300-410 Practice Test 49 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history applet TRACK-INTERFACE

Applet TRACK-INTERFACE:
  Time Created : Mar 1 00:00:12 2025
  Time Last Triggered : Mar 1 00:15:30 2025
  Time Last Executed : Mar 1 00:15:30 2025
  Trigger Count : 5
  Execution Count : 5
  Last Event Type : syslog
  Last Event Detail : OSPF-5-ADJCHG
  Last Action Executed : show ip route
  Last Action Result : Success

What does this output indicate?

Accepted Answer

The applet 'TRACK-INTERFACE' has been triggered 5 times and executed successfully each time, with the last trigger at 00:15:30.. The output shows the history for a specific EEM applet. It includes creation time, last trigger and execution times, trigger and execution counts, the last event that triggered it, the last action executed, and the result. This helps in determining if the applet is being triggered and executing successfully.

Answer

The applet 'TRACK-INTERFACE' has failed to execute 5 times.

Answer

The applet 'TRACK-INTERFACE' has not been triggered since it was created.

Answer

The applet 'TRACK-INTERFACE' executed the action 'show ip route' but the output was not captured.

Question 2

A network engineer is troubleshooting a route redistribution issue between EIGRP and BGP. Router R1 runs both EIGRP and BGP, and redistributes EIGRP routes into BGP. The engineer notices that some EIGRP routes are not appearing in the BGP table on R1. The show ip bgp command does not list these prefixes. The redistribute eigrp command is configured under BGP. What is the most likely cause?

Accepted Answer

The EIGRP routes are not present in the IP routing table on R1.. When redistributing into BGP, by default only classful networks are redistributed unless the subnets keyword is used. Additionally, BGP does not redistribute routes that are not in the routing table. However, a common cause is that the EIGRP routes are not in the global routing table due to administrative distance or other reasons.

Answer

The redistribute eigrp command under BGP is missing the subnets keyword.

Answer

BGP has a higher administrative distance than EIGRP.

Answer

The EIGRP process on R1 has a route filter blocking these routes.

Question 3

An engineer enables uRPF (strict mode) on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The customer network uses asymmetric routing where return traffic takes a different path. Which is the most likely explanation?

Accepted Answer

The uRPF strict mode requires that the source IP's best path is out the same interface; asymmetric routing violates this.. Strict uRPF checks that the source IP of incoming packets has a route in the FIB pointing back to the same interface. With asymmetric routing, the return path may use a different interface, causing the check to fail and the packet to be dropped.

Answer

The uRPF loose mode should be used instead, as it only requires a route to the source IP in the FIB.

Answer

The customer network is using private IP addresses that are not routable.

Answer

The uRPF allow-default option is missing, which is required for default routes.

Question 4

Which THREE symptoms indicate a problem with SNMP trap delivery from a Cisco router? (Choose THREE.)

Accepted Answer

The NMS does not receive traps, but other SNMP operations (gets) work.. SNMP traps are sent as unsolicited UDP packets from the router to the NMS, while SNMP get operations use a separate request-response mechanism. If gets succeed but traps fail, the issue is typically with trap configuration (e.g., wrong target IP, community string mismatch, or UDP port 162 blocked) rather than general SNMP or network connectivity.

Answer

The router CPU utilization is consistently above 90%.

Answer

The NMS can ping the router successfully.

Question 5

An engineer configures an EIGRP named mode with an offset-list applied to the delay metric on a serial interface. The offset-list increases the delay by 1000 microseconds. However, the feasible distance (FD) updates correctly, but the advertised distance (AD) does not change. What is the most likely explanation?

Accepted Answer

The offset-list only modifies the FD on the local router, not the AD received from the neighbor.. The offset-list in EIGRP modifies the composite metric (feasible distance) on the local router by adding delay to the interface where it is applied. However, the advertised distance (AD) is the metric that the neighbor reports for a route; it is received in EIGRP update packets and is not altered by the local router's offset-list. Therefore, only the FD changes, while the AD remains unchanged because it is a value learned from the neighbor.

Answer

The offset-list is applied to the wrong interface; it should be applied to the neighbor's interface.

Answer

The named mode EIGRP does not support offset-lists; only classic mode does.

Answer

The offset-list is configured with the wrong direction; it should be inbound.

Question 6

What is the default SNMP trap queue length on Cisco IOS?

Accepted Answer

10. The default SNMP trap queue length on Cisco IOS is 10. This value defines the maximum number of SNMP traps that can be queued in the trap buffer before they are sent to the configured SNMP trap receivers. If the queue is full and a new trap is generated, the oldest trap is dropped to make room for the new one.

Answer

100

Answer

Unlimited

Answer

5

Question 7

A network engineer runs the following command to troubleshoot Control Plane Policing (CoPP):

R1# show policy-map control-plane input class class-default
  Class-map: class-default (match-any)
    140091 packets, 12345678 bytes
    5 minute offered rate 1000 bps, drop rate 0 bps
    Match: any
    police:
        cir 8000 bps, bc 1500 bytes
        conformed 140091 packets, 12345678 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

CoPP is rate-limiting traffic to 8000 bps and not dropping any packets.. The output shows that the class-default policy-map for control-plane input has a police statement with a CIR of 8000 bps. The counters indicate 140,091 packets conformed and transmitted, with zero packets exceeded or violated. Since the drop rate is 0 bps and no packets have been dropped, CoPP is rate-limiting traffic to 8000 bps without any drops occurring.

Answer

CoPP is dropping all traffic to the control plane.

Answer

CoPP is not configured; the class-default shows no action.

Answer

CoPP is dropping packets due to exceeding the rate.

Question 8

What is the default value of the 'limit' parameter in the 'ipv6 nd prefix' command for the number of prefixes advertised in RA messages?

Accepted Answer

16. The default value of the 'limit' parameter in the 'ipv6 nd prefix' command is 16, as defined by Cisco IOS. This parameter controls the maximum number of IPv6 prefixes that can be advertised in Router Advertisement (RA) messages. When the number of prefixes exceeds this limit, the router will not include additional prefixes in the RA, ensuring the message stays within reasonable size constraints.

Answer

8

Answer

32

Answer

64

Question 9

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history events

Event History:
  Event Type    : syslog
  Time          : Mar 1 00:05:23
  Pattern       : OSPF-5-ADJCHG
  Trigger count : 1

Event Type    : timer
  Time          : Mar 1 00:06:00
  Timer Type    : absolute
  Timer Name    : MY-TIMER
  Trigger count : 1

What does this output indicate?

Accepted Answer

Two events have triggered EEM applets: a syslog event matching 'OSPF-5-ADJCHG' and an absolute timer named 'MY-TIMER'.. The output shows the event history for EEM. It lists events that have triggered EEM applets. Each entry shows the event type (syslog, timer, etc.), the time it occurred, specific details (pattern for syslog, timer type and name for timer), and the number of times that event triggered an applet. This helps in troubleshooting which events are being matched.

Answer

Two EEM applets are currently registered: one for syslog and one for timer.

Answer

The OSPF-5-ADJCHG syslog event triggered an applet that executed a timer.

Answer

The timer event is a countdown timer that triggered after 5 minutes and 23 seconds.

Question 10

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip nhrp detail
10.0.0.0/16 via 10.1.1.2, Tunnel0 created 00:01:00, expire 01:59:00
  Type: summary, Flags: used
  NBMA address: 192.168.1.2
  Registration: never

What does this output indicate?

Accepted Answer

The summary route 10.0.0.0/16 is learned via NHRP and is active, with the next hop being 192.168.1.2 over Tunnel0.. This output shows an NHRP cache entry for the summary route 10.0.0.0/16. The type is 'summary', indicating that this is a summary route learned via NHRP. The 'used' flag and NBMA address show that the route is active and pointing to a specific tunnel destination.

Answer

The summary route is not being used because the 'used' flag is not set.

Answer

The summary route is learned via EIGRP, not NHRP.

Answer

The summary route is a static route configured on the router.

Question 11

A network engineer is troubleshooting an EIGRP issue where a router is not installing a route in the routing table, even though the route is present in the EIGRP topology table. The route is a feasible successor, but it is not being used. What is the most likely reason for this?

Accepted Answer

The feasible successor has a higher metric than the current successor.. In EIGRP, a feasible successor is a backup route that meets the feasibility condition (reported distance < feasible distance). However, the router will only install the route with the best metric (the successor) into the routing table. If the feasible successor has a higher metric than the current successor, it will remain in the topology table as a backup but will not be used unless the successor fails. This matches option A.

Answer

The route is a summary route that is being suppressed.

Answer

The route is being filtered by a distribute-list in.

Answer

The EIGRP variance command is set to 1, preventing unequal-cost load balancing.

Question 12

Which of the following is true regarding the default behavior of NAT in Cisco IOS when handling ICMP traffic?

Accepted Answer

ICMP NAT entries timeout after 60 seconds by default.. C is correct because Cisco IOS NAT uses a default timeout of 60 seconds for ICMP NAT entries. When an ICMP packet is translated, the router creates a NAT translation entry, and if no subsequent traffic matches that entry within 60 seconds, the entry is removed. This behavior is independent of TCP or UDP timeouts and is specific to ICMP.

Answer

ICMP traffic is not translated by NAT unless explicitly configured.

Answer

ICMP NAT entries use the same timeout as TCP entries by default.

Answer

ICMP NAT entries are permanent and do not time out.

Question 13

Which SNMPv2c PDU type is used by the manager to request a large amount of data efficiently, such as an entire routing table?

Accepted Answer

GetBulkRequest. C is correct because SNMPv2c introduced the GetBulkRequest PDU specifically to allow a manager to retrieve large amounts of data, such as an entire routing table, in a single request. Unlike GetNextRequest, which requires repeated requests to walk through a MIB subtree, GetBulkRequest uses a non-repeaters and max-repetitions mechanism to fetch multiple variable bindings in one operation, significantly reducing network overhead and latency.

Answer

GetRequest

Answer

GetNextRequest

Answer

SetRequest

Question 14

Which TWO commands are used to troubleshoot Control Plane Policing (CoPP) and identify which traffic is being dropped? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays the applied policy map on the control plane, including class maps, match criteria, and per-class statistics such as the number of packets matched and dropped. This allows you to verify which traffic is being classified and confirm that CoPP is dropping the intended packets. It is the primary verification command for CoPP.

Answer

debug policy-map control-plane

Answer

show ip cache flow

Answer

show access-lists

Question 15

A network engineer is troubleshooting a site-to-site VPN that intermittently drops. The engineer configured IP SLA 10 to track reachability of the remote LAN gateway (10.1.2.1) using ICMP echo probes every 5 seconds. The IP SLA is used in a static route to influence failover. The engineer notices that the IP SLA state shows 'Active' but the tracked route is not installed. What is the most likely cause?

Accepted Answer

The track object is configured with 'ip sla 10 reachability' but the static route references the track object incorrectly.. The IP SLA is active, but the tracked object might not be configured correctly to react to the IP SLA state. The issue is that the track object is not linked to the IP SLA or the threshold is misconfigured.

Answer

The IP SLA probe is sending packets to the wrong destination IP.

Answer

The IP SLA probe frequency is too high, causing the router to ignore the results.

Answer

The remote gateway is not responding to ICMP echo requests due to firewall rules.