300-410 Practice Test 2 — 30 Questions

Question 1

An engineer redistributes OSPF routes into EIGRP. The OSPF routes have a metric of 20. After redistribution, the EIGRP topology table shows the routes but they are not installed in the routing table. The 'show ip eigrp topology' shows the route in active state. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EIGRP neighbor is stuck-in-active because a query was sent but no reply was received due to a unidirectional link.. When redistributing into EIGRP, a seed metric must be specified. If not, the routes are redistributed with an infinite metric (e.g., 4294967295) and are not installed. However, the question says the route is in active state, which indicates a query is pending. This is an edge case where the route is redistributed with a valid metric but the EIGRP process is stuck-in-active due to a unidirectional link or a neighbor not replying to queries.

Answer

The 'default-metric' command was not configured, so the routes are redistributed with an infinite metric.

Answer

The OSPF routes are external type 2, which are not redistributed by default.

Answer

The 'route-map' used for redistribution has a 'match ip address' that does not match the OSPF routes.

Question 2

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

Accepted Answer

The routers have the same OSPF router ID.. The INIT state indicates that the router has received a hello packet from the neighbor but the neighbor has not seen its own router ID in the hello packet. This is often due to a mismatch in the OSPF network type or a unicast communication issue. In a VLAN trunk scenario, if the subinterfaces are not in the same VLAN, the routers may not be able to communicate at Layer 2. However, the most common cause is that the routers are using the same router ID, which causes the hello packet to be ignored because the router sees its own router ID in the neighbor list.

Answer

The OSPF hello interval is mismatched between the two routers.

Answer

The subinterfaces are in different VLANs, preventing Layer 2 communication.

Answer

The OSPF network type is set to point-to-point on one side and broadcast on the other.

Question 3

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.. In a DMVPN phase 3 network, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to process them via the `ip nhrp shortcut` command. Without `ip nhrp redirect` on the hub, the hub forwards traffic between spokes without signaling them to establish a direct tunnel. The dynamic NHRP mapping on R1 for R2's tunnel IP indicates that R1 has learned R2's physical address via NHRP registration, but without the shortcut flag, R1 will not use that mapping to send traffic directly; instead, it continues to send traffic through the hub, which fails if the hub does not have a route or if the spoke-to-spoke tunnel is not triggered.

Answer

The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.

Answer

The tunnel interface on R1 is not in the correct VRF.

Answer

The IPsec transform set is mismatched between spokes.

Question 4

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER
IPv6 access list FILTER
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence 20
    permit ipv6 any any sequence 30

What does this output indicate?

Accepted Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.. The output shows an IPv6 access list with three explicit entries. Sequence 10 permits traffic from source 2001:DB8:1::/48 to any destination, sequence 20 denies traffic from 2001:DB8:2::/48 to any destination, and sequence 30 permits all other IPv6 traffic. Because sequence 30 explicitly permits any any, traffic not matching the first two entries is permitted, overriding the default implicit deny at the end of the list.

Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.

Answer

The access list will deny all traffic because of the deny statement.

Answer

The access list is invalid because IPv6 access lists require implicit deny at the end.

Question 5

What is the default EIGRP composite metric formula used for route calculation?

Accepted Answer

metric = (K1 * bandwidth) + (K3 * delay). The default EIGRP composite metric uses only K1 and K3, which correspond to bandwidth and delay, with K1=1 and K3=1 by default. This yields the formula metric = bandwidth + delay, where bandwidth is calculated as (10^7 / minimum path bandwidth in kbps) * 256 and delay is the sum of interface delays in tens of microseconds multiplied by 256. Option B correctly represents this default behavior.

Answer

metric = bandwidth + delay + load + reliability

Answer

metric = bandwidth + delay + MTU

Answer

metric = (K1 * bandwidth) + (K2 * load) + (K3 * delay) + (K5 / (K4 + reliability))

Question 6

A network engineer notices that routes redistributed from EIGRP into OSPF are causing routing loops. Router R1 has the following relevant configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 router ospf 1 redistribute eigrp 100 subnets metric-type 1 Router R2 shows: show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type E1 Last update from 10.1.1.1, 00:01:30 ago Also, R2 has a default route via R1. What is the root cause?

Accepted Answer

Mutual redistribution without filtering causes a routing loop; apply distribute-list or route-map with tags.. The mutual redistribution between EIGRP and OSPF without route filtering can cause a routing loop. R1 redistributes OSPF into EIGRP, and EIGRP back into OSPF, creating a feedback loop. The E1 metric of 20 suggests the route was redistributed twice. The correct fix is to implement route tagging and filtering to prevent loop.

Answer

The metric-type 1 should be type 2 to avoid loops.

Answer

The EIGRP metric values are incorrect; they should match OSPF cost.

Answer

The subnets keyword is missing in the redistribute command for OSPF.

Question 7

EIGRP network is experiencing stuck-in-active (SIA) routes. Router R1 shows: show ip eigrp topology active includes 10.0.0.0/24. Router R2 has: interface GigabitEthernet0/0, ip summary-address eigrp 100 10.0.0.0 255.255.255.0. What is the root cause?

Accepted Answer

The summary address on R2 is causing a query for the specific route to be suppressed.. The summary address configured on R2 (ip summary-address eigrp 100 10.0.0.0 255.255.255.0) causes R2 to advertise a single summary route (10.0.0.0/24) to R1. When R1 loses its route to 10.0.0.0/24 and sends a query for the specific prefix, R2 does not reply because the summary address suppresses the query for the more specific route, leaving R1 stuck-in-active (SIA) waiting for a reply that never comes.

Answer

R1 has a stuck interface causing the SIA.

Answer

EIGRP is misconfigured with wrong autonomous system number.

Answer

The route 10.0.0.0/24 is flapping, causing continuous queries.

Question 8

Consider the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 is translated to 203.0.113.1 using PAT.. The configuration uses an ACL (access-list 1) to match traffic from the 192.168.1.0/24 subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command translates all matching source IP addresses to the single IP address 203.0.113.1 (the outside interface IP) using Port Address Translation (PAT). This is a classic dynamic NAT overload configuration, where multiple internal hosts share one public IP by multiplexing on source ports.

Answer

Only traffic from 192.168.1.1 is translated to 203.0.113.1 using PAT.

Answer

Traffic is translated using static NAT to 203.0.113.1.

Answer

The configuration is incomplete; a NAT pool is required for dynamic translation.

Question 9

What is the default keepalive interval for a GRE tunnel interface on Cisco IOS-XE?

Accepted Answer

10 seconds. The default keepalive interval for a GRE tunnel interface on Cisco IOS-XE is 10 seconds. This is defined by the default behavior of the `keepalive` command on tunnel interfaces, which sends periodic keepalive packets to verify the reachability of the tunnel destination. If no keepalive reply is received within three consecutive intervals (30 seconds by default), the tunnel interface is marked as down.

Answer

5 seconds

Answer

15 seconds

Answer

20 seconds

Question 10

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Accepted Answer

Device Tracking. Device Tracking is the correct answer because it is the IPv6 First Hop Security (FHS) feature that maintains a 'device tracking' database to monitor and store reachability information for hosts. This database tracks the IPv6 address, MAC address, and binding state of each host, enabling features like ND Inspection and DHCPv6 Guard to verify host reachability before forwarding traffic.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

PACL

Question 11

Router R1 has the following configuration:
```
interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT
!
route-map PBR-OUT permit 10
 match ip address 100
 set ip next-hop 192.168.1.1
!
access-list 100 permit ip host 10.1.1.100 any
```
What is the effect of this configuration?

Accepted Answer

Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.. The route-map is applied as an inbound policy on the interface, but the name 'PBR-OUT' suggests outbound, which is misleading. However, the 'ip policy route-map' command applies to incoming packets on that interface. The ACL matches source 10.1.1.100 to any destination, and sets next-hop 192.168.1.1.

Answer

Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.

Answer

All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.

Answer

The configuration is invalid because the ACL must match destination, not source.

Question 12

What is the default behavior of PBR when a 'set ip next-hop' and a 'set ip default next-hop' are both configured in the same route-map entry?

Accepted Answer

The 'set ip next-hop' is used if reachable; otherwise, the 'set ip default next-hop' is used if the routing table has no explicit route.. The 'set ip next-hop' is evaluated first. If it is reachable, it is used. If not, then the 'set ip default next-hop' is used, but only if there is no explicit route in the routing table.

Answer

The 'set ip default next-hop' is always used first.

Answer

Both are used simultaneously, and the router load-balances.

Answer

The router ignores both and uses the routing table.

Question 13

Which statement accurately describes the default behavior of auto-summary in EIGRP on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, and EIGRP advertises subnets without automatic summarization.. In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without automatically summarizing them at classful boundaries, allowing for more granular route advertisement and preventing routing issues in discontiguous networks.

Answer

Auto-summary is enabled by default, causing EIGRP to summarize at classful boundaries.

Answer

Auto-summary is enabled by default but only for external routes.

Answer

Auto-summary is disabled by default unless the network is configured with a classful mask.

Question 14

Which DHCP message type is used by a client to renew its lease before it expires?

Accepted Answer

DHCPREQUEST. When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Answer

DHCPDISCOVER

Answer

DHCPACK

Answer

DHCPRELEASE

Question 15

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection. The tunnel works for IPv6 traffic, but when the engineer tries to run EIGRP for IPv6 over the tunnel, the neighbor relationship forms but routes are not exchanged. The engineer checks the EIGRP configuration and sees that the tunnel interface is included in the EIGRP process. What is the most likely explanation?

Accepted Answer

EIGRP for IPv6 requires the 'no shutdown' command under the address-family; without it, the process is administratively down.. EIGRP for IPv6 requires the 'no shutdown' command under the address-family configuration to activate the routing process. Without it, the EIGRP process remains administratively down, which prevents route exchange even though the neighbor relationship forms (since EIGRP hellos are sent but routes are not advertised or processed). This is a common misconfiguration when transitioning from EIGRP for IPv4, which does not require an explicit 'no shutdown'.

Answer

The tunnel interface is not configured with 'ipv6 eigrp' under the interface.

Answer

The IPsec transform set does not allow multicast traffic, which EIGRP uses for hellos.

Answer

The GRE tunnel does not support EIGRP for IPv6; only OSPFv3 is supported.

Question 16

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Accepted Answer

The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.. If PBR is not working and the router uses the routing table, it could be because the route map is not being processed due to a missing 'match' statement or the route map being empty. However, a common cause is that the route map has a 'match ip address' that references an ACL that does not exist or is misconfigured. The engineer should verify that the ACL 150 exists and is correctly configured.

Answer

The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Answer

The router is running an older IOS version that does not support PBR.

Answer

The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.

Question 17

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Accepted Answer

TCP port 49 is blocked between the router and the TACACS+ server.. The 'test aaa group tacacs+ admin cisco123 new-code' command uses the 'new-code' flag, which forces the test to use the TACACS+ protocol (TCP port 49) rather than the older, less secure method. Since the router can ping the TACACS+ server, Layer 3 connectivity is fine, but a failed authentication with 'new-code' strongly indicates that TCP port 49 is blocked by a firewall or ACL between the router and the server. TACACS+ relies on TCP port 49 for all communication, so blocking this port causes immediate failure.

Answer

The TACACS+ server shared key is incorrect.

Answer

The username 'admin' does not exist on the TACACS+ server.

Answer

The TACACS+ server is not configured for the router's IP address.

Question 18

A large enterprise network is experiencing intermittent SNMP polling failures from the NMS to router R2. R1 and R2 are connected via a serial link running OSPF. R1 has the following relevant configuration: snmp-server community public RO, snmp-server community private RW, snmp-server trap-source Loopback0, snmp-server enable traps ospf. R2 shows: debug ip packet shows packets from NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. No ACL is applied to any interface on R2. What is the root cause?

Accepted Answer

An ACL is applied to the SNMP community string that does not permit the NMS IP address.. The debug output on R2 shows packets from the NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. Since no ACL is applied to any interface on R2, the only remaining ACL that could cause this is an SNMP community ACL. The SNMP community string 'public' or 'private' can have an optional ACL applied via the 'snmp-server community [view ] [ro|rw] [acl-number]' command. If that ACL does not permit the NMS IP address (10.1.1.100), the router will silently drop SNMP packets from that source, even though no interface ACL exists. This matches the symptom exactly.

Answer

OSPF network type mismatch between R1 and R2 causes routing blackhole.

Answer

The NMS is using SNMPv3 with incorrect credentials, causing authentication failure.

Answer

R2's loopback interface is not advertised into OSPF, making it unreachable.

Question 19

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external
  Refresh Epoch 2
  65002
    10.2.2.2 from 10.2.2.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best

What does this output indicate?

Accepted Answer

The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.. The output shows two paths with equal local preference and metric. The best path is from AS 65002, likely due to a tie-breaking rule such as lower router ID or older route. The path from AS 65001 is valid but not best.

Answer

Both paths are equally preferred, and BGP load-balances traffic.

Answer

The path from AS 65002 is best because it has a higher local preference.

Answer

The path from AS 65001 is best because it was received first.

Question 20

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check uRPF configuration on the interface. Troubleshooting starts with checking the uRPF configuration on the interface, then verifying the routing table for the source prefix, checking for ACLs that might block traffic, examining uRPF drop counters, and finally using debug ipv6 packet to capture dropped packets.