300-410 Practice Exam 60 — 20 Questions

Question 1

A network engineer is troubleshooting IPv6 BGP path selection on Router R1. Router R1 is receiving a prefix from two different BGP peers, but it is not selecting the expected best path. Router R1 has the following relevant configuration:
router bgp 65000
 address-family ipv6 unicast
 neighbor 2001:DB8:1::2 route-map SET_LOCAL_PREF in
 neighbor 2001:DB8:2::2 route-map SET_MED in
!
route-map SET_LOCAL_PREF permit 10
 set local-preference 200
!
route-map SET_MED permit 10
 set metric 50
!
The output of show bgp ipv6 unicast 2001:DB8:3::/64 on Router R1 indicates that the path from 2001:DB8:1::2 has local preference 200, but the path from 2001:DB8:2::2 is selected. What is the root cause?

Accepted Answer

The route-map SET_LOCAL_PREF is not actually affecting the received prefix (for example, it is applied in the wrong direction or the neighbor is not matched), so the higher local preference is never set.. Local preference is the first BGP path-selection attribute compared after weight, and it is evaluated before AS path, origin, MED, and IGP metric to next-hop. The route-map SET_LOCAL_PREF is configured with 'set local-preference 200' and applied inbound to neighbor 2001:DB8:1::2. If it were taking effect, that path would have local preference 200 and would be preferred over the other path (default local preference 100). Since the path from 2001:DB8:2::2 is selected instead, the local-preference route-map is not actually affecting the received prefix. The most consistent cause is that the route-map is misapplied or otherwise ineffective, so the higher local preference is never set. IGP metric to next-hop (option D) is only considered much later in the decision process, after local preference, and cannot override a higher local preference.

Answer

The MED value of 50 is lower than the default, causing it to be preferred over local preference.

Answer

The prefix is not being advertised by the neighbor with the higher local preference route-map.

Answer

The BGP table has a route from an iBGP peer with a lower IGP metric to the next-hop, overriding the local preference.

Question 2

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp neighbors 10.1.1.2 advertised-routes
BGP table version is 14, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/24      0.0.0.0                  0         32768 i
*> 192.168.1.0/24   0.0.0.0                  0         32768 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is advertising two routes to neighbor 10.1.1.2, both originated locally.. The command 'show bgp neighbors 10.1.1.2 advertised-routes' displays the prefixes that the local router (R1) is sending to the specified neighbor. Both entries show next hop 0.0.0.0 and weight 32768, which are characteristics of locally originated routes (network statements or redistribution) in the BGP table, confirming R1 is advertising two locally originated prefixes to 10.1.1.2.

Answer

R1 is receiving two routes from neighbor 10.1.1.2.

Answer

R1 is advertising two routes, but one is suppressed due to dampening.

Answer

R1 is advertising two routes, but the neighbor is not receiving them due to filtering.

Question 3

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip interface GigabitEthernet0/1 | include access list
  Outgoing access list is 140
  Inbound access list is not set

Then the engineer runs:
R1# show ip access-lists 140
Extended IP access list 140
    10 deny icmp any any
    20 permit ip any any

What does this output indicate?

Accepted Answer

ACL 140 is applied outbound on GigabitEthernet0/1, denying ICMP and permitting all other traffic.. The output of 'show ip interface GigabitEthernet0/1 | include access list' shows 'Outgoing access list is 140', confirming ACL 140 is applied outbound on that interface. The ACL contains two entries: 'deny icmp any any' (sequence 10) and 'permit ip any any' (sequence 20). Access control lists are processed top-down, so for any outgoing traffic, the first matching entry determines the action. ICMP traffic matches the deny icmp entry first and is therefore blocked. All other IP traffic does not match the first entry but matches the permit ip any any and is permitted. Thus, ACL 140 denies ICMP and permits all other IP traffic outbound.

Answer

ACL 140 is applied inbound on GigabitEthernet0/1, blocking ICMP.

Answer

ACL 140 is not applied to any interface.

Answer

ACL 140 is applied both inbound and outbound.

Question 4

A network uses route summarization to reduce routing table size. After enabling Flexible NetFlow, some routes that were previously summarized are now being advertised individually. Router R1 has: interface GigabitEthernet0/0 ip summary-address eigrp 100 10.0.0.0 255.0.0.0. The flow monitor is applied to the same interface. show ip route eigrp | include (10.0.0.0/8) shows the summary route, but also shows more specific routes like 10.1.0.0/16. What is the root cause?

Accepted Answer

The flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from routing updates that are not summarized.. Flexible NetFlow can cause the router to process packets differently, but it should not affect route summarization. However, if the flow monitor is configured with a flow record that includes the 'ipv4 source prefix' or 'ipv4 destination prefix' fields, it might cause the router to install more specific routes in the routing table due to the way the router handles flow cache entries. The correct answer is that the flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, and the router is using that to create a route cache that overrides the summary route. But this is not standard behavior. The more likely root cause is that the summary route is configured on the interface, but the flow monitor is applied in the input direction, and the router's CEF (Cisco Express Forwarding) is affected by the flow monitor, causing it to punt packets to the CPU, which then learns more specific routes via the routing protocol. Actually, the correct answer is that the flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from the routing updates that are not summarized.

Answer

The flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, causing the router to install a route for each destination.

Answer

The summary route is not configured correctly; it should be a range of /8, but the more specific routes are from a different EIGRP process.

Answer

The flow exporter is sending the more specific routes to the collector, which then redistributes them back.

Question 5

In BGP, what is the default value of the keepalive timer?

Accepted Answer

60 seconds. In BGP, the default keepalive timer is 60 seconds, as specified in RFC 4271. This timer determines how often a BGP speaker sends Keepalive messages to its peer to maintain the session. The hold timer, which is three times the keepalive interval (default 180 seconds), triggers session teardown if no Keepalive or update is received within that period.

Answer

30 seconds

Answer

90 seconds

Answer

180 seconds

Question 6

Which TWO commands verify the operational status of a local SPAN session on a Cisco IOS-XE switch? (Choose TWO.)

Accepted Answer

show monitor session 1. Option A, `show monitor session 1`, is correct because on Cisco IOS-XE switches this command displays the details of a specific local SPAN session, including its source ports/VLANs, destination port, direction, and whether the session is operational. Option B, `show monitor`, is also correct because it lists all configured SPAN sessions and their status, allowing verification of the local SPAN session without specifying a session number. Option C, `show spanning-tree`, is incorrect because it displays Spanning Tree Protocol topology and port states, not SPAN session status. Option D, `show interfaces`, is incorrect because it shows interface statistics and line/protocol status, not SPAN configuration or operational state. Option E, `show vlan`, is incorrect because it displays VLAN membership and assignment information, not SPAN session details.

Answer

show spanning-tree

Answer

show interfaces

Answer

show vlan

Question 7

Which THREE statements about PBR and route-map sequence numbers are true? (Choose THREE.)

Accepted Answer

If a packet matches a route-map sequence with a 'permit' keyword, the set actions are applied, and no further sequences are evaluated.. Route maps used for PBR are evaluated in sequence number order. Each sequence can have match and set statements. If a packet matches a permit sequence, the set actions are applied and evaluation stops. A deny sequence does not drop the packet; it causes the router to skip to the next sequence. If no sequence matches, the packet is forwarded using normal routing (implicit deny). In PBR, the 'match ip address' command can reference a named or numbered ACL, but not a prefix list. To match a prefix list, you must use the 'match ip address prefix-list' command separately.

Answer

If a packet matches a route-map sequence with a 'deny' keyword, the packet is dropped immediately.

Answer

The 'set ip next-hop' command can be used in a route-map sequence with a 'deny' keyword to override the default behavior.

Question 8

Drag and drop the steps to configure a GRE tunnel for IPv6 over IPv4 into the correct order, from first to last.

Accepted Answer

Create tunnel interface with 'interface tunnel0'. The correct order follows the standard GRE tunnel configuration workflow for IPv6 over IPv4: first create the tunnel interface with 'interface tunnel0', then assign an IPv6 address to the tunnel, set the tunnel source, set the tunnel destination. Note that option E is incorrect because the correct command for IPv6 over IPv4 is 'tunnel mode gre ip', not 'tunnel mode gre ipv6'. Therefore, the correct steps are A, B, C, D only.

Answer

Configure tunnel mode as 'tunnel mode gre ipv6'

Question 9

Which TWO statements about EIGRP stub routing are true when troubleshooting a hub-and-spoke topology? (Choose TWO.)

Accepted Answer

A stub router advertises only connected and summary routes to its neighbors.. By default, an EIGRP stub router advertises only its connected and summary routes to its neighbors, which prevents it from being used as a transit router and limits query propagation in a hub-and-spoke topology. The stub feature is configured on the spoke router, not the hub; the hub detects the stub status and limits queries toward that spoke. Options C, D, and E are incorrect: a stub router's neighbors do not query it, connected routes are advertised by default, and the hub does not need the stub command to accept stub advertisements. Therefore, the two true statements are A and B.

Answer

A stub router will send a query to its neighbors if it loses a route.

Answer

Stub routers do not advertise any connected routes unless specifically configured.

Answer

The hub router must have the stub command configured to accept stub advertisements.

Question 10

What is the default SNMP trap queue length on Cisco IOS?

Accepted Answer

10. The default SNMP trap queue length on Cisco IOS is 10. This value defines the maximum number of SNMP traps that can be queued in the trap buffer before they are sent to the configured SNMP trap receivers. If the queue is full and a new trap is generated, the oldest trap is dropped to make room for the new one.

Answer

100

Answer

Unlimited

Answer

5

Question 11

A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?

Accepted Answer

The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.. The 'ip flow-export source <interface>' command sets the source IP address of the NetFlow export packets themselves (the UDP packets sent to the collector). If it is configured to the management interface, every export packet will show that IP as the source — which is exactly what the collector is reporting. This is a configuration issue on the export transport, not a problem with the flow records.

Answer

The router is performing NAT on the flow data before exporting.

Answer

The flow record is configured to match the router's interface IP as the source.

Answer

The collector is misconfigured to display the export packet source instead of the flow source.

Question 12

An engineer configures OSPF on two routers connected via a serial link. Both routers have 'ip ospf network point-to-point' configured, but the link is actually a Frame Relay multipoint subinterface. The OSPF neighbors remain stuck in EXSTART state. Which is the most likely explanation?

Accepted Answer

The MTU on the serial link is not consistent between the two routers, causing DBD packets to be dropped.. When OSPF neighbors are stuck in EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange. In this scenario, the 'ip ospf network point-to-point' command overrides the default Frame Relay multipoint behavior, but the actual link is a multipoint subinterface. This mismatch can cause MTU inconsistencies because the multipoint subinterface may have a different MTU than the point-to-point OSPF network type expects. If the MTU is not consistent between the two routers, DBD packets larger than the smaller MTU will be silently dropped, preventing the neighbors from progressing beyond EXSTART.

Answer

The OSPF hello timer is set too high, causing the neighbor to time out.

Answer

The area ID is different on the two routers.

Answer

The OSPF router ID is duplicated.

Question 13

What is the default OSPF reference bandwidth used in the cost calculation formula on Cisco IOS?

Accepted Answer

100 Mbps. Cisco IOS uses a default OSPF reference bandwidth of 100 Mbps (10^8) in the cost formula cost = reference bandwidth / interface bandwidth. This default dates back to when Fast Ethernet was the fastest common link, and it means any interface 100 Mbps or faster yields a cost of 1 unless the reference bandwidth is changed.

Answer

10 Mbps

Answer

1000 Mbps

Answer

1 Gbps

Question 14

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology 10.0.0.0 255.255.252.0

IP-EIGRP (AS 100): Topology entry for 10.0.0.0/22
  State: Passive, Origin: Internal, Metric [90/2172416], Tag 0
  Number of successors: 1
  FD is 2172416, Serno: 5
  Route is Summary
  Advertised by R2 (via Serial0/0/0)
  Reply status: 0

Based on this output, what is true about the route 10.0.0.0/22?

Accepted Answer

The route is a summary route learned from R2.. The output shows 'Route is Summary' and 'Advertised by R2', indicating that the summary route was learned from R2, not generated locally by R1. The 'Advertised by' field identifies the neighbor that advertised the route.

Answer

The route is a summary route generated by R1.

Answer

The route is an external route redistributed into EIGRP.

Answer

The route is in active state and being queried.

Question 15

Router R1 is leaking a summary route 10.0.0.0/8 from VRF-A into the global routing table, but hosts in the global table cannot reach subnet 10.1.1.0/24 within VRF-A. R1 configuration: ip vrf VRF-A, rd 100:1, route-target export 100:1, route-target import 100:1. Interface Gig0/0 in VRF-A has ip address 10.1.1.1 255.255.255.0. The leaking is done via route-map: route-map LEAK permit 10, match ip address prefix-list SUMMARY, set global. Prefix-list SUMMARY permits 10.0.0.0/8. What is the root cause?

Accepted Answer

The summary route 10.0.0.0/8 is being installed in the global table, but the more specific route 10.1.1.0/24 is not leaked, causing traffic to be dropped.. The prefix-list SUMMARY only permits 10.0.0.0/8, so only the aggregate is leaked into the global table. The more specific 10.1.1.0/24 remains inside VRF-A and is never exported, so global-table hosts match the /8 and forward traffic toward R1, but R1 has no /24 in the global RIB and drops the packets. Leaking a summary without the constituent specifics creates a black hole for every subnet inside the aggregate.

Answer

The route-map should use match ip address prefix-list SPECIFIC instead of SUMMARY.

Answer

The VRF must have a default route to reach the global table.

Answer

The prefix-list should permit 10.1.1.0/24 only.

Question 16

Router R1 has an ACL applied to interface Gig0/0 in VRF-A that permits only specific management traffic. The ACL is: access-list 100 permit udp any any eq snmp, access-list 100 permit tcp any any eq ssh, access-list 100 deny ip any any. The router's SNMP and SSH services are configured globally. Management stations in the global table cannot reach the router's VRF interface IP. What is the root cause?

Accepted Answer

The management station must be in the same VRF.. The root cause is that the management station must be in the same VRF as the router's VRF interface to reach it. The ACL permits SNMP and SSH traffic, but if the management station is in the global routing table and the interface is in VRF-A, the traffic cannot be routed to the VRF interface without proper VRF leaking or route targets. Thus, the management station needs to be in the same VRF (or there must be VRF route leaking) for connectivity.

Answer

The ACL does not permit the source IP address of the management station, causing traffic to be denied.

Answer

The ACL should be applied outbound on the VRF interface.

Answer

The ACL is missing a permit statement for the management station's source IP.

Question 17

An engineer is troubleshooting a network where R1 and R2 are running iBGP, and R1 learns the prefix 192.168.1.0/24 from R2 with an AD of 200. R1 also learns the same prefix via OSPF from R3 with AD 110. The engineer notices that R1 uses the iBGP route. What configuration change would cause this?

Accepted Answer

The engineer applied the distance bgp 20 100 200 command, lowering iBGP AD to 100.. The `distance bgp 20 100 200` command changes the administrative distance (AD) for BGP routes: the first value (20) is for external BGP (eBGP), the second (100) is for internal BGP (iBGP), and the third (200) is for locally originated routes. By setting the iBGP AD to 100, it becomes lower than OSPF's default AD of 110, so R1 prefers the iBGP route over the OSPF route. This directly explains why R1 uses the iBGP route despite OSPF's normally lower AD.

Answer

The engineer applied the distance bgp 20 200 200 command, which lowers eBGP AD but not iBGP.

Answer

The engineer applied the distance 150 0.0.0.0 255.255.255.255 under the OSPF process, raising OSPF AD to 150.

Answer

The OSPF route is a type 5 LSA, which has a higher AD than type 3 LSAs.

Question 18

Consider the following configuration on Router R4:

router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500

router ospf 1
 redistribute eigrp 100 metric 20 metric-type 1 subnets

What is a potential issue with this configuration?

Accepted Answer

Mutual redistribution without route filtering can cause routing loops or suboptimal routing.. Mutual redistribution between EIGRP and OSPF without route filtering can cause routing loops or suboptimal routing. When routes are redistributed from one protocol into another and then back, they can be re-injected with misleading metrics, leading to loops or inefficient paths. This is a classic issue in mutual redistribution scenarios.

Answer

The configuration is correct and will work without issues.

Answer

The 'metric-type 1' in OSPF redistribution may cause EIGRP routes to be preferred over OSPF routes.

Answer

The EIGRP metric values are invalid because load must be between 1 and 255.

Question 19

Drag and drop the steps to troubleshoot BGP adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping neighbor IP from source interface. First, check interface IP connectivity with ping; then verify BGP neighbor reachability and TCP port 179; next inspect BGP configuration for AS number mismatches; then examine BGP timers and update-source; finally use debug ip bgp to see session state transitions.

Question 20

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Accepted Answer

The syslog service on 10.1.1.200 is not running or is blocked by a firewall.. The router is configured to send syslog messages to two servers, and both are reachable via ping. If only one server receives messages, the most likely cause is that the syslog service on the second server is not running or is blocked by a firewall. Ping only tests ICMP reachability, not UDP port 514, so a firewall blocking syslog traffic would not be detected by ping.

Answer

The router can only send to one syslog server at a time.

Answer

The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.

Answer

The second server is configured with a different severity level using 'logging trap' under the host.