300-410 Practice Test 33 — 15 Questions

Question 1

A large enterprise network is experiencing intermittent SNMP polling failures from the NMS to router R2. R1 and R2 are connected via a serial link running OSPF. R1 has the following relevant configuration: snmp-server community public RO, snmp-server community private RW, snmp-server trap-source Loopback0, snmp-server enable traps ospf. R2 shows: debug ip packet shows packets from NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. No ACL is applied to any interface on R2. What is the root cause?

Accepted Answer

An ACL is applied to the SNMP community string that does not permit the NMS IP address.. The NMS is sending SNMP requests to R2's Loopback0 IP, but R2's OSPF configuration includes an implicit deny in the route map or distribution list that blocks the return path. However, the debug output indicates an ACL violation. The root cause is that R2 has a CoPP policy that rate-limits or drops SNMP traffic, but the debug shows ACL violation, so it is likely an implicit deny in the access-class applied to the VTY lines or an SNMP ACL. Given no interface ACL, the most common cause is an 'access-class' under line vty that denies the NMS IP, or an 'snmp-server community' with an ACL that implicitly denies the NMS. The correct answer is: 'An ACL is applied to the SNMP community string that does not permit the NMS IP address.'

Answer

OSPF network type mismatch between R1 and R2 causes routing blackhole.

Answer

The NMS is using SNMPv3 with incorrect credentials, causing authentication failure.

Answer

R2's loopback interface is not advertised into OSPF, making it unreachable.

Question 2

A network engineer configures SNMP traps on router R3 to monitor BGP events. R3 is an iBGP route reflector with multiple clients. The configuration includes: snmp-server enable traps bgp, snmp-server host 192.168.1.100 version 2c public. However, the NMS receives no BGP traps. R3's show snmp pending shows no pending traps. show snmp statistics shows TrapsSent: 0. The NMS can poll R3 successfully via SNMP. What is the root cause?

Accepted Answer

The BGP process is not configured to send traps to the SNMP agent; the command 'snmp-server enable traps bgp' is insufficient on some IOS versions without also enabling 'bgp snmp trap' under the BGP router configuration.. SNMP traps for BGP require the BGP MIB to be loaded and the bgp trap sub-type to be enabled. The command 'snmp-server enable traps bgp' enables all BGP traps, but some platforms require additional configuration like 'snmp-server trap-source' to ensure the source IP is reachable. However, the NMS can poll, so reachability is fine. The issue is that the router's SNMP agent is not generating traps because the BGP process is not sending notifications due to a missing 'bgp snmp trap' configuration under the BGP address-family or the router's SNMP trap queue is full. But show snmp pending shows none, so queue is fine. The correct answer is: 'The BGP process is not configured to send traps to the SNMP agent; the command 'snmp-server enable traps bgp' is insufficient on some IOS versions without also enabling 'bgp snmp trap' under the BGP router configuration.'

Answer

The NMS is using SNMPv3 but the router is configured for v2c, causing trap rejection.

Answer

An ACL on the NMS is blocking UDP port 162 from the router.

Answer

The router's SNMP trap queue is full, causing traps to be dropped.

Question 3

Router R4 is configured as an SNMP agent for a large network. The NMS is at 10.10.10.10. The configuration includes: snmp-server community mycom RO, snmp-server host 10.10.10.10 version 2c mycom, snmp-server enable traps. However, the NMS receives no traps. R4's show snmp statistics shows TrapsSent: 0, and show snmp pending shows no pending. The NMS can poll R4 using the community string 'mycom'. What is the root cause?

Accepted Answer

The community string 'mycom' is configured as read-only (RO), but SNMP trap notifications require a read-write (RW) community string on some IOS versions.. The community string 'mycom' is used for both read-only access and trap notification. However, the 'snmp-server host' command uses the community string as a key for trap authentication. If the community string is configured as RO, it may not be allowed to send traps because traps require RW access in some implementations. But more commonly, the issue is that the trap source interface is not configured, and the router uses the outgoing interface IP, which may not be reachable from the NMS. However, the NMS can poll, so reachability is fine. The correct answer is: 'The community string 'mycom' is configured as read-only (RO), but SNMP trap notifications require a read-write (RW) community string on some IOS versions.'

Answer

The NMS is not listening on UDP port 162.

Answer

The router's SNMP agent is disabled due to low memory.

Answer

The 'snmp-server enable traps' command is missing specific trap types.

Question 4

Router R5 is configured with SNMPv3 for secure management. The configuration includes: snmp-server group mygroup v3 priv, snmp-server user myuser mygroup v3 auth sha myauth priv aes 128 mypriv. The NMS is configured with the same credentials. However, the NMS cannot poll R5. The debug snmp packet shows: 'Authentication failure'. The NMS and R5 have correct time synchronization via NTP. What is the root cause?

Accepted Answer

The NMS is configured to use MD5 authentication, but the router is configured with SHA.. SNMPv3 authentication failure can be due to incorrect passwords, but the debug shows 'Authentication failure' specifically. Even with correct passwords, the SNMPv3 engine ID must match. The engine ID is generated from the router's MAC address or configured manually. If the NMS has a different engine ID, authentication fails. However, the most common subtle issue is that the SNMPv3 user is configured with a different authentication protocol than the NMS expects. The debug shows authentication failure, not privacy failure. The correct answer is: 'The NMS is configured to use MD5 authentication, but the router is configured with SHA.'

Answer

The SNMP engine ID on the router has changed due to a hardware replacement, causing the NMS to have a stale engine ID.

Answer

The NMS is using SNMPv2c community string instead of SNMPv3.

Answer

The router's clock is not synchronized with NTP, causing authentication key mismatch.

Question 5

Router R6 is configured to send SNMP inform requests to the NMS at 192.168.1.1. Configuration: snmp-server host 192.168.1.1 informs version 2c public, snmp-server enable traps. The NMS receives no informs. R6's show snmp statistics shows InformRequestsSent: 0, and show snmp pending shows no pending. The NMS can poll R6 successfully. The network has a firewall between R6 and the NMS that allows UDP 162. What is the root cause?

Accepted Answer

The 'snmp-server host' command for informs requires the 'informs' keyword to be placed correctly, but the router may not support informs with v2c; informs are only supported with SNMPv3.. SNMP informs require a response from the NMS. The NMS must be configured to send an SNMP response to the inform. If the NMS does not support informs or is not configured to respond, the router will not send informs. However, the show statistics shows 0 sends, meaning the router is not even attempting. The issue is that the router's SNMP agent is not generating the inform because the trap source is not reachable or the inform timeout is too low. But the NMS can poll, so reachability is fine. The correct answer is: 'The 'snmp-server host' command for informs requires the 'informs' keyword to be placed correctly, but the router may not support informs with v2c; informs are only supported with SNMPv3.'

Answer

The NMS is not configured to send SNMP responses to informs.

Answer

The firewall is blocking UDP 162 from the NMS to the router.

Answer

The router's SNMP agent is not enabled due to a missing 'snmp-server' command.

Question 6

Router R7 is part of an MPLS VPN network. It has multiple VRFs. The NMS is in the global routing table and needs to poll SNMP from devices in VRF BLUE. The configuration includes: snmp-server community public RO, snmp-server vrf BLUE community public RO. However, the NMS cannot poll the loopback interface of a router in VRF BLUE. The NMS can poll R7's global interfaces. What is the root cause?

Accepted Answer

The NMS is trying to poll a device in VRF BLUE, but the SNMP agent on R7 is not configured to respond to SNMP requests for that VRF because the 'snmp-server vrf' command is missing the 'community' keyword or the VRF is not properly associated with the SNMP process.. SNMP community strings for VRFs require the 'snmp-server vrf' command to associate the community with the VRF. However, the NMS must have reachability to the VRF's loopback. If the NMS is in the global table, it needs a route to the VRF's loopback via route leaking or MPLS VPN. The issue is that the NMS cannot reach the VRF loopback because there is no route. But the question states the NMS can poll R7's global interfaces, so reachability to R7 is fine. The correct answer is: 'The NMS is trying to poll a device in VRF BLUE, but the SNMP agent on R7 is not configured to respond to SNMP requests for that VRF because the 'snmp-server vrf' command is missing the 'community' keyword or the VRF is not properly associated with the SNMP process.'

Answer

The loopback interface of the device in VRF BLUE is not advertised into the VRF's routing table.

Answer

The SNMP community string 'public' is not allowed in VRF BLUE due to an ACL.

Answer

The NMS is using SNMPv3, but the VRF configuration only supports v2c.

Question 7

Router R8 is configured with SNMP and IP SLA. The IP SLA operation sends SNMP traps to the NMS when a threshold is crossed. The configuration includes: ip sla 1, icmp-echo 192.168.1.1, threshold 100, timeout 1000, frequency 10, ip sla schedule 1 life forever start-time now, snmp-server enable traps ip sla. However, the NMS receives no traps when the threshold is crossed. The IP SLA operation shows 'Over threshold' in show ip sla statistics. What is the root cause?

Accepted Answer

The IP SLA operation is missing the 'ip sla reaction-configuration' command to trigger SNMP traps when the threshold is exceeded.. IP SLA traps require the 'snmp-server enable traps ip sla' command, but also the IP SLA operation must be configured to send traps via the 'ip sla reaction-configuration' command. Without a reaction configuration, no traps are generated even if the threshold is crossed. The correct answer is: 'The IP SLA operation is missing the 'ip sla reaction-configuration' command to trigger SNMP traps when the threshold is exceeded.'

Answer

The NMS is not configured to receive IP SLA traps.

Answer

The SNMP community string is incorrect for trap sending.

Answer

The IP SLA operation is not scheduled correctly.

Question 8

Router R9 is configured with SNMP and NetFlow. The NMS uses SNMP to poll NetFlow statistics. The configuration includes: snmp-server community public RO, snmp-server enable traps netflow. However, the NMS cannot poll NetFlow MIB objects. The router's show snmp mib shows that the NetFlow MIB is not loaded. What is the root cause?

Accepted Answer

The NetFlow MIB is not loaded because NetFlow data export is not configured; the 'ip flow-export' command is missing.. NetFlow MIB is not loaded by default; it requires the 'ip flow-export' command to enable NetFlow and load the MIB. Additionally, the SNMP agent may need to have the MIB loaded via 'snmp-server mib' command. The correct answer is: 'The NetFlow MIB is not loaded because NetFlow data export is not configured; the 'ip flow-export' command is missing.'

Answer

The SNMP community string does not have read access to the NetFlow MIB.

Answer

The router's SNMP agent is not compatible with the NetFlow MIB.

Answer

The NMS is using an incorrect OID for NetFlow statistics.

Question 9

Router R10 is configured with SNMP and EEM. An EEM applet is configured to send an SNMP trap when a specific syslog message is generated. The applet uses the 'action snmp-trap' command. However, the NMS receives no trap. The syslog message is generated and logged. The router's show snmp statistics shows TrapsSent: 0. What is the root cause?

Accepted Answer

The EEM applet is configured to send a trap, but the 'snmp-server host' command is missing, so the router has no destination for the trap.. EEM applets that send SNMP traps require the 'snmp-server enable traps' command to be enabled globally, and also the EEM applet must have the correct privilege level. Additionally, the 'action snmp-trap' command in EEM uses the SNMP community string configured globally. If the community string is not configured or the trap host is not set, the trap is not sent. The correct answer is: 'The EEM applet is configured to send a trap, but the 'snmp-server host' command is missing, so the router has no destination for the trap.'

Answer

The syslog message is not matching the EEM trigger pattern correctly.

Answer

The EEM applet is not registered due to a syntax error.

Answer

The SNMP community string is not configured with RW privileges.

Question 10

A network engineer runs the following command to troubleshoot an SNMP issue:

R1# debug snmp packets
SNMP: Packet received via UDP from 10.1.1.1 on port 161
SNMP: GetRequest, reqid 12345, errstat 0, errindex 0
SNMP: Community string: public
SNMP: MIB object: 1.3.6.1.2.1.1.1.0 (sysDescr)
SNMP: Value: Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M
SNMP: Packet sent via UDP to 10.1.1.1 on port 161
SNMP: GetResponse, reqid 12345, errstat 0, errindex 0

What does this debug output indicate?

Accepted Answer

The SNMP agent is correctly responding to a GetRequest from the NMS at 10.1.1.1.. The debug snmp packets command shows SNMP packet exchanges. The output shows a successful GetRequest from 10.1.1.1 with community 'public' for sysDescr, and a GetResponse with no errors, indicating the SNMP agent is responding correctly.

Answer

The SNMP agent is failing to process the request due to a community string mismatch.

Answer

The SNMP agent is sending a trap to the NMS at 10.1.1.1.

Answer

The SNMP agent is ignoring the request due to an ACL blocking the NMS.

Question 11

A network engineer runs the following command to troubleshoot SNMP access:

R1# show snmp community
Community name: public
Community Index: public
Storage-Type: nonvolatile
Access: read-only
View: v1default

Community name: private
Community Index: private
Storage-Type: nonvolatile
Access: read-write
View: v1default

What does this output indicate?

Accepted Answer

The router has two SNMP communities: 'public' for read-only and 'private' for read-write access.. The show snmp community command displays configured SNMP community strings and their access levels. The output shows two communities: 'public' with read-only access and 'private' with read-write access, both using the default view.

Answer

The router only allows SNMP writes with the 'public' community.

Answer

The router is not configured for SNMP because no community strings are shown.

Answer

The router uses SNMPv3 and these communities are for backward compatibility.

Question 12

A network engineer runs the following command to troubleshoot SNMP traps:

R1# show snmp host
Host: 10.1.1.2
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

Host: 10.1.1.3
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

What does this output indicate?

Accepted Answer

SNMP traps are sent to two NMS hosts: 10.1.1.2 and 10.1.1.3 using SNMPv2c.. The show snmp host command displays configured SNMP trap receivers. The output shows two hosts (10.1.1.2 and 10.1.1.3) configured to receive SNMPv2c traps with community 'trap-public'.

Answer

SNMP traps are sent to host 10.1.1.2 only.

Answer

The router is configured to receive traps from these hosts.

Answer

SNMPv3 is used for trap communication.

Question 13

A network engineer runs the following command to troubleshoot SNMP access control:

R1# show snmp view
v1default - includes all objects up to OID 1.3.6.1.2.1.1
v1system - includes system MIB only (1.3.6.1.2.1.1)

What does this output indicate?

Accepted Answer

Two SNMP views are configured: 'v1default' with broader access and 'v1system' limited to the system MIB.. The show snmp view command displays configured SNMP views. The output shows two views: 'v1default' includes objects up to OID 1.3.6.1.2.1.1 (system group), and 'v1system' includes only the system MIB.

Answer

The router uses SNMPv3 views exclusively.

Answer

The 'v1default' view includes all MIB objects.

Answer

No views are configured, so SNMP access is denied.

Question 14

A network engineer runs the following command to troubleshoot SNMP trap generation:

R1# show snmp mib
sysDescr.0 = Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.7(3)M
sysObjectID.0 = .1.3.6.1.4.1.9.1.1
sysUpTime.0 = 123456789
sysContact.0 = admin@example.com
sysName.0 = R1
sysLocation.0 = Lab

What does this output indicate?

Accepted Answer

The router's system MIB is populated with correct values, including contact and location.. The show snmp mib command displays the system MIB objects. The output shows standard system group values: sysDescr (description), sysObjectID (enterprise OID), sysUpTime (uptime), sysContact, sysName, and sysLocation.

Answer

The router's sysContact is not configured, causing SNMP traps to fail.

Answer

The router is not responding to SNMP queries.

Answer

The router uses SNMPv3 only.

Question 15

A network engineer runs the following command to troubleshoot SNMP statistics:

R1# show snmp statistics
0 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
0 Number of requested variables
0 Number of altered variables
0 Get-request PDUs
0 Get-next PDUs
0 Set-request PDUs
0 Input queue drops
0 SNMP packets output
0 Too big errors
0 No such name errors
0 Bad values errors
0 General errors
0 Get-response PDUs
0 SNMP trap PDUs

What does this output indicate?

Accepted Answer

No SNMP traffic has been processed, which may indicate a configuration or connectivity issue.. The show snmp statistics command displays SNMP packet counters. All counters are zero, indicating that no SNMP packets have been processed since the last counter reset or router reload.

Answer

SNMP is working correctly with many successful requests.

Answer

The router is sending many SNMP traps.

Answer

There are errors due to bad community names.