300-410 Practice Test 43 — 15 Questions

Question 1

Which THREE symptoms indicate a misconfigured RSPAN session on a Cisco switch? (Choose THREE.)

Accepted Answer

The RSPAN VLAN is not allowed on the trunk between the source and destination switches.. Option A is correct because the RSPAN VLAN must be permitted (allowed) on every trunk carrying the monitored traffic between the source and destination switches; if it is pruned or not allowed, the mirrored frames never reach the destination switch and the session fails. Option B is correct because the RSPAN VLAN must be created and active on all participating switches, including the destination switch, so it can forward the mirrored traffic out the destination port; without it, the session cannot deliver captured frames. Option C is correct because a source switch must define the traffic to be mirrored with the 'monitor session 1 source' command; if that command is missing, no traffic is copied into the RSPAN VLAN and the session produces no output. Option D is not specific to RSPAN and a native VLAN mismatch is a general trunk misconfiguration, not a defined RSPAN symptom. Option E is incorrect because RSPAN operates at Layer 2 and does not depend on routing protocol redistribution of the RSPAN VLAN.

Answer

The native VLAN mismatch on the trunk link.

Answer

The routing protocol is not redistributing the RSPAN VLAN.

Question 2

A network engineer runs the following command to debug MPLS LDP errors:

R1# debug mpls ldp errors

Output:
*Mar  1 00:01:23.456: LDP: Received malformed hello from 10.0.0.2
*Mar  1 00:01:23.789: LDP: Received malformed initialization from 10.0.0.2
*Mar  1 00:01:24.012: LDP: Session with 10.0.0.2:0 (0x1234) is DOWN

What does this output indicate?

Accepted Answer

The LDP session with 10.0.0.2 failed due to malformed messages from the neighbor. The debug output shows LDP errors. R1 received malformed hello and initialization messages from neighbor 10.0.0.2, causing the LDP session to go down. This indicates a configuration mismatch or software bug on the neighbor.

Answer

The LDP session with 10.0.0.2 is up and stable

Answer

R1 is sending malformed messages to 10.0.0.2

Answer

The LDP session is using incorrect transport address

Question 3

A network engineer runs the following command to verify CoPP (Control Plane Policing) with route-maps:

R1# show policy-map control-plane input class class-default

Control Plane

Service-policy input: CoPP

Class-map: class-default (match-any)
      12234 packets, 1234567 bytes
      5 minute offered rate 1000 bps, drop rate 0 bps
      Match: any
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 12234 packets, 1234567 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

The CoPP policy is allowing all traffic and not dropping any packets.. The output shows the CoPP policy applied to the control plane. The class-default matches all traffic and polices it at 8000 bps. All packets have conformed and been transmitted, with no drops. This indicates that the CoPP policy is working and not dropping any traffic.

Answer

The CoPP policy is dropping all traffic because the CIR is too low.

Answer

The CoPP policy is only matching specific traffic classes.

Answer

The CoPP policy is not applied to the control plane.

Question 4

Examine the following partial configuration on router R1:

flow record RECORD-1
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect counter bytes
 collect counter packets
!
flow monitor MONITOR-1
 record RECORD-1
 cache timeout active 60
!
interface GigabitEthernet0/1
 ip flow monitor MONITOR-1 input
!

Which statement about this configuration is true?

Accepted Answer

The flow monitor will not export any data because no exporter has been configured.. The configuration defines a flow record, a flow monitor referencing that record, and applies the monitor to an interface, but it never defines a flow exporter or references one under the flow monitor with the 'exporter' command. Without an exporter, the flow monitor has no destination to send the collected flow data to, so no records will be exported off the device. The 'cache timeout active 60' only controls how long an active flow stays in the cache before being flushed to the exporter — it does not create an export path by itself.

Answer

The flow monitor will export flow records every 60 seconds regardless of whether the flow is still active.

Answer

The flow monitor will only export flows that have been idle for 60 seconds.

Answer

The flow record is missing the 'collect transport tcp-flags' command to be valid.

Question 5

Which BGP attribute is used as the first tie-breaker when multiple paths are available for the same prefix, assuming default settings?

Accepted Answer

Weight. C is correct because, under default BGP settings, the Weight attribute is the first tie-breaker when multiple paths exist for the same prefix. Weight is a Cisco-proprietary attribute that is locally significant to the router and is evaluated before any other BGP path selection criteria, including Local Preference and AS-path length.

Answer

Local preference

Answer

AS-path length

Answer

MED (Multi-Exit Discriminator)

Question 6

Examine this configuration on Router R6:

router ospf 1
 redistribute eigrp 100 subnets
 default-information originate always

What is a likely problem with this configuration?

Accepted Answer

The router will advertise a default route into OSPF even if it does not have a default route itself, potentially causing blackholing.. The 'default-information originate always' keyword forces OSPF to originate a default route (0.0.0.0/0) into the OSPF domain unconditionally, regardless of whether the router actually has a default route in its routing table. Without the 'always' keyword, OSPF only advertises a default route if one already exists locally. Using 'always' can cause traffic to be forwarded toward R6 and then dropped (blackholed) because R6 has no valid default path.

Answer

The 'default-information originate always' command is not allowed with redistribution.

Answer

The 'subnets' keyword is missing for EIGRP redistribution.

Answer

The redistribution will only work if EIGRP routes have a metric set.

Question 7

An engineer configures Control Plane Policing (CoPP) with a policy that denies all traffic in class-default. After applying the policy, BGP sessions to the router fail. What is the most likely explanation?

Accepted Answer

The class-default has an explicit 'drop' action, which overrides the implicit permit and drops all unmatched traffic, including BGP packets.. In a CoPP policy-map, class-default normally has an implicit permit, but if an explicit drop action is configured, it overrides that implicit behavior and drops all traffic not matched by earlier classes. BGP packets (TCP 179) that are not explicitly matched by a permit class therefore fall into class-default and are dropped, causing session failures. This is the most likely explanation given the described configuration.

Answer

The CoPP policy was applied to the wrong interface, so BGP packets are dropped by the interface ACL.

Answer

The BGP packets are matched by another class with a 'drop' action, but the class-default is irrelevant.

Answer

The CoPP policy uses 'rate-limit' in bps instead of pps, causing BGP packets to be dropped due to rate limiting.

Question 8

Which THREE statements about MPLS label operations (push, swap, pop) are true? (Choose THREE.)

Accepted Answer

The ingress LSR performs a label push operation.. In MPLS, the ingress LSR pushes a label, transit LSRs swap labels, and the penultimate hop router (PHP) pops the label. The egress LSR does not perform label operations if PHP is used. Label operations are based on the label forwarding table, not the routing table directly.

Answer

The egress LSR always performs a label pop operation.

Answer

Label operations are determined by the IP routing table.

Question 9

What is the default retransmission timeout for SNMP informs on a Cisco IOS device?

Accepted Answer

30 seconds. The default retransmission timeout for SNMP informs on Cisco IOS devices is 30 seconds, as specified by the Cisco SNMP configuration. This timeout controls how long the device waits for an acknowledgment (inform response) before retransmitting the inform request. Option B is correct because Cisco IOS uses a default timeout of 30 seconds for inform operations, which is distinct from the 5-second default for SNMP get/set requests.

Answer

5 seconds

Answer

60 seconds

Answer

10 seconds

Question 10

In MPLS LDP, what is the default label retention mode on Cisco IOS-XE routers?

Accepted Answer

Liberal Label Retention mode. The default label retention mode is Liberal, meaning that a router retains all label bindings received from neighbors, even if the neighbor is not the next hop for the FEC.

Answer

Conservative Label Retention mode

Answer

Ordered Label Retention mode

Answer

Independent Label Retention mode

Question 11

A network engineer is troubleshooting an EIGRP adjacency issue between two directly connected routers, R1 and R2. Both routers are configured with the same autonomous system number, but the adjacency fails to come up. The engineer checks the interfaces and verifies that they are up/up. On R1, the output of 'show ip eigrp neighbors' shows nothing. What is the most likely cause of this problem?

Accepted Answer

The interfaces are configured with IP addresses from different subnets.. EIGRP requires that directly connected neighbors share a common subnet for their interfaces. If R1 and R2 have IP addresses from different subnets, EIGRP will not form an adjacency because the hello packets sent by one router will be considered invalid by the other due to the subnet mismatch. The 'show ip eigrp neighbors' output is empty because no neighbor has been discovered, which is consistent with this Layer 3 mismatch.

Answer

The EIGRP process is shut down on one of the routers.

Answer

The passive-interface default command is configured under the EIGRP process.

Answer

The EIGRP router ID is the same on both routers.

Question 12

An engineer configures uRPF (Unicast Reverse Path Forwarding) in strict mode on a router interface facing the Internet. After configuration, legitimate traffic from customers is being dropped. The engineer verifies that the routing table has a route back to the source IP address. Which is the most likely explanation?

Accepted Answer

Asymmetric routing causes the return path to use a different interface. Strict uRPF checks that the source IP of an incoming packet is reachable via the same interface the packet arrived on. If the return route to the source points out a different interface (asymmetric routing), the check fails and the packet is dropped — even though a route to the source exists in the RIB.

Answer

The uRPF allow-default option is not configured

Answer

The source IP address is not in the routing table

Answer

uRPF strict mode requires CEF to be disabled

Question 13

Which THREE are valid syslog severity levels defined in RFC 5424? (Choose THREE.)

Accepted Answer

Emergency (0). RFC 5424 defines eight syslog severity levels numbered 0 through 7, and Emergency (0) is the highest-severity level, indicating the system is unusable, so option A is correct. Warning (4) is also a defined RFC 5424 severity, representing a condition that should be addressed but is not immediately critical, making option C correct. Informational (6) is likewise a valid RFC 5424 severity used for normal operational messages that require no action, so option E is correct. Option B is incorrect because the level numbered 1 is Alert, not Fatal, and Fatal is not an RFC 5424 severity name. Option D is incorrect because the highest defined severity number is 7 (Debug), so Trace (8) does not exist in RFC 5424.

Answer

Fatal (1)

Answer

Trace (8)

Question 14

A network engineer runs the following command to verify MPLS LDP discovery sources:

R1# show mpls ldp discovery detail

Output:
  Local LDP Identifier: 10.0.0.1:0
    Discovery Sources:
      Interfaces:
        GigabitEthernet0/0 (hello interval 5 s, targeted hello interval 10 s)
          LDP Id: 10.0.0.2:0, transport address: 10.0.0.2
          Hold time: 15 s (local: 15, peer: 15)
        GigabitEthernet0/1 (hello interval 5 s, targeted hello interval 10 s)
          LDP Id: 10.0.0.3:0, transport address: 10.0.0.3
          Hold time: 15 s (local: 15, peer: 15)

What does this output indicate?

Accepted Answer

R1 has discovered two LDP neighbors via link hellos on two different interfaces. The output shows two discovery sources on GigabitEthernet0/0 and GigabitEthernet0/1, each with a distinct LDP ID (10.0.0.2:0 and 10.0.0.3:0) and transport address, confirming R1 has discovered two LDP neighbors via link (basic) hellos on two different interfaces. The presence of 'Interfaces:' with per-interface LDP IDs and hold times confirms active neighbor discovery, not targeted-only or down sessions.

Answer

R1 is using targeted hellos only

Answer

R1 has no LDP neighbors

Answer

The LDP session with 10.0.0.2 is down

Question 15

Which MPLS label value is reserved for the Explicit NULL label and what is its purpose?

Accepted Answer

Label 0; used for the Explicit NULL label to indicate that the penultimate hop should pop the label.. Label value 0 is the IPv4 Explicit NULL label, used to signal the penultimate hop to pop the label stack and forward the packet based on the IP header.

Answer

Label 1; used for the Router Alert label.

Answer

Label 2; used for the Implicit NULL label.

Answer

Label 3; used for the Implicit NULL label.