300-410 Practice Test 48 — 15 Questions

Question 1

An engineer configures BGP between two iBGP peers in the same AS. The engineer sets 'next-hop-self' on the neighbor statement. However, the routes received from the iBGP peer still show the original next-hop as unreachable. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'next-hop-self' command was applied under the wrong address-family.. The 'next-hop-self' command in BGP modifies the next-hop attribute for routes advertised to the neighbor. However, if the route is received from an eBGP peer and then advertised to an iBGP peer, the next-hop is changed only for the iBGP peer if 'next-hop-self' is configured. But if the iBGP peer is also a route reflector client, the route reflector does not change the next-hop unless 'next-hop-self' is configured on the route reflector itself. The edge case here is that the engineer may have configured 'next-hop-self' on the wrong router or the command is applied to the wrong address-family.

Answer

The 'next-hop-self' command is not supported for iBGP peers.

Answer

The 'synchronization' command is enabled, causing the next-hop to be preserved.

Answer

The 'bgp bestpath as-path multipath-relax' command is interfering.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-MULTI

R1# show route-map PBR-MULTI
route-map PBR-MULTI, permit, sequence 10
  Match clauses:
    ip address (access-lists): 140
  Set clauses:
    ip next-hop 10.0.0.2 10.0.0.3
  Policy routing matches: 200 packets, 18000 bytes

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

R1# show ip route 10.0.0.3
% Network not in routing table

Based on this output, what is the most likely behavior for packets matching ACL 140?

Accepted Answer

Packets are forwarded to 10.0.0.2.. When multiple next-hops are specified in a set clause, PBR tries them in order. The first reachable next-hop is used. Here, 10.0.0.2 is reachable, so packets are forwarded to 10.0.0.2. The second next-hop is not reachable, but that does not affect the first.

Answer

Packets are load-balanced between 10.0.0.2 and 10.0.0.3.

Answer

Packets are dropped because one next-hop is unreachable.

Answer

Packets are forwarded to 10.0.0.3 via a recursive lookup.

Question 3

Which OSPF network type defaults to a 30-second hello interval and requires a DR/BDR election?

Accepted Answer

Non-broadcast (NBMA). Non-broadcast (NBMA) network type uses a 30-second hello interval and elects a DR/BDR, as per RFC 2328.

Answer

Broadcast

Answer

Point-to-point

Answer

Point-to-multipoint

Question 4

Which TWO commands can be used to verify IPv6 unicast RPF operation on an interface? (Choose TWO.)

Accepted Answer

show ipv6 interface. The 'show ipv6 interface' command displays IPv6 unicast RPF (uRPF) configuration and operational status per interface, including whether strict or loose mode is enabled and any drop counts. The 'show ipv6 cef detail' command verifies the Forwarding Information Base (FIB) entries used by uRPF to perform the reverse path lookup, confirming that the source address of incoming packets matches a valid return route in the CEF table.

Answer

show ipv6 access-list

Answer

show ipv6 route

Answer

show ipv6 traffic

Question 5

A network engineer runs the following command to verify OSPF interface details:

R1# show ip ospf interface gigabitethernet0/0 detail
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State BDR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 10.1.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 10.1.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Can be protected by per-prefix Loop-Free Fast Reroute
  Can be used for per-prefix Loop-Free Fast Reroute repair paths
  Index 1/1, flood queue length 0
  Next 0(0)/0(0)
  Last flood scan length is 1, maximum is 25
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Designated Router)
  Suppress hello for 0 neighbor(s)

What does this output indicate?

Accepted Answer

The router has a full adjacency with the DR (2.2.2.2).. The output shows detailed OSPF interface parameters, including state, timers, and neighbor information.

Answer

The router is the DR on this segment.

Answer

The interface is in a passive state with no neighbors.

Answer

The Hello timer is set to 40 seconds.

Question 6

A large enterprise network uses OSPFv3 for IPv6 routing. Router R1 and R2 are connected via a multi-access Ethernet link. R1 is configured with 'ipv6 ospf network point-to-point' while R2 uses the default broadcast network type. R1 has an IPv6 ACL applied inbound on its interface that permits only OSPF (89) and denies all other traffic. R2 is unable to form a full OSPF adjacency with R1. R2 shows 'OSPFv3 adjacency state is EXSTART/EXCHANGE' and logs 'Bad LSReq'. What is the root cause?

Accepted Answer

R1's ACL blocks OSPFv3 multicast hello packets (FF02::5), preventing adjacency formation on the broadcast link.. R1's inbound IPv6 ACL permits only OSPF (protocol 89) but denies all other traffic. When R1's interface is configured as 'ipv6 ospf network point-to-point', it expects to send unicast OSPFv3 packets to the neighbor, not multicast. However, R2, using the default broadcast network type, sends OSPFv3 hellos to the multicast address FF02::5 (AllSPFRouters). R1's ACL blocks these multicast hellos because they are not protocol 89 unicast packets, preventing adjacency formation. The 'Bad LSReq' error in EXSTART/EXCHANGE indicates that R1 never received R2's hellos, so it cannot build a proper link-state database.

Answer

R2's OSPFv3 process is configured with a different router-id, causing a DR election conflict.

Answer

The MTU mismatch between R1 and R2 causes OSPFv3 packet fragmentation, leading to LSReq errors.

Answer

R2 has a passive interface configured, preventing it from sending OSPFv3 hellos.

Question 7

Which THREE commands can be used to verify the current NTP synchronization status and configuration on a Cisco IOS router? (Choose THREE.)

Accepted Answer

show ntp status. The 'show ntp status' command displays the NTP synchronization status, including whether the router is synchronized to an NTP server, the stratum level, and the reference clock ID. This directly verifies the current synchronization state of the NTP process on the Cisco IOS router.

Answer

show ntp packets

Answer

show clock detail

Question 8

Which TWO statements correctly describe the behavior of TTL propagation in MPLS networks? (Choose TWO.)

Accepted Answer

Disabling TTL propagation prevents traceroute from revealing the internal LSR hops.. In MPLS, TTL propagation can be disabled for security or to hide the core topology. When disabled, the IP TTL is copied to the MPLS label only at the ingress LSR, and at the egress LSR the MPLS TTL is copied back to the IP header. By default, TTL propagation is enabled. The command 'no mpls ip propagate-ttl' disables it. Option A is correct because disabling TTL propagation hides the core hops from traceroute. Option B is correct because the command to disable is indeed 'no mpls ip propagate-ttl'. Option C is false: the command is not 'no mpls ip ttl-propagate'. Option D is false: traceroute shows only the ingress and egress LSRs, not all hops. Option E is false: when disabled, the TTL is not decremented across the MPLS core.

Answer

The command 'no mpls ip ttl-propagate' is used to disable TTL propagation.

Answer

When TTL propagation is disabled, traceroute shows every LSR hop in the MPLS core.

Answer

When TTL propagation is disabled, the TTL value is decremented normally at each LSR hop.

Question 9

Which SNMPv3 message type is used by an SNMP agent to send unsolicited notifications to a manager?

Accepted Answer

Trap or Inform. SNMPv3 agents use Trap or Inform messages to send unsolicited notifications to a manager without waiting for a polling request. Traps are unreliable (UDP, no acknowledgment), while Informs are reliable (require acknowledgment). This matches the definition of unsolicited notification in RFC 3416.

Answer

GetRequest

Answer

Response

Answer

GetBulkRequest

Question 10

Drag and drop the steps to troubleshoot Administrative Distance adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify physical connectivity and interface status. First, verify the physical connectivity and layer 1/2 status, then check the routing protocol neighbor adjacency, next examine the AD values of the routes learned from the neighbor, then review any route filtering or redistribution policies, and finally test end-to-end connectivity to confirm the fix.

Question 11

Router R5 is configured with SNMPv3 for secure management. The configuration includes: snmp-server group mygroup v3 priv, snmp-server user myuser mygroup v3 auth sha myauth priv aes 128 mypriv. The NMS is configured with the same credentials. However, the NMS cannot poll R5. The debug snmp packet shows: 'Authentication failure'. The NMS and R5 have correct time synchronization via NTP. What is the root cause?

Accepted Answer

The NMS is configured to use MD5 authentication, but the router is configured with SHA.. The debug output shows 'Authentication failure', which indicates that the SNMPv3 authentication credentials do not match between the NMS and the router. The router is configured with 'auth sha' for the user 'myuser', but the NMS is using MD5 authentication. Since SNMPv3 requires an exact match of the authentication protocol (SHA vs. MD5) and the associated passphrase, this mismatch causes the authentication failure.

Answer

The SNMP engine ID on the router has changed due to a hardware replacement, causing the NMS to have a stale engine ID.

Answer

The NMS is using SNMPv2c community string instead of SNMPv3.

Answer

The router's clock is not synchronized with NTP, causing authentication key mismatch.

Question 12

A network engineer runs the following command to debug IPv6 traffic filtering:

R1# debug ipv6 packet access-list FILTER detail
IPv6 packet debugging is on for access list FILTER (detail)

*Mar 1 00:01:23.456: IPv6: source 2001:DB8:2::1 (GigabitEthernet0/0)
*Mar 1 00:01:23.456:   dest 2001:DB8:3::1 (GigabitEthernet0/1)
*Mar 1 00:01:23.456:   traffic class 0, flowlabel 0, hlim 64, next header 6 (TCP)
*Mar 1 00:01:23.456:   denied by access-list FILTER

What does this output indicate?

Accepted Answer

The packet is denied because the source address 2001:DB8:2::1 matches the deny entry in the access list.. The debug output explicitly states 'denied by access-list FILTER', confirming that the packet was dropped due to a match against a deny entry in the named IPv6 access list. The source address 2001:DB8:2::1 is shown as the matching source, and since the debug includes 'detail', it provides the exact reason for denial. Access lists process entries sequentially, and the first match (permit or deny) determines the action; here, the source matched a deny statement.

Answer

The packet is permitted because it is a TCP packet.

Answer

The packet is denied because of uRPF check failure.

Answer

The packet is permitted because the destination is not in the access list.

Question 13

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After the configuration, a routing loop occurs for a specific prefix. The engineer checks and confirms that route tagging is not used. What is the most likely explanation?

Accepted Answer

The redistribution is not filtered, so the same prefix is redistributed back and forth, causing a loop.. Without route tagging, mutual redistribution can cause a routing loop when the same prefix is redistributed back and forth. The edge case is that OSPF and EIGRP have different administrative distances (AD). OSPF external routes have AD 110, and EIGRP external routes have AD 170. If the prefix is learned via both protocols, the router prefers the lower AD (OSPF external). However, if the router redistributes the EIGRP route into OSPF, and then receives it back via OSPF, it may prefer the OSPF route and cause a loop. The loop is exacerbated if the redistribution is not filtered.

Answer

The 'default-metric' command is missing in both protocols, causing the seed metric to be inconsistent.

Answer

The 'subnets' keyword is missing in the OSPF redistribution command.

Answer

The 'distance' command is used to change AD, causing OSPF and EIGRP to have the same AD.

Question 14

Given the following partial configuration:

ip cef
!
interface Loopback0
 ip address 10.0.0.1 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.252
 mpls ip
!
router ospf 1
 network 10.0.0.1 0.0.0.0 area 0
 network 10.1.1.0 0.0.0.3 area 0
!
mpls ldp router-id Loopback0 force

What is missing from this configuration to ensure proper MPLS LDP operation?

Accepted Answer

Nothing is missing; the configuration is complete for basic MPLS LDP operation.. The configuration appears correct: CEF enabled, MPLS enabled on the interface, OSPF advertising all networks, and LDP router-id set to a loopback. There is no missing element for basic LDP operation. However, some might think 'mpls label protocol ldp' is needed, but it is default. The question tests if the candidate can identify that nothing is missing.

Answer

The 'mpls label protocol ldp' command is missing globally or on the interface.

Answer

The 'mpls ldp neighbor' command is needed to specify the neighbor's IP address.

Answer

The 'mpls ip' command must also be applied under the OSPF process.

Question 15

A network engineer runs the following command to verify IPv6 First Hop Security operation:

R1# show ipv6 nd raguard policy TRUSTED

Policy: TRUSTED
  Status: Active
  Device role: host
  Trusted ports: Fa0/1
  Untrusted ports: none
  RA Guard: enabled
  RA Guard policy: allow
  ND inspection: enabled
  ND inspection policy: INSPECT

What does this output indicate?

Accepted Answer

The policy TRUSTED allows RAs on Fa0/1 and performs ND inspection using policy INSPECT.. The output shows that policy TRUSTED is active, with Fa0/1 listed as a trusted port. Since RA Guard is enabled with an 'allow' policy, Router Advertisements (RAs) received on Fa0/1 are permitted. Additionally, ND inspection is enabled using policy INSPECT, meaning Neighbor Discovery messages are inspected on that port. This matches option A.

Answer

The policy TRUSTED blocks all RAs on Fa0/1 and disables ND inspection.

Answer

The policy TRUSTED only applies to untrusted ports and has no effect on Fa0/1.

Answer

The policy TRUSTED is inactive and not applied to any interface.