300-410 Practice Exam 53 — 20 Questions

Question 1

R1 and R2 are connected via an IPsec VPN tunnel. They are running EIGRP over the tunnel. R1's show ip eigrp neighbors shows R2 as up, but R1's show ip eigrp topology shows all routes from R2 in passive state. However, R1's show ip route does not have any EIGRP routes from R2. What is the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

R2 is using a route-map to set EIGRP metric to 4294967295, making routes inaccessible.. The EIGRP metric of 4294967295 is the maximum possible metric (32-bit value), effectively making the route unreachable. When R2 applies a route-map to set this metric, R1 receives the routes but considers them inaccessible, so they appear in the topology table as passive (since the neighbor is up and the route is learned) but are not installed in the routing table. This matches the symptoms: neighbor adjacency is established, routes are in the topology table, but no EIGRP routes appear in the IP routing table.

Answer

EIGRP variance is set to 1, preventing load balancing.

Answer

The tunnel interface is down on R2.

Answer

R1 has a passive interface for the tunnel.

Question 2

An engineer is troubleshooting a GRE IPv6 tunnel between two sites. The tunnel is up, and the engineer can ping the remote tunnel endpoint IPv6 address. However, OSPFv3 neighbors over the tunnel fail to form. The engineer verifies that OSPFv3 is configured on both tunnel interfaces with the same area and that the network type is broadcast. What is the most likely cause?

Accepted Answer

The tunnel MTU is set to 1500, but the GRE encapsulation adds 24 bytes, causing OSPFv3 packets to be fragmented.. The GRE tunnel MTU of 1500 bytes does not account for the 24-byte GRE/IPv6 encapsulation overhead (20-byte IPv6 header + 4-byte GRE header). OSPFv3 packets, which can be up to 1500 bytes, become fragmented when encapsulated, but fragmentation is often disabled or handled poorly in tunnel interfaces, preventing OSPFv3 neighbor formation. This is the most likely cause because the tunnel is up and the endpoint is reachable, but the OSPFv3 packets are being dropped or corrupted due to fragmentation.

Answer

The OSPFv3 network type is set to point-to-point instead of broadcast.

Answer

The tunnel interface is missing the 'ipv6 ospf 1 area 0' command.

Answer

The tunnel keepalive is misconfigured, causing the tunnel to flap.

Question 3

A network engineer runs the following command to verify NAT translations:

R1# show ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
--- 10.2.2.2           10.1.1.1           192.168.1.1        192.168.1.1
  create 00:00:15, use 00:00:05, flags: extended, timing-out

What does the 'extended' flag indicate?

Accepted Answer

The translation includes port information, typical of PAT.. The 'extended' flag in the output of 'show ip nat translations verbose' indicates that the NAT translation includes Layer 4 port information, which is characteristic of Port Address Translation (PAT) or NAT overload. This allows multiple internal hosts to share a single public IP address by using unique port numbers, as opposed to a simple one-to-one translation without port multiplexing.

Answer

The translation is for a single port only.

Answer

The translation is static and never times out.

Answer

The translation is for a VPN tunnel.

Question 4

A network using IPv6 over IPv4 L2TPv3 tunnels is experiencing packet drops. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 tunnel mode l2tpv3 ipv6. Router R2 shows: R2# show l2tp tunnel Tunnel id 1, 1 session Session id 1, state established. R2# show ipv6 interface Tunnel0 Tunnel0 is up, line protocol is up. What is the root cause?

Accepted Answer

The MTU on the tunnel interface is too high, causing fragmentation of IPv6 packets.. In an L2TPv3 tunnel carrying IPv6 traffic, the tunnel interface MTU defaults to 1500 bytes, but the actual path MTU between the tunnel endpoints (192.0.2.1 and 198.51.100.1) is likely lower due to the added L2TPv3, UDP, and IP headers. This causes IPv6 packets larger than the effective path MTU to be dropped because IPv6 routers do not fragment packets; they rely on ICMPv6 Packet Too Big messages, which may be blocked or not processed, leading to packet loss.

Answer

The tunnel mode should be l2tpv3 ipv4 instead of ipv6.

Answer

The session ID on R1 does not match R2's session ID.

Answer

IPv6 routing is not enabled on R2.

Question 5

A network engineer runs the following command on Router R1:

R1# show ipv6 mtu

IPv6 MTU per interface:

Interface    MTU
Tunnel0      1476
Tunnel1      1476
GigabitEthernet0/0  1500

Based on this output, what is the most likely reason for the reduced MTU on the tunnel interfaces?

Accepted Answer

The tunnels are using GRE encapsulation, which adds 24 bytes of overhead.. The output shows an MTU of 1476 on the tunnel interfaces, which is exactly 24 bytes less than the 1500-byte MTU of the physical GigabitEthernet0/0 interface. GRE encapsulation adds a 4-byte outer IP header and a 4-byte GRE header (total 24 bytes with the inner IP header), reducing the payload MTU. This is the default behavior when a tunnel is configured without a manual MTU override, making option B correct.

Answer

The tunnels are configured with a manual MTU.

Answer

The tunnels are using IPsec, which adds more overhead.

Answer

The tunnels are 6to4 tunnels, which do not reduce MTU.

Question 6

An engineer configures DHCP snooping on a switch to prevent rogue DHCP servers. After enabling, legitimate DHCP clients on VLAN 10 cannot obtain addresses. The DHCP server is connected to a trusted port. The switch shows 'show ip dhcp snooping binding' with no entries. Which is the most likely explanation?

Accepted Answer

The DHCP server is on a different subnet, and no DHCP relay is configured; the switch only snoops broadcast traffic within the VLAN.. DHCP snooping builds its binding database by monitoring DHCPACK messages from trusted ports. If the DHCP server is on a different subnet than the clients (VLAN 10) and no DHCP relay (ip helper-address) is configured, the server's unicast reply never reaches the switch, so no snooping bindings are created. The switch only snoops broadcast DHCP traffic within the VLAN; without relay, the server's response is unicast and may not be seen by the snooping switch, leaving the binding table empty and clients unable to obtain addresses.

Answer

The trusted port is configured as an access port in VLAN 10, but the server is in VLAN 20.

Answer

The switch has 'ip dhcp snooping information option' disabled, preventing binding creation.

Answer

The DHCP server is using a different MAC address than expected, causing the switch to drop the packets.

Question 7

A router is configured as a DHCPv6 client on an interface using 'ipv6 address dhcp'. The router receives a valid IPv6 address from the server, but the address is not used for outgoing traffic. Which is the most likely explanation?

Accepted Answer

The router has a static IPv6 address configured on the same interface, and the DHCP-assigned address is not preferred for source selection.. When a router has both a static IPv6 address and a DHCPv6-assigned address on the same interface, the static address is typically preferred as the source address for outgoing traffic because it is manually configured and considered more stable. The DHCPv6-assigned address, while valid, is not selected as the source unless explicitly preferred via source-interface selection rules or policy. This explains why the address is received but not used.

Answer

The DHCPv6 server assigned a temporary address (IA_TA) instead of a non-temporary address (IA_NA).

Answer

The router's 'ipv6 unicast-routing' is disabled.

Answer

The DHCP-assigned address is in a different subnet than the default gateway.

Question 8

Which statement correctly describes the default behavior of the 'flow monitor' in Flexible NetFlow regarding the collection of BGP next-hop information?

Accepted Answer

BGP next-hop is collected only if the flow record includes the 'match routing bgp next-hop' command.. By default, Flexible NetFlow does not collect BGP next-hop information unless explicitly configured in the flow record.

Answer

BGP next-hop is always collected by default in Flexible NetFlow monitors.

Answer

BGP next-hop is never collected in Flexible NetFlow, only in traditional NetFlow.

Answer

BGP next-hop is collected by default only for IPv4 flows.

Question 9

A network engineer applies a CoPP (Control Plane Policing) policy to a router running VRF-Lite. The policy includes a class that matches SSH traffic and polices it to 1 Mbps. After applying the policy, the engineer cannot SSH into the router from any VRF. Which is the most likely explanation?

Accepted Answer

The CoPP policy has an explicit 'deny' in the class-default, which drops all traffic not matched by other classes.. CoPP policies are applied to the control plane and affect all traffic destined to the router, regardless of VRF. However, CoPP uses the global routing table for classification. If the SSH traffic is sourced from a VRF, the CoPP policy may not match it correctly because the class-map might be using 'match protocol' or 'match access-group' that is evaluated in the global context. Additionally, the default class (class-default) often has a police action that drops traffic if not explicitly allowed. A common edge case is that the engineer forgot to include a 'class-default' action to permit traffic, causing all unmatched traffic to be dropped.

Answer

The SSH traffic is being policed to 1 Mbps, but the traffic rate is below that, so it should be allowed.

Answer

The CoPP policy is applied to the control plane of the VRF, not the global control plane, so it does not affect SSH traffic.

Answer

The SSH traffic is being matched by a different class that has a 'drop' action, such as a class for ICMP.

Question 10

An engineer configures DHCPv6 prefix delegation on a Cisco router acting as a requesting client. The router receives a valid IA_PD prefix from the server, but no route for the delegated prefix appears in the routing table. Which is the most likely explanation?

Accepted Answer

The router's 'ipv6 dhcp client pd' command does not install a route; the engineer must manually configure a static route for the delegated prefix.. The `ipv6 dhcp client pd` command on a Cisco router acting as a DHCPv6 prefix delegation client does not automatically install a route for the delegated prefix into the routing table. The command only assigns the prefix to an interface for use (e.g., with `ipv6 address` commands), but the engineer must manually configure a static route pointing to the DHCP-learned next-hop address to populate the routing table.

Answer

DHCPv6 prefix delegation automatically installs a connected route; the issue is a missing 'ipv6 route' command to point the prefix to the DHCP-learned next-hop.

Answer

The DHCPv6 server must also send a route option; the requesting client cannot install a route without it.

Answer

The router's 'ipv6 unicast-routing' is disabled, preventing route installation.

Question 11

Which TWO statements correctly describe the behavior of SNMPv3 when using the 'noAuthNoPriv' security level? (Choose TWO.)

Accepted Answer

The SNMP engine ID is still used for message processing and identification.. SNMPv3 always uses the engine ID for message processing and identification, regardless of the security level. Even with 'noAuthNoPriv', the engine ID is included in the SNMP message to uniquely identify the SNMP engine, enabling proper message handling and context for the security model.

Answer

The username and password are sent in clear text.

Answer

The 'snmp-server user' command must include the 'auth' and 'priv' keywords set to 'md5' and 'des' respectively.

Answer

The security level is configured per user, not per group.

Question 12

An engineer configures Control Plane Policing (CoPP) on a router that terminates multiple IPsec site-to-site VPN tunnels. After applying the CoPP policy, some IPsec tunnels fail to establish, while others work fine. The engineer verifies that the CoPP policy permits IKE (UDP 500) and ESP (protocol 50) traffic. What is the most likely cause of the failure?

Accepted Answer

The CoPP policy uses the 'class class-default' with a police action that drops traffic exceeding a low rate, and IKE/ESP packets are being classified into class-default because the ACL does not match them correctly.. The most likely cause is that the CoPP ACL does not correctly match IKE (UDP 500) and ESP (protocol 50) packets, causing them to fall into the 'class-default' class. If the 'class-default' has a police action that drops traffic exceeding a low rate, these critical control-plane packets are dropped, preventing IPsec tunnel establishment. This explains why some tunnels work (those that happen to generate less traffic or are not rate-limited) while others fail.

Answer

The CoPP policy is applied to the wrong interface; it should be applied to the tunnel interface.

Answer

The IPsec tunnels use IKEv2, which uses UDP port 4500, and the CoPP policy only permits UDP 500.

Answer

The CoPP policy rate-limits traffic in bps, but IKE/ESP traffic is bursty, causing drops during the initial exchange.

Question 13

In a 6to4 tunnel, how is the tunnel destination address determined?

Accepted Answer

It is derived from the IPv6 destination address using the 2002::/16 prefix.. In a 6to4 tunnel, the tunnel destination address is automatically derived from the IPv6 destination address by extracting the IPv4 address embedded in the 2002::/16 prefix. Specifically, the first 16 bits of the IPv6 destination are 2002, and the next 32 bits represent the IPv4 address of the remote 6to4 router. This allows the tunnel to be dynamically established without manual configuration of each destination.

Answer

It is manually configured.

Answer

It is obtained via DNS.

Answer

It is the same as the tunnel source.

Question 14

A network engineer is troubleshooting a DHCPv4 issue where clients on a subnet are getting IP addresses from the correct pool, but they cannot reach the default gateway. The router is configured as a DHCP server with pool 'POOL' that includes 'default-router 192.168.1.1'. The router's interface IP is 192.168.1.1/24. Clients receive the address and default gateway, but pings to 192.168.1.1 fail. What is the most likely cause?

Accepted Answer

The router interface Gi0/0 is administratively down.. If the router's interface is up and has the correct IP, but clients cannot ping the gateway, the issue is often that the interface is in a different VLAN or the clients are on a different broadcast domain. However, the most common misconfiguration is that the 'default-router' command points to an IP that is not actually configured on the router's interface, or the interface is down. Given that the symptom is specific to the gateway, the likely cause is that the interface is shut down or has a different IP.

Answer

The DHCP pool has the wrong subnet mask.

Answer

The 'ip helper-address' command is interfering with DHCP.

Answer

The clients have a static ARP entry for the gateway.

Question 15

According to RFC 2663, what is the term for the process of translating both the source and destination IP addresses in a packet?

Accepted Answer

Twice NAT. RFC 2663 defines 'Twice NAT' as the process of translating both the source and destination IP addresses within a single packet. This is necessary when the private and public address spaces overlap, requiring simultaneous translation of both the source and destination fields to ensure proper routing and reachability.

Answer

Static NAT

Answer

PAT

Answer

Double NAT

Question 16

An engineer is troubleshooting an IPv6 deployment where hosts on a subnet are not receiving IPv6 addresses via SLAAC. The router is configured with 'ipv6 unicast-routing' and the interface has 'ipv6 address 2001:db8:1::1/64' and 'ipv6 nd other-config-flag'. The hosts are sending Router Solicitations but receive no Router Advertisements. What is the root cause?

Accepted Answer

The 'ipv6 nd ra suppress' command is configured on the interface.. For SLAAC to work, the router must send Router Advertisements (RAs). The 'ipv6 nd other-config-flag' only sets the 'O' flag for additional information (like DNS), but does not enable RA generation. The interface must have an 'ipv6 enable' command or a configured unicast address to automatically enable RA generation, but here the address is configured, so RA generation should be on by default. However, the 'ipv6 nd prefix' command may be missing or the interface may be administratively down. The most common cause is that the interface is not 'no shutdown' or the RA interval is set to 0. Given the symptom, the likely cause is that the interface is in a state where RAs are suppressed, such as when 'ipv6 nd ra suppress' is configured.

Answer

The interface is missing the 'ipv6 enable' command.

Answer

The 'ipv6 nd prefix' command is missing for the subnet.

Answer

The hosts are using DHCPv6 instead of SLAAC.

Question 17

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

Accepted Answer

The 'logging on' command is not configured globally.. The 'logging on' command is required globally to enable syslog message generation on Cisco IOS-XE devices. Without it, the router will not send any log messages to any destination, including the configured syslog server at 10.1.1.100, even though the 'logging host' and 'logging trap debugging' commands are present. The successful ping confirms IP connectivity, so the issue is that logging is disabled at the global level.

Answer

The syslog server is using UDP port 514, but the router is sending over TCP.

Answer

The 'logging source-interface' is set to a loopback that is not advertised in the routing table.

Answer

The 'logging buffered' command is overriding the remote logging configuration.

Question 18

An engineer configured IP SLA 40 with a UDP echo probe to monitor a remote server port 80. The IP SLA is used in a track object for a backup static route. The engineer observes that the IP SLA state is 'Timeout' even though the server is reachable via ping from the router. What is the most likely cause?

Accepted Answer

The server is not running a UDP service on port 80; HTTP uses TCP, so the UDP probe will fail.. UDP echo probes require a service listening on the specified port. If the server does not have a UDP service on port 80 (HTTP uses TCP), the probe will timeout.

Answer

The router's firewall is blocking UDP packets to the server.

Answer

The IP SLA frequency is set too high, causing the router to miss responses.

Answer

The track object is misconfigured with the wrong IP SLA number.

Question 19

A network engineer runs the following command on Router R1:

R1# show ip sla configuration 1

IP SLAs Infrastructure Engine-II
Entry number: 1
Owner: 
Tag: 
Type of operation to perform: icmp-echo
Target address: 192.168.1.1
Source address: 0.0.0.0
Source interface: none
Type Of Service parameter: 0
Verify data: No
Operation timeout (milliseconds): 5000
Request size (ARR data block): 28
Threshold (milliseconds): 100
Frequency (seconds): 10
Life (seconds): Forever
Ageout (seconds): 0

Based on this output, what is the primary problem with this IP SLA configuration?

Accepted Answer

The source address is set to 0.0.0.0, which may cause the probe to fail if the router does not have a valid route.. The source address is 0.0.0.0 and no source interface is configured. This means the router will use the outgoing interface's IP address, which might not be routable or expected. However, the key clue is that the threshold is set to 100 ms, but the operation timeout is 5000 ms. If the RTT exceeds 100 ms, the operation will report 'Over threshold' but not necessarily fail. The question focuses on configuration issues; the source address being 0.0.0.0 is a common misconfiguration that can cause problems if the router cannot reach the target.

Answer

The threshold value is too low, causing frequent threshold violations.

Answer

The frequency is set to 10 seconds, which is too fast for accurate measurements.

Answer

The operation timeout is too high, causing delays in failure detection.

Question 20

An engineer is troubleshooting an issue where an SNMPv2c NMS cannot poll interface counters on a Cisco router. Which THREE commands can be used to verify the SNMP configuration and connectivity? (Choose THREE.)

Accepted Answer

show snmp. The 'show snmp' command displays the overall SNMP agent status, including enabled traps, system contact, and location. This verifies that SNMP is configured and operational on the router, which is essential for an NMS to poll interface counters.

Answer

show ip snmp

Answer

debug snmp packet