300-410 Practice Test 41 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip policy
Interface   Route-map
FastEthernet0/0  PBR-MAP
Serial0/0    PBR-MAP

What does this output indicate?

Accepted Answer

The same route-map is applied to multiple interfaces, which may lead to unintended policy routing.. The output shows that the same route-map PBR-MAP is applied to both FastEthernet0/0 and Serial0/0. This could cause unexpected behavior if the route-map uses interface-specific conditions.

Answer

PBR is applied globally.

Answer

The route-map PBR-MAP is misconfigured.

Answer

PBR is only active on FastEthernet0/0.

Question 2

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP

class-map: MANAGEMENT (match-all)
      5 packets, 500 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 5 packets, 500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

class-map: ATTACK (match-all)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 100 packets, 10000 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Based on this output, what is happening to traffic matching class ATTACK?

Accepted Answer

All traffic in class ATTACK is being dropped.. The output shows that for class ATTACK, 100 packets were exceeded and dropped. This means the traffic rate exceeded the committed information rate (CIR) of 8000 bps, and all packets were dropped as per the exceed action.

Answer

All traffic in class ATTACK is being transmitted.

Answer

Traffic in class ATTACK is being rate-limited but not dropped.

Answer

Traffic in class ATTACK is being marked down.

Question 3

A network engineer is troubleshooting a BGP route reachability issue. R1 learns the prefix 10.1.1.0/24 via eBGP from R2 with an AD of 20, and via OSPF from R3 with an AD of 110. The engineer notices that R1 installs the OSPF route in the routing table instead of the eBGP route, even though the eBGP route is preferred by default. What is the most likely cause of this behavior?

Accepted Answer

The distance bgp 20 200 200 command is configured under the BGP process, increasing the AD of eBGP routes to 200.. The default administrative distance for eBGP is 20, and for OSPF is 110, so eBGP should be preferred. However, if the distance command is applied to the eBGP neighbor or the BGP process, it can increase the AD of eBGP routes, making them less preferred than OSPF.

Answer

The OSPF route has a lower metric than the eBGP route.

Answer

The OSPF route is an inter-area route, which has a lower AD than intra-area routes.

Answer

The eBGP route is not the best path because the next-hop is unreachable.

Question 4

Consider the following CoPP configuration:

access-list 150 permit tcp any any eq 179
access-list 150 permit udp any any eq 646
!
class-map match-all COPP-CORE
 match access-group 150
!
policy-map COPP-POLICY
 class COPP-CORE
  police 64000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is missing from this configuration to also protect against ICMP-based control-plane attacks?

Accepted Answer

Add 'permit icmp any any' to access-list 150 to include ICMP in the COPP-CORE class.. The current CoPP configuration only matches BGP (TCP port 179) and LDP (UDP port 646) traffic in the COPP-CORE class. ICMP-based control-plane attacks (e.g., ICMP floods, Smurf attacks) are not matched by any explicit class, so they fall into class-default, which has a higher police rate (128 kbps) and may allow excessive ICMP traffic to reach the control plane. Adding 'permit icmp any any' to access-list 150 ensures ICMP packets are classified into COPP-CORE and subjected to the more restrictive 64 kbps policer, protecting the control plane from ICMP-based attacks.

Answer

Change the class-default police rate to 64000 bps to match the COPP-CORE rate.

Answer

Add a second class-map for ICMP and apply a separate policer.

Answer

The configuration is complete; ICMP is not a significant control-plane threat.

Question 5

According to RFC 2663, what is the term for the process of translating both the source and destination IP addresses in a packet?

Accepted Answer

Twice NAT. RFC 2663 defines 'Twice NAT' as the process of translating both the source and destination IP addresses within a single packet. This is necessary when the private and public address spaces overlap, requiring simultaneous translation of both the source and destination fields to ensure proper routing and reachability.

Answer

Static NAT

Answer

PAT

Answer

Double NAT

Question 6

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

Accepted Answer

The uRPF strict mode check fails because the router does not have a route to the source IPv6 network pointing to the tunnel interface.. The uRPF strict mode check requires that the source IPv6 address of incoming traffic on the tunnel interface must have a route in the routing table pointing back to that same interface. Since the IPv6 traffic is sourced from a network behind the tunnel, the router likely has a route to that source network via a different interface (e.g., the physical LAN interface) or no route at all, causing uRPF to drop the packets. This is the most likely cause because the tunnel interface is the inbound interface for the decapsulated IPv6 packets, and uRPF strict mode validates the source address against the Forwarding Information Base (FIB) entry pointing to the tunnel interface.

Answer

The ACL is blocking the IPv6 traffic because the tunnel interface does not support ACLs.

Answer

The tunnel is not configured with the correct IPv4 source and destination.

Answer

The uRPF mode should be loose mode to allow traffic from any source.

Question 7

A network engineer runs the following command on Router R4:

R4# show ip route 10.10.10.0
Routing entry for 10.10.10.0/24
  Known via "connected", distance 0, metric 0 (connected)
  Redistributing via eigrp 100
  Last update from 10.10.10.1 on GigabitEthernet0/0, 00:00:00 ago
  Routing Descriptor Blocks:
  * 10.10.10.1, via GigabitEthernet0/0
      Route metric is 0, traffic share count is 1

Based on this output, which statement is true?

Accepted Answer

The route is a connected route, as indicated by distance 0.. The output explicitly states 'Known via "connected"' and shows 'distance 0, metric 0 (connected)'. In Cisco IOS, connected routes have an administrative distance of 0, which is the lowest possible and indicates the route is directly attached to an interface. The 'Redistributing via eigrp 100' line means the connected route is being redistributed into EIGRP, not that it was learned from EIGRP.

Answer

The route is a static route with distance 0.

Answer

The route is redistributed from EIGRP into connected.

Answer

The administrative distance of 0 indicates a floating static route.

Question 8

Router R4 has the following configuration:
```
interface GigabitEthernet0/5
 ip address 10.4.4.4 255.255.255.0
 ip policy route-map PBR-DEFAULT
!
route-map PBR-DEFAULT permit 10
 set ip default next-hop 192.168.3.1
```
What is the effect of this configuration?

Accepted Answer

All packets received on G0/5 are forwarded to 192.168.3.1 if they do not have a route in the routing table.. The `set ip default next-hop` command in a route-map applies policy-based routing only when the router has no explicit route in the routing table for the destination — it is a fallback, not an override. So packets received on G0/5 that lack a matching route entry are forwarded to 192.168.3.1, while packets with a valid route follow normal destination-based forwarding. Option A describes this conditional fallback behaviour accurately.

Answer

All packets received on G0/5 are forwarded to 192.168.3.1 regardless of the routing table.

Answer

The route-map is missing a match statement, so it does nothing.

Answer

The configuration is invalid because 'set ip default next-hop' requires an ACL.

Question 9

A network engineer configures SNMPv3 with authentication and privacy on a router. The NMS polls the router via the management interface. The engineer then adds a loopback interface and configures the router to send SNMP traps sourced from the loopback IP. The NMS stops receiving traps. Which is the most likely explanation?

Accepted Answer

The NMS is configured to accept traps only from the management interface IP address, not the loopback IP.. The NMS is likely configured with an ACL or trap receiver filter that only accepts SNMP traps from the management interface IP address. When the engineer configures 'snmp-server trap-source loopback0', the router changes the source IP of all outgoing traps to the loopback IP. If the NMS is not expecting traps from that IP, it will drop them, even though SNMPv3 authentication and privacy are correctly configured.

Answer

The loopback interface does not support SNMP trap generation.

Answer

The SNMP engine ID changed when the loopback interface was added.

Answer

The 'snmp-server trap-source' command requires a specific interface type.

Question 10

A network engineer is troubleshooting a route redistribution issue between OSPF and EIGRP. Routers R1 (OSPF) and R2 (EIGRP) are redistributing routes into each other. The engineer notices that some OSPF external routes are not appearing in the EIGRP topology table on R2, although the redistribution is configured. The show ip eigrp topology command on R2 does not list the missing prefixes. What is the most likely cause?

Accepted Answer

The redistribute ospf command under EIGRP is missing the match external keyword.. When redistributing OSPF routes into EIGRP, by default only internal OSPF routes (routes within the OSPF domain) are redistributed. To include OSPF external routes (routes redistributed into OSPF from other protocols), the 'match external' keyword must be specified in the redistribute command. Since the missing prefixes are OSPF external routes, the most likely cause is that the redistribute command under EIGRP is missing the 'match external' keyword.

Answer

The redistribute ospf command under EIGRP is missing the match internal keyword.

Answer

The OSPF process on R1 has a route filter blocking external routes.

Answer

EIGRP has a lower administrative distance than OSPF, causing route suppression.

Question 11

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip interface GigabitEthernet0/0 | include access list
  Outgoing access list is 102
  Inbound access list is not set

Then the engineer checks:
R1# show ip access-lists 102
Extended IP access list 102
    10 deny tcp any any eq 23
    20 permit ip any any

What does this output indicate?

Accepted Answer

ACL 102 is applied outbound on GigabitEthernet0/0, denying Telnet traffic and permitting all other traffic.. The output of 'show ip interface GigabitEthernet0/0 | include access list' shows 'Outgoing access list is 102', which means ACL 102 is applied in the outbound direction on that interface. The ACL itself contains a deny statement for TCP traffic destined to port 23 (Telnet) followed by a permit ip any any, so it denies Telnet traffic while permitting all other IP traffic. Option A correctly summarizes this behavior.

Answer

ACL 102 is applied inbound on GigabitEthernet0/0, blocking Telnet.

Answer

ACL 102 is not applied to any interface.

Answer

ACL 102 is applied inbound and outbound on GigabitEthernet0/0.

Question 12

Consider the following partial configuration on router R4:

interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 ipv6 address 2001:db8:1::1/64
 ipv6 ospf 1 area 0
!
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.0
 ipv6 address 2001:db8:2::1/64
 ipv6 ospf 1 area 0
!
ipv6 router ospf 1
 router-id 4.4.4.4

What is the effect of this configuration?

Accepted Answer

OSPFv3 will form adjacencies on both interfaces as intended because the router-id is correctly set and OSPFv3 is enabled on each interface.. OSPFv3 (OSPF for IPv6) uses a 32-bit router-id, which can be an IPv4 address (like 4.4.4.4) or any arbitrary 32-bit value, and does not require an IPv6 address. The configuration enables OSPFv3 process 1 under the global 'ipv6 router ospf 1' command, sets the router-id, and activates OSPFv3 on both interfaces with 'ipv6 ospf 1 area 0', allowing adjacencies to form normally on both GigabitEthernet0/0 and GigabitEthernet0/1.

Answer

OSPFv3 will not form adjacencies because the router-id must be an IPv6 address.

Answer

OSPFv3 will only form adjacency on GigabitEthernet0/0 because the router-id is not configured under the interface.

Answer

OSPFv3 will not form any adjacency because the network type is not specified.

Question 13

An engineer configures RSPAN VLAN 100 on two switches to monitor traffic across the network. The remote switch shows the RSPAN source as active, but the destination switch receives no mirrored traffic. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is not allowed on a trunk link between the source and destination switches.. For RSPAN to work, the RSPAN VLAN must be carried across every trunk link between the source switch and the destination switch. If the RSPAN VLAN is not in the allowed VLAN list on an intermediate trunk, the mirrored frames are dropped in transit, so the destination receives nothing even though the source session shows active. This is the classic RSPAN failure mode.

Answer

The RSPAN VLAN is configured as a native VLAN on the trunk, causing VLAN tagging issues.

Answer

The destination switch has a different RSPAN VLAN ID configured for the session.

Answer

The source switch has not enabled RSPAN globally with the 'monitor session' command.

Question 14

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# show bgp vpnv4 vrf CUSTOMER-A 10.1.1.0/24

Output:
BGP routing table entry for 10.1.1.0/24, version 10
Paths: (1 available, best #1, table CUSTOMER-A)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    0.0.0.0 from 0.0.0.0 (10.0.0.1)
      Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best
      Extended Community: RT:100:100
      mpls labels in/out nolabel/nolabel

What does this output indicate?

Accepted Answer

The route is locally originated and has no MPLS label. This shows a VPNv4 route for prefix 10.1.1.0/24 in VRF CUSTOMER-A. The path is local (sourced from this router), with next hop 0.0.0.0, and the route is valid and best. The extended community is RT:100:100. The mpls labels show nolabel/nolabel, meaning no MPLS label is assigned for this prefix, which could indicate a problem if labels are expected.

Answer

The route is learned from a BGP peer

Answer

The route has an MPLS label of 100

Answer

The route is not best

Question 15

A network engineer runs the following command to verify NetFlow export destination:

R1# show ip flow export

Flow export v9 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Destination(1)  192.168.1.100 (2055)
  Source IP         10.0.0.1
  Origin AS         65000
  Peer AS           65001
  Mask for source   255.255.255.255
  Mask for destination 255.255.255.255
  Version 9 flow records
  1234 flows exported in 567 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

What does this output indicate?

Accepted Answer

NetFlow export is successful with 1234 flows exported and no errors.. The output shows '1234 flows exported in 567 udp datagrams' and all error counters are zero, indicating successful export. The destination is 192.168.1.100 on port 2055, and version 9 is used. Therefore, NetFlow export is working without errors.

Answer

NetFlow export is failing due to adjacency issues.

Answer

NetFlow is using version 5 export.

Answer

The export destination is not configured.