300-410 Practice Test 2 — 30 Questions

Question 1

A network engineer runs the following debug command to troubleshoot a DHCPv4 issue on router R1:

R1# debug ip dhcp server events

Output:
 DHCPD: DHCPDISCOVER received from 0050.7966.6800 on interface GigabitEthernet0/0
 DHCPD: Sending DHCPOFFER to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPREQUEST received from 0050.7966.6800
 DHCPD: No binding found for client 0050.7966.6800
 DHCPD: Adding binding for client 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPINFORM received from 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCP server successfully assigned an IP address to the client, and the client sent a DHCPINFORM to request additional parameters.. The debug output shows the DHCP server successfully processing a DISCOVER, OFFER, REQUEST, and ACK sequence, followed by an INFORM message. The 'No binding found' message is normal for a new client, and the binding is created. The INFORM is used by the client to obtain additional configuration parameters after the address is assigned.

Answer

The DHCP server failed to create a binding for the client.

Answer

The DHCP client is using a relay agent because the DISCOVER was received on a different interface.

Answer

The DHCP server rejected the DHCPREQUEST because no binding was found.

Question 2

A network engineer is troubleshooting a DHCPv6 prefix delegation issue on router R1 and runs the following command:

R1# debug ipv6 dhcp detail

Output:
 IPv6 DHCP: Received SOLICIT message from FE80::21A:2BFF:FE3C:4D01 on GigabitEthernet0/0
 IPv6 DHCP: Using interface pool DHCP_POOL
 IPv6 DHCP: Sending ADVERTISE message to FE80::21A:2BFF:FE3C:4D01
 IPv6 DHCP: Received REQUEST message from FE80::21A:2BFF:FE3C:4D01
 IPv6 DHCP: Client requests prefix 2001:DB8:1::/48
 IPv6 DHCP: Prefix 2001:DB8:1::/48 not available in pool DHCP_POOL
 IPv6 DHCP: Sending REPLY message with Status Code NoPrefixAvail

What does this output indicate?

Accepted Answer

The DHCPv6 server has a pool configured but the requested prefix is not in that pool or is already allocated.. The debug output shows a DHCPv6 client requesting a specific prefix delegation, but the server's pool does not have that prefix available. The server responds with a NoPrefixAvail status code, indicating the prefix cannot be assigned.

Answer

The DHCPv6 client successfully received the prefix 2001:DB8:1::/48.

Answer

The DHCPv6 client is using a relay agent because the SOLICIT was received on a different interface.

Answer

The DHCPv6 server is configured with a stateless configuration because it sent an ADVERTISE without a prefix.

Question 3

What is the default DHCPv4 client lease time on a Cisco IOS-XE router configured as a DHCP client?

Accepted Answer

86400 seconds (1 day). Cisco IOS-XE defaults to a DHCPv4 lease time of 86400 seconds (1 day) when acting as a client, per RFC 2131 and Cisco implementation.

Answer

3600 seconds (1 hour)

Answer

43200 seconds (12 hours)

Answer

1800 seconds (30 minutes)

Question 4

A network engineer runs the following command to verify DHCPv4 server bindings on router R1:

R1# show ip dhcp binding

Output:
 Bindings from all pools not associated with VRF:
 IP address       Client-ID/              Lease expiration        Type
                   Hardware address/
                   User name
 192.168.1.10     0050.7966.6800           Mar 01 2025 12:00 PM   Automatic
 192.168.1.11     0063.6973.636f.2d30      Mar 01 2025 01:00 PM   Automatic
 192.168.1.12     0100.1a.2b.3c.4d.5e     Mar 01 2025 02:00 PM   Automatic

What does this output indicate?

Accepted Answer

The DHCP server has dynamically assigned three IP addresses to clients.. The show ip dhcp binding command displays active DHCP bindings. The output shows three active leases with IP addresses, client identifiers (MAC addresses or relay-agent IDs), lease expiration times, and the type (Automatic meaning dynamically assigned).

Answer

The DHCP server has three static bindings configured.

Answer

The DHCP server is out of IP addresses because all bindings are in use.

Answer

The DHCP server is using relay agents because the client IDs are long hexadecimal strings.

Question 5

A network engineer runs the following command to troubleshoot DHCPv6 address assignment on router R1:

R1# show ipv6 dhcp binding

Output:
 Client: FE80::21A:2BFF:FE3C:4D01
   DUID: 0003000121A2B3C4D5E6
   Username: unassigned
   VRF: default
   IA NA: IA ID 0x00040001, T1 302400, T2 483840
       Address: 2001:DB8:1::100
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)
   IA PD: IA ID 0x00040002, T1 302400, T2 483840
       Prefix: 2001:DB8:1::/48
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)

What does this output indicate?

Accepted Answer

The DHCPv6 server has assigned both an IPv6 address and a prefix delegation to the client.. The show ipv6 dhcp binding command displays DHCPv6 bindings. This client has both a non-temporary address (IA NA) and a prefix delegation (IA PD). The address 2001:DB8:1::100 and prefix 2001:DB8:1::/48 are assigned with lifetimes.

Answer

The DHCPv6 server has assigned only an IPv6 address to the client.

Answer

The DHCPv6 client is using stateless autoconfiguration (SLAAC) because no address is shown.

Answer

The DHCPv6 server has a pool with only one prefix available.

Question 6

A network engineer runs the following command to verify DHCPv4 server statistics on router R1:

R1# show ip dhcp server statistics

Output:
 Memory usage: 12345
 Address pools: 2
 Database agents: 0
 Automatic bindings: 150
 Manual bindings: 5
 Expired bindings: 10
 Malformed messages: 0

Message    Received
 BOOTREQUEST    0
 DHCPDISCOVER   200
 DHCPREQUEST    180
 DHCPDECLINE    2
 DHCPRELEASE    5
 DHCPINFORM     10

What does this output indicate?

Accepted Answer

The DHCP server has 150 active automatic bindings and 5 manual bindings.. The show ip dhcp server statistics command provides counts of various DHCP messages and bindings. Here, 200 DISCOVERs were received but only 180 REQUESTs, indicating some clients did not proceed after the OFFER. There are 150 automatic bindings and 5 manual (static) bindings.

Answer

The DHCP server has received 200 DHCPREQUEST messages.

Answer

The DHCP server has 10 malformed messages, indicating a configuration issue.

Answer

The DHCP server has 2 database agents configured.

Question 7

An enterprise uses EIGRP for IPv6 with route redistribution from a static route. R1 has a static route 2001:db8:0::/32 via Null0 redistributed into EIGRP. R2 receives this route and has a more specific route 2001:db8:1::/32 via a different interface. R2 has an IPv6 ACL applied inbound on the interface facing R1 that permits only EIGRP and denies all other traffic. R2's uRPF is configured in loose mode. Traffic from R2 to 2001:db8:2::1 fails. R2 shows 'show ipv6 route' has both routes, but 'show ipv6 cef' shows the summary route for 2001:db8:2::1 pointing to R1. What is the root cause?

Accepted Answer

The summary route 2001:db8:0::/32 on R1 points to Null0, causing traffic to be dropped at R1.. The ACL on R2 blocks the data traffic from R2 to the destination because the traffic is sent out the interface facing R1 (due to the summary route), but the ACL is inbound on that interface. However, uRPF loose mode only checks if a route exists in the FIB, not the interface. The issue is that the ACL is blocking the outbound traffic? Actually, the ACL is inbound, so it filters incoming traffic. The traffic from R2 to the destination is outbound, so the ACL does not affect it. The real issue is that the summary route points to R1, but the destination is not reachable via R1 because R1's Null0 route drops it. The ACL is a red herring; the root cause is the summary route causing blackholing.

Answer

The ACL on R2 blocks the return traffic from R1, causing asymmetric routing.

Answer

uRPF loose mode drops the packet because the source address is not in the FIB.

Answer

EIGRP redistribution of the static route creates a routing loop between R1 and R2.

Question 8

A dual-stack network uses BGP for IPv6 between two ISPs. R1 (AS 100) receives a full BGP table from R2 (AS 200). R1 has an IPv6 ACL applied inbound on the interface to R2 that permits only BGP (TCP 179) and denies all other traffic. R1 also has uRPF configured in strict mode on the same interface. R1's BGP table has a route to 2001:db8:1::/48 with next-hop 2001:db8:2::2. R1's routing table shows the route, but traffic from R1 to 2001:db8:1::1 fails. R1 shows 'show ipv6 cef 2001:db8:1::/48' points to 2001:db8:2::2 via the interface to R2. What is the root cause?

Accepted Answer

The ACL on R1 blocks the return traffic from the destination, which is not BGP, causing the ping to fail.. uRPF strict mode checks the source address of outgoing packets? No, it checks incoming packets. For traffic from R1 to the destination, the source is R1's own address. When the return traffic comes back, uRPF checks the source of the return packet. But the issue is that the ACL blocks all traffic except BGP. When R1 sends data to the destination, the return traffic is blocked by the ACL because it is not BGP. The uRPF is not the issue; the ACL is blocking the return traffic.

Answer

uRPF strict mode drops the outgoing traffic because the source address is not reachable via the interface.

Answer

The next-hop 2001:db8:2::2 is not reachable due to a missing ND entry.

Answer

BGP next-hop resolution fails because the next-hop is not in the FIB.

Question 9

A network engineer runs the following command to troubleshoot an IPv6 traffic filtering issue:

R1# show ipv6 access-list FILTER
IPv6 access list FILTER
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 2001:DB8:2::/48 any sequence 20
    permit ipv6 any any sequence 30

What does this output indicate?

Accepted Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, but permit all other IPv6 traffic.. The output shows an IPv6 access-list named FILTER with three entries. The first permits traffic from 2001:DB8:1::/48 to any destination. The second denies traffic from 2001:DB8:2::/48. The third permits all other IPv6 traffic. This is a typical filtering configuration.

Answer

The access list will permit traffic from 2001:DB8:1::/48 and deny traffic from 2001:DB8:2::/48, and implicitly deny all other IPv6 traffic.

Answer

The access list will deny all traffic because of the deny statement.

Answer

The access list is invalid because IPv6 access lists require implicit deny at the end.

Question 10

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify
  IPv6 verify source: strict

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.. The output shows that strict uRPF (unicast Reverse Path Forwarding) is enabled on interface GigabitEthernet0/0. This means the router will check that the source address of incoming IPv6 packets is reachable via the same interface on which the packet arrived.

Answer

Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.

Answer

Loose uRPF is enabled, which only checks if the source address is in the routing table.

Answer

uRPF is disabled on this interface.

Question 11

A network engineer runs the following command to debug IPv6 traffic filtering:

R1# debug ipv6 packet access-list FILTER detail
IPv6 packet debugging is on for access list FILTER (detail)

*Mar 1 00:01:23.456: IPv6: source 2001:DB8:2::1 (GigabitEthernet0/0)
*Mar 1 00:01:23.456:   dest 2001:DB8:3::1 (GigabitEthernet0/1)
*Mar 1 00:01:23.456:   traffic class 0, flowlabel 0, hlim 64, next header 6 (TCP)
*Mar 1 00:01:23.456:   denied by access-list FILTER

What does this output indicate?

Accepted Answer

The packet is denied because the source address 2001:DB8:2::1 matches the deny entry in the access list.. The debug output shows an IPv6 packet from 2001:DB8:2::1 to 2001:DB8:3::1 being denied by access-list FILTER. This matches the deny statement for the 2001:DB8:2::/48 prefix.

Answer

The packet is permitted because it is a TCP packet.

Answer

The packet is denied because of uRPF check failure.

Answer

The packet is permitted because the destination is not in the access list.

Question 12

A network engineer runs the following command to verify IPv6 uRPF drops:

R1# show ipv6 traffic | include verify
  0 verify source drops, 0 verify source suppressed drops

What does this output indicate?

Accepted Answer

No IPv6 packets have been dropped by uRPF checks.. The output shows counters for uRPF drops. Both counters are zero, indicating no packets have been dropped due to uRPF verification.

Answer

uRPF is not configured on any interface.

Answer

uRPF is dropping all packets.

Answer

The router is not processing IPv6 traffic.

Question 13

A network engineer runs the following command to debug IPv6 uRPF:

R1# debug ipv6 verify
IPv6 verify debugging is on

*Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0
*Mar 1 00:02:34.567:   no route to source

What does this output indicate?

Accepted Answer

The packet will be dropped because uRPF cannot find a route to the source address.. The debug output shows that a packet with source address 2001:DB8:4::1 arrived on GigabitEthernet0/0, but the router has no route to that source address. With uRPF enabled, this packet will be dropped.

Answer

The packet will be forwarded because uRPF only checks the destination.

Answer

The packet will be forwarded because the source is on the same interface.

Answer

The router will add a route to the source address.

Question 14

A network engineer runs the following command to verify IPv6 access-list hits:

R1# show ipv6 access-list FILTER | include matches
    permit ipv6 2001:DB8:1::/48 any sequence 10 (10 matches)
    deny ipv6 2001:DB8:2::/48 any sequence 20 (5 matches)
    permit ipv6 any any sequence 30 (100 matches)

What does this output indicate?

Accepted Answer

5 packets from 2001:DB8:2::/48 have been denied, and 110 packets have been permitted.. The output shows the number of packets matching each entry. Sequence 10 has 10 matches, sequence 20 has 5 matches (denied), and sequence 30 has 100 matches (permitted).

Answer

All packets from 2001:DB8:2::/48 have been permitted.

Answer

The access list has been applied to an interface but not used.

Answer

The access list is invalid because of the order of entries.

Question 15

A network engineer runs the following command to verify IPv6 uRPF on an interface:

R1# show ipv6 interface GigabitEthernet0/0 | include verify|suppress
  IPv6 verify source: strict
  IPv6 verify source suppress: disabled

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, and no suppression is configured, so all incoming packets are subject to strict verification.. The output shows strict uRPF is enabled and the suppress feature is disabled. Suppress allows uRPF to be bypassed for certain traffic (e.g., from known sources).

Answer

Loose uRPF is enabled with suppression.

Answer

uRPF is disabled on this interface.

Answer

Suppression is enabled, so uRPF checks are bypassed.

Question 16

Which IPv6 traffic filter can be used to match traffic based on the Flow Label field?

Accepted Answer

IPv6 access-list with the 'flow-label' option. IPv6 access-lists support matching on the flow label using the 'flow-label' keyword.

Answer

IPv6 prefix-list

Answer

IPv6 route-map with match ipv6 address

Answer

IPv6 uRPF

Question 17

A network engineer runs the following command to debug IPv6 uRPF with detailed information:

R1# debug ipv6 verify detail
IPv6 verify debugging is on (detail)

*Mar 1 00:03:45.678: IPv6 verify: source 2001:DB8:5::1 on GigabitEthernet0/0
*Mar 1 00:03:45.678:   route to source via GigabitEthernet0/1, not same as input interface

What does this output indicate?

Accepted Answer

The packet will be dropped because strict uRPF requires the return path to be through the same interface.. The debug output shows that a packet from source 2001:DB8:5::1 arrived on GigabitEthernet0/0, but the route to that source points out GigabitEthernet0/1. With strict uRPF, this packet will be dropped because the return path is not through the receiving interface.

Answer

The packet will be forwarded because a route exists.

Answer

The packet will be forwarded because uRPF is loose.

Answer

The router will change the route to use GigabitEthernet0/0.

Question 18

A network engineer runs the following command to verify IPv6 traffic filtering with logging:

R1# show logging | include FILTER
*Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet

What does this output indicate?

Accepted Answer

A TCP packet from 2001:DB8:2::1 to destination 2001:DB8:3::1 port 80 was denied by the access list.. The log message shows that a TCP packet from 2001:DB8:2::1 to 2001:DB8:3::1 was denied by the access-list FILTER. This is consistent with the deny entry for 2001:DB8:2::/48.

Answer

A TCP packet was permitted by the access list.

Answer

The access list is not applied to any interface.

Answer

The packet was dropped due to uRPF.

Question 19

What is the default administrative distance for IPv6 static routes in Cisco IOS-XE?

Accepted Answer

1. The default administrative distance for IPv6 static routes is 1, the same as for IPv4 static routes.

Answer

0

Answer

5

Answer

20

Question 20

Which statement correctly describes the behavior of IPv6 Unicast Reverse Path Forwarding (uRPF) in strict mode?

Accepted Answer

It verifies that the source address is reachable via the same interface and that the route points back to that interface.. Strict mode uRPF checks that the source address of an incoming packet is reachable via the same interface it arrived on, and that the route points back to that interface.

Answer

It verifies that the source address is in the routing table, but does not check the incoming interface.

Answer

It checks that the source address is reachable via the same interface and that the route is a connected route.

Answer

It only checks that the source address is not a multicast or link-local address.