300-410 Practice Test 26 — 15 Questions

Question 1

A large enterprise network is experiencing intermittent loss of reachability to a loopback interface on Router R2 from Router R1. R1 has the following relevant configuration: router eigrp 100, network 10.0.0.0 0.255.255.255, summary-address 10.0.0.0 255.255.252.0 5. R2 shows: 'show ip eigrp topology all-links' includes 10.0.0.0/22 as a summary route via Null0, but the specific /32 loopback 10.0.1.1 is not in the topology table. What is the root cause?

Accepted Answer

The summary-address command uses an administrative distance of 5, which is lower than the default EIGRP internal distance of 90, causing the summary to override the specific /32 route.. The summary-address command on R1 creates a local summary route to Null0, but the administrative distance of 5 (default for EIGRP summary) causes the summary to be preferred over more specific routes learned from neighbors. The specific /32 is suppressed because the summary is installed in the routing table with a better distance, blocking the more specific route from being installed. The fix is to adjust the summary distance or not summarize.

Answer

The network statement on R1 does not include the loopback interface of R2, preventing the route from being advertised.

Answer

The summary-address command is misconfigured; the mask should be 255.255.255.252 instead of 255.255.252.0.

Answer

R2 is not configured with EIGRP, so it cannot receive the route from R1.

Question 2

A network engineer redistributes OSPF routes into EIGRP on Router R1. After redistribution, Router R3, which is an EIGRP neighbor of R1, starts experiencing routing loops for the 192.168.1.0/24 network. R1 configuration: router eigrp 100, redistribute ospf 1 metric 10000 100 255 1 1500, route-map RM-OSPF-to-EIGRP. The route-map sets tag 100. R3 shows: 'show ip route 192.168.1.0' points to R1, but traceroute shows packets looping between R1 and R3. What is the root cause?

Accepted Answer

The redistribution metric is too low, causing the route to be preferred over the OSPF path, but the loop is due to missing route tagging and filtering on redistribution.. The redistribution injects OSPF routes into EIGRP with a metric that may be suboptimal. However, the key issue is that the route-map sets a tag, but without filtering, the redistributed routes may be re-advertised back into OSPF if mutual redistribution is configured elsewhere, causing a loop. In this case, the loop occurs because R1 redistributes into EIGRP, and R3, which may also have OSPF, redistributes the route back, creating a feedback loop. The fix is to use route tagging and filtering to prevent redistribution loops.

Answer

The EIGRP metric values are incorrect; the delay value of 100 is too high, causing the route to be considered unreachable.

Answer

The route-map is applied in the wrong direction; it should be applied to the redistribute command under OSPF instead of EIGRP.

Answer

R3 has a static route for 192.168.1.0/24 pointing to R1, overriding the dynamic route.

Question 3

A network engineer runs the following command to verify NAT on a VRF:

R1# show ip nat translations vrf CUSTOMER
Pro Inside global      Inside local       Outside local      Outside global
--- 10.2.2.2           10.1.1.1           192.168.1.1        192.168.1.1

What is the purpose of the 'vrf CUSTOMER' parameter?

Accepted Answer

It filters translations for a specific VRF, allowing per-customer NAT.. This shows NAT translations specific to a VRF, used in MPLS VPN environments where NAT is applied per VRF.

Answer

It shows all translations across all VRFs.

Answer

It enables NAT on the VRF interface.

Answer

It creates a new VRF for NAT.

Question 4

A BGP speaker R1 is advertising a prefix 10.10.0.0/16 to its eBGP neighbor R2. R2 is also receiving the same prefix from another eBGP neighbor R3 with a lower local preference. R1 configuration: router bgp 100, neighbor 192.168.1.2 remote-as 200, neighbor 192.168.1.2 route-map SET-LP in. Route-map SET-LP sets local-preference 150. R2 shows: 'show ip bgp 10.10.0.0/16' shows two paths: one from R1 with local pref 150, and one from R3 with local pref 100. The best path is via R3. Why is the path from R1 not selected?

Accepted Answer

The route-map is applied inbound on R1, but it should be applied outbound to affect the local preference on routes sent to R2.. The route-map SET-LP is applied in the inbound direction on R1, meaning it sets local preference on routes received from R2, not on routes sent to R2. R1 should apply the route-map outbound to affect the local preference on R2. Since the local preference is set incorrectly, R2 prefers the path from R3 due to lower local preference (100 vs 150, but note: higher local preference is preferred, so 150 should win; however, the issue is that the local preference is not being set on the advertised route, so R2 sees default local pref 100 from R1, and 150 from R3, so R3 wins). The root cause is the route-map direction.

Answer

The local-preference value of 150 is not high enough; it should be at least 200 to override the path from R3.

Answer

R2 has a route-map that sets local preference to 100 for all routes, overriding the value set by R1.

Answer

The prefix 10.10.0.0/16 is not in the BGP table of R1 because it is not originated or learned.

Question 5

A network engineer runs the following command to debug NAT with overload:

R1# debug ip nat overload
NAT: overload: s=10.1.1.1:1234->203.0.113.1:5678, d=192.168.1.1:80 [50]
NAT: overload: s=10.1.1.1:1235->203.0.113.1:5679, d=192.168.1.1:80 [51]
NAT: overload: s=10.1.1.2:80->203.0.113.1:5680, d=192.168.1.1:1024 [52]

What does this output indicate?

Accepted Answer

PAT is working correctly, translating multiple inside hosts to one outside IP.. The output shows PAT (overload) translating multiple inside addresses and ports to a single outside address with different ports. This is normal PAT operation.

Answer

NAT is failing because the outside address is the same for all.

Answer

The translations are static.

Answer

The inside hosts are using the same port numbers.

Question 6

In the context of NAT and PAT, what is the purpose of the ip nat translation timeout command?

Accepted Answer

It configures the timeout for all dynamic NAT translations globally.. The ip nat translation timeout command globally modifies the timeout value for dynamic NAT translations. It affects all protocols unless overridden by protocol-specific timers (e.g., ip nat translation udp-timeout).

Answer

It sets the timeout for static NAT entries.

Answer

It sets the timeout only for TCP translations.

Answer

It configures the timeout for translations on a specific interface.

Question 7

Two routers R1 and R2 are connected via a FastEthernet link. OSPF is configured on both with network type broadcast. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR. R2 shows: 'show ip ospf neighbor' lists R1 as FULL/BDR. However, pings between loopback interfaces on R1 and R2 fail intermittently. 'show ip route' on R1 shows the loopback of R2 as reachable via OSPF, but 'show ip ospf interface' on R1 shows the link as point-to-point. What is the root cause?

Accepted Answer

One router has 'ip ospf network point-to-point' configured, while the other uses the default broadcast, causing a mismatch in the network type.. The 'show ip ospf interface' output indicating point-to-point suggests that the interface has been manually configured as OSPF network type point-to-point, but the neighbor state shows DR/BDR election, which is inconsistent. This mismatch causes OSPF to form adjacency but with incorrect forwarding behavior. The actual configuration likely has 'ip ospf network point-to-point' on one router but not the other, leading to a mismatch. The fix is to ensure consistent network type.

Answer

The FastEthernet interface is operating at half-duplex, causing packet loss.

Answer

OSPF hello and dead timers are mismatched, preventing adjacency formation.

Answer

The MTU on the link is mismatched, causing OSPF packets to be dropped.

Question 8

A network engineer runs the following command to verify NAT after a fix:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.1        10.1.1.1           192.168.1.1        192.168.1.1
--- 203.0.113.2        10.1.1.2           192.168.1.2        192.168.1.2

What is the most likely configuration?

Accepted Answer

Dynamic NAT without overload, using a pool of addresses.. The output shows two dynamic translations with different inside global addresses, indicating a pool of addresses is used without PAT (overload).

Answer

Static NAT for each host.

Answer

PAT with a single address.

Answer

NAT is not configured.

Question 9

In Cisco IOS, what is the default behavior of the ip nat service command?

Accepted Answer

It is used to configure NAT for specific application-layer protocols and is not enabled by default.. The ip nat service command is used to enable or disable NAT for specific protocols or to change the port number used for NAT. By default, NAT is enabled for all protocols. The command is often used to adjust NAT behavior for protocols like SIP or H.323.

Answer

It disables NAT for all protocols by default.

Answer

It enables NAT only for TCP and UDP by default.

Answer

It configures the NAT translation timeout for all services.

Question 10

An EIGRP network with routers R1, R2, and R3 is experiencing frequent Stuck-in-Active (SIA) events for the prefix 172.16.1.0/24. R1 is the successor, R2 is the feasible successor. R3 is a query originator. 'show ip eigrp topology 172.16.1.0/24' on R1 shows the route in active state. 'show ip eigrp interfaces' on R2 shows the link to R3 is up but with high packet loss. What is the root cause?

Accepted Answer

High packet loss on the link between R2 and R3 causes EIGRP queries or replies to be dropped, leading to SIA.. The SIA condition occurs when a query is sent to neighbors and the reply is not received within the active timer. High packet loss on the link between R2 and R3 causes queries or replies to be lost, leading to the route staying active. The root cause is the unreliable link causing query/reply loss. The fix is to improve the link reliability or adjust EIGRP timers.

Answer

R3 has a route summarization that causes the query to be sent to the Null0 interface.

Answer

The EIGRP active timer is set too low on R1, causing premature SIA.

Answer

R2 has a distribute-list that filters the prefix, preventing the reply from being sent.

Question 11

A network engineer runs the following command to debug NAT with route maps:

R1# debug ip nat policy
NAT: policy: match ip address 100
NAT: policy: match ip address 100
NAT: policy: match ip address 100
NAT: policy: route-map RM-NAT permit 10
  match ip address 100
  set ip next-hop 10.0.0.1

What does this output indicate?

Accepted Answer

NAT is using a route map to redirect traffic for translation.. The debug shows that a route map is being used for NAT policy-based routing. The 'set ip next-hop' indicates traffic is being redirected, possibly for NAT purposes.

Answer

The route map is blocking all traffic.

Answer

NAT is not configured.

Answer

The route map is used for routing, not NAT.

Question 12

Drag and drop the steps to troubleshoot NAT and PAT adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping from inside host to outside destination. Troubleshooting NAT connectivity failures should start with verifying basic reachability using ping, then checking NAT translations with show ip nat translations, then examining the routing table to ensure return traffic is routed correctly, then verifying access lists for NAT, and finally checking for asymmetric routing or adjacency issues.

Question 13

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

Accepted Answer

The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.. For spoke-to-spoke tunnels to form, NHRP must be configured to allow spoke registration and resolution. The hub configuration includes 'ip nhrp map multicast dynamic', which allows spokes to register, but spokes must also have 'ip nhrp nhs' pointing to the hub. If R2 and R3 do not have NHRP server configuration, they will not register, and thus cannot learn each other's addresses. The root cause is missing NHRP NHS configuration on the spokes.

Answer

The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.

Answer

The NHRP network-id is different on R2 and R3, preventing communication.

Answer

The tunnel source interface is not reachable between spokes.

Question 14

A network engineer runs the following command to verify NAT on an interface:

R1# show ip nat interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  NAT: inside, active
  NAT: outside, active
  NAT: overload, active

What is the issue with this configuration?

Accepted Answer

The interface is configured as both inside and outside, which is invalid.. The interface is configured as both inside and outside, which is incorrect. An interface should be either inside or outside, not both.

Answer

The interface is correctly configured for NAT.

Answer

The interface is down.

Answer

Overload is not active.

Question 15

Which of the following is a limitation of NAT as defined in RFC 2663?

Accepted Answer

NAT breaks end-to-end IP connectivity and can interfere with application-layer protocols.. RFC 2663 describes NAT and its limitations. One key limitation is that NAT breaks end-to-end IP connectivity because it modifies IP addresses and possibly port numbers in packets, which can interfere with protocols that embed IP addresses in the payload (e.g., FTP, SIP).

Answer

NAT cannot translate UDP traffic.

Answer

NAT is incompatible with TCP traffic.

Answer

NAT requires all traffic to be encrypted.