300-410 Practice Test 18 — 15 Questions

Question 1

snmp-server enable traps
snmp-server host 192.168.1.100 traps version 2c public
snmp-server host 192.168.1.200 informs version 2c public

What is the effect of this configuration?

Accepted Answer

Traps are sent to 192.168.1.100 and informs are sent to 192.168.1.200.. The configuration explicitly uses the 'traps' keyword for 192.168.1.100 and the 'informs' keyword for 192.168.1.200. In SNMP, the 'snmp-server host' command defines the destination and type of notification; 'traps' are unacknowledged UDP messages, while 'informs' are acknowledged (requiring a response from the receiver). Therefore, traps are sent to 192.168.1.100 and informs to 192.168.1.200, making option A correct.

Answer

Both hosts receive traps.

Answer

Both hosts receive informs.

Answer

Only traps are enabled; informs require SNMPv3.

Question 2

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop 10.1.1.2
  Policy routing matches: 50 packets, 6000 bytes

What does this output indicate?

Accepted Answer

PBR is successfully forwarding matching traffic to 10.1.1.2.. The output shows that 50 packets have matched the route-map and have been policy-routed to next-hop 10.1.1.2. This indicates PBR is working.

Answer

The next-hop 10.1.1.2 is not reachable.

Answer

The ACL 101 is misconfigured.

Answer

PBR is not applied to any interface.

Question 3

A network engineer runs the following command to troubleshoot OSPF route filtering:

R1# show ip ospf database router 2.2.2.2

OSPF Router with ID (1.1.1.1) (Process ID 1)

Router Link States (Area 0)

LS age: 300
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 2.2.2.2
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000004
  Checksum: 0x1234
  Length: 48
  Number of Links: 2

Link connected to: a Stub Network
     (Link ID) Network/subnet number: 10.1.1.0
     (Link Data) Network Mask: 255.255.255.0
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

Link connected to: a Transit Network
     (Link ID) Designated Router address: 10.1.1.2
     (Link Data) Router Interface address: 10.1.1.1
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

What does this output indicate?

Accepted Answer

Router 2.2.2.2 is advertising two links, one of which is a stub network 10.1.1.0/24.. The output shows the OSPF router LSA from router 2.2.2.2. It lists two links: one stub network (10.1.1.0/24) and one transit network (via DR 10.1.1.2). This is normal OSPF operation.

Answer

Router 2.2.2.2 is filtering routes from area 0.

Answer

Router 2.2.2.2 is a DR for the transit network.

Answer

Router 2.2.2.2 has a mismatched area ID.

Question 4

Which TWO configuration steps are required to enable SNMPv3 with authentication and encryption on a Cisco router? (Choose TWO.)

Accepted Answer

snmp-server group GROUP v3 priv. The `snmp-server group GROUP v3 priv` command creates an SNMPv3 group that enforces the `priv` security level, which requires both authentication and encryption for all users in that group. This is the foundational step to enable SNMPv3 with auth and encryption, as the group defines the minimum security model (noAuthNoPriv, authNoPriv, or authPriv) that users must meet. Without this group configuration, users cannot be assigned the necessary privileges for encrypted communication.

Answer

snmp-server community PUBLIC ro

Answer

snmp-server host 10.1.1.1 version 3 priv USER

Answer

snmp-server enable traps

Question 5

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKEv1, I - IKEv2

C-id  Local       Remote      I-VRF    Status Encr Hash Auth DH     Lifetime Cap
1     10.1.1.1    10.1.1.2              ACTIVE aes  sha  psk  14    23:59:59

Based on this output, which statement is correct?

Accepted Answer

The IKEv1 SA is established with the peer 10.1.1.2.. The ISAKMP SA is active, using AES encryption, SHA hash, pre-shared key authentication, and Diffie-Hellman group 14. The lifetime is about 24 hours.

Answer

The IKEv2 SA is established with the peer 10.1.1.2.

Answer

The ISAKMP SA is not established; status is MM_NO_STATE.

Answer

The Diffie-Hellman group is group 2.

Question 6

A network engineer runs the following command to troubleshoot an Administrative Distance issue:

R1# show ip route summary
Route Source    Networks    Subnets    Overhead    Memory (bytes)
connected       2           0          0           512
static          1           0          0           256
eigrp 100       3           0          0           768
ospf 1          2           0          0           512
bgp 65001       1           0          0           256
internal        1           0          0           256
Total           10          0          0           2560

What does this output indicate?

Accepted Answer

The router has 10 routes total, with EIGRP contributing the most routes.. The output shows a summary of routes from different sources. It does not show administrative distance values directly, but it lists the routing protocols and their route counts.

Answer

The administrative distance for EIGRP routes is 90.

Answer

The router is redistributing between OSPF and EIGRP.

Answer

The BGP route is preferred over the OSPF route for the same prefix.

Question 7

A network engineer runs the following command to troubleshoot a VRF-Lite MPLS LDP issue:

R1# show mpls ldp bindings vrf CUSTOMER_F

Output:
  lib entry: 10.4.4.0/24, rev 2
    local binding:  label: 16
    remote binding: lsr: 2.2.2.2:0, label: 20
  lib entry: 10.5.5.0/24, rev 3
    local binding:  label: 17
    remote binding: lsr: 2.2.2.2:0, label: 21

What does this output indicate?

Accepted Answer

The VRF CUSTOMER_F has two prefixes with local labels 16 and 17, and remote labels 20 and 21 from LSR 2.2.2.2.. The 'show mpls ldp bindings vrf' command displays MPLS label bindings for a specific VRF. The output shows two prefixes (10.4.4.0/24 and 10.5.5.0/24) with local labels (16 and 17) and remote labels (20 and 21) from LSR 2.2.2.2. This indicates that LDP has successfully exchanged labels for these prefixes within the VRF.

Answer

MPLS LDP has not established a session with the remote LSR 2.2.2.2.

Answer

The labels are not being used because the VRF is not configured correctly.

Answer

The remote LSR is using the same labels as the local router.

Question 8

What is the default administrative distance for routes redistributed into BGP from an IGP?

Accepted Answer

200. When routes are redistributed into BGP from an IGP, they become local BGP routes, not eBGP. The default administrative distance for local BGP routes is 200, as configured by the `distance bgp` command: `distance bgp 20 200 200` (external, internal, local). Therefore, redistributed routes, which are considered local, have an AD of 200.

Answer

20

Answer

110

Answer

170

Question 9

An EIGRP network with multiple routers is experiencing frequent stuck-in-active (SIA) events for prefix 10.10.10.0/24. The network topology includes a slow WAN link between R1 and R2. R1's show ip eigrp topology 10.10.10.0/24 shows the route in active state with a query outstanding to R2. R2's show ip eigrp topology shows the same prefix in passive state. The EIGRP timers are default. What is the root cause?

Accepted Answer

R2 has a query outstanding to a neighbor over a slow link, preventing it from replying to R1 within the active timer.. R2 has the prefix in passive state, meaning it has not yet received a reply from one of its own neighbors over a slow link. Since R2 cannot reply to R1 until it gets that reply, R1's active timer expires, causing a stuck-in-active (SIA) event. This is a classic scenario where the query propagation delay exceeds the default active timer (3 minutes) due to a slow WAN link downstream from R2.

Answer

The active timer on R1 is too short for the slow WAN link; it should be increased to accommodate query propagation delays.

Answer

The EIGRP hello timer mismatch between R1 and R2 is causing neighbor flapping.

Answer

The prefix 10.10.10.0/24 is being summarized, causing the query to be sent for the summary instead.

Question 10

An engineer is troubleshooting a router that is not sending syslog messages to the syslog server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap informational'. The engineer can ping the syslog server from the router. 'show logging' shows that the logging buffer is filling with messages. What is the most likely cause?

Accepted Answer

The 'logging source-interface' command is missing, causing syslog messages to use an incorrect source IP.. The router can ping the syslog server and the logging buffer is filling, which confirms network reachability and that the router is generating syslog messages. However, without the 'logging source-interface' command, syslog packets use the IP address of the egress interface, which may not be reachable from the server (e.g., due to ACLs or routing asymmetry). This causes the server to drop the packets, even though the router can reach the server. The 'logging host' and 'logging trap informational' commands are correctly configured, so the issue lies in the source IP selection.

Answer

The syslog server is not listening on UDP port 514.

Answer

The 'logging on' command is not configured.

Answer

The syslog server's IP address is incorrect in the configuration.

Question 11

A network engineer is troubleshooting an issue where IPv6 traffic is being forwarded incorrectly on a switch. The switch is configured with IPv6 Source Guard on access ports. A legitimate host on port Fa0/1 with IPv6 address 2001:db8:1::10 is unable to send traffic to the default gateway. The engineer checks the IPv6 binding table and sees that the host's entry is missing. What is the most likely cause?

Accepted Answer

The host is using a static IPv6 address, and ND snooping is not enabled on the VLAN, so the binding was never learned.. IPv6 Source Guard relies on the IPv6 binding table, which is populated by IPv6 Neighbor Discovery (ND) snooping. If the host uses a static IPv6 address and ND snooping is not enabled on the VLAN, the switch never learns the binding, so IPv6 Source Guard drops the traffic as unauthorized. Enabling ND snooping allows the switch to inspect Neighbor Solicitation and Advertisement messages to build the binding table dynamically.

Answer

The host's MAC address is not in the MAC address table for VLAN 1.

Answer

The switch is running IPv6 First Hop Security in monitor mode, which logs violations but does not drop traffic.

Answer

The default gateway router is not sending Router Advertisements, so the host cannot form a default route.

Question 12

In a VRF-Lite setup using RIP, what is the default update timer value?

Accepted Answer

30 seconds. In a VRF-Lite setup using RIP, the default update timer value is 30 seconds. This is the standard RIP update interval defined in RFC 1058 and 2453, and it remains unchanged when RIP is used within a VRF. VRF-Lite does not alter the fundamental protocol timers of RIP; it only provides logical separation of routing tables. Therefore, the correct answer is 30 seconds.

Answer

60 seconds

Answer

90 seconds

Answer

180 seconds

Question 13

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

Accepted Answer

The flow record does not include any VLAN match fields.. Flexible NetFlow only exports fields that are explicitly included in the flow record; if the record lacks VLAN match fields such as dot1q VLAN ID or S-VLAN/C-VLAN, the collector will not receive per-VLAN data and all flows appear to share the same (or no) VLAN ID. The fix is to add the appropriate VLAN fields to the flow record's match statement. The physical interface application is not the root cause because subinterface traffic still traverses the physical interface.

Answer

The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.

Answer

The flow monitor is applied only to the physical interface, not the subinterfaces.

Answer

The collector does not support VLAN fields.

Question 14

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Accepted Answer

Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.. The most likely issue is that the RSPAN VLAN is not properly configured with the 'remote-span' command on both switches. Without this command, the VLAN is treated as a normal VLAN, and the destination port will not forward the mirrored traffic. The 'remote-span' command designates the VLAN as an RSPAN VLAN, enabling it to carry mirrored traffic across trunk links.

Answer

Check that the destination port is not in a shutdown state.

Answer

Ensure that the source interface is not configured with 'no monitor session'.

Answer

Confirm that the trunk between switches is configured as a dot1q trunk.

Question 15

Which statement about CoPP and IPv6 control plane traffic is correct?

Accepted Answer

CoPP can police IPv6 traffic using the same policy-map as IPv4. C is correct because Control Plane Policing (CoPP) uses MQC (Modular QoS CLI) policy-maps that can match both IPv4 and IPv6 traffic via class-maps referencing ACLs or protocol headers. The same policy-map can contain separate class entries for IPv4 and IPv6 traffic, allowing unified policing of control plane packets regardless of IP version. This is explicitly supported in Cisco IOS/IOS-XE, and CoPP is not limited to IPv4.

Answer

CoPP does not support IPv6 traffic

Answer

IPv6 traffic is automatically classified as critical

Answer

IPv6 control plane traffic is not subject to CoPP