300-410 Practice Test 19 — 15 Questions

Question 1

In BGP, what is the default administrative distance for eBGP routes?

Accepted Answer

20. The default administrative distance for eBGP is 20, while for iBGP it is 200. This means eBGP routes are more trusted than iBGP routes.

Answer

200

Answer

120

Answer

110

Question 2

Consider the following BGP configuration on router R2:

router bgp 65002
 bgp router-id 2.2.2.2
 neighbor 10.2.2.1 remote-as 65001
 neighbor 10.2.2.1 route-map FILTER in
!
route-map FILTER deny 10
 match ip address prefix-list BLOCKED
!
route-map FILTER permit 20
!
ip prefix-list BLOCKED permit 10.0.0.0/8 le 32

Which statement is true about routes received from 10.2.2.1?

Accepted Answer

Routes with prefix 10.0.0.0/8 or more specific are denied; all others are permitted.. The route-map FILTER is applied inbound. Sequence 10 denies any route matching prefix-list BLOCKED (10.0.0.0/8 and more specific). Sequence 20 permits all other routes. Routes with 10.x.x.x are denied.

Answer

All routes are accepted because the deny statement is misconfigured.

Answer

Only routes exactly matching 10.0.0.0/8 are denied; other 10.x.x.x routes are permitted.

Answer

The route-map is applied outbound, so it affects routes sent to 10.2.2.1.

Question 3

Examine the following EEM applet configuration:

!---
event manager applet BACKUP_CONFIG
event timer watchdog time 86400
action 1.0 cli command "enable"
action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg"
!---

What is the effect of this configuration?

Accepted Answer

The applet will copy the running configuration to the TFTP server every 24 hours.. The applet uses a watchdog timer event that triggers every 86400 seconds (24 hours). When triggered, it copies the running configuration to a TFTP server. This is a valid configuration for periodic backup.

Answer

The applet will copy the startup configuration instead of the running configuration.

Answer

The applet will fail because the TFTP server IP address is not reachable.

Answer

The applet will only trigger once because the watchdog timer is a one-shot timer.

Question 4

What is the default BGP administrative distance for routes learned from an external peer (eBGP) in Cisco IOS-XE?

Accepted Answer

20. Cisco IOS-XE assigns eBGP routes an administrative distance of 20 by default.

Answer

200

Answer

110

Answer

120

Question 5

What is the default behavior of BGP synchronization in Cisco IOS-XE?

Accepted Answer

Disabled by default. BGP synchronization is disabled by default in IOS-XE; routes can be advertised without being in the IGP.

Answer

Enabled by default

Answer

Enabled only for iBGP

Answer

Disabled only for eBGP

Question 6

An engineer configures a route reflector cluster with two route reflectors in the same cluster ID. After convergence, some iBGP routes are missing on clients, and 'show ip bgp' shows the path with 'r' flag. What is the most likely explanation?

Accepted Answer

The cluster ID is misconfigured and should be unique per route reflector.. When two route reflectors share the same cluster ID, they treat each other's updates as if from the same cluster. The route reflector loop prevention mechanism drops routes learned from another RR in the same cluster, causing route loss if the clients are not fully meshed.

Answer

The route reflectors have different BGP AS numbers, causing the 'r' flag to indicate a routing loop.

Answer

The clients have 'no bgp default route-reflector-client' configured, preventing them from receiving reflected routes.

Answer

The route reflectors have 'bgp cluster-id' set to 0.0.0.0, which disables cluster-based loop prevention.

Question 7

A network engineer configures EEM to monitor OSPF neighbor state changes. R1 has: event manager applet OSPF-MON event syslog pattern "%OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 syslog msg "OSPF neighbor change detected". After a link flap, the engineer notices that the EEM applet does not execute. Router R2 shows: OSPF neighbor state changes are logged, but no EEM actions occur. What is the root cause?

Accepted Answer

The syslog pattern matches, but the OSPF ADJCHG message is severity 5, which is below the default EEM syslog severity threshold of 4.. The EEM applet uses the syslog pattern trigger, but the OSPF ADJCHG message is logged at severity 5 (notification). By default, EEM syslog triggers only match severity 0-4 (emergency through warning). The engineer must adjust the logging severity or use a different trigger (e.g., event syslog pattern with severity).

Answer

The EEM applet is not registered correctly; it needs to be enabled with 'event manager applet OSPF-MON trigger'

Answer

The 'action 1.0 cli command "enable"' fails because the applet is already in privileged mode.

Answer

The OSPF neighbor change is not generating a syslog message due to logging buffer size.

Question 8

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are established, but traffic between spokes is not using the direct tunnel. What is the most likely explanation?

Accepted Answer

The spoke routers have a default route via the hub, so they send traffic to the hub instead of initiating NHRP resolution for a direct tunnel.. In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the destination network via the tunnel interface with a next hop that triggers NHRP resolution. If the spoke has a default route pointing to the hub, it will not attempt to resolve the spoke-to-spoke tunnel.

Answer

The hub has 'no ip nhrp redirect' configured, which disables spoke-to-spoke tunnel setup.

Answer

The spokes have 'ip nhrp shortcut' enabled, which forces all traffic through the hub.

Answer

The tunnel mode is set to 'tunnel mode gre multipoint' on the spokes, which is incorrect.

Question 9

A network engineer is troubleshooting a route redistribution issue between RIP and OSPF. Router R1 runs both RIP and OSPF, and redistributes RIP routes into OSPF. The engineer notices that RIP routes are not appearing in the OSPF database on neighboring routers. The show ip ospf database external command on a neighbor shows no external routes from R1. The redistribute rip command is configured under OSPF on R1. What is the most likely cause?

Accepted Answer

The redistribute rip command under OSPF is missing the subnets keyword.. When redistributing into OSPF, the subnets keyword is required to redistribute classless subnets. Without it, only classful networks are advertised, which may cause many routes to be missing.

Answer

RIP has a higher administrative distance than OSPF.

Answer

The OSPF process on R1 has a distribute-list blocking these routes.

Answer

The RIP process on R1 is not running.

Question 10

Which statement correctly describes the default value of the 'event timer countdown' when no countdown time is specified?

Accepted Answer

There is no default; a countdown time must be explicitly configured.. The 'event timer countdown' requires an explicit time value; there is no default — the configuration will be rejected if omitted.

Answer

The default countdown time is 60 seconds.

Answer

The default countdown time is 0 seconds, causing immediate trigger.

Answer

The default countdown time is 10 seconds.

Question 11

What is the default timer value for the EEM environment variable 'timer watchdog'?

Accepted Answer

60 seconds. The default watchdog timer is 60 seconds; it monitors the EEM policy execution and resets if exceeded.

Answer

30 seconds

Answer

120 seconds

Answer

180 seconds

Question 12

Which statement correctly describes the default authentication behavior for EEM policy files stored in flash?

Accepted Answer

EEM does not perform any authentication or integrity check on policy files by default.. EEM does not enforce any authentication by default; policy files are executed as-is without integrity checks.

Answer

EEM requires all policy files to be signed with a digital certificate.

Answer

EEM uses MD5 hash verification by default.

Answer

EEM uses the device's AAA configuration to authenticate policy execution.

Question 13

What is the default maximum recursion depth for EEM Tcl policies?

Accepted Answer

100. EEM limits Tcl policy recursion to 100 levels by default to prevent infinite loops.

Answer

10

Answer

50

Answer

Unlimited

Question 14

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

Based on this output, what is the most likely problem?

Accepted Answer

The flow monitor is not applied to any interface.. The cache shows 0 current entries and 0 flows added, indicating no traffic is being captured. This often means the flow monitor is not applied to any interface.

Answer

The cache size is too small at 1000 entries.

Answer

The active timeout is too long at 1800 seconds.

Answer

The cache type is Normal, which requires a sampler.

Question 15

Which EEM action type is used to modify the configuration of the device?

Accepted Answer

action cli. The 'action cli' command allows executing Cisco IOS commands, including configuration changes.

Answer

action syslog

Answer

action snmp-trap

Answer

action mail