300-410 Practice Exam 55 — 20 Questions

Question 1

Examine this BGP configuration on router R6:

router bgp 65006
 bgp router-id 6.6.6.6
 neighbor 10.6.6.7 remote-as 65007
 neighbor 10.6.6.7 weight 200
!

What is the effect of the weight command?

Accepted Answer

It sets the weight of all routes learned from 10.6.6.7 to 200, making them preferred over routes with lower weight.. The weight command assigns a weight value to routes from a specific neighbor. Weight is a Cisco-specific attribute that is local to the router. Higher weight is preferred over other routes. The default weight for eBGP routes is 0, so weight 200 makes routes from this neighbor preferred.

Answer

It sets the weight of routes sent to 10.6.6.7 to 200.

Answer

It has no effect because weight is only configurable under route-map.

Answer

It sets the MED value to 200 for routes from this neighbor.

Question 2

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP

class-map: MANAGEMENT (match-all)
      5 packets, 500 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 5 packets, 500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

class-map: ATTACK (match-all)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 100 packets, 10000 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Based on this output, what is happening to traffic matching class ATTACK?

Accepted Answer

All traffic in class ATTACK is being dropped.. The output shows that for class ATTACK, 100 packets were exceeded and dropped. This means the traffic rate exceeded the committed information rate (CIR) of 8000 bps, and all packets were dropped as per the exceed action.

Answer

All traffic in class ATTACK is being transmitted.

Answer

Traffic in class ATTACK is being rate-limited but not dropped.

Answer

Traffic in class ATTACK is being marked down.

Question 3

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Flap
3    00:01:32 UTC Mar 1  syslog              EIGRP_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Accepted Answer

The router is experiencing network instability causing repeated neighbor state changes.. The 'show event manager history events' command shows the last triggered events. The output shows repeated syslog events for EIGRP neighbor down and OSPF neighbor flap within a short timeframe, indicating a flapping condition. The correct answer is that the router is experiencing network instability causing repeated neighbor state changes.

Answer

The EEM policies are not configured correctly.

Answer

The EEM applet policies are disabled.

Answer

The syslog server is not reachable.

Question 4

A network engineer configures redistribution between OSPF and EIGRP on a multi-access link. After configuration, OSPF neighbors keep flapping. Router R1 config:
interface GigabitEthernet0/0
 ip ospf network broadcast
 ip ospf hello-interval 10
!
router ospf 1
 redistribute eigrp 100 subnets
!
router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500

R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2      1   FULL/DR        00:00:35     10.1.1.2        GigabitEthernet0/0
192.168.1.3      1   2WAY/DROTHER   00:00:31     10.1.1.3        GigabitEthernet0/0

What is the root cause?

Accepted Answer

The OSPF hello interval is too low, causing neighbor flapping under load from redistribution.. The OSPF network type is broadcast, but the EIGRP redistribution may be causing OSPF LSAs to be flooded with high CPU load, leading to neighbor flapping. Additionally, the hello interval is set to 10 seconds, but the dead interval is not explicitly set, defaulting to 40 seconds. If the router is overloaded, hello packets may be missed. The fix is to increase the dead interval or adjust the network type to point-to-point.

Answer

The EIGRP metric is misconfigured, causing route inconsistency.

Answer

The OSPF network type broadcast requires a DR/BDR election, causing instability.

Answer

The redistribute command under OSPF is missing the metric type.

Question 5

A network engineer is troubleshooting a DHCPv4 relay scenario where clients on subnet 10.1.1.0/24 are unable to obtain IP addresses from a DHCP server at 192.168.1.10. The router interface Gi0/0 (10.1.1.1/24) has 'ip helper-address 192.168.1.10' configured. The engineer captures packets and sees DHCP DISCOVER messages sourced from 10.1.1.1 being sent to 192.168.1.10, but no replies are seen. The server is reachable via ping from the router. What is the most likely cause?

Accepted Answer

The DHCP server is not configured with a scope for subnet 10.1.1.0/24.. The DHCP server may not have a route back to the client subnet (10.1.1.0/24) or the server's default gateway does not have a route. The relay agent sets the gateway IP address (giaddr) to the interface IP (10.1.1.1), and the server sends the OFFER back to that giaddr. If the server cannot reach 10.1.1.1, the reply is lost. However, the engineer confirms the server is reachable via ping, so the issue is likely that the server is not configured with a scope for the 10.1.1.0/24 subnet, causing it to drop the DISCOVER.

Answer

The DHCP server does not have a route to 10.1.1.0/24.

Answer

The 'ip helper-address' command should be configured on the server-facing interface, not the client-facing interface.

Answer

The router needs the 'ip dhcp relay information option' command.

Question 6

A network engineer runs the following command on switch SW1:

SW1# show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
    Both : Gi0/1, Gi0/2
Destination Ports : Gi0/3
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.. The output shows a local SPAN session with source ports Gi0/1 and Gi0/2, and destination port Gi0/3. The destination port is configured with native encapsulation and ingress is disabled, meaning traffic received on the destination port is not forwarded. The session is active and correctly configured.

Answer

The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.

Answer

The SPAN session is using RSPAN because the destination port has ingress disabled.

Answer

The SPAN session is not active because the destination port is not in forwarding state.

Question 7

A large enterprise network is experiencing intermittent IPv6 connectivity between two remote sites connected via an IPv6-in-IPv4 manual tunnel. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 ipv6 route 2001:DB8:2::/64 Tunnel0. Router R2 shows: R2# show ipv6 route 2001:DB8:1::/64 % Route not found. The tunnel interface is up/up on both routers, and IPv4 reachability between tunnel endpoints is verified. What is the root cause?

Accepted Answer

R2 is missing a static route for 2001:DB8:1::/64 pointing to its Tunnel0 interface.. The issue is that R2 has no route to the 2001:DB8:1::/64 network, which is the tunnel subnet on R1's side. Even though the tunnel is up/up and IPv4 reachability exists, R2 cannot return traffic to R1's tunnel endpoint address because it lacks a static route pointing to its own Tunnel0 interface. This is a common misconfiguration in point-to-point IPv6-in-IPv4 manual tunnels where both sides must have reciprocal static routes for the remote tunnel networks.

Answer

The tunnel destination on R1 is incorrect and should be 198.51.100.2.

Answer

The tunnel mode must be changed to ipv6ip for IPv6-in-IPv4 tunneling.

Answer

IPv6 unicast-routing is disabled on R2.

Question 8

An engineer is troubleshooting a DMVPN phase 2 deployment with IPv6 over mGRE tunnels. The spoke routers can ping the hub's tunnel IPv6 address, but cannot reach IPv6 networks behind other spokes. The engineer verifies that NHRP is configured and that the hub has a route to the spoke's internal networks. What is the most likely cause?

Accepted Answer

The spoke routers are missing a static route for the remote spoke's internal network pointing to the mGRE tunnel interface.. In a DMVPN Phase 2 deployment, spoke routers must have a route to remote spoke networks pointing to the mGRE tunnel interface. Without this static route, the spoke will not know to send traffic for the remote spoke's internal network over the tunnel, even though NHRP resolves the next-hop. The hub has a route to the spoke's internal networks, but that does not enable direct spoke-to-spoke communication without proper routing on the spokes themselves.

Answer

The NHRP authentication key is mismatched between the spokes.

Answer

The tunnel key is not configured on the mGRE interface.

Answer

The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.

Question 9

A network engineer configures SNMPv2c on router R3 with 'snmp-server community cisco RO' and 'snmp-server community cisco RW'. The NMS can poll read-only data but fails when trying to write a configuration value. The NMS uses the RW community string. What is the most likely cause?

Accepted Answer

The community string 'cisco' is used for both RO and RW; the router applies the first matching community, which is RO.. When two SNMPv2c community strings are identical (both 'cisco'), the router applies the first matching entry in its configuration. Since 'snmp-server community cisco RO' is configured before 'snmp-server community cisco RW', the router treats all requests using 'cisco' as read-only, regardless of the intended access level. This prevents write operations even when the NMS correctly sends the RW community string.

Answer

The NMS is sending the community string in uppercase, but the router expects lowercase.

Answer

The router needs the 'snmp-server enable traps' command to allow write operations.

Answer

The NMS must use SNMPv3 for write operations; SNMPv2c does not support writes.

Question 10

Examine the following configuration:
```
interface GigabitEthernet0/3
 ip access-group WEB_ONLY out
!
ip access-list extended WEB_ONLY
 permit tcp any any eq 80
 permit tcp any any eq 443
```
What is the effect of this ACL when applied outbound on GigabitEthernet0/3?

Accepted Answer

It permits only HTTP and HTTPS traffic to leave the interface; all other traffic is denied.. The ACL named WEB_ONLY explicitly permits TCP traffic destined for ports 80 (HTTP) and 443 (HTTPS). When applied outbound on GigabitEthernet0/3, it filters traffic leaving the interface. Since every ACL has an implicit deny any at the end, only HTTP and HTTPS traffic is permitted outbound; all other traffic is denied.

Answer

It permits all web traffic entering the interface.

Answer

It permits all TCP traffic to any destination.

Answer

It has no effect because the ACL is missing a deny statement.

Question 11

A network engineer configures SNMP traps on router R3 to monitor BGP events. R3 is an iBGP route reflector with multiple clients. The configuration includes: snmp-server enable traps bgp, snmp-server host 192.168.1.100 version 2c public. However, the NMS receives no BGP traps. R3's show snmp pending shows no pending traps. show snmp statistics shows TrapsSent: 0. The NMS can poll R3 successfully via SNMP. What is the root cause?

Accepted Answer

The BGP process is not configured to send traps to the SNMP agent; the command 'snmp-server enable traps bgp' is insufficient on some IOS versions without also enabling 'bgp snmp trap' under the BGP router configuration.. On many Cisco IOS versions, the command `snmp-server enable traps bgp` only enables the SNMP agent to send BGP traps, but the BGP process itself must be explicitly configured to generate those traps using the `bgp snmp trap` command under the BGP router configuration. Without this, the BGP process never sends trap notifications to the SNMP agent, resulting in zero traps sent despite the SNMP trap configuration being otherwise correct.

Answer

The NMS is using SNMPv3 but the router is configured for v2c, causing trap rejection.

Answer

An ACL on the NMS is blocking UDP port 162 from the router.

Answer

The router's SNMP trap queue is full, causing traps to be dropped.

Question 12

An engineer applies a CoPP policy to a router to protect the control plane from a DDoS attack. The policy includes a class-map matching UDP traffic to port 123 (NTP) and polices it to 1000 bps. After the policy is applied, the engineer notices that the router's clock is not synchronizing with its NTP server. The NTP server is reachable via ping. What is the most likely cause?

Accepted Answer

The CoPP policy is dropping NTP packets because the police rate is too low.. The CoPP policy is policing NTP traffic (UDP port 123) to only 1000 bps. NTP synchronization requires a steady exchange of packets, and a 1000 bps rate is extremely low—likely insufficient to allow the NTP packets through, causing them to be dropped. Since the NTP server is reachable via ping (ICMP is not affected by this CoPP policy), the issue is clearly that the police rate is too restrictive for NTP traffic.

Answer

The NTP server is not responding because of the DDoS attack.

Answer

The CoPP class-map is not matching NTP packets because it uses the wrong port number.

Answer

The router's NTP configuration has a wrong server IP address.

Question 13

Which control plane protocol packets are classified as 'critical' in the default CoPP policy?

Accepted Answer

OSPF hello packets and BGP keepalives. In the default Control Plane Policing (CoPP) policy on Cisco IOS/IOS-XE devices, control plane protocol packets are classified into three categories: critical, normal, and medium. OSPF hello packets and BGP keepalives are classified as 'critical' because they are essential for maintaining neighbor adjacencies and routing protocol convergence; dropping these packets can cause immediate network instability. The default CoPP policy uses class maps to match these protocols and applies a higher priority (e.g., police rate) to ensure they are processed before less critical traffic.

Answer

ICMP echo requests and SSH

Answer

Telnet and HTTP

Answer

NTP and SNMP

Question 14

Drag and drop the steps to configure a Control Plane Policing (CoPP) policy into the correct order, from first to last.

Accepted Answer

Create a class-map to match control plane traffic. The correct order starts by identifying traffic with a class-map, then grouping classes in a policy-map, applying actions (e.g., drop), attaching the policy to the control-plane, and finally verifying the configuration. This follows the standard MQC (Modular QoS CLI) workflow.

Question 15

Drag and drop the steps to troubleshoot Control Plane Policing (CoPP) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check if CoPP is applied to the control-plane. Troubleshooting CoPP failures starts by checking if the control-plane policy is applied, then verifying the class-map matches the correct protocol, checking for dropped packets, temporarily disabling CoPP to test, and finally adjusting the policy to permit the necessary traffic. This systematic approach isolates the issue without disrupting the network.

Question 16

A network engineer runs the following command to verify IPv6 uRPF on an interface:

R1# show ipv6 interface GigabitEthernet0/0 | include verify|suppress
  IPv6 verify source: strict
  IPv6 verify source suppress: disabled

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, and no suppression is configured, so all incoming packets are subject to strict verification.. The output shows 'IPv6 verify source: strict' and 'IPv6 verify source suppress: disabled'. This confirms that strict unicast Reverse Path Forwarding (uRPF) is enabled on the interface, meaning every incoming packet's source address is checked against the routing table to ensure the best return route uses the same incoming interface. Because suppression is disabled, no packets bypass this verification, so all incoming packets are subject to strict uRPF checks.

Answer

Loose uRPF is enabled with suppression.

Answer

uRPF is disabled on this interface.

Answer

Suppression is enabled, so uRPF checks are bypassed.

Question 17

A network engineer is troubleshooting an EIGRP adjacency issue between two directly connected routers, R1 and R2. Both routers are configured with the same autonomous system number, but the adjacency fails to come up. The engineer checks the interfaces and verifies that they are up/up. On R1, the output of 'show ip eigrp neighbors' shows nothing. What is the most likely cause of this problem?

Accepted Answer

The interfaces are configured with IP addresses from different subnets.. EIGRP requires that directly connected neighbors share a common subnet for their interfaces. If R1 and R2 have IP addresses from different subnets, EIGRP will not form an adjacency because the hello packets sent by one router will be considered invalid by the other due to the subnet mismatch. The 'show ip eigrp neighbors' output is empty because no neighbor has been discovered, which is consistent with this Layer 3 mismatch.

Answer

The EIGRP process is shut down on one of the routers.

Answer

The passive-interface default command is configured under the EIGRP process.

Answer

The EIGRP router ID is the same on both routers.

Question 18

A network engineer configures a 6to4 tunnel between two sites. The tunnel works for traffic from Site A to Site B, but return traffic from Site B to Site A fails. Both sites have IPv4 connectivity. What is the most likely explanation?

Accepted Answer

Site B's IPv4 address is private and not reachable from Site A; 6to4 requires public IPv4 addresses on both ends.. 6to4 tunnels require both endpoints to have globally routable public IPv4 addresses because the tunnel encapsulation uses the IPv4 address to derive the IPv6 prefix (2002::/16). If Site B has a private IPv4 address (e.g., 10.x.x.x or 192.168.x.x), Site A cannot route return traffic to it, as private addresses are not reachable over the public Internet. This explains why traffic from Site A to Site B works (Site A's public address is reachable), but return traffic fails.

Answer

The tunnel mode on Site B is configured as GRE IPv6 instead of 6to4.

Answer

The IPv6 MTU on the tunnel is set too high, causing fragmentation of return packets.

Answer

Site A has a firewall blocking incoming IPv4 protocol 41 packets.

Question 19

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Accepted Answer

uRPF is enabled in strict mode with allow-default. The command output explicitly shows 'IPv6 uRPF: strict mode (allow default route)', which confirms that uRPF is enabled in strict mode with the allow-default option. This configuration validates that the source address of incoming packets must have a matching route in the FIB pointing back to the same interface, and the allow-default keyword permits the use of a default route as a valid reverse path, which is necessary in scenarios where a default route is the only route to the source.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 20

A network engineer runs the following command to troubleshoot SNMP access lists:

R1# show snmp access
Access-list: 10
Community: public
View: v1default

Access-list: 20
Community: private
View: v1default

What does this output indicate?

Accepted Answer

SNMP access is controlled by ACLs: ACL 10 for 'public' and ACL 20 for 'private'.. The 'show snmp access' output displays the configured SNMP access control entries, which map community strings to access control lists (ACLs). In this case, ACL 10 is associated with the 'public' community and ACL 20 with the 'private' community, meaning SNMP access is restricted based on these ACLs. This is the standard method for controlling SNMPv1/v2c access, as the router uses the ACL to permit or deny SNMP requests from specific source IP addresses.

Answer

No ACLs are applied to SNMP, so all access is allowed.

Answer

The router uses SNMPv3 exclusively.

Answer

The 'public' community has read-write access.