300-410 Practice Test 5 — 10 Questions

Question 1

Router R1 has the following configuration:
```
interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT
!
route-map PBR-OUT permit 10
 match ip address 100
 set ip next-hop 192.168.1.1
!
access-list 100 permit ip host 10.1.1.100 any
```
What is the effect of this configuration?

Accepted Answer

Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.. The route-map is applied as an inbound policy on the interface, but the name 'PBR-OUT' suggests outbound, which is misleading. However, the 'ip policy route-map' command applies to incoming packets on that interface. The ACL matches source 10.1.1.100 to any destination, and sets next-hop 192.168.1.1.

Answer

Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.

Answer

All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.

Answer

The configuration is invalid because the ACL must match destination, not source.

Question 2

What is the default behavior of PBR when a 'set ip next-hop' and a 'set ip default next-hop' are both configured in the same route-map entry?

Accepted Answer

The 'set ip next-hop' is used if reachable; otherwise, the 'set ip default next-hop' is used if the routing table has no explicit route.. The 'set ip next-hop' is evaluated first. If it is reachable, it is used. If not, then the 'set ip default next-hop' is used, but only if there is no explicit route in the routing table.

Answer

The 'set ip default next-hop' is always used first.

Answer

Both are used simultaneously, and the router load-balances.

Answer

The router ignores both and uses the routing table.

Question 3

Which statement accurately describes the default behavior of auto-summary in EIGRP on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, and EIGRP advertises subnets without automatic summarization.. In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without automatically summarizing them at classful boundaries, allowing for more granular route advertisement and preventing routing issues in discontiguous networks.

Answer

Auto-summary is enabled by default, causing EIGRP to summarize at classful boundaries.

Answer

Auto-summary is enabled by default but only for external routes.

Answer

Auto-summary is disabled by default unless the network is configured with a classful mask.

Question 4

Which DHCP message type is used by a client to renew its lease before it expires?

Accepted Answer

DHCPREQUEST. When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Answer

DHCPDISCOVER

Answer

DHCPACK

Answer

DHCPRELEASE

Question 5

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection. The tunnel works for IPv6 traffic, but when the engineer tries to run EIGRP for IPv6 over the tunnel, the neighbor relationship forms but routes are not exchanged. The engineer checks the EIGRP configuration and sees that the tunnel interface is included in the EIGRP process. What is the most likely explanation?

Accepted Answer

EIGRP for IPv6 requires the 'no shutdown' command under the address-family; without it, the process is administratively down.. EIGRP for IPv6 requires the 'no shutdown' command under the address-family configuration to activate the routing process. Without it, the EIGRP process remains administratively down, which prevents route exchange even though the neighbor relationship forms (since EIGRP hellos are sent but routes are not advertised or processed). This is a common misconfiguration when transitioning from EIGRP for IPv4, which does not require an explicit 'no shutdown'.

Answer

The tunnel interface is not configured with 'ipv6 eigrp' under the interface.

Answer

The IPsec transform set does not allow multicast traffic, which EIGRP uses for hellos.

Answer

The GRE tunnel does not support EIGRP for IPv6; only OSPFv3 is supported.

Question 6

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Accepted Answer

The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.. If PBR is not working and the router uses the routing table, it could be because the route map is not being processed due to a missing 'match' statement or the route map being empty. However, a common cause is that the route map has a 'match ip address' that references an ACL that does not exist or is misconfigured. The engineer should verify that the ACL 150 exists and is correctly configured.

Answer

The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Answer

The router is running an older IOS version that does not support PBR.

Answer

The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.

Question 7

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Accepted Answer

TCP port 49 is blocked between the router and the TACACS+ server.. The 'test aaa group tacacs+ admin cisco123 new-code' command uses the 'new-code' flag, which forces the test to use the TACACS+ protocol (TCP port 49) rather than the older, less secure method. Since the router can ping the TACACS+ server, Layer 3 connectivity is fine, but a failed authentication with 'new-code' strongly indicates that TCP port 49 is blocked by a firewall or ACL between the router and the server. TACACS+ relies on TCP port 49 for all communication, so blocking this port causes immediate failure.

Answer

The TACACS+ server shared key is incorrect.

Answer

The username 'admin' does not exist on the TACACS+ server.

Answer

The TACACS+ server is not configured for the router's IP address.

Question 8

A large enterprise network is experiencing intermittent SNMP polling failures from the NMS to router R2. R1 and R2 are connected via a serial link running OSPF. R1 has the following relevant configuration: snmp-server community public RO, snmp-server community private RW, snmp-server trap-source Loopback0, snmp-server enable traps ospf. R2 shows: debug ip packet shows packets from NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. No ACL is applied to any interface on R2. What is the root cause?

Accepted Answer

An ACL is applied to the SNMP community string that does not permit the NMS IP address.. The debug output on R2 shows packets from the NMS (10.1.1.100) to R2's Loopback0 (10.2.2.2) being dropped with 'access-list violation'. Since no ACL is applied to any interface on R2, the only remaining ACL that could cause this is an SNMP community ACL. The SNMP community string 'public' or 'private' can have an optional ACL applied via the 'snmp-server community [view ] [ro|rw] [acl-number]' command. If that ACL does not permit the NMS IP address (10.1.1.100), the router will silently drop SNMP packets from that source, even though no interface ACL exists. This matches the symptom exactly.

Answer

OSPF network type mismatch between R1 and R2 causes routing blackhole.

Answer

The NMS is using SNMPv3 with incorrect credentials, causing authentication failure.

Answer

R2's loopback interface is not advertised into OSPF, making it unreachable.

Question 9

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external
  Refresh Epoch 2
  65002
    10.2.2.2 from 10.2.2.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best

What does this output indicate?

Accepted Answer

The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.. The output shows two paths with equal local preference and metric. The best path is from AS 65002, likely due to a tie-breaking rule such as lower router ID or older route. The path from AS 65001 is valid but not best.

Answer

Both paths are equally preferred, and BGP load-balances traffic.

Answer

The path from AS 65002 is best because it has a higher local preference.

Answer

The path from AS 65001 is best because it was received first.

Question 10

Drag and drop the steps to troubleshoot IPv6 traffic filtering and uRPF adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check uRPF configuration on the interface. Troubleshooting starts with checking the uRPF configuration on the interface, then verifying the routing table for the source prefix, checking for ACLs that might block traffic, examining uRPF drop counters, and finally using debug ipv6 packet to capture dropped packets.