300-410 Practice Test 29 — 15 Questions

Question 1

In DMVPN Phase 3 using OSPF, what is the default network type on a multipoint GRE tunnel interface?

Accepted Answer

NBMA. By default, a multipoint GRE tunnel interface is treated as an OSPF NBMA network type. This requires manual neighbor configuration unless the interface is set to broadcast or point-to-multipoint.

Answer

broadcast

Answer

point-to-multipoint

Answer

point-to-point

Question 2

A network engineer runs the following command to troubleshoot EIGRP over DMVPN:

R1# debug eigrp packets

EIGRP: Received HELLO on Tunnel0 nbr 10.0.0.2
EIGRP: New peer 10.0.0.2

What does this output indicate?

Accepted Answer

EIGRP neighbor adjacency with 10.0.0.2 is established over Tunnel0.. The debug output shows that R1 has received an EIGRP hello from 10.0.0.2 on Tunnel0 and has formed a new neighbor adjacency.

Answer

EIGRP is not enabled on Tunnel0.

Answer

The EIGRP neighbor is in a stuck-in-active state.

Answer

EIGRP authentication is failing between the routers.

Question 3

What is the default OSPF metric for a route learned over a DMVPN tunnel interface when the OSPF network type is broadcast?

Accepted Answer

1. OSPF default metric for a route is based on the reference bandwidth (default 100 Mbps) divided by the interface bandwidth. For a tunnel interface, the default bandwidth is 100 Mbps (on many platforms), so the metric is 1. However, if the tunnel bandwidth is set differently, the metric changes. The default metric is 1 when bandwidth is 100 Mbps.

Answer

10

Answer

100

Answer

0

Question 4

Consider the following partial configuration on router R2:

interface GigabitEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 ip ospf 1 area 0
!
interface GigabitEthernet0/1
 ip address 192.168.1.2 255.255.255.0
 ip ospf 1 area 0
!
router ospf 1
 router-id 2.2.2.2
 network 10.0.0.0 0.0.0.255 area 0
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will form adjacencies on both interfaces as intended; the configuration is redundant but functional.. The configuration redundantly enables OSPF on both interfaces via both the `ip ospf 1 area 0` interface-level command and the `network` statements under the OSPF process. This is valid and does not cause conflicts; OSPF will form adjacencies on both interfaces as intended. The router-id 2.2.2.2 is explicitly configured and will not be overridden by any loopback IP unless the router-id is not set or is removed.

Answer

OSPF will not form adjacencies because the interface and network commands conflict, causing OSPF to ignore the network statements.

Answer

OSPF will form adjacencies on both interfaces, but the router-id 2.2.2.2 will be overridden by the highest loopback IP.

Answer

OSPF will only form adjacency on GigabitEthernet0/1 because the network statement for 10.0.0.0 is incorrect.

Question 5

In a DMVPN Phase 2 deployment using EIGRP as the routing protocol, what is the default hello timer value on the tunnel interface?

Accepted Answer

5 seconds. EIGRP uses a default hello timer of 5 seconds on high-speed interfaces (including tunnel interfaces) and 60 seconds on low-speed interfaces. DMVPN tunnel interfaces are treated as high-speed by default.

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Question 6

An engineer configures SPAN on a Cisco switch to monitor traffic from a port that is also a SPAN destination for another session. The switch rejects the configuration. What is the most likely reason?

Accepted Answer

A SPAN destination port cannot be a SPAN source port due to hardware restrictions.. A SPAN destination port cannot be used as a SPAN source port in any session. This is a hardware limitation: the port is dedicated to receiving mirrored traffic and cannot also be monitored. The switch will return an error if you try to configure it as a source.

Answer

The SPAN session ID must be unique; overlapping sessions cause conflicts.

Answer

The switch has reached the maximum number of SPAN sessions.

Answer

The port is a trunk, and SPAN cannot monitor trunk ports as destinations.

Question 7

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Accepted Answer

The SNMP trap destination is not configured globally.. The EEM applet is triggered by a syslog message, but the syslog message may not be generated for that specific interface, or the SNMP trap action may require additional configuration such as an SNMP community or target host.

Answer

The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.

Answer

The EEM applet is not registered with the SNMP agent.

Answer

The SNMP trap action requires an SNMP community string to be specified in the applet.

Question 8

A network engineer runs the following command to troubleshoot a NAT issue:

R1# debug ip nat detailed
NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [45]
NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [46]
NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [47]
NAT*: s=192.168.1.1, d=10.2.2.2->10.1.1.1 [48]
NAT: s=10.1.1.1->10.2.2.2, d=192.168.1.1 [49]

What does this output indicate?

Accepted Answer

NAT is working correctly; the asterisk indicates a packet that was translated and fast-switched.. The output shows successful NAT translations: the source IP 10.1.1.1 is translated to 10.2.2.2 for outbound packets (lines without asterisk), and the return packet from 192.168.1.1 has its destination translated back to 10.1.1.1 (line with asterisk). The asterisk in 'NAT*' indicates that the packet was both translated and fast-switched (process-switched packets lack the asterisk), confirming correct operation.

Answer

NAT is failing; the asterisk indicates a packet that was dropped.

Answer

NAT is working but only for outbound traffic; return traffic is not being translated.

Answer

NAT is not configured; the output shows only routing information.

Question 9

A network engineer runs the following command to verify BGP route filtering:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local, (received & used)
    10.1.1.2 (metric 20) from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, internal, best
      rx pathid: 0, tx pathid: 0x0
      Community: no-export

What does the 'Community: no-export' indicate?

Accepted Answer

The route will not be advertised to any eBGP peers.. The community 'no-export' indicates that this route should not be advertised to any eBGP peers. This is a well-known community that controls route propagation.

Answer

The route will not be advertised to any iBGP peers.

Answer

The route is filtered by an inbound route-map.

Answer

The route is not installed in the routing table.

Question 10

Which statement correctly describes the behavior of OSPF network type 'point-to-multipoint' regarding neighbor discovery?

Accepted Answer

Neighbors are discovered via unicast hello packets and no DR/BDR is elected.. In OSPF point-to-multipoint network type, neighbors are manually configured or discovered via unicast hello packets because the network does not support broadcast or multicast flooding. No Designated Router (DR) or Backup Designated Router (BDR) is elected because the network is treated as a collection of point-to-point links, avoiding the need for a central adjacency point.

Answer

Neighbors are discovered via multicast hello packets and a DR/BDR is elected.

Answer

Neighbors are discovered via multicast hello packets but no DR/BDR is elected.

Answer

Neighbors are discovered via unicast hello packets and a DR/BDR is elected.

Question 11

An MPLS network uses LDP for label distribution. After enabling Flexible NetFlow on the core routers, some LDP sessions fail to establish. Router R1 shows: show mpls ldp neighbor | include (Peer|State) Peer LDP Ident: 10.0.0.2:0, State: OPERATIONAL. Router R2 shows: show mpls ldp neighbor | include (Peer|State) Peer LDP Ident: 10.0.0.1:0, State: INIT. What is the root cause?

Accepted Answer

The flow monitor is using a sampler that samples only 1 out of 100 packets, causing LDP hello messages to be missed.. Flexible NetFlow can consume CPU resources or change the way packets are processed. In this case, the LDP session is stuck in INIT state, which typically indicates a problem with the transport connection or hello messages. If a flow monitor is applied to the interface used for LDP (e.g., the core-facing interface), it might be using a sampler that samples only a fraction of packets, causing LDP hello messages to be missed. Alternatively, the flow monitor might be configured to use a flow record that includes the 'ipv4 ttl' field, which could cause the router to process LDP packets differently. The correct answer is that a flow sampler is configured on the interface, causing LDP hello packets to be sampled and potentially dropped, preventing the LDP session from moving to OPERATIONAL.

Answer

The LDP router-id is misconfigured, causing a conflict with the flow exporter.

Answer

The MPLS MTU is set too low, causing LDP packets to be fragmented.

Answer

The flow exporter is configured to use TCP port 646, conflicting with LDP.

Question 12

What is the default administrative distance for OSPF routes on a Cisco IOS-XE router?

Accepted Answer

110. The default administrative distance for OSPF is 110.

Answer

90

Answer

100

Answer

120

Question 13

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        QM_IDLE           1    0    ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete; the ISAKMP SA is established.. QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.

Answer

IKE phase 2 is complete; the IPsec SA is active.

Answer

The ISAKMP SA is in MM_NO_STATE; negotiation has failed.

Answer

The tunnel is down; the SA is in a dead state.

Question 14

A network engineer runs the following command on Router R1:

R1# show crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Protection suite of priority 20
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Based on this output, which statement is correct?

Accepted Answer

The router has two IKE policies configured; policy 10 will be preferred.. The output shows the configured IKE policies. Both use pre-shared key authentication. This is a normal configuration for IPsec VPN.

Answer

The router has no IKE policies configured; the output is empty.

Answer

The router uses certificate-based authentication.

Answer

The Diffie-Hellman group is group 2 (1024 bit).

Question 15

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKEv1, I - IKEv2

C-id  Local       Remote      I-VRF    Status Encr Hash Auth DH     Lifetime Cap
1     10.1.1.1    10.1.1.2              ACTIVE aes  sha  psk  14    23:59:59

Based on this output, which statement is correct?

Accepted Answer

The IKEv1 SA is established with the peer 10.1.1.2.. The ISAKMP SA is active, using AES encryption, SHA hash, pre-shared key authentication, and Diffie-Hellman group 14. The lifetime is about 24 hours.

Answer

The IKEv2 SA is established with the peer 10.1.1.2.

Answer

The ISAKMP SA is not established; status is MM_NO_STATE.

Answer

The Diffie-Hellman group is group 2.