300-410 Practice Test 26 — 15 Questions

Question 1

An engineer is troubleshooting a BGP peering problem between two routers, R1 (AS 65001) and R2 (AS 65002), connected via a firewall. The BGP session is flapping every few seconds. The engineer notices that the TCP connection is established, but BGP OPEN messages are not exchanged. The firewall logs show that TCP port 179 is allowed, but packets with the BGP marker (0xFFFFFFFF) are being dropped. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.. BGP uses a 16-byte marker (all 0xFF) in its messages. Some firewalls or intrusion prevention systems may misinterpret this as a malformed packet and drop it, preventing BGP from establishing.

Answer

The BGP session is flapping because the keepalive timer is set too low on both routers.

Answer

The BGP session is flapping because the routers have mismatched BGP AS numbers.

Answer

The BGP session is flapping because the firewall is performing TCP sequence number randomization, breaking the BGP session.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
AA:BB:CC:01:02:03   192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
AA:BB:CC:01:02:04   192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/1
AA:BB:CC:01:02:05   192.168.1.12     86400       dhcp-snooping   10    GigabitEthernet0/2

Based on this output, which statement is correct?

Accepted Answer

DHCP snooping is enabled and has recorded bindings for three clients.. The output shows three DHCP snooping bindings with MAC addresses, IP addresses, lease times, and associated VLANs and interfaces, which indicates that DHCP snooping is enabled and has successfully recorded these bindings for clients. The 'dhcp-snooping' type confirms these are dynamically learned from DHCP messages, and the presence of multiple clients on the same interface (GigabitEthernet0/1) is valid as long as they are on the same VLAN.

Answer

DHCP snooping has detected a rogue DHCP server on GigabitEthernet0/1.

Answer

DHCP snooping is not functioning because the bindings are not trusted.

Answer

DHCP snooping has a conflict because two clients are on the same interface.

Question 3

Consider this IP SLA configuration on router R6:

ip sla 60
 udp-echo 203.0.113.1 2000 source-ip 198.51.100.1
 frequency 20
ip sla schedule 60 life forever start-time now

What is the purpose of this configuration?

Accepted Answer

It tests UDP connectivity by sending a UDP packet and expecting a response.. The configuration sends UDP packets to destination 203.0.113.1 on port 2000, sourced from 198.51.100.1, every 20 seconds. It tests UDP connectivity and response time.

Answer

It tests ICMP echo instead of UDP.

Answer

It measures jitter and packet loss.

Answer

It will only work if the destination is a Cisco router.

Question 4

A network administrator is configuring a Cisco IOS XE router for MPLS Traffic Engineering (TE). The administrator wants to ensure that the router can signal an MPLS TE tunnel using RSVP. Which protocol must be enabled on the interfaces along the path to reserve bandwidth and distribute labels?

Accepted Answer

RSVP. MPLS Traffic Engineering requires RSVP to signal TE tunnels and reserve bandwidth along the path. RSVP-TE is an extension of RSVP that carries additional objects for traffic engineering, such as explicit route objects and label requests. It must be enabled on all interfaces that the tunnel traverses. While OSPF or IS-IS with TE extensions are used to advertise link attributes, and BGP may be used for routing, RSVP is the protocol that performs the actual signaling and resource reservation.

Answer

BGP

Answer

LDP

Answer

OSPF

Question 5

Which SNMPv2c PDU type is used by the manager to request a large amount of data efficiently, such as an entire routing table?

Accepted Answer

GetBulkRequest. C is correct because SNMPv2c introduced the GetBulkRequest PDU specifically to allow a manager to retrieve large amounts of data, such as an entire routing table, in a single request. Unlike GetNextRequest, which requires repeated requests to walk through a MIB subtree, GetBulkRequest uses a non-repeaters and max-repetitions mechanism to fetch multiple variable bindings in one operation, significantly reducing network overhead and latency.

Answer

GetRequest

Answer

GetNextRequest

Answer

SetRequest

Question 6

Which IPv6 access-list entry will deny traffic from any source to the destination prefix 2001:db8:1::/48?

Accepted Answer

deny ipv6 any 2001:db8:1::/48. The IPv6 access-list entry 'deny ipv6 any 2001:db8:1::/48' uses the correct syntax: the source is 'any' (all traffic), and the destination is the prefix 2001:db8:1::/48, which matches all addresses within that /48 range. This entry denies traffic from any source to the entire destination prefix, as required by the question.

Answer

deny ipv6 2001:db8:1::/48 any

Answer

deny ipv6 any host 2001:db8:1::1

Answer

deny ipv6 2001:db8:1::/48 2001:db8:1::/48

Question 7

In BGP, what is the default administrative distance for routes learned from an eBGP peer?

Accepted Answer

20. The default administrative distance for eBGP is 20, while iBGP has a default of 200.

Answer

200

Answer

120

Answer

110

Question 8

A network engineer runs the following command to verify MPLS LDP label bindings:

R1# show mpls ldp bindings 192.168.1.0 255.255.255.0

Output:
  lib entry: 192.168.1.0/24, rev 8
    local binding:  label: 101
    remote binding: lsr: 10.0.0.2:0, label: 201
    remote binding: lsr: 10.0.0.3:0, label: 301

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a local label of 101 and two remote labels from LDP neighbors. The output shows a local binding (label 101) that R1 assigns to the prefix 192.168.1.0/24, plus two remote bindings from LDP neighbors 10.0.0.2:0 (label 201) and 10.0.0.3:0 (label 301). This indicates R1 has learned label bindings for that prefix from two LDP peers, confirming LDP sessions are up and the prefix is known via LDP.

Answer

The prefix 192.168.1.0/24 is not reachable via any LDP neighbor

Answer

Label 101 is the only label assigned to this prefix in the network

Answer

The LDP session with 10.0.0.2 is down

Question 9

Consider the following configuration on router R2:

!--- R2 configuration
ip prefix-list FILTER seq 5 deny 10.1.0.0/16 le 24
ip prefix-list FILTER seq 10 permit 0.0.0.0/0 le 32
!
route-map BGP-IN permit 10
 match ip address prefix-list FILTER
!
router bgp 65000
 neighbor 192.168.1.1 route-map BGP-IN in
!

What is the effect of this configuration?

Accepted Answer

Routes within 10.1.0.0/16 with mask length 24 or shorter are denied; all other routes are permitted.. The prefix-list FILTER denies any prefix within 10.1.0.0/16 with a mask length less than or equal to 24 (i.e., 10.1.0.0/16 through 10.1.255.0/24). The permit statement allows all other prefixes. The route-map BGP-IN calls this prefix-list; since there is only one permit sequence, routes that match the deny statement in the prefix-list are implicitly denied by the route-map. Therefore, routes like 10.1.0.0/16, 10.1.1.0/24, etc., are filtered out.

Answer

All routes from neighbor 192.168.1.1 are accepted; the prefix-list is not applied correctly because the route-map only has a permit sequence.

Answer

Only routes with mask length exactly 24 are denied; all other routes are permitted.

Answer

The configuration is incomplete; a route-map must have a deny statement to filter routes.

Question 10

Which OSPF LSA type is used to advertise prefixes from other areas into the backbone area?

Accepted Answer

Type 3 (Summary LSA). Type 3 Summary LSAs are generated by Area Border Routers (ABRs) to advertise inter-area prefixes — networks learned in one area — into other areas, including the backbone (Area 0). When an ABR connects Area 0 to a non-backbone area, it converts Type 1/2 topology information from one area into Type 3 LSAs flooded into the other, enabling prefix reachability across area boundaries. This is the fundamental mechanism of OSPF's two-tier hierarchical design.

Answer

Type 1 (Router LSA)

Answer

Type 2 (Network LSA)

Answer

Type 5 (External LSA)

Question 11

A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?

Accepted Answer

The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.. The CoPP policy polices traffic from the management station to 100,000 bps. SNMP polls typically consist of multiple small UDP packets (e.g., get-request, get-response), but the aggregate rate of these polls can exceed 100 kbps if the polling interval is aggressive or multiple OIDs are queried. The dropped packets in the CoPP class statistics confirm that the policer is throttling the SNMP traffic, causing timeouts. Therefore, the police rate is too low for the actual SNMP traffic volume.

Answer

The SNMP community string is incorrect on the management station.

Answer

The CoPP class-map is matching the wrong source IP address.

Answer

The SNMP agent on the router is not responding due to high CPU.

Question 12

Which TWO commands would a network engineer use to verify NAT translations and their statistics on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip nat translations. Option A, 'show ip nat translations', is correct because it displays the current NAT translation table entries, showing the inside local, inside global, outside local, and outside global addresses for active translations on the Cisco IOS router. Option B, 'show ip nat statistics', is correct because it provides NAT statistics such as total active translations, hits, misses, expired translations, and interface information, which directly satisfies the requirement to verify NAT statistics. Option C, 'show ip nat verbose', is not a valid Cisco IOS command, so it cannot be used to verify NAT translations or statistics. Option D, 'show running-config | include nat', only filters the running configuration for lines containing 'nat' and shows configured NAT statements, not live translations or statistics. Option E, 'debug ip nat', is a real-time debugging command that displays NAT translation events as they occur, but it is used for troubleshooting packet-by-packet activity rather than verifying the translation table and statistics as requested.

Answer

show ip nat verbose

Answer

show running-config | include nat

Answer

debug ip nat

Question 13

An engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an EIGRP neighbor relationship with a spoke. The spoke's tunnel interface is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. The engineer checks 'show ip eigrp neighbors' on the hub and sees no neighbors. What is the most likely cause?

Accepted Answer

The spoke's tunnel interface is missing the 'ip nhrp map multicast dynamic' command.. EIGRP neighbor formation over a tunnel requires multicast support. In DMVPN, multicast traffic is sent via NHRP to the hub. If the spoke's tunnel interface does not have 'ip nhrp map multicast dynamic' or a static multicast map, the hub will not receive EIGRP hello packets from the spoke.

Answer

The hub's tunnel interface has 'no ip nhrp redirect' configured.

Answer

The spoke's EIGRP AS number does not match the hub's.

Answer

The hub's tunnel interface has 'ip nhrp authentication' configured but the spoke does not.

Question 14

Which statement accurately describes the behavior of the ip nat inside source static command when configuring static NAT for a single inside host?

Accepted Answer

It creates a permanent mapping that remains in the NAT table until the configuration is removed.. The `ip nat inside source static` command creates a permanent one-to-one mapping between an inside local IP address and an inside global IP address. This static entry remains in the NAT table indefinitely until the administrator explicitly removes it with the `no ip nat inside source static` command, making option B correct.

Answer

It dynamically allocates the global address from a pool and removes the entry after an idle timeout.

Answer

It requires the use of an access list to define which traffic is translated.

Answer

It translates only TCP and UDP traffic by default.

Question 15

Which THREE statements about IPv6 Source Guard are true? (Choose THREE.)

Accepted Answer

It filters IPv6 traffic based on the source IPv6 address of incoming packets.. Option A is correct because IPv6 Source Guard is a Layer 2 security feature that inspects incoming frames and drops those whose source IPv6 address does not match an entry in the IPv6 snooping binding table. Option B is correct because that binding table is the foundation of the feature, and it is populated dynamically by DHCPv6 snooping (for DHCPv6-assigned addresses) or by IPv6 ND Inspection (for statelessly autoconfigured or manually configured addresses). Option C is correct because IPv6 Source Guard supports a static prefix list, allowing an administrator to permit traffic from specific IPv6 prefixes in addition to the addresses learned in the binding table. Option D is not correct because IPv6 Source Guard operates only on ingress (incoming) traffic on a port, not on outgoing traffic. Option E is not correct because DHCPv6 snooping is not mandatory; the binding table can also be populated by ND Inspection, so the feature can function without DHCPv6 snooping being enabled on the VLAN.

Answer

It filters both incoming and outgoing IPv6 traffic on a port.

Answer

It requires DHCPv6 snooping to be enabled on the VLAN to function.