300-410 Practice Test 38 — 15 Questions

Question 1

Consider the following configuration on router R2:

!--- R2 configuration
ip prefix-list FILTER seq 5 deny 10.1.0.0/16 le 24
ip prefix-list FILTER seq 10 permit 0.0.0.0/0 le 32
!
route-map BGP-IN permit 10
 match ip address prefix-list FILTER
!
router bgp 65000
 neighbor 192.168.1.1 route-map BGP-IN in
!

What is the effect of this configuration?

Accepted Answer

Routes within 10.1.0.0/16 with mask length 24 or shorter are denied; all other routes are permitted.. The prefix-list FILTER denies any prefix within 10.1.0.0/16 with a mask length less than or equal to 24 (i.e., 10.1.0.0/16 through 10.1.255.0/24). The permit statement allows all other prefixes. The route-map BGP-IN calls this prefix-list; since there is only one permit sequence, routes that match the deny statement in the prefix-list are implicitly denied by the route-map. Therefore, routes like 10.1.0.0/16, 10.1.1.0/24, etc., are filtered out.

Answer

All routes from neighbor 192.168.1.1 are accepted; the prefix-list is not applied correctly because the route-map only has a permit sequence.

Answer

Only routes with mask length exactly 24 are denied; all other routes are permitted.

Answer

The configuration is incomplete; a route-map must have a deny statement to filter routes.

Question 2

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

Accepted Answer

The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.. The ACL denies ICMPv6 types 133-137, which are essential for Neighbor Discovery (ND) processes such as Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). Without permitting these types, the router cannot resolve IPv6 neighbors or maintain IPv6 connectivity, as ND is fundamental to IPv6 operation.

Answer

The ACL must be applied outbound, not inbound, to allow ND packets to be sent.

Answer

The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.

Answer

The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.

Question 3

A network engineer runs the following command on Router R1:

R1# show snmp mib

MIB: IF-MIB
MIB: SNMPv2-MIB
MIB: IP-MIB
MIB: CISCO-CONFIG-MAN-MIB
MIB: ENTITY-MIB

Based on this output, which statement is correct?

Accepted Answer

The router supports monitoring of configuration changes via SNMP.. The output of 'show snmp mib' lists the MIBs that the router supports. The presence of CISCO-CONFIG-MAN-MIB indicates that the router supports the Cisco Configuration Management MIB, which allows SNMP to monitor and manage configuration changes, such as when a configuration is saved or modified. Therefore, option A is correct.

Answer

The router does not support the IF-MIB.

Answer

The router only supports Cisco proprietary MIBs.

Answer

The ENTITY-MIB is used for entity authentication.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---
--- 192.0.2.13         10.0.0.13          ---                ---
--- 192.0.2.14         10.0.0.14          ---                ---
--- 192.0.2.15         10.0.0.15          ---                ---
--- 192.0.2.16         10.0.0.16          ---                ---
--- 192.0.2.17         10.0.0.17          ---                ---
--- 192.0.2.18         10.0.0.18          ---                ---
--- 192.0.2.19         10.0.0.19          ---                ---
--- 192.0.2.20         10.0.0.20          ---                ---

R1# show ip nat statistics
Total active translations: 11 (0 static, 11 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 200  Misses: 0
CEF Translated packets: 200, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 11
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 11

Based on this output, what is the problem?

Accepted Answer

The NAT pool is exhausted; no addresses are available for new translations.. The output shows 11 active dynamic NAT translations using all 11 addresses from pool POOL1 (192.0.2.10–192.0.2.20, which is a /28 subnet with 14 usable addresses, but the pool is defined from .10 to .20, giving exactly 11 addresses). With no Port Address Translation (PAT) configured, each inside host requires a unique global IP, so once all 11 addresses are in use, no new translations can be created, causing the pool to be exhausted.

Answer

PAT is not configured, causing address exhaustion.

Answer

The inside and outside interfaces are misconfigured.

Answer

Static NAT is conflicting with dynamic NAT.

Question 5

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, OSPF neighbors go down. The CoPP policy has a class that matches OSPF traffic with a rate-limit of 100 pps. Which is the most likely explanation?

Accepted Answer

The OSPF traffic is being dropped because the rate-limit is too low for the hello interval.. OSPF uses Hello packets to establish and maintain neighbor adjacencies, typically sent every 10 seconds on broadcast networks. If the CoPP rate-limit of 100 pps is too low to accommodate the burst of OSPF Hello packets (e.g., during neighbor initialization or network convergence), the policer will drop excess packets, causing the OSPF dead timer to expire and neighbors to go down. This is the most direct cause because the policy explicitly matches OSPF traffic and applies a strict rate limit that can starve the control plane of necessary protocol messages.

Answer

The CoPP policy is applied to the wrong interface.

Answer

The OSPF traffic is matched by the default class and dropped.

Answer

The CoPP policy uses 'police' instead of 'rate-limit'.

Question 6

Which TWO statements about Flexible NetFlow flow monitors and flow exporters are true? (Choose TWO.)

Accepted Answer

A flow monitor can reference only one flow record, but multiple flow monitors can reference the same flow record.. Flexible NetFlow separates flow monitoring into three components: flow record (defines what to collect), flow monitor (applies the record and associates an exporter), and flow exporter (defines export parameters). A flow monitor can reference only one flow record, but multiple flow monitors can reference the same flow record. A flow exporter can be shared by multiple flow monitors. The default export format is NetFlow version 9, not v5. The flow monitor is applied to an interface using the 'ip flow monitor' command, not 'ip flow-export'.

Answer

A flow exporter can be referenced by only one flow monitor to avoid export conflicts.

Answer

The default export format for Flexible NetFlow is NetFlow version 5.

Answer

The flow monitor is applied to an interface using the 'ip flow-export' command.

Question 7

A network engineer is troubleshooting PBR on a Cisco router where traffic from VLAN 100 (192.168.10.0/24) should be forwarded to next-hop 10.10.10.2 via a route map named 'VLAN100-PBR'. The engineer has applied the route map to interface GigabitEthernet0/0.100 (subinterface) using 'ip policy route-map VLAN100-PBR'. The engineer verifies that the route map is correctly configured with 'match ip address 100' and 'set ip next-hop 10.10.10.2', and the access list 100 matches the source subnet. However, traffic from VLAN 100 is still forwarded using the routing table. What is the most likely cause?

Accepted Answer

The traffic is arriving on the physical interface GigabitEthernet0/0 instead of the subinterface GigabitEthernet0/0.100.. PBR applied to a subinterface will only process traffic that arrives on that specific subinterface. If the traffic is arriving on the physical interface or another subinterface, it will not be matched. The engineer must ensure the traffic actually enters the subinterface where the policy is applied.

Answer

The access list 100 is missing the 'permit' keyword; PBR only processes permit statements.

Answer

The 'set ip next-hop' command must be followed by 'force' to override the routing table.

Answer

The route map must be applied to the VLAN interface (SVI) instead of the subinterface.

Question 8

Examine the following configuration on R3:

!--- R3 configuration
access-list 10 permit 192.168.0.0 0.0.255.255
access-list 10 deny   any
!
route-map OSPF-REDIST permit 10
 match ip address 10
 set metric-type type-1
!
router ospf 1
 redistribute eigrp 100 subnets route-map OSPF-REDIST
!

What is the effect of this configuration?

Accepted Answer

Only EIGRP routes in the 192.168.0.0/16 range are redistributed into OSPF as type-1 external routes.. The ACL 10 permits only routes with source IP in the 192.168.0.0/16 range. The route-map OSPF-REDIST matches this ACL and sets the metric type to type-1. Only EIGRP routes that match the ACL (i.e., have a network starting with 192.168.x.x) are redistributed into OSPF as type-1 external routes. Routes not matching the ACL are denied because the route-map has only one permit sequence and the ACL ends with deny any.

Answer

All EIGRP routes are redistributed into OSPF as type-1 external routes.

Answer

EIGRP routes in 192.168.0.0/16 are redistributed as type-2 by default; the set metric-type is ignored.

Answer

The configuration is invalid because the route-map uses an ACL that ends with deny any; a prefix-list must be used instead.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip vrf CUSTOMER
  Name                             Default RD           Interfaces
  CUSTOMER                         65001:100             Gi0/0.100
                                                        Gi0/1.100

Based on this output, which statement is correct?

Accepted Answer

The VRF CUSTOMER is configured with two subinterfaces.. The output of 'show ip vrf CUSTOMER' displays the VRF name, its default route distinguisher (RD) of 65001:100, and the interfaces assigned to it. The interfaces listed are Gi0/0.100 and Gi0/1.100, which are both subinterfaces (indicated by the .100 suffix). Therefore, the VRF CUSTOMER is correctly configured with two subinterfaces.

Answer

The VRF CUSTOMER has no route distinguisher configured.

Answer

The VRF CUSTOMER is not active because no routes are shown.

Answer

The VRF CUSTOMER is using OSPF as the routing protocol.

Question 10

An engineer configures ERSPAN on a Cisco router to monitor traffic from a tunnel interface. The mirrored traffic shows the tunnel's inner IP headers, but the outer encapsulation is missing. What is the most likely cause?

Accepted Answer

ERSPAN on a tunnel interface captures the inner IP packet, not the encapsulated GRE/IPsec packet.. When monitoring a tunnel interface with ERSPAN, the router captures the traffic at the point where it enters the tunnel (before encapsulation) or exits (after decapsulation). To capture the encapsulated packets, the source must be the physical egress interface, not the tunnel interface. By default, ERSPAN on a tunnel interface shows the inner packet.

Answer

The ERSPAN session is configured with 'erspan-type' that strips the outer header.

Answer

The collector is not configured to decode GRE headers.

Answer

The tunnel interface is in a VRF, causing the outer header to be removed.

Question 11

A network engineer is troubleshooting an OSPF network where an ABR (R1) is configured with the 'area 1 range 10.0.0.0 255.255.0.0' command to summarize routes from area 1 into area 0. After the configuration, routers in area 0 lose connectivity to the 10.0.1.0/24 subnet, although the summary route 10.0.0.0/16 is present in their routing tables. What is the most likely cause?

Accepted Answer

The summary route is installed, but the next-hop IP address for the summary route is not reachable from routers in area 0, causing traffic to be dropped.. The issue is that the summary route may be installed, but the more specific routes are suppressed. If the summary route points to a next hop that is not reachable or has a higher metric, traffic may be black-holed.

Answer

The summary route 10.0.0.0/16 is being advertised with a metric of 0, causing routers to prefer a default route instead.

Answer

The ABR is not generating the summary route because the component routes are not all in the same area.

Answer

The 10.0.1.0/24 subnet is not included in the summary range because the range command uses a network mask that does not match the subnet's network address.

Question 12

A network engineer is troubleshooting a DMVPN phase 2 network where the hub router is not forming an NHRP adjacency with a spoke. The spoke router is configured with 'ip nhrp nhs 10.0.0.1' and 'ip nhrp map 10.0.0.1 192.168.1.1'. The hub's tunnel interface IP is 10.0.0.1, and the physical interface IP is 192.168.1.1. The engineer pings the hub's tunnel IP from the spoke and it succeeds. However, 'show ip nhrp' on the spoke shows no NHRP entries. What is the most likely cause?

Accepted Answer

The hub router has 'ip nhrp authentication DMVPN' configured, but the spoke does not.. NHRP registration requires the spoke to send a Registration Request to the hub. If the hub does not respond, the spoke will not have NHRP entries. A common cause is that the hub's NHRP authentication is configured with a password, but the spoke's NHRP authentication is missing or mismatched.

Answer

The spoke's tunnel interface is in a different VRF than the hub's.

Answer

The hub's tunnel interface has 'no ip nhrp server-only' configured.

Answer

The spoke's NHRP map is incorrect; it should map the hub's tunnel IP to the hub's tunnel IP.

Question 13

In IPsec site-to-site VPN, what is the default IPsec SA lifetime in Cisco IOS?

Accepted Answer

3600 seconds and 4608000 kilobytes. The default IPsec Security Association (SA) lifetime in Cisco IOS for site-to-site VPNs is 3600 seconds (1 hour) and 4,608,000 kilobytes (4.5 GB). These values are defined in the IPsec transform set configuration and control when the SA expires, triggering a rekey via IKEv1 or IKEv2 to maintain secure communication.

Answer

86400 seconds and 256000 kilobytes

Answer

28800 seconds and 1000000 kilobytes

Answer

1800 seconds and 256000 kilobytes

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-OSPF (match-all)
      1000 packets, 60000 bytes
      5 minute offered rate 2000 bps, drop rate 0000 bps
      Match: access-group 140
      police:
          cir 64000 bps, bc 12000 bytes, be 12000 bytes
        conformed 1000 packets, 60000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

OSPF traffic is being transmitted without any drops.. The output shows that under the CoPP-OSPF class, 1000 packets have been conformed and transmitted, with zero exceeded or violated packets. This means all OSPF traffic matched by access-group 140 has been within the police rate of 64000 bps, so no packets have been dropped. Therefore, OSPF traffic is being transmitted without any drops.

Answer

OSPF packets are being dropped due to exceeding the police rate.

Answer

The police rate is set to 32000 bps.

Answer

The class-default is matching OSPF traffic.

Question 15

A network engineer is troubleshooting an EIGRP network where route summarization is configured. Router R1 has the 'ip summary-address eigrp 100 10.0.0.0 255.0.0.0' command on its interface facing R2. After the configuration, R2 loses connectivity to the 10.1.0.0/16 subnet, which is one of the component routes. The engineer checks the routing table on R2 and sees the summary route 10.0.0.0/8 but not the specific route. What is the most likely cause?

Accepted Answer

The 10.1.0.0/16 subnet is not included in the summary range because the summary mask is /8, but the subnet's network address is 10.1.0.0, which is within the range, but the EIGRP process may have a split-horizon issue or the component route is not in the EIGRP topology table.. In EIGRP, the summary address command suppresses the advertisement of more specific routes and generates the summary. However, if the summary route is not installed in the routing table (e.g., due to a missing component), the specific routes may still be suppressed, causing a black hole.

Answer

The summary route 10.0.0.0/8 is being advertised with a metric of infinity, causing it to be ignored.

Answer

The 10.1.0.0/16 subnet is not directly connected to R1, so it cannot be summarized.

Answer

The summary address command was applied on the wrong interface, causing the summary to be sent out all interfaces, including the one facing the 10.1.0.0/16 subnet's origin.