300-410 Practice Test 31 — 15 Questions

Question 1

Network management traffic from a monitoring server to routers R1, R2, and R3 is being blocked intermittently. The monitoring server uses SNMP and SSH. R1 configuration: access-list 100 permit udp any any eq snmp, access-list

100 permit tcp any any eq 22, access-list 
100 deny ip any any, and 'ip access-group 100 in' on the management interface. R2 shows: 'show snmp' indicates SNMP is enabled. R3 shows: 'show ssh' indicates SSH is enabled. The monitoring server can reach R1 but not R2 or R3. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL permits only SNMP and SSH, but blocks other necessary traffic such as ICMP and routing protocol packets, preventing the monitoring server from reaching R2 and R3.. The ACL on R1 permits only SNMP (UDP port 161) and SSH (TCP port 22), but denies all other IP traffic. For the monitoring server to reach R2 and R3, ICMP (for ping/traceroute) and routing protocol packets (e.g., OSPF, EIGRP) are necessary to establish and maintain reachability. Since the ACL blocks these, the server cannot communicate with R2 and R3, even though SNMP and SSH are enabled on those routers.

Answer

The ACL is applied in the wrong direction; it should be applied outbound to allow traffic from the management interface.

Answer

SNMP and SSH are not enabled on R2 and R3.

Answer

The monitoring server is not in the same subnet as the management interface, so routing is required but blocked by the ACL.

Question 2

Drag and drop the steps to configure PAT (overload) for dynamic source NAT into the correct order, from first to last.

Accepted Answer

Configure an access list to match inside local addresses. The correct order follows the standard Cisco IOS-XE configuration sequence: first define an access list to match interesting traffic, then create a NAT pool (if needed), then configure dynamic source translation with overload, then apply the configuration to the inside interface, and finally apply it to the outside interface.

Question 3

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify ACL application on interface and direction. Start by confirming the ACL is applied to the correct interface and direction; then check for implicit deny blocking traffic; verify sequence numbers and order; examine log entries for hits; finally, adjust ACL by inserting a permit statement before the deny.

Question 4

What is the default CoPP policy on a Cisco IOS-XE router if no service-policy is applied to the control-plane?

Accepted Answer

No CoPP policy is applied; all control-plane traffic is processed without rate-limiting.. C is correct because Cisco IOS-XE routers do not apply any default CoPP policy to the control-plane. Without an explicit 'service-policy' configuration under the 'control-plane' configuration mode, all control-plane traffic (including routing protocols, management traffic, and keepalives) is processed by the route processor without any rate-limiting or filtering. CoPP is an optional feature that must be manually configured to protect the control plane from excessive traffic.

Answer

All control-plane traffic is rate-limited to 64000 bps.

Answer

Only management traffic (SSH, Telnet) is rate-limited to 32000 bps.

Answer

A default policy is applied that drops all traffic exceeding 128000 bps.

Question 5

Router R5 has the following configuration:
```
interface GigabitEthernet0/6
 ip address 10.5.5.5 255.255.255.0
 ip policy route-map PBR-METRIC
!
route-map PBR-METRIC permit 10
 match ip address 103
 set metric 50
!
access-list 103 permit ip any any
```
What is the effect of the 'set metric 50' command in this PBR context?

Accepted Answer

The route-map has no effect because 'set metric' is not a valid PBR action; packets are routed normally.. The 'set metric' command in a route-map used for PBR is not a standard PBR action. PBR actions include set ip next-hop, set interface, set ip default next-hop, set default interface, and set ip tos/precedence. 'set metric' is used in redistribution route-maps, not PBR. This configuration will not cause an error, but the metric setting is ignored for PBR.

Answer

The metric of packets matching ACL 103 is set to 50, affecting routing decisions.

Answer

The router applies the metric to the route in the routing table for the source network.

Answer

The configuration is invalid and will be rejected by the router.

Question 6

Which TWO commands are used to troubleshoot SNMPv3 authentication or encryption failures? (Choose TWO.)

Accepted Answer

debug snmp packets. The 'debug snmp packets' command enables detailed logging of SNMP packet exchanges, including authentication and encryption failures. When SNMPv3 authentication or encryption fails, this debug output shows error messages such as 'Authentication failure' or 'Decryption error', directly indicating the problem. This is the primary tool for real-time troubleshooting of SNMPv3 security issues.

Answer

show snmp group

Answer

show running-config | include snmp

Answer

ping <NMS-IP>

Question 7

A network engineer configures an EEM applet to monitor uRPF (Unicast Reverse Path Forwarding) failures using the event syslog pattern 'IP-3-URPF'. The applet is designed to log when uRPF drops packets due to strict mode. The network has asymmetric routing, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

uRPF strict mode drops packets silently without generating a syslog message unless the 'log' keyword is used.. uRPF strict mode drops packets when the source IP address is not reachable via the incoming interface. However, the syslog message 'IP-3-URPF' is generated only when the 'ip verify unicast source reachable-via' command is configured with the 'allow-default' option or when the drop is logged explicitly. In strict mode without 'allow-default', the router may drop packets silently without generating a syslog message, especially if the drop is due to asymmetric routing. The EEM applet will not trigger because no syslog is generated for the drop.

Answer

The EEM applet must use 'event routing' to capture uRPF events.

Answer

Asymmetric routing causes uRPF to generate a different syslog pattern, such as 'IP-4-URPF'.

Answer

The uRPF must be configured in loose mode to generate syslog messages.

Question 8

Management traffic to a router's loopback interface is being dropped. Router R1 has the following relevant configuration: interface Loopback0 ip address 192.168.1.1 255.255.255.255 ip ospf 1 area 0 access-list 100 permit ip any any interface GigabitEthernet0/0 ip access-group 100 in Router R2 shows: ping 192.168.1.1 source 10.1.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) What is the root cause?

Accepted Answer

Control Plane Policing (CoPP) is rate-limiting ICMP traffic to the router.. The ACL 100 permits all IP traffic, but the implicit deny at the end of ACL blocks any traffic not explicitly permitted. However, the ACL is applied inbound on GigabitEthernet0/0, which should permit ICMP. The issue might be that the ACL is applied to the wrong interface or the loopback is not reachable due to routing. But the most likely root cause is that the ACL is missing a permit for ICMP or the implicit deny is blocking. Since the ACL permits all IP, it should work. Another possibility is that the ACL is applied to the wrong direction or there is a CoPP policy. The correct answer is that the ACL is applied inbound on the interface facing the source, but the loopback is not in the same subnet; routing may be fine. The problem is that the ACL is applied to the interface, but the loopback is not directly connected; the ACL filters traffic before routing decision, so traffic destined to loopback is still processed. The implicit deny is not the issue. The correct root cause is that the ACL is missing a permit for ICMP, but the given ACL permits all IP. So perhaps the ACL is not applied correctly. Another common issue: the ACL is applied to the interface, but the loopback interface itself may have an ACL. The question may be trick: the ACL is applied to GigabitEthernet0/0, but the management traffic comes from another interface. The correct fix is to apply ACL to the correct interface or remove it. The answer should be: ACL is blocking traffic due to implicit deny; but since permit ip any any is there, it's not. Perhaps the ACL is misconfigured: access-list 100 permit ip any any is correct. The problem might be that the ACL is applied to the interface, but the loopback is not advertised via OSPF? The ping fails due to routing. But the question says management traffic is dropped. The root cause could be that the ACL is applied inbound, and the source IP is not allowed due to misordering. However, the given ACL permits all. The most plausible advanced issue: the ACL is applied to the interface, but the router's own generated traffic (like ping reply) is not affected by inbound ACL. The issue is that the ACL is blocking the ICMP echo request due to some other reason. Perhaps the ACL has a deny statement earlier. But the snippet shows only permit. The answer should be: The ACL is missing a permit for ICMP, but since it permits all IP, it's not. Another possibility: The ACL is applied to the wrong interface. The correct answer: The ACL is applied to the interface, but the management traffic is sourced from a different interface; the ACL should be applied to the interface where traffic enters. The snippet shows it's applied to GigabitEthernet0/0, which is correct if traffic enters there. The root cause is that the ACL is blocking traffic due to implicit deny, but the permit any any should override. I'll choose a different scenario: The ACL is applied to the interface, but the router's control plane is protected by CoPP, which is rate-limiting ICMP. The correct answer is CoPP.

Answer

The ACL is missing a permit for ICMP; add permit icmp any any.

Answer

The loopback interface is not advertised via OSPF; check routing.

Answer

The ACL is applied outbound; change to inbound.

Question 9

Which IP SLA operation type is used to measure one-way delay, jitter, and packet loss?

Accepted Answer

udp-jitter. The udp-jitter operation type measures one-way delay, jitter, and packet loss by sending a stream of UDP packets and analyzing the responses.

Answer

icmp-echo

Answer

udp-echo

Answer

tcp-connect

Question 10

Examine this configuration on Router R4:
```
interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 ipv6 address 2001:DB8:6::1/64
 tunnel source GigabitEthernet0/0
 tunnel destination 172.16.1.2
 tunnel mode gre ip
```
What will be the effect?

Accepted Answer

The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.. The 'tunnel mode gre ip' command creates a generic routing encapsulation (GRE) tunnel over IPv4. GRE is protocol-agnostic and can encapsulate any Layer 3 protocol, including IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and sent to the tunnel destination. Therefore, the tunnel will successfully carry both IPv4 and IPv6 payloads.

Answer

The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.

Answer

The tunnel will fail because the tunnel source is an interface, not an IP address.

Answer

The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.

Question 11

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a network with asymmetric routing. Users report intermittent connectivity issues. Which is the most likely explanation?

Accepted Answer

Asymmetric routing causes packets to arrive on an interface that is not the best return path, so uRPF drops them.. Unicast Reverse Path Forwarding (uRPF) in strict mode checks that the source IP address of an incoming packet has a route in the routing table pointing back out the same interface on which the packet arrived. In an asymmetric routing scenario, packets may arrive on an interface that is not the best return path, causing the uRPF check to fail and the packet to be dropped. This explains the intermittent connectivity issues reported by users.

Answer

The uRPF configuration is missing the 'allow-default' option.

Answer

The routing table does not have a route for the source IP.

Answer

The interface has multiple IP addresses.

Question 12

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 100 to a remote collector at 192.168.10.10 via a GRE tunnel. The source interface is GigabitEthernet0/0/0. After configuration, the collector receives no mirrored packets. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 100 ip address 192.168.10.10 origin ip address 10.1.1.1 no shutdown. R1's routing table shows a default route via 10.1.1.2, and a static route to 192.168.10.0/24 via 10.1.1.2. The tunnel interface Tunnel0 is up/up with IP 10.1.1.1/30. What is the most likely root cause?

Accepted Answer

The GRE tunnel interface is used for the ERSPAN source IP, causing a recursive routing loop because the destination IP is routed via the tunnel's next-hop.. ERSPAN encapsulates mirrored packets in GRE with a destination IP of the collector. The router must have a route to the collector IP, but the encapsulated packets use the routing table of the default VRF. If the destination IP is reachable via a route that points to a next-hop that is not directly connected, the router may attempt to use the GRE tunnel interface itself, causing a recursive routing loop. The GRE tunnel interface IP (10.1.1.1) is used as the source, but the destination 192.168.10.10 is routed via 10.1.1.2, which is the tunnel's next-hop. This creates a recursion: the packet is encapsulated with destination 192.168.10.10, then routed, which again matches the tunnel, leading to a loop and packet drop. The fix is to use a separate source IP or ensure the route to the collector does not point back through the tunnel.

Answer

The monitor session is administratively down due to a missing 'no shutdown' command.

Answer

The ERSPAN destination IP address is in a different VRF that is not reachable from the source VRF.

Answer

The ERSPAN session ID 100 conflicts with an existing GRE key on the tunnel.

Question 13

An engineer configures BGP on a PE router in an MPLS L3VPN to advertise a customer prefix. The engineer notices that the prefix is not being advertised to the BGP neighbor, even though the prefix is in the routing table and the BGP session is up. The engineer checks the BGP configuration and sees that the 'network' command is configured correctly. The engineer also verifies that the prefix is not being filtered by any route-map. What is the most likely explanation?

Accepted Answer

BGP synchronization is enabled, and the prefix is not present in the IGP, so BGP does not advertise it.. In BGP, the 'network' command advertises a prefix only if it exists in the routing table with the exact same prefix length and next-hop. A common edge case is that the prefix in the routing table has a different prefix length (e.g., a /24 is in the routing table but the 'network' command specifies a /25) or the prefix is learned via a different protocol with a different administrative distance. Another edge case is that the BGP synchronization rule (if enabled) requires the prefix to be in the IGP before it is advertised. In MPLS L3VPN, synchronization is disabled by default, but if it is enabled, the prefix must be in the IGP. The most likely explanation is that synchronization is enabled and the prefix is not in the IGP.

Answer

The 'network' command is missing the 'mask' keyword, so BGP advertises the classful network instead.

Answer

The BGP neighbor is configured with 'next-hop-self', which prevents the prefix from being advertised.

Answer

The prefix is a connected route, and BGP requires the 'network' command to include the 'route-map' to advertise connected routes.

Question 14

Which THREE commands can be used to verify the operational state and configuration of an IPv6 tunnel? (Choose THREE.)

Accepted Answer

show interfaces tunnel 0. 'show interfaces tunnel 0' displays the operational state of the tunnel interface, including line protocol status, MTU, and encapsulation type (e.g., GRE/IPv6). This command verifies whether the tunnel is up/up and confirms the underlying transport is functioning.

Answer

show ip route

Answer

show ipv6 route

Question 15

R1 and R2 are OSPF neighbors with BFD enabled. R1#show ip ospf neighbor shows R2 as 'FULL/DR'. R1#show bfd neighbors shows the session as 'Up' with R2. R2#show bfd neighbors shows the session as 'Up' with R1. However, R1#show ip route shows that the route to 10.1.1.0/24 via R2 is missing. R1 has 'summary-address 10.1.1.0 255.255.255.0' configured under OSPF. What is the root cause?

Accepted Answer

The OSPF summary-address on R1 is suppressing the more specific route from R2.. OSPF summary-address on an ABR or ASBR suppresses more specific routes. If R1 is an ABR and has a summary-address for 10.1.1.0/24, it will not install the specific route from R2, even though BFD and OSPF adjacency are fine. The summary route may be advertised instead, but the specific route is missing from the routing table.

Answer

BFD is causing the route to be removed due to fast detection.

Answer

R2 is not advertising the route due to a filtering policy.

Answer

The OSPF cost on R1 is too high, causing the route to be ignored.