300-410 Practice Test 17 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a VRF-Lite OSPF adjacency issue:

R1# debug ip ospf adj vrf CUSTOMER_C

Output:
OSPF: 2 Way state received from 10.1.1.2 on interface GigabitEthernet0/1, address 10.1.1.2
OSPF: Neighbor 10.1.1.2 is eligible for DR election on interface GigabitEthernet0/1
OSPF: DR election: 10.1.1.1 (pri 1) is DR, 10.1.1.2 (pri 1) is BDR
OSPF: Build router LSA for area 0, router ID 1.1.1.1, seq 0x80000001
OSPF: Neighbor 10.1.1.2 is FULL, state changed from LOADING to FULL

What does this output indicate?

Accepted Answer

The OSPF adjacency formed successfully, with 10.1.1.1 as DR and 10.1.1.2 as BDR.. The debug output shows the neighbor state changing from LOADING to FULL, which means the OSPF adjacency successfully completed database exchange and reached the FULL state. It also shows that 10.1.1.1 was elected DR and 10.1.1.2 was elected BDR, confirming a stable adjacency on the segment. The earlier 2-Way state is a normal part of the DR/BDR election process before the adjacency progresses to FULL.

Answer

The OSPF adjacency failed because the neighbor remained in LOADING state.

Answer

The OSPF adjacency formed but the router ID is missing, causing instability.

Answer

The OSPF adjacency is stuck in 2-Way state due to mismatched area IDs.

Question 2

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# debug ip bgp updates

Output:
*Mar  1 00:01:23.456: BGP(0): 10.0.0.2 UPDATE out w/ attr: nexthop 10.0.0.1, origin i, metric 0, path 65000, extended community RT:100:100
*Mar  1 00:01:23.456: BGP(0): 10.0.0.2 UPDATE out for 10.1.1.0/24
*Mar  1 00:01:23.456: BGP(0): 10.0.0.2 UPDATE run, update group 1

What does this output indicate?

Accepted Answer

R1 is advertising prefix 10.1.1.0/24 to BGP peer 10.0.0.2. The debug output shows 'UPDATE out' and 'UPDATE out for 10.1.1.0/24', which explicitly indicates that R1 is sending (advertising) an update for prefix 10.1.1.0/24 to its BGP peer 10.0.0.2. The 'out' keyword in Cisco BGP debug output always refers to outbound updates, and the extended community RT:100:100 confirms this is an MPLS L3VPN route being advertised with a route target.

Answer

R1 is receiving an update for 10.1.1.0/24 from 10.0.0.2

Answer

R1 is withdrawing prefix 10.1.1.0/24

Answer

R1 is using OSPF to advertise the prefix

Question 3

Examine this configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable

Which statement is true?

Accepted Answer

Incoming traffic to 198.51.100.10:8080 is forwarded to 10.0.0.10:80.. The configuration uses a static NAT with TCP port translation (also known as NAT with port forwarding). The command `ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable` creates a one-to-one mapping between the inside local address/port (10.0.0.10:80) and the inside global address/port (198.51.100.10:8080). This means any incoming packet destined to 198.51.100.10 on TCP port 8080 will have its destination translated to 10.0.0.10 port 80, and the response traffic is reverse-translated. Option B correctly describes this behavior.

Answer

All traffic from 10.0.0.10 is translated to 198.51.100.10.

Answer

The 'extendable' keyword is invalid for static NAT.

Answer

This translation will not work unless 'ip nat inside source list' is also configured.

Question 4

In BGP, what is the default administrative distance for eBGP routes?

Accepted Answer

20. Cisco IOS assigns eBGP routes a default administrative distance of 20, making them more trusted than OSPF (110), RIP (120), and iBGP (200). This low AD ensures that when the same prefix is learned via eBGP and an IGP, the eBGP route is preferred in the routing table. The value 20 is a Cisco-specific default and is configurable via the 'distance bgp' command.

Answer

200

Answer

120

Answer

110

Question 5

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 170
    10 permit icmp any any echo (100 matches)
    20 permit icmp any any echo-reply (80 matches)
    30 deny ip any any (10 matches)

Based on this output, which statement is correct?

Accepted Answer

Only ICMP echo and echo-reply are permitted; all other IP traffic is denied.. The ACL 170 explicitly permits only ICMP echo (type 8) and echo-reply (type 0) traffic, as shown by the match counters. The final deny ip any any statement blocks all other IP traffic, including other ICMP types and non-ICMP IP protocols. Therefore, only ICMP echo and echo-reply are permitted; all other IP traffic is denied, making option B correct.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all IP traffic.

Answer

The ACL is not applied.

Question 6

What is the default maximum hop count for RIP routes in Cisco IOS?

Accepted Answer

15. RIP uses hop count as its metric, with a maximum valid hop count of 15. A hop count of 16 is considered infinity, meaning the destination is unreachable. This limit prevents routing loops but restricts RIP to small networks. The default maximum hop count in Cisco IOS is 15, as defined in RFC 1058 and 2453.

Answer

16

Answer

255

Answer

10

Question 7

A network engineer runs the following command on Router PE3:

PE3# show ip vrf interfaces
Interface      IP-Address      VRF                              Protocol
Gi0/0          10.1.1.1        CUSTOMER_C                       up      
Gi0/1          10.2.2.1        CUSTOMER_D                       up

Based on this output, which statement is correct?

Accepted Answer

Both interfaces are correctly assigned to VRFs and are operational.. The output shows both Gi0/0 and Gi0/1 assigned to VRFs (CUSTOMER_C and CUSTOMER_D respectively) with the Protocol column reading 'up', which confirms the interfaces are operational and correctly bound to their VRFs. This is the expected healthy state for VRF-lite or MPLS PE interfaces.

Answer

Interface Gi0/0 is down.

Answer

VRF CUSTOMER_C has no routes.

Answer

The router has no VRF configuration.

Question 8

Which THREE symptoms indicate that an IPv4 access control list may be misconfigured or not applied correctly? (Choose THREE.)

Accepted Answer

Traffic that should be permitted is being blocked.. A primary symptom of a misconfigured or incorrectly applied ACL is that it blocks traffic that should be permitted. This typically occurs when the ACL's sequence of permit and deny statements does not match the intended policy, or when the ACL is applied in the wrong direction (inbound vs. outbound) on an interface. The router processes ACL entries sequentially, so a deny statement placed before a permit statement for the same traffic will cause legitimate packets to be dropped.

Answer

The interface is flapping up and down.

Answer

Routing protocol neighbors are dropping.

Question 9

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

Accepted Answer

Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.. IPv6 Source Guard relies on the IPv6 binding table to validate traffic. When a host uses a static IPv6 address, the switch cannot learn the binding via DHCPv6 snooping. Enabling IPv6 ND snooping on the VLAN allows the switch to inspect Neighbor Discovery (ND) messages (RFC 4861) and dynamically populate the binding table with the host's IPv6 address and MAC address, thus permitting the traffic without disabling Source Guard.

Answer

Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.

Answer

Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.

Answer

Disable IPv6 Source Guard on the port connected to the host.

Question 10

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show ip ospf interface detail

FastEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0.0.0.0, Attached via Network Statement
  Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID Cost    Disabled    Shutdown      Topology Name
        0        1        no          no            Base
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 10.1.1.1, Interface address 10.1.1.1
  Backup Designated router (ID) 10.1.1.2, Interface address 10.1.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 25
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.1.1.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)

What does this output indicate?

Accepted Answer

OSPF is operating normally with one neighbor, suggesting CoPP is not impacting OSPF.. The output shows that OSPF has formed a full adjacency with neighbor 10.1.1.2, which is the Backup Designated Router. The neighbor count is 1 and the adjacent neighbor count is 1, indicating that OSPF is operating normally on this interface. Therefore, CoPP is not impacting OSPF Hello or adjacency formation.

Answer

OSPF is not forming adjacencies due to CoPP dropping Hello packets.

Answer

OSPF is experiencing DR/BDR election issues due to CoPP.

Answer

OSPF is not receiving Hello packets due to CoPP.

Question 11

A network engineer configures the following on a router:
```
router eigrp 100
 distance 150 10.0.0.0 0.255.255.255
```
What is the intended effect?

Accepted Answer

It sets the administrative distance to 150 for routes learned from any neighbor whose source IP matches the wildcard mask 0.255.255.255.. The EIGRP distance command syntax is distance

. Here, 150 is the administrative distance, 10.0.0.0 is the source IP, and 0.255.255.255 is the wildcard mask, meaning any neighbor whose source IP is in 10.0.0.0/8 will have its routes assigned an AD of 150. This is used to prefer another routing protocol for routes learned from specific EIGRP neighbors.

Answer

It sets the administrative distance for all EIGRP routes to 150.

Answer

It sets the administrative distance to 150 for all routes in the routing table with destination 10.0.0.0/8.

Answer

It sets the administrative distance to 150 for EIGRP external routes only.

Question 12

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.1.0/24 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is applied to interface GigabitEthernet0/0. The engineer notices that the PBR policy is not working at all. The engineer checks the route map configuration and sees 'match ip address 110' and 'set ip next-hop 10.10.10.2'. The engineer also checks the ACL 110 and confirms it matches 172.16.1.0/24. The engineer then checks the interface configuration and sees 'ip policy route-map PBR-172' applied. What should the engineer do next to isolate the issue?

Accepted Answer

Check if the next-hop 10.10.10.2 is reachable via the routing table.. For PBR with 'set ip next-hop', the router must be able to resolve the next-hop address via the routing table (RIB) before the policy can take effect. If 10.10.10.2 is not reachable through a valid route, the route map match succeeds but the set action is silently skipped, and traffic falls back to normal destination-based forwarding — making PBR appear completely broken. Verifying next-hop reachability is therefore the correct next diagnostic step.

Answer

Add the 'set ip default next-hop' command to the route map.

Answer

Change the route map to use 'set interface' instead of 'set ip next-hop'.

Answer

Apply the route map to the outgoing interface instead of the incoming interface.

Question 13

Which NetFlow version introduced the concept of templates to support variable-length flow records?

Accepted Answer

NetFlow version 9. NetFlow version 9 introduced templates, which allow the collector to interpret variable-length flow records. Templates define the format of subsequent data records, enabling flexibility and extensibility. This was a significant advancement over fixed-format versions like v5.

Answer

NetFlow version 5

Answer

NetFlow version 8

Answer

NetFlow version 10 (IPFIX)

Question 14

A network engineer is troubleshooting a routing issue in an EIGRP network. Router R1 is not learning a specific route from its neighbor R2, even though R2 has the route in its routing table. The engineer checks the EIGRP topology table on R1 and does not see the route. The output of 'show ip eigrp neighbors' shows that R1 and R2 are adjacent. What should the engineer check next?

Accepted Answer

Check if a distribute-list in or out is applied under the EIGRP process on R1.. If R1 and R2 are EIGRP neighbors but R1 does not have the route in its topology table, a distribute-list applied inbound on R1 or outbound on R2 could be filtering the route. Distribute-lists use access-lists or prefix-lists to permit or deny routes during the update process, preventing specific routes from being installed in the topology table even though the neighbor adjacency is established.

Answer

Check if the route is being summarized on R2.

Answer

Check if the EIGRP metric for the route is too high.

Answer

Check if the route is a connected route on R2.

Question 15

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.50.0/24 should be forwarded to next-hop 10.50.50.2. The route map 'PBR-50' is configured with 'match ip address 160' and 'set ip next-hop 10.50.50.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.50.0/24, but the router is also policy-routing traffic from other subnets that should not be affected. The engineer checks the ACL 160 and confirms it only matches 192.168.50.0/24. What is the most likely cause?

Accepted Answer

The route map has a sequence with no match condition, which matches all traffic.. A route map sequence with no match condition matches all traffic, so any traffic entering the interface where the route map is applied will be policy-routed to 10.50.50.2 — even subnets that should not be affected. This explains why other subnets are being policy-routed despite ACL 160 correctly matching only 192.168.50.0/24.

Answer

The ACL 160 has a 'permit ip any any' statement at the end.

Answer

The 'ip policy route-map' command is applied to multiple interfaces, and traffic from other subnets is entering those interfaces.

Answer

The router is using CEF switching, and PBR is applied to all traffic regardless of ACL.