300-410 Practice Test 2 — 25 Questions

Question 1

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

Accepted Answer

The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.. The ACL denies ICMPv6 types 133-137, which are essential for Neighbor Discovery (ND) processes such as Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). Without permitting these types, the router cannot resolve IPv6 neighbors or maintain IPv6 connectivity, as ND is fundamental to IPv6 operation.

Answer

The ACL must be applied outbound, not inbound, to allow ND packets to be sent.

Answer

The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.

Answer

The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.

Question 2

A network engineer runs the following command to verify DHCPv6 pool configuration on router R1:

R1# show ipv6 dhcp pool

Output:
 Pool DHCPv6_POOL :
   Prefix number: 1
   Prefix: 2001:DB8:1::/48
       Preferred lifetime 604800, valid lifetime 2592000
       Expires at Mar 01 2025 12:00 PM (2592000 seconds)
   DNS server: 2001:DB8::1
   Domain name: example.com
   Active clients: 5

What does this output indicate?

Accepted Answer

The DHCPv6 pool has 5 active clients and provides prefix delegation, DNS, and domain name.. The output shows a DHCPv6 pool configured with prefix delegation (2001:DB8:1::/48), DNS server, and domain name, along with 5 active clients. This confirms that the pool is used for stateful DHCPv6 (prefix delegation) and provides additional options, making option A correct.

Answer

The DHCPv6 pool is used only for stateless address autoconfiguration (SLAAC).

Answer

The DHCPv6 pool has 5 clients with addresses from the prefix 2001:DB8:1::/48.

Answer

The DHCPv6 pool has a preferred lifetime of 2592000 seconds.

Question 3

Drag and drop the steps to configure a DHCP pool and relay agent on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure DHCP pool with network and mask. First, you must define the DHCP pool with a name and network. Then, you set the default router and DNS server. Next, you exclude any addresses from the pool. Finally, you enable the DHCP relay agent on the interface facing clients to forward requests to the DHCP server.

Question 4

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check client interface for DHCP state and IP. Begin by checking the DHCP client's interface for an IP address and DHCP state. Then, verify that the relay agent is configured and reachable. Next, confirm that the DHCP server is reachable from the relay. After that, inspect access lists or firewall rules that might block DHCP traffic. Finally, review debug output to isolate the failure point.

Question 5

Drag and drop the steps to verify and validate DHCP (IPv4 and IPv6) operational state into the correct order, from first to last.

Accepted Answer

Display DHCP pool statistics and bindings. Start by checking the DHCP pool utilization and bindings. Then, verify that clients have received addresses from the correct pool. Next, confirm that the DHCP relay agent is forwarding packets. After that, validate DHCPv6 prefix delegation if used. Finally, ensure that the DHCP server is not running out of addresses.

Question 6

Which TWO statements about DHCPv6 prefix delegation are true? (Choose TWO.)

Accepted Answer

The delegating router must have a DHCPv6 pool configured with a prefix-delegation statement.. Option B is correct because the delegating router (DHCPv6 server) must have a DHCPv6 pool configured with a prefix-delegation statement to define the prefix pool from which it can assign prefixes to requesting routers. This is a mandatory configuration for the server to provide prefix delegation as per RFC 3633.

Answer

The requesting router uses the IA_NA option to request a prefix.

Answer

The delegating router must be configured with 'ipv6 dhcp server' under the downstream interface facing the requesting router.

Answer

The requesting router can only use the delegated prefix on the interface that received it.

Question 7

Drag and drop the steps for MPLS LDP label discovery and distribution into the correct order, from first to last.

Accepted Answer

Establish TCP connection on port 646. LDP label discovery and distribution begins with sending Hello messages to multicast 224.0.0.2 (UDP). Once a Hello is received, a LDP adjacency is formed directly, then a TCP connection on port 646 is established between the peers. After TCP is up, label mapping messages are exchanged. Finally, the learned labels populate the Label Information Base (LIB). The correct order is: B (Hello), C (adjacency), A (TCP connection), D (label mapping), E (LIB). Note that adjacency is formed before the TCP connection because LDP uses a two-phase discovery process.

Question 8

A network engineer configures a DHCP snooping trusted port on a switch to allow a legitimate DHCP server. However, clients connected to untrusted ports on the same VLAN cannot obtain IP addresses. The DHCP server is reachable and the switch shows no DHCP snooping drops. Which is the most likely explanation?

Accepted Answer

The DHCP server is not configured to trust the relay agent information option (option 82), causing it to discard the requests.. When DHCP snooping is enabled, the switch inserts the relay agent information option (option 82) into DHCP requests received on untrusted ports. If the DHCP server is not configured to trust or process option 82, it will discard these requests, preventing clients from obtaining IP addresses even though the switch reports no drops. This is the most likely cause because the DHCP server is reachable and the switch shows no drops, indicating the issue lies with how the server handles the relayed packets.

Answer

The trusted port is in the wrong VLAN; DHCP snooping only works when the trusted port is in the same VLAN as the clients.

Answer

The switch has 'ip dhcp snooping verify mac-address' enabled, causing MAC address mismatches.

Answer

The DHCP server is not configured with the correct subnet for the client VLAN.

Question 9

Drag and drop the steps for verifying and validating MPLS operations operational state into the correct order, from first to last.

Accepted Answer

Display MPLS forwarding table with show mpls forwarding-table. Start by confirming MPLS is enabled on interfaces (show mpls ip interface), then verify LDP peer state (show mpls ldp neighbor), review label bindings (show mpls ldp bindings), display the MPLS forwarding table (show mpls forwarding-table), and finally validate the LSP path (traceroute mpls ipv4).

Question 10

An engineer configures a DHCP server on a Cisco router to assign IP addresses from a pool. Clients receive addresses, but when the engineer checks 'show ip dhcp binding', no bindings are displayed. Which is the most likely explanation?

Accepted Answer

The 'ip dhcp excluded-address' command includes the entire pool range, so no addresses are assigned and no bindings are created.. The 'show ip dhcp binding' command only displays bindings that are currently active. If the lease time is very short or the clients release addresses, bindings may not appear. However, a more subtle edge case is when the DHCP server is configured with 'ip dhcp excluded-address' that includes the pool range, causing the server to not assign addresses but still respond with NAKs.

Answer

The DHCP pool is configured with 'lease infinite', causing bindings to be stored in a different database.

Answer

The router's DHCP server is configured in 'database' mode, which stores bindings externally.

Answer

The clients are using DHCPv6, not DHCPv4.

Question 11

An engineer configures DHCPv4 on a router with multiple pools for different subnets. Clients in subnet A receive addresses correctly, but clients in subnet B receive addresses from subnet A's pool. The router has 'ip dhcp relay' configured. Which is the most likely explanation?

Accepted Answer

The DHCP server selects the pool based on the giaddr; if the relay agent does not set the giaddr correctly, the server may use the first matching pool.. Option A is correct because when a DHCP relay agent forwards a client's request to the server, it inserts its own IP address (the interface address on the client's subnet) into the giaddr (gateway IP address) field. The DHCP server uses this giaddr to select the appropriate pool. If the relay agent fails to set the giaddr correctly—for example, due to misconfiguration or the relay interface not being on the correct subnet—the server may receive a giaddr of 0.0.0.0 or an incorrect address, causing it to fall back to the first configured pool that matches, which in this case is subnet A's pool.

Answer

The pools are configured in the wrong order; the server uses the first pool that matches the client's MAC address.

Answer

The router has 'ip dhcp smart-relay' enabled, which overrides pool selection.

Answer

The DHCP server is configured with 'network' statements that overlap.

Question 12

An engineer configures DHCPv6 prefix delegation on a router with multiple requesting interfaces. The router receives a /48 prefix from the server, but only one interface gets a /64 sub-prefix. Which is the most likely explanation?

Accepted Answer

Only one interface is configured with 'ipv6 address prefix-name ::1:0:0:0:1/64' using the delegated prefix; other interfaces lack this configuration.. Option A is correct because the router receives a /48 prefix from the DHCPv6 server, but each requesting interface must explicitly reference the delegated prefix using the 'ipv6 address prefix-name' command to derive a /64 sub-prefix. If only one interface has this configuration, only that interface will obtain a /64 sub-prefix; the other interfaces lack the necessary command to consume the delegated prefix.

Answer

The DHCPv6 server only delegates a single /64 prefix, not a /48.

Answer

The router's 'ipv6 dhcp client pd' command is missing the 'rapid-commit' option.

Answer

The router has 'ipv6 dhcp client information refresh' set to a high value, delaying updates.

Question 13

A network engineer is troubleshooting PAT (overload) on a Cisco router. The inside network uses 192.168.1.0/24, and the outside interface has IP 198.51.100.1. The engineer configured 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. Traffic from inside hosts works initially, but after a few minutes, new connections fail. 'Show ip nat translations' shows many entries with the same outside global IP but different ports. 'Show ip nat statistics' indicates that the number of translations is near 500. What is the most likely cause?

Accepted Answer

The router has run out of available port numbers for PAT.. The router is using PAT (Port Address Translation) with overload, which maps multiple inside local IP addresses to a single outside global IP (198.51.100.1) by using unique source port numbers. With approximately 500 active translations and the router nearing the default limit of around 500 PAT entries (or the available port range of 1024–65535 being exhausted), new connections fail because no unique port numbers are available to assign. This is the classic symptom of PAT port exhaustion.

Answer

The NAT pool is not configured with overload.

Answer

The outside interface is flapping, causing translations to be cleared.

Answer

The access list is denying some inside hosts.

Question 14

A network engineer is troubleshooting NAT for a VoIP phone that uses SIP. The phone is at 192.168.2.10, and the router performs PAT to the outside interface 198.51.100.1. The phone can register with the SIP server, but calls fail after 30 seconds. The engineer notices that the SIP signaling includes the phone's private IP in the SDP body. What is the most likely cause?

Accepted Answer

The router's SIP ALG is disabled, so the private IP in the SDP is not translated.. The SIP signaling includes the phone's private IP in the SDP body, which is used for media negotiation. When the router's SIP Application Layer Gateway (ALG) is disabled, it does not inspect and translate the private IP addresses embedded in the SDP payload. As a result, the SIP server sends media (RTP) to the private IP 192.168.2.10, which is unreachable from outside, causing the call to fail after the initial registration and signaling succeed.

Answer

The PAT port range is exhausted.

Answer

The phone's default gateway is misconfigured.

Answer

The outside interface has a firewall blocking UDP ports.

Question 15

An engineer applies a CoPP policy to a router to protect the control plane. The policy includes a class-map that matches all ICMP traffic and polices it to 5000 bps. After the policy is applied, the engineer notices that OSPF adjacencies are going down. The OSPF hello packets are not being received. What is the most likely cause?

Accepted Answer

The CoPP policy has a default class that drops all unmatched traffic, including OSPF packets.. The CoPP policy includes a class-map that matches only ICMP traffic, but when applied, it uses a default class that drops all unmatched traffic. OSPF hello packets, which are not ICMP, fall into this default class and are dropped, causing adjacencies to fail. This is a common misconfiguration where the policy lacks an explicit permit for essential control plane protocols like OSPF.

Answer

The CoPP policy is policing OSPF packets because the class-map matches all IP traffic, not just ICMP.

Answer

The OSPF hello packets are being rate-limited because they are ICMP packets.

Answer

The CoPP policy is applied to the wrong interface, causing OSPF packets to be dropped.

Question 16

An engineer configures EIGRP named mode on a router. The neighbor adjacency forms, but the router does not install any routes from the neighbor. The engineer checks and confirms that the neighbor is not configured as a stub. What is the most likely explanation?

Accepted Answer

The 'af-interface' has 'split-horizon' enabled by default, preventing the neighbor from advertising routes learned from the same interface.. In EIGRP named mode, the 'af-interface' configuration applies by default with 'split-horizon' enabled. Split-horizon prevents a router from advertising a route back out the interface from which it was learned. If the neighbor is reachable via the same interface and the only routes it has are those learned from this router, split-horizon blocks those routes from being advertised back, resulting in no routes being installed. This is a common pitfall in named mode because the default behavior differs from classic mode where split-horizon is disabled for EIGRP. The adjacency forms because hello packets are exchanged, but route exchange is blocked by split-horizon. Options A, C, and D are incorrect: default-information is not relevant unless default routes are involved; metric weights mismatch would prevent adjacency; log-neighbor-changes only affects logging, not route installation.

Answer

The 'default-information' is not allowed in named mode by default, so default routes are not accepted.

Answer

The 'metric weights' are mismatched between the two routers.

Answer

The 'log-neighbor-changes' command is missing, causing route installation to be suppressed.

Question 17

A network engineer configures CoPP on a router to limit ICMP traffic to 5000 bps. After the policy is applied, the engineer notices that the router is not responding to ping requests from a remote network. However, the router can ping other devices successfully. The engineer checks the CoPP statistics and sees that the ICMP class has dropped packets. What is the most likely root cause?

Accepted Answer

The CoPP policy is dropping incoming ICMP echo requests because the police rate is too low.. The CoPP policy is applied to control plane traffic, which includes ICMP echo requests destined to the router itself. When the police rate is set to 5000 bps, incoming ICMP echo requests are rate-limited and dropped if they exceed this threshold, causing the router to stop responding to pings. The fact that the router can still ping other devices confirms that the data plane is unaffected, isolating the issue to control plane policing of inbound ICMP.

Answer

The CoPP policy is dropping outgoing ICMP echo replies because the police rate applies to both directions.

Answer

The router's interface ACL is blocking incoming ICMP traffic.

Answer

The router's ICMP rate-limit feature is enabled globally.

Question 18

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: CoPP-SSH (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 110
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      1250 packets, 75000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: any

Based on this output, which statement is correct?

Accepted Answer

The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.. The output shows that the CoPP-ICMP and CoPP-SSH class-maps have zero packets matched (0 packets, 0 bytes), indicating that no traffic has been classified into these classes. This means the policy is not matching any ICMP or SSH packets, likely because the access-lists (100 and 110) are not correctly defined or applied, or the traffic is not reaching the control plane. Option B correctly identifies this lack of matching.

Answer

The CoPP policy is dropping all ICMP packets to the control plane.

Answer

The CoPP policy is rate-limiting SSH traffic to 16000 bps.

Answer

The CoPP policy is applied to the output direction.

Question 19

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      500 packets, 30000 bytes
      5 minute offered rate 1000 bps, drop rate 500 bps
      Match: access-group 120
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 300 packets, 18000 bytes; actions:
          transmit
        exceeded 100 packets, 6000 bytes; actions:
          drop
        violated 100 packets, 6000 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

BGP traffic is being rate-limited and some packets are being dropped.. The output shows that under the CoPP-BGP class, the police command has a committed information rate (CIR) of 8000 bps. The counters indicate 100 packets exceeded and 100 packets violated, both with a drop action, while only 300 packets conformed and were transmitted. This confirms that BGP traffic is being rate-limited and some packets are being dropped, making option B correct.

Answer

All BGP packets are being transmitted without any drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching BGP traffic.

Question 20

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip interface GigabitEthernet0/1 | include access list
  Outgoing access list is 140
  Inbound access list is not set

Then the engineer runs:
R1# show ip access-lists 140
Extended IP access list 140
    10 deny icmp any any
    20 permit ip any any

What does this output indicate?

Accepted Answer

ACL 140 is applied outbound on GigabitEthernet0/1, denying ICMP and permitting all other traffic.. The output of 'show ip interface GigabitEthernet0/1 | include access list' shows 'Outgoing access list is 140', confirming ACL 140 is applied outbound on that interface. The ACL contains two entries: 'deny icmp any any' (sequence 10) and 'permit ip any any' (sequence 20). Access control lists are processed top-down, so for any outgoing traffic, the first matching entry determines the action. ICMP traffic matches the deny icmp entry first and is therefore blocked. All other IP traffic does not match the first entry but matches the permit ip any any and is permitted. Thus, ACL 140 denies ICMP and permits all other IP traffic outbound.

Answer

ACL 140 is applied inbound on GigabitEthernet0/1, blocking ICMP.

Answer

ACL 140 is not applied to any interface.

Answer

ACL 140 is applied both inbound and outbound.