300-410 Practice Test 2 — 30 Questions

Question 1

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. Option A is correct because IPv6 ND Inspection builds a binding table (IPv6 address to MAC address mappings learned from DHCPv6 snooping or ND messages) and validates Neighbor Solicitation and Neighbor Advertisement messages against that table, dropping messages whose source link-layer address does not match the binding. Option B is correct because ND Inspection supports per-interface configuration, including the ability to rate-limit ND packets (using the ipv6 nd inspection limit rate command) to mitigate ND flooding and DoS attacks. Option C is not correct because blocking rogue DHCPv6 servers is the function of DHCPv6 Guard, not ND Inspection. Option D is not correct because ND Inspection relies on the IPv6 snooping binding table rather than a prefix list to validate addresses. Option E is not correct because ND Inspection is configured on a per-interface basis (with a global policy applied to interfaces), not globally only.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 2

A network engineer runs the following command to troubleshoot SNMP traps:

R1# show snmp host
Host: 10.1.1.2
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

Host: 10.1.1.3
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

What does this output indicate?

Accepted Answer

SNMP traps are sent to two NMS hosts: 10.1.1.2 and 10.1.1.3 using SNMPv2c.. The output of the 'show snmp host' command lists the configured SNMP trap receivers. Each entry shows a host IP address (10.1.1.2 and 10.1.1.3), port 162 (the standard SNMP trap port), and the SNMP version (2c). This confirms that the router is sending SNMPv2c traps to both NMS hosts, making option A correct.

Answer

SNMP traps are sent to host 10.1.1.2 only.

Answer

The router is configured to receive traps from these hosts.

Answer

SNMPv3 is used for trap communication.

Question 3

What is the default SNMP community string on a Cisco IOS device that has not been configured with any SNMP commands?

Accepted Answer

No default community string exists; SNMP is disabled.. By default, Cisco IOS devices have no SNMP community strings configured because SNMP is disabled until explicitly enabled with the 'snmp-server community' command. Without any SNMP configuration, the device does not respond to SNMP requests, making option D correct. This aligns with Cisco's security best practices to avoid exposing management access unintentionally.

Answer

public

Answer

private

Answer

cisco

Question 4

A network engineer runs the following command on Router R1:

R1# show ip eigrp traffic
EIGRP-IPv4 Traffic Statistics for AS(100)
  Hellos sent/received: 5000/4995
  Updates sent/received: 150/148
  Queries sent/received: 10/8
  Replies sent/received: 8/10
  Acks sent/received: 300/298
  Input queue high water mark: 10
  Input queue drops: 0
  SIA-Queries sent/received: 0/0
  SIA-Replies sent/received: 0/0
  Hello process ID: 123
  PDM process ID: 124
  Socket queue: 0/2000/10/0 (current/max/highest/drops)
  Input queue: 0/2000/10/0 (current/max/highest/drops)

Based on this output, which statement is correct?

Accepted Answer

The EIGRP process is operating normally with no signs of issues.. The output shows normal EIGRP operation: Hellos are exchanged nearly equally (5000 sent vs 4995 received), Updates, Queries, Replies, and Acks are balanced, and both input queue drops and SIA counters are zero. This indicates stable neighbor relationships and no packet loss or stuck-in-active events, confirming the EIGRP process is functioning without issues.

Answer

There is a problem because more queries were sent than replies received.

Answer

The input queue drops of 0 indicate that the router is not processing EIGRP packets.

Answer

The SIA-Queries count of 0 indicates that the network has experienced stuck-in-active events.

Question 5

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

Accepted Answer

Auto-summary is disabled by default, preventing classful summarization.. In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Answer

Auto-summary is enabled by default and summarizes routes at classful boundaries.

Answer

Auto-summary is enabled by default but only for tunnel interfaces.

Answer

Auto-summary is disabled by default but can be enabled only for DMVPN.

Question 6

Examine this BGP configuration on router R6:

router bgp 65006
 bgp router-id 6.6.6.6
 neighbor 10.6.6.7 remote-as 65007
 neighbor 10.6.6.7 weight 200
!

What is the effect of the weight command?

Accepted Answer

It sets the weight of all routes learned from 10.6.6.7 to 200, making them preferred over routes with lower weight.. The weight command assigns a weight value to routes from a specific neighbor. Weight is a Cisco-specific attribute that is local to the router. Higher weight is preferred over other routes. The default weight for eBGP routes is 0, so weight 200 makes routes from this neighbor preferred.

Answer

It sets the weight of routes sent to 10.6.6.7 to 200.

Answer

It has no effect because weight is only configurable under route-map.

Answer

It sets the MED value to 200 for routes from this neighbor.

Question 7

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 8

What is the default administrative distance for internal EIGRP routes?

Accepted Answer

90. The default administrative distance for internal Enhanced Interior Gateway Routing Protocol (EIGRP) routes is 90. This value is used by Cisco routers to select the best path when multiple routing protocols provide route information for the same destination network, with a lower administrative distance being preferred over a higher one.

Answer

110

Answer

120

Answer

170

Question 9

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::1
  DUID: 0003000100AABBCCDDEE
  Username: unknown
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::100/128
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The client has been assigned an IPv6 address via DHCPv6.. The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Answer

The client is using SLAAC instead of DHCPv6.

Answer

The client's lease has expired.

Answer

The client is not authorized.

Question 10

A network engineer is troubleshooting IPv6 DMVPN phase 2 spoke-to-spoke tunnel failures. Spoke routers are able to communicate with the hub, but direct spoke-to-spoke traffic is not working. Router R1 (spoke) has the following relevant configuration:
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ipv6 nhrp network-id 1
 ipv6 nhrp nhs 2001:DB8:1::2
 ipv6 nhrp map multicast dynamic
!
Router R2 (hub) shows: show ipv6 nhrp brief output indicates that both spokes are registered. What is the root cause?

Accepted Answer

The hub is missing the 'ipv6 nhrp redirect' command, and the spokes are missing 'ipv6 nhrp shortcut'.. In DMVPN Phase 2, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to use NHRP shortcuts. Without 'ipv6 nhrp redirect' on the hub and 'ipv6 nhrp shortcut' on the spokes, the spokes will forward all inter-spoke traffic through the hub instead of establishing a direct tunnel. The hub's NHRP brief shows both spokes are registered, confirming NHRP registration works, but the missing redirect/shortcut mechanism prevents direct spoke-to-spoke communication.

Answer

The tunnel mode is multipoint, but the spokes need to be configured with 'tunnel mode gre ip' for direct communication.

Answer

The spokes have different NHRP network IDs, preventing registration.

Answer

The IPv6 addresses on the tunnel interfaces are in different subnets.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 1

Round Trip Time (RTT) for Index 1
   Latest RTT: 200 ms
   Latest RTT (milliseconds): 200
   Latest RTT (microseconds): 200000
   Number of successes: 50
   Number of failures: 10
   Operation time to live: Forever
   Output: Over threshold

Based on this output, which statement is correct?

Accepted Answer

The latest RTT has exceeded the configured threshold value.. The 'Output: Over threshold' line indicates that the latest RTT exceeded the configured threshold. The number of failures (10) suggests some probes failed, but the key clue is the threshold violation. This does not necessarily mean the operation is down; it means a threshold event occurred.

Answer

The IP SLA operation has failed due to a timeout.

Answer

The IP SLA operation is not reachable and has been disabled.

Answer

The IP SLA responder is not configured on the target device.

Question 12

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 received-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 1

Based on this output, what can be inferred about the BGP session?

Accepted Answer

The BGP session is established and the neighbor is advertising one prefix.. The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Answer

The BGP session is not established.

Answer

The BGP session is in Active state.

Answer

The BGP session is in Idle state.

Question 13

Drag and drop the steps to verify and validate IP SLA operational state into the correct order, from first to last.

Accepted Answer

Check 'show ip sla configuration' for operation details. Begin by checking the overall IP SLA configuration to confirm the operation is defined, then review the latest statistics for RTT and success rate, examine the reaction configuration if tracking is used, verify the tracking object status, and finally confirm that tracked objects are influencing routing or policy.

Question 14

Given the following configuration on a router:
```
router ospf 1
 distance 150
```
What is the effect of this configuration?

Accepted Answer

It sets the administrative distance for OSPF routes to 150, overriding the default of 110.. This command sets the administrative distance for all OSPF routes to 150, overriding the default of 110.

Answer

It sets the administrative distance for OSPF routes to 150, but only for intra-area routes.

Answer

It sets the administrative distance for OSPF external routes to 150.

Answer

It sets the administrative distance for OSPF routes to 150, but only for routes learned from a specific neighbor.

Question 15

Given this configuration on router R2:
```
ip vrf CUSTOMER_D
 rd 100:1
!
interface GigabitEthernet0/0
 ip vrf forwarding CUSTOMER_D
 ip address 192.168.2.1 255.255.255.0
!
router ospf 1 vrf CUSTOMER_D
 network 192.168.2.0 0.0.0.255 area 0
```
What will happen when this configuration is applied?

Accepted Answer

OSPF will run on GigabitEthernet0/0 and form adjacencies within VRF CUSTOMER_D.. The OSPF process is tied to VRF CUSTOMER_D, so it only runs on interfaces that belong to that VRF. The network command matches the interface, so OSPF will form adjacencies on that interface within the VRF.

Answer

OSPF will fail because the OSPF process must be configured globally, not under the VRF.

Answer

OSPF will run on all interfaces, including those not in VRF CUSTOMER_D.

Answer

The network command is invalid because it uses a wildcard mask instead of a subnet mask.

Question 16

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show policy-map control-plane input class class-default

Class-map: class-default (match-any)
  0 packets, 0 bytes
  5 minute offered rate 0 bps, drop rate 0 bps
  Match: any
  police:
      cir 1000000 bps, bc 31250 bytes, be 31250 bytes
    conformed 0 packets, 0 bytes; actions:
      transmit
    violated 0 packets, 0 bytes; actions:
      drop
    conformed 0 bps, exceed 0 bps, violated 0 bps

What does this output indicate?

Accepted Answer

The CoPP policy is not matching any traffic, indicating a possible ACL or class-map misconfiguration.. The output shows zero packets matched in class-default, meaning no traffic is being classified by the CoPP policy. This indicates a possible misconfiguration in the ACL or class-map that defines the traffic to be policed, causing the policy to be effectively inactive. A correctly configured CoPP policy would show non-zero packet counts for matched traffic.

Answer

The CoPP policy is dropping all traffic due to a misconfigured CIR.

Answer

The CoPP policy is working correctly and policing traffic at 1 Mbps.

Answer

The CoPP policy is only applied to the output direction.

Question 17

In OSPF, what is the default behavior for auto-summary on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default. Cisco IOS-XE has auto-summary disabled by default for OSPF, meaning that redistributed routes are not summarized to their classful boundaries unless explicitly configured.

Answer

Auto-summary is enabled by default

Answer

Auto-summary is only enabled for external routes

Answer

Auto-summary is enabled only for inter-area routes

Question 18

Which EIGRP packet type is used to confirm receipt of an update during reliable transport in a VRF-Lite configuration?

Accepted Answer

ACK. EIGRP uses Reliable Transport Protocol (RTP) for Update, Query, and Reply packets, and the ACK packet is the mechanism that confirms receipt of those reliable packets. In a VRF-Lite configuration the same RTP behavior applies per-VRF, so an ACK is still the packet type that acknowledges an Update. Hello packets are unreliable and are not acknowledged, which is why ACK is the correct answer.

Answer

Hello

Answer

Update

Answer

Query

Question 19

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode

Based on this output, which statement is true?

Accepted Answer

uRPF is enabled in strict mode. The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 20

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

Accepted Answer

ND Snooping. C is correct because ND Snooping (Neighbor Discovery Snooping) is the IPv6 First Hop Security feature that prevents duplicate address detection (DAD) attacks by inspecting Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. It builds a binding table of valid IPv6-to-MAC address mappings and drops any NS messages that attempt to claim an address already in use by another device, thereby blocking DAD-based spoofing attacks.

Answer

RA Guard

Answer

DHCPv6 Guard

Answer

Source Guard