300-410 Practice Test 6 — 10 Questions

Question 1

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using eBGP with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 shows the route is received and best, but the show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 also shows the route has the 'r' flag (RIB-failure). What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is a static route in the VRF for 10.2.2.0/24 with a lower administrative distance.. A RIB-failure indicates that the route is received and best in BGP but is not installed in the routing table because another route with a lower administrative distance exists. This could be due to a static route or an IGP route for the same prefix in the VRF.

Answer

The route-target import on PE1 is misconfigured.

Answer

The MP-BGP session is not using the loopback interface.

Answer

The VRF on PE1 has a different route-target export.

Question 2

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. The hub router is configured with a multipoint GRE tunnel and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels. Which two statements describe the correct operation of DMVPN Phase 3 that could explain the issue? (Choose two.)

Accepted Answer

The hub must be configured with the ip nhrp redirect command to support Phase 3.. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect, and spokes must be configured with ip nhrp shortcut. The redirect command allows the hub to notify spokes of a better path, while the shortcut command enables spokes to act on those notifications and establish direct tunnels. Without these, spoke-to-spoke traffic will continue to traverse the hub, even if other NHRP settings are correct.

Answer

Spokes must be configured with the ip nhrp network-id command matching the hub.

Answer

The hub must be configured with the ip nhrp map multicast dynamic command.

Answer

The hub must be configured with the ip nhrp authentication command.

Question 3

A network engineer configured IP SLA 30 to monitor the reachability of a server (10.10.10.10) using ICMP echo probes. The IP SLA is linked to a track object that is used in a static default route. The engineer notices that the IP SLA state is 'Active', but the static route is not present in the routing table. The track object shows 'Up'. What should the engineer check first?

Accepted Answer

Verify that the static route includes the 'track' keyword and references the correct track object number.. The most likely issue is that the static route does not include the 'track' keyword or references the wrong track object number. Even if the IP SLA and track object are up, the route will not be installed if it is not explicitly linked to the track object. The engineer should first verify the static route configuration to ensure it includes 'track <object-number>' and that the number matches the track object.

Answer

Check if the server is responding to ICMP echo requests.

Answer

Ensure the IP SLA probe is configured with a timeout value less than the frequency.

Answer

Reboot the router to clear any routing table inconsistencies.

Question 4

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify IP connectivity between redistribution points. Troubleshooting connectivity failures due to redistribution starts with checking basic Layer 3 reachability, then verifying routing protocol adjacencies, followed by examining the redistribution configuration, then checking for route filtering issues, and finally testing end-to-end connectivity. This order isolates the problem systematically.

Question 5

A network engineer runs the following command on Router R1:

R1# show snmp host

Host: 192.168.1.100
Port: 162
Timeout: 1.5 seconds
Retries: 3
Version: 2c
Community: PUBLIC

Host: 192.168.1.200
Port: 162
Timeout: 3 seconds
Retries: 5
Version: 3
User: admin
Security level: authPriv

Based on this output, which statement is correct?

Accepted Answer

SNMP traps sent to 192.168.1.200 will be encrypted.. The SNMPv3 security level 'authPriv' for the host at 192.168.1.200 means authentication and privacy (encryption) are both enabled. SNMPv3 with authPriv uses the User-based Security Model (USM) to encrypt the entire SNMP packet payload, including the trap data, using protocols like AES or DES. This ensures that traps sent to 192.168.1.200 are encrypted.

Answer

Both hosts use the same SNMP version.

Answer

The host at 192.168.1.100 uses SNMPv3 with user 'admin'.

Answer

Traps to 192.168.1.200 will be sent with community string 'admin'.

Question 6

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Accepted Answer

The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.. EEM (Embedded Event Manager) applets execute actions sequentially, and variables are evaluated at the time the 'if' condition is reached, not at applet start. So if a 'set' action modifies a variable before an 'if' condition that references it, the 'if' sees the updated value. This is standard procedural execution order in EEM.

Answer

The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

Answer

The 'set' action cannot modify a variable that is used in an 'if' condition.

Answer

The applet will fail if a variable is modified after being used in an 'if' condition.

Question 7

Drag and drop the steps to configure IPv6 RA Guard on a switch into the correct order, from first to last.

Accepted Answer

Enable IPv6 snooping globally. First, globally enable IPv6 snooping. Then define an RA Guard policy with the trusted or untrusted role. Apply the policy to the desired interface. Verify the configuration with show commands. Finally, test the RA Guard operation by sending RAs from unauthorized ports.

Question 8

Drag and drop the steps to verify and validate IPv6 First Hop Security operational state into the correct order, from first to last.

Accepted Answer

Show ipv6 snooping global status. Start by checking global IPv6 snooping status. Then display the binding table for learned entries. Verify interface-specific FHS policies. Check the RA Guard policy counters for drops. Finally, validate the neighbor cache for correct MAC-to-IPv6 mappings.

Question 9

A network engineer is configuring policy-based routing (PBR) on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 (LAN) and GigabitEthernet0/1 (WAN). The engineer wants all HTTP traffic from the 10.1.1.0/24 subnet to be routed via next-hop 192.168.2.2 instead of the default route. The engineer creates a route map named PBR with sequence 10, matches an ACL that permits TCP port 80 from 10.1.1.0/24, and sets the next-hop to 192.168.2.2. The route map is applied to interface GigabitEthernet0/0 with the command `ip policy route-map PBR`. However, traffic still follows the default route. Which action will fix the problem?

Accepted Answer

Ensure the ACL used in the route map matches the correct source and destination addresses and ports, and that the route map is applied in the correct direction.. Policy-based routing (PBR) on Cisco IOS XE requires that the route map is applied to the interface where traffic enters the router and that the ACL matches the intended traffic. Common oversights include misconfigured ACLs (wrong source, destination, or port) or applying the policy to the wrong interface. Ensuring the ACL matches HTTP traffic from 10.1.1.0/24 and that the route map is applied inbound on GigabitEthernet0/0 will make PBR function as intended.

Answer

Configure the `ip local policy route-map PBR` command to apply the route map globally.

Answer

Apply the route map to the GigabitEthernet0/1 interface instead of GigabitEthernet0/0.

Answer

Add the `set ip next-hop verify-availability` command to the route map.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 nd raguard policy
Interface                      Policy                      Role            State
Gi0/0/0                        RA_GUARD                    router          ACTIVE
Gi0/0/1                        RA_GUARD                    host            ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/0 is allowed to send Router Advertisements.. The 'show ipv6 nd raguard policy' output shows that interface Gi0/0/0 is configured with the RA_GUARD policy in the 'router' role and is ACTIVE. In IPv6 RA Guard, a port in the 'router' role is explicitly permitted to send Router Advertisements (RAs), while ports in the 'host' role are blocked from sending RAs. Therefore, only Gi0/0/0 is allowed to send RAs, making option A correct.

Answer

Interface Gi0/0/1 is allowed to send Router Advertisements.

Answer

Interface Gi0/0/2 is allowed to send Router Advertisements.

Answer

All interfaces are blocked from sending Router Advertisements.