300-410 Practice Test 45 — 15 Questions

Question 1

Which TWO statements about the 'show ip bgp vpnv4 vrf <vrf-name>' command output are correct? (Choose TWO.)

Accepted Answer

The output includes the Route Distinguisher (RD) for each prefix.. Option B is correct because the 'show ip bgp vpnv4 vrf ' output lists each VPNv4 prefix together with its Route Distinguisher (RD), which is prepended to the IPv4 prefix to make it unique within the BGP table. Option C is correct because the same output includes the MPLS label (the VPN label or inner label) associated with each route, which the PE router uses for label-based forwarding of VPN traffic. Option A is incorrect because the command shows all VPNv4 routes in the VRF's BGP table, including routes learned from other PEs via MP-BGP, not just locally originated ones. Option D is incorrect because 'show ip route vrf ' displays the VRF's IP routing table (RIB), not the BGP VPNv4 table with RDs and labels. Option E is incorrect because CEF forwarding information is shown by commands such as 'show ip cef vrf ', not by the BGP VPNv4 table command.

Answer

The output displays only routes that are locally originated by the PE router.

Answer

The output is equivalent to 'show ip route vrf <vrf-name>'.

Answer

The output provides the CEF forwarding information for each prefix.

Question 2

Which TWO statements about the 'ip domain-lookup' and DNS configuration on a Cisco IOS router are true? (Choose TWO.)

Accepted Answer

The 'ip name-server' command can specify up to six DNS servers.. Option B is correct because the 'ip name-server' command on Cisco IOS accepts up to six DNS server addresses, allowing the router to query multiple name servers for resolution. Option C is correct because 'ip domain-list' appends additional domain suffixes to the DNS search list, so unqualified hostnames are tried against each listed domain in order. Option A is wrong because 'ip domain-lookup' is enabled by default on Cisco IOS routers, not disabled. Option D is wrong because 'ip host' creates static host entries that are not overwritten by DNS servers. Option E is wrong because 'show hosts' displays both static and dynamically learned host entries, not only static ones.

Answer

The 'ip domain-lookup' command is disabled by default on Cisco IOS routers.

Answer

The 'ip host' command creates a dynamic DNS entry that can be overwritten by a DNS server.

Answer

The 'show hosts' command displays only statically configured host entries.

Question 3

In IPsec site-to-site VPN, what is the default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers?

Accepted Answer

86400 seconds (24 hours). The default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers is 86400 seconds (24 hours). This is defined in the Cisco IOS default configuration for the `crypto isakmp policy` and is the recommended value to balance security and performance by reducing the frequency of re-authentication and Diffie-Hellman key exchanges.

Answer

3600 seconds (1 hour)

Answer

28800 seconds (8 hours)

Answer

1800 seconds (30 minutes)

Question 4

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip access-lists 101
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (12 matches)
    20 deny tcp any any eq 443 (5 matches)
    30 permit ip any any (100 matches)

What does this output indicate?

Accepted Answer

The ACL is permitting TCP traffic from 192.168.1.0/24 to any destination on port 80, denying all TCP traffic to port 443, and permitting all other IP traffic.. The ACL explicitly permits TCP traffic from source 192.168.1.0/24 to any destination on port 80 (line 10), denies TCP traffic from any source to any destination on port 443 (line 20), and then permits all other IP traffic (line 30). The match counts confirm that traffic matching each line has been processed, and the implicit deny at the end is never reached because line 30 permits everything else.

Answer

The ACL is denying all traffic because line 20 is an explicit deny.

Answer

The ACL is applied inbound on an interface and is blocking all traffic to port 443.

Answer

The ACL has no effect because the match counts are too low.

Question 5

Which EEM action type is used to modify the configuration of the device?

Accepted Answer

action cli. The EEM action type 'action cli' is used to execute CLI commands on the device, which is how an EEM policy modifies the device configuration. When an event triggers the policy, the 'action cli' statements run the specified commands in configuration or exec mode, allowing the policy to change settings, apply ACLs, or shut down interfaces. This is the action type designed for configuration modification.

Answer

action syslog

Answer

action snmp-trap

Answer

action mail

Question 6

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check tunnel interface status with 'show ipv6 interface brief'. The troubleshooting process follows a logical progression: first verify the tunnel interface is up/up, then check the IPv6 routing table for the destination prefix, inspect the tunnel source and destination IPs for correctness, verify IPv4 reachability to the tunnel destination, and finally examine ACLs or firewall rules that might block GRE protocol 47 traffic.

Question 7

A network engineer is troubleshooting an OSPFv2 issue where a router R1 is not receiving a specific route for 10.0.0.0/8 from a neighbor R2. The adjacency is FULL, and 'show ip ospf database' on R1 shows the LSA for 10.0.0.0/8 as a type 5 LSA. However, the route is not in the routing table. 'show ip route 10.0.0.0' shows no route. What is the most likely cause?

Accepted Answer

The router R1 has a distribute-list applied to the OSPF process that filters the route 10.0.0.0/8.. A distribute-list applied to the OSPF process on R1 can filter the route even though the LSA is present in the OSPF database. The LSA is received and stored (so it appears in 'show ip ospf database'), but the distribute-list prevents it from being installed in the routing table, which matches the symptom of a type 5 LSA present but no route.

Answer

The route is a type 5 LSA, but the router is in a stub area.

Answer

The router has a higher administrative distance for OSPF routes, causing it to prefer another routing protocol.

Answer

The route has a metric of 16777214, which is considered infinite.

Question 8

A network engineer is troubleshooting a route filtering problem with prefix-lists. Router R6 is using a prefix-list to filter routes from a BGP neighbor. The prefix-list is configured to permit only 192.168.0.0/16 and 192.168.1.0/24, but routes with prefix 192.168.2.0/24 are also being accepted. The engineer checks the prefix-list configuration and sees only two permit statements. What is the most likely cause?

Accepted Answer

The prefix-list is not applied to the BGP neighbor; the neighbor is using a different filter or no filter.. If routes with prefix 192.168.2.0/24 are being accepted despite a prefix-list that only permits 192.168.0.0/16 and 192.168.1.0/24, the most likely cause is that the prefix-list is not actually applied to the BGP neighbor. Without an inbound filter, the neighbor accepts all routes, including 192.168.2.0/24.

Answer

The prefix-list has an implicit permit at the end for all routes.

Answer

The prefix-list is using 'ge 24' which permits any prefix with a mask >= 24, including 192.168.2.0/24.

Answer

The BGP neighbor is configured with 'soft-reconfiguration inbound' which overrides prefix-list filtering.

Question 9

A network engineer is troubleshooting a VRF-Lite setup where two routers are connected via a serial link. Each router has VRF_SALES configured. The engineer configures EIGRP in VRF_SALES. The 'show ip eigrp vrf VRF_SALES neighbors' shows no neighbors. The 'show ip eigrp vrf VRF_SALES interfaces' shows the serial interface is passive. What is the most likely cause?

Accepted Answer

The 'passive-interface default' command is configured under the EIGRP process for VRF_SALES.. If 'show ip eigrp vrf VRF_SALES interfaces' shows the serial interface as passive, EIGRP will not send or receive hello packets on it, so no neighbor adjacency can form. The 'passive-interface default' command under the EIGRP VRF process makes all interfaces passive by default, requiring explicit 'no passive-interface' for interfaces that should form adjacencies. This directly explains the passive state and missing neighbors.

Answer

The 'network' command for the serial interface's subnet is missing.

Answer

The 'autonomous-system' number is different on the two routers.

Answer

The 'metric weights' command is misconfigured.

Question 10

Consider the following configuration on R5:

!--- R5 configuration
ip prefix-list PL-2 seq 5 permit 10.0.0.0/8 ge 16 le 24
!
route-map RMAP permit 10
 match ip address prefix-list PL-2
 set community 100:100
!
router bgp 65200
 neighbor 192.168.1.2 route-map RMAP out
!

What is the effect of this configuration?

Accepted Answer

Only routes with prefix 10.0.0.0/8 and mask length between 16 and 24 are sent to neighbor with community 100:100.. The prefix-list PL-2 permits 10.0.0.0/8 with a mask length between 16 and 24 (ge 16 le 24). The route-map RMAP matches this prefix-list and sets community 100:100. Since the route-map is applied outbound to neighbor 192.168.1.2, only routes that match the prefix-list are permitted by the route-map (implicit deny at the end of the route-map), and those matching routes are sent with community 100:100. Therefore, only routes with prefix 10.0.0.0/8 and mask length between 16 and 24 are sent, and they are tagged with community 100:100.

Answer

All routes with prefix 10.0.0.0/8 are sent to neighbor; routes with mask length between 16 and 24 get community 100:100.

Answer

Routes that match the prefix-list are sent with community 100:100; all other routes are sent without any community.

Answer

The configuration is invalid because the prefix-list uses ge and le together; only one can be used.

Question 11

What is the maximum number of VRFs that can be configured on a Cisco IOS router?

Accepted Answer

Platform-dependent, typically limited by available memory.. The number of VRFs configurable on a Cisco IOS router is not a fixed protocol limit; it depends on the platform's hardware resources, primarily memory (and sometimes TCAM or specific platform ASIC limits). Cisco documents that the practical maximum varies by router model and IOS version, so the correct answer is that it is platform-dependent.

Answer

256

Answer

1024

Answer

Unlimited

Question 12

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers have MP-BGP peering and the VRF is configured with route-target import 100:100. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, but the show ip route vrf CUSTOMER command does not have this route. The show ip bgp vpnv4 all 10.2.2.0/24 command on PE1 shows the route is received but not best. What is the most likely cause?

Accepted Answer

The BGP next-hop (PE2 loopback) is not reachable in the global routing table.. The route is present in the BGP VPNv4 table but not installed in the VRF routing table because the BGP next-hop (PE2's loopback) is not reachable in the global routing table. For a VPNv4 route to be considered best and installed, the next-hop must be resolvable via the global routing table (typically via an IGP or static route). If the next-hop is unreachable, the route remains in the BGP table but is not selected as best.

Answer

The route-target import on PE1 is missing.

Answer

The VRF on PE1 has a different route-target export.

Answer

The MP-BGP session is using an incorrect address family.

Question 13

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel over IPsec. The GRE tunnel is up/up, but the routing protocol (EIGRP) running over the GRE tunnel is not forming an adjacency. The engineer checks the tunnel configuration and sees that the tunnel source and destination are correct. What is the most likely cause?

Accepted Answer

The crypto map access list does not match GRE protocol (47) traffic.. In a GRE over IPsec configuration, the crypto map's ACL must permit GRE (IP protocol 47) traffic between the tunnel endpoints. If the ACL only matches other traffic (e.g., TCP/UDP), the GRE packets are not encrypted and the IPsec tunnel does not carry them, so EIGRP hellos never reach the peer and the adjacency fails even though the GRE tunnel shows up/up.

Answer

The EIGRP hello timer is set too high.

Answer

The tunnel interface is not configured with an IP address.

Answer

The IPsec transform set does not include ESP encryption.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 advertised-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 2

Based on this output, what can be concluded about the route 10.2.2.0/24?

Accepted Answer

The route 10.2.2.0/24 is being advertised back to the neighbor from which it was learned, which is incorrect.. The output shows that the route 10.2.2.0/24 has a next hop of 10.1.12.2, which is the neighbor's IP, and the path shows 65002, indicating it was learned from that neighbor. The command 'show bgp neighbors 10.1.12.2 advertised-routes' displays routes advertised to that neighbor, so this route is being advertised back to the neighbor it was learned from, which is incorrect due to BGP loop prevention (unless allowas-in is configured).

Answer

The route 10.2.2.0/24 is locally originated.

Answer

The route 10.2.2.0/24 has a weight of 0.

Answer

The route 10.2.2.0/24 is not valid.

Question 15

What is the default IKE (ISAKMP) lifetime value in Cisco IOS for IPsec Site-to-Site VPN?

Accepted Answer

86400 seconds (24 hours). The default IKE (ISAKMP) lifetime in Cisco IOS for IPsec Site-to-Site VPN is 86400 seconds (24 hours). This value is defined in the ISAKMP policy and controls how long the IKE Phase 1 security association (SA) remains active before requiring re-authentication. A longer lifetime reduces the overhead of re-establishing the Phase 1 tunnel, balancing security with performance.

Answer

3600 seconds (1 hour)

Answer

28800 seconds (8 hours)

Answer

180 seconds (3 minutes)