300-410 Practice Exam 56 — 20 Questions

Question 1

In EIGRP, which of the following K values is disabled by default and is associated with the maximum transmission unit (MTU)?

Accepted Answer

K5 (MTU). By default, EIGRP uses only K1 (bandwidth) and K3 (delay) in its composite metric calculation, with K1 and K3 set to 1. K2 (load), K4 (reliability), and K5 (MTU) are set to 0, meaning they are disabled by default. This question specifically targets the K value related to MTU, which is K5. Therefore, K5 (MTU) is the correct answer.

Answer

K1 (bandwidth)

Answer

K3 (delay)

Answer

K2 (load)

Question 2

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Accepted Answer

Configure source interface and direction. First, you must define the source interface and traffic direction. Next, specify the ERSPAN ID and destination IP address. Then, configure the ERSPAN origin IP address on the source switch. After that, enable the ERSPAN session globally. Finally, verify the session is active.

Question 3

A router has CoPP configured with a class-map that matches BGP traffic (TCP port 179) and polices it to 500 pps. The router has multiple iBGP peers. After applying the policy, some BGP sessions flap, but others remain stable. The flapping peers are those with higher latency. Which is the most likely explanation?

Accepted Answer

High-latency peers generate more TCP retransmissions, which are more likely to be dropped by the police rate, causing session flaps.. B is correct because high-latency BGP peers experience more TCP retransmissions due to delayed acknowledgments. The CoPP policer drops packets exceeding 500 pps, and these retransmissions increase the packet rate for those sessions, making them more likely to exceed the policer and be dropped. Dropping BGP TCP segments (including keepalives) causes the BGP hold timer to expire, leading to session flaps.

Answer

CoPP drops BGP packets based on source IP, and high-latency peers have different source IPs.

Answer

BGP uses UDP for keepalives, and CoPP only polices TCP.

Answer

The CoPP policy is applied to the wrong control plane; it should be applied to the forwarding plane.

Question 4

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# debug ip packet 110
IP packet debugging is on for access list 110
*Mar  1 00:15:22.345: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x2, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23
*Mar  1 00:15:22.346: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x10, sport 12345, dport 23, access list 110: matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23

What does this output indicate?

Accepted Answer

Telnet traffic from 10.1.1.1 to 10.2.2.2 is being denied by ACL 110.. The debug output shows packets with source IP 10.1.1.1 and destination IP 10.2.2.2, protocol TCP, destination port 23 (Telnet), and the log explicitly states 'matched line 10 deny tcp host 10.1.1.1 host 10.2.2.2 eq 23'. This confirms that ACL 110 is denying Telnet traffic from 10.1.1.1 to 10.2.2.2. The flags 0x2 (SYN) and 0x10 (ACK) indicate the initial and subsequent packets of the Telnet session are both being denied.

Answer

Telnet traffic from 10.1.1.1 to 10.2.2.2 is being permitted by ACL 110.

Answer

ACL 110 is applied outbound on GigabitEthernet0/0.

Answer

ACL 110 has no line 10.

Question 5

An engineer configures mutual redistribution between OSPF and EIGRP. After a few minutes, routing loops occur. The engineer did not use route tagging. Which is the most likely explanation?

Accepted Answer

Without route tagging, OSPF redistributes EIGRP routes back into OSPF, and EIGRP redistributes OSPF routes back into EIGRP, creating a cycle.. Mutual redistribution without route tagging creates a feedback loop: OSPF redistributes EIGRP-learned routes back into OSPF, and EIGRP redistributes OSPF-learned routes back into EIGRP. Each protocol re-advertises the other's routes, causing them to be learned and re-injected repeatedly, which leads to routing loops. Route tagging (e.g., using a route-map to set a tag) is the standard method to prevent such cycles by filtering redistributed routes that already originated from the other protocol.

Answer

Routes redistributed from OSPF into EIGRP have a higher administrative distance than the original OSPF routes, causing them to be preferred.

Answer

Redistributed routes retain their original metric, which can cause them to be preferred over the original route.

Answer

The seed metric for redistribution is not set, causing the redistributed routes to be rejected.

Question 6

In a VRF-Lite environment, EIGRP is configured between two routers. The engineer notices that the EIGRP neighbor relationship is flapping intermittently. Debug output shows 'dually' messages and the route is occasionally marked as 'stuck-in-active' (SIA). The link is Ethernet with no errors. Which is the most likely explanation?

Accepted Answer

A unidirectional link issue is present, where EIGRP packets are successfully sent but not received, causing the query process to time out.. EIGRP uses the Reliable Transport Protocol (RTP) for updates, queries, and replies. If there is a unidirectional link issue (e.g., one direction has high latency or packet loss), the query process may not receive replies in time, causing the route to become SIA. This is a classic edge case where the link appears operational but is unidirectional for EIGRP packets.

Answer

The EIGRP K-values are mismatched between the two routers, causing the neighbor to reset.

Answer

The EIGRP stub routing feature is enabled on one router, preventing query propagation and causing the active process to hang.

Answer

The 'eigrp log-neighbor-changes' command is causing excessive logging, which delays EIGRP processing.

Question 7

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          1000
High Watermark:                           1000

Flows added:                              50000
Flows aged:                               49000
  - Active timeout (1800 secs)           40000
  - Inactive timeout (15 secs)           8000
  - Event aged                           0
  - Watermark aged                       1000
  - Emergency aged                       0

Based on this output, what is the most likely issue?

Accepted Answer

The cache size is too small, causing watermark aging and potential loss of flow data.. The cache is full (1000 current entries, high watermark 1000), and watermark aging has occurred (1000 flows aged due to watermark). This indicates the cache is overflowing, causing flows to be aged prematurely to make room for new flows. This can lead to incomplete data.

Answer

The active timeout is set too low at 1800 seconds.

Answer

The inactive timeout is set too low at 15 seconds.

Answer

The flow exporter is not configured.

Question 8

An engineer is troubleshooting a router that is not sending syslog messages to the syslog server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap informational'. The engineer can ping the syslog server from the router. 'show logging' shows that the logging buffer is filling with messages. What is the most likely cause?

Accepted Answer

The 'logging source-interface' command is missing, causing syslog messages to use an incorrect source IP.. The router can ping the syslog server and the logging buffer is filling, which confirms network reachability and that the router is generating syslog messages. However, without the 'logging source-interface' command, syslog packets use the IP address of the egress interface, which may not be reachable from the server (e.g., due to ACLs or routing asymmetry). This causes the server to drop the packets, even though the router can reach the server. The 'logging host' and 'logging trap informational' commands are correctly configured, so the issue lies in the source IP selection.

Answer

The syslog server is not listening on UDP port 514.

Answer

The 'logging on' command is not configured.

Answer

The syslog server's IP address is incorrect in the configuration.

Question 9

In DHCPv6, what is the purpose of the 'managed-config-flag' in Router Advertisement messages?

Accepted Answer

It indicates that hosts should use DHCPv6 to obtain their IPv6 address and other configuration parameters.. The 'managed-config-flag' (M flag) in Router Advertisement (RA) messages, as defined in RFC 3315 and RFC 4861, tells hosts to use stateful DHCPv6 for both IPv6 address assignment and other configuration parameters (e.g., DNS servers). When set to 1, hosts must use DHCPv6 to obtain their IPv6 address, overriding SLAAC for addressing. This flag is part of the RA's prefix information option and directly controls whether hosts perform stateful or stateless address configuration.

Answer

It indicates that hosts should use SLAAC for addressing and DHCPv6 for other configuration only.

Answer

It indicates that the router is a DHCPv6 server.

Answer

It indicates that hosts should use only stateless address autoconfiguration.

Question 10

What is the default logging severity level for messages sent to the console in Cisco IOS-XE?

Accepted Answer

Level 7 (debugging). By default, Cisco IOS-XE logs messages with severity level 7 (debugging) and higher to the console.

Answer

Level 0 (emergencies)

Answer

Level 5 (notifications)

Answer

Level 4 (warnings)

Question 11

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

Accepted Answer

Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.. IPv6 Source Guard relies on the IPv6 binding table to validate traffic. When a host uses a static IPv6 address, the switch cannot learn the binding via DHCPv6 snooping. Enabling IPv6 ND snooping on the VLAN allows the switch to inspect Neighbor Discovery (ND) messages (RFC 4861) and dynamically populate the binding table with the host's IPv6 address and MAC address, thus permitting the traffic without disabling Source Guard.

Answer

Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.

Answer

Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.

Answer

Disable IPv6 Source Guard on the port connected to the host.

Question 12

Which TWO statements about the 'log' keyword in IPv4 ACL entries are correct? (Choose TWO.)

Accepted Answer

The log message includes the source and destination IP addresses and the protocol.. When the 'log' keyword is configured on an ACL entry, the router generates a syslog message that includes the source and destination IP addresses, the protocol (e.g., TCP, UDP, ICMP), and for TCP/UDP, the source and destination port numbers. This logging provides essential information for troubleshooting and security monitoring.

Answer

The 'log' keyword causes the router to generate a syslog message for every packet that matches the ACE.

Answer

The 'log' keyword is only available in extended ACLs, not standard ACLs.

Answer

Using the 'log' keyword significantly improves router performance by offloading logging to the CPU.

Question 13

A network engineer runs the following command on Router R1:

R1# show route-map
route-map FILTER_OSPF, permit, sequence 10
  Match clauses:
    ip address prefix-list OSPF_ROUTES
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
route-map FILTER_OSPF, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, which statement is correct?

Accepted Answer

The route-map will permit all routes that match the prefix-list OSPF_ROUTES and deny all others.. The route-map FILTER_OSPF has two sequences: sequence 10 permits routes matching prefix-list OSPF_ROUTES, and sequence 20 denies all other routes (since no match clause). The match counters show 0 packets/bytes, indicating no traffic has been matched yet, but this is a route-map used for route filtering, not policy routing. The correct answer is that the route-map will deny all routes not matching the prefix-list.

Answer

The route-map will permit all routes because sequence 20 has no match clause.

Answer

The route-map is used for policy-based routing and has matched 0 packets.

Answer

The route-map will deny only routes matching the prefix-list OSPF_ROUTES.

Question 14

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec using a crypto map. The tunnel works for unicast traffic, but OSPFv3 over the tunnel fails to form adjacency. The engineer checks the crypto map and sees that it only matches traffic with a specific access-list. What is the most likely explanation?

Accepted Answer

The crypto map access-list must include IPv6 protocol 89 (OSPF) to encrypt OSPFv3 packets; otherwise, they are sent in the clear and may be dropped.. OSPFv3 uses IPv6 protocol number 89 for its packets. When a crypto map is applied with an access-list that only matches specific traffic (e.g., unicast data), OSPFv3 packets (protocol 89) are not matched and are sent unencrypted. If the IPsec peer is configured to drop unencrypted traffic or if the GRE tunnel requires all traffic to be encrypted, OSPFv3 adjacency fails. Adding protocol 89 to the access-list ensures OSPFv3 packets are encrypted and processed correctly.

Answer

OSPFv3 cannot be encrypted with IPsec; it requires a separate encryption mechanism.

Answer

The GRE tunnel interface must be configured with 'tunnel protection ipsec' instead of a crypto map.

Answer

The crypto map is applied to the physical interface instead of the tunnel interface.

Question 15

A router is configured with uRPF (Unicast Reverse Path Forwarding) in strict mode on an interface that belongs to a VRF. The network uses asymmetric routing for load balancing. The engineer notices that legitimate traffic from a customer is being dropped. Which is the most likely explanation?

Accepted Answer

The uRPF strict mode requires that the source IP address be reachable via the same interface, but asymmetric routing causes the return path to use a different interface.. Strict uRPF checks that the source IP address of incoming packets has a route in the routing table that points back to the same interface. In asymmetric routing, the return path may be different (e.g., out another interface), so the source IP may not have a route back to the incoming interface. This causes legitimate traffic to be dropped. The edge case is that uRPF strict mode does not account for asymmetric routing, while loose mode does.

Answer

The uRPF loose mode is configured instead of strict mode, which only checks that a route exists for the source IP, not the interface.

Answer

The VRF has a default route that points to the incoming interface, causing uRPF to always succeed.

Answer

The 'ip verify unicast source reachable-via any' command is used, which is the loose mode, not strict.

Question 16

What is the default dead interval multiplier for OSPFv3?

Accepted Answer

4. In OSPFv3, the default dead interval multiplier is 4, meaning the router dead interval is calculated as 4 times the hello interval. This is defined in RFC 5340 and is consistent with OSPFv2 behavior, ensuring that a neighbor is declared down after missing four consecutive hello packets.

Answer

3

Answer

5

Answer

2

Question 17

Examine the RSPAN configuration:

vlan 100
 name RSPAN_VLAN
 remote-span
!
monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination remote vlan 100

What is the purpose of the 'remote-span' command under VLAN 100?

Accepted Answer

It allows VLAN 100 to be used for RSPAN traffic across multiple switches.. The 'remote-span' command designates VLAN 100 as an RSPAN VLAN, allowing it to carry mirrored traffic across switches. This is its primary purpose. While it also prevents user data traffic, that is a secondary effect, not the main purpose.

Answer

It enables spanning tree on VLAN 100.

Answer

It prevents VLAN 100 from being used for user data traffic.

Answer

It configures VLAN 100 as a native VLAN.

Question 18

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# debug ip bgp updates

Output:
BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, path 65002
BGP(0): 10.0.0.2 rcvd 10.1.1.0/24
BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, path 65002 65003
BGP(0): 10.0.0.2 rcvd 10.2.2.0/24

What does this output indicate?

Accepted Answer

The router is receiving BGP updates for prefixes 10.1.1.0/24 and 10.2.2.0/24 from neighbor 10.0.0.2.. The output shows BGP updates being received from neighbor 10.0.0.2, including prefixes and AS path information. This indicates successful BGP peering and route exchange.

Answer

The router is sending BGP updates to neighbor 10.0.0.2.

Answer

The router is experiencing a BGP route flap.

Answer

The router is filtering BGP updates due to a prefix list.

Question 19

Consider this OSPF configuration on router R4:

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
 neighbor 10.0.0.2

What is the effect of the neighbor statement?

Accepted Answer

The neighbor command is ignored because the network type is broadcast by default on Ethernet interfaces.. The neighbor command is used in OSPF for non-broadcast multi-access (NBMA) networks to manually specify neighbors. However, the interface used to reach 10.0.0.2 must be configured with the appropriate network type (e.g., point-to-multipoint or non-broadcast). If the network type is broadcast or point-to-point, the neighbor command is ignored.

Answer

R4 will attempt to form an OSPF adjacency with 10.0.0.2 over any interface that can reach it.

Answer

R4 will send unicast OSPF packets to 10.0.0.2, but only if the interface is in area 0.

Answer

The configuration is invalid because the neighbor command must include a priority.

Question 20

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?

Accepted Answer

The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.. PBR forwards traffic to the firewall, but the firewall is configured to drop traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall policy to allow traffic from the source subnet.

Answer

The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.

Answer

The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.