300-410 Practice Exam 57 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot a BGP prefix issue:

R1# show bgp ipv4 unicast 192.168.10.0/24
BGP routing table entry for 192.168.10.0/24, version 5
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

What does this output indicate?

Accepted Answer

The prefix is learned via eBGP and is the best path.. The output shows the prefix 192.168.10.0/24 is learned from neighbor 10.1.1.2 with the path type 'external', indicating eBGP. The line 'valid, external, best' confirms it is the best path, making option A correct.

Answer

The prefix is learned via iBGP and is not the best path.

Answer

The prefix is suppressed and not advertised to peers.

Answer

The prefix is invalid due to missing next-hop reachability.

Question 2

An engineer configures uRPF strict mode on an interface. After configuration, legitimate traffic from a directly connected network is dropped. The network is connected via a single link, and there is no asymmetric routing. Which is the most likely explanation?

Accepted Answer

The router has a default route pointing to a different interface, causing the source IP to fail the reachability check.. In strict uRPF mode, the router checks that the source IP address of an incoming packet is reachable via the same interface on which the packet arrived. If the router has a default route pointing out a different interface, the source IP of a directly connected network may not have a specific route back through the receiving interface, causing the reachability check to fail and legitimate traffic to be dropped.

Answer

The directly connected network is not in the routing table because the interface is down.

Answer

The uRPF command is missing the 'allow-default' option, which is required for directly connected networks.

Answer

The router has a static route for the source network with a different next-hop, causing the interface check to fail.

Question 3

A network engineer runs the following command on Router PE4:

PE4# show bgp vpnv4 unicast all summary
BGP router identifier 10.0.0.4, local AS number 65001
BGP table version is 25, main routing table version 25
5 network prefixes using 640 bytes of memory
5 path entries using 400 bytes of memory
3/3 BGP path/bestpath attribute entries using 360 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1424 total bytes of memory
BGP activity 15/10 prefixes, 20/15 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.5        4        65001    1020    1015       25    0    0 00:12:34        5
10.0.0.6        4        65002     500     495       25    0    0 00:06:20        0

Based on this output, what is the problem?

Accepted Answer

Neighbor 10.0.0.6 is not sending any prefixes.. The BGP summary shows two neighbors: 10.0.0.5 (AS 65001) with 5 prefixes received, and 10.0.0.6 (AS 65002) with 0 prefixes received. The neighbor 10.0.0.6 has been up for 6 minutes but has not sent any prefixes. This indicates a problem with prefix advertisement from that neighbor.

Answer

Neighbor 10.0.0.5 is not exchanging prefixes.

Answer

Both neighbors are in the Idle state.

Answer

The BGP table is empty.

Question 4

A network engineer enables IPv6 First Hop Security with 'ipv6 dhcp guard' on a switch port connected to a legitimate DHCPv6 server. Clients on other ports receive DHCPv6 replies, but the server's port is being err-disabled repeatedly. The engineer checks the logs and sees DHCPv6 server advertisements being dropped. What is the most likely cause?

Accepted Answer

The port is not configured as 'trusted' for DHCPv6 Guard, causing all server advertisements to be dropped.. When 'ipv6 dhcp guard' is enabled on a switch port, all DHCPv6 server advertisements (REPLY and ADVERTISE messages) are dropped by default unless the port is explicitly configured as 'trusted'. Since the server's port is untrusted, the switch drops the legitimate server's advertisements, causing the port to be err-disabled due to repeated violations. Configuring 'ipv6 dhcp guard trust' on the server-facing port resolves this issue.

Answer

The DHCPv6 server is sending messages with an invalid DUID.

Answer

DHCPv6 Guard only works with stateful DHCPv6, not stateless.

Answer

The switch is running an older IOS version that does not support DHCPv6 Guard.

Question 5

A network engineer runs the following command on Router R1:

R1# show route-map
route-map PBR-ROUTE, permit, sequence 10
  Match clauses:
    ip address (access-lists): ACL-PBR
  Set clauses:
    ip next-hop 192.168.1.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-ROUTE, permit, sequence 20
  Match clauses:
  Set clauses:
    ip next-hop 192.168.2.2
  Policy routing matches: 0 packets, 0 bytes

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-ROUTE

Based on this output, what is the most likely problem?

Accepted Answer

The access list ACL-PBR does not exist or matches no traffic.. The show route-map output shows zero policy routing matches. The route map is applied to the interface, but the access list ACL-PBR may not match any traffic, or traffic is not arriving on GigabitEthernet0/0. The set clause in sequence 20 is applied unconditionally (no match clause), which would normally match all traffic, but sequence 10 must be evaluated first; if ACL-PBR matches nothing, sequence 20 would match all, yet counters still show zero, indicating no traffic is being policy-routed at all.

Answer

The route map is not applied to an interface.

Answer

The next-hop 192.168.1.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 6

What is the default dead interval on a Cisco IOS-XE router for OSPF on a broadcast network type?

Accepted Answer

40 seconds. On a broadcast network type, OSPF uses a default dead interval of 40 seconds, which is four times the default hello interval of 10 seconds. This relationship is defined in RFC 2328, ensuring that a neighbor is declared down only after missing four consecutive hello packets.

Answer

10 seconds

Answer

30 seconds

Answer

120 seconds

Question 7

A network engineer runs the following command to troubleshoot SNMP traps:

R1# show snmp host
Host: 10.1.1.2
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

Host: 10.1.1.3
Port: 162
Timeout: 30
Retries: 3
Community: trap-public
Version: 2c
Filter: none

What does this output indicate?

Accepted Answer

SNMP traps are sent to two NMS hosts: 10.1.1.2 and 10.1.1.3 using SNMPv2c.. The output of the 'show snmp host' command lists the configured SNMP trap receivers. Each entry shows a host IP address (10.1.1.2 and 10.1.1.3), port 162 (the standard SNMP trap port), and the SNMP version (2c). This confirms that the router is sending SNMPv2c traps to both NMS hosts, making option A correct.

Answer

SNMP traps are sent to host 10.1.1.2 only.

Answer

The router is configured to receive traps from these hosts.

Answer

SNMPv3 is used for trap communication.

Question 8

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection using a transform set that includes ESP encryption and authentication. The tunnel comes up, but OSPFv3 over the tunnel fails to form adjacency. The engineer notices that the tunnel interface has an MTU of 1400. What is the most likely explanation?

Accepted Answer

The IPsec transform set includes both ESP encryption and authentication, which adds 50+ bytes of overhead; the tunnel MTU of 1400 is too high for the actual path MTU after encapsulation.. When IPsec ESP encryption and authentication are applied to a GRE tunnel, the combined overhead (typically 50–60 bytes for ESP headers, trailers, and authentication data) reduces the effective payload MTU. With a tunnel interface MTU of 1400, the actual packet size after adding GRE (20 bytes) and IPsec overhead can exceed the path MTU, causing fragmentation or drops. OSPFv3 uses large hello packets (often 1500 bytes), and if the encapsulated packet exceeds the path MTU, adjacency cannot form.

Answer

OSPFv3 requires the tunnel interface to be configured with 'ipv6 ospf network point-to-point' to work over GRE.

Answer

The IPsec configuration is missing the 'crypto map' applied to the tunnel interface.

Answer

The GRE tunnel mode should be 'tunnel mode gre ipv6' instead of the default.

Question 9

An engineer configures MPLS forwarding on a router. The MPLS LDP neighbors are established, but some prefixes are not being assigned labels. The engineer checks the 'show mpls ldp bindings' and sees that the prefixes are missing. What is the most likely explanation?

Accepted Answer

The prefix is learned via BGP, and LDP does not assign labels to BGP routes by default.. MPLS LDP assigns labels to prefixes that are in the routing table and are IGP routes. If a prefix is learned via BGP, LDP will not assign a label to it by default unless the 'mpls ldp autoconfig' or 'label-distribution' is configured for BGP. Additionally, if the prefix is a connected route or a static route, LDP may not assign a label unless explicitly configured. The edge case is that the prefix is a BGP route, and LDP does not label BGP routes by default.

Answer

The 'mpls ldp advertise-labels' command is configured to deny the prefix.

Answer

The 'mpls ldp label' command is missing on the interface.

Answer

The 'tag-switching' is not enabled globally.

Question 10

CoPP is rate-limiting legitimate routing traffic. Router R1 has: class-map match-any ROUTING, match protocol bgp, match protocol ospf, policy-map COPP, class ROUTING, police 10000 conform-action transmit exceed-action drop. BGP sessions flap. What is the root cause?

Accepted Answer

The police rate is too low, causing drops of BGP packets.. B is correct because the police rate of 10,000 bps (10 kbps) is too low for BGP traffic. BGP uses TCP port 179 and can generate bursts of packets during keepalive and update exchanges; if the policer drops BGP packets, the TCP session times out and flaps. The class-map correctly matches both BGP and OSPF, but the rate limit is insufficient for the combined control-plane traffic.

Answer

The class-map should match only BGP, not OSPF.

Answer

CoPP should be applied to the control plane, not the data plane.

Answer

BGP sessions flap due to MTU mismatch, not CoPP.

Question 11

An engineer configures a route-map to filter OSPF routes using a distribute-list. The distribute-list is applied inbound on an OSPF interface. Unexpectedly, the router still installs the filtered routes. Which is the most likely explanation?

Accepted Answer

The route is also learned via another OSPF neighbor that is not filtered by the distribute-list.. When a distribute-list is applied inbound on an OSPF interface, it filters routes received from that specific neighbor only. If the same route is also learned from another OSPF neighbor (or via a different OSPF process) that is not covered by the distribute-list, the router will still install that route from the unfiltered source. This is because OSPF installs the best route based on metric, regardless of the filtering applied to a single neighbor.

Answer

The distribute-list is applied to the wrong direction; it should be outbound to filter routes being advertised.

Answer

The distribute-list uses an ACL that does not match the route exactly, so the route is permitted.

Answer

The distribute-list is applied after the route is already installed in the routing table, so it has no effect.

Question 12

Which TWO configuration changes are required to enable IPsec site-to-site VPN with IKEv2 and pre-shared keys on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure an IKEv2 keyring with the pre-shared key and peer IP address.. A is correct because IKEv2 uses a keyring to store pre-shared keys (PSKs) and associate them with specific peer IP addresses, replacing the legacy 'crypto isakmp key' command used in IKEv1. The keyring is then referenced by an IKEv2 profile, which binds the authentication method and other parameters to the VPN session.

Answer

Apply the 'crypto isakmp key' command globally for the peer.

Answer

Define a transform set under the IKEv2 policy.

Answer

Use the 'crypto map' command to reference the IKEv2 profile.

Question 13

R1 and R2 are running EIGRP with IPsec site-to-site VPN over a WAN link. The tunnel interface is used for the VPN. R1's EIGRP configuration includes a distribute-list out that filters prefix 192.168.1.0/24. R2's show ip eigrp topology shows the prefix as active but never transitions to passive. R2's show ip route does not have 192.168.1.0/24. What is the root cause?

Accepted Answer

R1's distribute-list out under EIGRP is filtering the prefix 192.168.1.0/24 from being advertised to R2.. The distribute-list out command on R1 filters the prefix 192.168.1.0/24 from being included in EIGRP updates sent to R2. Since R2 never receives the route, it remains in an active state (query state) because it is still waiting for a reply from R1, and it never transitions to passive. This directly explains why the prefix is missing from R2's routing table.

Answer

EIGRP split-horizon is enabled on the tunnel interface.

Answer

The IPsec tunnel is dropping EIGRP multicast packets.

Answer

R2 has a passive interface configured for the tunnel.

Question 14

A network engineer runs the following command on Router R4:

R4# show ip route 10.10.10.0
Routing entry for 10.10.10.0/24
  Known via "connected", distance 0, metric 0 (connected)
  Redistributing via eigrp 100
  Last update from 10.10.10.1 on GigabitEthernet0/0, 00:00:00 ago
  Routing Descriptor Blocks:
  * 10.10.10.1, via GigabitEthernet0/0
      Route metric is 0, traffic share count is 1

Based on this output, which statement is true?

Accepted Answer

The route is a connected route, as indicated by distance 0.. The route is directly connected, as indicated by 'known via connected' and distance 0. The administrative distance of 0 is the default for connected routes.

Answer

The route is a static route with distance 0.

Answer

The route is redistributed from EIGRP into connected.

Answer

The administrative distance of 0 indicates a floating static route.

Question 15

An engineer configures RSPAN VLAN 100 on two switches to monitor traffic across the network. The remote switch shows the RSPAN source as active, but the destination switch receives no mirrored traffic. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is not allowed on a trunk link between the source and destination switches.. RSPAN requires that the RSPAN VLAN be created and allowed on all intermediate switches (trunks) between source and destination. If the RSPAN VLAN is pruned or not allowed on a trunk, the mirrored traffic never reaches the destination. Additionally, the RSPAN VLAN must not be used for user data.

Answer

The RSPAN VLAN is configured as a native VLAN on the trunk, causing VLAN tagging issues.

Answer

The destination switch has a different RSPAN VLAN ID configured for the session.

Answer

The source switch has not enabled RSPAN globally with the 'monitor session' command.

Question 16

A router R1 is redistributing BGP routes into OSPF, but some prefixes are missing. Router R1 has the following relevant configuration: router bgp 65000 neighbor 10.1.1.2 remote-as 65001 address-family ipv4 unicast neighbor 10.1.1.2 activate network 172.16.0.0 mask 255.255.255.0 router ospf 1 redistribute bgp 65000 subnets metric 100 Router R2 shows: show ip ospf database external 172.16.0.0 OSPF Router with ID 10.1.1.1 Type-5 AS External Link States LS age: 600 Options: (No TOS-capability, DC) LS Type: AS External Link Link State ID: 172.16.0.0 Advertising Router: 10.1.1.1 LS Seq Number: 80000001 Checksum: 0x1234 Length: 36 Network Mask: /24 Metric Type: 2 (Larger than any valid route) TOS: 0 Metric: 16777215 Forward Address: 0.0.0.0 External Route Tag: 0 What is the root cause?

Accepted Answer

The BGP route 172.16.0.0/24 is not in the routing table; check BGP table and next-hop reachability.. The metric of 16777215 (max) indicates the route is unreachable. This happens when BGP route is not valid (e.g., missing next-hop reachability) or when route-map sets metric to max. The BGP route may not be installed in routing table due to missing network statement or next-hop issue. The correct fix is to ensure BGP route is valid and reachable.

Answer

The metric 100 is too low; increase to match OSPF cost.

Answer

The subnets keyword is missing; add it to redistribute classful routes.

Answer

The OSPF process ID is mismatched; use process 1 on both routers.

Question 17

In IPv6 FHS, which protocol is used to secure Neighbor Discovery messages with cryptographic authentication?

Accepted Answer

SEND. B is correct because SEND (Secure Neighbor Discovery, RFC 3971) uses Cryptographically Generated Addresses (CGAs) and RSA signatures to authenticate Neighbor Discovery (ND) messages, protecting against threats like Neighbor Advertisement spoofing and Duplicate Address Detection (DAD) attacks. Unlike IPsec, SEND does not require a pre-established security infrastructure or key management, making it practical for securing ND in IPv6 first-hop segments.

Answer

IPsec

Answer

SSL/TLS

Answer

MACsec

Question 18

Examine the following partial configuration on Router R1:
```
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel destination 2001:DB8:2::2
 tunnel mode ipv6ip
```
What is the effect of this configuration?

Accepted Answer

The tunnel will not come up because the tunnel destination is an IPv6 address instead of an IPv4 address.. The tunnel mode ipv6ip requires an IPv4 address as the tunnel destination because it encapsulates IPv6 packets inside IPv4 packets for transport over an IPv4 network. In this configuration, the tunnel destination is set to an IPv6 address (2001:DB8:2::2), which is invalid for this tunnel mode, preventing the tunnel interface from coming up.

Answer

The tunnel will successfully encapsulate IPv6 packets in IPv4 and forward them.

Answer

The tunnel will use IPv6 as the transport protocol, encapsulating IPv4 packets.

Answer

The configuration is correct for a 6to4 tunnel.

Question 19

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:1234    10.0.0.10:1234     203.0.113.5:53    203.0.113.5:53
tcp 192.0.2.10:5678    10.0.0.10:5678     198.51.100.20:80  198.51.100.20:80
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 100  Misses: 0
CEF Translated packets: 100, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 3
   map-id 1
   overload
   [Id] ip nat inside source list ACL1 pool POOL1 overload
   refcount 3

Based on this output, what is the problem?

Accepted Answer

The third translation is not using PAT, indicating a possible ACL or route-map misconfiguration.. The third translation lacks a protocol and port number, meaning it is a simple dynamic NAT entry without Port Address Translation (PAT). Since the pool is configured with the `overload` keyword, all translations should use PAT to share the pool addresses. The presence of a non-PAT translation indicates that the ACL or route-map used to match traffic for NAT is misconfigured, causing some traffic to be translated without port multiplexing.

Answer

The pool is exhausted because 192.0.2.10 is used twice.

Answer

The outside interface is misconfigured as inside.

Answer

The NAT translations are all static.

Question 20

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.10.10.0/24 should be forwarded to next-hop 192.168.100.2. The route map 'PBR-10' is configured with 'match ip address 130' and 'set ip next-hop 192.168.100.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is dropping packets instead of forwarding them. The engineer checks the ACL 130 and confirms it matches 10.10.10.0/24. What is the most likely cause?

Accepted Answer

The route map has a deny statement that matches the traffic, causing packets to be dropped.. If PBR is dropping packets, it could be because the next-hop is unreachable and the route map has a 'set ip next-hop' command that fails, causing the router to drop the packet if no fallback is configured. However, by default, if the next-hop is unreachable, the router should use the routing table. But if the route map has a 'set ip next-hop' with 'verify-availability' and the next-hop is down, the router may drop the packet. Another possibility is that the route map has a 'deny' statement that drops traffic. The most likely cause is that the route map has a 'deny' statement that matches the traffic, causing it to be dropped.

Answer

The next-hop 192.168.100.2 is unreachable, and PBR drops packets when the next-hop is down.

Answer

The 'ip policy route-map' command is applied to the wrong interface, and the router is dropping packets due to ACL filtering.

Answer

The ACL 130 is missing the 'permit' keyword, causing all traffic to be denied.