300-410 Practice Test 21 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# show policy-map control-plane input class class-default

Output:
  Class-map: class-default (match-any)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: any
    police:
        cir 1000000 bps, bc 31250 bytes
        conformed 0 packets, 0 bytes; actions:
            transmit
        exceeded 0 packets, 0 bytes; actions:
            drop
        violated 0 packets, 0 bytes; actions:
            drop

What does this output indicate?

Accepted Answer

The CoPP policy is policing control plane traffic at 1 Mbps, but no packets have been matched yet.. The output shows a CoPP (Control Plane Policing) policy applied to the control plane input, policing at 1,000,000 bps (1 Mbps) with a 31,250-byte burst, and all counters (conformed, exceeded, violated) are zero with '0 packets, 0 bytes' matched. This means the policy is active and configured, but no control plane traffic has matched it yet.

Answer

The CoPP policy is dropping all control plane traffic.

Answer

The CoPP policy is not applied to the control plane.

Answer

The CoPP policy is using a class-map that matches all traffic.

Question 2

A network engineer is configuring OSPF on a router. The router has an interface with IP address 10.1.1.1/24 and another interface with IP address 192.168.1.1/24. The engineer wants to enable OSPF on both interfaces using a single network command under router ospf 1. Which command accomplishes this?

Accepted Answer

network 0.0.0.0 255.255.255.255 area 0. The network command in OSPF uses a wildcard mask to match interface IP addresses. To enable OSPF on all interfaces with one command, use network 0.0.0.0 255.255.255.255 area 0, which matches any IP address. This activates OSPF on both the 10.1.1.1/24 and 192.168.1.1/24 interfaces, satisfying the requirement.

Answer

network 10.0.0.0 0.255.255.255 area 0

Answer

network 10.1.1.0 0.0.0.255 area 0 and network 192.168.1.0 0.0.0.255 area 0

Answer

network 10.1.1.0 0.0.0.255 area 0

Question 3

An engineer configures IPsec between two routers using transform-set esp-aes 256 esp-sha-hmac. The tunnel fails to establish. Debug shows 'transform set proposal mismatch'. Which is the most likely explanation?

Accepted Answer

The other router uses 'esp-aes' without specifying the key length, defaulting to 128-bit, causing a mismatch.. The debug output 'transform set proposal mismatch' indicates that the IPsec transform sets on the two peers do not match. When 'esp-aes 256' is configured on one router, the other router must explicitly specify 'esp-aes 256' as well; if it only uses 'esp-aes' without specifying a key length, Cisco IOS defaults to AES-128. This mismatch in encryption algorithm strength (256-bit vs. 128-bit) causes the IKE phase 2 negotiation to fail.

Answer

The transform-set uses SHA-1, which is not supported by the other router.

Answer

The IPsec proposal includes both esp-aes and esp-3des, causing confusion.

Answer

The transform-set is missing the authentication header.

Question 4

A network administrator is setting up a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the VPN tunnel uses strong encryption and hashing algorithms. Which of the following should be configured to define the encryption and hashing algorithms used for the IPsec SA?

Accepted Answer

Transform set. The transform set is used to define the encryption and hashing algorithms for the IPsec SA. It is referenced by the crypto map or IPsec profile. The ISAKMP policy defines Phase 1 parameters, while the crypto map and IKEv2 profile are used for other purposes. Therefore, the transform set is the correct answer.

Answer

ISAKMP policy

Answer

IKEv2 profile

Answer

Crypto map

Question 5

What is the default OSPF dead interval on a broadcast multi-access network (e.g., Ethernet) when the hello interval is 10 seconds?

Accepted Answer

40 seconds. On broadcast multi-access networks like Ethernet, OSPF defaults to a hello interval of 10 seconds. The dead interval is calculated as 4 times the hello interval, resulting in a default dead interval of 40 seconds. This ensures that a router has multiple missed hello opportunities before being declared dead, providing stability against transient network issues.

Answer

30 seconds

Answer

20 seconds

Answer

10 seconds

Question 6

A network engineer runs the following command to verify Flexible NetFlow cache entries:

R1# show flow monitor FLOW-MONITOR-1 cache format record

Cache entry for flow 1:
    ipv4 source address: 10.0.0.1
    ipv4 destination address: 192.168.1.100
    ip protocol: 6
    counter bytes: 1500
    counter packets: 10
    timestamp sys-uptime first: 123456
    timestamp sys-uptime last: 123556

Cache entry for flow 2:
    ipv4 source address: 10.0.0.2
    ipv4 destination address: 192.168.1.101
    ip protocol: 17
    counter bytes: 500
    counter packets: 5
    timestamp sys-uptime first: 123457
    timestamp sys-uptime last: 123557

What does this output indicate?

Accepted Answer

The cache shows two flows with source/destination IP, protocol, byte/packet counts, and timestamps.. The output shows two active flows in the Flexible NetFlow cache. Flow 1 is a TCP (protocol 6) flow from 10.0.0.1 to 192.168.1.100 with 1500 bytes and 10 packets. Flow 2 is a UDP (protocol 17) flow from 10.0.0.2 to 192.168.1.101 with 500 bytes and 5 packets. The timestamps show the first and last packet times.

Answer

Both flows are TCP connections.

Answer

The cache does not include protocol information.

Answer

The flows are being exported immediately.

Question 7

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, the router's CPU spikes and routing loops occur. Which is the most likely explanation?

Accepted Answer

Routes redistributed from OSPF into EIGRP are then redistributed back into OSPF, creating a feedback loop.. Mutual redistribution without route tagging or filtering can cause a routing loop. A route redistributed from OSPF into EIGRP can be redistributed back into OSPF, creating a feedback loop. This is a classic redistribution loop.

Answer

The seed metric for EIGRP was not configured, causing the route to be redistributed with an infinite metric.

Answer

The administrative distance of the redistributed routes is lower than the original, causing them to be preferred.

Answer

The OSPF process ID must match on all routers; otherwise, redistribution fails.

Question 8

Consider the ERSPAN configuration on a router:

monitor session 1 type erspan-source
 source interface GigabitEthernet0/0/1 both
 destination
  erspan-id 1
  ip address 192.168.1.100
  origin ip address 192.168.1.1

What is the primary purpose of the 'origin ip address' command?

Accepted Answer

It defines the source IP address used in the ERSPAN GRE encapsulation.. The 'origin ip address' command in ERSPAN configuration specifies the source IP address that will be used in the ERSPAN GRE encapsulation. This IP address is typically the loopback or management interface of the source switch or router, and it identifies the origin of the ERSPAN traffic to the destination monitoring device. It is not the destination IP address, nor the monitored interface IP.

Answer

It specifies the IP address of the monitoring device.

Answer

It sets the IP address of the interface being monitored.

Answer

It enables ERSPAN on the specified interface.

Question 9

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The engineer enters the following commands:

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 C1sco123

After applying the configuration, the OSPF neighbor relationship fails to form. Which action must the engineer take to resolve the issue?

Accepted Answer

Configure the same MD5 key and key ID on the neighboring router's interface.. OSPF MD5 authentication requires that both neighbors have the same key ID and key string configured on their interfaces. The local router is correctly configured for MD5, but the neighbor lacks the matching key, causing authentication to fail. Configuring the identical key on the neighbor's interface will allow the adjacency to form.

Answer

Configure the ip ospf authentication-key command with the same password.

Answer

Change the key ID to 0 on both routers to match the default key.

Answer

Enable OSPF authentication globally using the area authentication command.

Question 10

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer wants to limit ICMP echo requests destined to the router to 100 packets per second, while allowing other traffic. Which configuration snippet correctly applies CoPP for this purpose?

Accepted Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
control-plane
 service-policy input CoPP. CoPP is implemented by defining a class-map to match traffic, a policy-map to police it, and then applying the policy-map to the control plane with 'service-policy input' under the 'control-plane' configuration mode. The correct snippet uses an ACL to match ICMP echo requests, polices them at 100 pps, and applies the policy to the control plane. This protects the route processor from excessive ICMP traffic while allowing other traffic.

Answer

class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input CoPP

Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy output CoPP

Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
control-plane
 service-policy output CoPP

Question 11

What is the default BGP keepalive timer value in Cisco IOS-XE?

Accepted Answer

60 seconds. The default BGP keepalive timer is 60 seconds, as defined in RFC 4271 and implemented in Cisco IOS-XE.

Answer

30 seconds

Answer

90 seconds

Answer

180 seconds

Question 12

A network engineer is implementing FlexVPN with IKEv2 between a hub and multiple spokes. The hub uses a single IKEv2 profile and a single IPsec profile. The engineer wants to ensure that each spoke can authenticate using a unique pre-shared key. Which IKEv2 keyring configuration should be used on the hub?

Accepted Answer

A single keyring with multiple peer entries, each specifying a different pre-shared key and matching the spoke's IP address.. FlexVPN supports a single IKEv2 keyring with multiple peer entries. Each peer entry can specify a unique pre-shared key and match criteria based on the spoke's identity, such as IP address or FQDN. The hub's IKEv2 profile references this keyring, and during IKEv2 authentication, the hub selects the appropriate key based on the peer's identity. This allows unique keys per spoke without needing multiple profiles or keyrings.

Answer

A single keyring with multiple peer entries, each specifying the same pre-shared key but different identities.

Answer

Multiple keyrings, each with a single peer entry, and multiple IKEv2 profiles referencing each keyring.

Answer

A single keyring with a single peer entry using a wildcard pre-shared key that matches all spokes.

Question 13

What is the default number of packets sent per IP SLA UDP Jitter operation?

Accepted Answer

10. The default number of packets sent per IP SLA UDP Jitter operation is 10. This is defined in the Cisco IOS IP SLA configuration, where the 'udp-jitter' operation type uses a default packet count of 10 for each probe. The jitter operation sends these packets at a configurable interval (default 20 ms) to measure delay, jitter, and packet loss.

Answer

1

Answer

20

Answer

100

Question 14

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. Phase 1 completes successfully, but Phase 2 fails. The administrator sees the log message 'QM FSM error' on the initiator. Which configuration mismatch is the most likely cause?

Accepted Answer

Mismatched transform sets. A QM FSM error during Phase 2 typically points to a mismatch in the quick mode parameters, most commonly the transform set. The transform set defines the encryption and authentication algorithms for the IPsec SA. If the initiator proposes a transform set that the responder does not have configured or does not support, the responder may reject the proposal, causing the initiator to log a QM FSM error. Verifying that both peers have identical transform sets resolves the issue.

Answer

Mismatched encryption algorithm in Phase 1

Answer

Mismatched DH group in Phase 1

Answer

Mismatched IKEv1 pre-shared keys

Question 15

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail GigabitEthernet0/0

IP-EIGRP interfaces for process 100

Interface                    Peers  Xmit Queue   Mean   Pacing Time   Multicast    Pending
                              Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0                          1       0/0       10       0/10          50           0
  Hello interval: 5 sec, Hold time: 15 sec
  Split horizon is enabled
  Summary address: 10.0.0.0/8
  Next xmit serial <none>
  Un/reliable mcasts: 0/0  Un/reliable ucasts: 0/0
  Mcast exceptions: 0  CR packets: 0  ACKs suppressed: 0
  Retransmissions: 0  Retry timer: 15
  Hello packets sent: 100, received: 99

Based on this output, what is the purpose of the summary address configured on this interface?

Accepted Answer

It advertises a summary route 10.0.0.0/8 to neighbors.. The 'Summary address: 10.0.0.0/8' line shows that a manual summary route is configured on this interface, which will be advertised to EIGRP neighbors.

Answer

It filters all routes in the 10.0.0.0/8 range.

Answer

It redistributes connected routes.

Answer

It disables split horizon.