300-410 Practice Exam 58 — 20 Questions

Question 1

Which TWO statements about IPv6 First Hop Security (FHS) RA Guard are true? (Choose TWO.)

Accepted Answer

The default RA Guard policy action is to block Router Advertisements from unauthorized ports.. The default action of an IPv6 RA Guard policy is to block Router Advertisements (RAs) received on ports that are not explicitly authorized. This prevents rogue devices from sending malicious RAs that could redirect traffic or launch man-in-the-middle attacks. The RA Guard feature enforces this by dropping unauthorized RAs at the switch level.

Answer

RA Guard validates the source MAC address of Router Advertisements against the IPv6 source address.

Answer

The default RA Guard policy action is to log Router Advertisements from unauthorized ports.

Answer

RA Guard is typically enabled on trunk ports to protect against rogue RAs from other VLANs.

Question 2

A network engineer is troubleshooting an EIGRP adjacency that is not forming. Both routers are configured for EIGRP with BFD. The engineer checks the BFD session and sees it is 'Down'. The interface between the routers is up/up. The EIGRP configuration appears correct. What is the most likely cause?

Accepted Answer

The BFD timers are configured with 'bfd interval 50 min_rx 50 multiplier 3' on one router and 'bfd interval 100 min_rx 100 multiplier 3' on the other, causing a negotiation failure.. EIGRP BFD requires that the BFD session be established before the EIGRP adjacency can form. If the BFD session is down, the issue is often a mismatch in BFD parameters or a lack of BFD configuration on one side.

Answer

The EIGRP process is configured with 'bfd all-interfaces' but the interface is not configured with 'eigrp bfd'.

Answer

The interface is configured with 'ip address 10.0.0.1 255.255.255.252' but the neighbor is using a different subnet.

Answer

The EIGRP autonomous system number is mismatched between the two routers.

Question 3

An engineer configures an IPsec site-to-site VPN between two routers running EIGRP. The EIGRP neighbor forms, but routes are not being exchanged. The engineer notices that the EIGRP neighbor is stuck in active state for certain routes. What is the most likely explanation?

Accepted Answer

The IPsec ACL is permitting EIGRP packets (protocol 88) only in one direction, so queries are sent but replies are dropped by the remote router's crypto map.. When EIGRP neighbors form but routes are not exchanged and the neighbor is stuck in active (SIA) state, it indicates that EIGRP queries are being sent but replies are not received. In an IPsec VPN, if the crypto ACL permits EIGRP (protocol 88) only in one direction, queries from one router are encrypted and sent, but the remote router's crypto map does not match the reply packets, so they are dropped. This prevents the EIGRP query/reply process from completing, causing routes to remain in active state and not be exchanged.

Answer

The EIGRP hello packets are being encrypted but the reply is not, causing asymmetric routing.

Answer

The EIGRP K-values are mismatched between the two routers.

Answer

The IPsec tunnel is using aggressive mode, which does not support multicast traffic.

Question 4

Drag and drop the steps to configure uRPF in strict mode on an edge router into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order begins with entering global configuration mode, then configuring the interface, enabling IPv6 on the interface, applying uRPF strict mode, and finally verifying the configuration with a show command.

Question 5

A network engineer configures an EEM applet to monitor redistribution events using the event syslog pattern 'IP-4-ROUTING'. The applet is intended to log when a route is redistributed from OSPF into EIGRP. The redistribution is configured without a seed metric for EIGRP, and the route is not redistributed. The EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

Redistribution into EIGRP without a seed metric fails silently, and no syslog message is generated.. When redistributing routes into EIGRP without a seed metric, the redistribution fails silently—no syslog message is generated. The EIGRP process drops the redistributed route because the default metric is not set. The 'IP-4-ROUTING' syslog message is only generated when a routing table change occurs due to redistribution, but since the route is not installed, no syslog is produced. The EEM applet will not trigger because there is no matching syslog event.

Answer

The EEM applet must use 'event routing' to capture redistribution events.

Answer

The syslog pattern 'IP-4-ROUTING' is incorrect; it should be 'IP-5-ROUTING'.

Answer

The redistribution is blocked by route tagging, preventing the syslog.

Question 6

Drag and drop the steps to enable and verify RESTCONF on IOS-XE into the correct order, from first to last.

Accepted Answer

Enable the HTTPS server using ip http secure-server. RESTCONF requires enabling the HTTPS server first, then the RESTCONF service, followed by authentication configuration, verifying the interface, and finally testing via a REST client.

Question 7

MPLS LDP neighbor mismatch is causing label distribution failures for summary routes. Router R1 and R2 are LDP peers. R1 has:
mpls ip
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 mpls ip
!
router ospf 1
 network 10.0.0.0 0.0.0.255 area 0
 area 0 range 10.0.0.0 255.255.252.0
!
R2 shows:
R2# show mpls ldp neighbor
Peer LDP Ident: 10.0.0.2:0, Transport address: 10.0.0.2
  TCP connection: 10.0.0.2.646 - 10.0.0.1.646
  State: Oper, Msgs sent/rcvd: 10/10
R2# show mpls forwarding-table 10.0.0.0/22
Local tag  outgoing tag  prefix         tag(s)  next-hop
16          Untagged      10.0.0.0/22   0       10.0.0.1
But R2 cannot forward traffic for 10.0.1.0/24. What is the root cause?

Accepted Answer

The OSPF summary suppresses the /24 routes, so LDP does not assign labels to them, causing forwarding failures.. The OSPF area range command creates a summary route 10.0.0.0/22 in the routing table, but LDP assigns labels only to routes that are in the routing table. The more specific /24 routes are suppressed by the summary, so LDP does not have labels for them. When R2 receives a packet for 10.0.1.0/24, it looks up the route, finds the summary, and forwards it to R1 with a label, but R1 may not have a label for the specific /24, causing a label mismatch or blackholing. The fix is to not summarize or to use label binding for more specific prefixes.

Answer

LDP is not enabled on the interface, so no labels are exchanged.

Answer

The OSPF area range command is not supported with MPLS.

Answer

R2 has a static route for 10.0.1.0/24 that overrides LDP.

Question 8

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# debug ip ospf adj

OSPF adjacency debugging is on
R1#
*Mar  1 00:05:23.123: OSPF: Rcv pkt from 10.1.1.2, FastEthernet0/0, area 0.0.0.0, packet type: 1 (Hello)
*Mar  1 00:05:23.123: OSPF: 2 Way Communication to 10.1.1.2 on FastEthernet0/0, state 2WAY
*Mar  1 00:05:23.124: OSPF: Send immediate hello to nbr 10.1.1.2, src address 10.1.1.1, on FastEthernet0/0
*Mar  1 00:05:23.124: OSPF: Rcv pkt from 10.1.1.2, FastEthernet0/0, area 0.0.0.0, packet type: 2 (DBD)
*Mar  1 00:05:23.125: OSPF: Rcv DBD from 10.1.1.2, seq 0x1234, opts 0x2, flag 0x7, mtu 1500 state EXSTART
*Mar  1 00:05:23.126: OSPF: Nbr 10.1.1.2 has state FULL

What does this output indicate?

Accepted Answer

OSPF adjacency is established successfully, indicating CoPP is not blocking OSPF traffic.. The debug output shows the OSPF adjacency progressing through the expected states (2WAY, EXSTART) and reaching FULL after receiving a Database Description (DBD) packet. This confirms that OSPF Hello and DBD packets are being processed normally, which means Control Plane Policing (CoPP) is not dropping OSPF traffic. CoPP would typically drop packets at the control plane, preventing state transitions like 2WAY or FULL.

Answer

OSPF adjacency is failing due to CoPP dropping Hello packets.

Answer

OSPF is experiencing packet loss due to MTU mismatch.

Answer

OSPF is stuck in EXSTART state due to CoPP.

Question 9

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/0
Interface GigabitEthernet0/0
  FNF: enabled
  Ingress IPV4/IPV6 flow monitoring: enabled
    Exporter: EXPORTER1
    Monitor: MONITOR1
  Egress IPV4/IPV6 flow monitoring: disabled
  Ingress MPLS flow monitoring: disabled
  Egress MPLS flow monitoring: disabled

Based on this output, what is the state of NetFlow on this interface?

Accepted Answer

NetFlow is only monitoring incoming traffic on this interface.. The output shows that ingress IPv4/IPv6 flow monitoring is enabled with an exporter and monitor configured, while egress IPv4/IPv6 flow monitoring is disabled. This means NetFlow is only monitoring incoming traffic on the interface, not outgoing traffic. The FNF (Flexible NetFlow) status confirms NetFlow is operational, but only for ingress direction.

Answer

NetFlow is fully enabled for both ingress and egress traffic.

Answer

NetFlow is not configured on this interface.

Answer

NetFlow is only monitoring MPLS traffic.

Question 10

What is the default administrative distance for OSPF routes in Cisco IOS?

Accepted Answer

110. OSPF has a default administrative distance of 110 in Cisco IOS. This value is used by the router to select the best route when multiple routing protocols provide route information for the same destination, with lower distances preferred over higher ones.

Answer

90

Answer

100

Answer

120

Question 11

In OSPFv3, which authentication method is supported by default?

Accepted Answer

IPsec authentication. OSPFv3 uses IPsec for authentication and encryption, as defined in RFC 4552. It does not support the simple password or MD5 authentication used in OSPFv2.

Answer

MD5 authentication

Answer

Simple password authentication

Answer

No authentication is supported

Question 12

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2      1   FULL/DR         00:00:35    192.168.1.2     Gi0/0
192.168.2.2      1   2WAY/DROTHER    00:00:38    192.168.2.2     Gi0/1
10.10.10.2       1   FULL/BDR        00:00:32    10.10.10.2      Gi0/2

Based on this output, what is a potential issue?

Accepted Answer

All OSPF neighbors are in appropriate states for their roles.. The output shows normal OSPF neighbor states for a multi-access network. The DR (192.168.1.2) is in FULL/DR state, the BDR (10.10.10.2) is in FULL/BDR state, and the DROTHER (192.168.2.2) is in 2WAY/DROTHER state, which is expected for a non-DR/non-BDR router on a broadcast multi-access segment. The 2WAY state is a valid and stable state for DROTHER neighbors, indicating that they have exchanged Hello packets and are aware of each other but do not form full adjacency with each other.

Answer

Neighbor 192.168.2.2 is stuck in 2WAY state, indicating a problem.

Answer

The DR election is incomplete on Gi0/0.

Answer

Neighbor 10.10.10.2 should be in FULL/DR state.

Question 13

Examine this configuration:

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable

Which statement is true?

Accepted Answer

Incoming traffic to 198.51.100.10:8080 is forwarded to 10.0.0.10:80.. The configuration uses a static NAT with TCP port translation (also known as NAT with port forwarding). The command `ip nat inside source static tcp 10.0.0.10 80 198.51.100.10 8080 extendable` creates a one-to-one mapping between the inside local address/port (10.0.0.10:80) and the inside global address/port (198.51.100.10:8080). This means any incoming packet destined to 198.51.100.10 on TCP port 8080 will have its destination translated to 10.0.0.10 port 80, and the response traffic is reverse-translated. Option B correctly describes this behavior.

Answer

All traffic from 10.0.0.10 is translated to 198.51.100.10.

Answer

The 'extendable' keyword is invalid for static NAT.

Answer

This translation will not work unless 'ip nat inside source list' is also configured.

Question 14

An engineer configures EIGRP named mode on a router and uses an offset-list to increase the feasible distance (FD) of a specific route. Unexpectedly, the route is still installed in the routing table with the original metric. Which is the most likely explanation?

Accepted Answer

The offset-list was applied to outbound updates instead of inbound, so it affected the FD on the neighbor, not the local router.. In EIGRP named mode, an offset-list applied to outbound updates modifies the metric on the route as advertised to neighbors, not the local router's feasible distance (FD). Since the local router's FD remains unchanged, the route is still installed with its original metric. To increase the FD locally, the offset-list must be applied to inbound updates.

Answer

The offset-list value was too large, causing the route to be suppressed.

Answer

The offset-list was applied to the wrong interface.

Answer

The route is a connected route, and offset-lists do not affect connected routes.

Question 15

What is the default OSPF metric for a route redistributed from another routing protocol into OSPF?

Accepted Answer

20. When a route is redistributed from another routing protocol into OSPF, the default metric is 20 for routes that are not BGP. This is defined in RFC 2328 and is the seed metric used when no explicit metric is configured with the redistribute command. The value 20 applies to most external routes (Type 2 by default), while BGP redistributed routes default to 1.

Answer

0

Answer

1

Answer

10

Question 16

An enterprise network uses EIGRP with route summarization. Router R1 has the following configuration: interface GigabitEthernet0/0 ip summary-address eigrp 100 10.1.0.0 255.255.252.0. Router R2, connected to R1 via GigabitEthernet0/0, shows: 'show ip route eigrp' includes 10.1.0.0/22 but not the more specific route 10.1.1.0/24. Hosts in subnet 10.1.1.0/24 are unreachable from R2. What is the root cause?

Accepted Answer

R1's summary address 10.1.0.0/22 includes the 10.1.1.0/24 subnet, so R1 suppresses the more specific route, and R2 only learns the summary. This is expected behavior, but if the summary does not match the actual network, reachability fails.. EIGRP's route summarization behavior is to suppress more specific routes (e.g., 10.1.1.0/24) when a covering summary (10.1.0.0/22) is configured on an interface. R2 learns only the summary route, but if the actual network 10.1.1.0/24 is not reachable via the summary's next hop (e.g., because the summary includes subnets not actually present or because R1 lacks a discard route), R2 cannot reach those hosts. The root cause is that the summary route does not accurately represent the reachable subnets, leading to black-holing.

Answer

R1 has a missing null0 route for the summary, causing it to not advertise the summary correctly.

Answer

The summary address 10.1.0.0/22 is configured on the wrong interface; it should be on the interface facing the internal network.

Answer

R2 has a route filter that blocks the 10.1.1.0/24 route.

Question 17

What is the default timeout for NAT translation entries in Cisco IOS?

Accepted Answer

86400 seconds (24 hours). C is correct because the default timeout for NAT translation entries in Cisco IOS is 86400 seconds (24 hours). This default applies to dynamic NAT translations that are not protocol-specific, such as those for TCP or UDP, and ensures that translations remain active for a full day before being aged out, balancing resource usage with session persistence.

Answer

60 seconds

Answer

300 seconds

Answer

Never expires

Question 18

Router R5 has this DHCP configuration:

ip dhcp pool POOL3
 network 172.16.0.0 255.255.255.0
 default-router 172.16.0.1
 option 150 ip 10.10.10.10
!
interface GigabitEthernet0/0
 ip address 172.16.0.1 255.255.255.0
 no shutdown

What is the purpose of the option 150 command?

Accepted Answer

It provides the IP address of a TFTP server to DHCP clients, typically used by VoIP phones.. Option 150 is a DHCP option that specifies the IP address of a TFTP server. Cisco IP phones use this option to locate the TFTP server from which they download their configuration and firmware files. The correct answer is A because this is the standard purpose of option 150 in a Cisco VoIP environment.

Answer

It sets the DNS server for the DHCP pool.

Answer

It defines a custom option that is ignored by standard DHCP clients.

Answer

It specifies the default gateway for the clients.

Question 19

BGP is used between two ISPs. Router R1 has: neighbor 10.0.0.2 route-map SET-MED in, route-map SET-MED permit 10, set metric 50. Router R2 shows: show ip bgp 172.16.0.0 includes MED 50 but the path is not preferred. What is the root cause?

Accepted Answer

MED is only compared when paths are from the same neighboring AS.. BGP's MED (Multi-Exit Discriminator) attribute is only compared between paths that originate from the same neighboring AS. In this scenario, even though R2 receives a route with MED 50 from R1, the path is not preferred because the competing path likely comes from a different neighboring AS, making the MED comparison invalid. MED is a non-transitive attribute that influences inbound traffic only when comparing multiple exit points from the same AS.

Answer

The MED value is too low to influence path selection.

Answer

The route-map should be applied outbound, not inbound.

Answer

The neighbor has a higher local preference overriding MED.

Question 20

Which TWO statements about AAA authentication on Cisco IOS-XE are true? (Choose TWO.)

Accepted Answer

The 'aaa authentication login default local' command creates a default method list that uses the local user database for login authentication.. The 'aaa authentication login default local' command explicitly configures the default method list to use the local user database for login authentication. This is the standard way to define a fallback or primary local authentication method for all lines that do not have a named method list applied.

Answer

If no AAA authentication method list is explicitly configured, the default method list uses the local user database.

Answer

The 'aaa authentication login default group radius local' command will first try RADIUS, and if RADIUS fails (not just rejects), it will fall back to local.

Answer

The 'aaa authentication login default method' command creates a method list with no authentication methods, which denies all login attempts.