300-410 Practice Exam 2 — 20 Questions

Question 1

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order begins with entering global configuration mode, then defining the EEM applet and its syslog trigger, followed by configuring the action to execute, and finally exiting configuration mode to register the applet.

Question 2

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

Accepted Answer

The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.. The debug output shows that the IPsec SA request is generated, but the transform proposal (esp-3des esp-sha-hmac) is rejected with 'not supported for proxy'. This indicates that the remote peer does not support or is configured with a different transform set, causing the proposal to fail validation. The SA is created with placeholder SPIs (0x1234, 0x5678) but no actual inbound/outbound SPI, confirming negotiation failure due to transform set mismatch.

Answer

The IPsec SA is established successfully with ESP 3DES and SHA.

Answer

The ACL for the crypto map is misconfigured, causing the traffic to not match.

Answer

The IKE phase 1 SA is not established before IPsec negotiation.

Question 3

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify
  IPv6 verify source: strict

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.. The output 'IPv6 verify source: strict' indicates that strict unicast Reverse Path Forwarding (uRPF) is enabled on the interface. Strict uRPF verifies that the source IPv6 address of an incoming packet is reachable via the routing table AND that the best return path to that source uses the same interface on which the packet was received. If either condition fails, the packet is dropped. This matches option A exactly.

Answer

Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.

Answer

Loose uRPF is enabled, which only checks if the source address is in the routing table.

Answer

uRPF is disabled on this interface.

Question 4

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 5

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.. The IPsec SA is present but the packet counters are all zero. This indicates that the tunnel is established but no interesting traffic is being sent through it. The likely cause is that the crypto ACL does not match the actual traffic or routing is not directing traffic into the tunnel.

Answer

The IPsec SA is not established; phase 1 is still pending.

Answer

The remote peer is unreachable; the SA is in a dead state.

Answer

The tunnel interface is down; the SA cannot be used.

Question 6

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# debug ip sla trace

IP SLAs trace debugging is on

*Mar  1 12:34:56.789: IP SLAs: Starting operation 10
*Mar  1 12:34:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: RTT = 12 ms
*Mar  1 12:34:56.790: IP SLAs: Operation 10 completed successfully
*Mar  1 12:35:56.789: IP SLAs: Starting operation 10
*Mar  1 12:35:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: RTT = 14 ms
*Mar  1 12:35:56.790: IP SLAs: Operation 10 completed successfully

What does this output indicate?

Accepted Answer

The IP SLA operation is successfully completing each probe cycle.. This debug output shows the IP SLA trace for operation 10 (newer command). It confirms successful ICMP echo probes with RTT values, indicating the operation is functioning correctly.

Answer

The IP SLA operation is failing because the RTT values are too high.

Answer

The IP SLA operation is not configured because no configuration is shown.

Answer

The IP SLA operation is timing out because no reply is received.

Question 7

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Accepted Answer

Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.. To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Answer

Configure 'no logging trap debugging' globally.

Answer

Use 'undebug all' to stop all debug output.

Answer

Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

Question 8

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Accepted Answer

Configure 'event cli pattern "write memory" sync no' under the applet.. The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'. The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.

Answer

Define the applet using the 'event manager policy' command instead of 'event manager applet'.

Answer

Add an 'event syslog pattern "WRITE"' to detect the write memory operation.

Answer

Include an 'action cli command "enable"' before the copy command to ensure privileged access.

Question 9

Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)

Accepted Answer

A time-range can include both absolute and periodic statements simultaneously.. The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.

Answer

The time-range is applied to the entire ACL, not individual ACEs.

Answer

If the router's clock is not set, the time-range will be considered active at all times.

Answer

The time-range feature can only be used with extended named ACLs, not standard ACLs.

Question 10

What is the maximum hop count for an EIGRP route?

Accepted Answer

224. EIGRP uses a maximum hop count of 224, not 255 like RIPv2 or other distance-vector protocols. This limit is hard-coded in the EIGRP protocol to prevent routing loops and excessive path lengths, and it is enforced by the EIGRP update process. Routes with a hop count exceeding 224 are considered unreachable and are not installed in the routing table.

Answer

15

Answer

255

Answer

Unlimited

Question 11

An engineer redistributes OSPF routes into EIGRP. The OSPF routes have a metric of 20. After redistribution, the EIGRP topology table shows the routes but they are not installed in the routing table. The 'show ip eigrp topology' shows the route in active state. Which is the most likely explanation?

Accepted Answer

The EIGRP neighbor is stuck-in-active because a query was sent but no reply was received due to a unidirectional link.. When redistributing into EIGRP, a seed metric must be specified. If not, the routes are redistributed with an infinite metric (e.g., 4294967295) and are not installed. However, the question says the route is in active state, which indicates a query is pending. This is an edge case where the route is redistributed with a valid metric but the EIGRP process is stuck-in-active due to a unidirectional link or a neighbor not replying to queries.

Answer

The 'default-metric' command was not configured, so the routes are redistributed with an infinite metric.

Answer

The OSPF routes are external type 2, which are not redistributed by default.

Answer

The 'route-map' used for redistribution has a 'match ip address' that does not match the OSPF routes.

Question 12

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

Accepted Answer

The routers have the same OSPF router ID.. The INIT state indicates that the router has received a hello packet from the neighbor but the neighbor has not seen its own router ID in the hello packet. This is often due to a mismatch in the OSPF network type or a unicast communication issue. In a VLAN trunk scenario, if the subinterfaces are not in the same VLAN, the routers may not be able to communicate at Layer 2. However, the most common cause is that the routers are using the same router ID, which causes the hello packet to be ignored because the router sees its own router ID in the neighbor list.

Answer

The OSPF hello interval is mismatched between the two routers.

Answer

The subinterfaces are in different VLANs, preventing Layer 2 communication.

Answer

The OSPF network type is set to point-to-point on one side and broadcast on the other.

Question 13

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.. In a DMVPN phase 3 network, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to process them via the `ip nhrp shortcut` command. Without `ip nhrp redirect` on the hub, the hub forwards traffic between spokes without signaling them to establish a direct tunnel. The dynamic NHRP mapping on R1 for R2's tunnel IP indicates that R1 has learned R2's physical address via NHRP registration, but without the shortcut flag, R1 will not use that mapping to send traffic directly; instead, it continues to send traffic through the hub, which fails if the hub does not have a route or if the spoke-to-spoke tunnel is not triggered.

Answer

The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.

Answer

The tunnel interface on R1 is not in the correct VRF.

Answer

The IPsec transform set is mismatched between spokes.

Question 14

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER
IPv6 access list FILTER
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence 20
    permit ipv6 any any sequence 30

What does this output indicate?

Accepted Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.. The output shows an IPv6 access list with three explicit entries. Sequence 10 permits traffic from source 2001:DB8:1::/48 to any destination, sequence 20 denies traffic from 2001:DB8:2::/48 to any destination, and sequence 30 permits all other IPv6 traffic. Because sequence 30 explicitly permits any any, traffic not matching the first two entries is permitted, overriding the default implicit deny at the end of the list.

Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.

Answer

The access list will deny all traffic because of the deny statement.

Answer

The access list is invalid because IPv6 access lists require implicit deny at the end.

Question 15

What is the default EIGRP composite metric formula used for route calculation?

Accepted Answer

metric = (K1 * bandwidth) + (K3 * delay). The default EIGRP composite metric uses only K1 and K3, which correspond to bandwidth and delay, with K1=1 and K3=1 by default. This yields the formula metric = bandwidth + delay, where bandwidth is calculated as (10^7 / minimum path bandwidth in kbps) * 256 and delay is the sum of interface delays in tens of microseconds multiplied by 256. Option B correctly represents this default behavior.

Answer

metric = bandwidth + delay + load + reliability

Answer

metric = bandwidth + delay + MTU

Answer

metric = (K1 * bandwidth) + (K2 * load) + (K3 * delay) + (K5 / (K4 + reliability))

Question 16

A network engineer notices that routes redistributed from EIGRP into OSPF are causing routing loops. Router R1 has the following relevant configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 router ospf 1 redistribute eigrp 100 subnets metric-type 1 Router R2 shows: show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type E1 Last update from 10.1.1.1, 00:01:30 ago Also, R2 has a default route via R1. What is the root cause?

Accepted Answer

Mutual redistribution without filtering causes a routing loop; apply distribute-list or route-map with tags.. The mutual redistribution between EIGRP and OSPF without route filtering can cause a routing loop. R1 redistributes OSPF into EIGRP, and EIGRP back into OSPF, creating a feedback loop. The E1 metric of 20 suggests the route was redistributed twice. The correct fix is to implement route tagging and filtering to prevent loop.

Answer

The metric-type 1 should be type 2 to avoid loops.

Answer

The EIGRP metric values are incorrect; they should match OSPF cost.

Answer

The subnets keyword is missing in the redistribute command for OSPF.

Question 17

EIGRP network is experiencing stuck-in-active (SIA) routes. Router R1 shows: show ip eigrp topology active includes 10.0.0.0/24. Router R2 has: interface GigabitEthernet0/0, ip summary-address eigrp 100 10.0.0.0 255.255.255.0. What is the root cause?

Accepted Answer

The summary address on R2 is causing a query for the specific route to be suppressed.. The summary address configured on R2 (ip summary-address eigrp 100 10.0.0.0 255.255.255.0) causes R2 to advertise a single summary route (10.0.0.0/24) to R1. When R1 loses its route to 10.0.0.0/24 and sends a query for the specific prefix, R2 does not reply because the summary address suppresses the query for the more specific route, leaving R1 stuck-in-active (SIA) waiting for a reply that never comes.

Answer

R1 has a stuck interface causing the SIA.

Answer

EIGRP is misconfigured with wrong autonomous system number.

Answer

The route 10.0.0.0/24 is flapping, causing continuous queries.

Question 18

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration uses an ACL (access-list 1) to match traffic from the 192.168.1.0/24 subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command translates all matching source IP addresses to the single IP address 203.0.113.1 (the outside interface IP) using Port Address Translation (PAT). This is a classic dynamic NAT overload configuration, where multiple internal hosts share one public IP by multiplexing on source ports.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 19

What is the default keepalive interval for a GRE tunnel interface on Cisco IOS-XE?

Accepted Answer

10 seconds. The default keepalive interval for a GRE tunnel interface on Cisco IOS-XE is 10 seconds. This is defined by the default behavior of the `keepalive` command on tunnel interfaces, which sends periodic keepalive packets to verify the reachability of the tunnel destination. If no keepalive reply is received within three consecutive intervals (30 seconds by default), the tunnel interface is marked as down.

Answer

5 seconds

Answer

15 seconds

Answer

20 seconds

Question 20

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Accepted Answer

Device Tracking. Device Tracking is the correct answer because it is the IPv6 First Hop Security (FHS) feature that maintains a 'device tracking' database to monitor and store reachability information for hosts. This database tracks the IPv6 address, MAC address, and binding state of each host, enabling features like ND Inspection and DHCPv6 Guard to verify host reachability before forwarding traffic.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

PACL