300-410 Practice Exam 4 — 20 Questions

Question 1

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.

Answer

The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.

Answer

The 'ip nat pool' command is required for all PAT configurations.

Question 2

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

Accepted Answer

It denies all traffic not explicitly permitted and is always present.. Every IPv4 ACL has an implicit deny any statement at the end that denies all traffic not explicitly permitted by earlier entries. This implicit rule is always present and cannot be removed, ensuring that only traffic matching a permit entry is allowed through the ACL.

Answer

It can be overridden by adding a permit any at the end.

Answer

It is invisible and applies only to TCP traffic.

Answer

It is always present and cannot be removed or overridden.

Question 3

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Accepted Answer

Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.. The configuration uses a standard ACL to match inside hosts (192.168.1.0/24) and dynamically assigns them a unique address from the pool 203.0.113.10–203.0.113.20. Because no 'overload' keyword is present, PAT is not enabled; each translation consumes a pool address, and once all 11 addresses are used, new translations fail until an existing translation times out or is cleared.

Answer

Inside hosts are translated to addresses in the pool using PAT.

Answer

The router uses the pool address as the source for all outbound traffic, regardless of ACL.

Answer

This configuration requires the 'ip nat outside' interface command to function.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor vrf BLUE

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR        00:00:32    10.1.1.2        GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER   00:00:35    10.1.2.2        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

The OSPF adjacencies are functioning normally.. The output shows two OSPF neighbors for VRF BLUE. Neighbor 10.0.0.2 is in FULL state and is the DR on GigabitEthernet0/0. Neighbor 10.0.0.3 is in 2WAY state and is a DROTHER on GigabitEthernet0/1. The 2WAY state is normal for neighbors that are not DR/BDR on a multi-access network. No problem is evident.

Answer

Neighbor 10.0.0.3 is not forming a full adjacency because it is a DROTHER.

Answer

Neighbor 10.0.0.2 is the Backup Designated Router.

Answer

Both neighbors are in the FULL state.

Question 5

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Accepted Answer

IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.. The `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Answer

IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

Answer

IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

Answer

IPv6 ACLs support the remark keyword for documentation.

Question 6

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

Accepted Answer

iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors. By default, iBGP routers do not advertise routes learned from one iBGP neighbor to another iBGP neighbor because of the split-horizon rule. This is a fundamental behavior to prevent routing loops, but it often catches engineers who expect iBGP to behave like eBGP. To overcome this, a route reflector or confederation must be used.

Answer

The next-hop-self command is required for iBGP

Answer

The BGP synchronization rule is enabled

Answer

The routes are not valid because the next-hop is not reachable

Question 7

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows that BFD is enabled for the LDP session and the BFD state is UP, providing fast failure detection for MPLS LDP neighbor.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 8

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 9

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

Accepted Answer

The local enable password is not configured.. The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password. If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Answer

The RADIUS server is not configured to provide the enable password.

Answer

The 'aaa authentication enable default' command is missing the 'local' keyword.

Answer

The router's enable secret is set to a different password.

Question 10

Two VRFs on router R1: VRF A and VRF B. R1 has:
ip vrf A
 rd 100:1
 route-target export 100:1
 route-target import 100:2
ip vrf B
 rd 100:2
 route-target export 100:2
 route-target import 100:1
R1 shows:
R1# show ip route vrf A
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
R1# show ip route vrf B
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
Router R2 (in VRF A) can ping 10.1.1.1, but router R3 (in VRF B) cannot. What is the root cause?

Accepted Answer

The next hop 10.2.2.2 is not reachable from VRF B due to missing interface in VRF B.. The route targets are misconfigured for route leaking. VRF A exports with RT 100:1 and imports RT 100:2. VRF B exports with RT 100:2 and imports RT 100:1. This creates a two-way leak, but the route 10.1.1.0/24 is learned via BGP from R2. If R2 is in VRF A, the route is exported with RT 100:1. VRF B imports RT 100:1, so VRF B should have the route. However, the issue might be that the route is not being advertised to R3 due to BGP next-hop resolution or VRF interface issues. The output shows both VRFs have the route, so the problem is likely that R3 cannot reach the next hop 10.2.2.2 because it is in a different VRF or the interface is not in VRF B. The root cause is that the next hop is not reachable from VRF B.

Answer

The route targets are reversed, causing VRF B to not import the route.

Answer

BGP is not configured to advertise VPNv4 routes.

Answer

R3 has a firewall blocking ICMP.

Question 11

What is the default lease duration for a DHCPv4 address pool on a Cisco IOS router?

Accepted Answer

1 day. The default lease duration for a DHCPv4 address pool on a Cisco IOS router is 1 day (86400 seconds). This is defined by the Cisco IOS DHCP server implementation, which uses a 24-hour lease as the default when no lease duration is explicitly configured under the DHCP pool configuration.

Answer

7 days

Answer

30 minutes

Answer

Infinite

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:1::1                              0   aaaa.bbbb.cccc  REACH  Gi0/0/0
2001:DB8:1::2                             10   aaaa.bbbb.cccd  STALE  Gi0/0/0
2001:DB8:1::3                              -   aaaa.bbbb.ccce  DELAY  Gi0/0/1
FE80::1                                    0   aaaa.bbbb.cccf  REACH  Gi0/0/0

Based on this output, which statement is correct?

Accepted Answer

The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.. The DELAY state in IPv6 Neighbor Discovery (ND) indicates that a neighbor has not been confirmed reachable within the last 5 seconds, and the router will send a Neighbor Solicitation (NS) message after the DELAY timer expires (default 5 seconds) to verify reachability. The entry for 2001:DB8:1::3 shows a hyphen in the Age column, meaning it was just created or refreshed, and it is in DELAY, so an NS will be sent soon.

Answer

All neighbors are in a stable state.

Answer

The neighbor 2001:DB8:1::2 is unreachable.

Answer

The link-local address FE80::1 is not valid.

Question 13

R1 and R2 are OSPF neighbors over a tunnel interface with BFD enabled. R1#show ip ospf interface tunnel0 shows 'BFD is enabled' but R1#show bfd neighbors shows the session as 'Down'. R2#show bfd neighbors shows the session as 'Down'. The tunnel is up and OSPF adjacency is full. R1 has 'bfd interval 100 min_rx 100 multiplier 3' under tunnel0. R2 has same. What is the root cause?

Accepted Answer

BFD is not supported over tunnel interfaces; it requires physical interfaces.. BFD over tunnel interfaces requires that the underlying transport (e.g., GRE) supports BFD. BFD cannot be established over a tunnel if the tunnel endpoint IP addresses are not directly connected; BFD requires physical connectivity. Since OSPF is full, the tunnel is working, but BFD fails because the tunnel is considered a virtual interface and BFD expects a direct physical link.

Answer

The tunnel mode must be changed to 'ipsec' for BFD to work.

Answer

OSPF must be configured with 'bfd all-interfaces' to work over tunnels.

Answer

The BFD timers must be increased for tunnel interfaces.

Question 14

In Cisco IOS, what is the default encryption algorithm for IKEv1 phase 1 if not specified in the ISAKMP policy?

Accepted Answer

DES. In Cisco IOS, when an IKEv1 ISAKMP policy is configured without specifying an encryption algorithm, the default encryption algorithm is DES (Data Encryption Standard). This is because Cisco IOS defaults to DES for IKEv1 phase 1 if no encryption is explicitly defined in the ISAKMP policy, as per the default policy parameters. DES uses a 56-bit key and is considered weak by modern standards, but it remains the default for backward compatibility.

Answer

AES 256

Answer

3DES

Answer

AES 128

Question 15

Drag and drop the steps to verify and validate IP SLA operational state into the correct order, from first to last.

Accepted Answer

Check 'show ip sla configuration' for operation details. Begin by checking the overall IP SLA configuration to confirm the operation is defined, then review the latest statistics for RTT and success rate, examine the reaction configuration if tracking is used, verify the tracking object status, and finally confirm that tracked objects are influencing routing or policy.

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::1
  DUID: 0003000100AABBCCDDEE
  Username: unknown
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::100/128
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The client has been assigned an IPv6 address via DHCPv6.. The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Answer

The client is using SLAAC instead of DHCPv6.

Answer

The client's lease has expired.

Answer

The client is not authorized.

Question 17

R1 and R2 are connected via an IPsec VPN tunnel. R1 has a static route to 10.10.10.0/24 pointing to the tunnel interface. R2 has a static route to 192.168.1.0/24 pointing to the tunnel interface. Both routers have BGP configured between loopback addresses over the tunnel. BGP peering is established, but R1 cannot ping 10.10.10.1 (R2's loopback) from its loopback. R1's show ip bgp shows the route as valid but not best. What is the root cause?

Accepted Answer

The static route to 10.10.10.0/24 via tunnel causes recursive routing failure because the tunnel destination is not reachable.. R1's static route to 10.10.10.0/24 points to the tunnel interface, but the tunnel destination (the remote peer's public IP) is not reachable via a valid routing path. This creates a recursive routing failure: the router tries to resolve the tunnel interface's next-hop (the tunnel destination) but cannot find a route to it, causing the BGP route to be marked as valid but not best. Without a reachable tunnel destination, the IPsec VPN cannot forward traffic, so pings from R1's loopback to 10.10.10.1 fail.

Answer

BGP next-hop-self is not configured on R2.

Answer

The IPsec tunnel is not encrypting BGP traffic.

Answer

The BGP network statement for 10.10.10.0/24 is missing on R2.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 1
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 1

Based on this output, what is the problem?

Accepted Answer

The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.. The output shows a single dynamic NAT translation with zero hits and zero misses, meaning no traffic has attempted to traverse the NAT process. This indicates the translation entry exists (likely from a previous or idle session) but no packets have matched the access list or triggered translation since the counters were cleared. The problem is that the NAT configuration is in place but not actively translating any traffic.

Answer

The NAT pool is exhausted.

Answer

PAT is misconfigured.

Answer

The inside and outside interfaces are reversed.

Question 19

An engineer configures DHCPv4 on a router with multiple pools for different subnets. Clients in subnet A receive addresses correctly, but clients in subnet B receive addresses from subnet A's pool. The router has 'ip dhcp relay' configured. Which is the most likely explanation?

Accepted Answer

The DHCP server selects the pool based on the giaddr; if the relay agent does not set the giaddr correctly, the server may use the first matching pool.. When a DHCP relay agent forwards a client's request to the server, it inserts its own IP address (the interface address on the client's subnet) into the giaddr (gateway IP address) field. The DHCP server uses this giaddr to select the appropriate pool. If the relay agent fails to set the giaddr correctly—for example, due to misconfiguration or the relay interface not being on the correct subnet—the server may receive a giaddr of 0.0.0.0 or an incorrect address, causing it to fall back to the first configured pool that matches, which in this case is subnet A's pool.

Answer

The pools are configured in the wrong order; the server uses the first pool that matches the client's MAC address.

Answer

The router has 'ip dhcp smart-relay' enabled, which overrides pool selection.

Answer

The DHCP server is configured with 'network' statements that overlap.

Question 20

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show snmp. The `show snmp` command displays the overall SNMP agent configuration, including contact, location, community strings, and SNMP version. The `show snmp host` command lists the configured SNMP notification receivers (trap or inform destinations) and verifies that the router is correctly configured to send SNMP messages to the management station. Together, these two commands confirm both the agent's operational state and its connectivity to remote hosts.

Answer

show snmp group

Answer

show snmp user

Answer

debug snmp packets