300-410 Practice Exam 54 — 20 Questions

Question 1

R1 and R2 are iBGP peers. R1 has: neighbor 10.1.1.2 route-map RM_SET in. The route-map RM_SET sets community 100:100. R2 advertises a prefix 172.16.1.0/24 with community 200:200. R1 receives the prefix and the community is changed to 100:100. However, R1's BGP table shows the prefix with community 100:100, but R1 does not propagate this prefix to its other iBGP peer R3. R3 has no special configuration. What is the root cause?

Accepted Answer

iBGP split-horizon rule prevents R1 from advertising routes learned from an iBGP peer to another iBGP peer.. By default, iBGP learned routes are not advertised to other iBGP peers to prevent loops, unless the router is a route reflector or confederation. R1 is not a route reflector, so it will not advertise the prefix learned from R2 to R3. The community manipulation is irrelevant to the propagation issue. The root cause is that iBGP split-horizon prevents R1 from advertising the prefix to R3.

Answer

The community 100:100 is being filtered by R3's inbound policy.

Answer

The route-map RM_SET should have been applied outbound on R2 instead.

Answer

R1 must have a network statement for 172.16.1.0/24 to advertise it.

Question 2

Consider the following EEM applet configuration:

!---
event manager applet CHECK_OSPF
event syslog pattern "OSPF-5-ADJCHG"
action 1.0 cli command "enable"
action 2.0 cli command "show ip ospf neighbor"
action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected."
!---

What is the effect of this configuration?

Accepted Answer

The applet will send an email to the administrator whenever an OSPF adjacency change occurs.. The EEM applet triggers on a syslog message matching the pattern "OSPF-5-ADJCHG". When triggered, it sends an email notification to the administrator. The 'cli command' actions are executed but their output is not used; the email is sent regardless. The applet does not require any additional configuration to send the email, provided the mail server is reachable.

Answer

The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.

Answer

The applet will fail because the 'event syslog pattern' must be configured with a regular expression.

Answer

The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.

Question 3

What is the maximum number of actions that can be configured in a single EEM applet?

Accepted Answer

255. The maximum number of actions in an EEM applet is 255. This is a hard limit in Cisco IOS. If more actions are needed, multiple applets must be used.

Answer

128

Answer

512

Answer

Unlimited

Question 4

R1 and R2 are eBGP peers. R1 advertises a prefix 192.168.1.0/24 with MED 50. R2 also receives the same prefix from another eBGP peer R3 with MED 100. R2's BGP best path selection chooses the path via R1 because of lower MED. However, R2's routing table shows the next-hop for 192.168.1.0/24 as 10.1.1.1 (R1), but R2 cannot ping 192.168.1.1. R2 has: interface GigabitEthernet0/0, ip address 10.1.1.2 255.255.255.0, and no ip route to 192.168.1.0/24 other than BGP. R1's interface to R2 has ip address 10.1.1.1 255.255.255.0. R1's BGP table shows the prefix with next-hop 10.1.1.1 (self). What is the root cause?

Accepted Answer

R1 does not have the prefix 192.168.1.0/24 in its routing table because the next-hop for that prefix in R1's BGP table is unreachable.. The issue is that R1 is advertising the prefix with next-hop 10.1.1.1, which is the interface IP of R1 towards R2. R2 installs the route with that next-hop, and since it is directly connected, R2 can reach it. However, R1 may not have a route to 192.168.1.0/24 in its routing table (e.g., it learned it via iBGP but did not install it due to next-hop unreachable or other issue). R1's BGP table shows the prefix, but if the next-hop is not reachable in R1's routing table, R1 will not install it in the routing table, and thus cannot forward packets. The root cause is that R1 does not have a valid route to the next-hop of the prefix it is advertising, so it cannot forward traffic.

Answer

R2's MED comparison is incorrect; lower MED should be preferred, but R2 should have chosen R3.

Answer

R2 is missing a static route to 192.168.1.0/24.

Answer

R1 should use next-hop-self when advertising to R2.

Question 5

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern occurs period '.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.

Question 6

R1 and R2 are iBGP peers in AS 65001. R1 has: neighbor 10.1.1.2 route-reflector-client. R2 advertises a prefix 10.0.0.0/8 with a community of no-export. R1 reflects this prefix to its other client R3. R3 is in a different AS (65002) via eBGP. R3 receives the prefix but does not advertise it to its eBGP neighbor R4 in AS 65003. What is the root cause?

Accepted Answer

The no-export community on the prefix prevents R3 from advertising it to eBGP neighbor R4.. The community no-export attached to the prefix prevents it from being advertised to any eBGP peers. When R1 reflects the prefix to R3 (iBGP), the community is preserved. R3, upon advertising to R4 (eBGP), checks the community and withholds the advertisement because of the no-export community. The root cause is that the no-export community is present on the prefix, which blocks eBGP advertisement.

Answer

R1 should have stripped the community before reflecting to R3.

Answer

R3 is missing the send-community command to its eBGP neighbor.

Answer

The route-reflector-client command on R1 should be on R2 instead.

Question 7

Consider the following EEM applet configuration:

!---
event manager applet INTERFACE_DOWN
event syslog pattern "%LINEPROTO-5-UPDOWN"
action 1.0 if $syslog_severity eq 5
action 2.0 cli command "enable"
action 3.0 cli command "clear counters"
!---

What will happen when a syslog message matching the pattern is generated?

Accepted Answer

The applet will execute the CLI commands unconditionally because the 'if' action is misconfigured.. The applet uses an 'if' action to check the syslog severity. If the severity is 5 (notification), the CLI commands are executed. However, the 'if' action is not closed with an 'end' statement, which is required. As a result, the applet will encounter a syntax error and may not execute correctly, or the CLI commands may be executed unconditionally depending on the IOS version.

Answer

The applet will execute the CLI commands only if the syslog severity is exactly 5.

Answer

The applet will fail to register because the 'if' action requires an 'else' clause.

Answer

The applet will clear the counters only for the interface that generated the syslog message.

Question 8

R1 and R2 are eBGP peers. R1 advertises a prefix 172.16.1.0/24 with AS_PATH 65001 65002. R2 receives the prefix and its BGP table shows AS_PATH 65001 65002. R2 has a route-map applied inbound that sets local-preference 150 for routes with AS_PATH containing 65002. R2 also has another eBGP peer R3 that advertises the same prefix with AS_PATH 65001 65003. R2's BGP best path selection chooses the path via R3 because of shorter AS_PATH length (2 vs 3). However, the network engineer expects the path via R1 to be preferred due to the higher local-preference. What is the root cause?

Accepted Answer

The route-map applied inbound on R2 from R1 has a match ip address prefix-list that does not include 172.16.1.0/24, so local-preference is not set.. Local-preference is evaluated before AS_PATH length in BGP best path selection. If the local-preference is set to 150 on the path via R1, it should be preferred over the path via R3 (which likely has default local-preference 100). The fact that R2 chooses R3 indicates that the local-preference was not applied correctly. The root cause is that the route-map is applied inbound on R2 from R1, but the route-map may have a match clause that does not match the prefix, or the set local-preference command is missing. In this scenario, the route-map is applied but the set local-preference is not executed because the match condition fails (e.g., match ip address prefix-list that does not include 172.16.1.0/24).

Answer

AS_PATH length is always preferred over local-preference in BGP best path selection.

Answer

The route-map should be applied outbound on R1 instead.

Answer

R2's BGP table shows the local-preference as 150 for the path via R1, but the best path selection ignores it due to a bug.

Question 9

Examine the following EEM applet configuration:

!---
event manager applet BACKUP_CONFIG
event timer watchdog time 86400
action 1.0 cli command "enable"
action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg"
!---

What is the effect of this configuration?

Accepted Answer

The applet will copy the running configuration to the TFTP server every 24 hours.. The applet uses a watchdog timer event that triggers every 86400 seconds (24 hours). When triggered, it copies the running configuration to a TFTP server. This is a valid configuration for periodic backup.

Answer

The applet will copy the startup configuration instead of the running configuration.

Answer

The applet will fail because the TFTP server IP address is not reachable.

Answer

The applet will only trigger once because the watchdog timer is a one-shot timer.

Question 10

Consider the following EEM applet configuration:

!---
event manager applet HIGH_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt entry-val 90 poll-interval 10
action 1.0 syslog msg "CPU utilization exceeded 90%"
!---

What is the problem with this configuration?

Accepted Answer

The OID is a scalar, so 'entry-op' and 'entry-val' cannot be used; they are only for table entries.. The 'event snmp oid' command requires a 'get-type' of 'exact' or 'next', but the OID specified is for a specific instance (cpmCPUTotal5sec). However, the OID is not complete; it should include the instance index. Additionally, the 'entry-op' and 'entry-val' are used for table entries, but this OID is a scalar. The correct approach is to use 'event snmp oid' with a scalar OID and use 'poll-interval' with 'entry-op' and 'entry-val' only for table entries. This configuration may cause the applet to not trigger correctly.

Answer

The 'poll-interval' is too short and will cause high CPU usage.

Answer

The applet will work correctly and generate a syslog message when CPU exceeds 90%.

Answer

The 'get-type exact' is incorrect; it should be 'get-type next'.

Question 11

R1 and R2 are iBGP peers in AS 65001. R1 has: neighbor 10.1.1.2 next-hop-self. R2 advertises a prefix 10.0.0.0/8 with next-hop 10.1.1.2. R1 receives the prefix and changes the next-hop to 10.1.1.1 (its own IP) due to next-hop-self. R1 then advertises this prefix to its eBGP peer R3 in AS 65002. R3 receives the prefix with next-hop 10.1.1.1. R3 has a static route to 10.1.1.0/24 via its interface to R1. However, R3 cannot reach 10.0.0.0/8 because R1 does not have a route to 10.0.0.0/8 in its routing table. What is the root cause?

Accepted Answer

R1 does not have a route to 10.0.0.0/8 in its routing table because the BGP route is not installed due to next-hop unreachable or administrative distance conflict.. R1 uses next-hop-self to change the next-hop to its own IP, but R1 must have a valid route to the prefix in its routing table to forward traffic. If R1 does not install the BGP route (e.g., because it is not the best path due to a higher metric or because the next-hop is unreachable), then R1 will not have a route to 10.0.0.0/8 in its routing table, and packets sent to R1 for that prefix will be dropped. The root cause is that R1 does not have the prefix installed in its routing table, possibly because it learned it from R2 but the next-hop (10.1.1.2) is not reachable in R1's routing table, or because R1 has a higher administrative distance route that overrides.

Answer

R3 should use next-hop-self to R1.

Answer

The next-hop-self command on R1 is misconfigured; it should be on R2.

Answer

R1's BGP table shows the prefix with next-hop 10.1.1.1, but that is the next-hop after next-hop-self; the issue is that R1 did not originate the route.

Question 12

Examine the following EEM applet configuration:

!---
event manager applet RELOAD_NOTIFY
event syslog pattern "%SYS-5-RELOAD"
action 1.0 cli command "enable"
action 2.0 cli command "send log "Router is reloading""
!---

What is the effect of this configuration?

Accepted Answer

The applet will fail because 'send log' is not a valid IOS command.. The applet triggers on a syslog message indicating a reload. It then executes a 'send log' command, which is not a valid IOS command. The correct command is 'send log' is not valid; the intended command might be 'send' or 'logger'. This will cause the action to fail, and the applet will not execute successfully.

Answer

The applet will send a log message to the console when a reload is initiated.

Answer

The applet will prevent the reload from occurring.

Answer

The applet will generate a syslog message with the text "Router is reloading".

Question 13

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# debug ip bgp updates

BGP(0): 10.1.1.2 UPDATE rcvd w/ attr: nexthop 10.1.1.2, origin i, localpref 100, metric 0
BGP(0): 10.1.1.2 rcvd 192.168.1.0/24
BGP(0): 10.1.1.2 rcvd UPDATE w/ attr: nexthop 10.1.1.2, origin i, localpref 100, metric 0
BGP(0): 10.1.1.2 rcvd 192.168.2.0/24
BGP(0): 10.1.1.2 rcvd UPDATE w/ attr: nexthop 10.1.1.2, origin i, localpref 100, metric 0 -- unreachable
BGP(0): 10.1.1.2 rcvd 192.168.3.0/24

What does this output indicate?

Accepted Answer

The neighbor 10.1.1.2 is withdrawing the prefix 192.168.3.0/24 while advertising 192.168.1.0/24 and 192.168.2.0/24.. The debug ip bgp updates output shows received BGP updates from neighbor 10.1.1.2. The third update includes 'unreachable', indicating that the neighbor is withdrawing the route 192.168.3.0/24. The other prefixes are being advertised normally.

Answer

The neighbor 10.1.1.2 is advertising three new prefixes: 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24.

Answer

The neighbor 10.1.1.2 is flapping all three prefixes due to a BGP session reset.

Answer

The neighbor 10.1.1.2 is sending a malformed update for 192.168.3.0/24, causing it to be marked as unreachable.

Question 14

What is the default BGP update timer interval in Cisco IOS-XE?

Accepted Answer

30 seconds for eBGP, 0 seconds for iBGP. BGP does not have a fixed update timer like RIP; updates are triggered by changes, but the default minimum route advertisement interval (MRAI) is 30 seconds for eBGP and 0 seconds for iBGP.

Answer

60 seconds for both eBGP and iBGP

Answer

5 seconds for eBGP, 15 seconds for iBGP

Answer

0 seconds for eBGP, 30 seconds for iBGP

Question 15

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Accepted Answer

The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.. EEM applets execute actions sequentially. If a 'set' action modifies a variable, that new value is used in any subsequent 'if' condition that references the same variable. Variables are not pre-evaluated; they are evaluated at the time the action is executed.

Answer

The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

Answer

The 'set' action cannot modify a variable that is used in an 'if' condition.

Answer

The applet will fail if a variable is modified after being used in an 'if' condition.

Question 16

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
  Refresh Epoch 2
  65002
    10.2.2.2 from 10.2.2.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 50, valid, external

What does this output indicate?

Accepted Answer

The path from AS 65001 is the best path due to its higher local preference of 100.. The show bgp ipv4 unicast command displays BGP paths for a specific prefix. Here, two paths are available: one from AS 65001 with local preference 100, and one from AS 65002 with local preference 50. The path with higher local preference (100) is selected as best.

Answer

Both paths are equally preferred, and BGP load-balances traffic to 192.168.1.0/24.

Answer

The path from AS 65002 is preferred because it has a lower local preference.

Answer

The path from AS 65002 is the best path because it has a lower metric.

Question 17

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp neighbors 10.1.1.2 advertised-routes
BGP table version is 14, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/24      0.0.0.0                  0         32768 i
*> 192.168.1.0/24   0.0.0.0                  0         32768 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is advertising two routes to neighbor 10.1.1.2, both originated locally.. The show bgp neighbors advertised-routes command shows routes that R1 is advertising to neighbor 10.1.1.2. The output lists two prefixes: 10.0.0.0/24 and 192.168.1.0/24. The next hop of 0.0.0.0 indicates these are locally originated routes (e.g., via network statement or redistribution).

Answer

R1 is receiving two routes from neighbor 10.1.1.2.

Answer

R1 is advertising two routes, but one is suppressed due to dampening.

Answer

R1 is advertising two routes, but the neighbor is not receiving them due to filtering.

Question 18

What is the default BGP keepalive timer value in Cisco IOS-XE?

Accepted Answer

60 seconds. The default BGP keepalive timer is 60 seconds, as defined in RFC 4271 and implemented in Cisco IOS-XE.

Answer

30 seconds

Answer

90 seconds

Answer

180 seconds

Question 19

Which TWO statements correctly describe the behavior of BGP conditional route injection? (Choose TWO.)

Accepted Answer

The condition for injection is defined by an exist-map, which must match a less specific prefix in the BGP table.. BGP conditional route injection allows a router to inject a more specific prefix into BGP when a condition (the existence of a less specific prefix) is met. The injected route is sourced from a route-map that defines the inject-map, and the condition is checked via an exist-map. The injected route is not automatically redistributed into other protocols unless explicitly configured. The 'show ip bgp neighbors' command does not display injection statistics; instead, 'show ip bgp injected-paths' is used. The injected prefix must be in the BGP table of the injecting router, but not necessarily learned from the neighbor specified in the inject-map.

Answer

The injected route is automatically redistributed into connected and static routes.

Answer

The 'show ip bgp neighbors' command displays the number of injected prefixes per neighbor.

Answer

The injected prefix must be learned from the neighbor specified in the inject-map.

Question 20

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

Accepted Answer

event cli. EEM provides the 'event cli' event type to match on CLI commands. The syntax is 'event cli pattern <string>' where the pattern can be a regular expression to match the command. Other event types like 'event syslog' match syslog messages, not CLI commands.

Answer

event syslog

Answer

event snmp

Answer

event timer