300-410 Practice Test 40 — 15 Questions

Question 1

A network engineer configures EEM to monitor BGP prefix limits on R1. R1 has: event manager applet BGP-PREFIX event syslog pattern "%BGP-3-PREFIX_LIMIT" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp 10.1.1.2" action 3.0 syslog msg "Cleared BGP session". Router R2 shows: BGP session with R1 is flapping, and logs show repeated prefix limit warnings. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EEM applet clears the BGP session, which resets the prefix count but does not prevent the neighbor from re-sending the same prefixes.. The EEM applet is triggered by the %BGP-3-PREFIX_LIMIT syslog message and responds by clearing the BGP session with the neighbor. Clearing the session resets the prefix counter, but the neighbor immediately re-establishes the session and re-advertises the same set of prefixes, which again exceeds the configured maximum-prefix limit. This creates an endless flap loop rather than solving the underlying issue of too many prefixes being advertised.

Answer

The syslog pattern is incorrect; it should be %BGP-4-PREFIX_LIMIT.

Answer

The clear command should be 'clear ip bgp *' to reset all sessions.

Answer

The BGP session is flapping due to a keepalive timer mismatch.

Question 2

A network engineer runs the following command to troubleshoot OSPF route propagation:

R1# show ip ospf database router 2.2.2.2

OSPF Router with ID (1.1.1.1) (Process ID 1)

Router Link States (Area 0)

LS age: 45
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 2.2.2.2
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000005
  Checksum: 0x1234
  Length: 48
  Number of Links: 2

Link connected to: a Transit Network
     (Link ID) Designated Router address: 10.1.1.2
     (Link Data) Router Interface address: 10.1.1.2
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

Link connected to: a Stub Network
     (Link ID) Network/subnet number: 192.168.1.0
     (Link Data) Network Mask: 255.255.255.0
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

What does this output indicate?

Accepted Answer

Router 2.2.2.2 has a link to a transit network with DR address 10.1.1.2 and a stub network 192.168.1.0/24.. The output shows a Router LSA (Type 1) for Router ID 2.2.2.2. It lists two links: one connected to a Transit Network with Designated Router address 10.1.1.2, and one connected to a Stub Network with network 192.168.1.0/24. This matches option B. The LSA is not a Type 5 External LSA (which would be shown differently) nor a Network LSA (Type 2). The router is advertising its links, not two stub networks (only one stub network is listed).

Answer

Router 2.2.2.2 is advertising two stub networks.

Answer

The LSA indicates a Type 5 External LSA from ASBR.

Answer

The output shows the network LSA for the transit network.

Question 3

An engineer configures an IPsec site-to-site VPN between two routers using iBGP for routing. The BGP session comes up, but routes learned from the remote site are not installed in the routing table. The engineer verifies that the IPsec tunnel is up and that the BGP prefixes are present in the BGP table. What is the most likely explanation?

Accepted Answer

The next-hop address for the BGP routes is the physical interface IP of the remote router, which is not reachable through the tunnel, so the route is not installed.. In iBGP, the next-hop for routes learned from an eBGP peer is not changed by default. When the remote router advertises prefixes, it sets the next-hop to its physical interface IP address. If the IPsec tunnel is configured to encrypt traffic between the two routers' tunnel endpoints (e.g., virtual tunnel interfaces or crypto maps applied to physical interfaces), the physical interface IP of the remote router may not be reachable through the tunnel. BGP will not install a route in the routing table if the next-hop is not reachable via a valid route in the routing table, even if the BGP session is up and the prefixes are in the BGP table.

Answer

The BGP synchronization rule is enabled, and the IGP does not carry the BGP routes, preventing installation.

Answer

The IPsec transform set uses SHA-2 authentication, which is incompatible with BGP MD5 authentication.

Answer

The BGP session is using loopback interfaces, and the IPsec tunnel is not configured to encrypt traffic to the loopback.

Question 4

Drag and drop the steps to verify and validate Device Access Control operational state into the correct order, from first to last.

Accepted Answer

Check AAA server reachability. First, check the AAA server reachability to ensure the backend is accessible. Then verify the active authentication method list applied globally. Next, confirm the authorization method list for exec or commands. After that, validate the accounting configuration to track access. Finally, test the actual access control by attempting a remote login.

Question 5

Which default administrative distance is assigned to routes learned via the Open Shortest Path First (OSPF) protocol?

Accepted Answer

110. OSPF routes have a default administrative distance of 110, as defined by Cisco IOS.

Answer

90

Answer

115

Answer

120

Question 6

Drag and drop the steps to troubleshoot Device Management adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping the management IP address from the management station. Troubleshooting starts with checking basic IP connectivity, then verifying the management protocol (e.g., NETCONF/RESTCONF) status, ensuring the correct port is open, checking AAA/authorization, and finally reviewing logs for errors.

Question 7

When using 'set ip next-hop verify-availability', what mechanism does the router use to determine if the next-hop is reachable?

Accepted Answer

It uses a tracked object that can be based on IP SLA, interface state, or other criteria.. The 'verify-availability' option uses a tracked object (configured with the 'track' command) which can be based on IP SLA, interface line-protocol, or other criteria. It does not use ARP or ICMP by default.

Answer

It sends an ICMP echo request to the next-hop every 10 seconds.

Answer

It checks the ARP table for the next-hop MAC address.

Answer

It performs a recursive routing table lookup to see if the next-hop is reachable.

Question 8

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on the outside interface of a router that terminates an IPsec site-to-site VPN. After the configuration, the VPN tunnel establishes, but traffic from the remote site is not forwarded correctly. The engineer verifies that the IPsec tunnel is up and that the routing table has the correct routes. What is the most likely explanation?

Accepted Answer

The return route for the remote site's physical IP points to the tunnel interface, but the packet arrives on the physical interface, so uRPF drops it because the source IP is not reachable via the incoming interface.. In strict mode, uRPF checks that the source IP address of an incoming packet is reachable via the exact interface on which the packet arrived. For IPsec site-to-site VPN traffic, the encapsulated (original) packet arrives on the physical outside interface, but the routing table's return route for the remote site's physical IP (the tunnel endpoint) points to the tunnel interface (e.g., a virtual tunnel interface or crypto map). Because the source IP is not reachable via the physical incoming interface, uRPF drops the packet, even though the IPsec tunnel is up and the routes are correct.

Answer

The IPsec tunnel uses transport mode, which does not encapsulate the original source IP, causing uRPF to see the remote router's physical IP as the source.

Answer

The uRPF configuration includes the 'allow-default' option, which allows packets with a default route, but the remote site's IP is not in the default route.

Answer

The IPsec transform set uses ESP with authentication, which changes the source IP of the packet.

Question 9

Which THREE symptoms indicate that route summarization may be causing routing issues in a network? (Choose THREE.)

Accepted Answer

Suboptimal routing paths are observed for certain destinations.. Option A is correct because route summarization advertises a single aggregate prefix that hides the individual component subnets, so a router may forward traffic toward the summary's next hop even when a more optimal path exists for a specific destination, producing suboptimal routing paths. Option B is correct because if a summary route (e.g., 10.0.0.0/16) is advertised but one of its constituent subnets (e.g., 10.0.5.0/24) does not actually exist or is not reachable on the advertising router, packets matching the summary are forwarded and then dropped, creating a black hole. Option C is correct because less-specific summary routes can point traffic back toward a router that only has the summary and not the specific subnet, causing packets to bounce between routers and form a routing loop. Option D is not correct because frequent SPF recalculations and high CPU are typically caused by network instability such as flapping links or adjacencies, not by summarization itself. Option E is not correct because duplicate IP addresses are an addressing/configuration error and are unrelated to route summarization behavior.

Answer

High CPU utilization on routers due to frequent SPF calculations.

Answer

Duplicate IP addresses are detected in the network.

Question 10

Given the following partial DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp authentication cisco123
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map multicast dynamic
 ip nhrp redirect
!

What is the purpose of the 'ip nhrp redirect' command?

Accepted Answer

It enables the hub to send redirect messages to spokes, telling them to use a direct tunnel to another spoke.. The 'ip nhrp redirect' command enables NHRP redirect functionality on the hub, allowing it to inform spoke routers when a more optimal direct spoke-to-spoke path exists. When a spoke sends traffic through the hub destined for another spoke's network, the hub forwards the initial packets but also sends an NHRP redirect message back to the originating spoke, telling it to resolve the destination NBMA address directly. This triggers the spoke to send an NHRP resolution request, establishing a direct DMVPN tunnel to the destination spoke, bypassing the hub for subsequent traffic.

Answer

It causes the hub to redirect all traffic through the hub itself.

Answer

It enables the hub to dynamically map multicast addresses.

Answer

It disables NHRP on the tunnel interface.

Question 11

Which EIGRP packet type is used to confirm receipt of an update during reliable transport?

Accepted Answer

ACK. C is correct because EIGRP uses a reliable transport protocol (RTP) to ensure delivery of certain packets like Updates, Queries, and Replies. The ACK packet is a lightweight, unreliable packet sent to explicitly acknowledge receipt of a reliable packet, confirming that the update was received without needing a full retransmission.

Answer

Hello

Answer

Update

Answer

Query

Question 12

A network engineer notices that BGP sessions between two directly connected routers are flapping every few minutes. The routers are running IOS-XE 17.3 and have CoPP enabled. The engineer checks the CoPP policy and sees a class-map matching BGP packets with a police rate of 8000 bps. The BGP session uses MD5 authentication and the routers exchange a full BGP table with 500,000 prefixes. What is the most likely cause of the BGP session flapping?

Accepted Answer

The CoPP police rate of 8000 bps is too low for the BGP keepalive and update traffic, causing packet drops.. The CoPP police rate of 8000 bps is insufficient for the BGP traffic generated by exchanging a full BGP table of 500,000 prefixes. BGP updates for such a large table can easily exceed 8000 bps, especially when combined with keepalive messages. When the police rate is exceeded, CoPP drops BGP packets, causing the session to flap as the hold timer expires due to missing keepalives or updates.

Answer

The BGP MD5 authentication is causing excessive CPU utilization, triggering CoPP drops.

Answer

The CoPP class-map is not matching BGP packets correctly because it uses a wrong access-list.

Answer

The BGP hold timer is set too low, causing the session to reset before CoPP drops are noticed.

Question 13

A network uses PBR to route traffic from a specific subnet (172.16.1.0/24) through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being sent to the WAN link but is not reaching the destination. Router R1 shows: 'show route-map' shows the route-map is applied, 'debug ip policy' shows traffic being forwarded to 10.10.10.2, but 'show ip route' on R1 shows a route to the destination via a different next-hop (10.20.20.2). What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 does not have a route to the destination, causing traffic to be dropped. Ensure the next-hop has a route to the destination or use a next-hop that does.. PBR forwards matching traffic to the configured next-hop (10.10.10.2) regardless of the routing table, but the next-hop router must itself have a valid route to the destination to forward the packet onward. If 10.10.10.2 lacks a route to the destination, it drops the traffic — which matches the symptom of PBR forwarding correctly but packets never arriving.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing PBR to use an unreachable next-hop.

Answer

The routing table on R1 has a better route to the destination via 10.20.20.2, but PBR is overriding it incorrectly.

Answer

The ACL in the route-map is matching traffic from the wrong subnet, causing PBR to be applied to the wrong traffic.

Question 14

An engineer configures OSPF on two routers connected via a point-to-point link. The routers are stuck in EXSTART state. 'show ip ospf neighbor' shows neighbor state EXSTART/EXCHANGE. Which is the most likely explanation?

Accepted Answer

The MTU on the interfaces is mismatched.. OSPF neighbors stuck in EXSTART/EXCHANGE state on a point-to-point link are most commonly caused by an MTU mismatch between the two interfaces. During the database description (DBD) exchange, OSPF includes the MTU in the DBD packets; if the MTU values do not match, the routers will not proceed to the EXCHANGE state and will remain in EXSTART. The fix is to align the MTU on both interfaces or use the 'ip ospf mtu-ignore' command.

Answer

The OSPF network type is mismatched (point-to-point vs broadcast).

Answer

The OSPF router IDs are identical.

Answer

The hello/dead intervals are mismatched.

Question 15

A network engineer is troubleshooting PBR on a Cisco router where traffic from VLAN 100 (192.168.10.0/24) should be forwarded to next-hop 10.10.10.2 via a route map named 'VLAN100-PBR'. The engineer has applied the route map to interface GigabitEthernet0/0.100 (subinterface) using 'ip policy route-map VLAN100-PBR'. The engineer verifies that the route map is correctly configured with 'match ip address 100' and 'set ip next-hop 10.10.10.2', and the access list 100 matches the source subnet. However, traffic from VLAN 100 is still forwarded using the routing table. What is the most likely cause?

Accepted Answer

The traffic is arriving on the physical interface GigabitEthernet0/0 instead of the subinterface GigabitEthernet0/0.100.. PBR is applied on the interface where traffic enters the router. If VLAN 100 traffic is arriving on the physical interface GigabitEthernet0/0 (for example, because the subinterface is not properly configured for 802.1Q encapsulation or the switch is sending untagged frames), the policy applied to GigabitEthernet0/0.100 will never be evaluated. The route map is correct, so the most likely cause is that the ingress interface does not match where the policy is attached.

Answer

The access list 100 is missing the 'permit' keyword; PBR only processes permit statements.

Answer

The 'set ip next-hop' command must be followed by 'force' to override the routing table.

Answer

The route map must be applied to the VLAN interface (SVI) instead of the subinterface.