300-410 Practice Test 33 — 15 Questions

Question 1

An engineer configures a DMVPN Phase 2 network. Spoke routers can communicate with the hub, but spoke-to-spoke traffic does not trigger a direct tunnel. Which is the most likely explanation?

Accepted Answer

The hub router is missing the 'ip nhrp redirect' command.. In a DMVPN Phase 2 network, spoke-to-spoke tunnels are triggered dynamically when a spoke receives an NHRP redirect from the hub. The 'ip nhrp redirect' command on the hub router enables it to send redirect messages to spokes, informing them of a more direct path to another spoke. Without this command, the hub forwards traffic between spokes but never signals the spokes to build a direct tunnel, so spoke-to-spoke traffic continues to traverse the hub.

Answer

The spoke routers have 'ip nhrp shortcut' configured.

Answer

The tunnel mode is set to gre multipoint on the spokes.

Answer

The NHRP authentication is mismatched.

Question 2

Router R6 has the following configuration:
```
interface GigabitEthernet0/7
 ip address 10.6.6.6 255.255.255.0
!
route-map PBR-MISS permit 10
 match ip address 104
 set ip next-hop 192.168.4.1
!
access-list 104 permit ip 10.6.6.0 0.0.0.255 192.168.0.0 0.0.255.255
```
What is missing in this configuration?

Accepted Answer

The interface is missing the 'ip policy route-map PBR-MISS' command.. The configuration is missing the 'ip policy route-map PBR-MISS' command on interface GigabitEthernet0/7. Without this command, the route map is not applied, and policy-based routing will not take effect. Therefore, option A correctly identifies the missing element.

Answer

The route-map is missing a 'set interface' command.

Answer

The ACL is missing a 'deny any any' statement.

Answer

The route-map sequence number must be 1.

Question 3

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure hostname and domain name. First, a hostname and domain name must be set to generate the RSA key pair. Then the RSA key pair is generated with the crypto key generate rsa command. Next, local AAA authentication is enabled with aaa new-model and aaa authentication login default local. The VTY lines are then configured to use SSH transport and the local login authentication. Finally, the SSH version is set to 2 for enhanced security.

Question 4

Consider the following partial configuration on a Cisco router:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface Serial0/0/0
 ip access-group BLOCK_TELNET out
!
line vty 0 4
 transport input telnet
 password cisco
 login

What is the effect of this configuration?

Accepted Answer

Telnet traffic from the router to remote devices via Serial0/0/0 is blocked; Telnet to the router itself is still allowed.. The ACL BLOCK_TELNET is applied outbound on Serial0/0/0, so it filters traffic leaving that interface. Telnet traffic (TCP port 23) sourced from the router itself (e.g., a user initiating a Telnet session from the router's CLI) is subject to this outbound ACL and is denied. However, Telnet traffic destined to the router (i.e., incoming management sessions to the VTY lines) is not affected because the ACL is not applied inbound on any interface, and the VTY lines have their own authentication and transport input settings.

Answer

All Telnet traffic to and from the router is blocked.

Answer

The ACL has no effect because it is applied outbound and Telnet is a TCP protocol.

Answer

The configuration is invalid because the ACL name contains an underscore.

Question 5

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE
IPv6 access list DENY-REMOTE
    deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else. The access list DENY-REMOTE explicitly denies IPv6 traffic sourced from the prefix 2001:DB8:2::/48 (sequence 10) and then permits all other IPv6 traffic (sequence 20). When applied to an interface, this results in only traffic from that specific prefix being blocked, while all other IPv6 traffic is allowed. This matches option B.

Answer

It permits all IPv6 traffic

Answer

It permits only IPv6 traffic from 2001:DB8:2::/48

Answer

It denies all IPv6 traffic

Question 6

Which THREE symptoms indicate a misconfiguration in the MPLS L3VPN control plane between two PEs? (Choose THREE.)

Accepted Answer

The command 'show ip bgp vpnv4 vrf CUSTOMER_A' shows no prefixes on the remote PE.. Common control plane issues include missing VPNv4 prefixes in BGP, lack of MPLS labels for VPN routes, and failure to establish the MP-BGP session. Correct routing table entries on the PE but no labels suggests a label allocation problem. Ping failure from CE to CE could be due to many issues, not specifically control plane. IGP adjacency down affects the underlay but is not a direct VPN control plane symptom.

Answer

Ping from CE1 to CE2 fails, but ping from CE1 to the local PE succeeds.

Answer

The IGP adjacency between PE and P routers is down.

Question 7

Consider this configuration on router R2:
```
interface GigabitEthernet0/0
 ip access-group RESTRICT_ACCESS in
!
ip access-list extended RESTRICT_ACCESS
 permit ip 10.0.0.0 0.255.255.255 any
 deny   ip any any
```
What traffic will be permitted inbound on GigabitEthernet0/0?

Accepted Answer

All traffic from the 10.0.0.0/8 network.. The access list RESTRICT_ACCESS uses a wildcard mask of 0.255.255.255, which matches the first octet exactly and ignores the remaining three octets. This effectively permits all traffic from the 10.0.0.0/8 network (10.0.0.0 through 10.255.255.255). The explicit deny ip any any at the end blocks all other traffic, so only traffic sourced from the 10.0.0.0/8 range is permitted inbound on GigabitEthernet0/0.

Answer

Only traffic from source 10.0.0.0/24.

Answer

All traffic from any source.

Answer

Only traffic from source 10.0.0.0/16.

Question 8

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

Accepted Answer

ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.. ND Inspection drops Neighbor Solicitations with an unspecified source address (::) because it requires a valid binding for the source address in its binding table. During Duplicate Address Detection (DAD), the source address is :: (RFC 4862), which has no corresponding binding, causing ND Inspection to drop the message and preventing DAD from completing.

Answer

RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.

Answer

DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.

Answer

IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.

Question 9

An engineer configures an IPsec site-to-site VPN between two routers using OSPF as the routing protocol. The OSPF neighbor forms, but routes are not being exchanged. The engineer verifies that the IPsec tunnel is up and that OSPF packets are being encrypted. The OSPF network type on the tunnel interface is set to broadcast. What is the most likely explanation for the missing routes?

Accepted Answer

The IPsec crypto map is configured to encrypt only unicast traffic, and OSPF hello packets are multicast (224.0.0.5), so they are dropped before encryption.. OSPF hello packets are sent to the multicast address 224.0.0.5, but IPsec crypto maps by default only encrypt unicast traffic. Since the crypto map does not match multicast packets, OSPF hellos are dropped before encryption, preventing OSPF neighbor adjacency from forming even though the IPsec tunnel is up and other packets are encrypted.

Answer

The OSPF network type broadcast requires a DR/BDR election, but the tunnel is point-to-point, so the DR election fails and routes are not exchanged.

Answer

The OSPF hello and dead intervals are mismatched, preventing the neighbor from forming.

Answer

The IPsec tunnel is using transport mode, which does not support multicast traffic.

Question 10

According to RFC 4787 (NAT Behavioral Requirements for UDP), what is the recommended default timeout for UDP NAT mappings?

Accepted Answer

300 seconds. RFC 4787, Section 4.3, specifies that the recommended default timeout for UDP NAT mappings is 300 seconds (5 minutes). This value balances the need to maintain active sessions while promptly releasing stale mappings to conserve NAT table resources. Cisco IOS NAT implementations adhere to this recommendation by default for UDP translations.

Answer

60 seconds

Answer

600 seconds

Answer

86400 seconds

Question 11

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify physical connectivity with ping. Start by verifying physical connectivity with ping to isolate Layer 1/2 issues. Then check the access control configuration on the interface to ensure it is not blocking traffic. Next, examine the adjacency table to confirm neighbor relationships. After that, review logs for authentication or authorization errors. Finally, use debug commands to capture real-time access control events.

Question 12

An engineer configures BFD on an OSPF link and also applies a distribute-list outbound under the OSPF process. The BFD session is up, but OSPF routes are not being advertised to the neighbor. The engineer verifies that the distribute-list is correctly configured. What is the most likely cause?

Accepted Answer

The 'area range' command is configured on the ABR, summarizing the route, and the distribute-list is filtering the summary.. OSPF distribute-list outbound only filters routes that are being redistributed into OSPF, not intra-area or inter-area LSAs. On an ABR, the 'area range' command generates a summary LSA (type 3), which can be filtered by a distribute-list outbound if it references that specific summary route. In this scenario, the distribute-list is correctly configured to deny the network, and the ABR summarizes that network via 'area range', causing the summary LSA to be filtered and not advertised to the neighbor. BFD does not affect this behavior.

Answer

The distribute-list is applied outbound, but OSPF distribute-lists only filter routes in the routing table, not LSAs, so the routes are still advertised.

Answer

The BFD session is flapping due to a mismatch in the 'bfd interval' command, causing OSPF to withdraw routes.

Answer

The distribute-list references an ACL that denies the network, but OSPF uses type 3 LSAs that are not affected by ACLs.

Question 13

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 6 detail
Session 6
---------
Type                   : ERSPAN Source Session
Source VLANs           : 
    Both               : 10-20
Destination IP         : 10.1.1.3
ERSPAN ID              : 200

What does this output indicate?

Accepted Answer

The session is correctly configured to monitor VLANs 10 through 20.. The output shows an ERSPAN source session with source VLANs 10-20, destination IP 10.1.1.3, and ERSPAN ID 200. This is a valid ERSPAN source session using VLANs as the source.

Answer

The session is misconfigured because ERSPAN cannot use VLANs as source.

Answer

The session is misconfigured because the ERSPAN ID must be less than 100.

Answer

The session is misconfigured because the destination IP must be on the same subnet.

Question 14

A DMVPN Phase 3 network with EIGRP as the routing protocol experiences intermittent connectivity between spokes. R1 (hub) has 'ip summary-address eigrp 100 10.0.0.0 255.255.0.0' configured on the tunnel interface. R2 (spoke) shows 'show ip eigrp topology all-links' listing 10.1.0.0/24 as reachable via R1, but traffic from R2 to 10.1.0.1 (another spoke) is forwarded to R1 instead of directly via the spoke-to-spoke tunnel. What is the root cause?

Accepted Answer

The summary route on the hub creates a less specific route that is preferred over the more specific /24 routes learned from other spokes, causing suboptimal routing.. The hub's summary route 10.0.0.0/16 is advertised to spokes, causing them to prefer the summary route over the more specific /24 routes learned from other spokes via NHRP redirect. This prevents spoke-to-spoke direct tunnels from being established or used, as traffic is forwarded to the hub based on the summary route.

Answer

EIGRP stub configuration on spokes prevents them from learning routes from other spokes.

Answer

NHRP redirect is disabled on the hub, preventing spoke-to-spoke tunnel establishment.

Answer

The spoke-to-spoke tunnel interface has a different MTU causing fragmentation.

Question 15

What is the maximum hop count for a route in RIP?

Accepted Answer

15. RIP (Routing Information Protocol) uses a maximum hop count of 15 to prevent routing loops. A route with a hop count of 16 is considered unreachable (infinite metric). This limit is defined in RFC 1058 for RIPv1 and RFC 2453 for RIPv2, ensuring that the network diameter remains small and loop-free.

Answer

16

Answer

255

Answer

32