300-410 Practice Test 44 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.1.2:0, Local LDP Ident: 192.168.0.1:0
        TCP connection: 192.168.1.2.646 - 192.168.0.1.49876
        State: Oper; Msgs sent/rcvd: 100/105; Downstream on demand
        Up time: 00:10:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 192.168.1.2
        Addresses bound to peer LDP Ident:
          192.168.1.2        10.1.1.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which means the LDP session is operational. The 'Downstream on demand' label distribution mode is a valid mode (RFC 5036) and does not indicate a problem. The session is exchanging label information, as evidenced by the 'Oper' state and the presence of peer addresses.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The LDP session is in the process of being established.

Answer

The LDP session is using downstream on demand mode, which is a problem.

Question 2

A network engineer runs the following command to troubleshoot a VRF-Lite CoPP issue:

R1# show policy-map control-plane input class CoPP-ACL vrf CUSTOMER_I

Output:
  Class-map: CoPP-ACL (match-all)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: access-group 100
    police:
        cir 8000 bps, bc 1500 bytes, be 1500 bytes
      conformed 0 packets, 0 bytes; actions:
        transmit
      exceeded 0 packets, 0 bytes; actions:
        drop
      violated 0 packets, 0 bytes; actions:
        drop

What does this output indicate?

Accepted Answer

The CoPP policy is rate-limiting traffic to 8000 bps, but no traffic has matched the class yet.. The 'show policy-map control-plane input class vrf' command displays CoPP policy statistics for a specific VRF. The output shows class CoPP-ACL matching access-group 100, with a police rate of 8000 bps. All counters are zero, indicating no traffic has matched this class. This could mean the ACL is not matching any packets, or no traffic is being sent to the control plane for this VRF.

Answer

The CoPP policy is dropping all packets that match access-group 100.

Answer

The CoPP policy has matched many packets and is dropping them due to exceeding the rate.

Answer

The CoPP policy is not applied to the control plane for this VRF.

Question 3

Examine the following partial configuration:

username admin privilege 15 secret 5 $1$abcdefg$hashedvalue
username operator privilege 1 password cisco
!
line console 0
 login local
!
line vty 0 4
 login local
 transport input ssh

What is a potential security issue with this configuration?

Accepted Answer

The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.. The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Answer

The 'admin' user has privilege 15, which is too high for administrative access.

Answer

The console line is missing the 'transport input' command.

Answer

The VTY lines should use 'login' without 'local' to allow remote authentication.

Question 4

Which THREE symptoms indicate that Policy-Based Routing (PBR) is not working as expected? (Choose THREE.)

Accepted Answer

Traffic that should be policy-routed follows the routing table instead.. If traffic that should be policy-routed follows the routing table instead, PBR may not be applied or the route-map may not match. High CPU usage can occur if PBR is process-switched and ACLs are large. If the 'set interface' specifies a down interface, packets are dropped. The 'show ip policy' command shows PBR application, not a symptom of failure. PBR does not affect routing table updates. A mismatch in ACLs can cause unintended forwarding.

Answer

The 'show ip policy' command shows the route-map applied to the interface.

Answer

The routing table is updated with new routes from PBR.

Question 5

A network engineer runs the following command on Router R1:

R1# show logging

Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer)
    Console logging: level debugging, 37 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level informational, 5 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 0 message lines logged
        Logging to 192.168.1.100 (udp port 514, audit disabled,
                link up),
          0 message lines logged, xml disabled,
          filtering disabled
        Logging Source Interface: Loopback0

Log Buffer (4096 bytes):

*Mar  1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Mar  1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Based on this output, which statement is correct?

Accepted Answer

Console logging is set to debugging level, meaning all debug messages will appear on the console.. The output shows that buffer logging is set to level informational, but the buffer only contains 4096 bytes and has logged only 5 messages. The trap logging (syslog server) is set to informational but has logged 0 messages, and the server 192.168.1.100 is reachable (link up). The key issue is that the syslog server is not receiving messages despite being configured correctly, likely due to the source interface being Loopback0 which may not have a route to the server or the server is not processing the messages. However, the question asks for a correct statement based on the output. The correct answer is that console logging is set to debugging, which is the most detailed level, and this is confirmed by the output showing 'level debugging' for console logging.

Answer

The syslog server at 192.168.1.100 is receiving messages because the link is up.

Answer

Buffer logging is set to debugging level, so all debug messages are stored in the buffer.

Answer

The logging buffer size is 4096 bytes, which is sufficient to store all messages without overwriting.

Question 6

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.2.2.0/24
BGP routing table entry for 10.2.2.0/24, version 5
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65002
    10.1.12.2 from 10.1.12.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is a potential issue with this route?

Accepted Answer

The route is not being advertised to any BGP peer, possibly due to outbound filtering.. The route is valid and best, but it is 'Not advertised to any peer'. This could be due to outbound filtering, such as a route-map, prefix-list, or the neighbor not being configured to receive the route. The route is learned from an eBGP peer but not being propagated.

Answer

The route has a low local preference of 100.

Answer

The next hop 10.1.12.2 is unreachable.

Answer

The route is not installed in the routing table.

Question 7

An engineer must prevent a VRF on a PE router from learning routes from a specific remote site in an MPLS L3VPN. Which TWO configuration changes on the local PE can achieve this? (Choose TWO.)

Accepted Answer

Remove the import RT that corresponds to the remote site's export RT from the VRF configuration.. To block routes from a specific remote site, the engineer can either remove the import RT that matches the remote site's export RT, or configure a route map with a 'match ip address' clause to deny specific prefixes and apply it to the import direction. Removing the export RT from the local VRF would affect how the local site's routes are advertised, not what is received. Changing the RD does not affect route acceptance. The 'neighbor ... default-originate' command is unrelated to filtering VPNv4 routes.

Answer

Remove the export RT from the VRF configuration.

Answer

Change the Route Distinguisher (RD) of the VRF to a different value.

Answer

Configure 'neighbor <remote-PE> default-originate' under the VRF address-family.

Question 8

A network engineer configures mutual redistribution between EIGRP and OSPF on a DMVPN hub router. The EIGRP domain includes the DMVPN tunnel network, and OSPF includes a corporate backbone. Unexpectedly, after a few minutes, the routing table on the hub shows oscillating routes between EIGRP and OSPF for the same prefix, causing intermittent connectivity. Which is the most likely explanation?

Accepted Answer

The mutual redistribution creates a routing loop because the redistributed routes are re-injected into the original protocol without proper filtering, causing the hub to prefer the redistributed route with a lower AD.. Mutual redistribution without route tagging or filtering can cause routing loops. When a route is redistributed from EIGRP into OSPF, it is then redistributed back into EIGRP with a different administrative distance (AD). Since OSPF has AD 110 and EIGRP has AD 90 (internal) or 170 (external), the redistributed route may be preferred over the original, causing a feedback loop. The corner case is that the default AD values cause the redistributed route to be installed, and then the router advertises it back, leading to instability. The fix is to use route tags or distribute-lists to prevent re-redistribution.

Answer

The DMVPN tunnel interface is not included in the OSPF process, causing the redistributed routes to have an incorrect next-hop that points to the tunnel interface.

Answer

The EIGRP and OSPF processes are using different metric styles, causing the redistributed routes to have infinite metrics and be ignored.

Answer

The hub router's routing table is overloaded due to the DMVPN tunnel being a multipoint interface, causing route flapping.

Question 9

An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?

Accepted Answer

Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.. RA Guard is the correct IPv6 First Hop Security feature to block rogue Router Advertisements (RAs) while allowing legitimate RAs. By configuring a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', the switch will forward RAs only from the trusted router port and drop RAs received on host ports. This directly prevents the attack described.

Answer

Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.

Answer

Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.

Answer

Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.

Question 10

A network engineer is troubleshooting a route filtering problem with prefix-lists. Router R6 is using a prefix-list to filter routes from a BGP neighbor. The prefix-list is configured to permit only 192.168.0.0/16 and 192.168.1.0/24, but routes with prefix 192.168.2.0/24 are also being accepted. The engineer checks the prefix-list configuration and sees only two permit statements. What is the most likely cause?

Accepted Answer

The prefix-list is not applied to the BGP neighbor; the neighbor is using a different filter or no filter.. Prefix-lists have an implicit deny at the end, but if the prefix-list is not applied correctly (e.g., to the neighbor inbound direction), or if the prefix-list has a 'ge' or 'le' operator that is too broad, it could permit more than intended. However, the most common issue is that the prefix-list is not applied at all, or the neighbor is using a different filter.

Answer

The prefix-list has an implicit permit at the end for all routes.

Answer

The prefix-list is using 'ge 24' which permits any prefix with a mask >= 24, including 192.168.2.0/24.

Answer

The BGP neighbor is configured with 'soft-reconfiguration inbound' which overrides prefix-list filtering.

Question 11

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.10.10.0/24
BGP routing table entry for 10.10.10.0/24, version 5
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0
      (received-only)

Based on this output, what does the "(received-only)" flag indicate?

Accepted Answer

The route is received but not installed in the routing table, likely due to a route-map filtering.. The "(received-only)" flag indicates that the route was received from a neighbor but is not installed in the routing table, often due to a route-map filtering or a prefix-list. The correct answer is that a route-map is likely filtering this route from being installed.

Answer

The route is best and installed in the routing table.

Answer

The route is suppressed by a route-map.

Answer

The route is being advertised to neighbors.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DROTHER    00:00:35    192.168.12.2    GigabitEthernet0/0
10.1.1.3         1   FULL/DR         00:00:32    192.168.13.3    GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

Router R1 has a full adjacency with both neighbors and is in a stable state.. The output shows two OSPF neighbors. The neighbor with state FULL/DROTHER indicates it is not the DR or BDR on that segment. The neighbor with state FULL/DR is the designated router. The dead times are within normal range, indicating the adjacency is stable.

Answer

Router R1 is the DR on the segment connected to GigabitEthernet0/0.

Answer

Router R1 is experiencing a neighbor timeout on GigabitEthernet0/1.

Answer

Router R1 is not receiving hello packets from 10.1.1.2.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology 10.50.50.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(192.168.1.1) for 10.50.50.0/24
  State: Active, Reply status: 0, Originating router: 192.168.1.1
  Routing Descriptor Blocks:
  10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag: 0x0
      Composite metric: (4294967295/4294967295), Route is Internal
      Vector metric:
        Minimum bandwidth: 100000 Kbit
        Total delay: 100 microseconds
        Reliability: 255/255
        Load: 1/255
        Minimum MTU: 1500
        Hop count: 1

Based on this output, what is the problem?

Accepted Answer

The route is in Active state with an infinite metric, indicating that the router has lost the route and is querying for a new path.. The route is in Active state with a composite metric of 4294967295 (the maximum 32-bit value, effectively infinite), which indicates that the router has lost the feasible successor and is actively sending queries to neighbors to find an alternative path. This is a classic sign of an EIGRP query process in progress, meaning the route is not stable or reachable.

Answer

The route is passive and stable.

Answer

The metric of 4294967295 is normal for a summary route.

Answer

The hop count of 1 indicates the route is one hop away and reachable.

Question 14

A network engineer runs the following command on Router R1:

R1# show mpls forwarding-table
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  10.1.1.0/24      0             Gi0/0      192.168.1.2
17         21         10.2.2.0/24      1500          Gi0/0      192.168.1.2
18         Untagged   10.3.3.0/24      0             Gi0/1      192.168.2.2

Based on this output, what is the problem with the label entry for 10.3.3.0/24?

Accepted Answer

The next-hop router 192.168.2.2 is not an LDP neighbor for this prefix.. The entry for 10.3.3.0/24 shows 'Untagged' in the outgoing label column, meaning the router is forwarding IP packets without an MPLS label. This indicates that the next-hop router (192.168.2.2) did not assign a label for this prefix, possibly because LDP is not enabled on that interface or the neighbor is not an LDP peer.

Answer

The label 18 is being swapped correctly.

Answer

The prefix 10.3.3.0/24 is being forwarded with MPLS label 18.

Answer

The label 18 is being popped by the next-hop router.

Question 15

Which TWO statements correctly describe the behavior of BGP route summarization using the 'aggregate-address' command? (Choose TWO.)

Accepted Answer

By default, the aggregate route is advertised with the ATOMIC_AGGREGATE attribute set.. The BGP 'aggregate-address' command creates a summary route in the BGP table. By default, the summary is advertised with the ATOMIC_AGGREGATE attribute and the aggregator router ID, but the more specific routes are still advertised unless the 'summary-only' keyword is used. The summary inherits the AS_PATH from the component routes, but the 'as-set' keyword is required to include the AS_PATH information in the aggregate. The summary does not automatically suppress the component routes.

Answer

The 'aggregate-address' command automatically suppresses the advertisement of all more specific routes.

Answer

The aggregate route inherits the AS_PATH of the longest matching more specific route.

Answer

The 'aggregate-address' command can be used to summarize both IPv4 and IPv6 prefixes in the same configuration.