300-410 Practice Questions 2 — 50 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq www (1000 matches)
    20 permit udp any any eq dns (500 matches)
    30 deny ip any any (200 matches)

Based on this output, what is the problem?

Accepted Answer

The ACL is blocking all traffic except web and DNS, which may be too restrictive.. The ACL explicitly permits only TCP port 80 (www) and UDP port 53 (dns) traffic, while the final deny ip any any statement blocks all other traffic. With only 1000 matches for web and 500 for DNS, the ACL is likely too restrictive for a production network, as it would drop essential traffic such as routing protocols, management traffic (e.g., SSH, SNMP), or other application flows. The output shows the ACL is present and has hit counts, but its restrictive nature is the problem.

Answer

The ACL is correctly permitting web and DNS traffic.

Answer

The ACL has no effect because it is not applied.

Answer

The ACL allows all traffic because of the permit statements.

Question 2

A network engineer runs the following command to verify BFD session details:

NeighAddr      LD/RD         RH/RS     State     Int
10.4.4.2      100/200       Up        Up        Gi0/1
MinTxInt: 500000, MinRxInt: 500000, Multiplier: 5

What does this output indicate?

Accepted Answer

BFD session is UP with a detection time of 2.5 seconds (500 ms * 5).. The output shows a BFD session with a multiplier of 5 and intervals of 500 ms. The high multiplier may indicate a need for more tolerance, but the session is UP.

Answer

BFD session is DOWN due to high multiplier.

Answer

BFD is using echo mode for faster detection.

Answer

BFD multiplier is set to 3, not 5.

Question 3

Which TWO statements correctly describe the behavior of the 'default-information originate' command in the context of route redistribution? (Choose TWO.)

Accepted Answer

In OSPF, the 'default-information originate' command always injects a default route into the OSPF domain, even if no default route exists in the routing table, provided the 'always' keyword is used.. The 'default-information originate' command in OSPF and EIGRP has specific behaviors. In OSPF, it always originates a default route regardless of the routing table, unless the 'always' keyword is omitted and there is no default route in the routing table. In EIGRP, it requires a default route in the routing table to inject the default, unless the 'always' keyword is used. The command does not automatically redistribute all routes; it only injects a default route.

Answer

In EIGRP, the 'redistribute static' command automatically injects a default route if a static default route is configured.

Answer

In OSPF, the 'default-information originate always' command will inject a default route even if OSPF is not configured on any interface.

Answer

In both OSPF and EIGRP, the 'default-information originate' command automatically redistributes all connected routes into the routing protocol.

Question 4

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. IPv6 ND Inspection validates Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages against the IPv6 snooping binding table. This table is built by gleaning information from DHCPv6 messages or by using the IPv6 Neighbor Discovery protocol itself, ensuring that only legitimate ND messages from trusted sources are forwarded, preventing attacks like Neighbor Cache exhaustion or address spoofing.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 5

Drag and drop the steps to verify and validate DHCP (IPv4 and IPv6) operational state into the correct order, from first to last.

Accepted Answer

Display DHCP pool statistics and bindings. Start by checking the DHCP pool utilization and bindings. Then, verify that clients have received addresses from the correct pool. Next, confirm that the DHCP relay agent is forwarding packets. After that, validate DHCPv6 prefix delegation if used. Finally, ensure that the DHCP server is not running out of addresses.

Question 6

An engineer configures a DHCP server on a Cisco router to assign IP addresses from a pool. Clients receive addresses, but when the engineer checks 'show ip dhcp binding', no bindings are displayed. Which is the most likely explanation?

Accepted Answer

The 'ip dhcp excluded-address' command includes the entire pool range, so no addresses are assigned and no bindings are created.. The 'show ip dhcp binding' command only displays bindings that are currently active. If the lease time is very short or the clients release addresses, bindings may not appear. However, a more subtle edge case is when the DHCP server is configured with 'ip dhcp excluded-address' that includes the pool range, causing the server to not assign addresses but still respond with NAKs.

Answer

The DHCP pool is configured with 'lease infinite', causing bindings to be stored in a different database.

Answer

The router's DHCP server is configured in 'database' mode, which stores bindings externally.

Answer

The clients are using DHCPv6, not DHCPv4.

Question 7

Which of the following is NOT a valid match criterion for a class-map used in Control Plane Policing?

Accepted Answer

match protocol. In Control Plane Policing (CoPP), class-maps are used to classify traffic destined to the control plane. The valid match criteria include match access-group, match ip dscp, and match ip precedence. However, match protocol is not a valid match criterion for a class-map under CoPP; it is used in other contexts like QoS policy-maps for application-level classification, but not for CoPP class-maps.

Answer

match access-group

Answer

match ip dscp

Answer

match ip precedence

Question 8

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor detail

Neighbor 10.1.1.4, interface address 192.168.14.4
    In the area 0 via interface GigabitEthernet0/2
    Neighbor priority is 1, State is 2WAY, 2 state changes
    DR is 10.1.1.1, BDR is 10.1.1.4
    Options is 0x12 (L L S R)
    Dead timer due in 00:00:38
    Neighbor is up for 00:05:22
    Index 1/1/1, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)
    Last retransmission scan length is 0, time is 0 msec
    Last retransmission scan time is 0 msec

Based on this output, what is the problem?

Accepted Answer

The neighbor is in 2WAY state, meaning the adjacency is not fully established.. The neighbor state is 2WAY, not FULL. This indicates that the neighbor relationship has not progressed to full adjacency. On a broadcast network, routers in 2WAY state have exchanged hello packets but have not completed database exchange. This could be due to mismatched MTU, authentication, or other issues, but the key observation is that the state is not FULL.

Answer

Router R1 is the DR and the neighbor is the BDR, so the state is correct.

Answer

The dead timer is about to expire, causing the neighbor to go down.

Answer

The neighbor has a lower priority than R1, so it remains in 2WAY.

Question 9

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# show bgp vpnv4 vrf CUSTOMER-A 10.1.1.0/24

Output:
BGP routing table entry for 10.1.1.0/24, version 10
Paths: (1 available, best #1, table CUSTOMER-A)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    0.0.0.0 from 0.0.0.0 (10.0.0.1)
      Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best
      Extended Community: RT:100:100
      mpls labels in/out nolabel/nolabel

What does this output indicate?

Accepted Answer

The route is locally originated and has no MPLS label. This shows a VPNv4 route for prefix 10.1.1.0/24 in VRF CUSTOMER-A. The path is local (sourced from this router), with next hop 0.0.0.0, and the route is valid and best. The extended community is RT:100:100. The mpls labels show nolabel/nolabel, meaning no MPLS label is assigned for this prefix, which could indicate a problem if labels are expected.

Answer

The route is learned from a BGP peer

Answer

The route has an MPLS label of 100

Answer

The route is not best

Question 10

An engineer configures CoPP on a router running EIGRP. The policy includes a class-map matching EIGRP traffic with a police rate of 1000 pps. After applying the policy, EIGRP neighbors form but occasionally go active and become stuck-in-active (SIA). Which is the most likely explanation?

Accepted Answer

The police rate in pps is too low, causing EIGRP reliable packets (queries/replies) to be dropped, leading to SIA.. EIGRP uses RTP (Reliable Transport Protocol) for certain packets like queries and replies. These reliable packets require acknowledgment; if the CoPP police rate of 1000 pps is too low, EIGRP queries or replies may be dropped. Missing acknowledgments cause the neighbor to be declared active, and if the query process is not completed within the active timer, the route becomes stuck-in-active (SIA).

Answer

EIGRP uses multicast, and CoPP cannot police multicast traffic.

Answer

CoPP only affects incoming traffic, but EIGRP SIA is caused by outgoing packet drops.

Answer

EIGRP uses TCP, and CoPP only polices UDP.

Question 11

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.

Answer

The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.

Answer

The 'ip nat pool' command is required for all PAT configurations.

Question 12

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

Accepted Answer

It denies all traffic not explicitly permitted and is always present.. Every IPv4 ACL has an implicit deny any statement at the end that denies all traffic not explicitly permitted by earlier entries. This implicit rule is always present and cannot be removed, ensuring that only traffic matching a permit entry is allowed through the ACL.

Answer

It can be overridden by adding a permit any at the end.

Answer

It is invisible and applies only to TCP traffic.

Answer

It is always present and cannot be removed or overridden.

Question 13

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Accepted Answer

Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.. The configuration uses a standard ACL to match inside hosts (192.168.1.0/24) and dynamically assigns them a unique address from the pool 203.0.113.10–203.0.113.20. Because no 'overload' keyword is present, PAT is not enabled; each translation consumes a pool address, and once all 11 addresses are used, new translations fail until an existing translation times out or is cleared.

Answer

Inside hosts are translated to addresses in the pool using PAT.

Answer

The router uses the pool address as the source for all outbound traffic, regardless of ACL.

Answer

This configuration requires the 'ip nat outside' interface command to function.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor vrf BLUE

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR        00:00:32    10.1.1.2        GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER   00:00:35    10.1.2.2        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

The OSPF adjacencies are functioning normally.. The output shows two OSPF neighbors for VRF BLUE. Neighbor 10.0.0.2 is in FULL state and is the DR on GigabitEthernet0/0. Neighbor 10.0.0.3 is in 2WAY state and is a DROTHER on GigabitEthernet0/1. The 2WAY state is normal for neighbors that are not DR/BDR on a multi-access network. No problem is evident.

Answer

Neighbor 10.0.0.3 is not forming a full adjacency because it is a DROTHER.

Answer

Neighbor 10.0.0.2 is the Backup Designated Router.

Answer

Both neighbors are in the FULL state.

Question 15

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Accepted Answer

IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.. The `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Answer

IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

Answer

IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

Answer

IPv6 ACLs support the remark keyword for documentation.

Question 16

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

Accepted Answer

iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors. By default, iBGP routers do not advertise routes learned from one iBGP neighbor to another iBGP neighbor because of the split-horizon rule. This is a fundamental behavior to prevent routing loops, but it often catches engineers who expect iBGP to behave like eBGP. To overcome this, a route reflector or confederation must be used.

Answer

The next-hop-self command is required for iBGP

Answer

The BGP synchronization rule is enabled

Answer

The routes are not valid because the next-hop is not reachable

Question 17

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows that BFD is enabled for the LDP session and the BFD state is UP, providing fast failure detection for MPLS LDP neighbor.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 18

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 19

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

Accepted Answer

The local enable password is not configured.. The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password. If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Answer

The RADIUS server is not configured to provide the enable password.

Answer

The 'aaa authentication enable default' command is missing the 'local' keyword.

Answer

The router's enable secret is set to a different password.

Question 20

Two VRFs on router R1: VRF A and VRF B. R1 has:
ip vrf A
 rd 100:1
 route-target export 100:1
 route-target import 100:2
ip vrf B
 rd 100:2
 route-target export 100:2
 route-target import 100:1
R1 shows:
R1# show ip route vrf A
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
R1# show ip route vrf B
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
Router R2 (in VRF A) can ping 10.1.1.1, but router R3 (in VRF B) cannot. What is the root cause?

Accepted Answer

The next hop 10.2.2.2 is not reachable from VRF B due to missing interface in VRF B.. The route targets are misconfigured for route leaking. VRF A exports with RT 100:1 and imports RT 100:2. VRF B exports with RT 100:2 and imports RT 100:1. This creates a two-way leak, but the route 10.1.1.0/24 is learned via BGP from R2. If R2 is in VRF A, the route is exported with RT 100:1. VRF B imports RT 100:1, so VRF B should have the route. However, the issue might be that the route is not being advertised to R3 due to BGP next-hop resolution or VRF interface issues. The output shows both VRFs have the route, so the problem is likely that R3 cannot reach the next hop 10.2.2.2 because it is in a different VRF or the interface is not in VRF B. The root cause is that the next hop is not reachable from VRF B.

Answer

The route targets are reversed, causing VRF B to not import the route.

Answer

BGP is not configured to advertise VPNv4 routes.

Answer

R3 has a firewall blocking ICMP.