300-410 Practice Exam 51 — 20 Questions

Question 1

An engineer is troubleshooting a BGP peering problem between two routers, R1 (AS 65001) and R2 (AS 65002), connected via a firewall. The BGP session is flapping every few seconds. The engineer notices that the TCP connection is established, but BGP OPEN messages are not exchanged. The firewall logs show that TCP port 179 is allowed, but packets with the BGP marker (0xFFFFFFFF) are being dropped. What is the most likely cause?

Accepted Answer

The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.. BGP uses a 16-byte marker (all 0xFF) in its messages. Some firewalls or intrusion prevention systems may misinterpret this as a malformed packet and drop it, preventing BGP from establishing.

Answer

The BGP session is flapping because the keepalive timer is set too low on both routers.

Answer

The BGP session is flapping because the routers have mismatched BGP AS numbers.

Answer

The BGP session is flapping because the firewall is performing TCP sequence number randomization, breaking the BGP session.

Question 2

An engineer configures a DMVPN Phase 2 network. Spoke routers can communicate with the hub, but spoke-to-spoke traffic is not establishing dynamically. The engineer verifies that NHRP is configured and that the hub is configured as an NHRP server. Which is the most likely explanation?

Accepted Answer

The hub is not configured with 'no ip next-hop-self' for the routing protocol on the tunnel interface. In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the remote spoke's tunnel IP address via the hub. This is achieved by the hub advertising the spoke's prefix with the next-hop set to the spoke's tunnel IP. However, if the hub does not configure 'no ip next-hop-self eigrp' (or similar for the routing protocol), the hub will set the next-hop to itself, preventing the spoke from directly reaching the remote spoke. This is a common edge case because the default behavior of routing protocols is to set the next-hop to the router's own IP.

Answer

NHRP authentication is mismatched between spokes

Answer

The spoke routers have not enabled NHRP redirect

Answer

The tunnel mode is set to GRE multipoint on the spokes

Question 3

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the outgoing interface and that the ACL defining interesting traffic is correct. Which is the most likely explanation?

Accepted Answer

The crypto ACL is not mirrored on both sides, so the SA is not established for the traffic. A common edge case is that the ACL defining interesting traffic is applied in the wrong direction. For IPsec, the ACL should match traffic that will be encrypted, and it must be applied to the crypto map. However, if the ACL is configured with the source and destination reversed (e.g., source is local network and destination is remote network on one router, but on the other router the ACL should also have source as local network), the traffic may not match. Additionally, if the ACL is not mirrored on both sides, the tunnel may come up but traffic will not be encrypted because the SA is not established for that traffic.

Answer

The transform-set is missing encryption or authentication

Answer

The crypto map is applied to the wrong interface

Answer

The IKE policy is not configured

Question 4

A network engineer is troubleshooting missing BGP routes on R3. R1 (AS 65001) is an eBGP peer of R2 (AS 65002), and R2 is an iBGP peer of R3 (AS 65002). R1 advertises the prefix 172.16.1.0/24 to R2. On R2, 'show ip bgp' shows the prefix with next-hop 10.1.1.1 (R1's interface). R3's BGP table does not contain this prefix. R2 and R3 are not route reflectors, and there are no other iBGP peers. What is the most likely cause?

Accepted Answer

R2 does not have the 'neighbor 10.1.1.3 activate' command under the BGP configuration for the iBGP session.. In iBGP, by default, routes learned from an iBGP peer are not advertised to other iBGP peers (split horizon). Since R2 learned the route from eBGP, it should advertise it to R3. However, if R3 learned the route via iBGP from another source, it might not be advertised. But the scenario implies R2 is not advertising to R3. The most common cause is that R2 has a route-map or filter blocking the advertisement, or the next-hop is unreachable from R3. However, given the information, the likely issue is that R2 does not have the route in its BGP table as best, or the next-hop is not reachable. But the stem says R2 shows the prefix. The correct answer is that R2 is not advertising because the next-hop (10.1.1.1) is not reachable from R3, but that would affect R3's ability to use the route, not R2's advertisement. Actually, R2 will advertise to iBGP peers regardless of next-hop reachability on the receiver. So the issue must be that R2 is not advertising due to a missing 'neighbor R3 activate' or a filter. The most plausible is that the network statement or redistribution is missing on R2 for the prefix? No, R2 has it. Let me re-read: R2's BGP table shows the prefix. The missing route on R3 could be due to R2 not having the 'neighbor 10.1.1.3 activate' under the BGP process, or a route-map blocking. The stem does not mention any filters. The most common cause in such scenarios is that the BGP session between R2 and R3 is not configured to exchange prefixes (missing activate).

Answer

R2 is not advertising the route because the next-hop 10.1.1.1 is not reachable from R3.

Answer

R2 is not advertising the route because BGP synchronization is enabled and the IGP does not have the route.

Answer

R2 is not advertising the route because the prefix is being filtered by an inbound route-map on R3.

Question 5

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, the router becomes unreachable via SSH, and OSPF neighbor adjacencies go down. The engineer checks the CoPP policy and sees that the class-map for SSH and OSPF traffic is configured with a police rate. Which is the most likely explanation?

Accepted Answer

The class-default is set to drop all traffic not matched by explicit classes. A common edge case with CoPP is that the default class (class-default) is often configured with an explicit deny or a very low rate, which can drop all traffic not matched by other classes. If the engineer does not include a 'class class-default' with an appropriate action (e.g., 'police' with a conform action of 'transmit'), all unmatched traffic, including critical control plane traffic, may be dropped. Additionally, if the police rate is too low for OSPF hello packets, adjacencies can fail.

Answer

The police rate for OSPF traffic is too high

Answer

The CoPP policy is applied to the wrong interface

Answer

The class-map for SSH uses the wrong match criteria

Question 6

An engineer is troubleshooting a BGP route selection issue. Router R1 receives two paths for prefix 10.0.0.0/8: one from eBGP peer R2 (AS 65002) with weight 0, local preference 100, and AS path 65002; and another from eBGP peer R3 (AS 65003) with weight 0, local preference 200, and AS path 65003 65004. R1's BGP table shows the path from R3 as the best route. The engineer wants the path from R2 to be preferred. What should the engineer do?

Accepted Answer

Configure a route-map on R1 to set local preference 150 for routes from R2.. BGP selects the best path based on several attributes. Local preference is checked before AS path length. To prefer the R2 path, the engineer can increase its local preference (e.g., via route-map) or decrease the local preference of the R3 path. Since local preference is higher for R3, lowering it or raising R2's will make R2 preferred.

Answer

Configure a route-map on R1 to prepend two additional AS numbers to the AS path from R3.

Answer

Configure a route-map on R1 to set weight 100 for routes from R2.

Question 7

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) has an eBGP session with R2 (AS 65002). R1 is advertising the prefix 192.168.1.0/24 to R2. On R2, the route appears in the BGP table but is not installed in the routing table. The output of 'show ip bgp 192.168.1.0/24' on R2 shows the route as valid, best, but with the 'r' flag (RIB-failure). The routing table on R2 shows a static route for 192.168.1.0/24 with administrative distance 1. What is the most likely cause?

Accepted Answer

The BGP route is not installed because a static route with a lower administrative distance exists for the same prefix.. RIB-failure occurs when BGP tries to install a route but a route with a lower administrative distance already exists. Here, the static route (AD 1) is preferred over the eBGP route (AD 20).

Answer

The BGP route is not installed because the next-hop is unreachable.

Answer

The BGP route is not installed because BGP synchronization is enabled.

Answer

The BGP route is not installed because the prefix length is too long.

Question 8

An engineer configures uRPF (Unicast Reverse Path Forwarding) in strict mode on a router interface facing the Internet. After configuration, legitimate traffic from customers is being dropped. The engineer verifies that the routing table has a route back to the source IP address. Which is the most likely explanation?

Accepted Answer

Asymmetric routing causes the return path to use a different interface. Strict uRPF checks that the source IP address of incoming packets has a route back through the same interface. If asymmetric routing is present (i.e., traffic comes in one interface but the return route points out a different interface), strict uRPF will drop the packets. This is a common edge case because engineers often assume that having a route to the source is sufficient, but strict mode requires the reverse path to be via the same interface.

Answer

The uRPF allow-default option is not configured

Answer

The source IP address is not in the routing table

Answer

uRPF strict mode requires CEF to be disabled

Question 9

An engineer is troubleshooting a BGP peering issue between two routers, R1 and R2, connected via a serial link. The BGP session is established, but routes are not being exchanged. The engineer checks the BGP configuration and sees that both routers have the 'neighbor' commands correctly configured. The output of 'show ip bgp summary' shows the session is in the Established state, but the prefix counts are zero. What is the most likely cause?

Accepted Answer

Neither router has any network statements or redistribution commands configured to inject prefixes into BGP.. If the BGP session is established but no prefixes are exchanged, the most common cause is that there are no networks configured under the BGP process or no redistribution. Alternatively, outbound filters could be blocking all prefixes. The stem says routes are not being exchanged, so the issue is on the advertisement side.

Answer

The BGP session is using MD5 authentication, but the passwords do not match.

Answer

The routers have mismatched BGP versions.

Answer

The update-source command is missing, causing the session to use the wrong interface.

Question 10

An engineer configures syslog logging to a remote server using the 'logging host' command. The engineer notices that syslog messages are not being received on the server, but the router can ping the server successfully. The engineer verifies that the logging level is set to debugging and that the server is configured to receive syslog messages. Which is the most likely explanation?

Accepted Answer

An ACL on the router is blocking UDP port 514 outbound. A common edge case is that the syslog messages are sent via UDP port 514, but the router may have a firewall or ACL that blocks UDP traffic. Additionally, the 'logging source-interface' command might be configured, but if the source interface is not reachable from the server (e.g., due to routing issues), the server may drop the messages. Another possibility is that the server is listening on a different port or the router is using a different port due to configuration. However, a less obvious issue is that the 'logging monitor' or 'logging buffered' commands can interfere if the logging process is overwhelmed, but the most likely is that the syslog messages are being sent but the server's firewall or the router's own ACL is blocking them.

Answer

The logging host command requires the 'transport tcp' option to work

Answer

The syslog server is not configured to accept messages from the router's IP

Answer

The logging level is set to emergencies only

Question 11

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) is an eBGP peer of R2 (AS 65002). R1 is advertising the prefix 10.0.0.0/8 to R2. R2 has an iBGP session with R3 (AS 65002). R3's BGP table shows the prefix 10.0.0.0/8 with next-hop 10.1.1.1 (R1's interface). However, R3 does not install this route in its routing table. The output of 'show ip route 10.0.0.0' on R3 shows no route. The engineer checks the routing table on R3 and sees that the interface connected to 10.1.1.0/24 is down. What is the most likely cause?

Accepted Answer

The next-hop 10.1.1.1 is not reachable because the directly connected interface is down.. For BGP to install a route, the next-hop must be reachable. If the interface to the next-hop is down, the route is considered unreachable and will not be installed.

Answer

The route is not installed because BGP synchronization is enabled.

Answer

The route is not installed because the prefix is being filtered by an inbound route-map on R3.

Answer

The route is not installed because the administrative distance of the route is too high.

Question 12

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Accepted Answer

The EEM applet is clearing the BGP session as part of its configured action.. The EEM applet is the root cause because it is configured to clear the BGP session upon a specific syslog event. The engineer should review the applet's trigger condition and action to identify why it is being triggered incorrectly or unnecessarily.

Answer

The BGP session is failing due to a physical layer issue.

Answer

The BGP session is failing due to a routing loop.

Answer

The EEM applet is causing a memory leak that crashes the BGP process.

Question 13

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 10.1.1.1, local AS number 65001
BGP table version is 15, main routing table version 15
2 network entries using 288 bytes of memory
2 path entries using 160 bytes of memory
2/1 BGP path/bestpath attribute entries using 288 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 736 total bytes of memory
BGP activity 4/2 prefixes, 4/2 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.12.2       4        65002    1023    1047       15    0    0 00:12:34        0
192.168.1.2     4        65003       0       0        0    0    0 never    Active

Based on this output, what is the problem with the BGP session to 192.168.1.2?

Accepted Answer

The BGP session to 192.168.1.2 has never been established and is in Active state, likely due to a lack of TCP connectivity.. The neighbor 192.168.1.2 is in Active state, meaning R1 is trying to establish a TCP connection but is not receiving a response. This could be due to reachability issues, incorrect AS number, or ACL blocking. The session has never been up (Up/Down: never).

Answer

The neighbor 192.168.1.2 is not reachable.

Answer

The neighbor 192.168.1.2 is in Idle state due to a misconfigured AS number.

Answer

The BGP session to 192.168.1.2 is established but not exchanging prefixes.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.1.1.0/24
BGP routing table entry for 10.1.1.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.1 from 0.0.0.0 (10.1.1.1)
      Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, which statement is correct?

Accepted Answer

The route 10.1.1.0/24 is locally originated and is the best path.. The output shows a locally originated network (10.1.1.0/24) with next hop 10.1.1.1 (the router itself). It is marked as valid, sourced, and best, meaning it is injected into BGP and will be advertised to peers.

Answer

The route 10.1.1.0/24 was learned from an eBGP peer.

Answer

The route 10.1.1.0/24 has a weight of 100.

Answer

The route 10.1.1.0/24 is not being advertised to any peer.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 10.1.12.2
BGP neighbor is 10.1.12.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.2.2.2
  BGP state = Idle
  Last read 00:00:00, last write 00:00:00, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Enhanced Refresh Capability: advertised
    Multisession Capability:
  State is never active
  Message statistics:
    InQ depth is 0
    OutQ depth is 0

Based on this output, what is the most likely cause of the BGP session being in Idle state?

Accepted Answer

The BGP neighbor is administratively shut down (neighbor shutdown).. Idle state typically indicates that BGP is not attempting to connect, often due to a configuration issue such as a missing neighbor statement, incorrect AS number, or a shutdown. The 'State is never active' suggests the session has never transitioned to Active, pointing to a configuration problem.

Answer

The neighbor 10.1.12.2 is not reachable via IP routing.

Answer

The remote AS number is misconfigured.

Answer

The BGP update timer is too long.

Question 16

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Accepted Answer

Modify the EEM applet trigger to match only the specific interfaces of interest.. The EEM applet is too broadly triggered, causing unnecessary syslog messages that may be interpreted as traps. The engineer should narrow the trigger condition to match only specific interfaces or use a more specific event filter.

Answer

Remove the EEM applet entirely.

Answer

Increase the debounce timer on the interface to reduce flapping.

Answer

Disable SNMP traps for interface state changes.

Question 17

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.2.2.0/24
BGP routing table entry for 10.2.2.0/24, version 5
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65002
    10.1.12.2 from 10.1.12.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is a potential issue with this route?

Accepted Answer

The route is not being advertised to any BGP peer, possibly due to outbound filtering.. The route is valid and best, but it is 'Not advertised to any peer'. This could be due to outbound filtering, such as a route-map, prefix-list, or the neighbor not being configured to receive the route. The route is learned from an eBGP peer but not being propagated.

Answer

The route has a low local preference of 100.

Answer

The next hop 10.1.12.2 is unreachable.

Answer

The route is not installed in the routing table.

Question 18

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.3.3.0/24
BGP routing table entry for 10.3.3.0/24, version 10
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65003 65004
    10.1.13.3 from 10.1.13.3 (10.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, external
      rx pathid: 0, tx pathid: 0
  Refresh Epoch 1
  65005
    10.1.15.5 from 10.1.15.5 (10.5.5.5)
      Origin IGP, metric 0, localpref 200, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, why is the path via 10.1.15.5 chosen as best?

Accepted Answer

Because it has a higher local preference of 200.. BGP selects the best path based on several criteria. Here, both paths are external, valid, and have the same weight (default 0). The path via 10.1.15.5 has a higher local preference (200 vs 100), which is the first tiebreaker after weight. Therefore, it is chosen as best.

Answer

Because it has a shorter AS path (65005 vs 65003 65004).

Answer

Because it has a lower metric (0 vs 0).

Answer

Because it was learned from a lower neighbor IP address.

Question 19

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Accepted Answer

The EEM applet runs before the router is fully booted, so the CLI commands fail.. The EEM applet uses the wrong event trigger. The 'SYS-5-RESTART' syslog message may not be generated or may be generated too early before the router is fully ready for configuration commands. The engineer should use 'event none' with a manual trigger or use 'event timer' to delay execution.

Answer

The EEM applet is not enabled globally.

Answer

The syslog pattern 'SYS-5-RESTART' is misspelled.

Answer

The EEM applet requires a 'event manager directory user' command to be configured.

Question 20

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.0.0.2
  BGP state = Idle
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Accepted Answer

The BGP neighbor is down, and the EEM policy may have been triggered.. The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Answer

The BGP neighbor is up and running.

Answer

The EEM policy is not registered.

Answer

The BGP session is established.