300-410 Practice Test 38 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          65002    1200    1200       10    0    0 01:00:00        5
10.2.2.2        4          65003    0       0          0    0    0 never    Active

Based on this output, what is the problem with the neighbor 10.2.2.2?

Accepted Answer

The neighbor is not reachable or is not configured to accept BGP connections.. The 'Active' state in BGP indicates that the router is actively trying to establish a TCP connection to the neighbor but has not yet succeeded. This typically occurs because the neighbor is unreachable (no route to the destination IP), the neighbor is not configured to accept BGP connections (e.g., no BGP process or incorrect ACL), or a firewall is blocking TCP port 179. The output shows 0 messages sent/received and 'never' uptime, confirming no session has ever been established.

Answer

The neighbor is in Idle state because of a hold timer expiry.

Answer

The neighbor has received 5 prefixes, indicating a successful session.

Answer

The BGP table version is 10, meaning there is a routing loop.

Question 2

A network engineer configures a DMVPN spoke with OSPF as the routing protocol:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map 10.0.0.1 192.168.1.1
 ip nhrp map multicast 192.168.1.1
!
router ospf 1
 network 10.0.0.0 0.0.0.255 area 0
!

What is a common issue with OSPF in this DMVPN Phase 2 configuration?

Accepted Answer

OSPF will elect a DR/BDR on the hub, which can cause suboptimal routing and adjacency issues.. In a DMVPN Phase 2 configuration, the tunnel interface is a multipoint GRE (mGRE) interface, which by default is treated as a broadcast network by OSPF. On a broadcast network, OSPF elects a DR and BDR, and in DMVPN the hub typically becomes the DR while spokes become DROTHERs. This causes spokes to form full adjacencies only with the hub, and inter-spoke traffic must transit the hub, producing suboptimal routing and potential adjacency or next-hop issues.

Answer

OSPF will not form adjacencies because of NHRP authentication.

Answer

OSPF will use point-to-point network type by default.

Answer

OSPF will automatically adjust to the DMVPN environment.

Question 3

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# debug eigrp packets hello

*Mar  1 00:05:23.123: EIGRP: received packet with MD5 authentication, key id = 1
*Mar  1 00:05:23.123: EIGRP: int GigabitEthernet0/0, src 10.1.1.2 dst 224.0.0.10, seq 0, ttl 1, opcode = 1 (Hello)
*Mar  1 00:05:23.123: EIGRP: authentication failed for packet from 10.1.1.2, key id = 1, integrity check failed

What does this output indicate?

Accepted Answer

The MD5 key ID or key string does not match between R1 and 10.1.1.2, preventing neighbor formation.. The debug output shows an EIGRP packet with MD5 authentication was received from 10.1.1.2, but the integrity check failed. This indicates that the MD5 key ID or key string configured on R1 does not match the one on the neighbor, which prevents the neighbor relationship from forming. The 'integrity check failed' message is a definitive sign of an authentication mismatch, not an intermittent issue.

Answer

The EIGRP neighbor relationship is up, but authentication is failing intermittently.

Answer

EIGRP is using plain-text authentication and the key is incorrect.

Answer

The neighbor 10.1.1.2 is not configured for EIGRP authentication.

Question 4

A network engineer runs the following command to verify IPv6 access-list hits:

R1# show ipv6 access-list FILTER | include matches
    permit ipv6 2001:DB8:1::/48 any sequence 10 (10 matches)
    deny ipv6 2001:DB8:2::/48 any sequence 20 (5 matches)
    permit ipv6 any any sequence 30 (100 matches)

What does this output indicate?

Accepted Answer

5 packets from 2001:DB8:2::/48 have been denied, and 110 packets have been permitted.. The output shows the hit counts for each ACL entry: sequence 10 has permitted 10 packets from 2001:DB8:1::/48, sequence 30 has permitted 100 packets from any source, and sequence 20 has denied 5 packets from 2001:DB8:2::/48. The total permitted packets are 10 + 100 = 110, and the denied count is 5, matching the statement in A.

Answer

All packets from 2001:DB8:2::/48 have been permitted.

Answer

The access list has been applied to an interface but not used.

Answer

The access list is invalid because of the order of entries.

Question 5

A network engineer notices that IPv6 hosts on a segment are not receiving Router Advertisements, even though Router R1 has IPv6 unicast-routing enabled and an IPv6 address on the interface. Router R1 has the following relevant configuration:
interface GigabitEthernet0/0
 ipv6 address 2001:DB8:1::1/64
 ipv6 nd suppress-ra
!
Router R2, connected to the same segment, shows: no IPv6 neighbors in the neighbor cache for R1's link-local address. What is the root cause?

Accepted Answer

The 'ipv6 nd suppress-ra' command is configured, which prevents Router Advertisements from being sent.. The 'ipv6 nd suppress-ra' command explicitly disables the sending of Router Advertisements (RAs) on the interface. Even though IPv6 unicast-routing is enabled and an IPv6 address is configured, R1 will not transmit RAs, which prevents IPv6 hosts from autoconfiguring their addresses and default routes via SLAAC or DHCPv6. This is the direct root cause of the hosts not receiving RAs.

Answer

The interface is in a down state due to a Layer 1 issue, preventing RA generation.

Answer

Router R2 has IPv6 routing disabled, so it cannot process RAs from R1.

Answer

The IPv6 address on R1 is not in the same subnet as the hosts, causing RA filtering.

Question 6

An engineer configures a DMVPN Phase 2 network. Spoke routers can communicate with the hub, but spoke-to-spoke traffic does not trigger a direct tunnel. Which is the most likely explanation?

Accepted Answer

The hub router is missing the 'ip nhrp redirect' command.. In a DMVPN Phase 2 network, spoke-to-spoke tunnels are triggered dynamically when a spoke receives an NHRP redirect from the hub. The 'ip nhrp redirect' command on the hub router enables it to send redirect messages to spokes, informing them of a more direct path to another spoke. Without this command, the hub forwards traffic between spokes but never signals the spokes to build a direct tunnel, so spoke-to-spoke traffic continues to traverse the hub.

Answer

The spoke routers have 'ip nhrp shortcut' configured.

Answer

The tunnel mode is set to gre multipoint on the spokes.

Answer

The NHRP authentication is mismatched.

Question 7

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              OSPF_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Up
3    00:01:32 UTC Mar 1  syslog              OSPF_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Up

Based on this output, which statement is correct?

Accepted Answer

The OSPF neighbor is flapping.. The event history shows the OSPF neighbor transitioning Down → Up → Down → Up within a four-second window, which is the textbook signature of an unstable adjacency. Rapid repeated state changes indicate the neighbor relationship is flapping rather than being stable or permanently down.

Answer

The OSPF neighbor is stable.

Answer

The EEM policy is not configured.

Answer

The OSPF neighbor is down permanently.

Question 8

Which DHCPv6 option carries the DNS recursive name server information?

Accepted Answer

Option 23 (DNS Recursive Name Server). DHCPv6 Option 23 (DNS Recursive Name Server) is specifically defined in RFC 3646 to carry the IPv6 addresses of DNS recursive name servers to DHCPv6 clients. This is the standard mechanism for IPv6 hosts to learn DNS server addresses via DHCPv6, analogous to DHCPv4 Option 6 for IPv4.

Answer

Option 6 (Domain Name Server)

Answer

Option 24 (Domain Search List)

Answer

Option 21 (SIP Server Domain Name)

Question 9

Examine the following configuration on a PE router:

ip vrf CUSTOMER-C
 rd 200:1
!
interface GigabitEthernet0/3
 ip vrf forwarding CUSTOMER-C
 ip address 10.2.2.1 255.255.255.252
!
router ospf 1 vrf CUSTOMER-C
 network 10.2.2.0 0.0.0.3 area 0
!
router bgp 65000
 address-family ipv4 vrf CUSTOMER-C
  redistribute ospf 1
 exit-address-family

What is missing from this configuration?

Accepted Answer

The VRF is missing route-target export and import commands.. In MPLS L3VPN, a VRF requires route-target export and import commands to control the distribution of VPN routes via MP-BGP. Without these, the VRF cannot import or export routes, and the VPN will not function. The configuration shows a VRF with RD but no route-targets, so they are missing.

Answer

The OSPF network command should use a wildcard mask of 0.0.0.0.

Answer

The BGP neighbor must be configured under the VRF address-family.

Answer

The VRF must have a route distinguisher that matches the route-target.

Question 10

Examine the following IPv6 ACL applied to an interface:

ipv6 access-list FILTER
 permit ipv6 any any fragments
 deny ipv6 any any

interface GigabitEthernet0/1
 ipv6 traffic-filter FILTER in

What is the effect of this configuration?

Accepted Answer

Only fragmented IPv6 packets are permitted; all other IPv6 traffic is denied.. The ACL explicitly permits only fragmented IPv6 packets via the 'permit ipv6 any any fragments' statement, while the subsequent 'deny ipv6 any any' statement denies all other IPv6 traffic. Since ACLs are processed sequentially, the permit for fragments is evaluated first, allowing only fragmented packets; all non-fragmented packets are then denied by the second entry.

Answer

All IPv6 traffic is permitted because the permit statement matches any packet.

Answer

The ACL is invalid because 'fragments' cannot be used with 'any any'.

Answer

The interface command is missing the 'ipv6 enable' prerequisite.

Question 11

A network engineer is troubleshooting a router that is not responding to SNMP polls from the NMS at 10.1.1.100. The SNMP configuration includes 'snmp-server community public RO' and 'snmp-server community private RW'. The engineer can ping the router from the NMS. 'show snmp' shows SNMP is enabled. What is the most likely cause?

Accepted Answer

An ACL is applied to the SNMP community that denies the NMS IP.. The NMS can ping the router, confirming IP reachability, and 'show snmp' confirms SNMP is enabled. The most likely cause is an ACL applied to the SNMP community that denies the NMS IP address (10.1.1.100). Cisco IOS allows an access-list to be attached to an SNMP community string using the 'snmp-server community [RO|RW] ' command, which filters SNMP requests based on source IP. Since the NMS can ping but not poll, the ACL is blocking SNMP traffic while permitting ICMP.

Answer

The NMS is using the wrong SNMP version.

Answer

The router's SNMP agent is disabled due to high CPU.

Answer

The NMS is using the wrong community string.

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)

Based on this output, what is the operational state of uRPF on this interface?

Accepted Answer

uRPF is enabled in strict mode. The output explicitly states 'IPv6 uRPF: strict mode (drop invalid packets)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled on the interface and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB pointing back to the same interface; if not, the packet is dropped. This is a direct read of the operational state from the show command.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 13

An engineer configures OSPF area range on an ABR to summarize routes. After configuration, some routes are still being advertised as individual LSAs into the backbone. Which is the most likely explanation?

Accepted Answer

The area range command does not summarize external routes redistributed into OSPF.. The OSPF 'area range' command only summarizes intra-area (Type 1 and Type 2) LSAs at an ABR; it does not affect external routes redistributed into OSPF as Type 5 (or Type 7) LSAs. External routes must be summarized with the 'summary-address' command on the ASBR (or NSSA ABR for Type 7). That is why some routes continue to be advertised individually after area range is configured.

Answer

The ABR is not configured with the summary-address command.

Answer

The area range is configured on the wrong ABR.

Answer

The OSPF process needs to be cleared to apply the area range.

Question 14

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)
  Inbound access list: FILTER-IPv6

Based on this output, which two features are configured on this interface?

Accepted Answer

uRPF in strict mode and inbound IPv6 ACL. The output shows 'IPv6 uRPF: strict mode (drop invalid packets)' and 'Inbound access list: FILTER-IPv6', confirming that unicast Reverse Path Forwarding in strict mode and an inbound IPv6 ACL are both configured on the interface. Strict uRPF verifies that the source address of incoming packets has a matching route in the FIB pointing back to the same interface, dropping packets that fail this check. The inbound ACL filters traffic before any routing decision, as indicated by the 'Inbound access list' line.

Answer

uRPF in loose mode and outbound IPv6 ACL

Answer

uRPF disabled and inbound IPv6 ACL

Answer

uRPF in strict mode and outbound IPv6 ACL

Question 15

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp neighbors 10.1.1.2 received-routes
BGP table version is 14, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/24      10.1.1.2                 0    100      0 65001 i
*> 192.168.1.0/24   10.1.1.2                 0    100      0 65001 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is receiving two routes from neighbor 10.1.1.2, both from AS 65001.. The command 'show bgp neighbors 10.1.1.2 received-routes' displays all routes received from the specified neighbor before any inbound filtering. The output shows two prefixes, both with next hop 10.1.1.2, and the AS path indicates they originated from AS 65001. The status codes show '*' for valid and '>' for best, meaning both are valid and best. Therefore, R1 is receiving two routes from neighbor 10.1.1.2, both from AS 65001.

Answer

R1 is sending two routes to neighbor 10.1.1.2.

Answer

R1 is receiving two routes, but one is filtered out by inbound policy.

Answer

R1 is receiving two routes, but the neighbor is not reachable.