300-410 Practice Test 39 — 15 Questions

Question 1

Management traffic is being dropped. Router R1 has: access-list 100 deny ip any any log, applied to VTY lines. Remote access via SSH fails, but console works. What is the root cause?

Accepted Answer

The ACL should permit SSH before the deny statement.. The ACL `access-list 100 deny ip any any log` applied to VTY lines denies all IP traffic, including SSH, before any permit statement can match. Since SSH traffic is denied, remote access fails. The correct fix is to add a `permit tcp any any eq 22` statement before the deny to allow SSH management traffic.

Answer

The VTY lines require transport input ssh, but the ACL is irrelevant.

Answer

The ACL is applied to the wrong interface.

Answer

The log keyword causes performance issues, not drops.

Question 2

Which CoPP mechanism prevents the CPU from being overwhelmed by control plane traffic?

Accepted Answer

Policing. CoPP (Control Plane Policing) uses policing to rate-limit control plane traffic destined to the CPU, preventing overload from excessive or malicious packets. Policing drops or marks packets that exceed the configured rate, protecting the route processor. This is the mechanism that directly prevents CPU overwhelm.

Answer

Shaping

Answer

Queuing

Answer

Compression

Question 3

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer verifies that the customer's IP prefix is in the routing table. Which is the most likely explanation?

Accepted Answer

The router has multiple equal-cost paths to the customer network, and the return path uses a different interface, causing strict uRPF to drop the packet.. Strict uRPF checks that the source IP of incoming packets has a route back to the same interface. If there is asymmetric routing, where the return path goes out a different interface, strict uRPF will drop the packets. A common edge case is when the router has multiple equal-cost paths to the source network, and the return traffic uses a different interface than the one the packet arrived on. In such cases, uRPF strict mode will fail because it only checks the best route, not all routes.

Answer

The customer network uses private IP addresses that are not routable, so uRPF drops them.

Answer

The interface is configured with 'ip verify unicast source reachable-via any', which is loose mode, not strict mode.

Answer

The routing table has a default route that points to a different interface, causing uRPF to use the default route for verification.

Question 4

What is the default administrative distance for a route learned via the Routing Information Protocol next generation (RIPng)?

Accepted Answer

120. RIPng, the IPv6 version of RIP, uses the same default administrative distance as RIPv2, which is 120.

Answer

110

Answer

100

Answer

170

Question 5

What is the default metric for an IPv6 static route redistributed into OSPFv3?

Accepted Answer

20. When an IPv6 static route is redistributed into OSPFv3, OSPFv3 assigns a default metric of 20 to external routes (type E1 or E2). This is consistent with OSPFv2 behavior, where redistributed routes (including static routes) receive a default metric of 20 unless explicitly overridden with the `metric` keyword under the `redistribute` command. Option C is correct because the default metric for redistributed static routes in OSPFv3 is 20.

Answer

0

Answer

1

Answer

10

Question 6

Drag and drop the steps to verify and validate the operational state of Control Plane Policing (CoPP) into the correct order, from first to last.

Accepted Answer

Verify CoPP policy is applied to the control-plane. Verification starts with confirming the policy is applied globally, then checking per-class statistics for drops, using show commands to examine packet counters, testing reachability to the control plane, and finally reviewing logs for any CoPP-related messages. This ensures the policy is working as intended.

Question 7

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list FILTER-IPv6
IPv6 access list FILTER-IPv6
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It permits only IPv6 traffic from 2001:DB8:1::/48 and denies everything else. The access list FILTER-IPv6 has two entries: a permit statement for source 2001:DB8:1::/48 to any destination (sequence 10), followed by an implicit deny all (sequence 20). When applied to an interface, only traffic matching the permit entry is allowed; all other IPv6 traffic is denied by the implicit deny rule at the end of the list. This results in permitting only traffic from the specified prefix and denying everything else.

Answer

It permits all IPv6 traffic

Answer

It denies all IPv6 traffic from 2001:DB8:1::/48

Answer

It permits all IPv6 traffic except from 2001:DB8:1::/48

Question 8

What is the default CoPP aggregate policer rate for control plane traffic on a Cisco IOS-XE device?

Accepted Answer

No default rate; CoPP is disabled by default. Cisco IOS-XE does not enable Control Plane Policing (CoPP) by default; it must be explicitly configured using the 'control-plane' command followed by 'service-policy' to attach a policy map. The absence of a default aggregate policer rate means that without CoPP configuration, the control plane is unprotected from traffic storms or DoS attacks. Options A, B, and D are incorrect because they suggest predefined rates that do not exist as defaults in Cisco IOS-XE.

Answer

32000 bps

Answer

75000 bps

Answer

128000 bps

Question 9

Which authentication method is supported by default for GRE tunnels in Cisco IOS-XE?

Accepted Answer

No authentication by default. GRE tunnels in Cisco IOS-XE do not include any built-in authentication mechanism by default. The GRE protocol (RFC 2784) defines a simple encapsulation method without authentication or encryption; any security features must be added externally, such as using IPsec to protect the tunnel traffic. Therefore, the correct answer is that no authentication is enabled by default.

Answer

MD5 authentication

Answer

SHA-256 authentication

Answer

Plain-text password authentication

Question 10

Router R1 is configured with ip nat inside source list 100 interface Loopback0 overload. Internal hosts at 192.168.1.0/24 can access the internet, but external hosts cannot initiate connections to an internal server at 10.1.1.10 that is also behind NAT. The server is supposed to be reachable via static NAT. Configuration: ip nat inside source static tcp 10.1.1.10 80 interface Loopback0 80. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global tcp 10.1.1.10:80 10.1.1.10:80 --- ---. External users get connection timeouts. What is the root cause?

Accepted Answer

The static NAT should use a specific global IP address instead of the interface; configure ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 80.. The static NAT configuration uses 'interface Loopback0' as the global address, which means it relies on the interface's dynamically assigned IP address. However, the overload rule (PAT) is also using the same interface, and the static NAT entry shown in 'show ip nat translations' displays the inside local address as the inside global address (10.1.1.10:80), indicating that the static translation is not being applied correctly. The root cause is that static NAT requires a specific global IP address (e.g., 203.0.113.10) to map the internal server, not the interface keyword, because the interface keyword is used for PAT and does not create a fixed one-to-one mapping for inbound connections.

Answer

The access-list 100 is blocking inbound traffic.

Answer

The Loopback0 interface is not in the routing table.

Answer

The static NAT entry is missing the 'add-route' option.

Question 11

Given the following configuration snippet on Router R5:

router eigrp 400
 network 10.1.1.0 0.0.0.255

What is wrong with this configuration?

Accepted Answer

The configuration is correct as shown.. The configuration uses a valid EIGRP AS number (400) and a correct wildcard mask (0.0.0.255) to match the 10.1.1.0/24 subnet. In EIGRP, the network command uses a wildcard mask to specify the exact interfaces to advertise, and 0.0.0.255 is the proper inverse of the subnet mask 255.255.255.0.

Answer

The wildcard mask should be 255.255.255.0.

Answer

The network address should be the classful network 10.0.0.0.

Answer

The AS number 400 is invalid; EIGRP AS numbers must be between 1 and 65535.

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic
IPv6 statistics:
  Rcvd: 1000 total, 800 unicast, 200 multicast
  Sent: 900 total, 700 unicast, 200 multicast
  Errors: 0
  Dropped: 0
  ND statistics:
    NS: 50 received, 40 sent
    NA: 30 received, 20 sent
    RS: 10 received, 5 sent
    RA: 2 received, 8 sent
    Redirect: 0 received, 0 sent

Based on this output, which statement is correct?

Accepted Answer

The router is receiving more Neighbor Solicitations than it is sending, which is expected.. In IPv6, Neighbor Solicitations (NS) are used for address resolution and duplicate address detection. A router typically receives more NS messages than it sends, as hosts send NS to resolve the router's link-layer address, while the router sends NS primarily for DAD or to verify neighbor reachability. The output shows 50 NS received versus 40 sent, which aligns with this expected behavior.

Answer

The router is not sending any Router Advertisements.

Answer

There is a high number of errors in IPv6 traffic.

Answer

The router is dropping many packets.

Question 13

A network engineer runs the following command to verify DHCPv4 pool configuration on router R1:

R1# show ip dhcp pool DHCP_POOL

Output:
 Pool DHCP_POOL :
   Utilization mark (high/low)    : 100 / 0
   Subnet size (first/next)       : 0 / 0
   Total addresses                : 254
   Leased addresses               : 100
   Pending event                  : none
   1 subnet is currently in the pool :
   Current index        IP address range                    Leased addresses
   192.168.1.1          192.168.1.1 - 192.168.1.254         100

What does this output indicate?

Accepted Answer

The DHCP pool has 254 addresses available, and 100 are currently leased.. The output shows 'Total addresses: 254' and 'Leased addresses: 100', meaning the pool contains 254 total addresses (the /24 subnet) and 100 are currently leased, leaving 154 available. The 'Utilization mark (high/low): 100 / 0' indicates the thresholds for alerts, not actual usage, and the pool is not exhausted.

Answer

The DHCP pool is exhausted because 100 addresses are leased.

Answer

The DHCP server is using a database agent to store leases.

Answer

The DHCP pool has a utilization mark of 100%, meaning it is full.

Question 14

A network engineer runs the following command to verify crypto engine connections on a DMVPN spoke:

R2# show crypto engine connections active

Crypto Engine Connections

ID  Type    Algorithm           Encrypt  Decrypt LastSeqN  IP-Address
    1  IPsec   AES256-SHA         100      100     100       192.168.1.2

What does this output indicate?

Accepted Answer

An IPsec SA is active with 100 packets encrypted and decrypted, indicating traffic flow.. The output shows an active IPsec SA with AES256-SHA as the encryption/integrity algorithm, and the Encrypt/Decrypt counters both at 100, meaning 100 packets have been encrypted and 100 decrypted — clear evidence of bidirectional traffic flow over the tunnel. The IP-Address 192.168.1.2 identifies the peer (the DMVPN hub or another spoke) for this SA.

Answer

No IPsec SAs are active; the connection list is empty.

Answer

The IPsec SA is failing due to algorithm mismatch.

Answer

The connection is for IKE, not IPsec.

Question 15

Which TWO statements about IPv4 extended access control lists are true? (Choose TWO.)

Accepted Answer

They can filter based on source and destination IP addresses.. IPv4 extended ACLs can filter traffic based on both source and destination IP addresses, as well as protocol type, port numbers, and other parameters. This is defined in the access-list command syntax (e.g., access-list 100 permit tcp 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255 eq 80), which allows granular control beyond standard ACLs that only filter on source IP.

Answer

They use a wildcard mask only for the destination address.

Answer

They can be named using numbers only.

Answer

They automatically log all matched packets.