300-410 Practice Test 29 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TEST

R1# show route-map PBR-TEST
route-map PBR-TEST, permit, sequence 10
  Match clauses:
    ip address (access-lists): 110
  Set clauses:
    ip next-hop 192.168.100.1
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 110
Extended IP access list 110
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 80
    20 permit tcp 10.0.0.0 0.255.255.255 any eq 443

R1# show ip route 192.168.100.1
Routing entry for 192.168.100.1/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely reason for zero policy routing matches?

Accepted Answer

The access list 110 is not matching any traffic arriving on GigabitEthernet0/0.. The output shows that the route map PBR-TEST is applied to GigabitEthernet0/0 and matches access list 110, but zero packets have matched. The most likely reason is that no traffic arriving on GigabitEthernet0/0 matches the access list criteria (TCP ports 80 or 443 from 10.0.0.0/8). The next-hop is reachable via OSPF, so that is not the issue. The route map sequence and application are correct.

Answer

The next-hop 192.168.100.1 is not reachable.

Answer

The route map sequence number is too high.

Answer

The route map needs to be applied globally.

Question 2

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 6 detail
Session 6
---------
Type                   : ERSPAN Source Session
Source VLANs           : 
    Both               : 10-20
Destination IP         : 10.1.1.3
ERSPAN ID              : 200

What does this output indicate?

Accepted Answer

The session is correctly configured to monitor VLANs 10 through 20.. The output shows an ERSPAN source session with source VLANs 10-20, destination IP 10.1.1.3, and ERSPAN ID 200. This is a valid ERSPAN source session using VLANs as the source.

Answer

The session is misconfigured because ERSPAN cannot use VLANs as source.

Answer

The session is misconfigured because the ERSPAN ID must be less than 100.

Answer

The session is misconfigured because the destination IP must be on the same subnet.

Question 3

In MPLS, what is the default label distribution control mode for LDP on Cisco IOS-XE?

Accepted Answer

Independent Label Distribution Control mode. The default label distribution control mode for LDP on Cisco IOS-XE is Independent Label Distribution Control mode. In this mode, each LSR can distribute label bindings to its neighbors independently, without waiting for a label binding from its downstream neighbor. This is the default behavior on Cisco IOS-XE.

Answer

Ordered Label Distribution Control mode

Answer

Liberal Label Retention mode

Answer

Conservative Label Retention mode

Question 4

A network engineer runs the following command on Router PE5:

PE5# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.7          1   FULL/DR        00:00:32    10.1.1.7        GigabitEthernet0/0
10.0.0.8          1   FULL/BDR       00:00:35    10.2.2.8        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

Both OSPF adjacencies are fully established.. The State column shows FULL/DR for neighbor 10.0.0.7 and FULL/BDR for 10.0.0.8. FULL means the link-state databases are synchronized and the adjacency is fully established on both segments. The DR/BDR roles are normal on a broadcast segment and do not indicate a problem.

Answer

One neighbor is in the EXSTART state.

Answer

The router is not the DR for any segment.

Answer

There is a mismatch in OSPF area IDs.

Question 5

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER
IPv6 access list FILTER
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence 20
    permit ipv6 any any sequence 30

What does this output indicate?

Accepted Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.. The output shows an IPv6 access list with three explicit entries. Sequence 10 permits traffic from source 2001:DB8:1::/48 to any destination, sequence 20 denies traffic from 2001:DB8:2::/48 to any destination, and sequence 30 permits all other IPv6 traffic. Because sequence 30 explicitly permits any any, traffic not matching the first two entries is permitted, overriding the default implicit deny at the end of the list.

Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.

Answer

The access list will deny all traffic because of the deny statement.

Answer

The access list is invalid because IPv6 access lists require implicit deny at the end.

Question 6

Which LSA type is used by OSPF to advertise prefixes from other routing protocols (redistribution) and has a default metric of 20?

Accepted Answer

Type 5 LSA (AS-external LSA). Type 5 LSAs (AS-external LSAs) are generated by an ASBR to advertise routes redistributed from other routing protocols or static routes into OSPF. They are flooded throughout the OSPF domain (except stub areas) and carry an external metric with a default value of 20 for redistributed routes.

Answer

Type 1 LSA (Router LSA)

Answer

Type 3 LSA (Summary LSA)

Answer

Type 4 LSA (ASBR Summary LSA)

Question 7

In OSPFv3, which authentication method is supported by default?

Accepted Answer

IPsec authentication. OSPFv3 uses IPsec for authentication and encryption, as defined in RFC 4552. It does not support the simple password or MD5 authentication used in OSPFv2.

Answer

MD5 authentication

Answer

Simple password authentication

Answer

No authentication is supported

Question 8

An enterprise network uses EIGRP with route summarization. Router R1 has the following configuration: interface GigabitEthernet0/0 ip summary-address eigrp 100 10.1.0.0 255.255.252.0. Router R2, connected to R1 via GigabitEthernet0/0, shows: 'show ip route eigrp' includes 10.1.0.0/22 but not the more specific route 10.1.1.0/24. Hosts in subnet 10.1.1.0/24 are unreachable from R2. What is the root cause?

Accepted Answer

R1's summary address 10.1.0.0/22 includes the 10.1.1.0/24 subnet, so R1 suppresses the more specific route, and R2 only learns the summary. This is expected behavior, but if the summary does not match the actual network, reachability fails.. EIGRP's route summarization behavior is to suppress more specific routes (e.g., 10.1.1.0/24) when a covering summary (10.1.0.0/22) is configured on an interface. R2 learns only the summary route, but if the actual network 10.1.1.0/24 is not reachable via the summary's next hop (e.g., because the summary includes subnets not actually present or because R1 lacks a discard route), R2 cannot reach those hosts. The root cause is that the summary route does not accurately represent the reachable subnets, leading to black-holing.

Answer

R1 has a missing null0 route for the summary, causing it to not advertise the summary correctly.

Answer

The summary address 10.1.0.0/22 is configured on the wrong interface; it should be on the interface facing the internal network.

Answer

R2 has a route filter that blocks the 10.1.1.0/24 route.

Question 9

BGP is used between two ISPs. Router R1 has: neighbor 10.0.0.2 route-map SET-MED in, route-map SET-MED permit 10, set metric 50. Router R2 shows: show ip bgp 172.16.0.0 includes MED 50 but the path is not preferred. What is the root cause?

Accepted Answer

MED is only compared when paths are from the same neighboring AS.. BGP's MED (Multi-Exit Discriminator) attribute is only compared between paths that originate from the same neighboring AS. In this scenario, even though R2 receives a route with MED 50 from R1, the path is not preferred because the competing path likely comes from a different neighboring AS, making the MED comparison invalid. MED is a non-transitive attribute that influences inbound traffic only when comparing multiple exit points from the same AS.

Answer

The MED value is too low to influence path selection.

Answer

The route-map should be applied outbound, not inbound.

Answer

The neighbor has a higher local preference overriding MED.

Question 10

An engineer configures OSPF on a link between two routers with MTU 1500 on one side and MTU 1400 on the other. The adjacency forms but is stuck in EXSTART. Which is the most likely explanation?

Accepted Answer

The router with the larger MTU sends DBD packets that exceed the smaller MTU, causing them to be dropped silently.. When OSPF routers have mismatched MTUs, the router with the larger MTU (1500) will send Database Description (DBD) packets that include the full MTU size in the interface MTU field. The router with the smaller MTU (1400) will reject these packets because they exceed its MTU, causing them to be silently dropped. This prevents the DBD exchange from completing, leaving the adjacency stuck in EXSTART state.

Answer

The router with the smaller MTU cannot process OSPF hello packets from the larger MTU side.

Answer

The adjacency is stuck because OSPF network type mismatch prevents DBD exchange.

Answer

The router with the larger MTU must have 'ip ospf mtu-ignore' configured to bypass the MTU check.

Question 11

A DMVPN network uses PBR to route traffic from spoke routers to specific hubs based on source IP. After a hub failure, traffic from spoke 1 (source 192.168.1.0/24) is being sent to a backup hub, but the backup hub drops the traffic. Router R1 (spoke) shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to next-hop 10.1.1.2 (backup hub). Router R2 (backup hub) shows: 'show ip route 192.168.1.0' returns no route. What is the root cause?

Accepted Answer

The backup hub does not have a route to the source subnet, causing it to drop traffic. Add a static route or enable routing protocol on the backup hub for the spoke subnet.. The backup hub (R2) has no route to the source subnet 192.168.1.0/24, as confirmed by 'show ip route 192.168.1.0' returning no route. Even though PBR on the spoke correctly forwards traffic to the backup hub, the backup hub cannot return traffic to the source subnet, so it drops the packets. Adding a static route or enabling a routing protocol on the backup hub for the spoke subnet resolves the issue.

Answer

The PBR route-map on the spoke is missing a 'set ip next-hop verify-availability' command, causing it to use the backup hub even when it is not fully reachable.

Answer

The spoke's routing table has a better route to the destination via the backup hub, overriding PBR.

Answer

The backup hub has a route to the source subnet but with a higher administrative distance, causing it to be ignored.

Question 12

Router R1 and R2 are running OSPF in area 0. R1 has a loopback interface with IP 192.168.1.1/32 advertised into OSPF. R2 learns this route as an intra-area route (AD 110). R2 also runs RIP and learns the same prefix from R3 with AD 120. R2's 'show ip route 192.168.1.1' shows the RIP route. What is the root cause?

Accepted Answer

R2's OSPF process has 'distance 130' configured, making OSPF routes have AD 130, which is higher than RIP's AD 120.. Administrative distance (AD) is the tiebreaker when two routing protocols offer the same prefix; lower AD wins. By default, OSPF has AD 110 and RIP has AD 120, so OSPF should win. The fact that RIP appears in the routing table means OSPF's AD was raised above 120 — the 'distance 130' configuration under the OSPF process does exactly that, making OSPF (130) lose to RIP (120). This is the only option consistent with the observed outcome.

Answer

The RIP route has a better metric than the OSPF route.

Answer

R2 has a static route with AD 1 that overrides both.

Answer

The OSPF route is an external route with AD 170 due to redistribution.

Question 13

A network engineer runs the following command on Router R8:

R8# show ip route 10.2.2.0
Routing entry for 10.2.2.0/24
  Known via "eigrp 100", distance 90, metric 28160
  Redistributing via eigrp 100
  Last update from 192.168.2.1 on GigabitEthernet0/0, 00:00:05 ago
  Routing Descriptor Blocks:
  * 192.168.2.1, from 192.168.2.1, 00:00:05 ago, via GigabitEthernet0/0
      Route metric is 28160, traffic share count is 1

R8 also has a static route to 10.2.2.0/24 with next-hop 192.168.3.1 configured with distance 95. Which route will be used?

Accepted Answer

The EIGRP route will be used because it has a lower administrative distance.. Cisco IOS selects routes by comparing administrative distance (AD) first; EIGRP's internal AD is 90, while the static route was configured with AD 95. Since 90 < 95, the EIGRP-learned route wins and is installed in the routing table, regardless of the fact that the static route was manually configured.

Answer

The static route will be used because it is manually configured.

Answer

Both routes will be used for load balancing.

Answer

Neither route will be used due to a routing loop.

Question 14

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on the ingress interface of a PE router in an MPLS L3VPN. The router is receiving VPN traffic from a customer edge (CE) router. The engineer notices that some legitimate traffic is being dropped by uRPF. The engineer verifies that the CE router has a route back to the source address in its routing table. What is the most likely explanation?

Accepted Answer

Asymmetric routing is causing the return path to use a different interface, violating the strict uRPF check.. Strict uRPF requires that the source IP of an incoming packet be reachable via the exact same interface on which the packet arrived. In an MPLS L3VPN, the PE router performs the uRPF lookup in the VRF routing table, and if the return path to the source uses a different interface (asymmetric routing), the strict check fails and the packet is dropped. The CE having a route back to the source is irrelevant because uRPF is enforced on the PE's ingress interface, not on the CE.

Answer

The uRPF 'allow-default' option is not configured, so default routes are not considered.

Answer

The CE router is not advertising the source network to the PE via BGP.

Answer

The uRPF mode is set to 'loose' instead of 'strict', causing all traffic to be dropped.

Question 15

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# debug ip packet 110
IP packet debugging is on for access list 110
*Mar  1 00:15:22.345: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x2, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23
*Mar  1 00:15:22.346: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x10, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23

What does this output indicate?

Accepted Answer

Telnet traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 110.. The debug output shows packets with source IP 10.1.1.1 and destination IP 10.2.2.2, protocol TCP, destination port 23 (Telnet), and the log explicitly states 'matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23'. This confirms that ACL 110 is denying Telnet traffic from 10.1.1.1 to 10.2.2.2. The flags 0x2 (SYN) and 0x10 (ACK) indicate the initial and subsequent packets of the Telnet session are both being denied.

Answer

Telnet traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 110.

Answer

ACL 110 is applied outbound on GigabitEthernet0/0.

Answer

ACL 110 has no line 10.