300-410 Practice Exam 51 — 20 Questions

Question 1

A large enterprise uses IP SLA to track a route to a remote site via an MPLS L3VPN. Router R1 (PE) has:

ip sla 8
 icmp-echo 10.10.10.10 source-ip 192.168.1.1
 frequency 10
ip sla schedule 8 life forever start-time now

track 8 ip sla 8 reachability

ip route vrf CUSTOMER 10.10.10.0 255.255.255.0 192.168.1.2 track 8

The MPLS network is operational, but the route is intermittently removed. Show output on R1:

show ip route vrf CUSTOMER 10.10.10.0
Routing entry for 10.10.10.0/24
  Known via "static", distance 1, metric 0
  Last update from 192.168.1.2 on GigabitEthernet0/0
  * 192.168.1.2, via GigabitEthernet0/0

But the track is down:

show track 8
Track 8
  IP SLA 8 reachability
  Reachability is Down
  3 changes, last change 00:00:15

What is the root cause?

Accepted Answer

The IP SLA is not configured with the vrf CUSTOMER keyword, so the probe is sent in the global table and cannot reach the target in the VRF.. The IP SLA probe is sent to 10.10.10.10, but the source IP is 192.168.1.1. In an MPLS L3VPN, the VRF CUSTOMER might have a different routing table. The probe is sent in the global table unless configured with vrf. The correct answer is that the IP SLA is not VRF-aware, so the probe fails, but the static route is still installed because the track is down but the route is not removed immediately due to the delay or because the route is still in the table from a previous state.

Answer

The MPLS label distribution is failing, causing the IP SLA probe to be dropped.

Answer

The source IP 192.168.1.1 is not in the VRF CUSTOMER, so the probe cannot be sourced correctly.

Answer

The track 8 is not supported for VRF routes.

Question 2

A network engineer runs the following command to troubleshoot SNMP access control:

R1# show snmp view
v1default - includes all objects up to OID 1.3.6.1.2.1.1
v1system - includes system MIB only (1.3.6.1.2.1.1)

What does this output indicate?

Accepted Answer

Two SNMP views are configured: 'v1default' with broader access and 'v1system' limited to the system MIB.. The output from 'show snmp view' lists two views: 'v1default' includes objects up to OID 1.3.6.1.2.1.1 (system MIB), and 'v1system' is explicitly limited to the system MIB. This indicates that 'v1default' has broader access than 'v1system', but neither includes all MIB objects. Option A correctly describes this configuration.

Answer

The router uses SNMPv3 views exclusively.

Answer

The 'v1default' view includes all MIB objects.

Answer

No views are configured, so SNMP access is denied.

Question 3

A network engineer is troubleshooting an IPv6 routing issue on a router that is receiving OSPFv3 routes from multiple neighbors. The engineer notices that some routes are missing from the routing table. The engineer checks the interface configuration and finds an inbound IPv6 ACL applied to the interface that permits only specific prefixes. The engineer also notices that the missing routes are from a neighbor that is sending routes with a prefix length of /48, while the ACL permits only /64 prefixes. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is filtering the OSPFv3 routes based on prefix length, and the /48 routes are not permitted.. The inbound IPv6 ACL on the interface is filtering OSPFv3 routes based on prefix length. Since the ACL permits only /64 prefixes, any routes with a /48 prefix length are denied and not installed in the routing table. This is the most likely cause of the missing routes.

Answer

The OSPFv3 neighbor relationship is down due to a mismatched area ID.

Answer

The router has a route-map that is denying the /48 routes before they are installed.

Answer

The IPv6 ACL is applied outbound, blocking the routes from being sent.

Question 4

Examine this configuration:

interface GigabitEthernet0/4
 ipv6 address 2001:db8:2::1/64
 ipv6 verify unicast source reachable-via any

What is the effect of the 'ipv6 verify unicast source reachable-via any' command?

Accepted Answer

The router performs loose uRPF: the source address must be reachable via any route in the FIB.. The command 'ipv6 verify unicast source reachable-via any' enables loose unicast Reverse Path Forwarding (uRPF) for IPv6. In loose mode, the router checks that the source address of an incoming packet is reachable via any route in the Forwarding Information Base (FIB), not necessarily through the receiving interface. This is the correct behavior described in option B.

Answer

The router performs strict uRPF: the source address must be reachable via the same interface the packet arrived on.

Answer

The router drops all packets with source addresses not in the same subnet as the interface.

Answer

The command is invalid because 'ipv6 verify unicast' requires a route-map.

Question 5

In an MPLS network, Router R1 is a provider edge (PE) router that redistributes BGP routes into OSPF. The network experiences intermittent loss of reachability to a specific prefix 10.10.10.0/24. R1 configuration includes: 'router ospf 1 redistribute bgp 65000 subnets metric-type 1' and 'router bgp 65000 neighbor 10.0.0.2 route-map SET-METRIC in' with a route-map that sets metric 100. R2, a P router, shows 'show ip route 10.10.10.0' output: 'O E1 10.10.10.0/24 [110/20] via 10.0.0.1, 00:00:15' but traffic fails. What is the root cause?

Accepted Answer

The OSPF redistribute command lacks the 'metric' keyword to use the BGP metric; default metric 20 is used, causing inconsistency.. The route-map applied to BGP inbound sets metric 100, but redistribution into OSPF uses the BGP metric as the OSPF cost. However, OSPF external route cost is calculated as metric-type 1 cost plus internal cost to the ASBR. The OSPF cost of 20 indicates the BGP metric is not being used correctly; instead, the default metric of 20 is applied because the 'metric' keyword is missing in the redistribute command, causing suboptimal path and potential blackholing due to metric mismatch.

Answer

The route-map SET-METRIC is not applied to the correct neighbor direction; it should be outbound.

Answer

The OSPF network type mismatch on the link between R1 and R2 causes adjacency issues.

Answer

The BGP neighbor 10.0.0.2 is not reachable due to ACL blocking.

Question 6

Two routers R1 and R2 are connected via a FastEthernet link. OSPF is configured on both with network type broadcast. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR. R2 shows: 'show ip ospf neighbor' lists R1 as FULL/BDR. However, pings between loopback interfaces on R1 and R2 fail intermittently. 'show ip route' on R1 shows the loopback of R2 as reachable via OSPF, but 'show ip ospf interface' on R1 shows the link as point-to-point. What is the root cause?

Accepted Answer

One router has 'ip ospf network point-to-point' configured, while the other uses the default broadcast, causing a mismatch in the network type.. The root cause is a mismatch in OSPF network type between R1 and R2. R1's 'show ip ospf interface' shows the link as point-to-point, indicating that 'ip ospf network point-to-point' is configured on R1, while R2 uses the default broadcast type. This mismatch causes R1 to not send OSPF hello packets with the correct multicast address (224.0.0.5 for point-to-point vs. 224.0.0.6 for broadcast DR/BDR election), leading to intermittent connectivity and the observed neighbor states (FULL/DR and FULL/BDR) that appear correct but are actually unstable.

Answer

The FastEthernet interface is operating at half-duplex, causing packet loss.

Answer

OSPF hello and dead timers are mismatched, preventing adjacency formation.

Answer

The MTU on the link is mismatched, causing OSPF packets to be dropped.

Question 7

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# debug ip packet 100 detail
IP packet debugging is on for access list 100
*Mar  1 00:12:34.567: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto UDP, flags 0x0, sport 12345, dport 80, access list 100: matched line 10 permit udp host 10.1.1.1 host 10.2.2.2 eq 80
*Mar  1 00:12:35.123: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x2, sport 12346, dport 443, access list 100: matched line 20 deny tcp host 10.1.1.1 host 10.2.2.2 eq 443
*Mar  1 00:12:35.124: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x10, sport 12346, dport 443, access list 100: matched line 20 deny tcp host 10.1.1.1 host 10.2.2.2 eq 443

What does this output indicate?

Accepted Answer

The ACL is applied inbound on GigabitEthernet0/0 and is permitting UDP traffic to port 80 while denying TCP traffic to port 443.. The debug output shows packets entering GigabitEthernet0/0 (source interface) and matching ACL 100. The first packet (UDP to port 80) matches line 10 (permit), while subsequent TCP packets to port 443 match line 20 (deny). Since the source interface is the inbound interface, the ACL is applied inbound. This confirms Option A: the ACL permits UDP to port 80 and denies TCP to port 443.

Answer

The ACL is applied outbound on GigabitEthernet0/0 and is permitting all traffic.

Answer

The ACL is misconfigured because TCP traffic to port 443 should be permitted.

Answer

The ACL is not applied to any interface because debug ip packet shows only the ACL number.

Question 8

A network administrator configures 'ipv6 dhcp guard' on a switch and sets the policy to 'allow only' for a specific DHCPv6 server. However, clients are still receiving DHCPv6 replies from a rogue server on the same VLAN. The engineer verifies that the rogue server's port is not trusted. What is the most likely reason the rogue server's advertisements are not being blocked?

Accepted Answer

IPv6 snooping is not enabled globally, so DHCPv6 Guard cannot inspect DHCPv6 messages.. DHCPv6 Guard relies on IPv6 snooping (also known as DHCPv6 snooping) to inspect DHCPv6 messages and enforce policies. If IPv6 snooping is not enabled globally on the switch, DHCPv6 Guard has no binding database or inspection mechanism to identify and block rogue DHCPv6 replies, even if the policy is configured and the rogue port is untrusted. The 'ipv6 dhcp guard' command alone is insufficient without the underlying snooping framework.

Answer

The rogue server is using a different UDP port for DHCPv6.

Answer

The 'allow only' policy only works for DHCPv6 requests, not replies.

Answer

The rogue server is on a trunk port, and DHCPv6 Guard does not apply to trunk ports.

Question 9

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip policy
Interface   Route-map
FastEthernet0/0  PBR-MAP

What does this output indicate?

Accepted Answer

PBR is enabled on FastEthernet0/0 with route-map PBR-MAP.. The output shows that PBR is applied on FastEthernet0/0 using route-map PBR-MAP. This confirms the interface-level configuration.

Answer

The route-map PBR-MAP is not configured.

Answer

PBR is applied globally and on the interface.

Answer

The route-map is applied to all interfaces.

Question 10

A DMVPN Phase 2 network is configured with EIGRP as the routing protocol over the tunnel interface. Spoke routers have `no ip split-horizon eigrp 100` configured on the tunnel interface. Unexpectedly, spoke-to-spoke tunnels are established, but EIGRP routes learned from one spoke are not installed in the routing table of another spoke, even though NHRP resolution works. Which is the most likely explanation?

Accepted Answer

The hub router has `ip next-hop-self eigrp 100` enabled by default, which sets the next-hop to the hub, preventing direct spoke-to-spoke routes.. In DMVPN Phase 2, spoke-to-spoke tunnels require that EIGRP next-hop self behavior is disabled or that the next-hop is changed. By default, EIGRP advertises routes with the next-hop set to the advertising router's tunnel IP. When a spoke learns a route from another spoke via the hub, the next-hop is the hub's tunnel IP, not the originating spoke. The spoke must have `no ip next-hop-self eigrp 100` on the hub's tunnel interface to preserve the original next-hop, allowing direct spoke-to-spoke communication.

Answer

The spoke routers need `ip split-horizon eigrp 100` enabled to advertise routes to other spokes.

Answer

EIGRP does not support DMVPN Phase 2; OSPF must be used for spoke-to-spoke routing.

Answer

The NHRP authentication is mismatched, so EIGRP packets are dropped.

Question 11

An ACL implicit deny is blocking management traffic due to route summarization. Router R1 has:
access-list 100 permit ip 10.0.0.0 0.0.3.255 any
!
interface GigabitEthernet0/0
 ip access-group 100 in
!
router eigrp 100
 network 10.0.0.0
!
R1 also has:
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip summary-address eigrp 100 10.0.0.0 255.255.252.0
!
A management station at 10.0.1.100 cannot SSH to R1's loopback 0 (10.0.0.1). What is the root cause?

Accepted Answer

The summary route changes the return path for traffic to the management station, and the return interface has an ACL with implicit deny blocking the SSH reply.. The ACL permits traffic from 10.0.0.0/22 (10.0.0.0-10.0.3.255) to any, but the summary route is also 10.0.0.0/22. However, the ACL is applied inbound on GigabitEthernet0/0. The management station's traffic comes from 10.0.1.100, which is within the permitted range, so the ACL should allow it. But the summary route may cause the return traffic to be sent via a different interface, and if that interface has an ACL with implicit deny, the SSH session fails. The root cause is that the summary route changes the path, and the return path has an ACL blocking traffic.

Answer

The ACL does not permit SSH traffic (port 22).

Answer

The summary route is not installed, so traffic is dropped.

Answer

EIGRP is not advertising the loopback route.

Question 12

What is the default administrative distance for a route learned via the Routing Information Protocol (RIP)?

Accepted Answer

120. RIP routes have a default administrative distance of 120.

Answer

100

Answer

110

Answer

130

Question 13

An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?

Accepted Answer

The hostname and domain name are not configured.. SSH requires a fully qualified domain name (FQDN) to generate RSA keys. Without a configured hostname and domain name, the 'crypto key generate rsa' command may appear to succeed but actually generates default keys that are not bound to the router's identity, causing SSH to refuse connections. The 'ip domain-name' and 'hostname' commands are prerequisites for proper RSA key generation and SSH operation.

Answer

The VTY lines are not configured with 'transport input ssh'.

Answer

The RSA key modulus is too small.

Answer

The IP address on GigabitEthernet0/0 is not in the same subnet as the client.

Question 14

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, the router's CPU spikes and routing loops occur. Which is the most likely explanation?

Accepted Answer

Routes redistributed from OSPF into EIGRP are then redistributed back into OSPF, creating a feedback loop.. Mutual redistribution without route tagging or filtering can cause a routing loop. A route redistributed from OSPF into EIGRP can be redistributed back into OSPF, creating a feedback loop. This is a classic redistribution loop.

Answer

The seed metric for EIGRP was not configured, causing the route to be redistributed with an infinite metric.

Answer

The administrative distance of the redistributed routes is lower than the original, causing them to be preferred.

Answer

The OSPF process ID must match on all routers; otherwise, redistribution fails.

Question 15

A network engineer runs the following command to troubleshoot an RSPAN issue:

R1# show monitor session 2 detail
Session 2
---------
Type                   : Remote Source Session
Source Ports           : 
    Both               : Gi0/0
Destination RSPAN VLAN : 100

What does this output indicate?

Accepted Answer

The session is correctly configured as an RSPAN source session.. The output shows an RSPAN source session with source port Gi0/0 and destination RSPAN VLAN 100. This is the source side of an RSPAN configuration.

Answer

The session is misconfigured because the destination must be a port, not a VLAN.

Answer

The session is misconfigured because the source port must be a VLAN.

Answer

The session is misconfigured because the RSPAN VLAN must be configured as a remote-span VLAN.

Question 16

A DMVPN network uses IPv6 with EIGRP as the routing protocol. Spoke routers R2 and R3 are behind NAT and use mGRE tunnels. The hub R1 has an IPv6 ACL applied inbound on the tunnel interface that permits only EIGRP and denies all other IPv6 traffic. Spoke-to-spoke traffic fails even though direct tunnels are established. R2 shows 'ping 2001:db8:3::1 source loopback0' fails, but 'ping 2001:db8:1::1' (hub) succeeds. What is the root cause?

Accepted Answer

R1's inbound ACL on the tunnel interface permits only EIGRP, dropping all other traffic including spoke-to-spoke data packets.. The hub router R1 has an inbound IPv6 ACL on its tunnel interface that permits only EIGRP traffic and denies all other IPv6 traffic. When spoke R2 attempts to send data (e.g., ping) directly to spoke R3, the packets are routed through the hub because the spokes do not have a direct route to each other's loopback addresses. Even though a direct mGRE tunnel exists between spokes, the data packets must first reach the hub, which drops them due to the ACL, causing spoke-to-spoke communication failure.

Answer

NAT traversal is broken for spoke-to-spoke traffic due to IPsec encryption issues.

Answer

EIGRP is not advertising spoke loopbacks to other spokes, causing no route.

Answer

The mGRE tunnel on R2 does not have a destination for R3, preventing direct communication.

Question 17

What is the default SNMP community string on a Cisco IOS device that has not been configured with any SNMP commands?

Accepted Answer

No default community string exists; SNMP is disabled.. By default, Cisco IOS devices have no SNMP community strings configured because SNMP is disabled until explicitly enabled with the 'snmp-server community' command. Without any SNMP configuration, the device does not respond to SNMP requests, making option D correct. This aligns with Cisco's security best practices to avoid exposing management access unintentionally.

Answer

public

Answer

private

Answer

cisco

Question 18

Which statement correctly describes the default behavior of EIGRP auto-summary on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, so subnets are advertised without summarization.. In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without summarizing them to their classful boundaries, preserving the original prefix lengths. This behavior changed from older IOS versions where auto-summary was enabled by default, which could cause routing issues in discontiguous networks.

Answer

Auto-summary is enabled by default, summarizing classful boundaries.

Answer

Auto-summary is enabled only for EIGRP named mode configurations.

Answer

Auto-summary is disabled by default, but only for IPv6 EIGRP.

Question 19

An engineer configures CoPP on a router with the following policy: class-map match-any PROTECT, match protocol ospf, police 1000 pps; class class-default, police 500 pps. After applying, OSPF neighbors form, but the router's CPU utilization remains high. Which is the most likely explanation?

Accepted Answer

The class-default police rate is too low, causing ARP packets to be dropped, but CPU is high due to the policing overhead.. The class-default police rate of 500 pps is too low to handle essential control-plane traffic like ARP, which falls into class-default. When ARP packets are dropped, the router must retry ARP resolution, generating additional CPU overhead from policing and retransmissions, keeping CPU utilization high. OSPF neighbors form because OSPF traffic is explicitly protected in the PROTECT class with a 1000 pps policer, but the underlying ARP starvation causes CPU strain.

Answer

OSPF traffic is being policed to 1000 pps, which is too high, causing CPU overload.

Answer

CoPP only works on hardware-switched platforms, not software.

Answer

The class-default should have a higher rate than the OSPF class.

Question 20

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip interface GigabitEthernet0/0 | include access list
  Outgoing access list is 102
  Inbound access list is not set

Then the engineer checks:
R1# show ip access-lists 102
Extended IP access list 102
    10 deny tcp any any eq 23
    20 permit ip any any

What does this output indicate?

Accepted Answer

ACL 102 is applied outbound on GigabitEthernet0/0, denying Telnet traffic and permitting all other traffic.. The output of 'show ip interface GigabitEthernet0/0 | include access list' shows 'Outgoing access list is 102', which means ACL 102 is applied in the outbound direction on that interface. The ACL itself contains a deny statement for TCP traffic destined to port 23 (Telnet) followed by a permit ip any any, so it denies Telnet traffic while permitting all other IP traffic. Option A correctly summarizes this behavior.

Answer

ACL 102 is applied inbound on GigabitEthernet0/0, blocking Telnet.

Answer

ACL 102 is not applied to any interface.

Answer

ACL 102 is applied inbound and outbound on GigabitEthernet0/0.