300-410 Practice Test 22 — 15 Questions

Question 1

An engineer enables 'ipv6 destination guard' on a switch to prevent IPv6 address spoofing. After configuration, a legitimate host on a port is unable to receive traffic from the network, although it can send traffic. The host has a global unicast address. The switch logs show that destination guard is dropping packets destined to that host. What is the most likely cause?

Accepted Answer

The host uses IPv6 privacy extensions and changes its address frequently, but the binding table only has the original address.. IPv6 Destination Guard validates destination addresses against the binding table. If the host's address is not in the binding table (e.g., because the host did not send an NA or the binding timed out), the switch drops packets destined to that address. The edge case is that Destination Guard requires the binding to be in 'REACHABLE' state. If the host is silent for a long time, the binding may become 'STALE' and eventually 'DELAY' or 'PROBE', but Destination Guard still accepts traffic as long as the binding exists. However, if the binding is removed due to a timeout or if the host's address was never learned (e.g., the host uses privacy extensions and changes its address frequently), Destination Guard will drop traffic. The most likely oversight is that the host uses temporary addresses (privacy extensions) that are not registered in the binding table because the switch only learns the initial address from the first NA.

Answer

Destination Guard blocks all global unicast addresses by default.

Answer

The switch port is not configured as 'trusted' for destination guard.

Answer

The host is using a link-local address, which destination guard does not support.

Question 2

A network engineer configures 'ipv6 snooping' globally on a switch and applies 'ipv6 verify source' on a port connected to a router running OSPFv3. The router's OSPFv3 neighborship with another router across the switch fails. The switch logs show that OSPFv3 packets are being dropped. The engineer checks the binding table and sees no entries for the router's link-local address. What is the most likely reason?

Accepted Answer

Source Guard does not learn link-local addresses via ND snooping, so OSPFv3 packets are dropped.. IPv6 Snooping and Source Guard typically rely on ND snooping to populate the binding table. However, OSPFv3 uses link-local addresses for communication, and link-local addresses are not learned via ND snooping because they are derived from the interface MAC address and are not advertised in NAs. The switch does not create binding entries for link-local addresses unless explicitly configured. Therefore, Source Guard drops OSPFv3 packets because the source link-local address is not in the binding table. The edge case is that IPv6 First Hop Security features often overlook link-local addresses, causing routing protocol failures.

Answer

OSPFv3 uses multicast addresses that are blocked by Source Guard.

Answer

The router must be configured as a static binding for its link-local address.

Answer

The switch must have 'ipv6 snooping' enabled on the VLAN, not globally.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three PAT translations using the interface address (192.0.2.10) with unique source ports (10000, 10001, 10002). This is correct PAT operation. The statistics show hits and no misses, indicating proper function.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 4

Which TCP flag combination triggers the NAT translation timeout to change from the default to the 'ip nat translation tcp-timeout' value?

Accepted Answer

FIN or RST. When a TCP connection is closed, the FIN or RST flag causes the NAT entry to use the shorter tcp-timeout (default 60 seconds) instead of the general timeout.

Answer

SYN

Answer

ACK

Answer

URG

Question 5

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration enables NAT overload (PAT) for the 192.168.1.0/24 network, translating all inside addresses to the IP of GigabitEthernet0/1 (203.0.113.1) with port multiplexing.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 6

An engineer configures 'ipv6 nd suppress' on a switch port to prevent the switch from sending Router Advertisements. However, after this configuration, hosts on that port cannot obtain IPv6 addresses via SLAAC, even though a router on another port is sending RAs. What is the most likely explanation?

Accepted Answer

The 'ipv6 nd suppress' command blocks all RA traffic on the port, including RAs forwarded from other ports.. The 'ipv6 nd suppress' command on a switch port prevents the switch from sending RAs, but it does not forward RAs from other routers. In fact, on some platforms, 'ipv6 nd suppress' also blocks the forwarding of RAs received on other ports to that port, because the switch treats the port as a host port. This is an edge case where the command is misunderstood: it suppresses all RA traffic on that port, both outgoing and incoming (forwarded). The hosts never receive the router's RAs.

Answer

The router's RAs are being filtered by an ACL on the switch.

Answer

The hosts must be configured to use DHCPv6 instead of SLAAC.

Answer

The switch port is in a different VLAN than the router.

Question 7

A network administrator configures 'ipv6 dhcp guard' on a switch and sets the policy to 'allow only' for a specific DHCPv6 server. However, clients are still receiving DHCPv6 replies from a rogue server on the same VLAN. The engineer verifies that the rogue server's port is not trusted. What is the most likely reason the rogue server's advertisements are not being blocked?

Accepted Answer

IPv6 snooping is not enabled globally, so DHCPv6 Guard cannot inspect DHCPv6 messages.. DHCPv6 Guard works by intercepting DHCPv6 server messages (Advertise and Reply) and checking them against the policy. However, if the switch does not have 'ipv6 snooping' enabled globally, DHCPv6 Guard may not be able to inspect the packets because it relies on the snooping database. The edge case is that DHCPv6 Guard requires IPv6 snooping to be enabled to function properly; without it, the guard may not be applied or may not filter correctly. Many engineers forget to enable 'ipv6 snooping' globally.

Answer

The rogue server is using a different UDP port for DHCPv6.

Answer

The 'allow only' policy only works for DHCPv6 requests, not replies.

Answer

The rogue server is on a trunk port, and DHCPv6 Guard does not apply to trunk ports.

Question 8

What is the problem with this NAT configuration?

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

Accepted Answer

The interface GigabitEthernet0/1 is missing the 'ip nat outside' command.. The outside interface (GigabitEthernet0/1) is missing the 'ip nat outside' command, which is required for NAT to function.

Answer

The ACL is too permissive; it should only permit specific hosts.

Answer

The 'overload' keyword is unnecessary for this configuration.

Answer

The inside interface should be GigabitEthernet0/1.

Question 9

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Static NAT requires defining a one-to-one mapping between inside local and inside global addresses, and then applying the ip nat inside and ip nat outside commands on the respective interfaces.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 10

Given this configuration:

ip nat pool GLOBAL 203.0.113.1 203.0.113.10 prefix-length 28
ip nat inside source list 10 pool GLOBAL overload
access-list 10 permit 10.0.0.0 0.255.255.255

What is the effect?

Accepted Answer

Inside hosts matching ACL 10 are translated to addresses in the pool using PAT.. This uses a pool of addresses with PAT (overload). Inside hosts matching ACL 10 are translated to one of the pool addresses with port multiplexing.

Answer

All inside hosts are translated to the first pool address only.

Answer

Each inside host gets a unique pool address without port translation.

Answer

The prefix-length 28 is invalid; a netmask must be used instead.

Question 11

Which THREE symptoms indicate that NAT is misconfigured or failing on a Cisco router? (Choose THREE.)

Accepted Answer

Inside hosts can ping the outside interface IP but cannot reach hosts beyond it.. Common NAT failure symptoms include: inability to ping from inside to outside (no translation), asymmetric routing causing one-way traffic, and translation table exhaustion. The other options describe unrelated issues.

Answer

The router's CPU utilization is high due to BGP process.

Answer

The show ip route command shows a default route pointing to the ISP next hop.

Question 12

According to RFC 2663, what is the term for the process of translating both the source and destination IP addresses in a packet?

Accepted Answer

Twice NAT. RFC 2663 defines 'Twice NAT' as the process where both source and destination addresses are translated, typically used when address spaces overlap.

Answer

Static NAT

Answer

PAT

Answer

Double NAT

Question 13

An engineer configures 'ipv6 verify source' with 'allow-default' on a switch port connected to a router that uses a default route via a static route. The router's traffic is being dropped by Source Guard. The engineer sees that the router's source address is in the binding table. What is the most likely cause?

Accepted Answer

The 'allow-default' option only permits traffic with source address matching the default route entry, not all traffic.. The 'allow-default' option in 'ipv6 verify source' allows traffic with a source address that matches the default route (::/0) in the binding table. However, this option only works if the binding table has an entry for the default prefix (::/0). If the router's traffic is being dropped, it might be because the router is using a global unicast source address that is not the default route. The edge case is that 'allow-default' is often misunderstood: it does not allow all traffic; it only allows traffic whose source address matches a binding entry for the default route. If the router's source address is a specific global address, that address must be in the binding table individually. The engineer likely thought 'allow-default' would permit all traffic, but it only permits traffic from the default prefix.

Answer

The router's source address is a link-local address, which is not supported by Source Guard.

Answer

The 'allow-default' option requires the router to send an NA for the default route.

Answer

The switch port must be configured as 'trusted' for Source Guard to work with routers.

Question 14

A network engineer is troubleshooting a router that is not sending SNMP traps to the NMS server at 10.1.1.100. The SNMP configuration includes 'snmp-server enable traps' and 'snmp-server host 10.1.1.100 version 2c public'. The engineer can ping the NMS server from the router, and 'show snmp' indicates SNMP is enabled. What is the most likely cause of the missing traps?

Accepted Answer

The 'snmp-server trap-source' command is missing, causing traps to use an incorrect source IP.. The router has SNMP traps enabled and a host configured, but the 'snmp-server trap-source' command is missing, causing traps to be sourced from an interface that may not be reachable or may have an incorrect source IP that the NMS expects.

Answer

The NMS server is not listening on UDP port 162.

Answer

The SNMP community string 'public' is not configured on the router.

Answer

The router's ACL is blocking outbound UDP traffic to port 162.

Question 15

An engineer is troubleshooting a router that fails to write its running configuration to startup configuration using 'copy running-config startup-config'. The command returns 'Destination filename [startup-config]?' and then the prompt returns without error. 'show startup-config' shows an empty configuration. What is the most likely cause?

Accepted Answer

The router is configured to boot from a TFTP server using the 'boot host' command, and the TFTP server is unreachable or does not allow writes.. The router may have insufficient space in NVRAM or the startup configuration file may be corrupted. However, a common issue is that the router is booting from a network server (TFTP) and the 'boot host' command points to a remote file, so 'copy running-config startup-config' attempts to write to the remote server but fails silently.

Answer

The NVRAM is full and the router cannot save the configuration.

Answer

The 'file prompt quiet' command is configured, suppressing prompts.

Answer

The router is running in ROMMON mode.