300-410 Practice Test 50 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot Control Plane Policing (CoPP):

R1# show policy-map control-plane input class class-default
  Class-map: class-default (match-any)
    140091 packets, 12345678 bytes
    5 minute offered rate 1000 bps, drop rate 0 bps
    Match: any
    police:
        cir 8000 bps, bc 1500 bytes
        conformed 140091 packets, 12345678 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

CoPP is rate-limiting traffic to 8000 bps and not dropping any packets.. The output shows that the class-default policy-map for control-plane input has a police statement with a CIR of 8000 bps. The counters indicate 140,091 packets conformed and transmitted, with zero packets exceeded or violated. Since the drop rate is 0 bps and no packets have been dropped, CoPP is rate-limiting traffic to 8000 bps without any drops occurring.

Answer

CoPP is dropping all traffic to the control plane.

Answer

CoPP is not configured; the class-default shows no action.

Answer

CoPP is dropping packets due to exceeding the rate.

Question 2

What is the default value of the 'limit' parameter in the 'ipv6 nd prefix' command for the number of prefixes advertised in RA messages?

Accepted Answer

16. The default value of the 'limit' parameter in the 'ipv6 nd prefix' command is 16, as defined by Cisco IOS. This parameter controls the maximum number of IPv6 prefixes that can be advertised in Router Advertisement (RA) messages. When the number of prefixes exceeds this limit, the router will not include additional prefixes in the RA, ensuring the message stays within reasonable size constraints.

Answer

8

Answer

32

Answer

64

Question 3

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history events

Event History:
  Event Type    : syslog
  Time          : Mar 1 00:05:23
  Pattern       : OSPF-5-ADJCHG
  Trigger count : 1

Event Type    : timer
  Time          : Mar 1 00:06:00
  Timer Type    : absolute
  Timer Name    : MY-TIMER
  Trigger count : 1

What does this output indicate?

Accepted Answer

Two events have triggered EEM applets: a syslog event matching 'OSPF-5-ADJCHG' and an absolute timer named 'MY-TIMER'.. The output shows the event history for EEM. It lists events that have triggered EEM applets. Each entry shows the event type (syslog, timer, etc.), the time it occurred, specific details (pattern for syslog, timer type and name for timer), and the number of times that event triggered an applet. This helps in troubleshooting which events are being matched.

Answer

Two EEM applets are currently registered: one for syslog and one for timer.

Answer

The OSPF-5-ADJCHG syslog event triggered an applet that executed a timer.

Answer

The timer event is a countdown timer that triggered after 5 minutes and 23 seconds.

Question 4

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip nhrp detail
10.0.0.0/16 via 10.1.1.2, Tunnel0 created 00:01:00, expire 01:59:00
  Type: summary, Flags: used
  NBMA address: 192.168.1.2
  Registration: never

What does this output indicate?

Accepted Answer

The summary route 10.0.0.0/16 is learned via NHRP and is active, with the next hop being 192.168.1.2 over Tunnel0.. This output shows an NHRP cache entry for the summary route 10.0.0.0/16. The type is 'summary', indicating that this is a summary route learned via NHRP. The 'used' flag and NBMA address show that the route is active and pointing to a specific tunnel destination.

Answer

The summary route is not being used because the 'used' flag is not set.

Answer

The summary route is learned via EIGRP, not NHRP.

Answer

The summary route is a static route configured on the router.

Question 5

A network engineer is troubleshooting an EIGRP issue where a router is not installing a route in the routing table, even though the route is present in the EIGRP topology table. The route is a feasible successor, but it is not being used. What is the most likely reason for this?

Accepted Answer

The feasible successor has a higher metric than the current successor.. In EIGRP, a feasible successor is a backup route that meets the feasibility condition (reported distance < feasible distance). However, the router will only install the route with the best metric (the successor) into the routing table. If the feasible successor has a higher metric than the current successor, it will remain in the topology table as a backup but will not be used unless the successor fails. This matches option A.

Answer

The route is a summary route that is being suppressed.

Answer

The route is being filtered by a distribute-list in.

Answer

The EIGRP variance command is set to 1, preventing unequal-cost load balancing.

Question 6

Which of the following is true regarding the default behavior of NAT in Cisco IOS when handling ICMP traffic?

Accepted Answer

ICMP NAT entries timeout after 60 seconds by default.. C is correct because Cisco IOS NAT uses a default timeout of 60 seconds for ICMP NAT entries. When an ICMP packet is translated, the router creates a NAT translation entry, and if no subsequent traffic matches that entry within 60 seconds, the entry is removed. This behavior is independent of TCP or UDP timeouts and is specific to ICMP.

Answer

ICMP traffic is not translated by NAT unless explicitly configured.

Answer

ICMP NAT entries use the same timeout as TCP entries by default.

Answer

ICMP NAT entries are permanent and do not time out.

Question 7

Which SNMPv2c PDU type is used by the manager to request a large amount of data efficiently, such as an entire routing table?

Accepted Answer

GetBulkRequest. C is correct because SNMPv2c introduced the GetBulkRequest PDU specifically to allow a manager to retrieve large amounts of data, such as an entire routing table, in a single request. Unlike GetNextRequest, which requires repeated requests to walk through a MIB subtree, GetBulkRequest uses a non-repeaters and max-repetitions mechanism to fetch multiple variable bindings in one operation, significantly reducing network overhead and latency.

Answer

GetRequest

Answer

GetNextRequest

Answer

SetRequest

Question 8

Which TWO commands are used to troubleshoot Control Plane Policing (CoPP) and identify which traffic is being dropped? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays the applied policy map on the control plane, including class maps, match criteria, and per-class statistics such as the number of packets matched and dropped. This allows you to verify which traffic is being classified and confirm that CoPP is dropping the intended packets. It is the primary verification command for CoPP.

Answer

debug policy-map control-plane

Answer

show ip cache flow

Answer

show access-lists

Question 9

A network engineer is troubleshooting a site-to-site VPN that intermittently drops. The engineer configured IP SLA 10 to track reachability of the remote LAN gateway (10.1.2.1) using ICMP echo probes every 5 seconds. The IP SLA is used in a static route to influence failover. The engineer notices that the IP SLA state shows 'Active' but the tracked route is not installed. What is the most likely cause?

Accepted Answer

The track object is configured with 'ip sla 10 reachability' but the static route references the track object incorrectly.. The IP SLA is active, but the tracked object might not be configured correctly to react to the IP SLA state. The issue is that the track object is not linked to the IP SLA or the threshold is misconfigured.

Answer

The IP SLA probe is sending packets to the wrong destination IP.

Answer

The IP SLA probe frequency is too high, causing the router to ignore the results.

Answer

The remote gateway is not responding to ICMP echo requests due to firewall rules.

Question 10

A network engineer configures EEM to monitor routing table changes on R1. R1 has: event manager applet ROUTE-MONITOR event syslog pattern "%ROUTING-5-ROUTECHANGE" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Routing table changed". After a route update, the engineer notices that the applet runs but the show ip route output does not reflect the change. Router R2 shows: the route is present in the routing table. What is the root cause?

Accepted Answer

The syslog message is generated before the routing table is updated, so the show command shows the old table.. The syslog message %ROUTING-5-ROUTECHANGE is generated before the routing table is fully updated. The EEM applet runs immediately, capturing the routing table before the change is applied. The correct fix is to add a delay using 'action wait' to allow the routing table to converge.

Answer

The syslog pattern is incorrect; it should be %ROUTING-5-ROUTECHANGED.

Answer

The routing protocol is not fully converged due to a hold-down timer.

Answer

The 'show ip route' command is not executed in privileged mode.

Question 11

Drag and drop the steps to verify and validate OSPF operational state into the correct order, from first to last.

Accepted Answer

Check OSPF neighbor state with show ip ospf neighbor. The verification process starts by checking the OSPF neighbor state with show ip ospf neighbor. Next, examine the OSPF database using show ip ospf database to see LSAs. Then, verify the routing table for OSPF routes with show ip route ospf. After that, check interface-specific OSPF details with show ip ospf interface. Finally, test end-to-end connectivity with extended ping to validate reachability.

Question 12

An engineer is troubleshooting why the NMS is receiving duplicate SNMP traps from router R9 for the same event. The router has two 'snmp-server host' commands pointing to the same NMS IP address but with different community strings: 'public' and 'private'. The NMS is configured to process traps from both communities. What is the most likely cause?

Accepted Answer

The router sends one trap per 'snmp-server host' command, resulting in duplicate traps for the same event.. Each 'snmp-server host' command creates a separate trap destination entry in the router's SNMP configuration. When a trap-generating event occurs, the router sends a trap to each configured destination. Since both commands point to the same NMS IP address but with different community strings ('public' and 'private'), the router sends two identical traps (one with each community string) for the same event, causing the NMS to receive duplicates.

Answer

The NMS is configured to listen on two different ports, causing duplicate reception.

Answer

The router has an SNMP trap filter that is misconfigured, causing the same trap to be sent twice.

Answer

The engineer enabled both 'snmp-server enable traps' and 'snmp-server enable informs', causing duplicate notifications.

Question 13

Which statement correctly describes the behavior of IPv6 Unicast Reverse Path Forwarding (uRPF) in strict mode?

Accepted Answer

It verifies that the source address is reachable via the same interface and that the route points back to that interface.. IPv6 uRPF strict mode requires that the source address of an incoming packet is reachable via the exact same interface on which the packet arrived, and that the best matching route in the FIB points back to that interface. This prevents spoofed traffic by ensuring the source is topologically correct from the router's perspective, as defined in RFC 3704.

Answer

It verifies that the source address is in the routing table, but does not check the incoming interface.

Answer

It checks that the source address is reachable via the same interface and that the route is a connected route.

Answer

It only checks that the source address is not a multicast or link-local address.

Question 14

DMVPN spoke-to-spoke tunnel failures are occurring due to route summarization. Hub router R1 has:
interface Tunnel0
 ip address 172.16.0.1 255.255.255.0
 ip nhrp network-id 1
 ip nhrp map multicast dynamic
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
!
router eigrp 100
 network 172.16.0.0
!
Spoke R2 has:
interface Tunnel0
 ip address 172.16.0.2 255.255.255.0
 ip nhrp network-id 1
 ip nhrp nhs 172.16.0.1
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
!
R1 also has:
interface GigabitEthernet0/0
 ip summary-address eigrp 100 10.0.0.0 255.255.252.0
!
Spokes cannot establish direct tunnels to each other for subnets within 10.0.0.0/22. What is the root cause?

Accepted Answer

The summary route causes spokes to forward traffic to the hub instead of establishing direct tunnels, as the summary is preferred over more specific routes.. The summary route 10.0.0.0/22 is advertised by R1 to all spokes. When a spoke wants to reach a subnet within that summary on another spoke, it sends traffic to R1 (the summary route) instead of using the NHRP redirect to establish a spoke-to-spoke tunnel. The summary overrides the more specific routes that would trigger NHRP redirects. The fix is to use a leak-map to advertise specific routes or disable summarization.

Answer

NHRP is not configured correctly on the spokes, so they cannot register.

Answer

EIGRP is not enabled on the tunnel interface, so routes are not exchanged.

Answer

The tunnel mode is not multipoint on the spokes.

Question 15

Given the following EIGRP configuration on Router R2:

router eigrp 200
 network 192.168.1.0
 network 10.0.0.0
 no auto-summary

Which statement is true about the operation of EIGRP?

Accepted Answer

EIGRP will advertise 192.168.1.0/24 and 10.0.0.0/8 as exact prefixes.. The 'no auto-summary' command disables automatic classful summarization in EIGRP. Therefore, EIGRP advertises the exact subnet masks configured under the 'network' statements: 192.168.1.0/24 and 10.0.0.0/8, rather than summarizing them to their classful boundaries (192.168.0.0/16 and 10.0.0.0/8). This ensures that all subnets are advertised with their original prefix lengths.

Answer

EIGRP will automatically summarize 192.168.1.0 to 192.168.0.0/16.

Answer

EIGRP will only advertise the classful networks 192.168.0.0/16 and 10.0.0.0/8.

Answer

EIGRP will not form neighbor adjacencies due to missing network mask.