300-410 Practice Exam 61 — 20 Questions

Question 1

An engineer configures IPsec between two routers using a site-to-site VPN with IKEv1. The configuration uses `crypto isakmp policy 10` with authentication pre-share and encryption aes. On the peer, the policy is configured with authentication pre-share and encryption 3des. Unexpectedly, the IKE phase 1 negotiation fails. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The encryption algorithms (AES vs 3DES) do not match, causing IKE phase 1 to fail.. IKE phase 1 (ISAKMP SA) negotiation requires both peers to agree on a matching transform set: encryption algorithm, hash algorithm, authentication method, and Diffie-Hellman group. Here the local policy uses AES while the peer uses 3DES, so no common encryption proposal exists and the ISAKMP SA cannot be built. The mismatch causes the negotiation to fail before phase 2 (IPsec SA) is even attempted.

Answer

The pre-shared key must be configured globally, not under the policy.

Answer

The IKE policy must have the same priority number on both ends.

Answer

The authentication method must be `rsa-sig` for site-to-site VPNs.

Question 2

What is the default OSPF hello interval on a Cisco IOS-XE router for a broadcast network type?

Accepted Answer

10 seconds. On Cisco IOS-XE routers, the default OSPF hello interval for broadcast and point-to-point network types is 10 seconds, with a corresponding dead interval of 40 seconds (4× the hello). This matches the OSPF standard for these multi-access and point-to-point media, where faster hello timers are used to detect neighbor loss quickly. Non-broadcast (NBMA) and point-to-multipoint networks use a 30-second hello by default instead.

Answer

30 seconds

Answer

40 seconds

Answer

60 seconds

Question 3

A network engineer runs the following command on switch SW1:

SW1# show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
    Both : Gi0/1, Gi0/2
Destination Ports : Gi0/3
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session is monitoring traffic on Gi0/1 and Gi0/2 and sending it to Gi0/3.. In the SPAN output, the 'Source Ports' section lists Gi0/1 and Gi0/2 with 'Both' direction, meaning traffic in both ingress and egress directions on those ports is copied. The 'Destination Ports' section lists Gi0/3, which is where the mirrored traffic is sent for analysis. Therefore, the session monitors Gi0/1 and Gi0/2 and forwards copies to Gi0/3.

Answer

The SPAN session is monitoring traffic on Gi0/3 and sending it to Gi0/1 and Gi0/2.

Answer

The SPAN session is using RSPAN because the destination port has ingress disabled.

Answer

The SPAN session is not active because the destination port is not in forwarding state.

Question 4

A network engineer runs the following command to troubleshoot Control Plane Policing (CoPP):

R1# show policy-map control-plane input class class-default
  Class-map: class-default (match-any)
    140091 packets, 12345678 bytes
    5 minute offered rate 1000 bps, drop rate 0 bps
    Match: any
    police:
        cir 8000 bps, bc 1500 bytes
        conformed 140091 packets, 12345678 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

CoPP is rate-limiting traffic to 8000 bps and not dropping any packets.. The output shows that the class-default policy-map for control-plane input has a police statement with a CIR of 8000 bps. The counters indicate 140,091 packets conformed and transmitted, with zero packets exceeded or violated. Since the drop rate is 0 bps and no packets have been dropped, CoPP is rate-limiting traffic to 8000 bps without any drops occurring.

Answer

CoPP is dropping all traffic to the control plane.

Answer

CoPP is not configured; the class-default shows no action.

Answer

CoPP is dropping packets due to exceeding the rate.

Question 5

A network engineer runs the following command to troubleshoot BFD session flapping:

R1# debug bfd packet

*Mar  1 00:15:23.456: BFD: [R1-to-R3] received async packet from 10.5.5.2, state UP, diag 0
*Mar  1 00:15:23.457: BFD: [R1-to-R3] sending async packet, state UP
*Mar  1 00:15:23.458: BFD: [R1-to-R3] received echo packet from 10.5.5.2, state UP
*Mar  1 00:15:23.459: BFD: [R1-to-R3] echo packet lost, no echo received for 300 ms
*Mar  1 00:15:23.460: BFD: [R1-to-R3] state UP -> DOWN (echo failure)

What does this output indicate?

Accepted Answer

BFD session went DOWN because of echo timeout, indicating possible path issue.. The debug output shows the BFD session transitioning from UP to DOWN specifically due to an echo failure — the echo packet sent to 10.5.5.2 was not returned within the 300 ms echo interval. This indicates the forwarding path for echo packets is broken even though async control packets are still being received, which is the classic signature of a unidirectional or return-path forwarding problem. The session is not stable and the cause is echo timeout, not async packet loss or multiplier misconfiguration.

Answer

BFD session is UP and stable.

Answer

BFD async packets are failing, causing session down.

Answer

BFD session is flapping due to misconfigured multiplier.

Question 6

A network engineer runs the following command on Router R1:

R1# show snmp mib

MIB: IF-MIB
MIB: SNMPv2-MIB
MIB: IP-MIB
MIB: CISCO-CONFIG-MAN-MIB
MIB: ENTITY-MIB

Based on this output, which statement is correct?

Accepted Answer

The router supports monitoring of configuration changes via SNMP.. The output of 'show snmp mib' lists the MIBs that the router supports. The presence of CISCO-CONFIG-MAN-MIB indicates that the router supports the Cisco Configuration Management MIB, which allows SNMP to monitor and manage configuration changes, such as when a configuration is saved or modified. Therefore, option A is correct.

Answer

The router does not support the IF-MIB.

Answer

The router only supports Cisco proprietary MIBs.

Answer

The ENTITY-MIB is used for entity authentication.

Question 7

A router experiences high CPU utilization due to SSH login attempts from an external attacker. The network engineer implements a CoPP policy to rate-limit SSH traffic to 10000 bps. After applying the policy, the engineer notices that legitimate SSH sessions from the management network are also being dropped intermittently. The CoPP policy uses a class-map that matches TCP port 22 traffic. What should the engineer do to fix this issue?

Accepted Answer

Create a separate class for legitimate SSH traffic from the management network with a higher police rate, and police the attacker's traffic more aggressively.. It uses a granular CoPP design: legitimate SSH traffic from the management network is placed in a separate class with a higher police rate, while the attacker's traffic is policed more aggressively. This preserves control-plane resources for authorized sessions without dropping them, addressing the root cause of the problem—overly broad rate-limiting of all TCP port 22 traffic.

Answer

Increase the police rate for the SSH class to 100000 bps to allow all SSH traffic.

Answer

Modify the class-map to match only SSH traffic from the attacker's source IP addresses using an access-list.

Answer

Remove the CoPP policy and implement an ACL on the interface to block the attacker's IP address.

Question 8

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall policy change, traffic from this VLAN is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to 192.168.1.1, but 'debug ip packet' on R1 shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but 'show access-lists' on the firewall shows an ACL that denies traffic from 10.10.10.0/24. What is the root cause?

Accepted Answer

The firewall has an ACL that denies traffic from 10.10.10.0/24. Update the ACL to allow this traffic.. The firewall's ACL explicitly denies traffic from 10.10.10.0/24, which is why packets forwarded by PBR to 192.168.1.1 receive no response. The debug output on R1 confirms PBR is working and packets are being sent to the firewall, so the drop is happening at the firewall due to the ACL. Updating the ACL to permit this traffic resolves the issue.

Answer

The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.

Answer

The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.

Question 9

Which statement about PBR and the 'set interface' command is correct?

Accepted Answer

The 'set interface' command forces the packet out the specified interface, and if the interface is down, the packet is dropped.. The 'set interface' command in a PBR route-map forces matched packets out a specific egress interface regardless of the routing table. Unlike 'set ip next-hop', which relies on recursive lookup and can fall back to the RIB if the next-hop is unreachable, 'set interface' is a hard directive: if the referenced interface is down or not up/up, the packet is dropped rather than being routed normally. This makes it useful for strict path selection but risky in environments with flapping links.

Answer

The 'set interface' command can only be used with point-to-point interfaces.

Answer

If the specified interface is down, the router uses the routing table.

Answer

The 'set interface' command requires a next-hop IP address to be specified.

Question 10

Which TWO statements about IP SLA ICMP echo operations are true? (Choose TWO.)

Accepted Answer

It measures round-trip time (RTT) between the source and destination.. Option A is correct because an IP SLA ICMP echo operation sends ICMP echo requests to a target and computes the round-trip time (RTT) between the source and destination, which is the core metric it reports. Option C is correct because after configuring the operation with the 'ip sla ' and 'icmp-echo' commands, you must activate it with the 'ip sla schedule start-time ... life ...' command, otherwise the operation never runs. Option B is not correct because jitter measurement is provided by UDP jitter operations (e.g., 'udp-jitter'), not by ICMP echo. Option D is not correct because the destination must be specified as an IP address or a resolvable name, and using a hostname requires DNS resolution to be configured on the device. Option E is not correct because the operation does not run continuously by default; it only runs once it is explicitly scheduled with 'ip sla schedule' and within the configured life/start-time parameters.

Answer

It measures jitter in the network path.

Answer

The destination can be specified as a hostname without any additional configuration.

Answer

The operation runs continuously by default after configuration.

Question 11

What is the default administrative distance for OSPFv3 internal routes?

Accepted Answer

110. OSPFv3, like OSPFv2, uses a default administrative distance of 110 for all internal routes (intra-area and inter-area). This value is hard-coded in Cisco IOS and is not configurable per-route type; it distinguishes OSPF routes from other routing protocols. Option B is correct because 110 is the standard AD for OSPF (both versions) internal routes.

Answer

90

Answer

115

Answer

120

Question 12

Consider the following DHCPv6 configuration on router R2:

ipv6 dhcp pool DHCP6_POOL
 dns-server 2001:db8::1
 domain-name example.com
!
interface GigabitEthernet0/0
 ipv6 address 2001:db8:1::1/64
 ipv6 dhcp server DHCP6_POOL
 ipv6 nd other-config-flag
 no shutdown

What is the effect of this configuration?

Accepted Answer

Hosts on this subnet will use SLAAC to obtain their IPv6 address and then use DHCPv6 to get DNS and domain information.. The configuration uses the `ipv6 nd other-config-flag` command, which sets the 'Other Configuration' flag (O-flag) in Router Advertisement (RA) messages. This tells hosts to use Stateless Address Autoconfiguration (SLAAC) for their IPv6 address (based on the prefix in the RA) and then use DHCPv6 (stateless DHCPv6) only to obtain additional parameters like DNS server and domain name, as defined in the DHCPv6 pool.

Answer

Hosts will obtain both their IPv6 address and DNS information from the DHCPv6 pool.

Answer

The DHCPv6 pool is missing the address prefix, so it will not provide any configuration to clients.

Answer

The ipv6 nd other-config-flag command is ignored because the DHCPv6 server is configured on the interface.

Question 13

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show policy-map control-plane input class class-default

Class-map: class-default (match-any)
    140225 packets, 12345678 bytes
    5 minute offered rate 1000 bps, drop rate 0 bps
    Match: any
    police:
        cir 1000000 bps, bc 31250 bytes
        conformed 140225 packets, 12345678 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

The CoPP policy is policing traffic to 1 Mbps, and all traffic so far has been within the limit and transmitted.. The output shows that the class-default class in the CoPP policy has a police configuration with a CIR of 1,000,000 bps (1 Mbps). All 140,225 packets have been counted as conforming, with zero exceeded or violated packets, and the conform action is 'transmit'. This means all traffic has been within the policed rate and has been forwarded without drops.

Answer

The CoPP policy is dropping all traffic because the CIR is too low.

Answer

The CoPP policy is not matching any traffic because the class-default does not match any packets.

Answer

The CoPP policy is only policing traffic that exceeds the CIR, but all traffic is being transmitted.

Question 14

Drag and drop the steps to troubleshoot VRF-Lite adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify VRF definition with show vrf detail. Start by checking if the VRF is defined correctly with show vrf. Then verify interface assignment to the correct VRF. Next, confirm that the IP address on the interface is in the VRF context. After that, test basic connectivity with ping using the VRF keyword. Finally, examine routing protocol adjacency status within the VRF.

Question 15

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla monitor configuration 10

IP SLAs Monitor, Infrastructure Engine-II.
Entry number: 10
Owner: 
Tag: 
Type of operation to perform: icmp-echo
Target address: 192.168.1.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already occurred
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday): FALSE
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
   Number of history intervals kept: 0
   Number of history buckets kept: 15
   History Statistics:
      Number of history Lives kept: 0

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is configured as an ICMP echo probe with a 60-second frequency and 5-second timeout.. The output shows 'Type of operation to perform: icmp-echo', indicating an ICMP echo probe. The 'Frequency (seconds): 60' means the probe runs every 60 seconds, and 'Operation timeout (milliseconds): 5000' means it times out after 5 seconds. The status is 'Active', not pending.

Answer

The IP SLA monitor operation is configured as a UDP jitter probe to 192.168.1.1.

Answer

The IP SLA monitor operation has a frequency of 5 seconds and a timeout of 60 seconds.

Answer

The IP SLA monitor operation is in a 'Pending' state.

Question 16

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# show ip access-lists 160
Extended IP access list 160
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22
    20 permit tcp 172.16.0.0 0.15.255.255 any eq 22
    30 permit tcp 192.168.0.0 0.0.255.255 any eq 22
    40 deny ip any any

What does this output indicate?

Accepted Answer

The ACL permits SSH from private IP ranges and denies all other traffic.. The ACL permits TCP traffic to destination port 22 (SSH) from the three private IP ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) using wildcard masks that match the respective network prefixes. The final explicit deny ip any any statement blocks all other traffic, so only SSH from private IP ranges is permitted.

Answer

The ACL permits all traffic from private IP ranges.

Answer

The ACL denies SSH from private IP ranges.

Answer

The ACL is applied inbound on an interface and is blocking all traffic.

Question 17

Which statement about IPv6 uRPF loose mode is true?

Accepted Answer

It only verifies that the source address exists in the FIB.. In IPv6 unicast Reverse Path Forwarding (uRPF) loose mode, the router checks the FIB (Forwarding Information Base) to verify that the source address of an incoming packet exists in the routing table. It does not require the source address to be reachable via the same interface, which is the key distinction from strict mode. This allows loose mode to be used in asymmetric routing scenarios where the return path may not match the ingress interface.

Answer

It requires the source address to be reachable via the same interface.

Answer

It drops packets with link-local source addresses.

Answer

It is enabled by default on all interfaces.

Question 18

Consider the configuration snippet:

logging 192.168.1.10 vrf Mgmt-intf
logging source-interface Vlan1
logging trap 6

What is the effect of the 'logging trap 6' command?

Accepted Answer

Messages of severity 0 through 6 are sent to the syslog server.. The 'logging trap 6' command sets the syslog severity threshold for messages sent to remote syslog servers. Because syslog severity numbers are inverted (0 is most severe, 7 is least), specifying level 6 means all messages with severity 0 through 6 (emergencies through informational) are sent, while level 7 (debugging) messages are suppressed.

Answer

Only messages of severity 6 are sent to the syslog server.

Answer

Messages of severity 6 through 7 are sent to the syslog server.

Answer

The number 6 is invalid; only named levels are accepted.

Question 19

DMVPN spoke-to-spoke tunnel is not forming between two spokes. Hub router R1 has the following relevant configuration: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 ip nhrp map multicast dynamic ip ospf 1 area 0 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint Spoke R2 shows: show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, NHRP Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.168.1.1 10.0.0.1 UP 00:10:00 D Spoke R3 shows similar, but no spoke-to-spoke tunnel. What is the root cause?

Accepted Answer

Missing ip nhrp redirect on hub and ip nhrp shortcut on spokes.. For DMVPN spoke-to-spoke tunnels to form dynamically, the hub must be configured with 'ip nhrp redirect' and each spoke with 'ip nhrp shortcut'. Without these, spokes only build tunnels to the hub (as shown by the single NHRP peer entry pointing to the hub), and traffic between spokes is routed through the hub rather than directly. The 'ip nhrp redirect' on the hub informs the originating spoke of a better path, and 'ip nhrp shortcut' on the spoke allows it to install a shortcut route to the destination spoke.

Answer

OSPF network type is broadcast; change to point-to-multipoint.

Answer

IPsec is not configured; DMVPN requires encryption.

Answer

The tunnel key is mismatched; configure tunnel key on all routers.

Question 20

Which TWO statements about the use of 'mpls ldp autoconfig' in an MPLS L3VPN environment are true? (Choose TWO.)

Accepted Answer

It automatically enables LDP on all interfaces that are part of the OSPF or IS-IS process.. The 'mpls ldp autoconfig' command is used under an OSPF or IS-IS process to automatically enable LDP on all interfaces participating in that IGP. It simplifies configuration but can be overridden per interface. It does not affect BGP sessions, nor does it enable LDP on loopback interfaces by default (loopbacks are not typically used for LDP label exchange). It does not enable MPLS on core interfaces automatically if they are not part of the IGP process.

Answer

It automatically enables LDP on loopback interfaces to facilitate BGP next-hop reachability.

Answer

It configures LDP on all interfaces, including those not running the IGP, as long as they are IP-enabled.

Answer

It is required for the PE-CE routing protocol to exchange labels with the CE router.