300-410 Practice Exam 52 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 advertised-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 2

Based on this output, what can be concluded about the route 10.2.2.0/24?

Accepted Answer

The route 10.2.2.0/24 is being advertised back to the neighbor from which it was learned, which is incorrect.. The route 10.2.2.0/24 is being advertised to the neighbor 10.1.12.2 with next hop 10.1.12.2 itself. This indicates that R1 is advertising a route it learned from the same neighbor back to it, which is a classic case of BGP split-horizon or route advertisement causing a potential loop. However, since it is advertised, it may be due to missing AS-path filtering or a misconfiguration.

Answer

The route 10.2.2.0/24 is locally originated.

Answer

The route 10.2.2.0/24 has a weight of 0.

Answer

The route 10.2.2.0/24 is not valid.

Question 2

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Accepted Answer

Use the 'show event manager statistics' command to see which applets are triggered most often.. High CPU from EEM is often due to excessive syslog triggers. The engineer should first identify which applets are being triggered most frequently and either optimize their conditions or reduce the number of applets.

Answer

Disable all EEM applets.

Answer

Increase the router's CPU priority for the EEM process.

Answer

Change the syslog trigger to use a less frequent pattern.

Question 3

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.4.4.0/24
BGP routing table entry for 10.4.4.0/24, version 8
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65006
    10.1.16.6 from 10.1.16.6 (10.6.6.6)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is the most likely reason the route is not advertised to any peer?

Accepted Answer

There is an outbound route-map or prefix-list filtering the route.. The route is valid and best, but not advertised. This could be due to outbound filtering (route-map, prefix-list) applied to the BGP neighbor, or the neighbor might not be configured to receive this prefix. Another possibility is that the route is suppressed by a policy.

Answer

The route has a local preference of 100, which is too low.

Answer

The BGP session to the neighbor is down.

Answer

The route is not in the routing table.

Question 4

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Accepted Answer

The SNMP trap destination is not configured globally.. The EEM applet is triggered by a syslog message, but the syslog message may not be generated for that specific interface, or the SNMP trap action may require additional configuration such as an SNMP community or target host.

Answer

The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.

Answer

The EEM applet is not registered with the SNMP agent.

Answer

The SNMP trap action requires an SNMP community string to be specified in the applet.

Question 5

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 received-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 1

Based on this output, what can be inferred about the BGP session?

Accepted Answer

The BGP session is established and the neighbor is advertising one prefix.. The output shows that R1 has received one prefix (10.2.2.0/24) from neighbor 10.1.12.2. The prefix is valid and best. This indicates the BGP session is established and exchanging routes.

Answer

The BGP session is not established.

Answer

The BGP session is in Active state.

Answer

The BGP session is in Idle state.

Question 6

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Accepted Answer

The regex pattern in the applet does not match the syslog message.. The EEM applet may have a regex that does not match the actual syslog message format. The engineer should verify the regex pattern using 'show event manager policy' or test the pattern.

Answer

The EEM applet is disabled.

Answer

The syslog message is not being sent to the EEM server due to logging level restrictions.

Answer

The interface is not being monitored because it is a subinterface.

Question 7

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.5.5.0/24
BGP routing table entry for 10.5.5.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65007
    10.1.17.7 from 10.1.17.7 (10.7.7.7)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what does the 'r' in the status codes indicate if present? (Not shown here, but the engineer notices a similar route with 'r' status.)

Accepted Answer

The route is a RIB-failure, meaning it is not installed in the routing table because another route with a lower administrative distance exists.. The 'r' status code stands for RIB-failure, meaning the route is valid in BGP but not installed in the routing table because a route with a lower administrative distance (e.g., from OSPF or EIGRP) already exists.

Answer

The route is suppressed by a route-map.

Answer

The route is not valid due to next-hop unreachability.

Answer

The route is dampened.

Question 8

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 9

Given the following BGP configuration on router R1:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 route-map SET-MED out
!
route-map SET-MED permit 10
 match ip address prefix-list LOOPBACKS
 set metric 100
!
route-map SET-MED permit 20
!
ip prefix-list LOOPBACKS permit 192.168.0.0/24

What is the effect of this configuration?

Accepted Answer

All routes are advertised to 10.1.1.2; the 192.168.0.0/24 route has MED 100, others have no MED.. The route-map SET-MED has two sequences. Sequence 10 matches prefix-list LOOPBACKS (192.168.0.0/24) and sets MED to 100. Sequence 20 permits everything else without setting MED, so other routes are advertised with their original MED.

Answer

Only the 192.168.0.0/24 route is advertised to 10.1.1.2, with MED 100.

Answer

All routes are advertised with MED 100 because the route-map is applied outbound.

Answer

Only the 192.168.0.0/24 route is advertised with no MED because the set metric is ignored.

Question 10

In BGP, what is the default administrative distance for eBGP routes?

Accepted Answer

20. The default administrative distance for eBGP is 20, while for iBGP it is 200. This means eBGP routes are more trusted than iBGP routes.

Answer

200

Answer

120

Answer

110

Question 11

Consider the following BGP configuration on router R2:

router bgp 65002
 bgp router-id 2.2.2.2
 neighbor 10.2.2.1 remote-as 65001
 neighbor 10.2.2.1 route-map FILTER in
!
route-map FILTER deny 10
 match ip address prefix-list BLOCKED
!
route-map FILTER permit 20
!
ip prefix-list BLOCKED permit 10.0.0.0/8 le 32

Which statement is true about routes received from 10.2.2.1?

Accepted Answer

Routes with prefix 10.0.0.0/8 or more specific are denied; all others are permitted.. The route-map FILTER is applied inbound. Sequence 10 denies any route matching prefix-list BLOCKED (10.0.0.0/8 and more specific). Sequence 20 permits all other routes. Routes with 10.x.x.x are denied.

Answer

All routes are accepted because the deny statement is misconfigured.

Answer

Only routes exactly matching 10.0.0.0/8 are denied; other 10.x.x.x routes are permitted.

Answer

The route-map is applied outbound, so it affects routes sent to 10.2.2.1.

Question 12

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Accepted Answer

The EEM applets are not registered due to a syntax error in the configuration.. Even if the EEM server is running, the applets may not be registered if they have syntax errors or if the 'event manager applet' command is missing. The engineer should use 'show event manager policy available' or 'show event manager policy registered' to verify if the applets are registered.

Answer

The EEM server is not listening for syslog events.

Answer

The router's logging level is set to emergencies only.

Answer

The EEM applets are configured with 'event none' and need manual triggering.

Question 13

Examine this BGP configuration on router R3:

router bgp 65003
 bgp router-id 3.3.3.3
 neighbor 10.3.3.2 remote-as 65002
 neighbor 10.3.3.2 ebgp-multihop 2
 neighbor 10.3.3.2 update-source Loopback0
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255

What is the likely issue with this configuration?

Accepted Answer

The neighbor 10.3.3.2 must be reachable via the loopback address 3.3.3.3; otherwise, the session will not come up.. The ebgp-multihop 2 allows the neighbor to be two hops away, but the update-source is set to Loopback0 (3.3.3.3). The neighbor 10.3.3.2 must be reachable via the loopback. If 10.3.3.2 is not reachable from 3.3.3.3, the session will not establish.

Answer

The ebgp-multihop value should be 1 for directly connected neighbors.

Answer

The remote-as 65002 should be the same as the local AS for eBGP.

Answer

The update-source command is not needed when using ebgp-multihop.

Question 14

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 15

A network engineer configures BGP on router R4:

router bgp 65004
 bgp router-id 4.4.4.4
 neighbor 10.4.4.3 remote-as 65003
 neighbor 10.4.4.3 password BGPsecret
!

What is the effect of the password command?

Accepted Answer

It enables MD5 authentication for the TCP session; the neighbor must also have the same password.. The password command enables MD5 authentication for the TCP connection between BGP peers. Both peers must have the same password; otherwise, the session will not establish.

Answer

It encrypts the BGP updates using the password as a key.

Answer

It sets a simple password that is sent in clear text with each BGP update.

Answer

It has no effect unless the neighbor is configured with the same password.

Question 16

Which TWO statements about BGP route reflectors are true when troubleshooting route propagation issues? (Choose TWO.)

Accepted Answer

A route reflector forwards routes received from a non-client peer to all client and non-client peers.. Route reflectors pass routes from non-client peers to all other peers (including other clients and non-clients) without requiring full mesh, but they do not modify the AS_PATH. The cluster ID is used to prevent loops within a cluster. Option B is incorrect because route reflectors do not prepend the AS_PATH. Option D is incorrect because clients must peer only with the route reflector, not with each other. Option E is incorrect because the next-hop is not changed by default.

Answer

A route reflector appends its own AS number to the AS_PATH when reflecting routes.

Answer

Clients in a route reflector cluster must be fully meshed with each other.

Answer

A route reflector changes the next-hop attribute to its own address when reflecting routes.

Question 17

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down
2    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Accepted Answer

Two EEM applet policies are registered and active.. The 'show event manager policy registered' command lists all EEM policies registered on the device. The output shows two applet policies registered, but no trigger events are shown. The correct answer is that two EEM applet policies are registered, but the output does not indicate whether they are enabled or disabled; registration means they are loaded and ready to trigger.

Answer

Two EEM applet policies are registered but disabled.

Answer

Only one EEM applet policy is registered.

Answer

The EEM applet policies are triggered by syslog events.

Question 18

Consider the following BGP configuration on router R5:

router bgp 65005
 bgp router-id 5.5.5.5
 neighbor 10.5.5.6 remote-as 65006
 neighbor 10.5.5.6 route-map SET-LP in
!
route-map SET-LP permit 10
 set local-preference 150
!

What is the result of this configuration?

Accepted Answer

All routes from 10.5.5.6 have their local preference set to 150, making them more preferred.. The route-map SET-LP is applied inbound. It sets the local preference to 150 for all routes received from 10.5.5.6. This makes those routes more preferred within the local AS compared to routes with default local preference (100).

Answer

Only routes that match a prefix-list are affected; otherwise, default local preference is used.

Answer

Local preference is set to 150 for routes sent to 10.5.5.6.

Answer

The route-map is ignored because local-preference can only be set outbound.

Question 19

Which TWO configuration steps are required to troubleshoot and fix a BGP route that is not being advertised to an EBGP neighbor due to the next-hop-self issue? (Choose TWO.)

Accepted Answer

Apply the neighbor next-hop-self command under the BGP router configuration for the EBGP neighbor.. The next-hop-self command on the EBGP neighbor or the IBGP peer (if the route is from IBGP) ensures the next hop is set to the local router's address. Alternatively, if the next hop is reachable via an IGP, no change is needed. Option A is incorrect because network statements do not affect next-hop. Option C is incorrect because EBGP multihop is for TTL issues. Option E is incorrect because the update-source command sets the source IP, not the next hop.

Answer

Configure a network statement under BGP to advertise the prefix.

Answer

Increase the EBGP multihop TTL using the neighbor ebgp-multihop command.

Answer

Use the neighbor update-source command to change the source IP of BGP updates.

Question 20

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Flap
3    00:01:32 UTC Mar 1  syslog              EIGRP_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Accepted Answer

The router is experiencing network instability causing repeated neighbor state changes.. The 'show event manager history events' command shows the last triggered events. The output shows repeated syslog events for EIGRP neighbor down and OSPF neighbor flap within a short timeframe, indicating a flapping condition. The correct answer is that the router is experiencing network instability causing repeated neighbor state changes.

Answer

The EEM policies are not configured correctly.

Answer

The EEM applet policies are disabled.

Answer

The syslog server is not reachable.