300-410 Practice Test 3 — 10 Questions

Question 1

In IPv6 FHS, which protocol is used to secure Neighbor Discovery messages with cryptographic authentication?

Accepted Answer

SEND. B is correct because SEND (Secure Neighbor Discovery, RFC 3971) uses Cryptographically Generated Addresses (CGAs) and RSA signatures to authenticate Neighbor Discovery (ND) messages, protecting against threats like Neighbor Advertisement spoofing and Duplicate Address Detection (DAD) attacks. Unlike IPsec, SEND does not require a pre-established security infrastructure or key management, making it practical for securing ND in IPv6 first-hop segments.

Answer

IPsec

Answer

SSL/TLS

Answer

MACsec

Question 2

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:10000   10.0.0.10:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10001   10.0.0.11:10000    203.0.113.5:53    203.0.113.5:53
udp 192.0.2.10:10002   10.0.0.12:10000    203.0.113.5:53    203.0.113.5:53

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 150  Misses: 0
CEF Translated packets: 150, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; multiple inside hosts share the same global address with unique ports.. The output shows three dynamic NAT translations, all using the same inside global address 192.0.2.10 with unique source ports (10000, 10001, 10002). This is the hallmark of Port Address Translation (PAT) or NAT overload, where multiple inside hosts (10.0.0.10, 10.0.0.11, 10.0.0.12) share a single public IP address by differentiating sessions via layer-4 port numbers. The 'overload' keyword in the dynamic mapping confirms PAT is active and working correctly.

Answer

The NAT pool is exhausted because all addresses are used.

Answer

Static NAT is configured for DNS traffic.

Answer

The inside and outside interfaces are swapped.

Question 3

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Accepted Answer

Device Tracking. Device Tracking is the correct answer because it is the IPv6 First Hop Security (FHS) feature that maintains a 'device tracking' database to monitor and store reachability information for hosts. This database tracks the IPv6 address, MAC address, and binding state of each host, enabling features like ND Inspection and DHCPv6 Guard to verify host reachability before forwarding traffic.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

PACL

Question 4

An engineer configures CoPP on a router running EIGRP. The policy includes a class-map matching EIGRP traffic with a police rate of 1000 pps. After applying the policy, EIGRP neighbors form but occasionally go active and become stuck-in-active (SIA). Which is the most likely explanation?

Accepted Answer

The police rate in pps is too low, causing EIGRP reliable packets (queries/replies) to be dropped, leading to SIA.. EIGRP uses RTP (Reliable Transport Protocol) for certain packets like queries and replies. These reliable packets require acknowledgment; if the CoPP police rate of 1000 pps is too low, EIGRP queries or replies may be dropped. Missing acknowledgments cause the neighbor to be declared active, and if the query process is not completed within the active timer, the route becomes stuck-in-active (SIA).

Answer

EIGRP uses multicast, and CoPP cannot police multicast traffic.

Answer

CoPP only affects incoming traffic, but EIGRP SIA is caused by outgoing packet drops.

Answer

EIGRP uses TCP, and CoPP only polices UDP.

Question 5

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1002    1000       10    0    0 00:15:30        5
192.168.2.2     4        65003    1005    1003       10    0    0 00:14:20        3
10.10.10.2      4        65004       0       0        0    0    0 00:00:05 Idle

Based on this output, what is the problem with neighbor 10.10.10.2?

Accepted Answer

The BGP session is not established; possible misconfiguration or reachability issue.. The output shows that neighbor 10.10.10.2 is in the Idle state with zero messages sent or received, indicating the BGP session has never been established. This typically results from a misconfiguration (e.g., wrong neighbor IP, incorrect AS number, missing update-source) or a Layer 3 reachability issue preventing the TCP connection on port 179.

Answer

The neighbor is administratively shut down.

Answer

The neighbor is in the process of establishing the session.

Answer

The neighbor has sent all its prefixes and is waiting for updates.

Question 6

A network engineer runs the following command to troubleshoot a BGP prefix issue:

R1# show bgp ipv4 unicast 192.168.10.0/24
BGP routing table entry for 192.168.10.0/24, version 5
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

What does this output indicate?

Accepted Answer

The prefix is learned via eBGP and is the best path.. The output shows the prefix 192.168.10.0/24 is learned from neighbor 10.1.1.2 with the path type 'external', indicating eBGP. The line 'valid, external, best' confirms it is the best path, making option A correct.

Answer

The prefix is learned via iBGP and is not the best path.

Answer

The prefix is suppressed and not advertised to peers.

Answer

The prefix is invalid due to missing next-hop reachability.

Question 7

A network engineer runs the following command to troubleshoot route redistribution:

R1# debug ip routing
IP: route table insert (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]
IP: route table delete (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]

What does this output indicate?

Accepted Answer

The EIGRP route replaces the OSPF route due to lower administrative distance.. The debug output shows the OSPF route (AD 110) being inserted first, then the EIGRP route (AD 90) being inserted, followed by the deletion of the OSPF route and re-insertion of the EIGRP route. This sequence indicates that the EIGRP route replaces the OSPF route because EIGRP has a lower administrative distance (90 vs. 110), making it more trustworthy. The routing table only keeps the best route based on AD, not metric, when comparing routes from different protocols.

Answer

The router is load-balancing between OSPF and EIGRP routes.

Answer

The OSPF route is preferred due to lower metric.

Answer

Both routes are installed in the routing table.

Question 8

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but traffic is not encrypted. Which is the most likely explanation?

Accepted Answer

The crypto ACL does not match the traffic that is being sent.. The most likely reason traffic is not encrypted despite the tunnel being up is that the crypto ACL (access-list) applied to the IPsec configuration does not match the actual traffic being sent. The crypto ACL defines which traffic should be protected by IPsec; if the ACL does not permit the specific source/destination or protocol/port of the traffic, the router will not attempt to encrypt it, even though the IKE and IPsec security associations (SAs) are established.

Answer

The transform set uses ESP with null encryption.

Answer

The ISAKMP policy has the wrong authentication method.

Answer

The pre-shared key is incorrect.

Question 9

A network engineer runs the following command to troubleshoot an OSPF adjacency issue:

R1# debug ip ospf adj
OSPF: Interface GigabitEthernet0/0 going Up
OSPF: Send with youngest orig age 0
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state INIT
OSPF: First DBD and we are not SLAVE
OSPF: Rcv DBD from 2.2.2.2 seq 0x1A opt 0x52 flag 0x7 len 32 mtu 1500 state EXSTART
OSPF: Nbr 2.2.2.2 has larger interface MTU

What does this output indicate?

Accepted Answer

OSPF adjacency is stuck due to MTU mismatch; the neighbor has a larger MTU.. The debug output shows that R1 receives a Database Description (DBD) packet from neighbor 2.2.2.2 with the INIT and EXSTART states, and then explicitly states 'Nbr 2.2.2.2 has larger interface MTU'. This indicates an MTU mismatch where the neighbor's interface MTU (1500) is larger than R1's interface MTU, preventing the OSPF adjacency from progressing beyond the EXSTART state. Option B is correct because the adjacency is stuck due to the MTU mismatch, as OSPF requires matching MTU values on both sides for DBD exchange to complete.

Answer

OSPF adjacency is forming correctly, moving to FULL state.

Answer

OSPF adjacency is stuck because the router is not the DR/BDR.

Answer

OSPF adjacency is stuck due to authentication mismatch.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE
IPv6 access list DENY-REMOTE
    deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else. The access list DENY-REMOTE explicitly denies IPv6 traffic sourced from the prefix 2001:DB8:2::/48 (sequence 10) and then permits all other IPv6 traffic (sequence 20). When applied to an interface, this results in only traffic from that specific prefix being blocked, while all other IPv6 traffic is allowed. This matches option B.

Answer

It permits all IPv6 traffic

Answer

It permits only IPv6 traffic from 2001:DB8:2::/48

Answer

It denies all IPv6 traffic