300-410 Practice Exam 51 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1 statistics

Flow Exporter: EXPORTER-1
  Packet send statistics (last 30 seconds):
    Packets sent: 0
    Packets dropped: 0
    Packets unsent: 0

Client send statistics:
    Packets sent: 0
    Packets dropped: 0
    Packets unsent: 0

Export statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped (no route): 0
    Number of Packets dropped (queue full): 0

Based on this output, what is the most likely cause of no exports?

Accepted Answer

The flow exporter is not referenced in any flow monitor, or the flow monitor is not attached to an interface.. The output shows zero packets sent, zero dropped, and zero unsent across all statistics, with no errors like unreachable destination or no route. This indicates the exporter is not being invoked at all, which typically means the flow exporter is not referenced by any flow monitor, or the flow monitor is not attached to an interface. Without that binding, no flows are exported.

Answer

The destination IP address is unreachable.

Answer

The UDP port is blocked by a firewall.

Answer

The source IP address is not configured on any interface.

Question 2

Given the following configuration on Router R2:

router eigrp 200
 redistribute ospf 1 metric 10000 100 255 1 1500
 default-metric 10000 100 255 1 1500

What is the effect of having both the 'metric' keyword in the redistribute command and the 'default-metric' command?

Accepted Answer

The 'metric' keyword overrides the default-metric for routes redistributed from OSPF into EIGRP.. The 'metric' keyword in the redistribute command explicitly sets the seed metric for routes redistributed from OSPF into EIGRP. When both the 'metric' keyword and the 'default-metric' command are present, the 'metric' keyword takes precedence for that specific redistribution. The 'default-metric' command only applies when no metric is specified in the redistribute command.

Answer

The 'metric' keyword is ignored; the default-metric is used for all redistributed routes.

Answer

Both metrics are applied, causing a conflict and potential routing issues.

Answer

The default-metric command is not needed and can be removed without any effect.

Question 3

An engineer configures an EEM applet to monitor DMVPN tunnel events using the event syslog pattern 'NHRP-3-REGISTRATION'. The applet is supposed to send an email when a spoke registers with the NHS. The DMVPN network uses Phase 2 with spoke-to-spoke tunnels. A spoke registers successfully, but the EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

Successful NHRP registration generates a syslog message with severity 6 (informational), not severity 3 (error).. The EEM applet uses 'event syslog pattern NHRP-3-REGISTRATION', which matches syslog messages with facility NHRP and severity level 3 (error). However, a successful NHRP registration generates a syslog message with severity 6 (informational), typically 'NHRP-6-REGISTRATION' or similar. Since the pattern specifies severity 3, the applet never matches the actual informational message, so it does not trigger.

Answer

The EEM applet must be configured with 'event nhrp' to capture NHRP events.

Answer

The DMVPN Phase 2 does not generate syslog messages for spoke registration.

Answer

The NHS must be configured with 'ip nhrp registration no-syslog' to suppress messages.

Question 4

A network engineer configures CoPP to protect the control plane, but after redistributing routes, some legitimate routing updates are dropped. Router R1 config:
control-plane
 service-policy input COPP
!
class-map match-all ROUTING
 match access-group name ROUTING
!
policy-map COPP
 class ROUTING
  police 100000 15000 15000 conform-action transmit exceed-action drop
!
access-list ROUTING permit tcp any any eq bgp
access-list ROUTING permit udp any any eq 520
access-list ROUTING permit ospf any any

R1# show policy-map control-plane input
  Class-map: ROUTING (match-all)
    100 packets, 10000 bytes
    5 minute offered rate 0 bps
    drop rate 0 bps
  Match: access-group name ROUTING
  police:
      cir 100000 bps, bc 15000 bytes, be 15000 bytes
    conformed 90 packets, 9000 bytes; actions: transmit
    exceeded 10 packets, 1000 bytes; actions: drop

What is the root cause?

Accepted Answer

The CoPP police rate is too low for the volume of routing updates during redistribution, causing drops.. The output shows that 10 packets were exceeded and dropped by the policer. The CoPP policy is configured with a committed information rate (CIR) of 100000 bps (100 kbps), which is relatively low for routing updates during redistribution. When routes are redistributed, there can be a burst of routing protocol packets (BGP, OSPF, etc.) that exceeds this rate, causing the policer to drop legitimate updates. The root cause is that the police rate is too low for the volume of routing updates.

Answer

The access-list is missing EIGRP protocol, causing EIGRP packets to be dropped.

Answer

The class-map is match-all, which requires all conditions to match, but only one ACL is present.

Answer

The policy-map is applied to the input of the control-plane, but redistribution uses output.

Question 5

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy configuration TRACK-INTERFACE

Applet TRACK-INTERFACE
  event syslog pattern "OSPF-5-ADJCHG"
  action 1.0 cli command "show ip route"
  action 2.0 cli command "show ip ospf neighbor"
  action 3.0 syslog msg "OSPF adjacency change detected"

What does this output indicate?

Accepted Answer

The applet 'TRACK-INTERFACE' is configured to trigger on syslog message 'OSPF-5-ADJCHG' and execute three actions in order: show ip route, show ip ospf neighbor, and send a syslog message.. The output shows the configuration of a specific EEM applet. It displays the event trigger and the actions in order. Each action has a step number (e.g., 1.0) that determines the order of execution. This is useful for verifying the applet configuration.

Answer

The applet 'TRACK-INTERFACE' is currently executing and has run the first two actions.

Answer

The applet 'TRACK-INTERFACE' has a syntax error because the actions are not numbered correctly.

Answer

The applet 'TRACK-INTERFACE' will only execute the first action because the others are commented out.

Question 6

An engineer configures iBGP between two routers in the same AS. The BGP table shows the prefix, but it is not installed in the routing table. The next-hop is reachable via an IGP route. Which is the most likely explanation?

Accepted Answer

BGP synchronization is enabled, and the prefix is not present in the IGP.. When BGP synchronization is enabled, the router will not install an iBGP-learned prefix into the routing table unless the same prefix is also present in the IGP (e.g., OSPF or EIGRP). Since the next-hop is reachable via IGP but the prefix itself is not in the IGP, the synchronization rule blocks the route from being installed. This is a classic scenario where the BGP table shows the prefix, but it is missing from the routing table.

Answer

The next-hop-self command is missing on the iBGP peer.

Answer

The prefix is filtered by an inbound route-map.

Answer

The maximum-paths limit is exceeded.

Question 7

Examine the following partial MPLS configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 10.0.1.1 255.255.255.252
 mpls ip
 mpls label protocol ldp
!
router ospf 1
 network 10.0.1.0 0.0.0.3 area 0
!
mpls ldp router-id Loopback0 force

What is the effect of this configuration?

Accepted Answer

LDP will establish a session with the neighbor on GigabitEthernet0/0, using Loopback0 as the transport address.. The command 'mpls ldp router-id Loopback0 force' forces LDP to use the Loopback0 interface address as the LDP router ID, which becomes the transport address for the LDP session. Because the interface has 'mpls ip' and 'mpls label protocol ldp' enabled and OSPF advertises the connected subnet, LDP will form a session with the directly connected neighbor on GigabitEthernet0/0 using that loopback-derived transport address.

Answer

LDP will use the IP address of GigabitEthernet0/0 as the router ID because 'force' is not valid.

Answer

LDP sessions will fail because OSPF is not redistributed into LDP.

Answer

MPLS forwarding will not occur because 'mpls label protocol ldp' is redundant and causes a conflict.

Question 8

Which of the following is a limitation of local SPAN on a Cisco switch?

Accepted Answer

It cannot mirror traffic to a remote switch.. Local SPAN (Switched Port Analyzer) on a Cisco switch can only mirror traffic to a destination port on the same switch — it cannot forward mirrored traffic across the network to a remote switch. Remote SPAN (RSPAN) or Encapsulated Remote SPAN (ERSPAN) is required for that. This is a fundamental limitation of local SPAN.

Answer

It can only monitor one source interface per session.

Answer

The destination port must be in the same VLAN as the source.

Answer

It cannot monitor both ingress and egress traffic simultaneously.

Question 9

What is the default behavior of BGP synchronization in Cisco IOS-XE?

Accepted Answer

Disabled by default. In Cisco IOS and IOS-XE, BGP synchronization is disabled by default. Historically it was enabled to prevent advertising iBGP-learned routes until they were confirmed via IGP, but modern designs (especially with full iBGP meshes or route reflectors) made it obsolete, so Cisco disabled it by default. Administrators must explicitly enable it with the synchronization command under router bgp if needed.

Answer

Enabled by default

Answer

Enabled only for iBGP

Answer

Disabled only for eBGP

Question 10

Which of the following is a limitation of NAT as defined in RFC 2663?

Accepted Answer

NAT breaks end-to-end IP connectivity and can interfere with application-layer protocols.. RFC 2663 defines NAT as a mechanism that modifies IP addresses and/or ports in packet headers, which inherently breaks the end-to-end IP connectivity model. This modification can interfere with application-layer protocols that embed IP addresses or port numbers in their payload, such as FTP, SIP, or DNS, because NAT does not automatically translate these embedded addresses.

Answer

NAT cannot translate UDP traffic.

Answer

NAT is incompatible with TCP traffic.

Answer

NAT requires all traffic to be encrypted.

Question 11

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.

Answer

The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.

Answer

The 'ip nat pool' command is required for all PAT configurations.

Question 12

An engineer configures DMVPN Phase 2 with spoke-to-spoke tunnels. Spokes can ping each other's physical interfaces, but cannot establish a direct tunnel. NHRP registration is successful. Which is the most likely explanation?

Accepted Answer

The hub is not configured with 'ip nhrp redirect' and the spokes are not configured with 'ip nhrp shortcut'.. In DMVPN Phase 2, spoke-to-spoke tunnels require NHRP redirect and shortcut mechanisms to dynamically build direct tunnels. The hub must be configured with 'ip nhrp redirect' to send redirect messages to spokes, and spokes must have 'ip nhrp shortcut' to install the NHRP-learned /32 host routes for direct traffic. Without these, spokes will forward traffic through the hub even though they can ping each other's physical interfaces, preventing the establishment of a direct tunnel.

Answer

The spokes have different NHRP authentication strings, causing NHRP resolution to fail.

Answer

The tunnel interface on the spokes is configured with 'tunnel mode gre multipoint' but the hub uses 'tunnel mode gre ip'.

Answer

The spokes are using different IPsec transform sets, causing the IPsec tunnel to fail.

Question 13

Drag and drop the steps to verify and validate the EIGRP operational state into the correct order, from first to last.

Accepted Answer

Display EIGRP process status with show ip eigrp interfaces. Begin by checking the overall EIGRP process status, then verify the neighbor table for adjacency, examine the topology table for feasible successors, review the routing table for installed routes, and finally use debug commands to validate ongoing operations if needed.

Question 14

What is the default hello interval for OSPFv3 on a broadcast network type in Cisco IOS-XE?

Accepted Answer

10 seconds. OSPFv3 uses the same default hello interval as OSPFv2 for broadcast and point-to-point network types, which is 10 seconds. This is defined in RFC 5340 and is the default on Cisco IOS-XE for OSPFv3 on broadcast networks.

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 15

Drag and drop the steps to verify and validate VRF-Lite operational state into the correct order, from first to last.

Accepted Answer

Display all VRFs with show vrf brief. Begin by listing all configured VRFs. Then confirm which interfaces belong to each VRF. Next, check the VRF-specific routing table for expected routes. After that, test reachability to a remote destination within the VRF. Finally, validate end-to-end connectivity with extended ping or traceroute using the VRF.

Question 16

Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.

Accepted Answer

Ping peer IP to confirm reachability. Start by verifying basic IP connectivity between peers, then check that the crypto isakmp policy and IKE proposals match. Next, confirm tunnel interface configuration and ACLs, then inspect IKE and IPsec SA states. Finally, enable debugs to isolate the specific failure.

Question 17

Consider the following partial configuration on router R6:

flow exporter EXPORTER-3
 destination 192.168.2.200
 source Loopback0
 transport udp 2055
 template data timeout 120
!
flow monitor MONITOR-6
 exporter EXPORTER-3
 record netflow ipv4 original-input
!
interface GigabitEthernet0/6
 ip flow monitor MONITOR-6 input
!

What is the effect of the 'template data timeout 120' command?

Accepted Answer

The router will resend the NetFlow v9 template to the collector every 120 seconds to ensure the collector has the latest template.. The 'template data timeout 120' command under the flow exporter configuration sets the refresh interval for NetFlow v9 (or IPFIX) templates to 120 seconds. Because NetFlow v9/IPFIX templates are sent periodically (not on every packet), the exporter re-transmits the template to the collector every 120 seconds so the collector can continue to decode flow records even if it missed the initial template or restarted. This ensures template freshness and collector synchronization.

Answer

The router will wait 120 seconds before sending any flow data after the first template is sent.

Answer

The router will export flow data only if the template has been successfully acknowledged by the collector within 120 seconds.

Answer

The router will store flow data for 120 seconds before exporting to allow batching.

Question 18

Two routers are configured with EIGRP and have a neighbor relationship. One router has a route to 192.168.1.0/24 with metric 100. The other router has a route to the same prefix with metric 200. An engineer configures an offset-list on the first router to increase the metric of 192.168.1.0/24 by 50, expecting the second router to prefer its own route. Unexpectedly, the second router still prefers the first router's route after the offset. Which is the most likely explanation?

Accepted Answer

The offset-list increased the metric from 100 to 150, which is still lower than the second router's metric of 200, so the second router still prefers the first router's route.. The offset-list adds 50 to the metric of the matched route on the first router, changing its advertised metric from 100 to 150. Since 150 is still lower than the second router's local metric of 200, the second router continues to prefer the route learned from the first router. The offset was insufficient to make the second router's own route preferable.

Answer

The offset-list must be applied inbound on the second router to increase the metric of the received route.

Answer

The offset-list command only affects feasible distance, not advertised distance, so the second router ignores it.

Answer

The second router has a higher administrative distance for the route, so it always prefers the first router's route.

Question 19

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla application

IP Service Level Agreements
Version: 2.0

IP SLAs Responder: Disabled
   IP SLAs Low Memory: Disabled
   IP SLAs ICMP Echo: Enabled
   IP SLAs ICMP Jitter: Enabled
   IP SLAs HTTP: Disabled
   IP SLAs FTP: Disabled
   IP SLAs UDP Jitter: Enabled
   IP SLAs TCP Connect: Enabled
   IP SLAs DNS: Disabled
   IP SLAs DHCP: Disabled
   IP SLAs DLSw: Disabled
   IP SLAs VoIP: Disabled
   IP SLAs Metro Ethernet: Disabled
   IP SLAs Video: Disabled
   IP SLAs LSP: Disabled
   IP SLAs LSP Group: Disabled
   IP SLAs VPLS: Disabled
   IP SLAs MPLS: Disabled
   IP SLAs MPLS Group: Disabled
   IP SLAs LDP: Disabled
   IP SLAs LDP Group: Disabled
   IP SLAs BFD: Disabled

What does this output indicate?

Accepted Answer

The device supports ICMP Echo, ICMP Jitter, UDP Jitter, and TCP Connect probes.. The output of 'show ip sla application' lists the IP SLA features and their status. The lines 'IP SLAs ICMP Echo: Enabled', 'IP SLAs ICMP Jitter: Enabled', 'IP SLAs UDP Jitter: Enabled', and 'IP SLAs TCP Connect: Enabled' indicate that these probe types are supported and enabled on the device. Therefore, the device supports these probe types.

Answer

The IP SLA responder is enabled, allowing the device to respond to probes.

Answer

All IP SLA operations are disabled on this device.

Answer

The device is running low on memory and cannot support IP SLA.

Question 20

Consider the following partial configuration on router R4:

flow exporter EXPORTER-2
 destination 10.10.10.1
 source Loopback0
 transport udp 9996
 option interface-table
 option sampler-table
!
flow monitor MONITOR-4
 exporter EXPORTER-2
 record netflow ipv4 original-input
!
interface GigabitEthernet0/4
 ip flow monitor MONITOR-4 input
!

What is the purpose of the 'option interface-table' and 'option sampler-table' commands under the exporter?

Accepted Answer

They instruct the router to periodically export metadata about interfaces and samplers to the collector, aiding in data interpretation.. The 'option interface-table' and 'option sampler-table' commands under a flow exporter enable the periodic export of metadata about interfaces and samplers to the NetFlow collector. This metadata is sent as separate option template records, allowing the collector to correctly interpret flow records that reference interface indices or sampler IDs. Without these options, the collector would receive flow data but lack the mapping to resolve interface names or sampling parameters, reducing the usefulness of the exported flows.

Answer

They enable the router to sample traffic based on interface and sampler tables before exporting.

Answer

They limit the export to only interface and sampler statistics, ignoring flow records.

Answer

They are required for the exporter to function; without them, no data is exported.