300-410 Practice Exam 4 — 20 Questions

Question 1

Which of the following is true about the SPAN source interface configuration?

Accepted Answer

By default, only ingress traffic is monitored.. A SPAN source interface can be configured to monitor both ingress and egress traffic, or either direction. By default, only ingress traffic is monitored if no direction is specified.

Answer

By default, both ingress and egress traffic are monitored.

Answer

By default, only egress traffic is monitored.

Answer

The direction must always be specified; there is no default.

Question 2

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-SNMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 130
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show access-lists 130

Extended IP access list 130
    10 permit udp any any eq snmp
    20 permit udp any any eq snmptrap

Based on this output, what is the most likely reason that no packets are matching the CoPP-SNMP class?

Accepted Answer

The SNMP traffic is being sent from the router itself, which is not processed through the input control plane policy.. The CoPP-SNMP class matches traffic via access-list 130, which permits SNMP and SNMP trap packets. However, the show policy-map control-plane output shows zero matched packets because the input control plane policy only processes traffic destined to the router (i.e., packets received on an interface and punted to the control plane). SNMP traffic generated by the router itself (e.g., traps or responses) is locally sourced and does not traverse the input control plane path; it is handled by the output control plane or bypasses CoPP entirely. Thus, the policy never sees these self-generated packets.

Answer

The access-list does not include the correct SNMP port numbers.

Answer

The police rate is too low and is dropping all packets before counting.

Answer

The class-map is using 'match-all' instead of 'match-any'.

Question 3

A network engineer is deploying DMVPN Phase 3 with OSPF over the tunnel interface. The hub router must summarize all spoke routes into a single /24 prefix before advertising them into the corporate OSPF domain. The engineer configures `area 0 range 10.10.0.0 255.255.255.0` on the hub's ABR. After applying the configuration, spoke routes are still advertised individually. Which action resolves the issue?

Accepted Answer

Ensure the hub router is an ABR by placing the tunnel interface in a different area than the corporate domain, then apply the `area X range` command for that area.. Inter-area route summarization in OSPF requires the router to be an ABR, meaning it must have interfaces in at least two areas. The `area range` command only takes effect on an ABR for routes from the specified area. If the hub's tunnel and corporate interfaces are in the same area, no summary LSA is generated, so the spoke routes are advertised individually.

Answer

Configure `ip ospf database-filter all out` on the hub tunnel interface to suppress individual LSAs and allow the summary to propagate.

Answer

Configure the `area 0 range 10.10.0.0 255.255.255.0` command on the hub router's tunnel interface instead of the global OSPF process.

Answer

Change the OSPF network type on the hub tunnel interface to point-to-multipoint and reapply the `area 0 range` command.

Question 4

Which LDP message type is used to request label bindings from a neighbor?

Accepted Answer

Label Request message. The Label Request message is sent by an LDP router to request a label binding for a specific FEC from its neighbor.

Answer

Label Mapping message

Answer

Label Withdraw message

Answer

Label Release message

Question 5

An engineer is troubleshooting a network where R1 and R2 are running EIGRP, and R2 redistributes a static route for 192.168.1.0/24 into EIGRP. R1 also learns the same prefix via OSPF from R3 with an AD of 110. The engineer observes that R1 prefers the EIGRP external route (AD 170) over the OSPF route. What configuration change would cause this behavior?

Accepted Answer

The engineer applied the distance eigrp 90 100 command under EIGRP, lowering the AD for external routes to 100.. By default, EIGRP external routes have an AD of 170, and OSPF has AD 110, so OSPF should be preferred. If the EIGRP external route is preferred, the AD must have been lowered, likely via the distance command under EIGRP.

Answer

The OSPF route is a type 5 LSA, which has a higher AD than type 3 LSAs.

Answer

The OSPF route has a metric of 20, while the EIGRP route has a metric of 2560.

Answer

The static route was redistributed with a route-map that sets the EIGRP metric to 1.

Question 6

A network engineer is configuring policy-based routing (PBR) on a Cisco IOS XE router. The engineer wants traffic from subnet 10.1.1.0/24 to be forwarded to next-hop 192.168.2.1, while all other traffic uses the default routing table. The engineer configures a route map and applies it to the ingress interface with `ip policy route-map PBR`. However, traffic from 10.1.1.0/24 is still following the default route. Which action should the engineer take to ensure PBR is applied?

Accepted Answer

Verify that the route map contains a match statement for the source subnet and a set statement for the next-hop, and that the route map is applied with the `ip policy route-map` command on the correct interface.. PBR requires a route map with proper match and set statements, and it must be applied to the ingress interface where the traffic enters. If the route map lacks a match for the source subnet or a set for the next-hop, or if it is applied incorrectly, PBR will not override the default routing. Verifying these elements ensures that traffic from 10.1.1.0/24 is forwarded to 192.168.2.1 as intended.

Answer

Enable `ip local policy route-map PBR` globally to apply the policy to all interfaces.

Answer

Apply the route map to the egress interface with the `ip policy route-map` command.

Answer

Configure a default route with a next-hop of 192.168.2.1 to override the existing default route.

Question 7

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against route processor overload. The engineer creates a class map matching OSPF and BGP traffic and a policy map that polices this traffic to 1 Mbps with a burst of 2000 bytes. After applying the policy map to the control plane, the engineer notices that OSPF adjacencies flap intermittently. Which action should the engineer take to resolve the flapping?

Accepted Answer

Increase the policed rate and burst size to accommodate legitimate routing protocol traffic.. CoPP policies that are too restrictive can drop legitimate control plane traffic, causing routing protocol adjacencies to flap. In this scenario, the policer rate of 1 Mbps is insufficient for OSPF and BGP traffic, leading to intermittent OSPF drops. Increasing the policed rate and burst size allows normal routing updates to pass while still providing protection against excessive traffic.

Answer

Disable OSPF authentication to reduce packet size and processing overhead.

Answer

Configure a higher priority queue for OSPF traffic in the policy map.

Answer

Apply the policy map to all interfaces instead of the control plane.

Question 8

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history events

Event History:
  Event Type    : syslog
  Time          : Mar 1 00:05:23
  Pattern       : OSPF-5-ADJCHG
  Trigger count : 1

Event Type    : timer
  Time          : Mar 1 00:06:00
  Timer Type    : absolute
  Timer Name    : MY-TIMER
  Trigger count : 1

What does this output indicate?

Accepted Answer

Two events have triggered EEM applets: a syslog event matching 'OSPF-5-ADJCHG' and an absolute timer named 'MY-TIMER'.. The output shows the event history for EEM. It lists events that have triggered EEM applets. Each entry shows the event type (syslog, timer, etc.), the time it occurred, specific details (pattern for syslog, timer type and name for timer), and the number of times that event triggered an applet. This helps in troubleshooting which events are being matched.

Answer

Two EEM applets are currently registered: one for syslog and one for timer.

Answer

The OSPF-5-ADJCHG syslog event triggered an applet that executed a timer.

Answer

The timer event is a countdown timer that triggered after 5 minutes and 23 seconds.

Question 9

A network engineer is configuring a DMVPN Phase 3 network with mGRE and NHRP. The hub router must be able to dynamically learn spoke routes and advertise them to other spokes. Which two statements are true regarding the configuration of the hub to support spoke-to-spoke communication in DMVPN Phase 3? (Choose two.)

Accepted Answer

The hub must have a route to all spoke networks, either through a routing protocol or summary route.. In DMVPN Phase 3, the hub must be configured with 'ip nhrp redirect' to inform spokes of a better direct path, and it must have a route to all spoke networks to provide initial connectivity and forwarding. The spokes require 'ip nhrp shortcut' to act on redirects. The other options are either not specific to Phase 3 or are configured on spokes.

Answer

The hub must have 'ip nhrp shortcut' configured on its tunnel interface.

Answer

The hub must have 'ip nhrp network-id' configured with the same value as the spokes.

Answer

The hub must have 'ip nhrp map multicast dynamic' configured to support multicast traffic.

Question 10

A network engineer is implementing GET VPN using GDOI on Cisco IOS routers. The key server must distribute the group policy, and the group members must register and receive rekey messages. The engineer needs to verify which components are required for the group members to successfully join the group and decrypt traffic. (Choose two.)

Accepted Answer

Group members must be configured with the group identity and a matching GDOI group configuration referencing the key server.. GET VPN GDOI group members must be configured with the correct group identity and key server reference, and they must successfully register to receive the KEK and TEK from the key server. These two elements are fundamental: the local group configuration identifies which key server to contact, and successful registration provides the keys needed to decrypt the group's encrypted traffic. Authentication uses IKEv1 rather than IKEv2 with a CA, and the encryption ACL comes from the downloaded policy.

Answer

Group members must have a static VRF configured to isolate the GET VPN traffic from the global routing table.

Answer

Group members must be configured with the same ACL as the key server to define interesting traffic for the encryption policy.

Answer

Group members must have IKEv2 configured with a certificate authority to authenticate to the key server.

Question 11

Consider the following configuration:

ipv6 access-list BLOCK-ICMP
 deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2
 ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Accepted Answer

The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.. The IPv6 ACL explicitly denies ICMPv6 echo-request and echo-reply messages (types 128 and 129) while the final permit ipv6 any any statement allows all other IPv6 traffic. The ipv6 traffic-filter command applied inbound on GigabitEthernet0/2 filters traffic as it enters the interface, so only the specified ICMP types are blocked, and all other IPv6 traffic is permitted.

Answer

The ACL blocks all ICMPv6 traffic because the deny statements are too broad.

Answer

The ACL must be applied outbound to filter echo-request.

Answer

The ACL is missing the 'log' keyword to be effective.

Question 12

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order begins with entering global configuration mode, then defining the EEM applet and its syslog trigger, followed by configuring the action to execute, and finally exiting configuration mode to register the applet.

Question 13

What is the default inter-packet interval (in milliseconds) for an IP SLA UDP Jitter operation?

Accepted Answer

20 ms. The default inter-packet interval for UDP Jitter is 20 milliseconds. This is the delay between sending successive packets within a single probe.

Answer

10 ms

Answer

50 ms

Answer

100 ms

Question 14

A network engineer is configuring a Cisco IOS XE router to act as a DHCP server for a subnet. The router must assign IP addresses from the 192.168.100.0/24 pool, but the first 10 addresses and the last address in the range must be excluded from dynamic assignment. Which command accomplishes this requirement?

Accepted Answer

Two separate commands: ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254. The Cisco IOS DHCP server uses the ip dhcp excluded-address command to specify addresses that should not be assigned dynamically. You can configure multiple excluded addresses or ranges by entering the command multiple times. In this scenario, the first 10 addresses and the last address must be excluded, so two separate commands are needed: one for the range and one for the individual address. Combining them into a single command with multiple arguments or using 'and' is not valid syntax.

Answer

ip dhcp excluded-address 192.168.100.1 192.168.100.10 192.168.100.254

Answer

ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254

Answer

ip dhcp excluded-address 192.168.100.1 192.168.100.10

Question 15

Which IP SLA operation type uses ICMP Echo Request/Reply packets to measure round-trip time?

Accepted Answer

ICMP Echo. The IP SLA ICMP Echo operation (type 1) uses ICMP Echo Request and Echo Reply messages to measure network latency and availability.

Answer

UDP Jitter

Answer

TCP Connect

Answer

HTTP

Question 16

A network engineer runs the following command to verify NetFlow export on an interface:

R1# show ip flow interface

GigabitEthernet0/0
  ip flow ingress
  ip flow egress

GigabitEthernet0/1
  ip flow ingress

What does this output indicate?

Accepted Answer

NetFlow is enabled on GigabitEthernet0/0 for both ingress and egress, and on GigabitEthernet0/1 for ingress only.. The 'show ip flow interface' output lists each interface and the direction(s) in which NetFlow is enabled. GigabitEthernet0/0 shows both 'ip flow ingress' and 'ip flow egress', meaning NetFlow captures traffic in both directions. GigabitEthernet0/1 shows only 'ip flow ingress', meaning only ingress traffic is captured. Option B accurately reflects this.

Answer

NetFlow is enabled only on GigabitEthernet0/0 for both directions.

Answer

NetFlow is enabled on GigabitEthernet0/0 for ingress only.

Answer

NetFlow is not enabled on any interface.

Question 17

A network engineer runs the following command to troubleshoot SNMP access lists:

R1# show snmp access
Access-list: 10
Community: public
View: v1default

Access-list: 20
Community: private
View: v1default

What does this output indicate?

Accepted Answer

SNMP access is controlled by ACLs: ACL 10 for 'public' and ACL 20 for 'private'.. The 'show snmp access' output displays the configured SNMP access control entries, which map community strings to access control lists (ACLs). In this case, ACL 10 is associated with the 'public' community and ACL 20 with the 'private' community, meaning SNMP access is restricted based on these ACLs. This is the standard method for controlling SNMPv1/v2c access, as the router uses the ACL to permit or deny SNMP requests from specific source IP addresses.

Answer

No ACLs are applied to SNMP, so all access is allowed.

Answer

The router uses SNMPv3 exclusively.

Answer

The 'public' community has read-write access.

Question 18

Which default administrative distance is assigned to a directly connected interface route?

Accepted Answer

0. Directly connected routes have a default administrative distance of 0, indicating the highest preference.

Answer

1

Answer

5

Answer

110

Question 19

Drag and drop the steps to configure SNMPv3 with auth-priv and verify traps into the correct order, from first to last.

Accepted Answer

Configure SNMPv3 group with auth-priv security level. First, define the SNMPv3 group with security model and privacy settings. Next, create the user with authentication and privacy passwords. Then, enable SNMP traps globally. After that, specify the trap receiver host with the correct security parameters. Finally, verify the configuration using show snmp user and show snmp host.

Question 20

Which EIGRP packet type is used to confirm receipt of a reliable update?

Accepted Answer

ACK. In EIGRP, reliable updates (Update, Query, Reply) require acknowledgment. The ACK packet is a Hello packet with the Acknowledgment field set, and it is used to confirm receipt of a reliable update. It is not a separate packet type but a function of the Hello packet.

Answer

Hello

Answer

Update

Answer

Reply