300-410 Practice Test 4 — 25 Questions

Question 1

R1 and R2 are connected via an IPsec VPN tunnel. R1 has a static route to 10.10.10.0/24 pointing to the tunnel interface. R2 has a static route to 192.168.1.0/24 pointing to the tunnel interface. Both routers have BGP configured between loopback addresses over the tunnel. BGP peering is established, but R1 cannot ping 10.10.10.1 (R2's loopback) from its loopback. R1's show ip bgp shows the route as valid but not best. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The static route to 10.10.10.0/24 via tunnel causes recursive routing failure because the tunnel destination is not reachable.. R1's static route to 10.10.10.0/24 points to the tunnel interface, but the tunnel destination (the remote peer's public IP) is not reachable via a valid routing path. This creates a recursive routing failure: the router tries to resolve the tunnel interface's next-hop (the tunnel destination) but cannot find a route to it, causing the BGP route to be marked as valid but not best. Without a reachable tunnel destination, the IPsec VPN cannot forward traffic, so pings from R1's loopback to 10.10.10.1 fail.

Answer

BGP next-hop-self is not configured on R2.

Answer

The IPsec tunnel is not encrypting BGP traffic.

Answer

The BGP network statement for 10.10.10.0/24 is missing on R2.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 1
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 1

Based on this output, what is the problem?

Accepted Answer

The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.. The output shows a single dynamic NAT translation with zero hits and zero misses, meaning no traffic has attempted to traverse the NAT process. This indicates the translation entry exists (likely from a previous or idle session) but no packets have matched the access list or triggered translation since the counters were cleared. The problem is that the NAT configuration is in place but not actively translating any traffic.

Answer

The NAT pool is exhausted.

Answer

PAT is misconfigured.

Answer

The inside and outside interfaces are reversed.

Question 3

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show snmp. The `show snmp` command displays the overall SNMP agent configuration, including contact, location, community strings, and SNMP version. The `show snmp host` command lists the configured SNMP notification receivers (trap or inform destinations) and verifies that the router is correctly configured to send SNMP messages to the management station. Together, these two commands confirm both the agent's operational state and its connectivity to remote hosts.

Answer

show snmp group

Answer

show snmp user

Answer

debug snmp packets

Question 4

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip access-lists CoPP-ACL
extended IP access list CoPP-ACL
    10 permit eigrp any any (100 matches)
    20 permit ospf any any (50 matches)
    30 permit bgp any any (200 matches)
    40 deny ip any any (0 matches)

What does this output indicate?

Accepted Answer

CoPP is permitting routing protocol traffic, including EIGRP, OSPF, and BGP, which are used for route summarization. No drops indicate CoPP is not blocking summarization.. This output shows an access list used for Control Plane Policing (CoPP). The match counts indicate that EIGRP, OSPF, and BGP traffic are being permitted. The absence of matches on the deny statement suggests that no traffic is being dropped, which could indicate that CoPP is not affecting route summarization traffic.

Answer

CoPP is dropping all routing protocol traffic, preventing route summarization.

Answer

CoPP is only allowing BGP traffic, blocking EIGRP and OSPF summarization.

Answer

CoPP is not configured because the access list is empty.

Question 5

Which TWO statements about EEM environment variables and their scoping are true? (Choose TWO.)

Accepted Answer

Environment variables defined using the 'event manager environment' global configuration command are available to all EEM applets on the device.. The correct answers are A and E. Option A is correct because EEM environment variables set with the 'event manager environment' global configuration command are global and available to all applets on the device. Option E is correct because the '$_syslog_msg' variable is only populated when the applet is triggered by a syslog event; it is not available for other event types. Option B is incorrect because variables set with 'action set' within an applet are local to that applet and are not automatically shared with other applets. Option C is incorrect because the '$_cli_msg' variable, when used with 'event cli', does not contain the full command line including parameters; it only contains the command keyword. Option D is incorrect because there is no standard EEM variable '$_event_pub_sec'; the correct variable for event publish security information is '$_event_pub_sec_name' or similar, but not as described.

Answer

Variables set within an applet using the 'action set' command are automatically available to other applets running on the same device.

Answer

The '$_cli_msg' variable, when used with 'event cli', contains the full command line that triggered the event, including any parameters.

Answer

The '$_event_pub_sec' variable provides the priority and severity of the event that triggered the applet.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.1.0
Routing entry for 192.168.1.0/24
  Known via "ospf 1", distance 110, metric 20, type extern 2, forward metric 100
  Redistributing via ospf 1
  Last update from 10.1.1.2 on GigabitEthernet0/1, 00:00:05 ago
  Routing Descriptor Blocks:
  * 10.1.1.2, from 10.1.1.2, 00:00:05 ago, via GigabitEthernet0/1
      Route metric is 20, traffic share count is 1

Based on this output, what is the problem?

Accepted Answer

The route is being redistributed back into OSPF, which could cause a routing loop if not filtered.. The output shows a route learned via OSPF with type extern 2 and metric 20. The route is also 'Redistributing via ospf 1', meaning this router is redistributing this route back into OSPF. This could cause a routing loop if the route is redistributed back into the same OSPF process from which it was learned. The problem is that the route is being redistributed without filtering, potentially causing loops.

Answer

The route is an external OSPF route with metric 20, which is the default for Type 2 external routes.

Answer

The forward metric is 100, which is the metric to the ASBR.

Answer

The route is learned from neighbor 10.1.1.2, which is the next hop.

Question 7

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

Accepted Answer

The flow monitor is not associated with any flow exporter.. A flow exporter must be associated with the flow monitor. If the monitor does not reference the exporter, no data is exported even if flows are cached.

Answer

The flow exporter is configured with the wrong destination IP address.

Answer

The flow exporter is missing the 'source' interface command.

Answer

The flow cache is full, preventing new exports.

Question 8

Which TWO statements about the 'distance' command in Cisco IOS routing protocols are true? (Choose TWO.)

Accepted Answer

Under EIGRP, the 'distance eigrp

' command sets different ADs for internal and external routes.. The distance command can be used to modify the administrative distance for routes learned via a routing protocol. It can be applied globally or with an access-list or prefix-list to match specific routes. The command does not affect the AD of routes from other protocols. The distance value must be between 1 and 255. The command can be used under EIGRP, OSPF, RIP, and BGP, but the syntax varies slightly.

Answer

The 'distance' command can be used to change the AD of connected routes.

Answer

The 'distance' command requires a route-map to match specific prefixes in all routing protocols.

Answer

The 'distance' command can be used to set an AD of 0 for a specific route.

Question 9

OSPF network type mismatch on a multi-access link is causing route summarization issues. Router R1 and R2 are connected via Ethernet, but R1 has:
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
!
Router R2 has default OSPF network type (broadcast). R1 is configured with:
router ospf 1
 area 0 range 10.0.0.0 255.255.255.0
!
R2 shows:
R2# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.1          0   FULL/  -        00:00:30    10.0.0.1        GigabitEthernet0/0
But R2 does not have the summary route in its routing table. What is the root cause?

Accepted Answer

R1 is not an ABR (only area 0), so the area range command does not generate a summary route.. The network type mismatch (point-to-point on R1, broadcast on R2) prevents proper adjacency formation. Although the neighbor state shows FULL, the DR/BDR election is affected. R1's point-to-point setting means it does not participate in DR election, and R2 expects a DR. This can cause LSA flooding issues, and the area range summary may not be advertised correctly. The summary route is generated by the ABR, but if R1 is not an ABR (area 0 only), the range command has no effect. The root cause is that R1 is not an ABR, so area range does not apply.

Answer

The network type mismatch causes OSPF to not exchange LSAs correctly, preventing the summary.

Answer

The summary route is suppressed because the interface is point-to-point.

Answer

R2 has a static route that overrides the summary.

Question 10

An enterprise uses EIGRP for IPv6 with route redistribution from a static route. R1 has a static route 2001:db8:0::/32 via Null0 redistributed into EIGRP. R2 receives this route and has a more specific route 2001:db8:1::/32 via a different interface. R2 has an IPv6 ACL applied inbound on the interface facing R1 that permits only EIGRP and denies all other traffic. R2's uRPF is configured in loose mode. Traffic from R2 to 2001:db8:2::1 fails. R2 shows 'show ipv6 route' has both routes, but 'show ipv6 cef' shows the summary route for 2001:db8:2::1 pointing to R1. What is the root cause?

Accepted Answer

The summary route 2001:db8:0::/32 on R1 points to Null0, causing traffic to be dropped at R1.. R1's static route 2001:db8:0::/32 via Null0 is redistributed into EIGRP, and R2 learns this summary route. When R2 sends traffic to 2001:db8:2::1, the CEF table (show ipv6 cef) shows the longest prefix match for 2001:db8:2::1 is the summary 2001:db8:0::/32 pointing to R1, not the more specific 2001:db8:1::/32. R1 then forwards the packet to Null0 (a virtual interface that drops traffic), causing the failure. The more specific route 2001:db8:1::/32 on R2 is not used because 2001:db8:2::1 does not fall within that prefix.

Answer

The ACL on R2 blocks the return traffic from R1, causing asymmetric routing.

Answer

uRPF loose mode drops the packet because the source address is not in the FIB.

Answer

EIGRP redistribution of the static route creates a routing loop between R1 and R2.

Question 11

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show policy-map control-plane input class class-default

Class-map: class-default (match-any)
  0 packets, 0 bytes
  5 minute offered rate 0 bps, drop rate 0 bps
  Match: any
  police:
      cir 1000000 bps, bc 31250 bytes, be 31250 bytes
    conformed 0 packets, 0 bytes; actions:
      transmit
    violated 0 packets, 0 bytes; actions:
      drop
    conformed 0 bps, exceed 0 bps, violated 0 bps

What does this output indicate?

Accepted Answer

The CoPP policy is not matching any traffic, indicating a possible ACL or class-map misconfiguration.. The output shows zero packets matched in class-default, meaning no traffic is being classified by the CoPP policy. This indicates a possible misconfiguration in the ACL or class-map that defines the traffic to be policed, causing the policy to be effectively inactive. A correctly configured CoPP policy would show non-zero packet counts for matched traffic.

Answer

The CoPP policy is dropping all traffic due to a misconfigured CIR.

Answer

The CoPP policy is working correctly and policing traffic at 1 Mbps.

Answer

The CoPP policy is only applied to the output direction.

Question 12

A network engineer is troubleshooting an OSPFv2 route flapping issue. The router R1 is learning a route to 192.168.1.0/24 via two different paths: one through R2 and one through R3. The route is flapping between the two paths every few seconds. 'show ip ospf interface' shows that both interfaces are stable. What is the most likely cause?

Accepted Answer

The routers R2 and R3 have the same OSPF router ID.. Route flapping can be caused by a number of issues, but if the interfaces are stable, the problem is likely due to a routing loop or a metric issue. One common cause is that the routers are using the same router ID, causing OSPF to see the same route from two different neighbors as equal-cost paths, but the route may be flapping due to a change in the metric. Another cause is that the link between R1 and R2 is flapping at Layer 1, but the stem says the interfaces are stable. The most likely cause is that the routers have duplicate router IDs, which can cause OSPF to treat the same route as two different routes and cause instability.

Answer

The route is being redistributed by both R2 and R3 with different metrics.

Answer

The OSPF network type on the interfaces is set to broadcast, causing DR/BDR instability.

Answer

The link between R1 and R2 has a high error rate causing intermittent packet loss.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip bgp 10.1.1.0/24
BGP routing table entry for 10.1.1.0/24, version 10
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.2.2.2 from 10.2.2.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0
      Community: 100:200

Based on this output, what is the problem?

Accepted Answer

The route 10.1.1.0/24 is redistributed from an IGP into BGP, as indicated by the 'Local' path.. The output shows a BGP route with 'Local' as the path, meaning it was redistributed into BGP locally. The origin is IGP, and the community is 100:200. The route is valid and best. However, the 'Local' path indicates redistribution from an IGP into BGP, which is common in redistribution scenarios.

Answer

The route 10.1.1.0/24 is learned via an eBGP session and has a local preference of 100.

Answer

The community 100:200 is automatically assigned by BGP for all redistributed routes.

Answer

The route is not being advertised to any peers because it is not marked as best.

Question 14

A network engineer runs the following command on Router R1:

R1# show snmp user

User name: monitor
Engine ID: 800000090300001122334455
storage-type: nonvolatile
Authentication Protocol: MD5
Privacy Protocol: DES
Group-name: readonly

User name: admin
Engine ID: 800000090300AABBCCDDEEFF
storage-type: nonvolatile
Authentication Protocol: SHA
Privacy Protocol: AES256
Group-name: admin

Based on this output, which statement is correct?

Accepted Answer

The 'monitor' user uses deprecated authentication and privacy protocols.. The 'monitor' user is configured with MD5 for authentication and DES for privacy. Both MD5 and DES are considered deprecated in SNMPv3 due to known security vulnerabilities; RFC 3414 defines MD5 as a weaker authentication protocol, and DES (56-bit key) is no longer recommended for encryption. The output confirms these protocols are in use, making option A correct.

Answer

The 'admin' user can only read MIB objects.

Answer

Both users use the same engine ID.

Answer

The 'monitor' user cannot authenticate because MD5 is not supported.

Question 15

A network engineer runs the following command on Router PE2:

PE2# show ip bgp vpnv4 vrf CUSTOMER_A 10.10.10.0 24
BGP routing table entry for 10.10.10.0/24, version 15
Paths: (1 available, best #1, table CUSTOMER_A)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  Local, imported path from 10.10.10.0/24
    10.1.1.1 (metric 20) from 10.1.1.1 (10.1.1.1)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:100:100
      mpls labels in/out 18/19

Based on this output, what is the problem?

Accepted Answer

The route is functioning correctly with no issues.. The output shows a VPNv4 route for VRF CUSTOMER_A. The route is marked as 'imported path from 10.10.10.0/24', which indicates it was imported from the global table or another VRF. The route is valid and best, with labels assigned. No problem is indicated; the route is functioning correctly.

Answer

The route is not being advertised to any BGP peer.

Answer

The route is missing the required Route Target community.

Answer

The route has an incorrect label binding.

Question 16

An engineer must enable BFD for an OSPF single-hop session between two directly connected routers. Which TWO configuration changes are required on each router? (Choose TWO.)

Accepted Answer

Configure the bfd interval command under the interface.. To enable BFD for OSPF, you must first enable BFD on the interface (bfd interval) and then enable BFD support under the OSPF routing process or interface (ip ospf bfd). The bfd neighbor command is for static BFD sessions, not OSPF. The router ospf command alone does not enable BFD. The bfd all-interfaces command enables BFD on all OSPF interfaces but still requires interface-level BFD configuration.

Answer

Configure the bfd neighbor command under global configuration.

Answer

Configure the router ospf command and then use the bfd all-interfaces command.

Answer

Configure the bfd slow-timers command under the interface.

Question 17

A network engineer runs the following command to debug IPv6 uRPF:

R1# debug ipv6 verify
IPv6 verify debugging is on

*Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0
*Mar 1 00:02:34.567:   no route to source

What does this output indicate?

Accepted Answer

The packet will be dropped because uRPF cannot find a route to the source address.. The debug output shows that uRPF (unicast Reverse Path Forwarding) checked the source address 2001:DB8:4::1 on the incoming interface GigabitEthernet0/0 and found no route to that source in the IPv6 routing table. When uRPF is enabled and a packet arrives on an interface, the router performs a reverse path lookup: it checks whether the best return route to the source address points back to the same interface. If no route exists at all, the lookup fails, and uRPF considers the source as unreachable, causing the packet to be dropped. This is a strict-mode uRPF behavior, and the debug message 'no route to source' confirms the packet will be discarded.

Answer

The packet will be forwarded because uRPF only checks the destination.

Answer

The packet will be forwarded because the source is on the same interface.

Answer

The router will add a route to the source address.

Question 18

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode

Based on this output, which statement is true?

Accepted Answer

uRPF is enabled in strict mode. The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 19

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Accepted Answer

IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.. IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.

Answer

IPv6 uRPF checks the destination address of incoming packets.

Answer

IPv6 uRPF is used to filter multicast traffic.

Question 20

A network engineer runs the following command to verify NetFlow export destination:

R1# show ip flow export

Flow export v9 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Destination(1)  192.168.1.100 (2055)
  Source IP         10.0.0.1
  Origin AS         65000
  Peer AS           65001
  Mask for source   255.255.255.255
  Mask for destination 255.255.255.255
  Version 9 flow records
  1234 flows exported in 567 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

What does this output indicate?

Accepted Answer

NetFlow export is successful with 1234 flows exported and no errors.. The output shows that NetFlow export is working correctly. It is exporting version 9 flows to destination 192.168.1.100 on port 2055, using source IP 10.0.0.1. There are no failures or drops, indicating successful export.

Answer

NetFlow export is failing due to adjacency issues.

Answer

NetFlow is using version 5 export.

Answer

The export destination is not configured.