300-410 Practice Test 39 — 15 Questions

Question 1

Drag and drop the steps to troubleshoot DHCP (IPv4 and IPv6) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check client interface for DHCP state and IP. Begin by checking the DHCP client's interface for an IP address and DHCP state. Then, verify that the relay agent is configured and reachable. Next, confirm that the DHCP server is reachable from the relay. After that, inspect access lists or firewall rules that might block DHCP traffic. Finally, review debug output to isolate the failure point.

Question 2

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "eigrp 100", distance 90, metric 2684416, type internal
  Redistributing via eigrp 100
  Last update from 10.0.0.2 on Tunnel0, 00:00:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, from 10.0.0.2, via Tunnel0
      Route metric is 2684416, traffic share count is 1
      Total delay is 20000 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

What does this output indicate?

Accepted Answer

The IPsec tunnel is up and EIGRP is exchanging routes over the tunnel.. The output shows a route to 192.168.2.0/24 learned via EIGRP (distance 90) with the next hop 10.0.0.2 reachable through Tunnel0. The last update was 23 seconds ago, confirming the tunnel is up and EIGRP is actively exchanging routing information over the IPsec tunnel. This indicates the IPsec Site-to-Site VPN is functioning and dynamic routing is working correctly.

Answer

The route to the remote LAN is not present, indicating a routing issue.

Answer

The route is using a static route, not a dynamic routing protocol.

Answer

The tunnel interface is down, causing the route to be unreachable.

Question 3

Drag and drop the steps to configure a DHCP pool and relay agent on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure DHCP pool with network and mask. First, you must define the DHCP pool with a name and network. Then, you set the default router and DNS server. Next, you exclude any addresses from the pool. Finally, you enable the DHCP relay agent on the interface facing clients to forward requests to the DHCP server.

Question 4

An engineer configures uRPF (Unicast Reverse Path Forwarding) in strict mode on a router interface facing the Internet. After configuration, legitimate traffic from customers is being dropped. The engineer verifies that the routing table has a route back to the source IP address. Which is the most likely explanation?

Accepted Answer

Asymmetric routing causes the return path to use a different interface. Strict uRPF checks that the source IP address of incoming packets has a route back through the same interface. If asymmetric routing is present (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the packets. This is a common edge case because engineers often assume that having a route to the source is sufficient, but strict mode requires the reverse path to be via the same interface.

Answer

The uRPF allow-default option is not configured

Answer

The source IP address is not in the routing table

Answer

uRPF strict mode requires CEF to be disabled

Question 5

An MPLS network is experiencing label distribution failures. Router R1 is an LSR connected to R2. R1's show mpls ldp neighbor shows R2 in OPERATIONAL state, but show mpls ldp bindings shows no label bindings for prefixes learned via OSPF from R2. R1's mpls ldp router-id is 1.1.1.1, and R2's is 2.2.2.2. The OSPF process on R1 advertises the loopback0 interface with ip address 1.1.1.1 255.255.255.255, and R2's loopback0 is 2.2.2.2. The link between them is 192.168.1.0/30. What is the root cause?

Accepted Answer

The LDP router-id on R1 is not reachable from R2 because OSPF is not advertising the loopback0 route, causing LDP to not exchange label bindings.. R1 shows R2 as an LDP neighbor in OPERATIONAL state, meaning the LDP session (TCP port 646) is established. However, no label bindings are exchanged for OSPF-learned prefixes from R2. LDP uses the router-id (1.1.1.1) as the transport address for label binding exchange. If OSPF does not advertise R1's loopback0 (1.1.1.1/32), R2 cannot reach this address, so LDP cannot complete the label mapping exchange, even though the neighbor session is up. The correct root cause is that R1's LDP router-id is not reachable from R2.

Answer

The mpls ldp label allocation is configured as 'per-prefix' instead of 'per-interface'.

Answer

The OSPF process on R1 has a route-map filtering the loopback route.

Answer

The LDP session is using the interface IP address as transport, but OSPF is not advertising the interface network.

Question 6

Which TWO statements correctly describe the behavior of VRF-Lite when using OSPF as the IGP? (Choose TWO.)

Accepted Answer

The OSPF process must be configured with the 'vrf ' keyword to associate it with a specific VRF.. In VRF-Lite, OSPF can be configured per VRF, and the OSPF process uses the VRF's routing table. The 'router ospf vrf ' command creates a VRF-aware OSPF process. By default, OSPF uses the VRF's route table, not the global table. The 'network' statement under the OSPF process is still used to enable OSPF on interfaces, but the interface must be in the same VRF. Option A is correct because the OSPF process is VRF-specific. Option D is correct because the 'network' command is still valid. Option B is incorrect because OSPF does not require BGP; it can run directly. Option C is incorrect because OSPF does not automatically redistribute connected routes; a redistribution command is needed. Option E is incorrect because OSPF LSA types are the same in VRF-Lite.

Answer

OSPF in VRF-Lite requires an MP-BGP session to exchange routes between VRFs.

Answer

By default, OSPF automatically redistributes all connected routes in the VRF into OSPF.

Answer

OSPF in VRF-Lite uses different LSA types compared to global OSPF.

Question 7

Which TWO statements about IPv4 extended access control lists are true? (Choose TWO.)

Accepted Answer

They can filter based on source and destination IP addresses.. IPv4 extended ACLs can filter traffic based on both source and destination IP addresses, as well as protocol type, port numbers, and other parameters. This is defined in the access-list command syntax (e.g., access-list 100 permit tcp 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255 eq 80), which allows granular control beyond standard ACLs that only filter on source IP.

Answer

They use a wildcard mask only for the destination address.

Answer

They can be named using numbers only.

Answer

They automatically log all matched packets.

Question 8

What is the default transport protocol used by NetFlow exporters on Cisco IOS-XE?

Accepted Answer

UDP. The default transport protocol is UDP, typically on port 2055, though configurable.

Answer

TCP

Answer

SCTP

Answer

ICMP

Question 9

An engineer configures NAT overload (PAT) on a router to translate internal addresses to a single public IP. Users can browse the web, but some applications that use non-standard ports fail. Which is the most likely explanation?

Accepted Answer

The application uses protocols that do not have port numbers, such as GRE, and PAT cannot handle them.. PAT (Port Address Translation) relies on TCP/UDP port numbers to multiplex multiple internal addresses to a single public IP. Protocols like GRE (Generic Routing Encapsulation) and IPsec ESP/AH do not use port numbers, so PAT cannot differentiate between multiple sessions using these protocols. This causes the translation to fail for such applications, even though standard web traffic (HTTP/HTTPS) works fine.

Answer

The NAT pool is exhausted.

Answer

The inside interface is not configured correctly.

Answer

The outside interface has a different MTU.

Question 10

An engineer applies a CoPP policy to a router to protect the control plane. The policy includes a class-map that matches all ICMP traffic and polices it to 5000 bps. After the policy is applied, the engineer notices that OSPF adjacencies are going down. The OSPF hello packets are not being received. What is the most likely cause?

Accepted Answer

The CoPP policy has a default class that drops all unmatched traffic, including OSPF packets.. The CoPP policy includes a class-map that matches only ICMP traffic, but when applied, it uses a default class that drops all unmatched traffic. OSPF hello packets, which are not ICMP, fall into this default class and are dropped, causing adjacencies to fail. This is a common misconfiguration where the policy lacks an explicit permit for essential control plane protocols like OSPF.

Answer

The CoPP policy is policing OSPF packets because the class-map matches all IP traffic, not just ICMP.

Answer

The OSPF hello packets are being rate-limited because they are ICMP packets.

Answer

The CoPP policy is applied to the wrong interface, causing OSPF packets to be dropped.

Question 11

Which THREE configuration steps are required to enable DMVPN Phase 3 on a spoke router? (Choose THREE.)

Accepted Answer

Configure the tunnel interface as a multipoint GRE interface.. To enable DMVPN Phase 3 on a spoke, you must configure the tunnel interface as multipoint GRE (mGRE), set the tunnel source to the physical interface, and configure an NHRP map to the hub with an authentication string. Phase 3 also uses 'ip nhrp shortcut' and 'ip nhrp redirect' commands, but the question asks for required steps that are common to all Phase 3 spokes. The other options are either not required or are for different phases.

Answer

Disable split horizon on the tunnel interface.

Answer

Configure the tunnel mode as 'tunnel mode ipsec ipv4'.

Question 12

What is the default administrative distance for OSPFv3 internal routes?

Accepted Answer

110. OSPFv3, like OSPFv2, uses a default administrative distance of 110 for all internal routes (intra-area and inter-area). This value is hard-coded in Cisco IOS and is not configurable per-route type; it distinguishes OSPF routes from other routing protocols. Option B is correct because 110 is the standard AD for OSPF (both versions) internal routes.

Answer

90

Answer

115

Answer

120

Question 13

Drag and drop the steps to configure conditional debugging and syslog forwarding into the correct order, from first to last.

Accepted Answer

Enable logging to buffer. First, enable logging to a buffer to capture debug messages locally. Then, set the logging severity level to ensure debug messages are included. Next, configure the syslog server IP address. After that, enable logging to the remote syslog server. Finally, enable conditional debugging to limit debug output based on specific conditions.

Question 14

A large enterprise network is experiencing intermittent loss of connectivity to a subnet 10.10.10.0/24 from remote sites. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 ip ospf 1 area 0 interface GigabitEthernet0/1 ip address 10.2.2.1 255.255.255.252 ip ospf 1 area 1 router ospf 1 area 1 range 10.10.0.0 255.255.248.0 Router R2 shows: show ip route 10.10.10.0 Routing entry for 10.10.8.0/21 Known via "ospf 1", distance 110, metric 20, type inter-area Last update from 10.1.1.2 on GigabitEthernet0/0, 00:05:32 ago What is the root cause?

Accepted Answer

The summary route 10.10.8.0/21 does not include 10.10.10.0/24; adjust the area range to 10.10.0.0/20.. The area range configured on R1 is 10.10.0.0/21 (255.255.248.0), which only covers networks 10.10.0.0 through 10.10.7.255. The subnet 10.10.10.0/24 falls outside this range. As a result, when R1 summarizes routes from area 1 into area 0, it does not generate a summary that includes 10.10.10.0/24. The summary route 10.10.8.0/21 seen on R2 is coming from a different source or is a default summary; it does not correspond to the misconfigured range. The correct fix is to change the area range to 10.10.0.0/20 (255.255.240.0) to encompass the subnet.

Answer

The metric of 20 indicates a redistribution issue; check redistributed routes.

Answer

The OSPF network type on GigabitEthernet0/0 is causing adjacency issues; change to point-to-point.

Answer

The area 1 range command is misconfigured with the wrong area; it should be area 0.

Question 15

A network engineer runs the following command on Router P1:

P1# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.48632
        State: Oper, Msgs sent/rcvd: 120/118, Downstream
        Up time: 00:12:34
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.1.1.2
        Addresses bound to peer LDP Ident:
          10.0.0.2         192.168.1.1

Based on this output, which statement is correct?

Accepted Answer

The LDP session is up and functioning correctly.. The show mpls ldp neighbor output shows a single LDP neighbor with IP 10.0.0.2. The state is 'Oper' (operational), and the neighbor has been up for 12 minutes. The output indicates a healthy LDP session.

Answer

The LDP session is down.

Answer

The router is not receiving label bindings from the neighbor.

Answer

The LDP router ID is misconfigured.