300-410 Practice Exam 59 — 20 Questions

Question 1

An engineer configures Control Plane Policing (CoPP) on a router running OSPF. After applying the policy, OSPF neighbors intermittently drop and recover. The CoPP policy includes a class-map matching OSPF traffic with a police rate of 64000 bps. The router has multiple OSPF neighbors and the link utilization is normal. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The police rate is in bits per second, but OSPF hello packets are small; the packet-per-second rate is exceeded, causing drops.. OSPF hello packets are small (typically 44–64 bytes), so a police rate of 64000 bps translates to a very low packet-per-second (pps) allowance. When multiple OSPF neighbors send hellos and other OSPF packets, the pps limit is easily exceeded, causing CoPP to drop packets and disrupt neighbor adjacencies. This is the most likely cause of intermittent OSPF neighbor drops despite normal link utilization.

Answer

The CoPP policy uses the default class class-default, which drops OSPF packets.

Answer

OSPF uses UDP, and CoPP only filters TCP traffic.

Answer

The CoPP policy is applied to the wrong interface; it should be applied to the management interface.

Question 2

Which TWO commands would a network engineer use to verify NAT translations and their statistics on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip nat translations. The 'show ip nat translations' command displays the current active NAT/PAT translation entries in the translation table, including inside local, inside global, outside local, and outside global addresses. The 'show ip nat statistics' command provides aggregate counters such as total translations, hits, misses, expired translations, and the number of dynamic mappings. Together, these two commands give a complete view of both the active translations and their performance statistics, which is essential for verifying NAT operations.

Answer

show ip nat verbose

Answer

show running-config | include nat

Answer

debug ip nat

Question 3

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer verifies that the customer's IP prefix is in the routing table. Which is the most likely explanation?

Accepted Answer

The router has multiple equal-cost paths to the customer network, and the return path uses a different interface, causing strict uRPF to drop the packet.. Strict uRPF checks that the source IP of incoming packets has a route back to the same interface. If there is asymmetric routing, where the return path goes out a different interface, strict uRPF will drop the packets. A common edge case is when the router has multiple equal-cost paths to the source network, and the return traffic uses a different interface than the one the packet arrived on. In such cases, uRPF strict mode will fail because it only checks the best route, not all routes.

Answer

The customer network uses private IP addresses that are not routable, so uRPF drops them.

Answer

The interface is configured with 'ip verify unicast source reachable-via any', which is loose mode, not strict mode.

Answer

The routing table has a default route that points to a different interface, causing uRPF to use the default route for verification.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip nhrp
192.168.1.0/24 via 172.16.0.2
   Tunnel0 created 00:00:15, expire 00:01:45
   Type: dynamic, Flags: unique
   NBMA address: 10.1.1.2
192.168.2.0/24 via 172.16.0.3
   Tunnel0 created 00:00:10, expire 00:01:50
   Type: dynamic, Flags: unique
   NBMA address: 10.1.1.3

Based on this output, what is the problem?

Accepted Answer

The NHRP holdtime is too short, causing frequent re-registrations.. The output shows NHRP cache entries for remote networks. The expire time is decreasing, indicating these are dynamic entries learned via NHRP. The problem is that the NHRP holdtime is set to 2 minutes (120 seconds), as seen from the expire time starting at 2 minutes. This is a short holdtime that may cause frequent re-registrations.

Answer

The NHRP entries are static and will not expire.

Answer

The tunnel interface is down.

Answer

The NBMA addresses are incorrect.

Question 5

Which TWO commands can be used to verify route summarization on a Cisco router running OSPF? (Choose TWO.)

Accepted Answer

show ip route summary. The 'show ip route summary' command provides a summary of the routing table including the number of routes and the memory used, while 'show ip ospf border-routes' displays the OSPF route table entries for ABRs and ASBRs, which can include summary routes. 'show ip protocols' does not directly show summarization details. 'show ip route' alone does not summarize. 'show ip ospf database' shows the LSDB, not the summarized routing table.

Answer

show ip protocols

Answer

show ip route

Answer

show ip ospf database

Question 6

A network engineer configures RSPAN on a switch to monitor traffic from VLAN 10 to a remote switch via VLAN 100 as the RSPAN VLAN. The source switch has: monitor session 1 source vlan 10 rx monitor session 1 destination remote vlan 100. The remote switch has: monitor session 2 source remote vlan 100 monitor session 2 destination interface Gi0/1. The remote switch's Gi0/1 is connected to a network analyzer. The analyzer sees no traffic. The RSPAN VLAN 100 is configured on all intermediate switches with the 'remote-span' command. However, the intermediate switches run MST and VLAN 100 is mapped to a different MST instance than the native VLAN. What is the root cause?

Accepted Answer

MST maps VLAN 100 to a different instance, causing the port to be in a blocking state for that instance, thus dropping RSPAN traffic.. RSPAN relies on flooding the mirrored traffic across the RSPAN VLAN. In MST, if the RSPAN VLAN is mapped to a different MST instance than the native VLAN, the spanning-tree topology may block the RSPAN VLAN on some ports. Specifically, if the RSPAN VLAN is in a different MST instance, the port may be in a blocking state for that instance, preventing the mirrored traffic from reaching the destination. The 'remote-span' command does not override MST behavior. The fix is to map the RSPAN VLAN to the same MST instance as the native VLAN or use a single spanning-tree region.

Answer

The RSPAN VLAN is not allowed on the trunk ports between switches.

Answer

The 'remote-span' command is missing on the source and destination switches.

Answer

The RSPAN VLAN must be the native VLAN on all trunks.

Question 7

A BGP speaker R1 is advertising a prefix 10.10.0.0/16 to its eBGP neighbor R2. R2 is also receiving the same prefix from another eBGP neighbor R3 with a lower local preference. R1 configuration: router bgp 100, neighbor 192.168.1.2 remote-as 200, neighbor 192.168.1.2 route-map SET-LP in. Route-map SET-LP sets local-preference 150. R2 shows: 'show ip bgp 10.10.0.0/16' shows two paths: one from R1 with local pref 150, and one from R3 with local pref 100. The best path is via R3. Why is the path from R1 not selected?

Accepted Answer

The route-map is applied inbound on R1, but it should be applied outbound to affect the local preference on routes sent to R2.. The route-map SET-LP is applied inbound on R1 (neighbor 192.168.1.2 route-map SET-LP in), which means it sets local preference on routes received from R2, not on routes sent to R2. Local preference is a BGP attribute that is propagated only to iBGP peers and is not exchanged between eBGP peers. To influence R2's best path selection, the route-map must be applied outbound on R1 (neighbor 192.168.1.2 route-map SET-LP out) so that the local-preference value is set on the update sent to R2. Since R1 sets local preference inbound, R2 never receives the modified value, and R2's best path selection defaults to the path from R3 with local preference 100, which is the only local preference R2 sees from R1 (default 100).

Answer

The local-preference value of 150 is not high enough; it should be at least 200 to override the path from R3.

Answer

R2 has a route-map that sets local preference to 100 for all routes, overriding the value set by R1.

Answer

The prefix 10.10.0.0/16 is not in the BGP table of R1 because it is not originated or learned.

Question 8

Router R1 and R2 are running OSPF and BGP. R1 is an ASBR redistributing BGP routes into OSPF. R2 is an ABR between area 0 and area 1. R2 has 'distance ospf external 150' configured. R3 in area 1 learns a BGP-redistributed route 10.0.0.0/8 via R2 with AD 150. R3 also learns the same prefix via a different path from R4 (another ABR) with AD 110 (default OSPF external). R3's 'show ip route 10.0.0.0' shows the route via R4. What is the root cause?

Accepted Answer

R2's 'distance ospf external 150' makes the external route less preferred than the default AD 110 from R4.. OSPF administrative distance can be set per route type. With 'distance ospf external 150', the external routes from R2 have AD 150, while routes from R4 have default AD 110. R3 prefers the route with lower AD (110 via R4). This is expected behavior, but the question might imply that the route via R2 should be preferred due to some other reason. The correct answer is that the configuration on R2 increases the AD for external routes, making them less preferred.

Answer

R4's route is an inter-area route (AD 110) while R2's route is external (AD 150), so inter-area is preferred.

Answer

R3 has a route-map that prefers routes from R4.

Answer

The route from R2 is not in the OSPF database due to a filter.

Question 9

A network engineer runs the following command on Router R1:

R1# show snmp mib ifmib ifindex

ifIndex: 1
Interface: GigabitEthernet0/0
Description: GigabitEthernet0/0

ifIndex: 2
Interface: GigabitEthernet0/1
Description: GigabitEthernet0/1

ifIndex: 3
Interface: Loopback0
Description: Loopback0

ifIndex: 10
Interface: Tunnel0
Description: Tunnel0

Based on this output, which statement is correct?

Accepted Answer

The ifIndex for Loopback0 is 3.. The output of 'show snmp mib ifmib ifindex' displays the ifIndex values assigned to each interface by the SNMP agent. The table clearly shows Loopback0 with ifIndex 3, making option A correct. ifIndex values are not guaranteed to be sequential or start from 0; they are assigned dynamically and can have gaps, as seen with Tunnel0 having ifIndex 10.

Answer

The ifIndex values are assigned sequentially starting from 0.

Answer

GigabitEthernet0/0 has ifIndex 2.

Answer

Tunnel0 has ifIndex 3.

Question 10

A network engineer is troubleshooting a connectivity issue between two sites. R1 learns the prefix 10.0.0.0/8 via RIP (AD 120) from R2, and also via a directly connected interface on R3. The engineer notices that R1 uses the RIP route instead of the connected route. What is the most likely cause?

Accepted Answer

The RIP route has an AD of 120, but the connected route is for a different subnet mask.. Connected routes have an AD of 0, which is always preferred over any dynamic routing protocol. If the connected route is not used, it likely does not exist for that exact prefix, or the interface is down. However, if the prefix is learned via RIP with AD 120, the connected route should take precedence. The only way RIP is preferred is if the connected route is not present for that prefix.

Answer

The connected interface on R3 has a higher metric than the RIP route.

Answer

The distance rip 0 command was applied under RIP, making RIP routes have AD 0.

Answer

The connected interface is administratively down.

Question 11

An engineer configures uRPF loose mode on an interface that is part of an IPv6 network with multiple equal-cost paths to the same destination via different interfaces. The router receives traffic from a source that is reachable via one of the paths, but the traffic arrives on a different interface. The traffic is dropped. Which is the most likely explanation?

Accepted Answer

The source address is a link-local address (fe80::), which is not installed in the global routing table, causing uRPF loose mode to drop the packet.. In uRPF loose mode, the router checks that the source address of an incoming packet has a matching entry in the routing table, but it does not require that the packet arrives on the interface used to reach that source. However, link-local addresses (fe80::/10) are not installed in the global IPv6 routing table; they are only reachable on the local link. Therefore, when a packet with a link-local source address arrives, uRPF loose mode finds no matching route and drops the packet, regardless of the interface.

Answer

The router has 'ipv6 uRPF strict' configured instead of loose, but the show command indicates loose.

Answer

The equal-cost paths cause the routing table to have multiple entries, and uRPF loose mode requires a single best path.

Answer

The interface has an IPv6 ACL that denies the traffic before uRPF is applied.

Question 12

Which NetFlow version introduced the concept of templates to support variable-length flow records?

Accepted Answer

NetFlow version 9. NetFlow version 9 introduced templates, allowing flexible and extensible flow record formats.

Answer

NetFlow version 5

Answer

NetFlow version 8

Answer

NetFlow version 10 (IPFIX)

Question 13

A network engineer is troubleshooting a routing issue in an EIGRP network. Router R1 is not learning a specific route from its neighbor R2, even though R2 has the route in its routing table. The engineer checks the EIGRP topology table on R1 and does not see the route. The output of 'show ip eigrp neighbors' shows that R1 and R2 are adjacent. What should the engineer check next?

Accepted Answer

Check if a distribute-list in or out is applied under the EIGRP process on R1.. If R1 and R2 are EIGRP neighbors but R1 does not have the route in its topology table, a distribute-list applied inbound on R1 or outbound on R2 could be filtering the route. Distribute-lists use access-lists or prefix-lists to permit or deny routes during the update process, preventing specific routes from being installed in the topology table even though the neighbor adjacency is established.

Answer

Check if the route is being summarized on R2.

Answer

Check if the EIGRP metric for the route is too high.

Answer

Check if the route is a connected route on R2.

Question 14

An engineer is troubleshooting a missing BGP route on R3. R3 has an eBGP session with R4 (AS 65004) and an iBGP session with R1 (AS 65003). R4 advertises a prefix 192.168.1.0/24 to R3, and R3's BGP table shows the route with next-hop 10.1.4.4. However, R3 does not install this route in its routing table. The output of 'show ip bgp 192.168.1.0/24' on R3 shows the route as valid but not best. What is the most likely cause?

Accepted Answer

The route is not installed because the next-hop 10.1.4.4 is not reachable via any routing table entry.. For an eBGP route to be installed, the next-hop must be reachable via an IGP or static route. If the next-hop is not reachable, BGP marks the route as valid but not best.

Answer

The route is not installed because BGP synchronization is enabled and the IGP does not have the route.

Answer

The route is not installed because the prefix length is too long for the routing table.

Answer

The route is not installed because R3 has a higher administrative distance for eBGP routes.

Question 15

Consider the following configuration:

ipv6 access-list BLOCK-ICMP
 deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2
 ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Accepted Answer

The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.. The IPv6 ACL explicitly denies ICMPv6 echo-request and echo-reply messages (types 128 and 129) while the final permit ipv6 any any statement allows all other IPv6 traffic. The ipv6 traffic-filter command applied inbound on GigabitEthernet0/2 filters traffic as it enters the interface, so only the specified ICMP types are blocked, and all other IPv6 traffic is permitted.

Answer

The ACL blocks all ICMPv6 traffic because the deny statements are too broad.

Answer

The ACL must be applied outbound to filter echo-request.

Answer

The ACL is missing the 'log' keyword to be effective.

Question 16

A network engineer configures iBGP between DMVPN hub and spokes using the hub as a route reflector. On the hub, the BGP configuration includes 'neighbor <spoke-ip> next-hop-self'. Unexpectedly, spokes receive routes from other spokes with the next-hop set to the hub's tunnel IP, but the spokes cannot reach that next-hop because it is not in their routing table. Which is the most likely explanation?

Accepted Answer

The hub's 'next-hop-self' command is configured under the BGP neighbor statement for the spoke, but the route reflector behavior overrides it, causing the hub to not modify the next-hop for routes reflected between spokes.. In a DMVPN Phase 2 or 3 network, the hub typically sets the next-hop to itself using 'next-hop-self' for routes advertised to spokes. However, if the hub is a route reflector, it does not change the next-hop for routes received from one spoke and advertised to another spoke, unless 'next-hop-self' is explicitly configured. The corner case is that 'next-hop-self' must be applied under the address-family or neighbor configuration, and if it is misapplied or missing for the route-reflector client sessions, the spoke-to-spoke routes retain the original next-hop (the other spoke's tunnel IP), which may not be reachable if NHRP redirect or shortcuts are not enabled.

Answer

The spokes are not configured as route-reflector clients, so the hub does not reflect routes between them, and the next-hop remains unchanged.

Answer

The iBGP session between hub and spokes is using loopback interfaces, and the next-hop is set to the loopback IP, which is not reachable via the tunnel.

Answer

The 'next-hop-self' command is only applicable for eBGP sessions, not iBGP, so it has no effect on the reflected routes.

Question 17

A network redistributes OSPF into EIGRP. Router R1 has: redistribute ospf 1 metric 10000 100 255 1 1500. Router R2 shows: show ip route eigrp includes some OSPF routes but not 192.168.1.0/24. What is the root cause?

Accepted Answer

The high delay metric (10000) may cause the route to be suppressed by EIGRP's feasibility condition.. C is correct because EIGRP uses a feasibility condition to prevent routing loops, which requires that the reported distance (RD) from a neighbor be strictly less than the feasible distance (FD). The redistribute command sets the EIGRP metric components in the order bandwidth, delay, reliability, load, MTU. Here, the delay is set to 10000 tens of microseconds, which is extremely high (100,000 microseconds). This high delay inflates the composite metric, making the FD very large. When this route is advertised to an EIGRP neighbor, the neighbor's RD may equal or exceed its own FD for that route, violating the feasibility condition and causing the route to be suppressed from the routing table.

Answer

The OSPF route 192.168.1.0/24 is not in the OSPF database.

Answer

The EIGRP metric components are misordered; delay should be 100, not 10000.

Answer

Redistribution requires a route-map to filter specific routes.

Question 18

A network engineer runs the following command on Router PE3:

PE3# show ip vrf interfaces
Interface      IP-Address      VRF                              Protocol
Gi0/0          10.1.1.1        CUSTOMER_C                       up      
Gi0/1          10.2.2.1        CUSTOMER_D                       up

Based on this output, which statement is correct?

Accepted Answer

Both interfaces are correctly assigned to VRFs and are operational.. The show ip vrf interfaces command displays VRF-to-interface mappings. Both interfaces are up and assigned to VRFs CUSTOMER_C and CUSTOMER_D respectively. This indicates proper VRF configuration.

Answer

Interface Gi0/0 is down.

Answer

VRF CUSTOMER_C has no routes.

Answer

The router has no VRF configuration.

Question 19

Given this configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What will happen when traffic from 10.1.1.0/24 to 10.2.2.0/24 is generated?

Accepted Answer

The traffic will be forwarded normally without encryption.. The crypto map is not applied to any interface. Without the `crypto map CMAP` command under GigabitEthernet0/1, the router has no IPsec policy to enforce on that interface. Traffic matching access-list 101 will simply be forwarded normally as clear-text IP packets, since no encryption is triggered.

Answer

The traffic will be dropped because the ACL denies it.

Answer

The router will attempt to establish an IPsec tunnel but fail because the crypto map is missing.

Answer

The router will create a dynamic crypto map entry automatically.

Question 20

A network engineer configures SNMPv3 with authentication only (no privacy) on a router. The NMS can poll the router successfully. Later, the engineer adds the 'priv' option to the user configuration. The NMS now fails to poll the router. Which is the most likely explanation?

Accepted Answer

The NMS is still configured with the old credentials that do not include the privacy protocol and key.. When the engineer adds the 'priv' option to the SNMPv3 user configuration on the router, the security level changes from authNoPriv to authPriv. The NMS must be updated with the matching privacy protocol (e.g., AES or DES) and the corresponding privacy key. If the NMS still uses the old credentials without the privacy parameters, the authentication will succeed but the privacy decryption will fail, causing the NMS to reject the response and report a polling failure.

Answer

The router's SNMP engine ID changed when the user was modified.

Answer

The privacy protocol (e.g., AES) is not supported on the router.

Answer

The NMS must restart to recognize the new security level.