300-410 Practice Test 19 — 15 Questions

Question 1

An engineer configures NAT on a router with 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. The inside hosts are 10.0.0.0/24, and the outside interface is 203.0.113.1. Traffic works for most hosts, but one host at 10.0.0.50 cannot access the internet. 'Show ip nat translations' shows no entry for this host. 'Show access-lists' shows ACL 1 permits 10.0.0.0 0.0.0.255. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The host has a misconfigured subnet mask or default gateway.. The host at 10.0.0.50 is within the ACL 1 permitted range, yet no NAT translation appears, indicating the traffic never reaches the NAT process. A misconfigured subnet mask or default gateway on the host would cause its packets to be sent to the wrong next-hop or be dropped locally, preventing the router from seeing the traffic and creating a translation. Since 'show ip nat translations' shows no entry, the issue is upstream of NAT, pointing to a host-side configuration problem.

Answer

The host's IP address is statically assigned and conflicts with another device.

Answer

The NAT pool is exhausted.

Answer

The router's inside interface is administratively down.

Question 2

What is the default SNMPv3 security level for a user configured with the "snmp-server user username groupname v3 auth sha password" command?

Accepted Answer

authNoPriv. When you configure an SNMPv3 user with the `snmp-server user username groupname v3 auth sha password` command without explicitly specifying a privacy (encryption) password or the `priv` keyword, the default security level is `authNoPriv`. This means authentication is enabled using SHA, but no encryption is applied to the SNMP packets. The security level is implicitly set to `authNoPriv` because the command includes an authentication password but omits the privacy password.

Answer

noAuthNoPriv

Answer

authPriv

Answer

The command is invalid without specifying a security level.

Question 3

Which statement correctly describes the default behavior of the 'flow monitor' in Flexible NetFlow regarding the collection of BGP next-hop information?

Accepted Answer

BGP next-hop is collected only if the flow record includes the 'match routing bgp next-hop' command.. By default, Flexible NetFlow does not collect BGP next-hop information unless explicitly configured in the flow record.

Answer

BGP next-hop is always collected by default in Flexible NetFlow monitors.

Answer

BGP next-hop is never collected in Flexible NetFlow, only in traditional NetFlow.

Answer

BGP next-hop is collected by default only for IPv4 flows.

Question 4

An engineer is troubleshooting a router that is configured as an NTP client. The router's clock is not synchronizing with the NTP server at 192.168.1.1. 'show ntp status' shows 'clock is unsynchronized', and 'show ntp associations' shows the server as '.INIT.' with no reachability. The engineer can ping the NTP server. What is the most likely cause?

Accepted Answer

The NTP server is not configured to respond to NTP requests from this client.. The '.INIT.' state in 'show ntp associations' indicates that the client has sent NTP packets to the server but has not received any valid NTP responses. Since the engineer can ping the server, Layer 3 connectivity is fine, ruling out network issues. The most likely cause is that the NTP server is not configured to respond to requests from this client, either due to an access control list (ACL) on the server, a 'restrict' statement denying the client, or the server not being configured as an NTP server at all.

Answer

The router's 'ntp source' command is missing, causing NTP packets to use an incorrect source IP.

Answer

The router's clock is set too far in the future, causing NTP to reject the server's time.

Answer

The router has 'ntp authenticate' enabled without the proper key.

Question 5

What is the default export interval for NetFlow data when using the 'flow exporter' with UDP as the transport protocol?

Accepted Answer

Exports are triggered by flow aging or cache fullness, not a fixed interval.. The default export interval is based on flow cache timeout; there is no fixed interval—exports occur when flows age out or cache is full.

Answer

Every 60 seconds

Answer

Every 30 seconds

Answer

Every 10 seconds

Question 6

Which of the following is true regarding the use of prefix-lists versus access-lists for route filtering?

Accepted Answer

Prefix-lists can match on both network address and prefix length, while access-lists match only on network address.. Prefix-lists are designed specifically for route filtering and can match both the network address and the prefix length (subnet mask) using the 'ge' (greater than or equal) and 'le' (less than or equal) keywords. Access-lists, when used for route filtering, can only match the network address portion of a route and cannot filter based on prefix length. This makes prefix-lists more precise and flexible for controlling routing updates.

Answer

Access-lists can match on prefix length using the 'ge' and 'le' keywords.

Answer

Access-lists are more efficient than prefix-lists for route filtering.

Answer

Prefix-lists can only be used with BGP, while access-lists can be used with any protocol.

Question 7

A network engineer runs the following command on Router R6:

R6# show ip route 10.0.0.0
Routing entry for 10.0.0.0/8
  Known via "eigrp 100", distance 90, metric 28160
  Redistributing via eigrp 100
  Last update from 192.168.1.1 on GigabitEthernet0/0, 00:00:10 ago
  Routing Descriptor Blocks:
  * 192.168.1.1, from 192.168.1.1, 00:00:10 ago, via GigabitEthernet0/0
      Route metric is 28160, traffic share count is 1

Additionally, an OSPF route for the same prefix is learned with distance 110. Which route will be installed in the routing table?

Accepted Answer

The EIGRP route will be installed because it has a lower administrative distance.. EIGRP internal routes have a default administrative distance of 90, which is lower than OSPF's default distance of 110. Therefore, the EIGRP route will be preferred and installed in the routing table.

Answer

The OSPF route will be installed because it has a lower metric.

Answer

Both routes will be installed for load balancing.

Answer

Neither route will be installed due to a conflict.

Question 8

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check client interface for DHCP state and IP. Begin by checking the DHCP client's interface for an IP address and DHCP state. Then, verify that the relay agent is configured and reachable. Next, confirm that the DHCP server is reachable from the relay. After that, inspect access lists or firewall rules that might block DHCP traffic. Finally, review debug output to isolate the failure point.

Question 9

A network engineer is configuring OSPFv3 on a Cisco router. The router has two interfaces in Area 0: GigabitEthernet0/0 (IPv6 address 2001:db8:1::1/64) and GigabitEthernet0/1 (IPv6 address 2001:db8:2::1/64). After enabling IPv6 unicast routing and configuring OSPFv3 with the router-id 1.1.1.1, the engineer notices that no OSPFv3 neighbors are forming. Which action is most likely to resolve the issue?

Accepted Answer

Enable OSPFv3 on the interfaces using the ipv6 ospf 1 area 0 command.. OSPFv3 requires enabling the protocol on each interface using the ipv6 ospf process-id area area-id command. Without this, the interface does not participate in OSPFv3, and no hellos are sent or received. The router ID and network type are secondary. Assigning IPv6 addresses from the same subnet is irrelevant because OSPFv3 uses link-local addresses for neighbor discovery.

Answer

Assign IPv6 addresses from the same subnet to both interfaces.

Answer

Set the OSPFv3 network type to point-to-point on both interfaces.

Answer

Configure a 64-bit router ID using the router-id command under the OSPFv3 process.

Question 10

A network engineer is configuring a route map for BGP policy. The engineer wants to match routes that originate from AS 65001 and have a community value of 100:200. The route map should then set the local preference to 200. Which configuration snippet accomplishes this?

Accepted Answer

ip as-path access-list 1 permit ^65001$
ip community-list standard 1 permit 100:200
route-map POLICY permit 10
 match as-path 1
 match community 1
 set local-preference 200. To match routes from AS 65001 with community 100:200 and set local preference, the configuration must include both an AS-path access list and a community list, and apply both matches in the route map. The correct snippet defines the AS-path access list with the regex ^65001$ to match routes originated in AS 65001, defines a standard community list to match 100:200, and then uses both in the route map with the set clause.

Answer

ip as-path access-list 1 permit ^65001$
route-map POLICY permit 10
 match as-path 1
 set local-preference 200

Answer

route-map POLICY permit 10
 match as-path 1
 match community 1
 set local-preference 200

Answer

ip community-list standard 1 permit 100:200
route-map POLICY permit 10
 match community 1
 set local-preference 200

Question 11

Drag and drop the steps to configure a DHCP pool and relay agent on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure DHCP pool with network and mask. First, you must define the DHCP pool with a name and network. Then, you set the default router and DNS server. Next, you exclude any addresses from the pool. Finally, you enable the DHCP relay agent on the interface facing clients to forward requests to the DHCP server.

Question 12

A network engineer is implementing policy-based routing (PBR) on a Cisco IOS router. The engineer wants to route traffic from the 10.1.1.0/24 subnet to a next-hop of 192.168.1.1, while all other traffic uses the default routing table. Which configuration correctly implements this?

Accepted Answer

route-map PBR permit 10
 match ip address 10
 set ip next-hop 192.168.1.1
!
interface GigabitEthernet0/0
 ip policy route-map PBR
!
access-list 10 permit 10.1.1.0 0.0.0.255. Policy-based routing (PBR) allows you to override the normal routing table based on criteria such as source IP address. The correct configuration uses a route map with a match statement for the source subnet and a set statement to define the next-hop. The route map is then applied to the interface with the ip policy route-map command. The set ip next-hop command ensures that matched traffic is forwarded to the specified next-hop, while other traffic uses the default routing table.

Answer

route-map PBR permit 10
 match ip address 10
 set ip default next-hop 192.168.1.1
!
interface GigabitEthernet0/0
 ip policy route-map PBR
!
access-list 10 permit 10.1.1.0 0.0.0.255

Answer

route-map PBR permit 10
 match ip address 10
 set ip next-hop 192.168.1.1
!
interface GigabitEthernet0/0
 ip route-cache policy
!
access-list 10 permit 10.1.1.0 0.0.0.255

Answer

route-map PBR permit 10
 match ip address 10
 set interface GigabitEthernet0/1
!
interface GigabitEthernet0/0
 ip policy route-map PBR
!
access-list 10 permit 10.1.1.0 0.0.0.255

Question 13

A network administrator is troubleshooting an EIGRP named mode configuration on a Cisco IOS XE router. The router is not forming an adjacency with a neighbor. The administrator verifies that the AS number is 100, the K-values are default, and authentication is not configured. Which command should be used to verify the EIGRP hello and hold timers on the interface?

Accepted Answer

show ip eigrp interfaces detail. To verify EIGRP hello and hold timers on an interface, the show ip eigrp interfaces detail command is used. It provides per-interface EIGRP parameters, including hello interval and hold time. Other commands like show ip eigrp neighbors detail focus on neighbor state, while show ip protocols gives a global view. The topology table shows routes, not timers. Therefore, the interfaces detail command is the correct choice for troubleshooting timer mismatches.

Answer

show ip eigrp neighbors detail

Answer

show ip protocols

Answer

show ip eigrp topology

Question 14

A network engineer is troubleshooting a manual IPv6-in-IPv4 tunnel between two Cisco routers. The tunnel is up, and both routers can ping each other's tunnel IPv6 addresses. However, traffic from a host behind Router A to a host behind Router B fails. The engineer notices that Router A has a route to the remote IPv6 prefix via the tunnel, but Router B does not have a route to the local IPv6 prefix. What is the most likely cause?

Accepted Answer

Router B is missing a static route pointing the local IPv6 prefix to the tunnel interface.. The tunnel is up and both routers can ping each other's tunnel IPv6 addresses, confirming that the tunnel itself is operational. However, traffic from a host behind Router A to a host behind Router B fails because Router B lacks a route back to the local IPv6 prefix (the network behind Router A). For bidirectional communication, both routers must have a route to the remote IPv6 prefix pointing to the tunnel interface. Since Router B is missing this static route, it cannot forward return traffic into the tunnel, causing the failure.

Answer

The tunnel mode is set to 'ipv6ip 6to4' instead of 'ipv6ip'.

Answer

The tunnel source on Router B is misconfigured with the wrong IPv4 address.

Answer

The IPv6 access-list on Router B is blocking incoming traffic from the local prefix.

Question 15

A network engineer is configuring Policy-Based Routing (PBR) on a Cisco router. The goal is to forward all HTTP traffic (TCP port 80) from the 10.1.1.0/24 subnet to next-hop 192.168.2.1. Which configuration sequence is correct?

Accepted Answer

Create an extended ACL that permits TCP port 80 from 10.1.1.0/24 to any, reference it in a route-map with a match ip address statement, set the next-hop to 192.168.2.1, and apply the route-map to the incoming interface with the ip policy route-map command.. PBR requires an ACL to classify traffic based on source, destination, and port. An extended ACL can match TCP port 80. The route-map then matches the ACL and sets the next-hop. Finally, the route-map is applied to the incoming interface with the ip policy route-map command. The other options either match all traffic, use a standard ACL that cannot match ports, or attempt to match ports directly in a route-map, which is not supported.

Answer

Create a route-map with a match statement for TCP port 80 and a set statement for next-hop 192.168.2.1, then apply it globally with the ip policy route-map command.

Answer

Create a standard ACL that permits 10.1.1.0/24, reference it in a route-map with a match ip address statement, set the next-hop to 192.168.2.1, and apply the route-map to the outgoing interface with the ip policy route-map command.

Answer

Create a route-map with a match statement for IP address 10.1.1.0/24 and a set statement for next-hop 192.168.2.1, then apply it to the incoming interface with the ip policy route-map command.