300-410 Practice Test 43 — 15 Questions

Question 1

A multi-router network uses PBR to steer traffic from subnet 172.16.1.0/24 through a WAN link (next-hop 10.10.10.2). After a routing change, traffic from this subnet is being dropped. Router R1 shows: 'show route-map' indicates the route-map is applied, 'show ip policy' shows the policy on the interface, but 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2'. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The next-hop 10.10.10.2 is not reachable, and PBR drops packets when no route to the next-hop exists. Configure a fallback route or use 'set ip default next-hop'.. PBR requires the next-hop to be reachable via a route in the routing table. If the next-hop is not reachable (e.g., due to a routing change or a missing route), PBR will drop the packet unless a fallback is configured. In this case, the next-hop 10.10.10.2 is not reachable, so PBR drops the traffic. The solution is to either ensure the next-hop is reachable or configure a default route or fallback action.

Answer

The ACL in the route-map is incorrectly denying traffic from 172.16.1.0/24, causing PBR to not match the traffic.

Answer

The interface where PBR is applied is in a different VRF, causing the next-hop to be unreachable.

Answer

The next-hop 10.10.10.2 is reachable but the route-map has a 'match ip address' that is too specific, excluding some traffic.

Question 2

A router running EIGRP has a CoPP policy that includes a class-map matching EIGRP packets with a police rate of 2000 bps. The network engineer notices that EIGRP neighbor adjacencies are flapping. The EIGRP network has 100 routes. The engineer checks the CoPP statistics and sees that the EIGRP class has dropped 500 packets in the last hour. What is the most likely root cause?

Accepted Answer

The CoPP police rate of 2000 bps is insufficient for EIGRP hello and update traffic, causing packet drops.. The CoPP police rate of 2000 bps is too low for EIGRP traffic. EIGRP hello packets are sent every 5 seconds (default) and are typically around 60-80 bytes each, plus periodic updates and queries. With 100 routes, the initial exchange and any topology changes generate significant update traffic. Dropping 500 packets in an hour confirms the rate is insufficient, causing hello loss and neighbor flapping.

Answer

The EIGRP hello interval is set too low, causing excessive hello packets that exceed the police rate.

Answer

The EIGRP authentication is causing larger packets that exceed the police rate.

Answer

The CoPP class-map is matching EIGRP packets incorrectly, causing them to be dropped by a default class.

Question 3

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop 10.1.1.2
  Policy routing matches: 50 packets, 6000 bytes

What does this output indicate?

Accepted Answer

PBR is successfully forwarding matching traffic to 10.1.1.2.. The output shows that 50 packets have matched the route-map and have been policy-routed to next-hop 10.1.1.2. This indicates PBR is working.

Answer

The next-hop 10.1.1.2 is not reachable.

Answer

The ACL 101 is misconfigured.

Answer

PBR is not applied to any interface.

Question 4

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip policy
Interface   Route-map
FastEthernet0/0  PBR-MAP
Serial0/0    PBR-MAP

What does this output indicate?

Accepted Answer

The same route-map is applied to multiple interfaces, which may lead to unintended policy routing.. The output shows that the same route-map PBR-MAP is applied to both FastEthernet0/0 and Serial0/0. This could cause unexpected behavior if the route-map uses interface-specific conditions.

Answer

PBR is applied globally.

Answer

The route-map PBR-MAP is misconfigured.

Answer

PBR is only active on FastEthernet0/0.

Question 5

Which statement about PBR and the 'match ip address' command is correct?

Accepted Answer

It can reference a named or numbered ACL.. The 'match ip address' command references an access-list (standard or extended) to match packets based on source/destination IP addresses.

Answer

It can only match on source IP addresses.

Answer

It can match on MAC addresses.

Answer

It matches packets before routing table lookup.

Question 6

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The engineer also configures 'set ip default next-hop 10.0.0.3' in the same route-map sequence. Traffic that matches ACL 100 is forwarded to 10.0.0.2, but traffic that does not match ACL 100 is forwarded to 10.0.0.3 only if there is no route in the routing table. However, the engineer expects all unmatched traffic to go to 10.0.0.3 regardless of the routing table. What is the misunderstanding?

Accepted Answer

The 'set ip default next-hop' command overrides the routing table only when no route exists; the engineer wants unconditional forwarding.. The 'set ip default next-hop' command is used only when the packet does not have a matching route in the routing table. If a route exists (even a default route), the packet follows the routing table. The engineer should use 'set ip next-hop' instead of 'set ip default next-hop' to force all unmatched traffic to the next-hop.

Answer

The route-map sequence order is incorrect; the default next-hop should be in a separate sequence.

Answer

The ACL 100 is blocking all traffic, so no traffic matches the set commands.

Answer

The 'set ip default next-hop' command requires a 'set interface' command to work.

Question 7

An engineer configures PBR on a Cisco router using the following commands: 'route-map PBR permit 10', 'match ip address 100', 'set ip next-hop 10.1.1.1', and applies it inbound on interface GigabitEthernet0/1. Which TWO statements about this configuration are true? (Choose TWO.)

Accepted Answer

Packets that do not match ACL 100 will be forwarded using the normal routing table.. PBR is applied inbound on an interface. The route map matches packets using ACL 100. If the next hop is unreachable, the packet is forwarded using the routing table (if a default route exists) or dropped. PBR can be verified using 'show route-map' and 'debug ip policy'. The route map must be applied to the interface using 'ip policy route-map PBR'.

Answer

The command 'ip policy route-map PBR' must be applied under interface GigabitEthernet0/1 in global configuration mode.

Answer

If the next hop 10.1.1.1 becomes unreachable, packets that match ACL 100 will be dropped by default.

Answer

The route map must also include a 'match interface' statement to specify the incoming interface.

Question 8

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for traffic that is fragmented. What is the most likely reason?

Accepted Answer

PBR only matches the first fragment; subsequent fragments are forwarded based on the routing table because they lack Layer 4 headers.. PBR processes only the first fragment of a fragmented packet; subsequent fragments do not contain Layer 4 information (e.g., TCP/UDP ports) and may not match the ACL if it includes Layer 4 criteria. Additionally, PBR may not be applied to non-initial fragments by default, causing them to be forwarded normally.

Answer

The route-map is missing a 'match fragment' command.

Answer

Fragmented packets are always dropped by PBR.

Answer

The ACL in the route-map is using a 'deny' statement for fragmented packets.

Question 9

An engineer configures SNMPv2c with a read-only community string 'public' on a router. The NMS can poll interface statistics, but when trying to poll OSPF neighbor states, the NMS receives no response. Which is the most likely explanation?

Accepted Answer

The OSPF MIB is not supported or not loaded on the router.. The most likely explanation is that the OSPF MIB is not supported or not loaded on the router. SNMPv2c with a read-only community string 'public' can poll standard interface MIB objects (like ifEntry) because those are part of the base IF-MIB, which is always loaded. However, OSPF neighbor states are defined in the OSPF-MIB (RFC 1850/4750), which is an enterprise-specific MIB that must be explicitly supported and loaded in the router's SNMP agent. If the OSPF MIB is not present, the agent will not respond to GET requests for OSPF-related OIDs, even though the community string has read-only access.

Answer

The community string 'public' is not allowed to access the OSPF MIB due to a missing 'snmp-server view' command.

Answer

OSPF neighbor states are only available via SNMPv3 due to security restrictions.

Answer

The NMS must use the OSPF process ID in the OID to poll neighbor states.

Question 10

Router R4 has the following DHCPv6 configuration:

ipv6 dhcp pool DHCP6_POOL2
 address prefix 2001:db8:2::/64
 dns-server 2001:db8::1
!
interface GigabitEthernet0/1
 ipv6 address 2001:db8:2::1/64
 ipv6 dhcp server DHCP6_POOL2
 ipv6 nd managed-config-flag
 no shutdown

What is the effect of this configuration?

Accepted Answer

Hosts will use DHCPv6 to obtain both their IPv6 address and other configuration parameters like DNS.. The configuration uses the `ipv6 nd managed-config-flag` command, which sets the Managed Address Configuration flag (M flag) in Router Advertisement (RA) messages. When the M flag is set to 1, hosts are instructed to use DHCPv6 (stateful DHCPv6) to obtain their IPv6 addresses, not SLAAC. Additionally, the DHCPv6 pool provides DNS server information, so hosts will use DHCPv6 for both addressing and other configuration parameters like DNS. This matches option A.

Answer

Hosts will use SLAAC for addressing and DHCPv6 for DNS only.

Answer

The DHCPv6 pool is missing a domain-name, so it will not provide any configuration.

Answer

The ipv6 nd managed-config-flag command is incompatible with the DHCPv6 server and will cause an error.

Question 11

An EIGRP network with routers R1, R2, and R3 is experiencing frequent Stuck-in-Active (SIA) events for the prefix 172.16.1.0/24. R1 is the successor, R2 is the feasible successor. R3 is a query originator. 'show ip eigrp topology 172.16.1.0/24' on R1 shows the route in active state. 'show ip eigrp interfaces' on R2 shows the link to R3 is up but with high packet loss. What is the root cause?

Accepted Answer

High packet loss on the link between R2 and R3 causes EIGRP queries or replies to be dropped, leading to SIA.. The high packet loss on the link between R2 and R3 causes EIGRP queries or replies to be dropped. When R3 originates a query for the prefix 172.16.1.0/24, R1 (the successor) transitions the route to active state and sends queries to all neighbors, including R2. R2, as the feasible successor, must reply, but if the link to R3 has high packet loss, the query from R2 to R3 or the reply from R3 back to R2 may be lost, preventing R2 from sending its reply to R1 within the active timer, leading to a Stuck-in-Active (SIA) event.

Answer

R3 has a route summarization that causes the query to be sent to the Null0 interface.

Answer

The EIGRP active timer is set too low on R1, causing premature SIA.

Answer

R2 has a distribute-list that filters the prefix, preventing the reply from being sent.

Question 12

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using OSPF with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip cef vrf CUSTOMER 10.2.2.0 command on PE1 shows the next-hop as 192.168.1.2 and the output interface as GigabitEthernet0/0. The show mpls forwarding-table 192.168.1.2 detail command on PE1 shows a label with outgoing interface GigabitEthernet0/0. The show ip route 192.168.1.2 command on PE1 shows the route with a next-hop of 10.0.0.2 and output interface GigabitEthernet0/0. The show ip cef 192.168.1.2 command on PE1 shows the next-hop as 10.0.0.2 and output interface GigabitEthernet0/0. What is the most likely cause?

Accepted Answer

The PE2 router does not have a label for the CE1 prefix in its LFIB.. All forwarding components on PE1 are correct. The issue is likely on the remote side, such as PE2 not having a label for the return traffic or CE2 not having a route back. The engineer should check PE2's forwarding table for the CE1 prefix.

Answer

The VRF route-target import on PE2 is misconfigured.

Answer

The OSPF process on PE1 is not redistributing BGP routes into OSPF.

Answer

The MP-BGP session is using an incorrect update-source.

Question 13

An engineer configures iBGP between two routers in the same AS. The BGP session comes up, but the routes learned from the eBGP neighbor are not installed in the routing table. The IGP does not carry the BGP next-hop address. Which is the most likely explanation?

Accepted Answer

The BGP next-hop is not reachable because the IGP does not advertise it, and no static route exists.. For a BGP route to be installed in the routing table, the next-hop address must be reachable via the IGP or a static route. Since the IGP does not carry the BGP next-hop address and no static route exists, the next-hop is unreachable, causing the route to remain in the BGP table but not be installed in the routing table.

Answer

The BGP synchronization rule is enabled, causing the route to be suppressed until the IGP learns it.

Answer

The next-hop-self command is missing on the eBGP neighbor, so the iBGP router sees the external next-hop.

Answer

The BGP table shows the route as valid, but the routing table does not install it due to administrative distance.

Question 14

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla configuration 10

IP SLAs, Infrastructure Engine-II.
Entry number: 10
Owner: 
Tag: 
Type of operation to perform: icmp-echo
Target address: 192.168.1.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already occurred
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday): FALSE
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
   Number of history intervals kept: 0
   Number of history buckets kept: 15
   History Statistics:
      Number of history Lives kept: 0

What does this output indicate?

Accepted Answer

The IP SLA operation is configured as an ICMP echo probe to 192.168.1.1 with a 60-second frequency.. This output shows the configuration of IP SLA operation 10. It is an ICMP echo probe to 192.168.1.1, with a 60-second frequency and 5-second timeout. The status is 'Active', meaning it is enabled.

Answer

The IP SLA operation is configured as an HTTP GET request to 192.168.1.1.

Answer

The IP SLA operation has a timeout of 60 seconds and a frequency of 5 seconds.

Answer

The IP SLA operation is in a 'Pending' state and not yet active.

Question 15

A network engineer runs the following command on Router R1:

R1# show route-map VRF_RED_MAP
route-map VRF_RED_MAP, permit, sequence 10
  Match clauses:
    ip address prefix-list RED_PREFIXES
  Set clauses:
    tag 100
  Policy routing matches: 0 packets, 0 bytes

Based on this output, what is the problem?

Accepted Answer

The route-map is not applied to any interface.. The route-map VRF_RED_MAP has a match clause for prefix-list RED_PREFIXES and a set clause to tag 100. The policy routing matches show 0 packets, meaning the route-map has never been used. This could indicate that the route-map is not applied to any interface or that no traffic matches the prefix-list.

Answer

The prefix-list RED_PREFIXES is empty.

Answer

The set clause is incorrect.

Answer

The route-map sequence is invalid.