300-410 Practice Test 5 — 25 Questions

Question 1

An engineer enables 'ipv6 destination guard' on a switch to prevent IPv6 address spoofing. After configuration, a legitimate host on a port is unable to receive traffic from the network, although it can send traffic. The host has a global unicast address. The switch logs show that destination guard is dropping packets destined to that host. What is the most likely cause?

Accepted Answer

The host uses IPv6 privacy extensions and changes its address frequently, but the binding table only has the original address.. Option A is correct because IPv6 destination guard relies on the IPv6 neighbor discovery (ND) binding table to validate destination addresses. If the host uses IPv6 privacy extensions (RFC 4941), it generates temporary addresses that change frequently. The binding table only contains the original address learned from the initial ND exchange, so packets destined to the new temporary address are dropped as spoofed, even though the traffic is legitimate.

Answer

Destination Guard blocks all global unicast addresses by default.

Answer

The switch port is not configured as 'trusted' for destination guard.

Answer

The host is using a link-local address, which destination guard does not support.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three dynamic NAT translations, all using the same inside global address 192.0.2.10 with unique source ports (10000, 10001, 10002). This is the hallmark of Port Address Translation (PAT) or NAT overload, where multiple inside hosts (10.0.0.10, 10.0.0.11, 10.0.0.12) share a single public IP address by differentiating sessions via layer-4 port numbers. The 'overload' keyword in the dynamic mapping confirms PAT is active and working correctly.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 3

A network administrator configures 'ipv6 dhcp guard' on a switch and sets the policy to 'allow only' for a specific DHCPv6 server. However, clients are still receiving DHCPv6 replies from a rogue server on the same VLAN. The engineer verifies that the rogue server's port is not trusted. What is the most likely reason the rogue server's advertisements are not being blocked?

Accepted Answer

IPv6 snooping is not enabled globally, so DHCPv6 Guard cannot inspect DHCPv6 messages.. DHCPv6 Guard relies on IPv6 snooping (also known as DHCPv6 snooping) to inspect DHCPv6 messages and enforce policies. If IPv6 snooping is not enabled globally on the switch, DHCPv6 Guard has no binding database or inspection mechanism to identify and block rogue DHCPv6 replies, even if the policy is configured and the rogue port is untrusted. The 'ipv6 dhcp guard' command alone is insufficient without the underlying snooping framework.

Answer

The rogue server is using a different UDP port for DHCPv6.

Answer

The 'allow only' policy only works for DHCPv6 requests, not replies.

Answer

The rogue server is on a trunk port, and DHCPv6 Guard does not apply to trunk ports.

Question 4

What is the problem with this NAT configuration?

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

Accepted Answer

The interface GigabitEthernet0/1 is missing the 'ip nat outside' command.. The configuration is missing the 'ip nat outside' command on interface GigabitEthernet0/1. For NAT to function, Cisco IOS requires that the inside interface be marked with 'ip nat inside' and the outside interface with 'ip nat outside'. Without this, the router does not know which interface is the external (outside) interface, and the NAT translation will not be applied to outgoing packets.

Answer

The ACL is too permissive; it should only permit specific hosts.

Answer

The 'overload' keyword is unnecessary for this configuration.

Answer

The inside interface should be GigabitEthernet0/1.

Question 5

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Option A is correct because the 'ip nat inside source static' command in global configuration mode defines the static one-to-one mapping between an inside local (private) IP address and an inside global (public) IP address. This is the fundamental configuration step for static NAT, as it creates the permanent translation entry in the NAT table without requiring dynamic address pools or access lists.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 6

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are not being established. The hub router has 'ip nhrp redirect' enabled, and spokes have 'ip nhrp shortcut' enabled. The engineer notices that when a spoke sends traffic to another spoke, the hub forwards the traffic correctly, but the spoke does not initiate an NHRP resolution request to the destination spoke. The spoke's routing table shows the destination subnet via the hub. What is the most likely cause?

Accepted Answer

The hub's NHRP authentication is configured but the spoke's is not.. In DMVPN phase 2, spoke-to-spoke tunnels require NHRP resolution requests from the spoke. The hub forwards these requests to the destination spoke. If NHRP authentication is configured on the hub but not on the spoke, the spoke's NHRP packets (including resolution requests) will be rejected by the hub because the authentication key does not match. This prevents the spoke from receiving NHRP replies necessary to establish the shortcut. Since the stem states that spokes have 'ip nhrp shortcut' enabled, the missing authentication is the most likely cause. Option D accurately describes this mismatch.

Answer

The spoke's tunnel interface does not have 'ip nhrp shortcut' enabled.

Answer

The hub's tunnel interface does not have 'ip nhrp redirect' enabled.

Answer

The spoke's routing table has a static route to the destination subnet via the hub.

Question 7

In a multi-VRF environment, Router R1 is leaking routes between VRF A and VRF B using route-target import/export. Hosts in VRF A can ping hosts in VRF B, but traffic from VRF B to VRF A fails when NAT is applied on the VRF A egress interface. Configuration: ip nat inside source list 100 interface GigabitEthernet0/1 vrf A overload. Router R1 shows: show ip nat translations vrf A: no entries. What is the root cause?

Accepted Answer

The interface GigabitEthernet0/1 is not in VRF A.. The issue is that interface GigabitEthernet0/1 is not in VRF A. For the NAT command 'ip nat inside source list 100 interface GigabitEthernet0/1 vrf A overload' to work, the interface must be part of VRF A. If it is not, the NAT translations will not be created, as seen in the output 'show ip nat translations vrf A: no entries'. Ensure the interface is configured with 'ip vrf forwarding A' to place it in the correct VRF.

Answer

The NAT command is missing the 'vrf A' keyword; it should be ip nat inside source list 100 interface GigabitEthernet0/1 vrf A overload.

Answer

The route leaking is misconfigured; use route-map to filter routes.

Answer

The access-list 100 is blocking VRF B traffic.

Question 8

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1002    1000       10    0    0 00:15:30        5
192.168.2.2     4        65003    1005    1003       10    0    0 00:14:20        3
10.10.10.2      4        65004       0       0        0    0    0 00:00:05 Idle

Based on this output, what is the problem with neighbor 10.10.10.2?

Accepted Answer

The BGP session is not established; possible misconfiguration or reachability issue.. The output shows that neighbor 10.10.10.2 is in the Idle state with zero messages sent or received, indicating the BGP session has never been established. This typically results from a misconfiguration (e.g., wrong neighbor IP, incorrect AS number, missing update-source) or a Layer 3 reachability issue preventing the TCP connection on port 179.

Answer

The neighbor is administratively shut down.

Answer

The neighbor is in the process of establishing the session.

Answer

The neighbor has sent all its prefixes and is waiting for updates.

Question 9

Router R1 is configured with ip nat inside source list 100 interface Loopback0 overload. Internal hosts at 192.168.1.0/24 can access the internet, but external hosts cannot initiate connections to an internal server at 10.1.1.10 that is also behind NAT. The server is supposed to be reachable via static NAT. Configuration: ip nat inside source static tcp 10.1.1.10 80 interface Loopback0 80. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global tcp 10.1.1.10:80 10.1.1.10:80 --- ---. External users get connection timeouts. What is the root cause?

Accepted Answer

The static NAT should use a specific global IP address instead of the interface; configure ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 80.. The static NAT configuration uses 'interface Loopback0' as the global address, which means it relies on the interface's dynamically assigned IP address. However, the overload rule (PAT) is also using the same interface, and the static NAT entry shown in 'show ip nat translations' displays the inside local address as the inside global address (10.1.1.10:80), indicating that the static translation is not being applied correctly. The root cause is that static NAT requires a specific global IP address (e.g., 203.0.113.10) to map the internal server, not the interface keyword, because the interface keyword is used for PAT and does not create a fixed one-to-one mapping for inbound connections.

Answer

The access-list 100 is blocking inbound traffic.

Answer

The Loopback0 interface is not in the routing table.

Answer

The static NAT entry is missing the 'add-route' option.

Question 10

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.1.2:0, Local LDP Ident: 192.168.0.1:0
        TCP connection: 192.168.1.2.646 - 192.168.0.1.49876
        State: Oper; Msgs sent/rcvd: 100/105; Downstream on demand
        Up time: 00:10:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 192.168.1.2
        Addresses bound to peer LDP Ident:
          192.168.1.2        10.1.1.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which means the LDP session is operational. The 'Downstream on demand' label distribution mode is a valid mode (RFC 5036) and does not indicate a problem. The session is exchanging label information, as evidenced by the 'Oper' state and the presence of peer addresses.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The LDP session is in the process of being established.

Answer

The LDP session is using downstream on demand mode, which is a problem.

Question 11

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Users report that some websites load slowly or partially. Router R1 shows: show ip nat statistics: Total active translations: 65535 (0 static, 65535 dynamic; 65535 extended). The NAT pool is exhausted. What is the root cause?

Accepted Answer

Reduce the NAT timeout values using ip nat translation timeout and ip nat translation tcp-timeout.. The NAT pool is exhausted with 65535 active translations, which is the maximum number of PAT entries (port numbers) available for a single public IP. This causes new or existing sessions to fail or load partially. Reducing NAT timeout values (e.g., ip nat translation timeout and ip nat translation tcp-timeout) frees port mappings faster, alleviating the exhaustion without requiring additional public IPs.

Answer

Increase the access-list 100 to include more internal hosts.

Answer

Change the NAT to use a pool of public IPs instead of overload.

Answer

Clear the NAT table with clear ip nat translation * periodically.

Question 12

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane
  Control Plane

Service-policy input: CoPP
    class-map: MANAGEMENT (match-all)
      100 packets, 5000 bytes
      5 minute offered rate 0 bps
      police:
          8000 bps, 1500 limit, 1500 extended limit
        conformed 95 packets, 4750 bytes; action: transmit
        exceeded 5 packets, 250 bytes; action: drop
        conformed 0 bps, exceed 0 bps

class-map: ROUTING (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          16000 bps, 3000 limit, 3000 extended limit
        conformed 200 packets, 10000 bytes; action: transmit
        exceeded 0 packets, 0 bytes; action: drop
        conformed 0 bps, exceed 0 bps

Based on this output, what is happening to traffic matching the MANAGEMENT class?

Accepted Answer

Some management traffic is being dropped because it exceeds the configured police rate.. The output shows that the MANAGEMENT class has a police rate of 8000 bps. Out of 100 packets, 5 packets were exceeded and dropped because they exceeded this configured rate. This confirms that some management traffic is being dropped due to policing, making option B correct.

Answer

All management traffic is being transmitted without any drops.

Answer

The management traffic is being rate-limited but no packets are dropped.

Answer

The police rate is too high, causing all traffic to be dropped.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip sla statistics
IPSLAs Latest Statistics:

Round Trip Time (RTT) for Index 1
   Latest RTT: 10 ms
   Latest RTT (milliseconds): 10
   Number of successes: 100
   Number of failures: 0
   Operation time to live: 3000
   Operation frequency: 60 seconds
   Next operation start time: 00:00:45

Based on this output, what is the status of the IP SLA operation?

Accepted Answer

The IP SLA operation is successful and has a low RTT.. Option B is correct because the output shows 100 successes and 0 failures, with a latest RTT of 10 ms, indicating the IP SLA operation is functioning correctly and with low latency. The 'Number of successes: 100' confirms the operation has been consistently successful, and the low RTT value reflects good network performance.

Answer

The IP SLA operation has failed 100 times.

Answer

The IP SLA operation is not configured correctly.

Answer

The IP SLA operation is about to expire.

Question 14

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/0
Interface GigabitEthernet0/0
  FNF: enabled
  Ingress IPV4/IPV6 flow monitoring: enabled
    Exporter: EXPORTER1
    Monitor: MONITOR1
  Egress IPV4/IPV6 flow monitoring: disabled
  Ingress MPLS flow monitoring: disabled
  Egress MPLS flow monitoring: disabled

Based on this output, what is the state of NetFlow on this interface?

Accepted Answer

NetFlow is only monitoring incoming traffic on this interface.. The output shows that ingress IPv4/IPv6 flow monitoring is enabled with an exporter and monitor configured, while egress IPv4/IPv6 flow monitoring is disabled. This means NetFlow is only monitoring incoming traffic on the interface, not outgoing traffic. The FNF (Flexible NetFlow) status confirms NetFlow is operational, but only for ingress direction.

Answer

NetFlow is fully enabled for both ingress and egress traffic.

Answer

NetFlow is not configured on this interface.

Answer

NetFlow is only monitoring MPLS traffic.

Question 15

Given the following partial configuration on router R1:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 network 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/2
 ip address 172.16.1.1 255.255.255.0

What is the effect of this configuration?

Accepted Answer

EIGRP will only advertise the 10.1.1.0/24 and 192.168.1.0/24 networks; the 172.16.1.0/24 network will not be advertised and no EIGRP adjacency will be formed on that interface.. Option B is correct because EIGRP uses the network command with a wildcard mask to determine which interfaces to enable EIGRP on. The network 10.0.0.0 0.255.255.255 matches interfaces with an IP address in the 10.x.x.x range, enabling EIGRP on GigabitEthernet0/0 (10.1.1.1). The network 192.168.1.0 0.0.0.255 matches the 192.168.1.0/24 subnet, enabling EIGRP on GigabitEthernet0/1 (192.168.1.1). The 172.16.1.0/24 network is not matched by any network statement, so EIGRP is not enabled on GigabitEthernet0/2, and no adjacency is formed there.

Answer

EIGRP will form adjacencies and advertise all three interfaces because the network statements use classful boundaries.

Answer

EIGRP will advertise all three networks because the network 10.0.0.0 command includes all interfaces with an IP starting with 1, 172, or 192.

Answer

EIGRP will not form any adjacencies because the network statements must use exact subnet masks instead of wildcard masks.

Question 16

Consider the following partial configuration on router R4:

interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 ipv6 address 2001:db8:1::1/64
 ipv6 ospf 1 area 0
!
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.0
 ipv6 address 2001:db8:2::1/64
 ipv6 ospf 1 area 0
!
ipv6 router ospf 1
 router-id 4.4.4.4

What is the effect of this configuration?

Accepted Answer

OSPFv3 will form adjacencies on both interfaces as intended because the router-id is correctly set and OSPFv3 is enabled on each interface.. Option C is correct because OSPFv3 (OSPF for IPv6) uses a 32-bit router-id, which can be an IPv4 address (like 4.4.4.4) or any arbitrary 32-bit value, and does not require an IPv6 address. The configuration enables OSPFv3 process 1 under the global 'ipv6 router ospf 1' command, sets the router-id, and activates OSPFv3 on both interfaces with 'ipv6 ospf 1 area 0', allowing adjacencies to form normally on both GigabitEthernet0/0 and GigabitEthernet0/1.

Answer

OSPFv3 will not form adjacencies because the router-id must be an IPv6 address.

Answer

OSPFv3 will only form adjacency on GigabitEthernet0/0 because the router-id is not configured under the interface.

Answer

OSPFv3 will not form any adjacency because the network type is not specified.

Question 17

Given the following partial configuration on router R5:

interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip pim sparse-mode
!
interface GigabitEthernet0/1
 ip address 10.2.2.1 255.255.255.0
 ip pim sparse-mode
!
router ospf 1
 router-id 5.5.5.5
 network 10.0.0.0 0.255.255.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will form adjacencies on both interfaces, and PIM sparse-mode will operate normally; the configuration is valid.. The configuration is valid because OSPF and PIM sparse-mode operate independently on an interface. OSPF uses multicast address 224.0.0.5/6 for hello packets and forms adjacencies regardless of PIM sparse-mode being enabled. PIM sparse-mode requires an RP to function, but its presence does not affect OSPF adjacency formation. The network statement 10.0.0.0 0.255.255.255 matches both interfaces (10.1.1.1 and 10.2.2.1), so OSPF will form adjacencies on both.

Answer

OSPF will not form adjacencies because PIM sparse-mode is enabled on the interfaces.

Answer

OSPF will only form adjacency on GigabitEthernet0/0 because the network statement does not match GigabitEthernet0/1.

Answer

PIM sparse-mode will not work because there is no rendezvous point (RP) configured.

Question 18

Consider the following partial configuration on router R6:

router bgp 65001
 bgp router-id 6.6.6.6
 neighbor 10.0.0.2 remote-as 65002
 neighbor 10.0.0.2 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

The route-map will set the MED to 50 for all routes advertised to neighbor 10.0.0.2, and all routes will be advertised.. Option B is correct because the route-map SET-MED is applied as an outbound route-map on the BGP neighbor 10.0.0.2. Since the route-map has a permit statement with no match clause, it implicitly matches all routes. The set metric 50 command then sets the MED (Multi-Exit Discriminator) to 50 for all routes advertised to that neighbor. All routes are still advertised because the route-map does not contain any deny statements or match conditions that would filter them.

Answer

Only routes that match a specific prefix will have MED set to 50; other routes will not be advertised.

Answer

The configuration is invalid because the route-map must have a match clause.

Answer

The MED will only be set if the neighbor is also configured with a route-map for inbound updates.

Question 19

Which TWO statements about ERSPAN source session configuration are correct? (Choose TWO.)

Accepted Answer

The source session must include the 'type erspan-source' keyword.. ERSPAN encapsulates mirrored traffic in GRE and sends it over an IP network. The source session must specify the keyword 'type erspan-source', configure the 'erspan-id' and destination IP address (IPv4 only; IPv6 is not supported for ERSPAN source in most IOS-XE versions). The destination session on the remote switch decapsulates the GRE tunnel and presents the traffic to a local destination port.

Answer

The source session can use an IPv6 address for the destination without any additional configuration.

Answer

The source session can be configured to use a VRF for the destination IP reachability.

Answer

The source session automatically creates a GRE tunnel interface that can be verified with 'show ip interface brief'.

Question 20

Which BGP attribute is considered the highest priority (most preferred) in the BGP best path selection process?

Accepted Answer

Weight. C is correct because the Weight attribute is Cisco-proprietary and is evaluated first in the BGP best path selection process. It has the highest priority, with a higher weight being preferred, and it is local to the router only.

Answer

Local preference

Answer

AS path length

Answer

MED