300-410 Practice Test 44 — 15 Questions

Question 1

Which SNMP version introduced the use of a User-based Security Model (USM) and View-based Access Control Model (VACM)?

Accepted Answer

SNMPv3. SNMPv3 introduced the User-based Security Model (USM) for authentication and encryption, and the View-based Access Control Model (VACM) for granular access control. These models provide message integrity, authentication, and encryption, addressing the security deficiencies of earlier SNMP versions.

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv2u

Question 2

Which THREE symptoms indicate a DHCP IPv4 starvation attack or address pool exhaustion? (Choose THREE.)

Accepted Answer

Legitimate clients fail to obtain an IP address via DHCP.. Option A is correct because DHCP starvation attacks consume all available addresses in the scope, so legitimate clients sending DHCPDISCOVER receive no DHCPOFFER and fail to obtain a lease. Option B is correct because the defining symptom of pool exhaustion is the DHCP scope showing 100% utilization, often with leases bound to numerous unknown or randomized MAC addresses generated by the attack tool. Option C is correct because starvation tools such as Yersinia or dhcpstarv request leases using spoofed/changing MAC addresses, so the DHCP server's binding table fills with many leases tied to spoofed MAC addresses. Option D is not a recognized symptom of DHCP starvation; high CPU on clients is unrelated to DHCP pool exhaustion. Option E is not a symptom of starvation either, since DAD failures typically indicate duplicate IP addressing or rogue DHCP servers, not exhaustion of the DHCP pool.

Answer

Client devices experience high CPU utilization due to DHCP processing.

Answer

Duplicate IP address detection (DAD) failures are reported on all clients.

Question 3

R1 and R2 are eBGP peers. R1 advertises a summary route 10.0.0.0/8 via aggregate-address 10.0.0.0 255.0.0.0 summary-only. R2 receives the summary but also expects to receive more specific routes (e.g., 10.1.0.0/16) for traffic engineering. R2's BGP table shows only the summary, and the more specific routes are missing. R1's configuration includes: router bgp 65001, network 10.1.0.0 mask 255.255.0.0, and aggregate-address 10.0.0.0 255.0.0.0 summary-only. What is the root cause?

Accepted Answer

The summary-only keyword suppresses all more specific routes, including the network 10.1.0.0/16, from being advertised to R2.. The aggregate-address command with the summary-only keyword advertises only the aggregate 10.0.0.0/8 to BGP peers and suppresses all more-specific component routes (such as 10.1.0.0/16) from being advertised. This is the documented behavior of summary-only in Cisco IOS: it creates the aggregate and filters the contributing routes from outbound updates. Removing summary-only (or using suppress-map/as-set) would allow the more specifics to be advertised alongside the summary.

Answer

The network 10.1.0.0/16 is not in the routing table of R1, so it cannot be advertised.

Answer

R2 must have a route-map to accept the more specific route.

Answer

The aggregate-address should be configured with the as-set keyword to include more specifics.

Question 4

What is the default transport protocol used by NetFlow exporters on Cisco IOS-XE?

Accepted Answer

UDP. NetFlow exporters on Cisco IOS-XE use UDP as the default transport protocol, typically sending flow records to a collector on UDP port 2055 (or 9995/9996 depending on configuration). UDP is chosen because flow export is high-volume and loss-tolerant — if a flow record is lost, the next one will arrive shortly, so the overhead of TCP's reliability mechanisms is unnecessary.

Answer

TCP

Answer

SCTP

Answer

ICMP

Question 5

Which THREE symptoms indicate that Control Plane Policing (CoPP) might be misconfigured or causing connectivity issues? (Choose THREE.)

Accepted Answer

OSPF or BGP neighbors are flapping, with log messages indicating adjacency timeouts.. CoPP is designed to protect the control plane by rate-limiting traffic. If CoPP is misconfigured with overly restrictive policies, it can drop OSPF or BGP hello packets, causing neighbor adjacencies to time out and flap. Log messages showing adjacency timeouts directly point to control plane packet loss, a classic symptom of CoPP misconfiguration.

Answer

CPU utilization is consistently low, and all control plane traffic is passing without drops.

Answer

Throughput on data interfaces increases significantly.

Question 6

Consider this configuration on Router R5:
```
interface Tunnel0
 ipv6 address 2001:DB8:7::1/64
 tunnel source 192.168.10.1
 tunnel destination 192.168.20.2
 tunnel mode ipv6ip
 tunnel ttl 64
```
What is the effect?

Accepted Answer

The tunnel will work, and the TTL field in the outer IPv4 header will be set to 64.. The configuration creates an IPv6-over-IPv4 manual tunnel (tunnel mode ipv6ip). The tunnel source is specified as an IP address, which is valid; the router uses that address as the source of the outer IPv4 header. The 'tunnel ttl 64' command explicitly sets the Time-to-Live field in the outer IPv4 header to 64, overriding the default value.

Answer

The tunnel will not work because the tunnel source is an IP address, not an interface.

Answer

The tunnel mode should be 'gre ip' for IPv6 over IPv4.

Answer

The tunnel will use the IPv6 TTL for the outer header.

Question 7

Which DHCPv4 message type does a client send to request a specific IP address previously offered?

Accepted Answer

DHCPREQUEST. The DHCPREQUEST message is used by the client to formally request the specific IP address that was previously offered by the DHCP server in a DHCPOFFER. This occurs during the DHCP lease selection phase, where the client broadcasts or unicasts a DHCPREQUEST to accept the offered IP address and bind the lease.

Answer

DHCPDISCOVER

Answer

DHCPOFFER

Answer

DHCPACK

Question 8

Which statement correctly describes the default behavior of EIGRP auto-summary on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, so subnets are advertised without summarization.. In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without summarizing them to their classful boundaries, preserving the original prefix lengths. This behavior changed from older IOS versions where auto-summary was enabled by default, which could cause routing issues in discontiguous networks.

Answer

Auto-summary is enabled by default, summarizing classful boundaries.

Answer

Auto-summary is enabled only for EIGRP named mode configurations.

Answer

Auto-summary is disabled by default, but only for IPv6 EIGRP.

Question 9

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show ip route summary

IP routing table name: Default-IP-Routing-Table (0x0)
IP routing table maximum-paths: 32
Route entry limits: 1000000 active, 2000000 total
Number of prefixes: 500
Prefixes with memory: 500
Number of paths: 600
Paths with memory: 600
Number of operations: 1200
Number of deleted entries: 0

What does this output indicate?

Accepted Answer

The routing table has 500 prefixes, indicating that routing protocols are functioning and CoPP is not blocking updates.. The output shows 500 prefixes and 600 paths in the routing table, which indicates that routing protocols are exchanging routes and the routing table is being populated normally. Since CoPP is designed to protect the control plane by rate-limiting or dropping excessive traffic, a healthy routing table with a typical number of prefixes suggests that CoPP is not blocking routing updates. Therefore, option B is correct.

Answer

The routing table is empty due to CoPP dropping routing updates.

Answer

The routing table has too many prefixes, causing CoPP to drop packets.

Answer

The routing table is not being updated due to a CoPP policy.

Question 10

A network engineer runs the following command to troubleshoot IPsec with route-maps:

R1# show crypto ipsec transform-set
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Transport, }

Transform set ESP-AES: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel, }

What does this output indicate?

Accepted Answer

There are two transform sets configured, one using transport mode and one using tunnel mode.. The output shows two IPsec transform sets: 'combined' and 'ESP-AES'. The 'combined' set uses transport mode, while 'ESP-AES' uses tunnel mode. This indicates that different transform sets are configured for different purposes.

Answer

The transform set 'combined' is not valid.

Answer

IPsec is not configured because no transform set is active.

Answer

The transform set 'ESP-AES' is used for route-map filtering.

Question 11

A network engineer is troubleshooting a BGP peering issue between two directly connected routers, R1 and R2. R1 is configured with 'neighbor 10.1.1.2 remote-as 65002' and 'neighbor 10.1.1.2 update-source Loopback0', while R2 uses 'neighbor 10.1.1.1 remote-as 65001' and 'neighbor 10.1.1.1 update-source Loopback0'. The loopback interfaces are not advertised into any IGP, and there is no static route for the loopback addresses. The BGP session remains in Idle state. What is the most likely cause?

Accepted Answer

The BGP session is stuck in Idle because the neighbor statements reference loopback interfaces that are not reachable.. BGP forms a TCP session between the addresses specified in the neighbor statements. Because update-source Loopback0 is configured, R1 sources its TCP packets from its loopback address and expects to reach R2's loopback (10.1.1.2) as the neighbor. Since the loopbacks are not advertised into any IGP and no static routes exist, neither router has a route to the other's loopback, so the TCP three-way handshake to port 179 never completes and the session stays in Idle.

Answer

The BGP session is stuck in Idle because the remote-as values are mismatched.

Answer

The BGP session is stuck in Idle because the update-source command is not allowed on directly connected interfaces.

Answer

The BGP session is stuck in Idle because the neighbor statements must use the directly connected interface IP addresses.

Question 12

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) is an eBGP peer of R2 (AS 65002). R1 is advertising the prefix 10.0.0.0/8 to R2. R2 has an iBGP session with R3 (AS 65002). R3's BGP table shows the prefix 10.0.0.0/8 with next-hop 10.1.1.1 (R1's interface). However, R3 does not install this route in its routing table. The output of 'show ip route 10.0.0.0' on R3 shows no route. The engineer checks the routing table on R3 and sees that the interface connected to 10.1.1.0/24 is down. What is the most likely cause?

Accepted Answer

The next-hop 10.1.1.1 is not reachable because the directly connected interface is down.. R3 does not install the route because the next-hop 10.1.1.1 is not reachable; the interface connected to 10.1.1.0/24 is down. BGP requires a valid next-hop to install a route in the routing table. Since the directly connected interface is down, the next-hop is unreachable, and the route is not installed.

Answer

The route is not installed because BGP synchronization is enabled.

Answer

The route is not installed because the prefix is being filtered by an inbound route-map on R3.

Answer

The route is not installed because the administrative distance of the route is too high.

Question 13

Drag and drop the steps to set up a PE-CE BGP session in an MPLS L3VPN into the correct order, from first to last.

Accepted Answer

Configure VRF with route distinguisher and route-target. The correct order starts with defining the VRF and its RD/RT on the PE, then assigning the VRF to the CE-facing interface. After that, the PE interface is configured with an IP address and BGP is enabled in the VRF address-family. Finally, the BGP neighbor is activated under the VRF address-family to establish the PE-CE session.

Question 14

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are established, but traffic between spokes is not using the direct tunnel. What is the most likely explanation?

Accepted Answer

The spoke routers have a default route via the hub, so they send traffic to the hub instead of initiating NHRP resolution for a direct tunnel.. In DMVPN Phase 2, spoke-to-spoke direct tunnels require the spoke to resolve the remote spoke's NBMA address via NHRP. If a spoke has a default route pointing to the hub, its routing table sends all non-local traffic to the hub instead of triggering NHRP resolution for the destination spoke, so traffic traverses hub-and-spoke paths even though direct tunnels could form. Removing the default route (or using specific routes plus NHRP shortcut) restores direct spoke-to-spoke forwarding.

Answer

The hub has 'no ip nhrp redirect' configured, which disables spoke-to-spoke tunnel setup.

Answer

The spokes have 'ip nhrp shortcut' enabled, which forces all traffic through the hub.

Answer

The tunnel mode is set to 'tunnel mode gre multipoint' on the spokes, which is incorrect.

Question 15

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Accepted Answer

Initiate IKE_SA_INIT exchange. IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.