300-410 Practice Test 49 — 15 Questions

Question 1

What is the default behavior of EEM when multiple policies are registered for the same event?

Accepted Answer

Policies run in order of priority (lower number = higher priority), then alphabetically by name.. When multiple EEM policies are registered for the same event, they run in order of priority (lower number = higher priority), and if priorities are equal, alphabetically by policy name. This deterministic ordering ensures predictable execution.

Answer

All policies run simultaneously in parallel.

Answer

Only the first registered policy runs.

Answer

Policies run in reverse order of registration.

Question 2

An engineer is troubleshooting a BGP peering issue between two routers, R1 and R2, connected via a serial link. The BGP session is established, but routes are not being exchanged. The engineer checks the BGP configuration and sees that both routers have the 'neighbor' commands correctly configured. The output of 'show ip bgp summary' shows the session is in the Established state, but the prefix counts are zero. What is the most likely cause?

Accepted Answer

Neither router has any network statements or redistribution commands configured to inject prefixes into BGP.. A BGP session can reach the Established state purely through neighbor configuration and TCP/179 connectivity, but no prefixes will be exchanged unless routes are injected into BGP via network statements, redistribution, or aggregation. Zero prefix counts in 'show ip bgp summary' with an Established session is the classic signature of a missing route injection configuration. The session itself is healthy; the routing table is simply empty of BGP-advertised routes.

Answer

The BGP session is using MD5 authentication, but the passwords do not match.

Answer

The routers have mismatched BGP versions.

Answer

The update-source command is missing, causing the session to use the wrong interface.

Question 3

Which BGP message type is sent when a fatal error is detected, causing the BGP session to close?

Accepted Answer

NOTIFICATION. The BGP NOTIFICATION message is sent when a fatal error is detected, such as a hold timer expiration, a malformed attribute, or a configuration mismatch. Upon sending or receiving a NOTIFICATION, the BGP session is immediately closed. This is defined in RFC 4271.

Answer

OPEN

Answer

UPDATE

Answer

KEEPALIVE

Question 4

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 192.0.2.10:80      10.0.0.10:80       203.0.113.5:12345 203.0.113.5:12345
tcp 192.0.2.10:80      10.0.0.11:80       203.0.113.5:67890 203.0.113.5:67890

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 2 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 50  Misses: 0
CEF Translated packets: 50, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat inside source list ACL1 interface GigabitEthernet0/1 overload
   refcount 2

Based on this output, what is the problem?

Accepted Answer

PAT is not assigning unique source ports; both translations use port 80, which will cause conflicts.. The output shows two dynamic NAT translations mapping different inside local hosts (10.0.0.10 and 10.0.0.11) to the same inside global IP address (192.0.2.10) and the same source port (80). PAT (Port Address Translation) should assign unique source ports to differentiate the sessions, but here both translations use port 80, which will cause conflicts when return traffic arrives because the router cannot determine which inside host should receive the packet. This indicates a misconfiguration or a bug where PAT is not performing port overload correctly.

Answer

The NAT pool is misconfigured because it uses the interface address.

Answer

The inside and outside interfaces are swapped.

Answer

Static NAT is interfering with dynamic NAT.

Question 5

What is the default OSPF reference bandwidth used in the metric calculation on Cisco IOS-XE?

Accepted Answer

100 Mbps. Cisco IOS-XE uses a default OSPF reference bandwidth of 100 Mbps (10^8), which is the historical default inherited from early OSPF implementations. The OSPF cost is calculated as reference bandwidth divided by interface bandwidth, so a 100 Mbps interface has a cost of 1, and faster interfaces (1 Gbps, 10 Gbps) all default to cost 1 unless the reference bandwidth is changed. This is why modern networks often raise the reference bandwidth to 1000 or 10000 Mbps.

Answer

1000 Mbps

Answer

10 Mbps

Answer

10000 Mbps

Question 6

An engineer configures OSPFv2 on two routers with a direct Ethernet link. The routers are stuck in the EXSTART state. Which is the most likely explanation?

Accepted Answer

The interface MTU on one router is 1500, and on the other is 1400.. The most likely explanation for OSPFv2 being stuck in EXSTART on a direct Ethernet link is an MTU mismatch between the interfaces. During EXSTART, routers exchange DBD packets that include the MTU; if the MTU values differ, the routers will not proceed to EXCHANGE. A mismatch of 1500 vs. 1400 is a classic cause.

Answer

The OSPF hello and dead intervals are mismatched.

Answer

One router has OSPF authentication configured, and the other does not.

Answer

The OSPF network type is point-to-point on one router and broadcast on the other.

Question 7

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Accepted Answer

The EEM applet is clearing the BGP session as part of its configured action.. The logs show an EEM applet is triggered just before each BGP failure, and the applet is explicitly configured to clear the BGP session when a specific syslog message appears. This is a direct cause-and-effect: the applet's action (clearing BGP) is what is tearing down the session, not an underlying network fault.

Answer

The BGP session is failing due to a physical layer issue.

Answer

The BGP session is failing due to a routing loop.

Answer

The EEM applet is causing a memory leak that crashes the BGP process.

Question 8

Which THREE commands can be used to verify the operational state and configuration of an IPv6 tunnel? (Choose THREE.)

Accepted Answer

show interfaces tunnel 0. Option A, 'show interfaces tunnel 0', is correct because it displays the operational state (up/down) of the tunnel interface along with encapsulation, line protocol status, and packet counters, which directly verifies the tunnel's operational state. Option B, 'show ipv6 interface tunnel 0', is correct because it shows the IPv6-specific configuration and status of the tunnel interface, including the IPv6 address, link-local address, and whether IPv6 is enabled on that interface. Option C, 'show running-config interface tunnel 0', is correct because it displays the configured tunnel parameters such as tunnel source, tunnel destination, tunnel mode (e.g., ipv6ip), and other interface settings, verifying the tunnel's configuration. Option D, 'show ip route', is not correct because it only displays the IPv4 routing table and does not provide tunnel-specific operational or configuration details. Option E, 'show ipv6 route', is not correct because it only shows the IPv6 routing table and does not verify the tunnel interface's state or configuration.

Answer

show ip route

Answer

show ipv6 route

Question 9

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.1.1.0/24
BGP routing table entry for 10.1.1.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.1 from 0.0.0.0 (10.1.1.1)
      Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, which statement is correct?

Accepted Answer

The route 10.1.1.0/24 is locally originated and is the best path.. The output shows the route 10.1.1.0/24 with 'Local' origin, 'sourced' and 'best' flags, and weight 32768. This indicates the route is locally originated (e.g., via a network statement or redistribution) and is the best path. The 'Local' in the path indicates it was locally generated, not learned from a peer.

Answer

The route 10.1.1.0/24 was learned from an eBGP peer.

Answer

The route 10.1.1.0/24 has a weight of 100.

Answer

The route 10.1.1.0/24 is not being advertised to any peer.

Question 10

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?

Accepted Answer

The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.. The root cause is that the EEM applet BGP-MONITOR is triggered by the syslog pattern '%BGP-3-NOTIFICATION', and its action clears all BGP sessions with 'clear ip bgp *'. This creates a feedback loop: a BGP notification triggers the applet, which clears all BGP sessions, causing new BGP notifications, which trigger the applet again, leading to intermittent session resets. The output showing R2's BGP neighbor up for only 5 seconds confirms frequent resets.

Answer

The BGP keepalive timer is set too low on R1.

Answer

The syslog pattern is incorrect and matches unrelated messages.

Answer

There is an MTU mismatch between R1 and R2.

Question 11

An engineer configures OSPFv3 with multiple areas. On the ABR, routes from area 1 are not being advertised into area 0. Which is the most likely explanation?

Accepted Answer

The ABR does not have a direct interface in area 0.. For a router to function as an OSPFv3 Area Border Router (ABR), it must have at least one interface in the backbone area (area 0). Without a direct interface in area 0, the router cannot generate Type 3 summary LSAs for area 1 into area 0, so routes from area 1 will not be advertised into the backbone. This is a fundamental OSPF topology requirement, not a configuration option.

Answer

The ABR has a higher router ID than the other routers.

Answer

The OSPFv3 process is configured with the 'no-redistribution' command.

Answer

The ABR is configured as a stub router.

Question 12

Which statement correctly describes the default authentication behavior for EEM policy files stored in flash?

Accepted Answer

EEM does not perform any authentication or integrity check on policy files by default.. By default, EEM does not authenticate or verify the integrity of policy files stored in flash — it simply loads and executes them. This means an attacker with write access to flash could modify a policy file and have it executed without any signature or hash check, which is why Cisco recommends securing device access and optionally using signed policies. The default behavior is no authentication or integrity check.

Answer

EEM requires all policy files to be signed with a digital certificate.

Answer

EEM uses MD5 hash verification by default.

Answer

EEM uses the device's AAA configuration to authenticate policy execution.

Question 13

Which default IPsec transform set is automatically created in Cisco IOS when configuring a site-to-site VPN?

Accepted Answer

No default transform set is created. Cisco IOS does not automatically create any default IPsec transform set when configuring a site-to-site VPN. Transform sets must be explicitly defined using the `crypto ipsec transform-set` command, which specifies the encryption and authentication algorithms. The absence of a default ensures that administrators intentionally select the appropriate security parameters for their environment.

Answer

esp-aes 256 esp-sha-hmac

Answer

esp-3des esp-sha-hmac

Answer

esp-aes 128 esp-md5-hmac

Question 14

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

Based on this output, what is the most likely problem?

Accepted Answer

The flow monitor is not applied to any interface.. The output shows 'Current entries: 0', 'Flows added: 0', and all aging counters at 0, which means the flow monitor cache is not receiving any flow data. The most likely cause is that the flow monitor (or its associated flow exporter/record) has not been applied to any interface, so no traffic is being monitored. If the monitor were applied, even with no matching traffic, you would typically see some cache activity or at least the monitor would be active; zero flows added across all counters strongly indicates the monitor is not attached to an interface.

Answer

The cache size is too small at 1000 entries.

Answer

The active timeout is too long at 1800 seconds.

Answer

The cache type is Normal, which requires a sampler.

Question 15

What is the default administrative distance for OSPF routes in a VRF-Lite environment on Cisco IOS-XE?

Accepted Answer

110. OSPF's default administrative distance on Cisco IOS-XE is 110, and this value is unchanged in a VRF-Lite environment. VRF-Lite simply creates separate routing tables per VRF on the same physical router; it does not alter the administrative distance of the routing protocols running inside each VRF. Therefore, OSPF routes in a VRF still have an AD of 110.

Answer

90

Answer

120

Answer

170