300-410 Practice Test 37 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show ip ospf interface detail

FastEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0.0.0.0, Attached via Network Statement
  Process ID 1, Router ID 10.1.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID Cost    Disabled    Shutdown      Topology Name
        0        1        no          no            Base
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 10.1.1.1, Interface address 10.1.1.1
  Backup Designated router (ID) 10.1.1.2, Interface address 10.1.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 25
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 10.1.1.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)

What does this output indicate?

Accepted Answer

OSPF is operating normally with one neighbor, suggesting CoPP is not impacting OSPF.. The output shows that OSPF has formed a full adjacency with neighbor 10.1.1.2, which is the Backup Designated Router. The neighbor count is 1 and the adjacent neighbor count is 1, indicating that OSPF is operating normally on this interface. Therefore, CoPP is not impacting OSPF Hello or adjacency formation.

Answer

OSPF is not forming adjacencies due to CoPP dropping Hello packets.

Answer

OSPF is experiencing DR/BDR election issues due to CoPP.

Answer

OSPF is not receiving Hello packets due to CoPP.

Question 2

Which TWO statements about BFD echo mode are true? (Choose TWO.)

Accepted Answer

Echo packets are generated by the sending router and forwarded back by the remote router.. In BFD echo mode, the sending router generates echo packets that are looped back by the remote router, allowing detection of failures without involving the remote router's control plane. This reduces CPU load on the remote router. The other statements are false because echo mode does not require a separate session for each direction, and it does not increase the number of BFD control packets.

Answer

Echo mode requires a separate BFD session for each direction.

Answer

Echo mode increases the number of BFD control packets sent between routers.

Answer

Echo mode is enabled by default on all interfaces.

Question 3

Which TWO commands can be used to verify the operational state of BFD sessions on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

show bfd neighbors. The 'show bfd neighbors' command displays BFD session details such as neighbor address, interface, state, and timers. The 'show bfd session' command provides similar information, including the local discriminator and session state. The other commands are either unrelated or do not show BFD session state.

Answer

show ip route

Answer

show bfd statistics

Answer

show running-config | include bfd

Question 4

Examine the partial BFD configuration on a router:

interface GigabitEthernet0/0
 bfd interval 100 min_rx 100 multiplier 3
!
interface GigabitEthernet0/1
 bfd interval 200 min_rx 200 multiplier 3
!
router ospf 1
 bfd all-interfaces
!

The router has OSPF neighbors on both interfaces. Which statement is true?

Accepted Answer

The BFD session on GigabitEthernet0/0 will detect failures in 300 ms, and on GigabitEthernet0/1 in 600 ms.. BFD timers are configured per interface. Each BFD session independently uses the timers configured on its respective interface. The multiplier is applied per session.

Answer

Both BFD sessions will use the same timer values because OSPF is configured with 'bfd all-interfaces'.

Answer

The BFD session on GigabitEthernet0/1 will not form because the interval is too high.

Answer

The router will use the minimum interval across all interfaces for consistency.

Question 5

A router has the following BFD configuration for a static route:

ip route 10.0.0.0 255.255.255.0 192.168.1.2
bfd map 192.168.1.2 10.0.0.0 255.255.255.0
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 bfd interval 100 min_rx 100 multiplier 3
!

What is the purpose of the 'bfd map' command in this context?

Accepted Answer

It creates a BFD session to the next-hop 192.168.1.2 and associates it with the static route to 10.0.0.0/24.. For static routes, BFD must be explicitly mapped to the next-hop and destination prefix. The 'bfd map' command associates a BFD session with a static route so that if BFD detects a failure, the static route is removed from the routing table.

Answer

It maps the BFD session to the interface, enabling BFD for all static routes using that interface.

Answer

It maps the BFD session to the OSPF process, which is incorrect for static routes.

Answer

It is used to configure BFD for multiple static routes simultaneously.

Question 6

Which BFD packet type is used for initial session establishment and carries the discriminator values?

Accepted Answer

BFD Control packets. BFD Control packets are used for session establishment, carrying local and remote discriminator values, and are sent periodically to maintain the session.

Answer

BFD Echo packets

Answer

BFD Poll packets

Answer

BFD Hello packets

Question 7

R1 and R2 are IS-IS neighbors with BFD enabled. R1#show clns is-neighbors shows R2 as 'Up'. R1#show bfd neighbors shows the session as 'Down'. R2#show bfd neighbors shows the session as 'Up' with R1. R1 has 'bfd interval 50 min_rx 50 multiplier 3' on the interface. R2 has 'bfd interval 100 min_rx 100 multiplier 3'. The link is stable. What is the root cause?

Accepted Answer

R1 has an ACL blocking UDP port 3784 from R2.. IS-IS BFD requires that the BFD session be established between the same IP addresses used for IS-IS. If R1's BFD session is down but R2's is up, it indicates a unidirectional issue. This can be due to an MTU mismatch where R1's BFD packets are fragmented and dropped, or a firewall blocking inbound BFD packets on R1. Here, the most likely cause is that R1 has an ACL denying UDP port 3784 from R2.

Answer

IS-IS requires 'bfd all-interfaces' to work with BFD.

Answer

The BFD multiplier on R1 is too low.

Answer

The IS-IS metric must be set to 1 for BFD.

Question 8

How does BFD prevent loops in a network where multiple BFD sessions might exist between the same pair of routers?

Accepted Answer

By matching the Your Discriminator field against the local discriminator. BFD uses a mandatory Your Discriminator field in Control packets; a router will only accept a BFD Control packet if the Your Discriminator matches its own local discriminator, preventing misdirected packets from creating loops.

Answer

By using TTL values to limit packet propagation

Answer

By requiring authentication in all BFD packets

Answer

By using sequence numbers in BFD Control packets

Question 9

A network engineer runs the following command to troubleshoot BFD with BGP:

R1# show bgp ipv4 unicast 10.3.3.0/24

BGP routing table entry for 10.3.3.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0
      BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BGP is using BFD with state UP, enabling sub-second failure detection for this prefix.. The output shows that BFD is enabled for the BGP session and the BFD state is UP, indicating fast failure detection for the BGP neighbor.

Answer

BFD is disabled for this BGP neighbor.

Answer

BFD state is DOWN, so BGP uses its own timers.

Answer

BGP is using BFD only for IPv6 prefixes.

Question 10

What is the default BFD multiplier (detection time multiplier) on Cisco IOS-XE?

Accepted Answer

3. The default BFD multiplier is 3, meaning the detection time is 3 times the negotiated hello interval.

Answer

1

Answer

2

Answer

4

Question 11

An engineer configures IPsec between two routers using transform-set esp-aes 256 esp-sha-hmac. The tunnel fails to establish. Debug shows 'transform set proposal mismatch'. Which is the most likely explanation?

Accepted Answer

The other router uses 'esp-aes' without specifying the key length, defaulting to 128-bit, causing a mismatch.. The debug output 'transform set proposal mismatch' indicates that the IPsec transform sets on the two peers do not match. When 'esp-aes 256' is configured on one router, the other router must explicitly specify 'esp-aes 256' as well; if it only uses 'esp-aes' without specifying a key length, Cisco IOS defaults to AES-128. This mismatch in encryption algorithm strength (256-bit vs. 128-bit) causes the IKE phase 2 negotiation to fail.

Answer

The transform-set uses SHA-1, which is not supported by the other router.

Answer

The IPsec proposal includes both esp-aes and esp-3des, causing confusion.

Answer

The transform-set is missing the authentication header.

Question 12

Consider the following configuration on router R2:

!--- R2 configuration
ip prefix-list FILTER seq 5 deny 10.1.0.0/16 le 24
ip prefix-list FILTER seq 10 permit 0.0.0.0/0 le 32
!
route-map BGP-IN permit 10
 match ip address prefix-list FILTER
!
router bgp 65000
 neighbor 192.168.1.1 route-map BGP-IN in
!

What is the effect of this configuration?

Accepted Answer

Routes within 10.1.0.0/16 with mask length 24 or shorter are denied; all other routes are permitted.. The prefix-list FILTER denies any prefix within 10.1.0.0/16 with a mask length less than or equal to 24 (i.e., 10.1.0.0/16 through 10.1.255.0/24). The permit statement allows all other prefixes. The route-map BGP-IN calls this prefix-list; since there is only one permit sequence, routes that match the deny statement in the prefix-list are implicitly denied by the route-map. Therefore, routes like 10.1.0.0/16, 10.1.1.0/24, etc., are filtered out.

Answer

All routes from neighbor 192.168.1.1 are accepted; the prefix-list is not applied correctly because the route-map only has a permit sequence.

Answer

Only routes with mask length exactly 24 are denied; all other routes are permitted.

Answer

The configuration is incomplete; a route-map must have a deny statement to filter routes.

Question 13

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

Accepted Answer

The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.. The ACL denies ICMPv6 types 133-137, which are essential for Neighbor Discovery (ND) processes such as Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). Without permitting these types, the router cannot resolve IPv6 neighbors or maintain IPv6 connectivity, as ND is fundamental to IPv6 operation.

Answer

The ACL must be applied outbound, not inbound, to allow ND packets to be sent.

Answer

The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.

Answer

The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.

Question 14

A network engineer runs the following command on Router R1:

R1# show snmp mib

MIB: IF-MIB
MIB: SNMPv2-MIB
MIB: IP-MIB
MIB: CISCO-CONFIG-MAN-MIB
MIB: ENTITY-MIB

Based on this output, which statement is correct?

Accepted Answer

The router supports monitoring of configuration changes via SNMP.. The output of 'show snmp mib' lists the MIBs that the router supports. The presence of CISCO-CONFIG-MAN-MIB indicates that the router supports the Cisco Configuration Management MIB, which allows SNMP to monitor and manage configuration changes, such as when a configuration is saved or modified. Therefore, option A is correct.

Answer

The router does not support the IF-MIB.

Answer

The router only supports Cisco proprietary MIBs.

Answer

The ENTITY-MIB is used for entity authentication.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---
--- 192.0.2.13         10.0.0.13          ---                ---
--- 192.0.2.14         10.0.0.14          ---                ---
--- 192.0.2.15         10.0.0.15          ---                ---
--- 192.0.2.16         10.0.0.16          ---                ---
--- 192.0.2.17         10.0.0.17          ---                ---
--- 192.0.2.18         10.0.0.18          ---                ---
--- 192.0.2.19         10.0.0.19          ---                ---
--- 192.0.2.20         10.0.0.20          ---                ---

R1# show ip nat statistics
Total active translations: 11 (0 static, 11 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 200  Misses: 0
CEF Translated packets: 200, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 11
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 11

Based on this output, what is the problem?

Accepted Answer

The NAT pool is exhausted; no addresses are available for new translations.. The output shows 11 active dynamic NAT translations using all 11 addresses from pool POOL1 (192.0.2.10–192.0.2.20, which is a /28 subnet with 14 usable addresses, but the pool is defined from .10 to .20, giving exactly 11 addresses). With no Port Address Translation (PAT) configured, each inside host requires a unique global IP, so once all 11 addresses are in use, no new translations can be created, causing the pool to be exhausted.

Answer

PAT is not configured, causing address exhaustion.

Answer

The inside and outside interfaces are misconfigured.

Answer

Static NAT is conflicting with dynamic NAT.