300-410 Practice Test 40 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip access-lists 130
Extended IP access list 130
    10 deny ip host 10.1.1.1 host 10.2.2.2
    20 permit ip any any

Then the engineer runs:
R1# debug ip packet 130
IP packet debugging is on for access list 130
*Mar  1 00:20:10.123: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto ICMP, access list 130: matched line 10 deny ip host 10.1.1.1 host 10.2.2.2

What does this output indicate?

Accepted Answer

ICMP traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 130.. The debug output explicitly shows that the packet with source 10.1.1.1 and destination 10.2.2.2 matched line 10 of ACL 130, which is a deny statement. Since the ACL is evaluated sequentially and the first match is a deny, the ICMP traffic is denied. The debug message confirms the match, so option A is correct.

Answer

ICMP traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 130.

Answer

ACL 130 is applied outbound on GigabitEthernet0/0.

Answer

ACL 130 is not matching any packets.

Question 2

An engineer configures EIGRP stub with `eigrp stub connected static` on a remote router. The remote router has a directly connected network and a static route redistributed into EIGRP. Unexpectedly, the hub router does not receive the static route, although the connected route is learned. Which is the most likely explanation?

Accepted Answer

The stub router must also have `redistribute static` configured under the EIGRP process for the static route to be advertised.. The `eigrp stub connected static` command only advertises connected and static routes that are directly configured on the stub router, but it does not automatically redistribute the static route into EIGRP unless redistribution is explicitly configured. The stub command only controls which routes are advertised, not the redistribution process. Without `redistribute static` under the EIGRP process, the static route is not injected into EIGRP.

Answer

The hub router has a route filter that blocks the static route due to administrative distance mismatch.

Answer

The stub router is configured with `eigrp stub connected static` but the static route is not directly connected, so it is ignored.

Answer

The stub router must use `eigrp stub receive-only` to advertise static routes.

Question 3

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After configuration, legitimate traffic from a directly connected network is being dropped. Which is the most likely explanation?

Accepted Answer

Asymmetric routing is causing the return path to use a different interface.. Strict uRPF checks that the source IP address of incoming packets has a route in the routing table that points back to the same interface. If there is asymmetric routing where the return path uses a different interface, strict uRPF will drop the traffic. This is a common edge case in networks with multiple paths.

Answer

The 'allow-default' option is not configured, and a default route exists.

Answer

The interface is configured with an IP address that is not in the routing table.

Answer

The routing table has a more specific route for the source network via a different interface.

Question 4

Drag and drop the steps to troubleshoot Route Maps and Route Filtering adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify BGP neighbor state with show ip bgp summary. Start by verifying BGP neighbor state with show ip bgp summary. Next, examine the route-map configuration for syntax errors using show route-map. Then, check if the route-map is applied correctly to the neighbor with show running-config. After that, use debug ip bgp updates to see if prefixes are being filtered. Finally, adjust the route-map sequence or match criteria to resolve the issue.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                           (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0            13 00:12:34   12   200  0  45
1   10.2.2.2                Gi0/1            12 00:10:20   15   200  0  32
2   10.3.3.2                Gi0/2            14 00:08:15   18   200  0  28
3   10.4.4.2                Gi0/3            13 00:06:10   20   200  0  22

Based on this output, which statement is correct?

Accepted Answer

All four EIGRP neighbors are in the established state and exchanging routes.. All four neighbors show a Q Cnt of 0, which indicates no packets are queued for retransmission, and the Hold timers are within the default 15-second range, confirming that hello packets are being received regularly. The SRTT values are low (12-20 ms), and the RTO is consistent at 200 ms, which together with the established neighbor states (indicated by the 'H' column showing adjacency indices) confirms that all neighbors have successfully formed an adjacency and are exchanging routes in the EIGRP AS 100.

Answer

Neighbor 10.4.4.2 has a high SRTT of 20 ms, indicating a slow link.

Answer

The Q Cnt of 0 means that there are 0 packets queued for retransmission, but this could indicate a problem.

Answer

The neighbor on Gi0/3 has the lowest uptime, so it may be flapping.

Question 6

Drag and drop the steps to troubleshoot SPAN, RSPAN, and ERSPAN adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check SPAN/RSPAN/ERSPAN session status. Begin by checking the SPAN/RSPAN/ERSPAN session status with show commands. Then, verify that the source and destination VLANs or interfaces are up. Next, confirm that any intermediate switches support the required encapsulation. After that, test IP connectivity for ERSPAN destinations using ping. Finally, review ACLs or filters that might block mirrored traffic.

Question 7

Which TWO statements about SNMPv3 configuration on Cisco IOS XE are true? (Choose TWO.)

Accepted Answer

The 'snmp-server user' command can specify an authentication and privacy password for a user.. The 'snmp-server user' command in Cisco IOS XE allows you to configure both an authentication password (e.g., MD5 or SHA) and a privacy password (e.g., DES or AES) for an SNMPv3 user, enabling secure message exchange. This is essential for implementing the authPriv security level, which provides both authentication and encryption.

Answer

The 'snmp-server group' command creates a group and assigns a username to it.

Answer

The engine ID is automatically generated and cannot be manually configured.

Answer

SNMPv3 supports only the authPriv security level.

Question 8

A network engineer is troubleshooting a DHCPv4 issue where a router configured as a DHCP server is not assigning addresses from a pool to clients on a specific VLAN. The pool is configured with 'network 10.1.1.0 255.255.255.0' and 'default-router 10.1.1.1'. The router's interface Gi0/0.10 (subinterface) has encapsulation dot1Q 10 and IP 10.1.1.1/24. Clients send DISCOVER messages, but the router does not respond. The engineer notices that the router has multiple DHCP pools configured. What is the most likely cause?

Accepted Answer

The DHCP pool is configured under a VRF, but the interface is not in that VRF.. The router has multiple DHCP pools configured, and the pool for VLAN 10 is likely bound to a VRF. When a DHCP pool is configured under a VRF, the router only responds to DHCP DISCOVER messages received on interfaces that belong to that same VRF. Since the subinterface Gi0/0.10 is not in the VRF, the router ignores the client broadcasts, even though the IP address and subnet match the pool.

Answer

The subinterface is missing the 'ip helper-address' command.

Answer

The 'ip dhcp server' command is missing globally.

Answer

The encapsulation dot1Q 10 is misconfigured, causing the router to not receive broadcasts.

Question 9

Given this configuration on router R2:
```
ip vrf CUSTOMER_D
 rd 100:1
!
interface GigabitEthernet0/0
 ip vrf forwarding CUSTOMER_D
 ip address 192.168.2.1 255.255.255.0
!
router ospf 1 vrf CUSTOMER_D
 network 192.168.2.0 0.0.0.255 area 0
```
What will happen when this configuration is applied?

Accepted Answer

OSPF will run on GigabitEthernet0/0 and form adjacencies within VRF CUSTOMER_D.. The OSPF process is tied to VRF CUSTOMER_D, so it only runs on interfaces that belong to that VRF. The network command matches the interface, so OSPF will form adjacencies on that interface within the VRF.

Answer

OSPF will fail because the OSPF process must be configured globally, not under the VRF.

Answer

OSPF will run on all interfaces, including those not in VRF CUSTOMER_D.

Answer

The network command is invalid because it uses a wildcard mask instead of a subnet mask.

Question 10

Drag and drop the steps to configure and verify Policy-Based Routing (PBR) into the correct order, from first to last.

Accepted Answer

Create route map with sequence number. First, define the route map with a sequence number. Next, match the interesting traffic using an ACL or prefix list. Then, set the next-hop or interface. Apply the route map under the interface in the inbound direction. Finally, verify with 'show route-map' or 'show ip policy'.

Question 11

A network engineer configures OSPF on two routers connected via Ethernet. The adjacency forms but remains stuck in EXSTART state. Both routers have identical OSPF configuration except for MTU. Which is the most likely explanation?

Accepted Answer

The MTU on the interfaces is mismatched, causing DBD packet rejection.. OSPF uses the interface MTU in Database Description (DBD) packets. If MTU values differ, the neighbor will reject DBD packets larger than its own MTU, causing the adjacency to stall in EXSTART. The fix is to use 'ip ospf mtu-ignore' or match MTU.

Answer

The OSPF network type is point-to-point on one side and broadcast on the other.

Answer

The OSPF router ID is identical on both routers.

Answer

The 'ip ospf authentication' is configured only on one side.

Question 12

DMVPN network with hub R1 and spoke R2. R1 has:
interface Tunnel0
 ip address 172.16.1.1 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp authentication cisco123
R2 has:
interface Tunnel0
 ip address 172.16.1.2 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp nhs 172.16.1.1
 ip nhrp authentication cisco123
R2 shows:
R2# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
NHRP domain: 1
Interface: Tunnel0, IPv4 NHRP Details
Type:Spoke, NHC:172.16.1.2, NBMA:10.2.2.2
  (no NHRP mappings)
R2# ping 172.16.1.1 source 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
What is the root cause?

Accepted Answer

The hub R1 is missing the 'ip nhrp map multicast dynamic' command.. The NHRP authentication strings do not match: R1 has 'cisco123', R2 has 'cisco123'? They match. But the output shows no NHRP mappings. The issue is that the spoke R2 has not registered with the hub. This could be due to a mismatch in NHRP network ID, but they match. Another possibility is that the hub's tunnel interface is not configured with 'ip nhrp map multicast dynamic' to accept registrations. Without that, the hub does not add the spoke to its NHRP database, and the spoke cannot resolve the hub's NBMA address. The ping fails because the spoke has no NHRP mapping for the hub.

Answer

The authentication string is mismatched between hub and spoke.

Answer

The tunnel mode on R2 should be 'tunnel mode gre ip' instead of multipoint.

Answer

The NHRP network ID must be different on hub and spoke.

Question 13

A network engineer runs the following command to verify MPLS forwarding:

R1# show mpls forwarding-table 192.168.1.0 255.255.255.0 detail

Output:
Local  Outgoing    Prefix            Bytes Label   Outgoing   Next Hop
Label  Label       or Tunnel Id      Switched     interface
101    201         192.168.1.0/24    0            Gi0/0      10.0.0.2
    MAC/Encaps: 14/18, MTU: 1500, Label Stack {201}
    No output feature configured

What does this output indicate?

Accepted Answer

Packets with label 101 will be swapped to label 201 and forwarded to 10.0.0.2. The output shows the MPLS forwarding table entry for prefix 192.168.1.0/24. The local label is 101, outgoing label is 201, next hop is 10.0.0.2 via GigabitEthernet0/0. The label stack contains only label 201.

Answer

Packets with label 101 will be popped and forwarded as IP packets

Answer

The prefix 192.168.1.0/24 is directly connected

Answer

The label stack has two labels

Question 14

A switch is configured with SPAN to monitor traffic on interface Gi0/0/0 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source interface Gi0/0/0 both monitor session 1 destination interface Gi0/1. The analyzer sees only half of the traffic (only incoming or outgoing). The switch also has an EtherChannel configured on Gi0/0/0 as part of a port-channel. The port-channel is up/up. What is the root cause?

Accepted Answer

The SPAN source is a physical interface that is part of an EtherChannel; SPAN should be configured on the port-channel interface instead.. When a source interface is part of an EtherChannel, SPAN must be configured on the port-channel interface, not on the individual physical interface. If SPAN is configured on a physical interface that is part of a port-channel, the switch may only monitor traffic on that specific physical link, not the entire EtherChannel. This can result in only a portion of the traffic being mirrored. The fix is to use the port-channel interface as the source.

Answer

The destination interface Gi0/1 is not in the same VLAN as the source.

Answer

The monitor session is missing the 'no shutdown' command.

Answer

The EtherChannel load-balancing algorithm causes some traffic to be missed.

Question 15

In a standard IPv4 ACL, what is the default wildcard mask if none is explicitly configured?

Accepted Answer

0.0.0.0 (host match). In a standard IPv4 ACL, if no wildcard mask is explicitly configured, the default wildcard mask is 0.0.0.0, which means the ACL matches only the exact source IP address (a host match). This is because the access-list command treats the source address as a host address when no mask is provided, effectively applying a host wildcard mask.

Answer

255.255.255.255 (any match)

Answer

The mask is mandatory; configuration is rejected without it.

Answer

The mask is derived from the source address class.