300-410 Practice Test 50 — 15 Questions

Question 1

A network engineer runs the following command to verify MPLS forwarding:

R1# show mpls forwarding-table 192.168.1.0 255.255.255.0 detail

Output:
Local  Outgoing    Prefix            Bytes Label   Outgoing   Next Hop
Label  Label       or Tunnel Id      Switched     interface
101    201         192.168.1.0/24    0            Gi0/0      10.0.0.2
    MAC/Encaps: 14/18, MTU: 1500, Label Stack {201}
    No output feature configured

What does this output indicate?

Accepted Answer

Packets with label 101 will be swapped to label 201 and forwarded to 10.0.0.2. The output shows the MPLS forwarding table entry for prefix 192.168.1.0/24. The local label is 101, outgoing label is 201, next hop is 10.0.0.2 via GigabitEthernet0/0. The label stack contains only label 201.

Answer

Packets with label 101 will be popped and forwarded as IP packets

Answer

The prefix 192.168.1.0/24 is directly connected

Answer

The label stack has two labels

Question 2

Which statement about PBR and the 'set ip precedence' command is correct?

Accepted Answer

It modifies the IP header of the packet.. The 'set ip precedence' command in PBR modifies the IP Precedence field in the Type of Service (ToS) byte of the IP header. This is used for marking packets for QoS purposes. It does not set DSCP, which uses a different set of bits in the ToS byte.

Answer

It sets the DSCP value.

Answer

It can only be used with 'set ip next-hop'.

Answer

It is used for load-balancing.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 10.1.1.1 advertised-routes

BGP table version is 10, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/8       0.0.0.0                  0         32768 i
*> 10.1.0.0/16      0.0.0.0                  0         32768 i
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.1.2.0/24      0.0.0.0                  0         32768 i

Based on this output, what is a problem with the BGP advertisements?

Accepted Answer

The router is advertising overlapping prefixes, including both summary and specific routes.. The output shows that R1 is advertising four prefixes: 10.0.0.0/8, 10.1.0.0/16, 10.1.1.0/24, and 10.1.2.0/24. These are overlapping because 10.0.0.0/8 encompasses 10.1.0.0/16, which in turn encompasses the two /24s. Advertising both summary and more-specific routes can cause suboptimal routing and increase BGP table size. The correct answer identifies this as the problem.

Answer

The router is not advertising any routes.

Answer

The router is only advertising the summary route.

Answer

The router is using incorrect next-hop.

Question 4

Which TWO commands can be used to verify OSPFv2 path selection and cost metrics on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip ospf interface. Option A, 'show ip ospf interface', is correct because it displays per-interface OSPFv2 parameters including the interface cost, network type, hello/dead timers, and area, which directly verifies the cost metrics that drive OSPF path selection. Option B, 'show ip route ospf', is correct because it shows the OSPF-learned routes installed in the routing table along with their metric (cost) and next-hop, confirming which paths OSPF selected. Option C, 'show ip ospf neighbor', only verifies adjacency states and neighbor IDs, not path selection or cost. Option D, 'traceroute', shows the forwarding path taken by packets but does not reveal OSPF cost values or OSPF's internal selection logic. Option E, 'show ip protocols', displays routing protocol parameters such as timers, networks, and administrative distance, but not OSPF interface costs or the resulting OSPF route selection.

Answer

show ip ospf neighbor

Answer

traceroute

Answer

show ip protocols

Question 5

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

Accepted Answer

The IPsec transform set on one router does not match the transform set on the other.. An active IKE SA indicates that IKE phase 1 completed successfully, but no IPsec SAs means phase 2 failed. The most common cause is a mismatch in the IPsec transform set or the crypto map access list between the two routers.

Answer

The pre-shared key is incorrect on one of the routers.

Answer

The tunnel interface is down.

Answer

The IKE proposal is mismatched.

Question 6

What is the default timeout value (in milliseconds) for an IP SLA operation?

Accepted Answer

5000 ms. The default timeout for an IP SLA operation in Cisco IOS is 5000 milliseconds (5 seconds). This value applies to the operation's response wait time before the probe is considered failed, and it is configurable via the 'timeout' command under ip sla configuration. Knowing this default matters when tuning SLA probes for latency-sensitive monitoring.

Answer

1000 ms

Answer

10000 ms

Answer

60000 ms

Question 7

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla statistics 10

Round Trip Time (RTT) for Index 10
   Latest RTT: 12 ms
   Latest RTT (milliseconds): 12
   Latest RTT (microseconds): 12000
   Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021
   Last operation return code: OK
   Number of successes: 100
   Number of failures: 0
   Operation time to live: Forever

What does this output indicate?

Accepted Answer

The IP SLA operation is working correctly with no failures.. The output shows 'Last operation return code: OK', 100 successes, and 0 failures, indicating the IP SLA operation is functioning correctly. The latest RTT of 12 ms is a normal, healthy round-trip time, not a failure condition.

Answer

The IP SLA operation has failed because the RTT is too low.

Answer

The IP SLA operation has timed out and needs to be reconfigured.

Answer

The IP SLA operation is not configured for this index.

Question 8

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history applet TRACK-INTERFACE

Applet TRACK-INTERFACE:
  Time Created : Mar 1 00:00:12 2025
  Time Last Triggered : Mar 1 00:15:30 2025
  Time Last Executed : Mar 1 00:15:30 2025
  Trigger Count : 5
  Execution Count : 5
  Last Event Type : syslog
  Last Event Detail : OSPF-5-ADJCHG
  Last Action Executed : show ip route
  Last Action Result : Success

What does this output indicate?

Accepted Answer

The applet 'TRACK-INTERFACE' has been triggered 5 times and executed successfully each time, with the last trigger at 00:15:30.. The output shows the history for a specific EEM applet. It includes creation time, last trigger and execution times, trigger and execution counts, the last event that triggered it, the last action executed, and the result. This helps in determining if the applet is being triggered and executing successfully.

Answer

The applet 'TRACK-INTERFACE' has failed to execute 5 times.

Answer

The applet 'TRACK-INTERFACE' has not been triggered since it was created.

Answer

The applet 'TRACK-INTERFACE' executed the action 'show ip route' but the output was not captured.

Question 9

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

Accepted Answer

ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.. ND Inspection drops Neighbor Solicitations with an unspecified source address (::) because it requires a valid binding for the source address in its binding table. During Duplicate Address Detection (DAD), the source address is :: (RFC 4862), which has no corresponding binding, causing ND Inspection to drop the message and preventing DAD from completing.

Answer

RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.

Answer

DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.

Answer

IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding
IPv6 Address                              MAC Address       VLAN Interface        State
2001:DB8:1::100                           aaaa.bbbb.cccc    10    Gi0/0/0          ACTIVE
2001:DB8:1::101                           aaaa.bbbb.cccd    10    Gi0/0/0          ACTIVE
2001:DB8:1::102                           aaaa.bbbb.ccce    10    Gi0/0/1          ACTIVE
2001:DB8:1::103                           aaaa.bbbb.cccf    10    Gi0/0/1          ACTIVE

Based on this output, which statement is correct?

Accepted Answer

All entries are in the ACTIVE state, meaning they are valid bindings.. The ACTIVE state in IPv6 snooping binding indicates that the binding has been validated and is currently in use, meaning the IPv6 address, MAC address, VLAN, and interface combination is legitimate. Option A is correct because all four entries show ACTIVE, confirming they are valid bindings that have passed the First Hop Security (FHS) validation process, such as Duplicate Address Detection (DAD) or neighbor solicitation verification.

Answer

The binding for 2001:DB8:1::103 is invalid.

Answer

The table shows only IPv6 addresses from SLAAC.

Answer

There are no entries for VLAN 10.

Question 11

Which TWO commands can be used to verify OSPFv3 interface parameters and troubleshoot adjacency issues? (Choose TWO.)

Accepted Answer

show ipv6 ospf interface. Option A, 'show ipv6 ospf interface', is correct because it displays OSPFv3-specific interface parameters such as area ID, interface state, hello/dead intervals, network type, and DR/BDR roles, which are essential for verifying that neighbors agree on these values before an adjacency can form. Option B, 'debug ipv6 ospf hello', is correct because it dynamically shows the OSPFv3 hello packets being sent and received, including hello/dead timers, area ID, and neighbor lists, which directly helps diagnose why an adjacency is stuck (e.g., mismatched timers or area IDs). Option C, 'show ip ospf interface', is not correct because it is an OSPFv2 (IPv4) command and does not display OSPFv3 interface information. Option D, 'debug ip ospf adj', is not correct because it debugs OSPFv2 adjacency events, not OSPFv3. Option E, 'show ipv6 ospf database', is not correct because it displays the OSPFv3 link-state database rather than interface parameters or hello-level adjacency troubleshooting information.

Answer

show ip ospf interface

Answer

debug ip ospf adj

Answer

show ipv6 ospf database

Question 12

A network engineer is troubleshooting an IPv6 connectivity problem across an IPv4 MPLS network using 6PE. The 6PE routers have MP-BGP sessions to exchange IPv6 prefixes, and the tunnel between them is up. However, a customer edge router behind one 6PE router cannot reach an IPv6 prefix behind the other 6PE router. The engineer checks the 6PE router's BGP table and sees the prefix, but the routing table shows the next-hop as unreachable. What is the most likely cause?

Accepted Answer

The MPLS LDP session between the 6PE routers or between the 6PE and P routers is down, so no label exists for the BGP next-hop.. In 6PE, the BGP next-hop for an IPv6 prefix is the IPv4 address of the remote 6PE router. The 6PE router must have a label-switched path (LSP) to that IPv4 next-hop, which requires a working MPLS LDP session to distribute a label for that IPv4 address. If the LDP session is down, no label exists for the BGP next-hop, making it unreachable in the routing table even though the BGP table contains the prefix.

Answer

The 6PE router is missing the 'ipv6 unicast-routing' command.

Answer

The tunnel interface is not in the VRF of the customer.

Answer

The remote 6PE router is not advertising the IPv6 prefix via BGP.

Question 13

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1
  FNF: monitor
    Monitor: FLOW-MONITOR-1
      direction: Input
      traffic-statistics:  enabled

Based on this output, what can be concluded?

Accepted Answer

The flow monitor is applied only to incoming traffic on this interface.. The output shows that flow monitor FLOW-MONITOR-1 is applied to GigabitEthernet0/1 in the input direction with traffic statistics enabled.

Answer

The flow monitor is applied to both input and output traffic.

Answer

Traffic statistics are disabled.

Answer

The flow monitor is not attached to any interface.

Question 14

Which statement about administrative distance is true regarding the selection of routes in a routing table?

Accepted Answer

The route with the lowest administrative distance is installed in the routing table.. The route with the lowest administrative distance is installed in the routing table when multiple routing protocols provide a route to the same destination. Administrative distance is a measure of trustworthiness; lower values are preferred. This is a fundamental principle in Cisco routing.

Answer

Routes with higher administrative distance are always preferred.

Answer

Administrative distance is only considered when metrics are equal.

Answer

Administrative distance is used to select the best path within the same routing protocol.

Question 15

What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?

Accepted Answer

Both ingress and egress traffic are monitored.. In a local SPAN session, if no direction is specified, the default is to monitor both ingress and egress traffic. This means that all traffic entering and leaving the source interface is copied to the destination interface. The direction keyword is optional and defaults to `both`.

Answer

Only ingress traffic is monitored.

Answer

Only egress traffic is monitored.

Answer

No traffic is monitored until direction is explicitly set.