300-410 Practice Exam 60 — 20 Questions

Question 1

What is the default administrative distance for routes redistributed into EIGRP from another protocol?

Accepted Answer

170. By default, EIGRP assigns an administrative distance of 170 to routes learned via redistribution, distinguishing them from internal EIGRP routes (AD 90) and external EIGRP routes (AD 170).

Answer

90

Answer

110

Answer

200

Question 2

Which TWO configuration changes will prevent a specific route from being redistributed from OSPF into EIGRP using a route-map? (Choose TWO.)

Accepted Answer

Configure a route-map with a deny clause that matches the route, and apply it to the redistribution command.. To block redistribution, you can either match the route with a deny clause in the route-map, or use a prefix-list that denies the route and reference it in a match clause. A distribute-list under EIGRP is not used for redistribution filtering. A route-map with a permit clause and no match will permit all routes. A match ip address prefix-list with a permit entry will permit the route.

Answer

Apply a distribute-list out under the EIGRP process that denies the route.

Answer

Use a route-map with a permit clause and no match statement, then apply it to the redistribution.

Answer

Create a prefix-list that denies the route, then use match ip address prefix-list in a route-map permit clause.

Question 3

In MPLS, what is the default label distribution control mode for LDP on Cisco IOS-XE?

Accepted Answer

Independent Label Distribution Control mode. The default label distribution control mode for LDP on Cisco IOS-XE is Independent. In Independent mode, a router can advertise a label for a FEC as soon as it has forwarding information (e.g., a route) for that FEC, without waiting for a label from its next hop. Ordered mode, on the other hand, requires the router to wait for a label from the next hop before advertising, which is not the default for LDP (though it is used for RSVP-TE and other applications).

Answer

Ordered Label Distribution Control mode

Answer

Liberal Label Retention mode

Answer

Conservative Label Retention mode

Question 4

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding
IPv6 Address                              MAC Address       VLAN Interface        State
2001:DB8:1::100                           aaaa.bbbb.cccc    10    Gi0/0/0          ACTIVE
2001:DB8:1::101                           aaaa.bbbb.cccd    10    Gi0/0/0          ACTIVE
2001:DB8:1::102                           aaaa.bbbb.ccce    10    Gi0/0/1          ACTIVE
2001:DB8:1::103                           aaaa.bbbb.cccf    10    Gi0/0/1          ACTIVE

Based on this output, which statement is correct?

Accepted Answer

All entries are in the ACTIVE state, meaning they are valid bindings.. The ACTIVE state in IPv6 snooping binding indicates that the binding has been validated and is currently in use, meaning the IPv6 address, MAC address, VLAN, and interface combination is legitimate. Option A is correct because all four entries show ACTIVE, confirming they are valid bindings that have passed the First Hop Security (FHS) validation process, such as Duplicate Address Detection (DAD) or neighbor solicitation verification.

Answer

The binding for 2001:DB8:1::103 is invalid.

Answer

The table shows only IPv6 addresses from SLAAC.

Answer

There are no entries for VLAN 10.

Question 5

When using an extended ACL to filter traffic, which fields can be matched? (Choose the most complete answer.)

Accepted Answer

Source and destination IP addresses, protocol, and port numbers.. Extended ACLs (access control lists) operate at Layer 3 and Layer 4 of the OSI model, allowing matching on source and destination IP addresses, protocol (e.g., TCP, UDP, ICMP), and port numbers. This granularity enables precise traffic filtering beyond the source-only limitation of standard ACLs. Option B correctly lists all these matchable fields, making it the most complete answer.

Answer

Only source IP address.

Answer

Source IP address and destination port number only.

Answer

MAC address and IP address.

Question 6

A network engineer runs the following debug command to troubleshoot a DHCPv4 issue on router R1:

R1# debug ip dhcp server events

Output:
 DHCPD: DHCPDISCOVER received from 0050.7966.6800 on interface GigabitEthernet0/0
 DHCPD: Sending DHCPOFFER to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPREQUEST received from 0050.7966.6800
 DHCPD: No binding found for client 0050.7966.6800
 DHCPD: Adding binding for client 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0
 DHCPD: DHCPINFORM received from 0050.7966.6800
 DHCPD: Sending DHCPACK to 0050.7966.6800 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCP server successfully assigned an IP address to the client, and the client sent a DHCPINFORM to request additional parameters.. The debug output shows the DHCP server receiving a DHCPDISCOVER, sending a DHCPOFFER, receiving a DHCPREQUEST, creating a new binding, and sending a DHCPACK. The subsequent DHCPINFORM from the client is a standard request for additional configuration parameters (like DNS or domain name) after the client already has an IP address. The server responds with a DHCPACK, confirming successful assignment and parameter delivery.

Answer

The DHCP server failed to create a binding for the client.

Answer

The DHCP client is using a relay agent because the DISCOVER was received on a different interface.

Answer

The DHCP server rejected the DHCPREQUEST because no binding was found.

Question 7

Which statement accurately describes the behavior of the ip nat inside source static command when configuring static NAT for a single inside host?

Accepted Answer

It creates a permanent mapping that remains in the NAT table until the configuration is removed.. The `ip nat inside source static` command creates a permanent one-to-one mapping between an inside local IP address and an inside global IP address. This static entry remains in the NAT table indefinitely until the administrator explicitly removes it with the `no ip nat inside source static` command, making option B correct.

Answer

It dynamically allocates the global address from a pool and removes the entry after an idle timeout.

Answer

It requires the use of an access list to define which traffic is translated.

Answer

It translates only TCP and UDP traffic by default.

Question 8

Router R1 is running EIGRP in VRF-A with two neighbors: R2 and R3. R2 is a directly connected router, R3 is reachable via R2. The network is experiencing EIGRP stuck-in-active (SIA) routes for prefixes learned from R3. R1 configuration: router eigrp 100, address-family ipv4 vrf VRF-A, network 10.0.0.0. R2 is configured similarly. The link between R1 and R2 is a serial link with low bandwidth. What is the root cause?

Accepted Answer

The low-bandwidth serial link between R1 and R2 causes EIGRP query packets to be delayed, exceeding the active timer and resulting in SIA.. EIGRP SIA occurs when a query is sent to a neighbor and the reply is not received within the active timer (default 3 minutes). In a VRF-Lite scenario, if the query scope is not limited, the query may propagate to R3 via R2, but if the serial link has low bandwidth or high delay, the query may time out. However, the most common cause in VRF-Lite is that the query is sent to all neighbors, and if one neighbor (R2) does not reply due to a slow link, SIA occurs. The issue is that the query scope includes R2, but the link is slow, causing the active timer to expire.

Answer

The VRF configuration on R2 is missing the network statement for the link to R3.

Answer

EIGRP is not supported in VRF-Lite.

Answer

The active timer should be increased to prevent SIA.

Question 9

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

Accepted Answer

The IPsec transform set on one router does not match the transform set on the other.. An active IKE SA indicates that IKE phase 1 completed successfully, but no IPsec SAs means phase 2 failed. The most common cause is a mismatch in the IPsec transform set or the crypto map access list between the two routers.

Answer

The pre-shared key is incorrect on one of the routers.

Answer

The tunnel interface is down.

Answer

The IKE proposal is mismatched.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 3

Round Trip Time (RTT) for Index 3
   Latest RTT: 150 ms
   Latest RTT (milliseconds): 150
   Latest RTT (microseconds): 150000
   Number of successes: 80
   Number of failures: 20
   Operation time to live: Forever
   Output: OK

R1# show track 1
Track 1
  IP SLA 3 reachability
  Reachability is Up
    2 changes, last change 00:00:10
  Latest operation return code: OK
  Latest RTT (milliseconds): 150
  Tracked by:
    ip route 0.0.0.0 0.0.0.0 192.168.1.1 track 1

Based on this output, which statement is correct?

Accepted Answer

The IP SLA operation is considered reachable, and the tracked static route is active.. The track shows 'Reachability is Up' based on IP SLA 3. The IP SLA statistics show successes and failures, but the latest return code is OK, so the track is up. This means the static route is active. The failures (20) indicate some probes failed, but the track still considers it reachable because the threshold for reachability is likely based on a percentage or consecutive failures.

Answer

The static route is removed because the IP SLA operation has failures.

Answer

The IP SLA operation has a 20% failure rate, so the track should be down.

Answer

The IP SLA operation is using a wrong source address.

Question 11

An engineer configures Control Plane Policing (CoPP) on a router. After configuration, OSPF neighbors are flapping. Which is the most likely explanation?

Accepted Answer

The class-default is configured with a police action that drops OSPF packets exceeding the rate.. CoPP applies a policy-map to the control plane. If the default class-default is used without an explicit permit for OSPF packets, the implicit deny at the end of the policy-map will drop OSPF packets. The default class-default action is 'drop' if not explicitly configured, but even if a 'police' action is configured, the default behavior is to drop packets that exceed the rate.

Answer

The CoPP policy is applied to the wrong direction (input vs output).

Answer

The access-list used to classify OSPF packets is missing the 'permit' statement for OSPF protocol.

Answer

The CoPP policy uses 'drop' action for OSPF class.

Question 12

An engineer must configure NAT so that inside hosts (192.168.1.0/24) are translated to a public IP pool (203.0.113.1-203.0.113.10) when accessing the Internet, but must NOT translate traffic destined to a VPN subnet (10.10.10.0/24) reachable via the same outside interface. Which TWO configuration steps are required? (Choose TWO.)

Accepted Answer

Create an ACL that denies 10.10.10.0 0.0.0.255 and permits any, then reference it in a route map with 'match ip address'.. It creates an ACL that denies the VPN subnet (10.10.10.0/24) and permits all other traffic, which is then referenced in a route map. This route map is used with 'ip nat inside source route-map RMAP pool POOL' to ensure that traffic destined to the VPN subnet is NOT translated, while all other traffic (including Internet-bound traffic) is translated using the public IP pool. This approach leverages route-map matching to selectively bypass NAT for specific destinations.

Answer

Apply 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' where ACL 1 permits 192.168.1.0 0.0.0.255.

Answer

Configure 'ip nat inside source static 192.168.1.1 203.0.113.1' for each host to ensure translation.

Answer

Apply 'ip access-group 100 in' on the inside interface to block traffic to the VPN subnet.

Question 13

A network engineer runs the following command to troubleshoot OSPF route installation:

R1# show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

O    10.1.1.0/24 [110/10] via 10.1.1.2, 00:12:34, GigabitEthernet0/0
O IA 192.168.1.0/24 [110/20] via 10.1.1.2, 00:10:00, GigabitEthernet0/0
O E2 5.5.5.5/32 [110/20] via 10.1.1.2, 00:05:00, GigabitEthernet0/0

What does this output indicate?

Accepted Answer

All OSPF routes are learned from the same next-hop 10.1.1.2.. The output shows OSPF routes in the routing table, including intra-area, inter-area, and external routes.

Answer

The route to 5.5.5.5/32 is an intra-area route.

Answer

The route to 192.168.1.0/24 is a directly connected network.

Answer

The router has a default route installed.

Question 14

What is the maximum number of ERSPAN sessions that can be configured on a Cisco IOS-XE router?

Accepted Answer

24. The maximum number of ERSPAN sessions is platform-dependent, but typically up to 24 sessions on high-end routers like ASR1000 series. This is a hardware/software limitation.

Answer

4

Answer

8

Answer

64

Question 15

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast summary
BGP router identifier 1.1.1.1, local AS number 65000
BGP table version is 15, main routing table version 15
2 network entries using 288 bytes of memory
2 path entries using 160 bytes of memory
2/2 BGP path/bestpath attribute entries using 296 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Bitfield cache entries: current 1 (at peak 1) using 32 bytes of memory
BGP using 800 total bytes of memory
BGP activity 6/0 prefixes, 6/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4        65001      15      15       15    0    0 00:12:34        2
10.2.2.2        4        65002      10      12       15    0    0 00:08:21        0

What does this output indicate?

Accepted Answer

Neighbor 10.2.2.2 is not sending any routes, possibly due to filtering or no routes to advertise.. The show bgp summary output shows BGP neighbor states and prefix counts. Neighbor 10.1.1.2 is up and has sent 2 prefixes. Neighbor 10.2.2.2 is up but has sent 0 prefixes, indicating a possible issue with route advertisement or filtering.

Answer

Both neighbors are fully operational and exchanging routes.

Answer

Neighbor 10.1.1.2 is not sending any routes.

Answer

The BGP session with 10.2.2.2 is down.

Question 16

A network administrator configures 'ipv6 nd raguard' on a switch port connected to a router. The router is sending Router Advertisements with a non-zero Router Lifetime. The switch logs indicate that RAs are being dropped, and the port goes into err-disable state. The engineer checks the RA Guard policy and sees that the default policy is applied. What is the most likely reason for the drops?

Accepted Answer

The RA has a hop-limit less than 255, which RA Guard treats as invalid and drops.. The default RA Guard policy on Cisco switches blocks Router Advertisements (RAs) that do not have a hop limit of 255. This is because legitimate routers always send RAs with a hop limit of 255, as specified in RFC 4861. When the router sends an RA with a hop limit less than 255, RA Guard treats it as invalid and drops it, which can also trigger err-disable state on the port.

Answer

The RA Guard policy is configured to block all RAs regardless of source.

Answer

The router is using a multicast MAC address that is not allowed by RA Guard.

Answer

The switch port is in access mode, and RA Guard only works on trunk ports.

Question 17

A network engineer is troubleshooting an MPLS L2VPN (VPWS) where the pseudowire between two PE routers is down. The show mpls l2transport vc command displays state 'down' and the VC ID is correct on both ends. The engineer checks the MPLS LDP session and sees it is up, but the targeted LDP session for the pseudowire is not established. What is the most likely cause?

Accepted Answer

The mpls ldp neighbor command is missing on one or both PEs.. For a pseudowire to be established, a targeted LDP session is required between the two PE routers. If the targeted LDP session is not established, the pseudowire cannot exchange labels. The most common cause is that the mpls ldp neighbor command is missing or misconfigured on one or both PEs.

Answer

The VC ID does not match on both ends.

Answer

The IGP is not converging, causing reachability issues.

Answer

The mpls label protocol ldp command is missing globally.

Question 18

Examine the following partial IPv6 DHCP guard configuration:

ipv6 dhcp guard policy DHCP_GUARD
 device-role server
 match server access-list SERVER_ACL
interface GigabitEthernet0/2
 ipv6 dhcp guard policy DHCP_GUARD

Which statement is true about this configuration?

Accepted Answer

The interface will allow DHCP server messages only from sources matching SERVER_ACL.. The configuration applies the DHCP_GUARD policy to GigabitEthernet0/2 with the device-role set to server and a match server access-list SERVER_ACL. This means the interface is configured to trust DHCP server messages, but only those that match the source addresses permitted by SERVER_ACL. Any DHCP server messages from sources not matching the ACL will be dropped, while client messages are unaffected because the policy only filters server-side traffic.

Answer

The interface will block all DHCP server messages.

Answer

The interface will allow all DHCP client messages.

Answer

The interface will drop all DHCP messages.

Question 19

A BGP-speaking router R1 is redistributing BGP routes into EIGRP. R1 has configuration: router bgp 100 redistribute eigrp 100. Router R2, an EIGRP neighbor, shows: 'show ip route eigrp' includes some BGP routes but with high metrics. Traffic to those destinations is suboptimal. What is the root cause?

Accepted Answer

R1 has a route-map that sets the metric to 100000 1000 255 1 1500, which is too high, causing suboptimal path selection.. The route-map explicitly sets a high composite metric (100000 1000 255 1 1500) for redistributed BGP routes into EIGRP. This high metric causes R2 to prefer other paths (if available) or to consider the route less optimal, leading to suboptimal traffic forwarding. The configuration snippet indicates that a route-map is applied during redistribution, which overrides any default-metric and directly inflates the metric.

Answer

R1 has no default-metric configured for EIGRP, so redistributed BGP routes use the default metric of infinity, causing them to be unreachable.

Answer

BGP routes have a lower administrative distance than EIGRP, so they are not installed.

Answer

R2 has a route filter that increases the metric for BGP-originated routes.

Question 20

Given the following partial configuration on router R3:

ip access-list extended FILTER
 permit ip 10.0.0.0 0.255.255.255 any
 deny ip any any
!
route-map RMAP permit 10
 match ip address FILTER
 set metric 100
!
router eigrp 100
 redistribute connected route-map RMAP

What is the effect of this configuration?

Accepted Answer

Only connected routes with a prefix matching 10.0.0.0/8 will be redistributed into EIGRP with metric 100; all other connected routes are not redistributed.. The route-map RMAP uses the access-list FILTER to match only IP prefixes that fall within the 10.0.0.0/8 range (wildcard mask 0.255.255.255). When applied to the 'redistribute connected' command, only connected routes whose network address matches this prefix are redistributed into EIGRP with the set metric of 100. All other connected routes are implicitly denied by the route-map's deny ip any any statement, so they are not redistributed.

Answer

All connected routes will be redistributed into EIGRP with a metric of 100.

Answer

No routes will be redistributed because the route-map sequence number is not specified.

Answer

The redistribution will fail because the route-map must specify a metric for EIGRP redistribution.