300-410 Practice Exam 2 — 20 Questions

Question 1

In IPv6 FHS, which protocol is used to secure Neighbor Discovery messages with cryptographic authentication?

Accepted Answer

SEND. B is correct because SEND (Secure Neighbor Discovery, RFC 3971) uses Cryptographically Generated Addresses (CGAs) and RSA signatures to authenticate Neighbor Discovery (ND) messages, protecting against threats like Neighbor Advertisement spoofing and Duplicate Address Detection (DAD) attacks. Unlike IPsec, SEND does not require a pre-established security infrastructure or key management, making it practical for securing ND in IPv6 first-hop segments.

Answer

IPsec

Answer

SSL/TLS

Answer

MACsec

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three dynamic NAT translations, all using the same inside global address 192.0.2.10 with unique source ports (10000, 10001, 10002). This is the hallmark of Port Address Translation (PAT) or NAT overload, where multiple inside hosts (10.0.0.10, 10.0.0.11, 10.0.0.12) share a single public IP address by differentiating sessions via layer-4 port numbers. The 'overload' keyword in the dynamic mapping confirms PAT is active and working correctly.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 3

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Accepted Answer

Device Tracking. Device Tracking is the correct answer because it is the IPv6 First Hop Security (FHS) feature that maintains a 'device tracking' database to monitor and store reachability information for hosts. This database tracks the IPv6 address, MAC address, and binding state of each host, enabling features like ND Inspection and DHCPv6 Guard to verify host reachability before forwarding traffic.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

PACL

Question 4

An engineer configures CoPP on a router running EIGRP. The policy includes a class-map matching EIGRP traffic with a police rate of 1000 pps. After applying the policy, EIGRP neighbors form but occasionally go active and become stuck-in-active (SIA). Which is the most likely explanation?

Accepted Answer

The police rate in pps is too low, causing EIGRP reliable packets (queries/replies) to be dropped, leading to SIA.. EIGRP uses RTP (Reliable Transport Protocol) for certain packets like queries and replies. These reliable packets require acknowledgment; if the CoPP police rate of 1000 pps is too low, EIGRP queries or replies may be dropped. Missing acknowledgments cause the neighbor to be declared active, and if the query process is not completed within the active timer, the route becomes stuck-in-active (SIA).

Answer

EIGRP uses multicast, and CoPP cannot police multicast traffic.

Answer

CoPP only affects incoming traffic, but EIGRP SIA is caused by outgoing packet drops.

Answer

EIGRP uses TCP, and CoPP only polices UDP.

Question 5

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1002    1000       10    0    0 00:15:30        5
192.168.2.2     4        65003    1005    1003       10    0    0 00:14:20        3
10.10.10.2      4        65004       0       0        0    0    0 00:00:05 Idle

Based on this output, what is the problem with neighbor 10.10.10.2?

Accepted Answer

The BGP session is not established; possible misconfiguration or reachability issue.. The output shows that neighbor 10.10.10.2 is in the Idle state with zero messages sent or received, indicating the BGP session has never been established. This typically results from a misconfiguration (e.g., wrong neighbor IP, incorrect AS number, missing update-source) or a Layer 3 reachability issue preventing the TCP connection on port 179.

Answer

The neighbor is administratively shut down.

Answer

The neighbor is in the process of establishing the session.

Answer

The neighbor has sent all its prefixes and is waiting for updates.

Question 6

A network engineer runs the following command to troubleshoot a BGP prefix issue:

R1# show bgp ipv4 unicast 192.168.10.0/24
BGP routing table entry for 192.168.10.0/24, version 5
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

What does this output indicate?

Accepted Answer

The prefix is learned via eBGP and is the best path.. The output shows the prefix 192.168.10.0/24 is learned from neighbor 10.1.1.2 with the path type 'external', indicating eBGP. The line 'valid, external, best' confirms it is the best path, making option A correct.

Answer

The prefix is learned via iBGP and is not the best path.

Answer

The prefix is suppressed and not advertised to peers.

Answer

The prefix is invalid due to missing next-hop reachability.

Question 7

A network engineer runs the following command to troubleshoot route redistribution:

R1# debug ip routing
IP: route table insert (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]
IP: route table delete (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]

What does this output indicate?

Accepted Answer

The EIGRP route replaces the OSPF route due to lower administrative distance.. The debug output shows the OSPF route (AD 110) being inserted first, then the EIGRP route (AD 90) being inserted, followed by the deletion of the OSPF route and re-insertion of the EIGRP route. This sequence indicates that the EIGRP route replaces the OSPF route because EIGRP has a lower administrative distance (90 vs. 110), making it more trustworthy. The routing table only keeps the best route based on AD, not metric, when comparing routes from different protocols.

Answer

The router is load-balancing between OSPF and EIGRP routes.

Answer

The OSPF route is preferred due to lower metric.

Answer

Both routes are installed in the routing table.

Question 8

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but traffic is not encrypted. Which is the most likely explanation?

Accepted Answer

The crypto ACL does not match the traffic that is being sent.. The most likely reason traffic is not encrypted despite the tunnel being up is that the crypto ACL (access-list) applied to the IPsec configuration does not match the actual traffic being sent. The crypto ACL defines which traffic should be protected by IPsec; if the ACL does not permit the specific source/destination or protocol/port of the traffic, the router will not attempt to encrypt it, even though the IKE and IPsec security associations (SAs) are established.

Answer

The transform set uses ESP with null encryption.

Answer

The ISAKMP policy has the wrong authentication method.

Answer

The pre-shared key is incorrect.

Question 9

A network engineer runs the following command to troubleshoot an OSPF adjacency issue:

R1# debug ip ospf adj
OSPF: Interface GigabitEthernet0/0 going Up
OSPF: Send with youngest orig age 0
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state INIT
OSPF: First DBD and we are not SLAVE
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART
OSPF: Nbr 2.2.2.2 has larger interface MTU

What does this output indicate?

Accepted Answer

OSPF adjacency is stuck due to MTU mismatch; the neighbor has a larger MTU.. The debug output shows that R1 receives a Database Description (DBD) packet from neighbor 2.2.2.2 with the INIT and EXSTART states, and then explicitly states 'Nbr 2.2.2.2 has larger interface MTU'. This indicates an MTU mismatch where the neighbor's interface MTU (1500) is larger than R1's interface MTU, preventing the OSPF adjacency from progressing beyond the EXSTART state. Option B is correct because the adjacency is stuck due to the MTU mismatch, as OSPF requires matching MTU values on both sides for DBD exchange to complete.

Answer

OSPF adjacency is forming correctly, moving to FULL state.

Answer

OSPF adjacency is stuck because the router is not the DR/BDR.

Answer

OSPF adjacency is stuck due to authentication mismatch.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE
IPv6 access list DENY-REMOTE
    deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else. The access list DENY-REMOTE explicitly denies IPv6 traffic sourced from the prefix 2001:DB8:2::/48 (sequence 10) and then permits all other IPv6 traffic (sequence 20). When applied to an interface, this results in only traffic from that specific prefix being blocked, while all other IPv6 traffic is allowed. This matches option B.

Answer

It permits all IPv6 traffic

Answer

It permits only IPv6 traffic from 2001:DB8:2::/48

Answer

It denies all IPv6 traffic

Question 11

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. Option A is correct because IPv6 ND Inspection builds a binding table (IPv6 address to MAC address mappings learned from DHCPv6 snooping or ND messages) and validates Neighbor Solicitation and Neighbor Advertisement messages against that table, dropping messages whose source link-layer address does not match the binding. Option B is correct because ND Inspection supports per-interface configuration, including the ability to rate-limit ND packets (using the ipv6 nd inspection limit rate command) to mitigate ND flooding and DoS attacks. Option C is not correct because blocking rogue DHCPv6 servers is the function of DHCPv6 Guard, not ND Inspection. Option D is not correct because ND Inspection relies on the IPv6 snooping binding table rather than a prefix list to validate addresses. Option E is not correct because ND Inspection is configured on a per-interface basis (with a global policy applied to interfaces), not globally only.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 12

A network engineer runs the following command to troubleshoot SNMP traps:

R1# show snmp host
Host: 10.1.1.2
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

Host: 10.1.1.3
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

What does this output indicate?

Accepted Answer

SNMP traps are sent to two NMS hosts: 10.1.1.2 and 10.1.1.3 using SNMPv2c.. The output of the 'show snmp host' command lists the configured SNMP trap receivers. Each entry shows a host IP address (10.1.1.2 and 10.1.1.3), port 162 (the standard SNMP trap port), and the SNMP version (2c). This confirms that the router is sending SNMPv2c traps to both NMS hosts, making option A correct.

Answer

SNMP traps are sent to host 10.1.1.2 only.

Answer

The router is configured to receive traps from these hosts.

Answer

SNMPv3 is used for trap communication.

Question 13

What is the default SNMP community string on a Cisco IOS device that has not been configured with any SNMP commands?

Accepted Answer

No default community string exists; SNMP is disabled.. By default, Cisco IOS devices have no SNMP community strings configured because SNMP is disabled until explicitly enabled with the 'snmp-server community' command. Without any SNMP configuration, the device does not respond to SNMP requests, making option D correct. This aligns with Cisco's security best practices to avoid exposing management access unintentionally.

Answer

public

Answer

private

Answer

cisco

Question 14

A network engineer runs the following command on Router R1:

R1# show ip eigrp traffic
EIGRP-IPv4 Traffic Statistics for AS(100)
  Hellos sent/received: 5000/4995
  Updates sent/received: 150/148
  Queries sent/received: 10/8
  Replies sent/received: 8/10
  Acks sent/received: 300/298
  Input queue high water mark: 10
  Input queue drops: 0
  SIA-Queries sent/received: 0/0
  SIA-Replies sent/received: 0/0
  Hello process ID: 123
  PDM process ID: 124
  Socket queue: 0/2000/10/0 (current/max/highest/drops)
  Input queue: 0/2000/10/0 (current/max/highest/drops)

Based on this output, which statement is correct?

Accepted Answer

The EIGRP process is operating normally with no signs of issues.. The output shows normal EIGRP operation: Hellos are exchanged nearly equally (5000 sent vs 4995 received), Updates, Queries, Replies, and Acks are balanced, and both input queue drops and SIA counters are zero. This indicates stable neighbor relationships and no packet loss or stuck-in-active events, confirming the EIGRP process is functioning without issues.

Answer

There is a problem because more queries were sent than replies received.

Answer

The input queue drops of 0 indicate that the router is not processing EIGRP packets.

Answer

The SIA-Queries count of 0 indicates that the network has experienced stuck-in-active events.

Question 15

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

Accepted Answer

Auto-summary is disabled by default, preventing classful summarization.. In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Answer

Auto-summary is enabled by default and summarizes routes at classful boundaries.

Answer

Auto-summary is enabled by default but only for tunnel interfaces.

Answer

Auto-summary is disabled by default but can be enabled only for DMVPN.

Question 16

Examine this BGP configuration on router R6:

router bgp 65006
 bgp router-id 6.6.6.6
 neighbor 10.6.6.7 remote-as 65007
 neighbor 10.6.6.7 weight 200
!

What is the effect of the weight command?

Accepted Answer

It sets the weight of all routes learned from 10.6.6.7 to 200, making them preferred over routes with lower weight.. The weight command assigns a weight value to routes from a specific neighbor. Weight is a Cisco-specific attribute that is local to the router. Higher weight is preferred over other routes. The default weight for eBGP routes is 0, so weight 200 makes routes from this neighbor preferred.

Answer

It sets the weight of routes sent to 10.6.6.7 to 200.

Answer

It has no effect because weight is only configurable under route-map.

Answer

It sets the MED value to 200 for routes from this neighbor.

Question 17

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 18

What is the default administrative distance for internal EIGRP routes?

Accepted Answer

90. The default administrative distance for internal Enhanced Interior Gateway Routing Protocol (EIGRP) routes is 90. This value is used by Cisco routers to select the best path when multiple routing protocols provide route information for the same destination network, with a lower administrative distance being preferred over a higher one.

Answer

110

Answer

120

Answer

170

Question 19

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::1
  DUID: 0003000100AABBCCDDEE
  Username: unknown
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::100/128
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The client has been assigned an IPv6 address via DHCPv6.. The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Answer

The client is using SLAAC instead of DHCPv6.

Answer

The client's lease has expired.

Answer

The client is not authorized.

Question 20

A network engineer is troubleshooting IPv6 DMVPN phase 2 spoke-to-spoke tunnel failures. Spoke routers are able to communicate with the hub, but direct spoke-to-spoke traffic is not working. Router R1 (spoke) has the following relevant configuration:
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ipv6 nhrp network-id 1
 ipv6 nhrp nhs 2001:DB8:1::2
 ipv6 nhrp map multicast dynamic
!
Router R2 (hub) shows: show ipv6 nhrp brief output indicates that both spokes are registered. What is the root cause?

Accepted Answer

The hub is missing the 'ipv6 nhrp redirect' command, and the spokes are missing 'ipv6 nhrp shortcut'.. In DMVPN Phase 2, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to use NHRP shortcuts. Without 'ipv6 nhrp redirect' on the hub and 'ipv6 nhrp shortcut' on the spokes, the spokes will forward all inter-spoke traffic through the hub instead of establishing a direct tunnel. The hub's NHRP brief shows both spokes are registered, confirming NHRP registration works, but the missing redirect/shortcut mechanism prevents direct spoke-to-spoke communication.

Answer

The tunnel mode is multipoint, but the spokes need to be configured with 'tunnel mode gre ip' for direct communication.

Answer

The spokes have different NHRP network IDs, preventing registration.

Answer

The IPv6 addresses on the tunnel interfaces are in different subnets.