changed with the 'logging facility' command.

Answer

Local0

Answer

User

Answer

Syslog

Question 5

What is the default size of the logging buffer on a Cisco IOS-XE router if not explicitly configured?

Accepted Answer

4096 bytes. The default logging buffer size on most Cisco IOS-XE platforms is 4096 bytes. This is a standard default value that candidates should know.

Answer

8192 bytes

Answer

16384 bytes

Answer

No buffer is allocated by default.

Question 6

Which THREE configuration steps are required to send syslog messages from a Cisco router to a remote syslog server? (Choose THREE.)

Accepted Answer

Configure the syslog server IP address using the 'logging <ip-address>' command.. To send syslog messages to a remote server, you must enable logging globally, specify the server address, and set the logging trap level (or use default). Setting the source interface is optional but recommended. Configuring NTP is not required for syslog. Enabling SNMP is unrelated.

Answer

Set the logging source interface using 'logging source-interface <interface>'.

Answer

Configure NTP to ensure accurate timestamps in syslog messages.

Question 7

Which THREE symptoms indicate a potential OSPFv2 neighbor adjacency problem due to a mismatch in configuration? (Choose THREE.)

Accepted Answer

The neighbor state remains stuck in INIT or EXSTART.. A mismatch in hello/dead timers, area ID, or authentication causes neighbors to stay stuck in INIT or EXSTART state. A mismatched MTU can cause stuck in EXSTART/EXCHANGE. A mismatched network type can also cause issues. Routes missing from the routing table is a symptom of many issues, not specific to mismatches.

Answer

The neighbor state is 2WAY/DROTHER.

Answer

The 'show ip ospf neighbor' output shows the neighbor but with a state of DOWN.

Question 8

Examine this OSPF configuration on router R5:

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of the passive-interface default command?

Accepted Answer

All interfaces except GigabitEthernet0/0 will be passive; GigabitEthernet0/0 will send and receive OSPF hellos.. The passive-interface default command sets all interfaces as passive by default, meaning they will not send OSPF hello packets or form adjacencies. The no passive-interface command then overrides this for the specified interface, allowing it to form adjacencies.

Answer

All interfaces are passive, including GigabitEthernet0/0, because the no passive-interface command is ignored.

Answer

Only interfaces with network statements will be affected; other interfaces remain active.

Answer

The configuration is invalid because passive-interface default cannot be used with OSPF.

Question 9

What is the default OSPF hello interval on a point-to-point serial interface?

Accepted Answer

10 seconds. OSPF hello interval defaults are based on the network type. For point-to-point and broadcast networks, the default hello interval is 10 seconds. For NBMA and point-to-multipoint, it is 30 seconds.

Answer

30 seconds

Answer

40 seconds

Answer

20 seconds

Question 10

A router has CoPP configured with a class-map that matches all traffic and polices it to 10000 pps. The router also has IPsec configured for a site-to-site VPN. After applying CoPP, the IPsec tunnel goes up, but traffic through the tunnel is intermittently dropped. Which is the most likely explanation?

Accepted Answer

CoPP drops IKE packets during rekey, causing the IPsec tunnel to fail temporarily.. CoPP polices control plane traffic, and IKE (UDP 500/4500) is control plane traffic. During IPsec rekey, IKE packets are sent to the router's control plane for processing. If CoPP drops these IKE packets due to the 10000 pps policer, the rekey fails, causing the IPsec tunnel to temporarily go down until the next rekey attempt. The tunnel itself stays up initially, but traffic is intermittently dropped because the tunnel fails during rekey events.

Answer

CoPP drops ESP packets, which are data plane traffic.

Answer

IPsec uses TCP, and CoPP only polices UDP.

Answer

The CoPP policy is applied to the tunnel interface, not the control plane.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-DEFAULT

R1# show route-map PBR-DEFAULT
route-map PBR-DEFAULT, permit, sequence 10
  Match clauses:
    ip address (access-lists): 150
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-DEFAULT, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 150
Extended IP access list 150
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely problem?

Accepted Answer

No traffic matching ACL 150 is arriving on GigabitEthernet0/0.. The route map has a deny sequence 20 with no match clause, which means it matches all packets. Since route maps are processed in order, if sequence 10 does not match (zero matches), sequence 20 will match all remaining packets and deny them (i.e., not apply PBR), causing them to be routed normally. However, the counters show zero for both sequences, indicating no traffic is being processed at all, likely because no traffic matching ACL 150 arrives on the interface.

Answer

The deny sequence 20 is blocking all traffic from being policy-routed.

Answer

The next-hop 10.0.0.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 12

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# debug ip packet

Output:
IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 3
IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 4
IP: s=10.1.1.1 (GigabitEthernet0/1), d=10.2.2.2, len 100, rcvd 5

What does this output indicate?

Accepted Answer

The router is experiencing a routing loop, as indicated by the repeated packets with the same source and destination.. The output shows repeated packets from the same source to the same destination, which may indicate a routing loop or excessive traffic. The engineer should use 'undebug all' to stop the debug and then investigate the routing table.

Answer

The router is functioning normally; these are just normal IP packets being forwarded.

Answer

The router is receiving multicast traffic and showing each packet individually.

Answer

The debug command is not working correctly because the output is too repetitive.

Question 13

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# show ip route summary

Output:
Route Source    Networks    Subnets    Overhead    Memory (bytes)
connected       0           2          0           0
static          0           0          0           0
ospf 1          5           10         0           0
bgp 65001       3           5          0           0

Total           8           17         0           0

What does this output indicate?

Accepted Answer

The routing table contains 8 networks and 17 subnets, with OSPF contributing the most routes.. The output shows the routing table summary, including the number of networks and subnets from each routing protocol. This helps in understanding the routing table size and protocol contributions.

Answer

The router has a routing table with 25 total routes.

Answer

The router is using BGP as the primary routing protocol.

Answer

The router has no static routes configured.

Question 14

Which syslog facility code is used by default for Cisco IOS messages when sent to a syslog server?

Accepted Answer

Facility 20 (local4). Cisco IOS defaults to facility code 20 (local4) for syslog messages.

Answer

Facility 16 (local0)

Answer

Facility 23 (local7)

Answer

Facility 24 (no default)

Question 15

Which OSPF packet type is used to send link-state advertisements (LSAs) and is acknowledged by the receiver?

Accepted Answer

Link State Update (type 4). OSPF packet type 4 is the Link State Update packet, used to flood LSAs. It is acknowledged by the receiver via a Link State Acknowledgment packet (type 5).

Answer

Hello (type 1)

Answer

Database Description (type 2)

Answer

Link State Request (type 3)