300-410 Practice Test 40 — 15 Questions

Question 1

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Accepted Answer

The syslog service on 10.1.1.200 is not running or is blocked by a firewall.. Cisco IOS allows multiple logging hosts, but each must be configured with a separate 'logging host' command. If the second server is not receiving messages, it may be because the 'logging trap' level for that specific host is set to a higher severity (e.g., 'logging host 10.1.1.200 trap errors') that filters out most messages, or the server is not listening. However, a common mistake is that the second host is configured with a different port or protocol that is not supported. But the most typical cause is that the second server's syslog service is not running or is firewalled.

Answer

The router can only send to one syslog server at a time.

Answer

The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.

Answer

The second server is configured with a different severity level using 'logging trap' under the host.

Question 2

What is the default EIGRP hello interval on a point-to-point serial interface with bandwidth 1544 Kbps?

Accepted Answer

5 seconds. EIGRP uses a default hello interval of 5 seconds on high-speed interfaces (bandwidth >= 1544 Kbps) and 60 seconds on low-speed interfaces (bandwidth <= 1544 Kbps).

Answer

60 seconds

Answer

10 seconds

Answer

30 seconds

Question 3

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Accepted Answer

The 'clock timezone' command is not configured on the router.. The 'service timestamps log datetime msec' command uses the router's local time, but if the time zone is not configured, the timestamps will appear in UTC (the default). To show the correct local time, the 'clock timezone' command must be configured to set the appropriate offset.

Answer

The NTP server is not providing timezone information.

Answer

The 'service timestamps log' command should use 'localtime' instead of 'datetime'.

Answer

The syslog server is overwriting the timestamps with its own.

Question 4

Which EIGRP packet type is used to confirm receipt of a reliable update?

Accepted Answer

ACK. EIGRP uses reliable transport for updates, queries, and replies. The receiver sends an ACK packet (a Hello packet with no data) to confirm receipt.

Answer

Hello

Answer

Update

Answer

Reply

Question 5

Drag and drop the steps to troubleshoot EIGRP neighbor adjacency formation into the correct order, from first to last.

Accepted Answer

Verify Layer 1 and Layer 2 connectivity between routers. The correct order ensures that you first verify the physical and data link layer, then check IP connectivity, confirm EIGRP is enabled on the correct interfaces, verify the autonomous system number matches, and finally check for any passive interface configuration that might block adjacency.

Question 6

What is the default EIGRP hold time multiplier relative to the hello interval?

Accepted Answer

Hold time is three times the hello interval. By default, EIGRP sets the hold time to three times the hello interval. This ensures that a few missed hellos do not immediately cause neighbor loss.

Answer

Hold time equals hello interval

Answer

Hold time is twice the hello interval

Answer

Hold time is four times the hello interval

Question 7

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Accepted Answer

Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.. To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Answer

Configure 'no logging trap debugging' globally.

Answer

Use 'undebug all' to stop all debug output.

Answer

Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

Question 8

Drag and drop the steps to troubleshoot EIGRP adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Display the EIGRP neighbor table using show ip eigrp neighbors. Start by checking the EIGRP neighbor table to confirm adjacency state, then verify interface status and MTU mismatch, review K-value mismatches, inspect ACLs that might block EIGRP packets, and finally check for authentication mismatches.

Question 9

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Accepted Answer

The 'logging on' command is not configured.. The 'show logging' output clearly states that syslog logging is disabled. The most common cause is that the global 'logging on' command is missing from the configuration. Without this command, no syslog messages are generated or sent to any destination.

Answer

The logging buffer is full and needs to be cleared.

Answer

The router has run out of memory to generate syslog messages.

Answer

The 'logging host' command is missing, so no destination is configured.

Question 10

Drag and drop the steps to verify and validate the EIGRP operational state into the correct order, from first to last.

Accepted Answer

Display EIGRP process status with show ip eigrp interfaces. Begin by checking the overall EIGRP process status, then verify the neighbor table for adjacency, examine the topology table for feasible successors, review the routing table for installed routes, and finally use debug commands to validate ongoing operations if needed.

Question 11

A network engineer runs the following command on Router R1:

R1# show logging

Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer)
    Console logging: level debugging, 37 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level informational, 5 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 0 message lines logged
        Logging to 192.168.1.100 (udp port 514, audit disabled,
                link up),
          0 message lines logged, xml disabled,
          filtering disabled
        Logging Source Interface: Loopback0

Log Buffer (4096 bytes):

*Mar  1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Mar  1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Based on this output, which statement is correct?

Accepted Answer

Console logging is set to debugging level, meaning all debug messages will appear on the console.. The output shows that buffer logging is set to level informational, but the buffer only contains 4096 bytes and has logged only 5 messages. The trap logging (syslog server) is set to informational but has logged 0 messages, and the server 192.168.1.100 is reachable (link up). The key issue is that the syslog server is not receiving messages despite being configured correctly, likely due to the source interface being Loopback0 which may not have a route to the server or the server is not processing the messages. However, the question asks for a correct statement based on the output. The correct answer is that console logging is set to debugging, which is the most detailed level, and this is confirmed by the output showing 'level debugging' for console logging.

Answer

The syslog server at 192.168.1.100 is receiving messages because the link is up.

Answer

Buffer logging is set to debugging level, so all debug messages are stored in the buffer.

Answer

The logging buffer size is 4096 bytes, which is sufficient to store all messages without overwriting.

Question 12

Which TWO statements correctly describe the behavior of EIGRP stub routing and its impact on troubleshooting? (Choose TWO.)

Accepted Answer

A stub router configured with the 'leak-map' option can advertise specific routes learned from other EIGRP neighbors beyond the stub restrictions.. EIGRP stub routing restricts the types of queries sent to a stub router and prevents it from acting as a transit router. Leak-map allows selective leaking of routes. The stub router does not send queries to its neighbors, but it can still receive queries from them. 'show ip eigrp topology' shows all routes, not just stub-learned ones. The 'connected' keyword only advertises connected routes, not summary or static unless specified.

Answer

When a router is configured as an EIGRP stub with the 'connected' keyword, it automatically advertises all connected interfaces, including passive interfaces, to its neighbors.

Answer

The command 'show ip eigrp topology all-links' on a stub router displays only the routes that are in the routing table, as stub routers do not store feasible successors.

Answer

An EIGRP stub router configured with the 'static' keyword will automatically redistribute all static routes into EIGRP, even if the 'redistribute static' command is not present.

Question 13

Which TWO actions will prevent an EIGRP neighbor relationship from forming due to authentication mismatch? (Choose TWO.)

Accepted Answer

One router is configured with 'ip authentication mode eigrp 100 md5' and the other with 'ip authentication mode eigrp 100 sha256'.. EIGRP authentication can be configured using MD5 or SHA-256. The key chain must match in name and key ID, and the key string must be identical. If one side uses MD5 and the other uses SHA-256, the authentication type differs. If the key ID does not exist on one side, authentication fails. The 'accept-lifetime' and 'send-lifetime' can cause failure if the current time is outside the valid range. If only one side has authentication configured, the neighbor relationship will form but with a warning, not a failure.

Answer

One router has 'ip authentication key-chain eigrp 100 MYCHAIN' configured, while the other router has no authentication configuration at all.

Answer

The 'accept-lifetime' on one router is set to 00:00:00 Jan 1 2020 to 23:59:59 Dec 31 2020, and the current time is in 2023.

Question 14

An engineer is troubleshooting an EIGRP network where routes from router R1 are not being installed in the routing table of router R2, although R2 sees them in the EIGRP topology table. Which TWO configuration issues could cause this problem? (Choose TWO.)

Accepted Answer

R2 has a static route with administrative distance 150 for the same prefix, and EIGRP's default administrative distance is 90.. Routes in the topology table but not in the routing table can be due to administrative distance issues, metric problems, or route filtering. A higher administrative distance from another routing protocol can prevent installation. The 'variance' command does not affect route installation; it only allows multiple unequal-cost paths. The 'maximum-paths' command limits the number of routes but does not block a single route. The 'distance' command can change administrative distance for specific routes. The 'offset-list' can increase metric, making the route less preferred.

Answer

The 'variance' command is configured on R2 with a value of 2, but the EIGRP route has a feasible successor with a higher metric.

Answer

The 'maximum-paths' command on R2 is set to 1, and there is already one EIGRP route for the same prefix in the routing table.

Question 15

A network engineer runs the following command on Router R2:

R2# show logging | include %SYS-5-CONFIG_I

*Mar  1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console

Based on this output, what is the most likely problem?

Accepted Answer

The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.. The output shows multiple configuration changes being made from the console in a short period of time. This could indicate unauthorized access or a misconfiguration that is causing repeated configuration changes. However, the most likely problem is that the logging level is set too low, and these messages are being generated due to a loop or automated script. But the key clue is that the messages are from the console, suggesting someone is making changes repeatedly. The correct answer is that the router is being reconfigured frequently, possibly due to a configuration loop or an attacker.

Answer

The router has a memory leak causing frequent reloads.

Answer

The logging buffer is full and messages are being overwritten.

Answer

The syslog server is not reachable, so messages are only logged locally.