300-410 Practice Exam 58 — 20 Questions

Question 1

Which THREE statements about IPv4 access control list sequence numbers are true? (Choose THREE.)

Accepted Answer

Sequence numbers allow insertion of new entries between existing ones.. Sequence numbers in IPv4 ACLs allow administrators to insert new entries between existing ones without deleting and re-entering the entire ACL. This is because each entry is assigned a unique sequence number, and new entries can be added with a sequence number that falls between two existing numbers, enabling granular control over the order of evaluation.

Answer

Sequence numbers are automatically assigned in increments of 10 for numbered ACLs.

Answer

Resequencing an ACL changes the order of evaluation.

Question 2

Which TWO commands verify the application and content of an IPv4 access control list on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip interface. The 'show ip interface' command displays the access lists applied to an interface, including the direction (inbound/outbound) and the specific ACL name or number. The 'show access-lists' command shows the detailed content of all ACLs, including the exact permit/deny statements, sequence numbers, and hit counts, verifying both the application and the rules.

Answer

show running-config | include access-list

Answer

show ip route

Answer

debug ip packet

Question 3

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.4.4.0/24
BGP routing table entry for 10.4.4.0/24, version 8
Paths: (1 available, best #1, table default)
  Not advertised to any peer
  Refresh Epoch 1
  65006
    10.1.16.6 from 10.1.16.6 (10.6.6.6)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what is the most likely reason the route is not advertised to any peer?

Accepted Answer

There is an outbound route-map or prefix-list filtering the route.. The 'Not advertised to any peer' line in the BGP table entry indicates that R1 is not sending this prefix to any of its BGP neighbors, even though the route is valid and marked as best. Since the session is up (the route was received from 10.1.16.6) and the route is in the BGP table, the most likely cause is an outbound filter — a route-map, prefix-list, or distribute-list applied in the outbound direction on the neighbor statement — that is suppressing advertisement. Local preference of 100 is the default and has no bearing on whether a route is advertised.

Answer

The route has a local preference of 100, which is too low.

Answer

The BGP session to the neighbor is down.

Answer

The route is not in the routing table.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology all-links
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.10.10.0/24, 1 successors, FD is 28160, Qos: 0
     via 10.1.1.2 (28160/28160), GigabitEthernet0/0
     via 10.2.2.2 (28672/28160), GigabitEthernet0/1
P 10.20.20.0/24, 1 successors, FD is 28160, Qos: 0
     via 10.2.2.2 (28160/28160), GigabitEthernet0/1
     via 10.3.3.2 (28672/28160), GigabitEthernet0/2

Based on this output, which statement is correct?

Accepted Answer

The route to 10.20.20.0/24 has no feasible successor.. The EIGRP feasibility condition requires the reported distance (RD) to be strictly less than the feasible distance (FD) for a path to be a feasible successor. In the output, for route 10.20.20.0/24, the FD is 28160, and both paths have an RD of 28160, which equals the FD, not less. Therefore, no feasible successor exists for this route. Option A is incorrect because neither route has a feasible successor. Option C is incorrect because the FD for 10.10.10.0/24 is 28160, not 28672. Option D is incorrect because the route is marked 'Passive', not 'Active'.

Answer

The network has redundant paths with feasible successors for both routes.

Answer

The FD for 10.10.10.0/24 is 28672.

Answer

The route to 10.10.10.0/24 is in Active state.

Question 5

An engineer configures an EEM applet to react to BGP prefix changes using the event syslog pattern 'BGP-5-ADJCHANGE'. The applet sends a custom SNMP trap. The BGP session between two routers is established, but when a route is withdrawn due to next-hop-self requirement for iBGP, the EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

The BGP-5-ADJCHANGE syslog is only generated for session state changes, not for individual route updates.. The BGP-5-ADJCHANGE syslog message is generated only when the BGP session state changes (e.g., from Established to Idle or vice versa). It is not generated for individual prefix updates or withdrawals. When a route is withdrawn due to next-hop-self requirement, the BGP session remains established, so no ADJCHANGE event occurs. The EEM applet will not trigger because the syslog pattern does not match any generated message.

Answer

The EEM applet must be configured with 'event bgp' to monitor BGP prefix changes.

Answer

The next-hop-self requirement causes a BGP notification that generates a different syslog pattern.

Answer

The EEM applet requires the 'event manager directory' to be set for SNMP traps.

Question 6

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "eigrp 100", distance 90, metric 2684416, type internal
  Redistributing via eigrp 100
  Last update from 10.0.0.2 on Tunnel0, 00:00:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, from 10.0.0.2, via Tunnel0
      Route metric is 2684416, traffic share count is 1
      Total delay is 20000 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 1

What does this output indicate?

Accepted Answer

The IPsec tunnel is up and EIGRP is exchanging routes over the tunnel.. The output shows a route to 192.168.2.0/24 learned via EIGRP (distance 90) with the next hop 10.0.0.2 reachable through Tunnel0. The last update was 23 seconds ago, confirming the tunnel is up and EIGRP is actively exchanging routing information over the IPsec tunnel. This indicates the IPsec Site-to-Site VPN is functioning and dynamic routing is working correctly.

Answer

The route to the remote LAN is not present, indicating a routing issue.

Answer

The route is using a static route, not a dynamic routing protocol.

Answer

The tunnel interface is down, causing the route to be unreachable.

Question 7

What is the default EIGRP hello interval on a point-to-point serial interface with bandwidth 1544 Kbps?

Accepted Answer

5 seconds. EIGRP hello intervals depend on interface type and bandwidth. On point-to-point serial interfaces (and multipoint interfaces with bandwidth greater than T1), the default hello interval is 5 seconds. On multipoint interfaces with bandwidth of T1 (1544 Kbps) or lower, the default is 60 seconds. Since the question specifies a point-to-point serial interface at 1544 Kbps, the correct default is 5 seconds.

Answer

60 seconds

Answer

10 seconds

Answer

30 seconds

Question 8

A service provider network uses OSPF with route summarization on Area Border Routers (ABRs). Router R1 (ABR) has the configuration:
router ospf 1
 area 1 range 10.1.0.0 255.255.240.0
 area 1 range 10.1.16.0 255.255.240.0
Router R2 (internal to area 1) shows:
R2# show ip route ospf
     10.1.0.0/20 is subnetted, 1 subnets
O IA 10.1.0.0/20 [110/2] via 10.2.1.1, 00:00:15, Serial0/0/0
     10.1.16.0/20 is subnetted, 1 subnets
O IA 10.1.16.0/20 [110/2] via 10.2.1.1, 00:00:10, Serial0/0/0
     10.1.32.0/20 [110/3] via 10.2.1.2, 00:00:05, Serial0/0/1
R2 is missing a route to 10.1.48.0/20. What is the root cause?

Accepted Answer

The ABR R1 has a missing 'area 1 range 10.1.48.0 255.255.240.0' command.. The ABR R1 configured two summary ranges for area 1, but the missing route 10.1.48.0/20 is not covered by either summary. OSPF summarization on the ABR creates Type 3 LSAs for the configured ranges, but any routes not falling within those ranges are not advertised as summaries and are also not advertised as individual routes (unless the 'no discard-route' option is used). This causes the missing route. The correct fix is to add an additional summary range covering 10.1.48.0/20 or use a broader summary.

Answer

R2 has a routing table limit that prevents installation of the route.

Answer

R1's OSPF process has a distribute-list blocking the route.

Answer

The missing route is a result of OSPF route filtering at the area boundary.

Question 9

Which TWO commands would a network engineer use to verify the NHRP registration status of a spoke router in a DMVPN Phase 2 network? (Choose TWO.)

Accepted Answer

show dmvpn. The 'show dmvpn' command displays the current DMVPN tunnel status, including the NHRP registration state of each peer. The 'show ip nhrp' command shows the NHRP cache entries, which include the registration status and mapping information. The other commands either do not show NHRP registration details or are for different purposes.

Answer

show crypto isakmp sa

Answer

show ip route

Answer

show ip eigrp neighbors

Question 10

An engineer is troubleshooting an EIGRP network where routes from router R1 are not being installed in the routing table of router R2, although R2 sees them in the EIGRP topology table. Which TWO configuration issues could cause this problem? (Choose TWO.)

Accepted Answer

R2 has an OSPF route with administrative distance 110 for the same prefix, and the EIGRP route is external with administrative distance 170.. Option B is correct because EIGRP external routes have a default administrative distance of 170, which is higher (less preferred) than OSPF's 110, so R2 would keep the OSPF route in the routing table even though the EIGRP route appears in the topology table. Option D is correct because an offset-list applied to EIGRP increments the reported/advertised metric for matching routes, and if that inflated metric makes the path from R1 worse than an alternate path from another neighbor, R2 will not install the R1 route as the best route. Option A is not correct because a static route with AD 150 is less preferred than EIGRP's internal AD of 90, so EIGRP would still win and be installed. Option C is not correct because variance only enables unequal-cost load balancing via feasible successors; a higher-metric feasible successor not being used does not prevent the successor route itself from being installed. Option E is not correct because maximum-paths limits how many equal-cost paths are installed, but it does not prevent the first/best EIGRP route for a prefix from being placed in the routing table.

Answer

R2 has a static route with administrative distance 150 for the same prefix, and EIGRP's default administrative distance is 90.

Answer

The 'variance' command is configured on R2 with a value of 2, but the EIGRP route has a feasible successor with a higher metric.

Answer

The 'maximum-paths' command on R2 is set to 1, and there is already one EIGRP route for the same prefix in the routing table.

Question 11

A network engineer is implementing policy-based routing (PBR) on a Cisco router. The goal is to route traffic from a specific subnet to a next-hop IP address that is not directly connected. Which configuration is required to achieve this?

Accepted Answer

A route map that matches the source subnet and sets the next-hop IP address, and a static route to the next-hop IP address.. PBR with 'set ip next-hop' requires that the next-hop IP address be reachable. If it is not directly connected, a static route must be present to resolve the next-hop. The other options either do not address the reachability requirement or use incorrect syntax.

Answer

A route map that matches the source subnet and sets the interface to the next-hop interface.

Answer

A route map that matches the source subnet and sets the default next-hop IP address.

Answer

A route map that matches the source subnet and sets the next-hop IP address.

Question 12

What is the default action for a CoPP policy-map class that does not have an explicit 'police' command?

Accepted Answer

Transmit all packets in that class. In Control Plane Policing (CoPP), if a class within a policy-map does not contain an explicit 'police' command, the default action is to transmit all packets matching that class. This is because CoPP operates on a permit-by-default model; only classes with a configured policer will have traffic rate-limited or dropped. The absence of a police action means no restriction is applied, so packets are allowed through to the control plane.

Answer

Drop all packets in that class

Answer

Log all packets in that class

Answer

Apply the default aggregate policer

Question 13

Examine this partial configuration on Router R3:

router ospf 1
 redistribute rip subnets metric-type 1 metric 50

What is the effect of the 'metric-type 1' keyword?

Accepted Answer

Redistributed RIP routes become OSPF Type 1 external LSAs, and the metric is the sum of the external metric (50) plus the internal OSPF cost to the ASBR.. The 'metric-type 1' keyword makes redistributed routes OSPF E1 (Type 1 external) LSAs, whose cost is the external metric (50) plus the cumulative internal OSPF cost from the receiving router to the ASBR. This makes the path cost topology-aware, so routers closer to the ASBR prefer the route.

Answer

Redistributed RIP routes become OSPF Type 2 external LSAs with a fixed metric of 50.

Answer

The 'metric-type 1' is ignored because the 'metric' keyword is also used.

Answer

The redistributed routes will have a metric of 50 and will not be affected by internal OSPF cost.

Question 14

Examine this IP SLA configuration on router R5:

ip sla 50
 icmp-echo 10.20.20.1 source-ip 192.168.10.1
 frequency 10
ip sla schedule 50 life forever start-time now

What is the effect of this configuration?

Accepted Answer

It will continuously monitor reachability to 10.20.20.1 from source 192.168.10.1.. The IP SLA configuration defines an ICMP echo operation (number 50) that sends pings to 10.20.20.1 from source IP 192.168.10.1 every 10 seconds. The 'ip sla schedule 50 life forever start-time now' command starts the operation immediately and keeps it running indefinitely, so it continuously monitors reachability.

Answer

It will stop after 10 successful replies.

Answer

It will measure jitter between the two IPs.

Answer

It will only work if 10.20.20.1 is directly connected.

Question 15

An engineer configures PBR with a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The route-map is applied inbound on interface GigabitEthernet0/1. Traffic from a host on that interface is forwarded via 10.0.0.2, but the engineer notices that packets with destination IP 10.0.0.2 itself are also being redirected, causing a loop. Why does this happen?

Accepted Answer

The set ip next-hop command does not check if the next-hop is the router itself, so packets destined to the router are forwarded instead of being processed locally.. When PBR uses 'set ip next-hop', the router rewrites the forwarding decision for matched packets without checking whether the next-hop address belongs to the router itself. If the ACL matches traffic destined to the router's own IP (which is also the configured next-hop), the router forwards the packet out toward 10.0.0.2 instead of delivering it to its own control plane, creating a forwarding loop or black hole. The fix is to exclude the next-hop address (and the router's own addresses) from the ACL match.

Answer

The ACL 100 inadvertently matches the router's own IP address as source.

Answer

PBR is applied outbound, causing packets to the router to be re-routed.

Answer

The route-map has a default route that sends all traffic to 10.0.0.2.

Question 16

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is not coming up. The engineer runs 'show crypto isakmp sa' and sees no active IKE SAs. The peer IP address is correctly configured. What should the engineer check first?

Accepted Answer

Check the IP connectivity between the two public IP addresses using ping.. The absence of IKE SAs indicates that IKE phase 1 negotiation has not started or failed. The first step is to verify that the routers can reach each other at the IP layer, as a connectivity issue will prevent any IKE exchange.

Answer

Verify that the crypto map is correctly applied to the outside interface.

Answer

Check the IPsec transform set configuration on both routers.

Answer

Verify the pre-shared key is identical on both routers.

Question 17

In a standard IPv4 ACL, what is the default wildcard mask if none is explicitly configured?

Accepted Answer

0.0.0.0 (host match). In a standard IPv4 ACL, if no wildcard mask is explicitly configured, the default wildcard mask is 0.0.0.0, which means the ACL matches only the exact source IP address (a host match). This is because the access-list command treats the source address as a host address when no mask is provided, effectively applying a host wildcard mask.

Answer

255.255.255.255 (any match)

Answer

The mask is mandatory; configuration is rejected without it.

Answer

The mask is derived from the source address class.

Question 18

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip bgp 10.0.0.0/16
BGP routing table entry for 10.0.0.0/16, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local, (aggregated by 65000 1.1.1.1)
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Atomic-aggregate

What does this output indicate?

Accepted Answer

The route 10.0.0.0/16 is an aggregate route, and the atomic-aggregate attribute indicates that the AS path may be incomplete.. This output shows the BGP table entry for prefix 10.0.0.0/16. The path is marked as 'aggregated', indicating it is a summary route. The 'Atomic-aggregate' attribute suggests that the route is an aggregate and may have lost some AS path information.

Answer

The route is a normal BGP learned route without summarization.

Answer

The route is suppressed and not advertised to neighbors.

Answer

The route is learned via redistribution from OSPF.

Question 19

In IPsec site-to-site VPN, what is the purpose of the 'match address' command under a crypto map?

Accepted Answer

It identifies the traffic that will be encrypted and sent through the tunnel.. The 'match address' command under a crypto map references an access list (ACL) that defines which traffic should be protected by IPsec. When a packet matches a permit entry in that ACL, it triggers the IPsec process to encrypt and tunnel the traffic to the remote peer. This is the fundamental mechanism for selecting interesting traffic in a site-to-site VPN.

Answer

It specifies the peer IP address for the tunnel.

Answer

It defines the encryption and authentication algorithms.

Answer

It sets the lifetime for the IPsec SA.

Question 20

A network engineer runs the following command on Router R1:

R1# show crypto map
Crypto Map "VPN-MAP" 10 ipsec-isakmp
    Peer = 10.1.1.2
    Extended IP access list 100
        access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255
    Current peer: 10.1.1.2
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={ESP-AES256-SHA,}
    Interfaces using crypto map VPN-MAP:
        Tunnel0

Based on this output, which statement is correct?

Accepted Answer

The crypto map is applied to interface Tunnel0 and uses ACL 100 to define interesting traffic.. The output clearly shows that the crypto map 'VPN-MAP' is applied to interface Tunnel0, as indicated by the 'Interfaces using crypto map VPN-MAP: Tunnel0' line. It also shows that ACL 100 is used to define interesting traffic, with the permit statement matching source 10.1.1.0/24 to destination 192.168.1.0/24. Therefore, the statement that the crypto map is applied to Tunnel0 and uses ACL 100 is correct.

Answer

Perfect Forward Secrecy (PFS) is enabled.

Answer

The crypto map uses dynamic IPsec peer discovery.

Answer

The crypto map is not applied to any interface.