300-410 Practice Test 4 — 25 Questions

Question 1

A network engineer runs the following command to verify NetFlow export on an interface:

R1# show ip flow interface

GigabitEthernet0/0
  ip flow ingress
  ip flow egress

GigabitEthernet0/1
  ip flow ingress

What does this output indicate?

Accepted Answer

NetFlow is enabled on GigabitEthernet0/0 for both ingress and egress, and on GigabitEthernet0/1 for ingress only.. The 'show ip flow interface' output lists each interface and the direction(s) in which NetFlow is enabled. GigabitEthernet0/0 shows both 'ip flow ingress' and 'ip flow egress', meaning NetFlow captures traffic in both directions. GigabitEthernet0/1 shows only 'ip flow ingress', meaning only ingress traffic is captured. Option B accurately reflects this.

Answer

NetFlow is enabled only on GigabitEthernet0/0 for both directions.

Answer

NetFlow is enabled on GigabitEthernet0/0 for ingress only.

Answer

NetFlow is not enabled on any interface.

Question 2

A network engineer runs the following command to troubleshoot SNMP access lists:

R1# show snmp access
Access-list: 10
Community: public
View: v1default

Access-list: 20
Community: private
View: v1default

What does this output indicate?

Accepted Answer

SNMP access is controlled by ACLs: ACL 10 for 'public' and ACL 20 for 'private'.. The 'show snmp access' output displays the configured SNMP access control entries, which map community strings to access control lists (ACLs). In this case, ACL 10 is associated with the 'public' community and ACL 20 with the 'private' community, meaning SNMP access is restricted based on these ACLs. This is the standard method for controlling SNMPv1/v2c access, as the router uses the ACL to permit or deny SNMP requests from specific source IP addresses.

Answer

No ACLs are applied to SNMP, so all access is allowed.

Answer

The router uses SNMPv3 exclusively.

Answer

The 'public' community has read-write access.

Question 3

Which default administrative distance is assigned to a directly connected interface route?

Accepted Answer

0. Directly connected routes have a default administrative distance of 0, indicating the highest preference.

Answer

1

Answer

5

Answer

110

Question 4

Drag and drop the steps to configure SNMPv3 with auth-priv and verify traps into the correct order, from first to last.

Accepted Answer

Configure SNMPv3 group with auth-priv security level. First, define the SNMPv3 group with security model and privacy settings. Next, create the user with authentication and privacy passwords. Then, enable SNMP traps globally. After that, specify the trap receiver host with the correct security parameters. Finally, verify the configuration using show snmp user and show snmp host.

Question 5

Which EIGRP packet type is used to confirm receipt of a reliable update?

Accepted Answer

ACK. In EIGRP, reliable updates (Update, Query, Reply) require acknowledgment. The ACK packet is a Hello packet with the Acknowledgment field set, and it is used to confirm receipt of a reliable update. It is not a separate packet type but a function of the Hello packet.

Answer

Hello

Answer

Update

Answer

Reply

Question 6

A network engineer runs the following command to troubleshoot a VRF-Lite IPsec issue:

R1# show crypto ipsec transform-set vrf CUSTOMER_H

Output:
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel,  }

What does this output indicate?

Accepted Answer

The transform set uses ESP with AES 256 and SHA-HMAC in tunnel mode.. The 'show crypto ipsec transform-set vrf' command displays the IPsec transform set for a specific VRF. The output shows a transform set named 'combined' that uses ESP with AES 256-bit encryption and SHA-HMAC authentication. It will negotiate a tunnel mode (as opposed to transport mode).

Answer

The transform set uses ESP with AES 256 and SHA-HMAC in transport mode.

Answer

The transform set uses AH with AES 256 and MD5.

Answer

The transform set does not specify any encryption or authentication.

Question 7

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Accepted Answer

The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.. Private VLAN (PVLAN) on VLAN 20 isolates ports within the same VLAN, preventing direct communication between hosts on isolated ports. Even though the hosts share the same VLAN, PVLAN restricts traffic so that isolated ports can only communicate with a promiscuous port (e.g., a router uplink), not with each other. This directly explains why IPv6 hosts on VLAN 20 cannot ping each other.

Answer

IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.

Answer

RA Guard is blocking Neighbor Advertisements between hosts.

Answer

DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Question 8

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor whether the packet loss stops. This isolation test directly correlates the applet's activity with the symptom. If packet loss ceases when the applet is disabled, it confirms the applet as the root cause.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 9

Which TWO statements correctly describe the behavior of OSPFv3 when troubleshooting neighbor adjacency issues on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

OSPFv3 neighbor adjacencies are formed using the link-local IPv6 address of the neighbor.. Option A is correct because OSPFv3 forms neighbor adjacencies over IPv6 link-local addresses, which are used as the source and next-hop for Hello packets on the link. Option D is correct because the 'show ipv6 ospf neighbor' command output includes the neighbor's link-local address, which is essential when troubleshooting adjacency issues. Option B is incorrect because the OSPFv3 router ID is a 32-bit value, not 128-bit, and is typically derived from an IPv4 address or manually configured. Option C is incorrect because OSPFv3 is enabled on an interface with the 'ipv6 ospf area ' command, while 'ipv6 router ospf' enters the OSPFv3 process configuration mode. Option E is incorrect because OSPFv3 network type is configured per interface, not globally under the OSPFv3 process.

Answer

The OSPFv3 router ID is a 128-bit value derived from the highest loopback IPv6 address.

Answer

The 'ipv6 router ospf' command is used to enable OSPFv3 on an interface.

Answer

OSPFv3 uses the network type configured under the OSPFv3 process globally, not per interface.

Question 10

Which TWO statements about the syslog message format and its fields are correct? (Choose TWO.)

Accepted Answer

The facility code in a syslog message identifies the type of process that generated the message, such as local7 (value 23).. The only correct statement is A. The facility code identifies the type of process that generated the message (local7 is facility 23). B is incorrect because severity 0 is Emergency, not Debugging. C is incorrect because Cisco IOS does not add sequence numbers by default; this requires the service sequence-numbers command. D is incorrect because the default Cisco syslog timestamp is not DD/MM/YYYY; the default format is typically *HH:MM:SS or MMM DD YYYY HH:MM:SS when timestamps are enabled. E is incorrect because the hostname field uses the device's configured hostname, not the IP address.

Answer

The severity level in a syslog message ranges from 0 (debugging) to 7 (emergency).

Answer

By default, Cisco IOS includes a sequence number in every syslog message when logging is enabled.

Answer

The timestamp in a syslog message from a Cisco device is formatted as DD/MM/YYYY HH:MM:SS by default.

Answer

The hostname field in a syslog message is derived from the IP address of the interface that sends the message.

Question 11

An engineer is troubleshooting an EIGRP issue where a router is not learning any routes from a neighbor, but the neighbor adjacency is up. The engineer checks the EIGRP topology table on the local router and sees that the neighbor is listed, but no routes from that neighbor are present. The engineer also verifies that the neighbor has routes to advertise. What is the most likely cause?

Accepted Answer

The neighbor is configured as an EIGRP stub router.. When an EIGRP neighbor adjacency is up but no routes are received from the neighbor, the most likely cause is that the neighbor is configured as an EIGRP stub router. A stub router advertises only a default route or its directly connected and summary routes, depending on the stub setting, and does not advertise all learned routes. Since the engineer confirmed the neighbor has routes to advertise, the stub configuration on the neighbor would prevent those routes from being sent, even though the adjacency remains established.

Answer

The local router has a distribute-list out applied to the neighbor.

Answer

The EIGRP metric weights are different on the two routers.

Answer

The local router has a route-map applied to the EIGRP process that is filtering all routes.

Question 12

Drag and drop the steps to verify and validate route redistribution operational state into the correct order, from first to last.

Accepted Answer

Check routing table for redistributed prefixes. Verification of redistribution starts with checking the routing table for redistributed routes, then examining the specific protocol database, followed by verifying the redistribution configuration, then checking for administrative distance issues, and finally using traceroute to validate the path. This order confirms routes are present, correctly sourced, and reachable.

Question 13

Examine the following configuration on a PE router:

ip vrf CUSTOMER-E
 rd 400:1
 route-target export 400:1
 route-target import 400:2
!
interface GigabitEthernet0/5
 ip vrf forwarding CUSTOMER-E
 ip address 10.4.4.1 255.255.255.252
!
router bgp 65000
 neighbor 10.0.0.1 remote-as 65000
 neighbor 10.0.0.1 update-source Loopback0
!
 address-family vpnv4
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community extended
 exit-address-family
!
 address-family ipv4 vrf CUSTOMER-E
  neighbor 10.4.4.2 remote-as 65003
  neighbor 10.4.4.2 activate
  neighbor 10.4.4.2 route-map SET-COMMUNITY in
 exit-address-family
!
route-map SET-COMMUNITY permit 10
 set community 100:100

What is the effect of the route-map on the incoming routes from the CE?

Accepted Answer

The route-map will set the standard community 100:100 on the routes received from the CE, but the RT is still determined by the route-target export command.. The route-map SET-COMMUNITY is applied inbound on the BGP session with the CE, so it sets the standard community 100:100 on routes received from the CE. However, the route-target (RT) for the VRF is determined by the route-target export command under the VRF configuration, not by the standard community set by the route-map. The RT is a BGP extended community used for VPN route distribution, and it is separate from standard communities.

Answer

The route-map will override the route-target export and set the RT to 100:100.

Answer

The route-map will cause the BGP session to reset because the community format is incorrect.

Answer

The route-map will have no effect because the community is not sent to the CE.

Question 14

What is the default action for a packet that does not match any route-map entry in a PBR policy?

Accepted Answer

The packet is forwarded using the routing table.. Policy-Based Routing (PBR) via route-maps uses an implicit deny at the end of the route-map, but 'deny' in a route-map used for PBR means 'do not policy-route this packet' — the packet is then forwarded normally using the routing table. This differs from route-maps used for route redistribution, where an implicit deny means the route is not redistributed. The key distinction is the context: PBR route-maps fall through to normal destination-based forwarding.

Answer

The packet is dropped.

Answer

The packet is sent to the CPU for processing.

Answer

The router sends an ICMP unreachable message.

Question 15

What is the default behavior of PBR when a 'set ip next-hop' and a 'set ip default next-hop' are both configured in the same route-map entry?

Accepted Answer

The 'set ip next-hop' is used if reachable; otherwise, the 'set ip default next-hop' is used if the routing table has no explicit route.. In PBR, 'set ip next-hop' and 'set ip default next-hop' have distinct semantics: 'set ip next-hop' is evaluated first and used if the specified next hop is reachable; 'set ip default next-hop' is only used when the routing table has no explicit route for the destination. When both are configured in the same route-map entry, the router prefers the explicit next-hop if reachable, falling back to the default next-hop only when no explicit route exists.

Answer

The 'set ip default next-hop' is always used first.

Answer

Both are used simultaneously, and the router load-balances.

Answer

The router ignores both and uses the routing table.

Question 16

In VRF-Lite, which routing protocols can be used within a VRF?

Accepted Answer

OSPF, EIGRP, RIP, and BGP can all be configured per VRF.. VRF-Lite supports running any standard routing protocol independently within each VRF, including OSPF, EIGRP, RIP, and BGP. Each VRF maintains its own routing table and protocol instance, so you configure the protocol under the VRF address family or with the 'vrf' keyword. This per-VRF isolation is the core value of VRF-Lite — multiple virtual routing domains on one physical router.

Answer

Only static routing is supported in VRF-Lite.

Answer

Only OSPF and EIGRP are supported in VRF-Lite.

Answer

BGP cannot be used within a VRF in VRF-Lite.

Question 17

Consider the following BGP configuration with BFD:

router bgp 65000
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 fall-over bfd
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.252
 bfd interval 200 min_rx 200 multiplier 4
!

What is the effect of the 'neighbor fall-over bfd' command?

Accepted Answer

BGP will use BFD for fast failure detection; if BFD goes down, BGP will reset the session immediately.. The 'neighbor fall-over bfd' command enables BGP to use BFD for fast failure detection. When BFD detects a failure, BGP will immediately tear down the peering session without waiting for the hold timer.

Answer

BGP will use BFD to detect link failures, but the BGP hold timer still applies.

Answer

BGP will ignore the BFD session and continue using its own keepalive/hold mechanism.

Answer

The 'fall-over bfd' command is only needed if BFD timers are less than 100 ms.

Question 18

Which TWO statements about MPLS label imposition, disposition, and swapping are true? (Choose TWO.)

Accepted Answer

Penultimate Hop Popping (PHP) reduces the processing load on the egress LSR by having the penultimate LSR pop the label.. Option A is correct because Penultimate Hop Popping (PHP) lets the penultimate LSR pop the MPLS label before forwarding the packet to the egress LSR, so the egress LSR receives a plain IP packet and avoids an extra label lookup, reducing its processing load. Option B is correct because a core/intermediate LSR performs the label swap operation, replacing the incoming label value with the outgoing label value from its LFIB (LIB) entry before forwarding the frame. Option C is wrong because label imposition (push) is performed by the ingress LSR (ingress edge LER), not the egress LSR, which performs disposition (pop) or receives an already-popped packet. Option D is wrong because PHP is a normal behavior between adjacent LSRs and does not require the egress LSR to be non-adjacent to the penultimate LSR. Option E is wrong because PHP is enabled by default on Cisco IOS routers (the implicit null label is advertised), not disabled by default requiring explicit configuration.

Answer

The egress LSR performs label imposition (push) before forwarding the IP packet to the destination.

Answer

PHP is enabled only when the egress LSR is not directly connected to the penultimate LSR.

Answer

By default, PHP is disabled on Cisco IOS routers and must be explicitly configured.

Question 19

Given the following partial configuration on router R1:

ip sla 10
 icmp-echo 192.168.1.1 source-ip 10.0.0.1
 frequency 10
ip sla schedule 10 life forever start-time now

Which statement best describes the effect of this configuration?

Accepted Answer

It sends ICMP echo requests from 10.0.0.1 to 192.168.1.1 every 10 seconds.. The ip sla 10 configuration defines an ICMP echo operation with destination 192.168.1.1 and source-ip 10.0.0.1, with a frequency of 10 seconds. The ip sla schedule 10 life forever start-time now activates it immediately and indefinitely, so R1 sends ICMP echo requests from 10.0.0.1 to 192.168.1.1 every 10 seconds.

Answer

It sends ICMP echo requests from 192.168.1.1 to 10.0.0.1 every 10 seconds.

Answer

It sends ICMP echo requests every 10 seconds but only after the first successful reply.

Answer

It sends ICMP echo requests only once and then stops.

Question 20

Given this IP SLA configuration on router R4:

ip sla 40
 icmp-echo 10.10.10.1 source-ip 172.16.1.1
 frequency 15
ip sla schedule 40 life forever start-time now

Which statement is true?

Accepted Answer

The source IP 172.16.1.1 must be configured on an interface of R4.. In Cisco IOS IP SLA ICMP-echo operations, the source-ip specified must be a valid IP address configured on a local interface of the router (or reachable via a loopback). The router uses this address as the source of the ICMP echo packets, so it must be locally assigned; otherwise the operation cannot source the probe and will fail. This makes option A correct.

Answer

The source IP 172.16.1.1 can be any IP address, even if not local.

Answer

The operation will fail because frequency 15 is too high.

Answer

The operation will use TCP instead of ICMP.