300-410 Practice Exam 3 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 1

Round Trip Time (RTT) for Index 1
   Latest RTT: 200 ms
   Latest RTT (milliseconds): 200
   Latest RTT (microseconds): 200000
   Number of successes: 50
   Number of failures: 10
   Operation time to live: Forever
   Output: Over threshold

Based on this output, which statement is correct?

Accepted Answer

The latest RTT has exceeded the configured threshold value.. The 'Output: Over threshold' line indicates that the latest RTT exceeded the configured threshold. The number of failures (10) suggests some probes failed, but the key clue is the threshold violation. This does not necessarily mean the operation is down; it means a threshold event occurred.

Answer

The IP SLA operation has failed due to a timeout.

Answer

The IP SLA operation is not reachable and has been disabled.

Answer

The IP SLA responder is not configured on the target device.

Question 2

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 received-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 1

Based on this output, what can be inferred about the BGP session?

Accepted Answer

The BGP session is established and the neighbor is advertising one prefix.. The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Answer

The BGP session is not established.

Answer

The BGP session is in Active state.

Answer

The BGP session is in Idle state.

Question 3

Drag and drop the steps to verify and validate IP SLA operational state into the correct order, from first to last.

Accepted Answer

Check 'show ip sla configuration' for operation details. Begin by checking the overall IP SLA configuration to confirm the operation is defined, then review the latest statistics for RTT and success rate, examine the reaction configuration if tracking is used, verify the tracking object status, and finally confirm that tracked objects are influencing routing or policy.

Question 4

Given the following configuration on a router:
```
router ospf 1
 distance 150
```
What is the effect of this configuration?

Accepted Answer

It sets the administrative distance for OSPF routes to 150, overriding the default of 110.. This command sets the administrative distance for all OSPF routes to 150, overriding the default of 110.

Answer

It sets the administrative distance for OSPF routes to 150, but only for intra-area routes.

Answer

It sets the administrative distance for OSPF external routes to 150.

Answer

It sets the administrative distance for OSPF routes to 150, but only for routes learned from a specific neighbor.

Question 5

Given this configuration on router R2:
```
ip vrf CUSTOMER_D
 rd 100:1
!
interface GigabitEthernet0/0
 ip vrf forwarding CUSTOMER_D
 ip address 192.168.2.1 255.255.255.0
!
router ospf 1 vrf CUSTOMER_D
 network 192.168.2.0 0.0.0.255 area 0
```
What will happen when this configuration is applied?

Accepted Answer

OSPF will run on GigabitEthernet0/0 and form adjacencies within VRF CUSTOMER_D.. The OSPF process is tied to VRF CUSTOMER_D, so it only runs on interfaces that belong to that VRF. The network command matches the interface, so OSPF will form adjacencies on that interface within the VRF.

Answer

OSPF will fail because the OSPF process must be configured globally, not under the VRF.

Answer

OSPF will run on all interfaces, including those not in VRF CUSTOMER_D.

Answer

The network command is invalid because it uses a wildcard mask instead of a subnet mask.

Question 6

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show policy-map control-plane input class class-default

Class-map: class-default (match-any)
  0 packets, 0 bytes
  5 minute offered rate 0 bps, drop rate 0 bps
  Match: any
  police:
      cir 1000000 bps, bc 31250 bytes, be 31250 bytes
    conformed 0 packets, 0 bytes; actions:
      transmit
    violated 0 packets, 0 bytes; actions:
      drop
    conformed 0 bps, exceed 0 bps, violated 0 bps

What does this output indicate?

Accepted Answer

The CoPP policy is not matching any traffic, indicating a possible ACL or class-map misconfiguration.. The output shows zero packets matched in class-default, meaning no traffic is being classified by the CoPP policy. This indicates a possible misconfiguration in the ACL or class-map that defines the traffic to be policed, causing the policy to be effectively inactive. A correctly configured CoPP policy would show non-zero packet counts for matched traffic.

Answer

The CoPP policy is dropping all traffic due to a misconfigured CIR.

Answer

The CoPP policy is working correctly and policing traffic at 1 Mbps.

Answer

The CoPP policy is only applied to the output direction.

Question 7

In OSPF, what is the default behavior for auto-summary on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default. Cisco IOS-XE has auto-summary disabled by default for OSPF, meaning that redistributed routes are not summarized to their classful boundaries unless explicitly configured.

Answer

Auto-summary is enabled by default

Answer

Auto-summary is only enabled for external routes

Answer

Auto-summary is enabled only for inter-area routes

Question 8

Which EIGRP packet type is used to confirm receipt of an update during reliable transport in a VRF-Lite configuration?

Accepted Answer

ACK. EIGRP uses Reliable Transport Protocol (RTP) for Update, Query, and Reply packets, and the ACK packet is the mechanism that confirms receipt of those reliable packets. In a VRF-Lite configuration the same RTP behavior applies per-VRF, so an ACK is still the packet type that acknowledges an Update. Hello packets are unreliable and are not acknowledged, which is why ACK is the correct answer.

Answer

Hello

Answer

Update

Answer

Query

Question 9

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode

Based on this output, which statement is true?

Accepted Answer

uRPF is enabled in strict mode. The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 10

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

Accepted Answer

ND Snooping. C is correct because ND Snooping (Neighbor Discovery Snooping) is the IPv6 First Hop Security feature that prevents duplicate address detection (DAD) attacks by inspecting Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. It builds a binding table of valid IPv6-to-MAC address mappings and drops any NS messages that attempt to claim an address already in use by another device, thereby blocking DAD-based spoofing attacks.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

Source Guard

Question 11

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using eBGP with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 shows the route is received and best, but the show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 also shows the route has the 'r' flag (RIB-failure). What is the most likely cause?

Accepted Answer

There is a static route in the VRF for 10.2.2.0/24 with a lower administrative distance.. A RIB-failure indicates that the route is received and best in BGP but is not installed in the routing table because another route with a lower administrative distance exists. This could be due to a static route or an IGP route for the same prefix in the VRF.

Answer

The route-target import on PE1 is misconfigured.

Answer

The MP-BGP session is not using the loopback interface.

Answer

The VRF on PE1 has a different route-target export.

Question 12

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. The hub router is configured with a multipoint GRE tunnel and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels. Which two statements describe the correct operation of DMVPN Phase 3 that could explain the issue? (Choose two.)

Accepted Answer

The hub must be configured with the ip nhrp redirect command to support Phase 3.. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect, and spokes must be configured with ip nhrp shortcut. The redirect command allows the hub to notify spokes of a better path, while the shortcut command enables spokes to act on those notifications and establish direct tunnels. Without these, spoke-to-spoke traffic will continue to traverse the hub, even if other NHRP settings are correct.

Answer

Spokes must be configured with the ip nhrp network-id command matching the hub.

Answer

The hub must be configured with the ip nhrp map multicast dynamic command.

Answer

The hub must be configured with the ip nhrp authentication command.

Question 13

A network engineer configured IP SLA 30 to monitor the reachability of a server (10.10.10.10) using ICMP echo probes. The IP SLA is linked to a track object that is used in a static default route. The engineer notices that the IP SLA state is 'Active', but the static route is not present in the routing table. The track object shows 'Up'. What should the engineer check first?

Accepted Answer

Verify that the static route includes the 'track' keyword and references the correct track object number.. The most likely issue is that the static route does not include the 'track' keyword or references the wrong track object number. Even if the IP SLA and track object are up, the route will not be installed if it is not explicitly linked to the track object. The engineer should first verify the static route configuration to ensure it includes 'track <object-number>' and that the number matches the track object.

Answer

Check if the server is responding to ICMP echo requests.

Answer

Ensure the IP SLA probe is configured with a timeout value less than the frequency.

Answer

Reboot the router to clear any routing table inconsistencies.

Question 14

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify IP connectivity between redistribution points. Troubleshooting connectivity failures due to redistribution starts with checking basic Layer 3 reachability, then verifying routing protocol adjacencies, followed by examining the redistribution configuration, then checking for route filtering issues, and finally testing end-to-end connectivity. This order isolates the problem systematically.

Question 15

A network engineer runs the following command on Router R1:

R1# show snmp host

Host: 192.168.1.100
Port: 162
Timeout: 1.5 seconds
Retries: 3
Version: 2c
Community: PUBLIC

Host: 192.168.1.200
Port: 162
Timeout: 3 seconds
Retries: 5
Version: 3
User: admin
Security level: authPriv

Based on this output, which statement is correct?

Accepted Answer

SNMP traps sent to 192.168.1.200 will be encrypted.. The SNMPv3 security level 'authPriv' for the host at 192.168.1.200 means authentication and privacy (encryption) are both enabled. SNMPv3 with authPriv uses the User-based Security Model (USM) to encrypt the entire SNMP packet payload, including the trap data, using protocols like AES or DES. This ensures that traps sent to 192.168.1.200 are encrypted.

Answer

Both hosts use the same SNMP version.

Answer

The host at 192.168.1.100 uses SNMPv3 with user 'admin'.

Answer

Traps to 192.168.1.200 will be sent with community string 'admin'.

Question 16

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Accepted Answer

The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.. EEM (Embedded Event Manager) applets execute actions sequentially, and variables are evaluated at the time the 'if' condition is reached, not at applet start. So if a 'set' action modifies a variable before an 'if' condition that references it, the 'if' sees the updated value. This is standard procedural execution order in EEM.

Answer

The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

Answer

The 'set' action cannot modify a variable that is used in an 'if' condition.

Answer

The applet will fail if a variable is modified after being used in an 'if' condition.

Question 17

Drag and drop the steps to configure IPv6 RA Guard on a switch into the correct order, from first to last.

Accepted Answer

Enable IPv6 snooping globally. First, globally enable IPv6 snooping. Then define an RA Guard policy with the trusted or untrusted role. Apply the policy to the desired interface. Verify the configuration with show commands. Finally, test the RA Guard operation by sending RAs from unauthorized ports.

Question 18

Drag and drop the steps to verify and validate IPv6 First Hop Security operational state into the correct order, from first to last.

Accepted Answer

Show ipv6 snooping global status. Start by checking global IPv6 snooping status. Then display the binding table for learned entries. Verify interface-specific FHS policies. Check the RA Guard policy counters for drops. Finally, validate the neighbor cache for correct MAC-to-IPv6 mappings.

Question 19

A network engineer is configuring policy-based routing (PBR) on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 (LAN) and GigabitEthernet0/1 (WAN). The engineer wants all HTTP traffic from the 10.1.1.0/24 subnet to be routed via next-hop 192.168.2.2 instead of the default route. The engineer creates a route map named PBR with sequence 10, matches an ACL that permits TCP port 80 from 10.1.1.0/24, and sets the next-hop to 192.168.2.2. The route map is applied to interface GigabitEthernet0/0 with the command `ip policy route-map PBR`. However, traffic still follows the default route. Which action will fix the problem?

Accepted Answer

Ensure the ACL used in the route map matches the correct source and destination addresses and ports, and that the route map is applied in the correct direction.. Policy-based routing (PBR) on Cisco IOS XE requires that the route map is applied to the interface where traffic enters the router and that the ACL matches the intended traffic. Common oversights include misconfigured ACLs (wrong source, destination, or port) or applying the policy to the wrong interface. Ensuring the ACL matches HTTP traffic from 10.1.1.0/24 and that the route map is applied inbound on GigabitEthernet0/0 will make PBR function as intended.

Answer

Configure the `ip local policy route-map PBR` command to apply the route map globally.

Answer

Apply the route map to the GigabitEthernet0/1 interface instead of GigabitEthernet0/0.

Answer

Add the `set ip next-hop verify-availability` command to the route map.

Question 20

A network engineer runs the following command on Router R1:

R1# show ipv6 nd raguard policy
Interface                      Policy                      Role            State
Gi0/0/0                        RA_GUARD                    router          ACTIVE
Gi0/0/1                        RA_GUARD                    host            ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/0 is allowed to send Router Advertisements.. The 'show ipv6 nd raguard policy' output shows that interface Gi0/0/0 is configured with the RA_GUARD policy in the 'router' role and is ACTIVE. In IPv6 RA Guard, a port in the 'router' role is explicitly permitted to send Router Advertisements (RAs), while ports in the 'host' role are blocked from sending RAs. Therefore, only Gi0/0/0 is allowed to send RAs, making option A correct.

Answer

Interface Gi0/0/1 is allowed to send Router Advertisements.

Answer

Interface Gi0/0/2 is allowed to send Router Advertisements.

Answer

All interfaces are blocked from sending Router Advertisements.