300-410 Practice Test 27 — 15 Questions

Question 1

An MPLS network with routers R1, R2, and R3 is experiencing label distribution failures. R1 and R2 are LDP neighbors, but R2 shows: 'show mpls ldp neighbor' shows R1 in state OPERATIONAL, but 'show mpls forwarding-table' shows no labels for prefixes from R3. R3 is connected to R2 via a different interface. R2 configuration: mpls ip on both interfaces. R1 shows: 'show mpls ldp bindings' includes prefixes from R3. What is the root cause?

Accepted Answer

The interface between R2 and R3 is missing the 'mpls ip' command, preventing LDP from establishing a session and exchanging labels.. The issue is that LDP is working between R1 and R2, but R2 is not receiving labels for prefixes from R3. This could be due to LDP not being enabled on the link between R2 and R3, or a mismatch in LDP router IDs. The fact that R1 has bindings for R3's prefixes suggests that R3 is advertising them to R1, but R2 is not receiving them. The root cause is likely that the LDP session between R2 and R3 is not established due to a missing 'mpls ip' on the interface or an LDP router ID issue.

Answer

The LDP router ID on R2 is set to a loopback that is not reachable from R3.

Answer

R3 is using a different label distribution protocol, such as TDP.

Answer

The MPLS label range on R2 is exhausted, preventing new label bindings.

Question 2

What is the default timeout value for a NAT translation entry that is not using Port Address Translation (PAT) in Cisco IOS?

Accepted Answer

86400 seconds. The default timeout for a basic NAT translation (no PAT) is 86400 seconds (24 hours). This is defined in RFC 2663 and implemented as the default in Cisco IOS.

Answer

60 seconds

Answer

300 seconds

Answer

3600 seconds

Question 3

Which statement accurately describes the behavior of the ip nat inside source static command when configuring static NAT for a single inside host?

Accepted Answer

It creates a permanent mapping that remains in the NAT table until the configuration is removed.. The ip nat inside source static command creates a permanent one-to-one mapping between an inside local IP address and an inside global IP address. This translation is always present in the NAT table and does not time out.

Answer

It dynamically allocates the global address from a pool and removes the entry after an idle timeout.

Answer

It requires the use of an access list to define which traffic is translated.

Answer

It translates only TCP and UDP traffic by default.

Question 4

In Cisco IOS, what is the default timeout for TCP NAT translations when the TCP session is idle?

Accepted Answer

86400 seconds. The default TCP NAT translation timeout in Cisco IOS is 86400 seconds (24 hours) when no data is being transferred. However, if the TCP session is established and idle, the timeout is 60 minutes (3600 seconds) after the first packet. The 24-hour value applies to the overall translation entry.

Answer

60 seconds

Answer

300 seconds

Answer

3600 seconds

Question 5

Which of the following is true regarding the default behavior of NAT in Cisco IOS when handling ICMP traffic?

Accepted Answer

ICMP NAT entries timeout after 60 seconds by default.. Cisco IOS NAT translates ICMP traffic by default. ICMP query types (such as echo request/reply) are translated using the ICMP identifier field as a pseudo-port, and the default timeout for ICMP NAT entries is 60 seconds.

Answer

ICMP traffic is not translated by NAT unless explicitly configured.

Answer

ICMP NAT entries use the same timeout as TCP entries by default.

Answer

ICMP NAT entries are permanent and do not time out.

Question 6

What is the default maximum number of NAT translations that can be created in Cisco IOS?

Accepted Answer

Unlimited, limited only by available memory. Cisco IOS does not have a fixed default maximum number of NAT translations; it is limited by available memory. However, the ip nat translation max-entries command can be used to set a limit. Without configuration, the limit is dynamic based on system resources.

Answer

512 translations

Answer

1024 translations

Answer

4096 translations

Question 7

Network management traffic from a monitoring server to routers R1, R2, and R3 is being blocked intermittently. The monitoring server uses SNMP and SSH. R1 configuration: access-list 100 permit udp any any eq snmp, access-list 100 permit tcp any any eq 22, access-list 100 deny ip any any, and 'ip access-group 100 in' on the management interface. R2 shows: 'show snmp' indicates SNMP is enabled. R3 shows: 'show ssh' indicates SSH is enabled. The monitoring server can reach R1 but not R2 or R3. What is the root cause?

Accepted Answer

The ACL permits only SNMP and SSH, but blocks other necessary traffic such as ICMP and routing protocol packets, preventing the monitoring server from reaching R2 and R3.. The ACL on R1 is applied inbound on the management interface, which filters traffic coming into R1. However, for traffic to reach R2 and R3, it must traverse R1. The ACL permits SNMP and SSH to any destination, but the implicit deny at the end blocks other traffic, including routing protocols or ICMP needed for reachability. Additionally, the ACL may be blocking return traffic if not applied correctly. The root cause is that the ACL is too restrictive, blocking necessary control plane traffic.

Answer

The ACL is applied in the wrong direction; it should be applied outbound to allow traffic from the management interface.

Answer

SNMP and SSH are not enabled on R2 and R3.

Answer

The monitoring server is not in the same subnet as the management interface, so routing is required but blocked by the ACL.

Question 8

Drag and drop the steps to configure PAT (overload) for dynamic source NAT into the correct order, from first to last.

Accepted Answer

Configure an access list to match inside local addresses. The correct order follows the standard Cisco IOS-XE configuration sequence: first define an access list to match interesting traffic, then create a NAT pool (if needed), then configure dynamic source translation with overload, then apply the configuration to the inside interface, and finally apply it to the outside interface.

Question 9

A VRF-aware network has VRF BLUE on routers R1 and R2. Routes are leaked between VRF BLUE and the global table on R1 using route-replicate. R2 shows: 'show ip route vrf BLUE' includes a route 10.10.10.0/24 learned via OSPF, but 'show ip route' (global) on R1 does not include this route. R1 configuration: ip vrf BLUE, rd 100:1, route-target export 100:1, route-target import 100:1, and 'route-replicate from vrf BLUE to global unicast 10.10.10.0 255.255.255.0'. What is the root cause?

Accepted Answer

The 'route-replicate' command is not configured under the VRF, so it does not take effect; it must be placed under 'ip vrf BLUE'.. The route-replicate command is used to leak routes from VRF to global table. However, the command syntax requires a route-map or specific prefix to be matched. The configuration shown uses a prefix list implicitly, but the route-replicate command may not be correctly applied under the VRF or may require a route-map. Additionally, the route must be in the VRF table to be replicated. The root cause is that the route-replicate command is misconfigured; it should be under the VRF configuration, not as a standalone command.

Answer

The OSPF route in VRF BLUE has a tag that prevents it from being leaked.

Answer

The route 10.10.10.0/24 is not in the VRF BLUE table on R1 because it is learned via R2.

Answer

The route-replicate command requires a route-map to specify the prefix, but none is provided.

Question 10

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# debug eigrp packets
EIGRP: Received HELLO on GigabitEthernet0/0 nbr 10.1.1.2
  AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0
EIGRP: Sending HELLO on GigabitEthernet0/0
  AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0
EIGRP: Received UPDATE on GigabitEthernet0/0 nbr 10.1.1.2
  AS 100, Flags 0x1, Seq 1/0 idbQ 0/0 iidbQ un/rely 0/0
EIGRP: Sending UPDATE on GigabitEthernet0/0 nbr 10.1.1.2
  AS 100, Flags 0x1, Seq 2/1 idbQ 0/0 iidbQ un/rely 0/0

What does this output indicate?

Accepted Answer

EIGRP adjacency is forming and routes are being exchanged successfully.. The debug output shows normal EIGRP hello and update packet exchange between neighbors. The sequence numbers increment properly, indicating adjacency is established and routes are being exchanged without errors.

Answer

EIGRP adjacency is stuck in INIT state because no hello packets are received.

Answer

EIGRP is experiencing authentication failures.

Answer

EIGRP is only sending hellos but not receiving updates.

Question 11

Which statement correctly describes the default behavior of EIGRP auto-summary on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, so subnets are advertised without summarization.. In modern Cisco IOS-XE releases (15.x and later), EIGRP auto-summary is disabled by default. This changed from older IOS versions where auto-summary was enabled by default.

Answer

Auto-summary is enabled by default, summarizing classful boundaries.

Answer

Auto-summary is enabled only for EIGRP named mode configurations.

Answer

Auto-summary is disabled by default, but only for IPv6 EIGRP.

Question 12

Drag and drop the steps to enable and verify RESTCONF on IOS-XE into the correct order, from first to last.

Accepted Answer

Enable the HTTPS server using ip http secure-server. RESTCONF requires enabling the HTTPS server first, then the RESTCONF service, followed by authentication configuration, verifying the interface, and finally testing via a REST client.

Question 13

A network engineer runs the following command to troubleshoot an OSPF adjacency issue:

R1# debug ip ospf adj
OSPF: Interface GigabitEthernet0/0 going Up
OSPF: Send with youngest orig age 0
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state INIT
OSPF: First DBD and we are not SLAVE
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART
OSPF: Nbr 2.2.2.2 has larger interface MTU

What does this output indicate?

Accepted Answer

OSPF adjacency is stuck due to MTU mismatch; the neighbor has a larger MTU.. The debug shows that the OSPF neighbor has a larger interface MTU, which prevents the adjacency from forming. OSPF requires matching MTU values on the link.

Answer

OSPF adjacency is forming correctly, moving to FULL state.

Answer

OSPF adjacency is stuck because the router is not the DR/BDR.

Answer

OSPF adjacency is stuck due to authentication mismatch.

Question 14

Which OSPF LSA type is used to describe a default route injected into a regular area by an Area Border Router (ABR)?

Accepted Answer

Type 3 (Summary LSA). Type 3 LSAs are summary LSAs generated by ABRs to advertise networks from one area to another. When an ABR injects a default route into a regular area, it uses a Type 3 LSA with a destination of 0.0.0.0.

Answer

Type 1 (Router LSA)

Answer

Type 2 (Network LSA)

Answer

Type 5 (AS-External LSA)

Question 15

Drag and drop the steps to troubleshoot Device Management adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping the management IP address from the management station. Troubleshooting starts with checking basic IP connectivity, then verifying the management protocol (e.g., NETCONF/RESTCONF) status, ensuring the correct port is open, checking AAA/authorization, and finally reviewing logs for errors.