300-410 Practice Exam 61 — 20 Questions

Question 1

Which TWO configuration steps are required to apply an IPv4 extended access list to an interface in Cisco IOS? (Choose TWO.)

Accepted Answer

Configure the ACL using access-list or ip access-list commands.. An IPv4 extended ACL must first be defined using either the numbered `access-list` command or the named `ip access-list extended` command before it can be applied. Option B is correct because the `ip access-group` command is the only way to bind a configured ACL to an interface in Cisco IOS, specifying the direction (in or out) and optionally the VLAN filter.

Answer

Create the ACL directly under the interface configuration mode.

Answer

Use the access-class command on the interface.

Answer

Enable the ACL with the ip inspect command.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology 10.10.10.0/24
EIGRP-IPv4 Topology Entry for AS(100)/ID(192.168.1.1) for 10.10.10.0/24
  State: Passive, Reply status: 0, Originating router: 192.168.1.1
  Routing Descriptor Blocks:
  0.0.0.0 (Null0) from 0.0.0.0, Send flag: 0x0
      Composite metric: (2560000000/0), Route is Internal
      Vector metric:
        Minimum bandwidth: 100000 Kbit
        Total delay: 100 microseconds
        Reliability: 255/255
        Load: 1/255
        Minimum MTU: 1500
        Hop count: 0

Based on this output, what is the problem?

Accepted Answer

The route is a local summary route pointing to Null0, which is normal for EIGRP summarization.. The output shows a Null0 summary route in EIGRP, which is normal when manual summarization is configured. The route is in Passive state with a composite metric of 2560000000/0, indicating it is a local summary route installed to prevent routing loops. This is expected behavior, not a problem.

Answer

The route has a metric of 2560000000, indicating a network failure.

Answer

The hop count of 0 means the route is not reachable.

Answer

The route is in Active state, indicating a problem.

Question 3

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 4

Consider the following partial EIGRP configuration on router R1:

router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 summary-address 10.0.0.0 255.255.255.0 5

What is the effect of the 'summary-address 10.0.0.0 255.255.255.0 5' command?

Accepted Answer

It creates a summary route 10.0.0.0/24 with an administrative distance of 5, advertised out all EIGRP-enabled interfaces.. The 'summary-address' command in EIGRP creates a summary route and advertises it out all interfaces enabled for EIGRP. The administrative distance value (5) is optional and sets the distance for the summary route.

Answer

It creates a summary route 10.0.0.0/24 and sets the metric to 5.

Answer

It creates a summary route 10.0.0.0/24 and suppresses more specific routes with a metric of 5.

Answer

It creates a summary route 10.0.0.0/24 with a tag of 5.

Question 5

Which TWO statements about MPLS label imposition (push) are true? (Choose TWO.)

Accepted Answer

Label imposition occurs at the ingress LSR.. Label imposition occurs at the ingress LSR, which pushes a label onto an unlabeled IP packet. The label is based on the FEC (Forwarding Equivalence Class) derived from the IP destination. The egress LSR pops the label, not imposes it.

Answer

Label imposition occurs at the egress LSR.

Answer

The imposed label is always the top label in a label stack.

Answer

Label imposition is performed using the 'tag-switching' command.

Question 6

An engineer configures SNMPv2c with a community string 'public' and an ACL that permits the NMS. The NMS can poll the router. The engineer then applies a CoPP policy that drops SNMP packets (UDP port 161) from all sources except the NMS. The NMS now fails to poll. Which is the most likely explanation?

Accepted Answer

The CoPP policy's ACL does not include the NMS IP address, so SNMP packets from the NMS are dropped by the class-default.. CoPP (Control Plane Policing) applies to all traffic destined to the router's control plane, including SNMP. If the CoPP policy's ACL does not explicitly permit the NMS IP address for UDP port 161, those packets fall into the class-default, which is configured to drop them. Even though the SNMP community string ACL permits the NMS, CoPP is evaluated before the packet reaches the SNMP process, so the drop occurs first.

Answer

CoPP only affects routing protocol traffic, not SNMP.

Answer

The SNMP community string ACL is overridden by the CoPP policy.

Answer

The router requires a reload for the CoPP policy to take effect.

Question 7

A large enterprise network uses EIGRP with route summarization. Router R1 has the following configuration: interface GigabitEthernet0/0, ip summary-address eigrp 100 10.0.0.0 255.255.252.0. Router R2 shows: show ip route eigrp includes 10.0.0.0/22 but not 10.0.3.0/24. What is the root cause?

Accepted Answer

The EIGRP summary address suppresses more specific routes within its range.. The EIGRP `ip summary-address` command on R1 creates a summary route (10.0.0.0/22) that is advertised to R2, and by default EIGRP suppresses the advertisement of all more specific routes that fall within the summary range (10.0.0.0/22 includes 10.0.3.0/24). This is the intended behavior of EIGRP route summarization: the summary route replaces the component routes to reduce routing table size and update overhead.

Answer

The summary address is misconfigured; it should be 10.0.0.0/24.

Answer

R2 has a route filter blocking 10.0.3.0/24.

Answer

R1's interface is down, preventing route advertisement.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip ospf database summary 172.16.0.0

OSPF Router with ID (1.1.1.1) (Process ID 1)

Summary Net Link States (Area 0)

LS age: 100
  Options: (No TOS-capability, DC)
  LS Type: Summary Links(Network)
  Link State ID: 172.16.0.0 (Summary Network Number)
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0x1234
  Length: 28
  Network Mask: /20
  TOS: 0  Metric: 10

Based on this output, what does this LSA represent?

Accepted Answer

It is a summary route for 172.16.0.0/20 advertised by ABR 2.2.2.2.. This is a Type 3 Summary LSA, which is used to advertise inter-area routes. The Advertising Router is 2.2.2.2, an ABR.

Answer

It is a router LSA from R1.

Answer

It is an external route from ASBR.

Answer

It is a network LSA for the 172.16.0.0 network.

Question 9

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.2.2:0, Local LDP Ident: 192.168.1.1:0
        TCP connection: 10.1.1.2.646 - 10.1.1.1.646
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:45:00
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.1.1.2
        Addresses bound to peer LDP Ident:
          10.1.1.2     192.168.2.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which indicates the LDP session is operational. The 'Downstream' label distribution mode and the fact that messages have been sent and received (100/100) confirm that the session is actively exchanging label information. This matches the correct answer that the LDP session is operational and exchanging label information.

Answer

The LDP session is in a down state due to a TCP reset.

Answer

The LDP session is in initialization state because no labels have been exchanged.

Answer

The LDP session is using UDP instead of TCP.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 1
IPSLAs Latest Operation Statistics
IPSLA operation id: 1
Type of operation: icmp-echo
Latest RTT: 10 milliseconds
Latest operation start time: 00:15:30 UTC Mon Mar 1 2021
Latest operation return code: OK
Number of successes: 100
Number of failures: 0
Operation time to live: Forever

Based on this output, which statement is correct?

Accepted Answer

The IP SLA operation is successful and has a low RTT.. The output shows an IP SLA operation of type icmp-echo with a return code 'OK', 100 successes, and 0 failures. This indicates the operation is functioning correctly.

Answer

The IP SLA operation has failed 100 times.

Answer

The IP SLA operation type is udp-jitter.

Answer

The IP SLA operation has expired.

Question 11

Consider the following EIGRP configuration on Router R1:

router eigrp 100
 network 10.0.0.0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of this configuration?

Accepted Answer

EIGRP will form neighbor adjacencies only on GigabitEthernet0/0.. The 'passive-interface default' command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets on them. The 'no passive-interface GigabitEthernet0/0' command then overrides this default for that specific interface, allowing EIGRP to send and receive hellos and thus form neighbor adjacencies only on GigabitEthernet0/0.

Answer

EIGRP will form neighbor adjacencies on all interfaces.

Answer

EIGRP will not form any neighbor adjacencies.

Answer

EIGRP will form neighbor adjacencies on all interfaces except GigabitEthernet0/0.

Question 12

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 120
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip bgp summary
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          200      10      10        1    0    0 00:05:00        5

Based on this output, what is the most likely problem?

Accepted Answer

The access-list 120 is not matching BGP traffic, so it is falling into class-default.. The CoPP policy shows zero packets matched under class CoPP-BGP, which uses access-group 120. Since the BGP session to 10.1.1.2 is up and exchanging routes, BGP traffic is not being classified by the policy and is instead falling into the default class, which typically permits all traffic. This indicates that access-list 120 does not match the BGP packets, likely due to incorrect ACL entries or direction.

Answer

The BGP session is down.

Answer

The police rate is too low and is dropping all BGP packets.

Answer

The policy-map is applied to the output direction.

Question 13

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After a few minutes, routing loops occur. The engineer did not configure route tagging. Which is the most likely explanation?

Accepted Answer

The router redistributes routes from OSPF into EIGRP, and then those routes are redistributed back into OSPF, creating a loop.. Without route tagging, when the router redistributes OSPF routes into EIGRP, those routes are learned by EIGRP neighbors. If the same router (or another router) then redistributes those EIGRP-learned routes back into OSPF, OSPF will accept them because they appear as external routes with a lower administrative distance than the original OSPF intra-area routes. This creates a mutual redistribution loop, causing routing instability and loops.

Answer

The seed metric is not configured, causing EIGRP to reject the redistributed routes.

Answer

OSPF has a lower administrative distance than EIGRP, causing route preference issues.

Answer

The router is running both protocols on the same interface, causing a conflict.

Question 14

A network administrator configures an ACL to filter routes during redistribution, but management traffic stops working. Router R1 config:
access-list 100 permit ip 10.0.0.0 0.255.255.255 any
!
router eigrp 100
 redistribute ospf 1 route-map FILTER
!
route-map FILTER permit 10
 match ip address 100

R1# show ip route 10.1.1.1
Routing entry for 10.1.1.1/32
  Known via "connected", distance 0, metric 0
  Redistributing via eigrp 100

What is the root cause?

Accepted Answer

The ACL implicit deny blocks all routes not matching 10.0.0.0/8, including management routes.. The ACL only permits 10.0.0.0/8, but the management traffic may use a different source or destination. The implicit deny at the end of the ACL blocks all other routes, including management prefixes. The fix is to add a permit statement for the management network or use a more specific ACL.

Answer

The route-map is missing the set metric command, causing routes to be unreachable.

Answer

The access-list is applied in the wrong direction.

Answer

The redistribute command is missing the subnets keyword.

Question 15

Which of the following is a limitation of NAT as defined in RFC 2663?

Accepted Answer

NAT breaks end-to-end IP connectivity and can interfere with application-layer protocols.. RFC 2663 defines NAT as a mechanism that modifies IP addresses and/or ports in packet headers, which inherently breaks the end-to-end IP connectivity model. This modification can interfere with application-layer protocols that embed IP addresses or port numbers in their payload, such as FTP, SIP, or DNS, because NAT does not automatically translate these embedded addresses.

Answer

NAT cannot translate UDP traffic.

Answer

NAT is incompatible with TCP traffic.

Answer

NAT requires all traffic to be encrypted.

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: loose mode

Based on this output, what is the operational state of uRPF on this interface?

Accepted Answer

uRPF is enabled in loose mode. The command 'show ipv6 interface gigabitethernet 0/0 | include uRPF' returns 'IPv6 uRPF: loose mode', which directly indicates that unicast Reverse Path Forwarding (uRPF) is enabled and operating in loose mode on this interface. Loose mode checks only that a source address exists in the routing table, without requiring that the incoming interface matches the best return path.

Answer

uRPF is disabled

Answer

uRPF is enabled in strict mode

Answer

uRPF is enabled but only for IPv4

Question 17

A network engineer is troubleshooting an OSPFv2 issue where a router R1 is not receiving a specific route for 10.0.0.0/8 from a neighbor R2. The adjacency is FULL, and 'show ip ospf database' on R1 shows the LSA for 10.0.0.0/8 as a type 5 LSA. However, the route is not in the routing table. 'show ip route 10.0.0.0' shows no route. What is the most likely cause?

Accepted Answer

The router R1 has a distribute-list applied to the OSPF process that filters the route 10.0.0.0/8.. If the LSA is in the database, the route should be installed unless there is a filtering mechanism or a routing table issue. One common cause is that the router has a route map that filters the route from being installed. Another possibility is that the router has a static route that is being preferred, but the stem says no route is present. The most likely cause is that the router has a distribute-list that filters the route.

Answer

The route is a type 5 LSA, but the router is in a stub area.

Answer

The router has a higher administrative distance for OSPF routes, causing it to prefer another routing protocol.

Answer

The route has a metric of 16777214, which is considered infinite.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip ospf virtual-links

Virtual Link OSPF_VL0 to router 10.1.1.3 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/0, Cost of using 10
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:08
  Adjacency State FULL

Based on this output, what can be concluded?

Accepted Answer

The virtual link is functioning correctly and the adjacency is full.. The virtual link to router 10.1.1.3 is up and in FULL state. It is running as a demand circuit, which suppresses hello packets when the link is stable. The transit area is area 1.

Answer

The virtual link is using area 0 as the transit area.

Answer

Router R1 is not receiving hello packets on the virtual link.

Answer

The virtual link has a cost of 1.

Question 19

Two routers R1 and R2 are connected via Ethernet. R1 has:
interface GigabitEthernet0/0
 ip ospf network point-to-point
R2 has default OSPF network type (broadcast). R1 shows:
R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.2.2.2          0   FULL/  -        00:00:35    10.1.1.2        GigabitEthernet0/0
R2 shows:
R2# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.1          1   FULL/DR        00:00:30    10.1.1.1        GigabitEthernet0/0
R1 is not installing OSPF routes from R2. What is the root cause?

Accepted Answer

OSPF network type mismatch prevents proper LSA exchange, causing R1 to ignore routes from R2.. OSPF network type mismatch: R1 is point-to-point, R2 is broadcast. On the point-to-point side, R1 expects no DR/BDR election and uses a different LSA format. The broadcast side sees R1 as DR (because R1's priority is 0? Actually R1 has priority 0? Output shows R1's neighbor has priority 0, but R2 shows R1 as DR. This inconsistency causes adjacency but routes are not exchanged properly due to LSA type mismatch. The fix is to match network types.

Answer

R1 has a higher OSPF priority, causing it to become DR and not accept routes.

Answer

The dead timer mismatch causes adjacency to be unstable.

Answer

R2 is not configured with the same OSPF process ID.

Question 20

After redistributing OSPF into EIGRP, an EIGRP router becomes stuck-in-active (SIA) for certain routes. Router R1 config:
router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500
!
router ospf 1
 redistribute eigrp 100 subnets

R1# show ip eigrp topology 10.0.0.0/8
IP-EIGRP (AS 100): Topology entry for 10.0.0.0/8
  State: Active, 0:01:15, Reply count: 0
  Originating router: 10.1.1.1
  Last sent query: 10.1.1.2

What is the root cause?

Accepted Answer

The redistributed OSPF route is a summary that causes EIGRP queries to go unanswered, leading to SIA.. The EIGRP route for 10.0.0.0/8 is in Active state, meaning it is waiting for replies from neighbors. The redistribution from OSPF may be injecting a summary route that causes a query to be sent to all neighbors, but one neighbor may not have a route back, causing the query to be unanswered. The fix is to ensure that the redistributed routes are not summarized or to use a stub router to limit query scope.

Answer

The EIGRP metric is too high, causing the route to be unreachable.

Answer

The OSPF redistribution is missing the subnets keyword, causing classful behavior.

Answer

The EIGRP AS number is mismatched between routers.