300-410 Practice Exam 1 — 20 Questions

Question 1

Drag and drop the steps to establish a DMVPN Phase 2 spoke-to-spoke tunnel into the correct order, from first to last.

Accepted Answer

Configure NHRP and mGRE on hub and spokes. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. First, the spoke must have a valid NHRP registration to the hub. When traffic from one spoke to another triggers an NHRP resolution request, the hub forwards it to the target spoke, which replies. The spoke then initiates a direct mGRE tunnel, and finally, the spoke-to-spoke IPsec session is established.

Question 2

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.3.3.0/24      10.1.1.2                 0    100      0 i

Total number of prefixes 1

What does this output indicate?

Accepted Answer

BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.. The output shows a single BGP prefix (10.3.3.0/24) received from neighbor 10.1.1.2, with the route marked as valid (*) and best (>). This confirms that BGP is successfully receiving and processing the update, and the route is eligible for installation in the routing table. Since the route appears in the received-routes output, CoPP is not dropping the inbound BGP update packets, as CoPP would prevent the packets from reaching the BGP process entirely.

Answer

BGP is not receiving any routes due to CoPP dropping updates.

Answer

BGP is receiving routes but not installing them in the routing table due to CoPP.

Answer

BGP session is flapping due to CoPP.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)
                       Xmit Queue   Mean   Pacing Time   Multicast    Pending
Interface        Peers  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0              1       0/0       12       0/10         50           0
Gi0/1              1       0/0       15       0/10         50           0
Gi0/2              1       0/0       18       0/10         50           0
Gi0/3              1       0/0       20       0/10         50           0
Gi0/4              0       0/0        0       0/10         50           0

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/4 has no EIGRP neighbor, which may indicate a configuration issue or lack of connectivity.. The output shows that interface Gi0/4 has 0 peers, while all other interfaces have 1 peer. In EIGRP, a peer count of 0 indicates that no neighbor adjacency has been formed on that interface. This could be due to a configuration mismatch (e.g., different AS numbers, passive interface, or authentication) or a Layer 1/2 connectivity issue. Therefore, option A is correct.

Answer

All interfaces have at least one EIGRP neighbor.

Answer

The mean SRTT on Gi0/2 is 18 ms, which is too high and indicates a problem.

Answer

The pending routes count of 0 on all interfaces indicates a routing loop.

Question 4

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Accepted Answer

The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.. When the RSPAN VLAN is also configured as the native VLAN on a trunk, mirrored frames are sent untagged on that trunk. Intermediate switches may treat untagged frames as belonging to the native VLAN rather than the RSPAN VLAN, causing them to be forwarded incorrectly or dropped, resulting in intermittent traffic at the destination.

Answer

VTP transparent mode prevents RSPAN from working correctly.

Answer

The source VLAN 50 is not allowed on the trunk ports.

Answer

The monitor session 2 is missing the 'no shutdown' command.

Question 5

Which of the following is a mandatory condition for a route to be considered a feasible successor in EIGRP?

Accepted Answer

The reported distance must be less than the feasible distance.. In EIGRP, a feasible successor is a backup route that can be used immediately if the successor fails. The mandatory condition for a route to be considered a feasible successor is that its reported distance (RD) must be less than the feasible distance (FD) of the current successor. This ensures the backup route is loop-free, as per the Diffusing Update Algorithm (DUAL).

Answer

The metric must be equal to the successor's metric.

Answer

The next-hop router must be directly connected.

Answer

The route must be learned from the same AS.

Question 6

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 7

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows 'BFD enabled, BFD state: UP', indicating that BFD is operational for this LDP session, which allows faster failure detection than LDP hello timers alone.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 8

A network administrator is configuring a Cisco IOS router to authenticate administrative logins using TACACS+ with a fallback to local authentication. The TACACS+ server is reachable, but the administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used. The router currently has the following configuration:

aaa new-model
aaa authentication login default group tacacs+ local

tacacs server TAC1
 address ipv4 10.1.1.1
 key cisco

What additional configuration is required to ensure that the router falls back to local authentication when the TACACS+ server does not respond?

Accepted Answer

No additional configuration is required; the existing configuration already provides fallback to local authentication.. The AAA authentication method list specifies the order of authentication methods. When 'group tacacs+' is followed by 'local', the router tries TACACS+ first. If the TACACS+ server does not respond (e.g., timeout), the router proceeds to the next method, local authentication. Thus, the existing configuration already ensures fallback. The other options either do not enable fallback or are redundant.

Answer

Configure aaa authentication login default group tacacs+ local

Answer

Configure tacacs server TAC1 with the timeout 5 command

Answer

Configure aaa authentication login default group tacacs+ local-case

Question 9

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Option A is correct because static NAT is created with the global configuration command ip nat inside source static

, which permanently maps one inside local address to one inside global address. Option B is correct because the router must know which interface is the internal side, and that is done by entering the interface configuration and issuing the ip nat inside command on the interface facing the internal network. Option C is wrong because ip nat outside must be applied to the external-facing interface, not the internal one. Option D is wrong because an access list is used for dynamic NAT or PAT with the pool/overload syntax, not for a static one-to-one mapping. Option E is wrong because there is no global ip nat service command required to activate NAT on Cisco IOS; NAT is enabled by the inside/outside interface designations and the translation statements themselves.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 10

What is the default administrative distance for OSPF routes on a Cisco IOS-XE router?

Accepted Answer

110. The default administrative distance for OSPF is 110.

Answer

90

Answer

100

Answer

120

Question 11

Examine the following partial configuration:

username admin privilege 15 secret 5 $1$abcdefg$hashedvalue
username operator privilege 1 password cisco
!
line console 0
 login local
!
line vty 0 4
 login local
 transport input ssh

What is a potential security issue with this configuration?

Accepted Answer

The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.. The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Answer

The 'admin' user has privilege 15, which is too high for administrative access.

Answer

The console line is missing the 'transport input' command.

Answer

The VTY lines should use 'login' without 'local' to allow remote authentication.

Question 12

A network engineer runs the following command to verify IPv6 traffic filtering with logging:

R1# show logging | include FILTER
*Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet

What does this output indicate?

Accepted Answer

A TCP packet from 2001:DB8:2::1 to destination 2001:DB8:3::1 port 80 was denied by the access list.. The log message shows an IPv6 ACL (named FILTER) logging a denied TCP packet from source 2001:DB8:2::1 port 12345 to destination 2001:DB8:3::1 port 80. The keyword 'denied' in the log entry confirms the packet was blocked by the access list, making option A correct.

Answer

A TCP packet was permitted by the access list.

Answer

The access list is not applied to any interface.

Answer

The packet was dropped due to uRPF.

Question 13

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 14

Which DHCP message type is used by a client to renew its lease before it expires?

Accepted Answer

DHCPREQUEST. When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Answer

DHCPDISCOVER

Answer

DHCPACK

Answer

DHCPRELEASE

Question 15

A network engineer runs the following command to verify DHCPv4 server statistics on router R1:

R1# show ip dhcp server statistics

Output:
 Memory usage: 12345
 Address pools: 2
 Database agents: 0
 Automatic bindings: 150
 Manual bindings: 5
 Expired bindings: 10
 Malformed messages: 0

Message    Received
 BOOTREQUEST    0
 DHCPDISCOVER   200
 DHCPREQUEST    180
 DHCPDECLINE    2
 DHCPRELEASE    5
 DHCPINFORM     10

What does this output indicate?

Accepted Answer

The DHCP server has 150 active automatic bindings and 5 manual bindings.. The 'Automatic bindings: 150' and 'Manual bindings: 5' fields directly indicate the number of active leases assigned dynamically (via DHCP) and statically (via manual configuration), respectively. These represent the current active bindings on the DHCP server, with no other interpretation needed.

Answer

The DHCP server has received 200 DHCPREQUEST messages.

Answer

The DHCP server has 10 malformed messages, indicating a configuration issue.

Answer

The DHCP server has 2 database agents configured.

Question 16

A network engineer runs the following command to troubleshoot DHCPv6 address assignment on router R1:

R1# show ipv6 dhcp binding

Output:
 Client: FE80::21A:2BFF:FE3C:4D01
   DUID: 0003000121A2B3C4D5E6
   Username: unassigned
   VRF: default
   IA NA: IA ID 0x00040001, T1 302400, T2 483840
       Address: 2001:DB8:1::100
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)
   IA PD: IA ID 0x00040002, T1 302400, T2 483840
       Prefix: 2001:DB8:1::/48
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)

What does this output indicate?

Accepted Answer

The DHCPv6 server has assigned both an IPv6 address and a prefix delegation to the client.. The output shows both an IA_NA (Identity Association for Non-temporary Address) with an IPv6 address (2001:DB8:1::100) and an IA_PD (Identity Association for Prefix Delegation) with a prefix (2001:DB8:1::/48). This confirms that the DHCPv6 server has assigned both a global unicast address and a delegated prefix to the client, making option B correct.

Answer

The DHCPv6 server has assigned only an IPv6 address to the client.

Answer

The DHCPv6 client is using stateless autoconfiguration (SLAAC) because no address is shown.

Answer

The DHCPv6 server has a pool with only one prefix available.

Question 17

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1:

R1# debug ipv6 dhcp relay

Output:
 IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0
 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCPv6 relay agent is successfully forwarding messages between the client and server.. The debug output shows a complete DHCPv6 four-message exchange (SOLICIT-ADVERTISE-REQUEST-REPLY) being relayed between the client (FE80::1) and the server (2001:DB8:2::1). Each message is received on one interface and forwarded out the other, confirming the relay agent is functioning correctly. Therefore, option B is correct.

Answer

The DHCPv6 relay agent is not functioning because messages are not being forwarded.

Answer

The DHCPv6 server is unreachable because no REPLY is received.

Answer

The DHCPv6 client is using a global unicast address as its link-local address.

Question 18

An engineer applies the following configuration to an interface:

interface GigabitEthernet0/5
 ipv6 dhcp guard attach-policy DHCP_GUARD
 ipv6 snooping database file nvram:ipv6-snoop.db

Which statement is true?

Accepted Answer

The DHCP guard policy is applied to the interface, and the snooping database is stored in NVRAM.. The 'ipv6 dhcp guard attach-policy DHCP_GUARD' command applies the DHCP Guard policy to the interface, and the 'ipv6 snooping database file nvram:ipv6-snoop.db' command configures the snooping database to be stored in NVRAM. These two commands operate independently; the DHCP Guard policy is enforced immediately upon attachment, regardless of the database's presence or population state.

Answer

The DHCP guard policy is applied only if the snooping database is present.

Answer

The interface will not forward any DHCP messages until the database is populated.

Answer

The snooping database is used to validate DHCP server messages.

Question 19

In IPv6 First Hop Security, what is the purpose of the 'device-role' command in a DHCP guard policy?

Accepted Answer

It specifies whether the interface is a server, client, or relay for DHCP filtering.. The 'device-role' command in a DHCP guard policy specifies the role of the interface as either a DHCP server, client, or relay. This allows the switch to filter DHCP messages based on the expected role, blocking unauthorized DHCP server messages on interfaces that should only have clients or relays. It is a key component of IPv6 First Hop Security to prevent rogue DHCPv6 servers.

Answer

It sets the trust level for ND inspection.

Answer

It defines the VLAN membership for the interface.

Answer

It enables IPv6 routing on the interface.

Question 20

A network engineer runs the following command to verify BFD with EIGRP:

R1# show ip eigrp 100 topology 10.2.2.0/24

EIGRP-IPv4 Topology Entry for AS(100)/ID(10.2.2.0/24)
  State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072
  Descriptor Blocks:
  10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag: 0x0
      Composite metric: (131072/130816), Route is Internal
      Vector metric:
        Minimum bandwidth is 100000 Kbit
        Total delay is 100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
        Originating router is 2.2.2.2
      BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

EIGRP is using BFD with state UP, providing sub-second convergence.. The output shows that BFD is enabled for the EIGRP neighbor and the BFD state is UP, indicating fast failure detection is active for this route.

Answer

EIGRP has no BFD session for this neighbor.

Answer

BFD is down, so EIGRP relies on its own hello/dead timers.

Answer

EIGRP is using BFD in passive mode only.