300-410 Practice Exam 52 — 20 Questions

Question 1

In a VRF-Lite network, OSPF is configured with a distribute-list that filters routes from being installed in the routing table. The engineer notices that the distribute-list is working, but the filtered routes are still being advertised to OSPF neighbors. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The distribute-list is applied inbound, which only prevents the route from being installed in the RIB, but the route remains in the OSPF LSDB and is advertised to neighbors.. The OSPF distribute-list in (or out) filters routes from being installed in the routing table (RIB) but does not affect the OSPF link-state database (LSDB) or the advertisement of routes. To filter routes from being advertised, the distribute-list must be applied outbound, or an area filter (using 'area range' with 'not-advertise') must be used. This is a common misconception: distribute-list in only affects local RIB installation, not LSDB propagation.

Answer

The distribute-list is applied outbound, but the neighbor has a higher priority, so the route is still advertised.

Answer

The OSPF process has the 'database-filter all out' command configured, which overrides the distribute-list.

Answer

The distribute-list uses an ACL that does not match the route correctly, so the route is not filtered.

Question 2

What is the default IPv6 hop limit for packets sent over a tunnel interface in Cisco IOS-XE?

Accepted Answer

64. The default IPv6 hop limit for packets sent over a tunnel interface in Cisco IOS-XE is 64. This value is defined in RFC 2473 and is used by Cisco for tunnel interfaces such as GRE, IPv6-in-IPv4, and ISATAP. The hop limit is decremented by one when the packet is encapsulated and again when it is decapsulated, so the effective end-to-end hop count is reduced by two.

Answer

128

Answer

255

Answer

32

Question 3

In a DMVPN network with VRF-Lite, Router R1 (hub) and R2 (spoke) are configured for VRF-A. The DMVPN tunnel is up, but spoke-to-spoke traffic between R2 and R3 (another spoke) fails. R1 has configuration: interface Tunnel0, ip vrf forwarding VRF-A, ip address 172.16.0.1 255.255.255.0, tunnel source Gig0/0, tunnel mode gre multipoint. R2 has similar configuration with tunnel destination dynamic. The NHRP map for R3 is missing on R2. What is the root cause?

Accepted Answer

The NHRP mapping for R3 is missing on R2, preventing direct spoke-to-spoke tunnel establishment.. In DMVPN, spoke-to-spoke tunnels require NHRP resolution. If R2 does not have an NHRP map for R3, it cannot establish a direct tunnel. The hub (R1) should facilitate NHRP resolution, but if the VRF configuration is not properly propagated, NHRP may fail. The root cause is that the NHRP mapping is missing, often due to VRF mismatch in NHRP configuration or because the hub is not properly forwarding NHRP requests.

Answer

The tunnel mode should be gre multipoint on all spokes.

Answer

The VRF must be removed from the tunnel interface for DMVPN to work.

Answer

The hub router must have a static route for each spoke.

Question 4

Which authentication method is supported by default for GRE tunnels in Cisco IOS-XE?

Accepted Answer

No authentication by default. GRE tunnels in Cisco IOS-XE do not include any built-in authentication mechanism by default. The GRE protocol (RFC 2784) defines a simple encapsulation method without authentication or encryption; any security features must be added externally, such as using IPsec to protect the tunnel traffic. Therefore, the correct answer is that no authentication is enabled by default.

Answer

MD5 authentication

Answer

SHA-256 authentication

Answer

Plain-text password authentication

Question 5

In IPsec site-to-site VPN, what is the default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers?

Accepted Answer

86400 seconds (24 hours). The default lifetime for ISAKMP (IKE phase 1) security associations on Cisco IOS routers is 86400 seconds (24 hours). This is defined in the Cisco IOS default configuration for the `crypto isakmp policy` and is the recommended value to balance security and performance by reducing the frequency of re-authentication and Diffie-Hellman key exchanges.

Answer

3600 seconds (1 hour)

Answer

28800 seconds (8 hours)

Answer

1800 seconds (30 minutes)

Question 6

Consider this partial configuration:

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/2
 ip address 172.16.0.1 255.255.255.0
 ip nat inside

What is true about traffic from the 172.16.0.0/24 network?

Accepted Answer

It is not translated and will be forwarded with its original source IP.. The NAT configuration uses an access-list (list 1) that only matches traffic from the 192.168.1.0/24 network. Traffic sourced from the 172.16.0.0/24 network does not match this access-list, so it is not subject to NAT translation. As a result, the router forwards packets from 172.16.0.0/24 with their original source IP address unchanged.

Answer

It is translated using PAT to 203.0.113.1.

Answer

It is dropped because NAT is required for all inside interfaces.

Answer

It is translated using a different pool because it is on a separate inside interface.

Question 7

An engineer configures mutual redistribution between OSPF and EIGRP on a router that is part of an IPsec site-to-site VPN. After the configuration, routing loops occur intermittently. The engineer has not used any route tagging. What is the most likely cause of the routing loops?

Accepted Answer

Routes redistributed from OSPF into EIGRP are re-distributed back into OSPF because there is no route tagging to identify them as OSPF-originated.. Without route tagging, routes redistributed from OSPF into EIGRP are not marked as OSPF-originated. When EIGRP redistributes these routes back into OSPF, OSPF accepts them as external routes, creating a mutual redistribution loop. This occurs because OSPF has no mechanism to distinguish between its own routes and those learned from EIGRP without explicit tagging (e.g., using a route-map with a tag).

Answer

The seed metric for EIGRP redistribution is set to a low value, causing EIGRP routes to be preferred over OSPF routes.

Answer

The IPsec tunnel is using transport mode, which causes routing protocol packets to be dropped.

Answer

The OSPF process has a higher administrative distance than EIGRP, causing route flapping.

Question 8

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# debug ip bgp updates

BGP(0): 10.1.1.2 rcv UPDATE w/ attr: nexthop 10.1.1.2, origin i, metric 0, path 65002
BGP(0): 10.1.1.2 rcv UPDATE about 192.168.1.0/24 -- DENIED due to: community no-export;

What does this output indicate?

Accepted Answer

The route 192.168.1.0/24 is denied because of the no-export community, which prevents it from being advertised to any peer.. The debug output explicitly states 'DENIED due to: community no-export'. The no-export community (0xFFFFFF01) prevents the route from being advertised to any eBGP peer, but it does not prevent the route from being received or installed in the local BGP table. However, in this context, the router is denying the incoming update because of an inbound policy that matches the no-export community and rejects the route. Option B correctly identifies that the route is denied due to the no-export community, which stops it from being advertised to any peer.

Answer

The route 192.168.1.0/24 is accepted and installed in the BGP table because the community is no-export.

Answer

The route 192.168.1.0/24 is denied because of an inbound prefix-list filter.

Answer

The route 192.168.1.0/24 is accepted but marked with no-export for outbound filtering.

Question 9

A network engineer runs the following command on Router R6:

R6# show logging | include %SEC-6-IPACCESSLOGP

*Mar  1 00:01:15.123: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12345) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:20.456: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12346) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:25.789: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12347) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:30.012: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12348) -> 192.168.1.1(80), 1 packet

Based on this output, what is the most likely problem?

Accepted Answer

A host at 10.0.0.100 is attempting to access a web server at 192.168.1.1 and is being blocked by the ACL.. The output shows repeated denied packets from source 10.0.0.100 to destination 192.168.1.1 on port 80 (HTTP). This indicates that a host at 10.0.0.100 is trying to access a web server at 192.168.1.1 but is being blocked by ACL ACL_INBOUND. The pattern suggests a possible scan or attack, or a legitimate access that is being denied due to misconfiguration.

Answer

The ACL ACL_INBOUND is permitting traffic from 10.0.0.100 to 192.168.1.1 on port 80.

Answer

The router is experiencing a DoS attack from 192.168.1.1.

Answer

The ACL ACL_INBOUND is not configured on any interface.

Question 10

Consider the following partial configuration:

ip access-list extended SECURE_ACCESS
 permit icmp any any echo
 permit icmp any any echo-reply
 permit tcp any host 192.168.1.1 eq 22
 permit tcp any host 192.168.1.1 eq 443
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group SECURE_ACCESS in
!
interface GigabitEthernet0/1
 ip access-group SECURE_ACCESS out

What is a potential issue with this ACL placement?

Accepted Answer

The ACL may block traffic that needs to pass between the two interfaces because it is applied in both directions.. The ACL SECURE_ACCESS is applied inbound on GigabitEthernet0/0 and outbound on GigabitEthernet0/1. This means traffic entering G0/0 is filtered by the ACL, and traffic exiting G0/1 is also filtered by the same ACL. Since the ACL denies all IP traffic by default (via the 'deny ip any any' at the end), any packet that must traverse from G0/0 to G0/1 will be checked twice: once inbound on G0/0 and again outbound on G0/1. If the packet matches a permit statement on the inbound check, it may still be denied on the outbound check if the source/destination or protocol does not match the permit entries from the perspective of the outbound interface. In this configuration, the ACL permits only ICMP echo/echo-reply and TCP to 192.168.1.1 on ports 22 and 443; all other traffic is denied. Therefore, legitimate traffic between the two interfaces that does not match these specific permits will be blocked, potentially disrupting connectivity.

Answer

The ACL is missing a 'permit ip any any' statement, so all traffic is denied.

Answer

The ACL should be applied only inbound on both interfaces.

Answer

The ACL permits ICMP echo and echo-reply, which could allow ping floods.

Question 11

Which TWO configuration steps are required to enable IPsec site-to-site VPN with IKEv2 on a Cisco router? (Choose TWO.)

Accepted Answer

Configure an IKEv2 keyring with the pre-shared key.. An IKEv2 keyring stores the pre-shared key (PSK) used for authenticating the remote peer during IKEv2 SA establishment. Without a keyring, the router has no local credential to present or verify against the peer. Option B is correct because an IKEv2 proposal defines the mandatory encryption (e.g., AES-256) and integrity (e.g., SHA-256) algorithms that both peers must agree on for the IKEv2 Phase 1 (IKE SA) negotiation.

Answer

Configure a crypto isakmp policy for phase 1.

Answer

Configure an IKEv2 profile and bind it to the crypto map.

Answer

Configure the 'crypto ipsec transform-set' command.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 5  Misses: 0
CEF Translated packets: 5, CEF Punted packets: 0
Expired translations: 0

Based on this output, which statement is correct?

Accepted Answer

Static NAT is configured for host 10.0.0.10 to 192.0.2.10.. The output shows a single static NAT translation from inside local address 10.0.0.10 to inside global address 192.0.2.10. The 'show ip nat statistics' confirms '1 static' translation with no dynamic entries, and the NAT table lacks a port number, indicating a one-to-one static mapping rather than PAT. Therefore, static NAT is correctly configured for host 10.0.0.10 to 192.0.2.10.

Answer

Dynamic NAT is configured with overload.

Answer

The NAT pool is exhausted.

Answer

PAT is translating multiple hosts to the same global address.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip sla statistics
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Type of operation: icmp-echo
        Latest RTT: 20 milliseconds
        Latest operation start time: 12:00:00 UTC Mon Mar 1 2021
        Latest operation return code: OK
        Number of successes: 100
        Number of failures: 0

Based on this output, which statement is correct?

Accepted Answer

The IP SLA probe is successfully reaching the target with no failures.. The output shows 100 successes and 0 failures for the ICMP echo operation, with a latest return code of OK, confirming that the IP SLA probe is successfully reaching the target without any failures. The 'Number of successes: 100' and 'Number of failures: 0' directly indicate a 100% success rate for the probe.

Answer

The IP SLA probe has failed 100 times.

Answer

The IP SLA probe is using UDP jitter.

Answer

The IP SLA probe is not configured because the operation ID is 1.

Question 14

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp interface GigabitEthernet0/1
GigabitEthernet0/1 is in server mode
  Using pool: POOL6
  Preference value: 0
  Hint from client: ignored
  Rapid-Commit: disabled

Based on this output, which statement is correct?

Accepted Answer

The interface is configured as a DHCPv6 server using pool POOL6.. The command output explicitly states 'GigabitEthernet0/1 is in server mode' and 'Using pool: POOL6', which confirms that the interface is acting as a DHCPv6 server. The DHCPv6 server assigns IPv6 addresses and other configuration parameters from the specified pool to requesting clients.

Answer

The interface is configured as a DHCPv6 client.

Answer

The interface is using rapid-commit for faster address assignment.

Answer

The interface is in DHCPv6 relay mode.

Question 15

Which THREE symptoms indicate that NAT is misconfigured or failing on a Cisco router? (Choose THREE.)

Accepted Answer

Inside hosts can ping the outside interface IP but cannot reach hosts beyond it.. If inside hosts can ping the outside interface IP but cannot reach hosts beyond it, this indicates that NAT is translating the source address correctly for outbound traffic, but the router is not performing NAT for destinations beyond the outside interface. This typically happens when the NAT configuration lacks an access list that matches the inside-to-outside traffic or when the ip nat inside/outside interface commands are misapplied, causing the router to forward packets without translation for destinations beyond the directly connected network.

Answer

The router's CPU utilization is high due to BGP process.

Answer

The show ip route command shows a default route pointing to the ISP next hop.

Question 16

What is the default CoPP classification for ARP packets on a Cisco IOS-XE device?

Accepted Answer

Critical. B is correct because on Cisco IOS-XE devices, ARP packets are classified under the 'Critical' control plane class by default. This ensures that ARP processing receives high priority to maintain Layer 2 connectivity and avoid adjacency timeouts, which could lead to network instability.

Answer

Normal

Answer

Management

Answer

Best-effort

Question 17

Which TWO statements are true regarding the use of VRF-Lite in a Cisco Enterprise network? (Choose TWO.)

Accepted Answer

VRF-Lite enables multiple virtual routing tables on a single router, providing traffic separation without MPLS.. VRF-Lite allows multiple routing tables on a single router, enabling traffic separation without MPLS. It relies on static routes or dynamic routing protocols like OSPF, EIGRP, or BGP within each VRF. The incorrect options: MPLS is not required for VRF-Lite; VRF-Lite does not support MPLS VPNv4 route exchange (that requires MPLS); and VRF-Lite does not inherently provide encryption.

Answer

VRF-Lite requires MPLS to exchange VPNv4 routes between routers.

Answer

VRF-Lite can automatically encrypt traffic between VRFs using IPsec.

Answer

VRF-Lite can only be used with static routing.

Question 18

Given the following partial configuration on a router:

ip access-list standard FILTER_SNMP
 permit 192.168.1.0 0.0.0.255
 deny any
!
snmp-server community public RO FILTER_SNMP
snmp-server location DataCenter
snmp-server contact admin@example.com

What is the effect of this configuration?

Accepted Answer

Only SNMP requests from the 192.168.1.0/24 network are allowed with the community string 'public'.. The configuration applies the standard ACL 'FILTER_SNMP' to the SNMP community string 'public' with read-only (RO) access. The ACL permits only the 192.168.1.0/24 network, so SNMP requests (e.g., GET, GETNEXT) from that subnet are allowed, while all other sources are denied. This is the intended effect of using an ACL to restrict SNMP access by source IP.

Answer

SNMP requests from any source are allowed because the ACL is not applied correctly.

Answer

The community string 'public' allows read-write access.

Answer

The ACL is applied outbound, so SNMP responses are filtered.

Question 19

In IPsec site-to-site VPN, what is the purpose of the 'match address' command under a crypto map?

Accepted Answer

It identifies the traffic that will be encrypted and sent through the tunnel.. The 'match address' command under a crypto map references an access list (ACL) that defines which traffic should be protected by IPsec. When a packet matches a permit entry in that ACL, it triggers the IPsec process to encrypt and tunnel the traffic to the remote peer. This is the fundamental mechanism for selecting interesting traffic in a site-to-site VPN.

Answer

It specifies the peer IP address for the tunnel.

Answer

It defines the encryption and authentication algorithms.

Answer

It sets the lifetime for the IPsec SA.

Question 20

Which TWO configuration steps are required to enable a Cisco IOS router as a stateful DHCPv6 server for clients on interface GigabitEthernet0/0? (Choose TWO.)

Accepted Answer

Configure a DHCPv6 pool with the 'ipv6 dhcp pool POOL_NAME' command and define an address prefix.. The 'ipv6 dhcp pool POOL_NAME' command creates a DHCPv6 pool, and defining an address prefix within that pool is required to specify the IPv6 addresses that the server can assign to clients. This is the fundamental step for configuring a stateful DHCPv6 server, as the pool holds the address allocation parameters.

Answer

Configure the interface with 'ipv6 dhcp client POOL_NAME'.

Answer

Set the 'ipv6 nd managed-config-flag' on the interface.

Answer

Enable IPv6 on the interface with 'ipv6 enable'.