300-410 Practice Test 23 — 15 Questions

Question 1

A large enterprise network is experiencing intermittent connectivity failures for VoIP traffic traversing a DMVPN hub-and-spoke topology. Hub router R1 has the following relevant configuration: ip nat inside source list 100 interface Tunnel0 overload. Spoke router R2 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 10.1.1.1 192.168.1.1 203.0.113.1 203.0.113.1. VoIP calls drop after 30 seconds. What is the root cause?

Accepted Answer

Configure ip nat translation timeout 60 for UDP to align with VoIP timers.. The issue is that PAT overload on the DMVPN tunnel interface causes NAT entries to be created for VoIP traffic, but the default NAT timeout (24 hours for TCP, 300 seconds for UDP) does not match the DMVPN tunnel keepalive or VoIP session timers. When the tunnel rekeys or the VoIP session refreshes, the NAT entry may be stale, causing asymmetric routing or dropped packets. The correct fix is to adjust NAT timeouts or use route-map to exempt VoIP traffic from NAT.

Answer

Add ip nat inside source list 100 interface Tunnel0 overload to the spoke router.

Answer

Change the DMVPN tunnel mode to GRE over IPsec with no NAT.

Answer

Use ip nat outside source list 100 interface Tunnel0 overload.

Question 2

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal hosts can access the internet, but traffic to a specific external server at 203.0.113.200 is being dropped. Router R1 shows: show ip nat statistics: Total active translations: 1000. Debug ip nat: NAT: s=192.168.1.1->203.0.113.1, d=203.0.113.200 [0]. The external server shows no received packets. What is the root cause?

Accepted Answer

The router does not have a route to 203.0.113.200; configure a default route or specific route.. The debug shows successful NAT translation, but the packet is still dropped. This could be due to a route issue: the router may not have a route to 203.0.113.200, or the next-hop is unreachable. The correct fix is to check the routing table for the destination.

Answer

The access-list 100 is blocking the destination.

Answer

The NAT translation is failing due to port exhaustion.

Answer

The external server is blocking the source IP.

Question 3

A network engineer is troubleshooting a router that has been running for 200 days. The router experiences a sudden reboot, and after reload, the configuration is missing. 'show startup-config' returns 'startup-config is not present'. The engineer checks the boot variable: 'boot system flash:ios-image.bin'. What is the most likely cause of the configuration loss?

Accepted Answer

The engineer did not execute 'copy running-config startup-config' before the reboot.. The router likely has a corrupt NVRAM or the startup configuration was never saved. However, the key clue is that the router has been running for 200 days without a save, and the 'copy running-config startup-config' was not performed, so the startup-config is empty or missing.

Answer

The router's NVRAM has a hardware failure and lost the configuration.

Answer

The 'boot system' command points to a TFTP server that also contains a configuration file, overwriting the local startup-config.

Answer

The router's configuration register is set to 0x2142, ignoring startup-config.

Question 4

An engineer is troubleshooting a router that is not sending syslog messages to the syslog server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap informational'. The engineer can ping the syslog server from the router. 'show logging' shows that the logging buffer is filling with messages. What is the most likely cause?

Accepted Answer

The 'logging source-interface' command is missing, causing syslog messages to use an incorrect source IP.. The router has logging to a remote host configured, but the 'logging source-interface' is missing, so syslog messages are sourced from the outgoing interface IP, which may not be reachable or may be filtered by the server.

Answer

The syslog server is not listening on UDP port 514.

Answer

The 'logging on' command is not configured.

Answer

The syslog server's IP address is incorrect in the configuration.

Question 5

A network engineer is troubleshooting a router that is not responding to ICMP echo requests from a management station at 10.10.10.1. The router has an ACL applied to the VTY lines that permits only 10.10.10.0/24. The engineer can telnet to the router from the management station. What is the most likely cause?

Accepted Answer

An inbound ACL on the interface denies ICMP from 10.10.10.1.. Telnet is permitted by the VTY ACL, but ICMP is controlled by an interface ACL or the global 'ip icmp rate-limit' feature. The most likely cause is an inbound ACL on the interface that denies ICMP from the management station.

Answer

The VTY ACL also applies to ICMP traffic.

Answer

The router has 'no ip icmp echo' configured globally.

Answer

The management station is not in the routing table of the router.

Question 6

An engineer is troubleshooting a router that is configured as an NTP client. The router's clock is not synchronizing with the NTP server at 192.168.1.1. 'show ntp status' shows 'clock is unsynchronized', and 'show ntp associations' shows the server as '.INIT.' with no reachability. The engineer can ping the NTP server. What is the most likely cause?

Accepted Answer

The NTP server is not configured to respond to NTP requests from this client.. The NTP server may be reachable via ping, but NTP uses UDP port 123. The router may have an ACL blocking NTP traffic, or the NTP server may not be responding. However, a common issue is that the NTP server is not configured to serve time to the client, or the client's NTP source interface is incorrect.

Answer

The router's 'ntp source' command is missing, causing NTP packets to use an incorrect source IP.

Answer

The router's clock is set too far in the future, causing NTP to reject the server's time.

Answer

The router has 'ntp authenticate' enabled without the proper key.

Question 7

Router R1 is performing NAT for internal users to access the internet. The configuration includes: ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal hosts cannot reach a specific external server at 203.0.113.50. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 10.1.1.1 192.168.1.1 203.0.113.50 203.0.113.50. Debug ip nat shows 'NAT: translation failed (no buffer)'. What is the root cause?

Accepted Answer

The NAT translation table is full; clear the table with clear ip nat translation *.. The 'no buffer' error indicates that the NAT translation table is full, typically due to an exhaustion of available ports for PAT. This can happen if many connections are initiated but not closed, or if the NAT pool is too small. The correct fix is to increase the number of available ports or clear stale entries.

Answer

The access-list 100 is misconfigured and blocking the server's IP.

Answer

The interface GigabitEthernet0/1 is down.

Answer

The external server is unreachable due to routing issues.

Question 8

A network engineer is troubleshooting a router that is not responding to SNMP polls from the NMS at 10.1.1.100. The SNMP configuration includes 'snmp-server community public RO' and 'snmp-server community private RW'. The engineer can ping the router from the NMS. 'show snmp' shows SNMP is enabled. What is the most likely cause?

Accepted Answer

An ACL is applied to the SNMP community that denies the NMS IP.. The router has SNMP communities configured, but an ACL may be applied to the community that restricts access. The most common issue is an access-list applied to the community string that does not permit the NMS IP.

Answer

The NMS is using the wrong SNMP version.

Answer

The router's SNMP agent is disabled due to high CPU.

Answer

The NMS is using the wrong community string.

Question 9

In a multi-VRF environment, Router R1 is leaking routes between VRF A and VRF B using route-target import/export. Hosts in VRF A can ping hosts in VRF B, but traffic from VRF B to VRF A fails when NAT is applied on the VRF A egress interface. Configuration: ip nat inside source list 100 interface GigabitEthernet0/1 vrf A overload. Router R1 shows: show ip nat translations vrf A: no entries. What is the root cause?

Accepted Answer

The NAT command is missing the 'vrf A' keyword; it should be ip nat inside source list 100 interface GigabitEthernet0/1 vrf A overload.. NAT configuration for VRF A requires the 'vrf' keyword to be specified in the NAT command. Without it, NAT does not operate within the VRF context. The missing 'vrf A' in the NAT configuration means that traffic from VRF B to VRF A is not translated, causing asymmetric routing or unreachability.

Answer

The route leaking is misconfigured; use route-map to filter routes.

Answer

The access-list 100 is blocking VRF B traffic.

Answer

The interface GigabitEthernet0/1 is not in VRF A.

Question 10

An engineer is troubleshooting a router that is configured to archive configurations to a TFTP server at 192.168.1.10. The 'archive' configuration includes 'path tftp://192.168.1.10/config-archive' and 'write-memory'. The engineer notices that the archive is not being created after 'copy running-config startup-config'. What is the most likely cause?

Accepted Answer

The TFTP server does not have write permissions for the directory.. The archive 'write-memory' command triggers an archive when the startup-config is written, but the TFTP server may not allow file creation, or the path is incorrect. A common issue is that the TFTP server requires a filename, not a directory path, or the server is not reachable.

Answer

The 'archive' configuration is missing the 'time-period' command.

Answer

The router's 'file prompt quiet' command is configured, suppressing error messages.

Answer

The TFTP server's IP address is incorrect in the path.

Question 11

A network engineer is troubleshooting a router that is not allowing SSH connections from any management station. The router has 'ip domain-name example.com' and 'crypto key generate rsa' configured. 'line vty 0 4' has 'transport input ssh' and 'login local'. The engineer can ping the router from a management station. What is the most likely cause?

Accepted Answer

The RSA key was generated with a modulus less than 768 bits, causing SSH to fail.. SSH requires proper AAA or local authentication, and the VTY lines must have 'login local' or AAA configured. However, a common issue is that the RSA key is not generated with sufficient modulus size (minimum 768 bits for SSHv2).

Answer

The VTY lines are missing the 'login local' command.

Answer

The router has 'ip ssh version 1' configured, and the client only supports SSHv2.

Answer

The management station is using the wrong username or password.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                           (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:12:34   10   200  0  15
1   192.168.2.2             Gi0/1            10 00:10:22   12   200  0  22
2   10.10.10.2              Gi0/2            14 00:08:15   15   200  0  18

Based on this output, which statement is correct?

Accepted Answer

All EIGRP neighbors are operating normally.. The output shows three EIGRP neighbors with normal hold timers and uptimes. The Q count is 0 for all, indicating no queued packets. The SRTT and RTO values are low, indicating good network conditions. There is no problem evident in this output.

Answer

Neighbor 192.168.1.2 has a high SRTT indicating a slow link.

Answer

Neighbor 10.10.10.2 is experiencing packet loss due to high RTO.

Answer

The Q count of 0 indicates that EIGRP is not exchanging routes.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2      1   FULL/DR         00:00:35    192.168.1.2     Gi0/0
192.168.2.2      1   2WAY/DROTHER    00:00:38    192.168.2.2     Gi0/1
10.10.10.2       1   FULL/BDR        00:00:32    10.10.10.2      Gi0/2

Based on this output, what is a potential issue?

Accepted Answer

All OSPF neighbors are in appropriate states for their roles.. On interface Gi0/1, the neighbor is in 2WAY/DROTHER state, which is normal for a non-DR/BDR router on a multi-access network. However, the question asks for a potential issue; the output itself shows no problem. The correct answer is that all neighbors are in expected states.

Answer

Neighbor 192.168.2.2 is stuck in 2WAY state, indicating a problem.

Answer

The DR election is incomplete on Gi0/0.

Answer

Neighbor 10.10.10.2 should be in FULL/DR state.

Question 14

What is the default OSPF dead interval on an Ethernet broadcast network?

Accepted Answer

40 seconds. The default OSPF dead interval is 4 times the hello interval. On broadcast networks (like Ethernet), the default hello interval is 10 seconds, so the dead interval is 40 seconds.

Answer

10 seconds

Answer

30 seconds

Answer

120 seconds

Question 15

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1002    1000       10    0    0 00:15:30        5
192.168.2.2     4        65003    1005    1003       10    0    0 00:14:20        3
10.10.10.2      4        65004       0       0        0    0    0 00:00:05 Idle

Based on this output, what is the problem with neighbor 10.10.10.2?

Accepted Answer

The BGP session is not established; possible misconfiguration or reachability issue.. Neighbor 10.10.10.2 is in Idle state, with very few messages exchanged (0 MsgRcvd, 0 MsgSent) and a short uptime (5 seconds). This indicates the BGP session is not established, likely due to a configuration issue or connectivity problem.

Answer

The neighbor is administratively shut down.

Answer

The neighbor is in the process of establishing the session.

Answer

The neighbor has sent all its prefixes and is waiting for updates.