300-410 Practice Test 2 — 10 Questions

Question 1

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.. In a DMVPN network, spokes must use the 'ip nhrp nhs' command to register their real (physical) IP addresses with the hub (NHS). Without this command, the hub never learns the spokes' addresses, so it cannot provide NHRP resolution replies to other spokes attempting to form spoke-to-spoke tunnels. The absence of dynamic sessions on R2 and no NHRP entries for R2 on R3 directly indicate that R2 never registered with the hub.

Answer

The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.

Answer

The NHRP network-id is different on R2 and R3, preventing communication.

Answer

The tunnel source interface is not reachable between spokes.

Question 2

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a customer network. The customer has a default route pointing to the router. After enabling uRPF, the router drops traffic from the customer that has a source IP address that is not in the routing table as a directly connected or static route. What is the most likely explanation?

Accepted Answer

Strict mode uRPF requires a specific route for the source IP; a default route is not sufficient.. Strict mode uRPF verifies that the source IP address of an incoming packet matches a specific route in the routing table, and that the interface used to reach that source IP is the same as the incoming interface. A default route (0.0.0.0/0) is a catch-all entry and does not provide a specific, directly connected or static route for the customer's source IP. Therefore, the router drops the traffic because it cannot find an exact match for the source IP in the routing table, which is a fundamental requirement of strict mode.

Answer

The customer's default route causes asymmetric routing, which breaks strict mode.

Answer

The uRPF mode should be loose mode to allow the default route.

Answer

The router has an ACL that is blocking the traffic before uRPF checks.

Question 3

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

Accepted Answer

The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.. The inbound ACL on the OSPF interface blocks the OSPF-learned route from being installed in the routing table. Since mutual redistribution is configured, the same prefix is also learned via EIGRP. EIGRP has a default administrative distance (AD) of 90 for internal routes, which is lower than OSPF's AD of 110. Therefore, the router selects the EIGRP route as the best path, and the prefix remains in the routing table but now points to the EIGRP next hop.

Answer

The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.

Answer

The router has a static route for the prefix with AD 1.

Answer

The OSPF process has a distribute-list that is filtering the route.

Question 4

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0
Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:2::1, subnet is 2001:DB8:2::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Accepted Answer

uRPF is enabled in loose mode. The output explicitly shows 'IPv6 uRPF: loose mode (allow default route)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled in loose mode. In loose mode, the router checks that the source address of an incoming packet has a matching entry in the routing table, but it does not require the incoming interface to match the best return path. This is distinct from strict mode, which requires both a routing table entry and that the incoming interface is the same as the outgoing interface for the return route.

Answer

uRPF is disabled

Answer

uRPF is enabled in strict mode

Answer

uRPF is enabled but only for IPv4

Question 5

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.. EIGRP for IPv6 uses multicast address FF02::A for all EIGRP packets, including hello, update, query, and reply. The ACL permits only hello and update packets, blocking query and reply packets. EIGRP requires query and reply packets for the Diffusing Update Algorithm (DUAL) to converge and install routes; without them, the router cannot complete the route installation process, even though the neighbor relationship is established.

Answer

The EIGRP router ID is not configured.

Answer

The ACL is applied outbound, blocking the EIGRP updates from being sent.

Answer

The EIGRP for IPv6 is not enabled on the interface.

Question 6

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

Accepted Answer

The hub router does not have a route to the remote spoke's LAN subnet.. In DMVPN phase 3, for spoke-to-spoke shortcuts to be installed, the spoke must receive an NHRP redirect from the hub. If the hub does not send a redirect, the spoke will not create a shortcut. The hub sends a redirect only if it has a route to the destination subnet. If the hub does not have a route to the remote spoke's LAN, it will not send a redirect.

Answer

The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.

Answer

The spoke's routing table has a static route to the remote spoke's LAN via the hub.

Answer

The hub's tunnel interface has 'no ip nhrp redirect' configured.

Question 7

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

Accepted Answer

deny ipv6 any 2001:db8:1::/48. The IPv6 access-list entry 'deny ipv6 any 2001:db8:1::/48' uses the correct syntax: the source is 'any' (all traffic), and the destination is the prefix 2001:db8:1::/48, which matches all addresses within that /48 range. This entry denies traffic from any source to the entire destination prefix, as required by the question.

Answer

deny ipv6 2001:db8:1::/48 any

Answer

deny ipv6 any host 2001:db8:1::1

Answer

deny ipv6 2001:db8:1::/48 2001:db8:1::/48

Question 8

An engineer configures a DMVPN Phase 2 network. Spoke routers are configured with a route map that sets the next-hop to the tunnel interface for routes learned from the hub. This is intended to allow spoke-to-spoke direct communication. However, spoke-to-spoke traffic still goes through the hub. Which is the most likely explanation?

Accepted Answer

The route map is applied on the spoke router inbound from the hub, but it should be applied on the hub router outbound to the spokes.. In DMVPN Phase 2, spoke-to-spoke direct communication requires that the spoke routers have a route with the next-hop set to the tunnel interface of the remote spoke. However, if the route map is applied inbound on the spoke from the hub, it sets the next-hop to the hub's tunnel interface, not the remote spoke. The correct approach is to use a route map on the hub that sets the next-hop to the spoke's tunnel IP when advertising routes, or to use the 'next-hop-self' command incorrectly. The edge case is that the route map is applied on the spoke, not the hub.

Answer

The route map uses a prefix-list that does not match the spoke's subnet.

Answer

The spoke routers have NHRP authentication mismatch, preventing direct communication.

Answer

The tunnel mode is mGRE on the spokes, which does not support spoke-to-spoke.

Question 9

A DMVPN phase 3 network with IPv6 over IPv4 tunnels is experiencing spoke-to-spoke tunnel failures. Hub router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp network-id 1 ip nhrp map multicast dynamic ipv6 nhrp map multicast dynamic. Spoke router R2 shows: R2# show dmvpn detail Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete NHRP domain: 1 Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, Total NBMA Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.0.2.2 2001:DB8:1::2 UP 00:10:00 D. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command under Tunnel0.. In DMVPN Phase 3, spoke-to-spoke tunnels rely on the hub to send NHRP Redirect messages to trigger shortcut creation. The hub's configuration is missing the `ip nhrp redirect` command under Tunnel0, which prevents it from informing the spoke that a better path exists directly to another spoke. Without this redirect, the spoke never initiates an NHRP Resolution Request to build a direct tunnel, causing spoke-to-spoke communication to fail.

Answer

The spoke is missing the ip nhrp shortcut command under Tunnel0.

Answer

The tunnel mode should be gre multipoint on the spokes.

Answer

IPv6 NHRP is not supported on DMVPN phase 3.

Question 10

In a VRF-Lite setup, Router R1 and R2 are running OSPF in VRF-A. R1 has interface Gig0/0 in VRF-A with ip ospf network point-to-point. R2 has interface Gig0/1 in VRF-A with default network type (broadcast). The link between them is a direct Ethernet connection. OSPF neighbors are not forming. What is the root cause?

Accepted Answer

The OSPF network types are mismatched: one side is point-to-point, the other is broadcast, causing neighbor adjacency failure.. OSPF network type mismatch prevents neighbor formation. On a broadcast network, OSPF expects DR/BDR elections, while point-to-point expects no election. The mismatch causes hello packets to be ignored because the OSPF interface parameters (like hello interval, dead interval, and network type) differ. Specifically, on a point-to-point link, the neighbor state machine expects a different packet format and does not process broadcast hellos.

Answer

The VRF names must match for OSPF to form neighbors.

Answer

The OSPF process ID must be the same on both routers.

Answer

The interface must be configured with the same IP subnet mask.