300-410 Practice Test 20 — 15 Questions

Question 1

A network engineer is configuring a static route on a Cisco IOS router. The engineer wants the route to be used only if the primary route fails. Which command should be used to configure a floating static route?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 192.168.1.1 200. A floating static route is a static route with an administrative distance higher than the primary route, so it is only installed in the routing table when the primary route is unavailable. The command `ip route 0.0.0.0 0.0.0.0 192.168.1.1 200` sets the administrative distance to 200, making it less preferred than dynamic routes. This is the standard method to configure a floating static route.

Answer

ip route 0.0.0.0 0.0.0.0 192.168.1.1 track 1

Answer

ip route 0.0.0.0 0.0.0.0 192.168.1.1 name BACKUP

Answer

ip route 0.0.0.0 0.0.0.0 192.168.1.1 permanent

Question 2

A network engineer runs the following command on Router R1:

R1# show ip dhcp conflict
IP address       Detection method     Detection time        VRF
192.168.1.20     Ping                 Mar 01 2020 01:00 AM  
192.168.1.21     Gratuitous ARP       Mar 01 2020 01:05 AM

Based on this output, what is the problem?

Accepted Answer

The DHCP server has detected IP address conflicts, meaning another device on the network is using the same IP addresses.. The `show ip dhcp conflict` command displays IP addresses that the DHCP server has detected as already in use on the network. The detection methods (Ping and Gratuitous ARP) confirm that another device is responding to these addresses, indicating a conflict. This output directly shows that the DHCP server is functioning but has identified conflicts, meaning another host is using the same IP addresses.

Answer

The DHCP server is working normally; conflicts are automatically resolved.

Answer

The DHCP server is not responding to client requests.

Answer

The DHCP pool is misconfigured with overlapping subnets.

Question 3

Given the following partial configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

IPsec tunnel is established when traffic from 10.1.1.0/24 to 10.2.2.0/24 triggers it.. The configuration uses a crypto map with 'match address 101' referencing an ACL that permits traffic from 10.1.1.0/24 to 10.2.2.0/24. This triggers IPsec SA negotiation via ISAKMP (IKEv1) only when interesting traffic is detected. The tunnel is established dynamically upon matching traffic, which is the standard behavior for a site-to-site VPN using a crypto map.

Answer

The tunnel will only be established if the peer initiates first.

Answer

The transform set uses AES 256 with MD5 authentication, which is incorrect.

Answer

ISAKMP lifetime is set to 86400 seconds, which is too short for a site-to-site VPN.

Question 4

A network engineer at a branch office is configuring OSPFv3 on a dual-stack router. The router must form an adjacency with a neighboring router that is also running OSPFv3. The engineer notices that the neighbor relationship remains in EXSTART state. Which command should be used to verify the OSPFv3 interface parameters that could cause this issue?

Accepted Answer

show ipv6 ospf interface. The correct answer is the command that displays OSPFv3 interface parameters. EXSTART state issues in OSPFv3 are commonly caused by MTU mismatches or network type mismatches. The 'show ipv6 ospf interface' command provides these details, allowing the engineer to compare and correct the configuration. Other commands show neighbor status, database, or protocol summary but lack interface parameter details.

Answer

show ipv6 protocols

Answer

show ipv6 ospf neighbor

Answer

show ipv6 ospf database

Question 5

A network engineer runs the following command to troubleshoot SNMPv3 group configuration:

R1# show snmp group
group name: admin-group
security model: v3 auth priv
read view: v1default
write view: v1default
notify view: v1default

Group name: monitor-group
security model: v3 auth no priv
read view: v1default
write view: none
notify view: v1default

What does this output indicate?

Accepted Answer

The 'admin-group' requires authentication and encryption, while 'monitor-group' requires only authentication.. The output shows that 'admin-group' uses security model 'v3 auth priv', which requires both authentication and encryption (privacy). 'monitor-group' uses 'v3 auth no priv', which requires authentication but no encryption. This matches option A exactly.

Answer

Both groups require authentication and encryption.

Answer

The 'monitor-group' has read-write access.

Answer

The groups use SNMPv2c security model.

Question 6

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1:
  Description: Exports to collector
  Export protocol: NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.1.100
    Source IP address: 10.0.0.1
    Transport Protocol: UDP
    Destination Port: 2055
    Source Port: 0
  Collector Configuration:
    VRFs:
      Default
  Options Configuration:
    Sampler: Not configured
  Export Statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped: 0

Based on this output, what is the most likely reason that no flows are being exported?

Accepted Answer

The flow exporter is not referenced in any flow monitor applied to an interface.. The output shows that the flow exporter has no flows exported, and the export statistics are all zero. This indicates that the exporter is not actively exporting data, likely because it is not referenced in a flow monitor that is applied to an interface. Without a flow monitor, the exporter is not triggered to export any flows.

Answer

The destination port is incorrect; NetFlow version 9 requires port 9996.

Answer

The source IP address is not reachable from the destination.

Answer

The sampler is not configured, causing all packets to be dropped.

Question 7

Drag and drop the steps to troubleshoot Route Maps and Route Filtering adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify BGP neighbor state with show ip bgp summary. Start by verifying BGP neighbor state with show ip bgp summary. Next, examine the route-map configuration for syntax errors using show route-map. Then, check if the route-map is applied correctly to the neighbor with show running-config. After that, use debug ip bgp updates to see if prefixes are being filtered. Finally, adjust the route-map sequence or match criteria to resolve the issue.

Question 8

A network engineer is configuring EIGRP on a Cisco router. The router has two paths to the same destination network with different metrics. The engineer wants to enable unequal-cost load balancing. Which command must be configured to allow EIGRP to use the higher-cost path?

Accepted Answer

variance 2. The 'variance' command is required to enable unequal-cost load balancing in EIGRP. It sets a multiplier that determines which feasible successor routes, with metrics higher than the successor, can be used. The higher-cost path must also be a feasible successor (satisfy the feasibility condition) to be considered. Once variance is set, EIGRP can install multiple paths with different metrics.

Answer

traffic-share balanced

Answer

metric weights 0 1 1 1 1 1

Answer

maximum-paths 2

Question 9

Drag and drop the steps to troubleshoot SPAN, RSPAN, and ERSPAN adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check SPAN/RSPAN/ERSPAN session status. Begin by checking the SPAN/RSPAN/ERSPAN session status with show commands. Then, verify that the source and destination VLANs or interfaces are up. Next, confirm that any intermediate switches support the required encapsulation. After that, test IP connectivity for ERSPAN destinations using ping. Finally, review ACLs or filters that might block mirrored traffic.

Question 10

A network engineer is configuring a Cisco router to authenticate OSPF neighbors using MD5. The router is connected to two OSPF neighbors on the same subnet. The engineer wants to enable MD5 authentication on the interface with a key ID of 1 and a password of 'Cisco123'. Which command sequence correctly accomplishes this?

Accepted Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123. To enable OSPF MD5 authentication on a specific interface, you must enter interface configuration mode and issue both 'ip ospf authentication message-digest' to turn on MD5 authentication and 'ip ospf message-digest-key 1 md5 Cisco123' to define the key. This method allows per-interface authentication, which is suitable when only certain interfaces require MD5. The other options either misplace the key command, use plaintext authentication, or configure area-wide authentication incorrectly.

Answer

router ospf 1
 area 0 authentication
 ip ospf message-digest-key 1 md5 Cisco123

Answer

router ospf 1
 area 0 authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123

Answer

interface GigabitEthernet0/0
 ip ospf authentication-key Cisco123
 ip ospf authentication message-digest

Question 11

Drag and drop the steps to configure and verify Policy-Based Routing (PBR) into the correct order, from first to last.

Accepted Answer

Create route map with sequence number. First, define the route map with a sequence number. Next, match the interesting traffic using an ACL or prefix list. Then, set the next-hop or interface. Apply the route map under the interface in the inbound direction. Finally, verify with 'show route-map' or 'show ip policy'.

Question 12

DMVPN network with hub R1 and spoke R2. R1 has:
interface Tunnel0
 ip address 172.16.1.1 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp authentication cisco123
R2 has:
interface Tunnel0
 ip address 172.16.1.2 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp nhs 172.16.1.1
 ip nhrp authentication cisco123
R2 shows:
R2# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
NHRP domain: 1
Interface: Tunnel0, IPv4 NHRP Details
Type:Spoke, NHC:172.16.1.2, NBMA:10.2.2.2
  (no NHRP mappings)
R2# ping 172.16.1.1 source 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
What is the root cause?

Accepted Answer

The hub R1 is missing the 'ip nhrp map multicast dynamic' command.. The NHRP authentication strings do not match: R1 has 'cisco123', R2 has 'cisco123'? They match. But the output shows no NHRP mappings. The issue is that the spoke R2 has not registered with the hub. This could be due to a mismatch in NHRP network ID, but they match. Another possibility is that the hub's tunnel interface is not configured with 'ip nhrp map multicast dynamic' to accept registrations. Without that, the hub does not add the spoke to its NHRP database, and the spoke cannot resolve the hub's NBMA address. The ping fails because the spoke has no NHRP mapping for the hub.

Answer

The authentication string is mismatched between hub and spoke.

Answer

The tunnel mode on R2 should be 'tunnel mode gre ip' instead of multipoint.

Answer

The NHRP network ID must be different on hub and spoke.

Question 13

A network engineer runs the following command to debug IPv6 uRPF with detailed information:

R1# debug ipv6 verify detail
IPv6 verify debugging is on (detail)

*Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0
*Mar 1 00:03:45.678:   route to source via GigabitEthernet0/1, not same as input interface

What does this output indicate?

Accepted Answer

The packet will be dropped because strict uRPF requires the return path to be through the same interface.. The debug output shows that the source address 2001:DB8:5::1 is reachable via GigabitEthernet0/1, but the packet arrived on GigabitEthernet0/0. With strict unicast Reverse Path Forwarding (uRPF), the router verifies that the best return route to the source uses the same interface on which the packet was received. Since the interfaces do not match, the router drops the packet to prevent spoofing.

Answer

The packet will be forwarded because a route exists.

Answer

The packet will be forwarded because uRPF is loose.

Answer

The router will change the route to use GigabitEthernet0/0.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip route summary

IP routing table maximum-paths: 32
IP routing table has 15 routes, using 900 bytes of memory
  Number of prefixes:
       /8: 1, /16: 2, /20: 3, /24: 9
  Route types:
    Connected: 4, Static: 1, OSPF: 10
  Route sources:
    OSPF: 10, Connected: 4, Static: 1

Based on this output, what is a potential issue regarding route summarization?

Accepted Answer

There are too many /24 prefixes, suggesting poor summarization.. The routing table has many /24 prefixes (9), indicating that route summarization is not being used effectively, leading to a larger routing table.

Answer

The routing table is too small.

Answer

There are too many OSPF routes.

Answer

The routing table is empty.

Question 15

Which statement correctly describes the default behavior of the Embedded Event Manager (EEM) when an event occurs and no action is explicitly defined?

Accepted Answer

EEM will take no action and the event is silently ignored.. EEM applets consist of an event detector and one or more actions. If an event is registered but no action is defined, EEM simply logs the event internally and takes no further action — the event is silently ignored from an operational standpoint. There is no implicit default action such as reload, syslog, or SNMP trap unless explicitly configured.

Answer

EEM will generate a syslog message by default.

Answer

EEM will execute the default action of reloading the device.

Answer

EEM will send an SNMP trap by default.