300-410 Practice Exam 62 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# debug eigrp packets update

*Mar  1 00:10:15.456: EIGRP: received packet with opcode = 2 (Update) on GigabitEthernet0/0, src 10.1.2.2 dst 10.1.2.1
*Mar  1 00:10:15.456:   EIGRP: Update contains 5 routes, version 145, seq 10
*Mar  1 00:10:15.456:   EIGRP: Update update/interval, 10.1.1.0/24 metric 131072
*Mar  1 00:10:15.456:   EIGRP: Update update/interval, 10.2.2.0/24 metric 131072
*Mar  1 00:10:15.456:   EIGRP: Update update/interval, 10.3.3.0/24 metric 131072
*Mar  1 00:10:15.456:   EIGRP: Update update/interval, 10.4.4.0/24 metric 131072
*Mar  1 00:10:15.456:   EIGRP: Update update/interval, 10.5.5.0/24 metric 131072

What does this output indicate?

Accepted Answer

The neighbor is sending a periodic update with five routes, which is normal EIGRP behavior.. EIGRP sends periodic updates every 90 seconds by default (via the 'ip hello-interval eigrp' and related timers), and the debug output shows a received update with five routes, all having the same metric of 131072, which is typical for a periodic update that refreshes the routing table without indicating a topology change. The 'update/interval' keyword in the debug output explicitly indicates this is a periodic update, not a triggered or full update.

Answer

The neighbor is sending a partial update with five routes, which is typical for a triggered update after a topology change.

Answer

The neighbor is sending a full update, which occurs during initial neighbor formation or after a major change.

Answer

The neighbor is sending an update with incorrect metrics, causing routing issues.

Question 2

MPLS network: LDP neighbors are down between R1 and R2. R1 shows: show mpls ldp neighbor includes nothing. R2 has: interface GigabitEthernet0/0, mpls ip, but R1 has no mpls ip on its interface. What is the root cause?

Accepted Answer

R1's interface lacks the mpls ip command, preventing LDP hello transmission.. The root cause is that R1's interface is missing the 'mpls ip' command. This command is required on each interface to enable MPLS forwarding and to send LDP hello messages (UDP port 646) to neighbors. Without it, R1 cannot discover R2 as an LDP neighbor, so the LDP session never forms, and 'show mpls ldp neighbor' returns nothing on R1.

Answer

R1 and R2 are in different MPLS domains.

Answer

LDP router IDs are not reachable.

Answer

The label distribution protocol is set to TDP instead of LDP.

Question 3

Drag and drop the steps to verify and validate the SNMP operational state into the correct order, from first to last.

Accepted Answer

Check SNMP agent status with show snmp. Begin by checking the SNMP agent status with show snmp. Then, view the SNMP community strings and access permissions. Next, examine SNMP trap and inform configurations. After that, use show snmp mib to verify MIB object accessibility. Finally, perform a test poll from the NMS to confirm end-to-end functionality.

Question 4

Which loop prevention mechanism is used by default in RIP within a VRF-Lite configuration?

Accepted Answer

Split horizon. RIP uses split horizon as a default loop prevention mechanism, which prevents a route from being advertised out the interface from which it was learned.

Answer

Route poisoning

Answer

Hold-down timer

Answer

TTL expiry

Question 5

A network engineer runs the following command on Router R7:

R7# show logging | include %SYS-2-MALLOCFAIL

*Mar  1 00:05:10.123: %SYS-2-MALLOCFAIL: Memory allocation failed for size 1024, from process 0x12345678, pool Processor
*Mar  1 00:06:20.456: %SYS-2-MALLOCFAIL: Memory allocation failed for size 2048, from process 0x12345678, pool Processor
*Mar  1 00:07:30.789: %SYS-2-MALLOCFAIL: Memory allocation failed for size 512, from process 0x12345678, pool Processor

Based on this output, what is the most likely problem?

Accepted Answer

The router has a memory leak or is running out of memory in the Processor pool.. The output shows memory allocation failures in the Processor pool. This indicates that the router is running low on memory, which can cause various issues including process crashes, inability to allocate buffers, and overall instability. The process ID 0x12345678 is likely a specific process that is consuming memory or failing to allocate.

Answer

The router is experiencing high CPU utilization due to routing protocol updates.

Answer

The router's logging buffer is full and cannot store new messages.

Answer

The router has a hardware failure in the memory module.

Question 6

Consider the following partial configuration on router R6:

router bgp 65001
 bgp router-id 6.6.6.6
 neighbor 10.0.0.2 remote-as 65002
 neighbor 10.0.0.2 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

The route-map will set the MED to 50 for all routes advertised to neighbor 10.0.0.2, and all routes will be advertised.. The route-map SET-MED is applied as an outbound route-map on the BGP neighbor 10.0.0.2. Since the route-map has a permit statement with no match clause, it implicitly matches all routes. The set metric 50 command then sets the MED (Multi-Exit Discriminator) to 50 for all routes advertised to that neighbor. All routes are still advertised because the route-map does not contain any deny statements or match conditions that would filter them.

Answer

Only routes that match a specific prefix will have MED set to 50; other routes will not be advertised.

Answer

The configuration is invalid because the route-map must have a match clause.

Answer

The MED will only be set if the neighbor is also configured with a route-map for inbound updates.

Question 7

A network engineer is troubleshooting an IPv6 over IPv4 tunnel that is used to connect two remote sites. The tunnel is configured with a tunnel source that is a loopback interface. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address. The engineer checks the routing table and sees a route to the remote loopback's IPv4 address via a default route. What is the most likely cause?

Accepted Answer

The remote router does not have a route to the loopback network used as the tunnel source; it only has a default route that may not cover that prefix.. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address because the remote router lacks a route back to the loopback network used as the tunnel source. The remote router only has a default route, which may not cover the specific prefix of the local loopback, causing return traffic to be dropped. For IPv6 over IPv4 tunnels, the tunnel source and destination must be reachable via unicast routing; a missing or insufficient route (like a default that doesn't match) breaks bidirectional communication.

Answer

The tunnel destination is configured with the loopback address of the remote router, but the remote router's tunnel source is a different interface.

Answer

The tunnel interface is missing the 'tunnel mode ipv6ip' command.

Answer

The IPv6 address on the tunnel interface is not in the same subnet as the remote tunnel IPv6 address.

Question 8

Given this configuration:

ip nat pool GLOBAL 203.0.113.1 203.0.113.10 prefix-length 28
ip nat inside source list 10 pool GLOBAL overload
access-list 10 permit 10.0.0.0 0.255.255.255

What is the effect?

Accepted Answer

Inside hosts matching ACL 10 are translated to addresses in the pool using PAT.. The configuration uses `ip nat inside source list 10 pool GLOBAL overload`, which combines a NAT pool with the `overload` keyword to enable Port Address Translation (PAT). ACL 10 permits all 10.0.0.0/8 addresses, so inside hosts matching this ACL are translated to the pool addresses (203.0.113.1–203.0.113.10) with port multiplexing, allowing many hosts to share the same public IP. This is the standard Cisco PAT behavior, making option C correct.

Answer

All inside hosts are translated to the first pool address only.

Answer

Each inside host gets a unique pool address without port translation.

Answer

The prefix-length 28 is invalid; a netmask must be used instead.

Question 9

In OSPFv3, what is the purpose of the link-local address in the neighbor adjacency process?

Accepted Answer

The link-local address is used as the source address for OSPFv3 packets and for next-hop resolution.. OSPFv3 uses link-local addresses for neighbor discovery and as the source address for OSPF packets. This is a change from OSPFv2, which uses the interface's IPv4 address. The link-local address is used for next-hop resolution and adjacency formation.

Answer

The link-local address is used as the router ID for OSPFv3.

Answer

The link-local address is only used for DR/BDR election.

Answer

The link-local address is not used in OSPFv3; global unicast addresses are used instead.

Question 10

An engineer configures IPsec between two routers using a site-to-site VPN with IKEv1. The configuration uses `crypto isakmp policy 10` with authentication pre-share and encryption aes. On the peer, the policy is configured with authentication pre-share and encryption 3des. Unexpectedly, the IKE phase 1 negotiation fails. Which is the most likely explanation?

Accepted Answer

The encryption algorithms (AES vs 3DES) do not match, causing IKE phase 1 to fail.. IKEv1 requires that the encryption algorithm, hash, authentication method, and Diffie-Hellman group match exactly between peers. The encryption algorithm mismatch (AES vs 3DES) causes the IKE proposal to be rejected. Even though both use pre-shared keys, the encryption mismatch is a common edge case.

Answer

The pre-shared key must be configured globally, not under the policy.

Answer

The IKE policy must have the same priority number on both ends.

Answer

The authentication method must be `rsa-sig` for site-to-site VPNs.

Question 11

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Accepted Answer

The 'clock timezone' command is not configured on the router.. The 'service timestamps log datetime msec' command uses the router's local time, but if the time zone is not configured, the timestamps will appear in UTC (the default). To show the correct local time, the 'clock timezone' command must be configured to set the appropriate offset.

Answer

The NTP server is not providing timezone information.

Answer

The 'service timestamps log' command should use 'localtime' instead of 'datetime'.

Answer

The syslog server is overwriting the timestamps with its own.

Question 12

Refer to the following partial configuration:

logging console informational
logging monitor debugging
logging trap errors
logging buffered 4096

Which statement is true about the logging levels?

Accepted Answer

The console receives messages of severity 0 through 6.. Logging levels: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), debugging (7). The trap level 'errors' means only messages severity 0-3 are sent to syslog servers. Console 'informational' means 0-6. Monitor 'debugging' means 0-7. Buffer defaults to debugging if not specified, but here it is set to 4096 bytes without a level, so it defaults to debugging.

Answer

The monitor receives messages of severity 0 through 6.

Answer

The syslog server receives messages of severity 0 through 7.

Answer

The buffer stores messages of severity 0 through 6.

Question 13

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 10.1.1.1, local AS number 65001
BGP table version is 15, main routing table version 15
2 network entries using 288 bytes of memory
2 path entries using 160 bytes of memory
2/1 BGP path/bestpath attribute entries using 288 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 736 total bytes of memory
BGP activity 4/2 prefixes, 4/2 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.12.2       4        65002    1023    1047       15    0    0 00:12:34        0
192.168.1.2     4        65003       0       0        0    0    0 never    Active

Based on this output, what is the problem with the BGP session to 192.168.1.2?

Accepted Answer

The BGP session to 192.168.1.2 has never been established and is in Active state, likely due to a lack of TCP connectivity.. The neighbor 192.168.1.2 is in Active state, meaning R1 is trying to establish a TCP connection but is not receiving a response. This could be due to reachability issues, incorrect AS number, or ACL blocking. The session has never been up (Up/Down: never).

Answer

The neighbor 192.168.1.2 is not reachable.

Answer

The neighbor 192.168.1.2 is in Idle state due to a misconfigured AS number.

Answer

The BGP session to 192.168.1.2 is established but not exchanging prefixes.

Question 14

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Accepted Answer

The syslog service on 10.1.1.200 is not running or is blocked by a firewall.. Cisco IOS allows multiple logging hosts, but each must be configured with a separate 'logging host' command. If the second server is not receiving messages, it may be because the 'logging trap' level for that specific host is set to a higher severity (e.g., 'logging host 10.1.1.200 trap errors') that filters out most messages, or the server is not listening. However, a common mistake is that the second host is configured with a different port or protocol that is not supported. But the most typical cause is that the second server's syslog service is not running or is firewalled.

Answer

The router can only send to one syslog server at a time.

Answer

The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.

Answer

The second server is configured with a different severity level using 'logging trap' under the host.

Question 15

An engineer configures Control Plane Policing (CoPP) on a router with a policy-map that matches EIGRP packets and sets a police rate of 1000 pps. The class-default is configured with a police rate of 100 pps. Unexpectedly, EIGRP neighbor relationships start flapping, even though the EIGRP packet rate is well below 1000 pps. Which is the most likely explanation?

Accepted Answer

The class-map matching EIGRP does not include multicast address 224.0.0.10, causing EIGRP packets to fall into class-default and be policed at 100 pps.. CoPP applies to packets destined to the control plane. EIGRP uses multicast address 224.0.0.10. If the class matching EIGRP does not include the multicast group or uses an incorrect match criterion, EIGRP packets may fall into class-default and be policed at the lower rate (100 pps). This is a common misconfiguration where the ACL or class-map does not properly match EIGRP traffic.

Answer

The police rate of 1000 pps is too low for EIGRP hello packets, causing drops.

Answer

CoPP must be applied to the management interface, not the control plane.

Answer

The class-default police rate must be higher than the EIGRP class rate.

Question 16

Which THREE commands can be used to verify and troubleshoot EIGRP route redistribution issues, specifically when routes are not being redistributed correctly? (Choose THREE.)

Accepted Answer

'show ip route'. Troubleshooting redistribution involves verifying that routes are in the source routing protocol, that the redistribute command is correct, and that metrics are set. 'show ip eigrp topology' shows EIGRP routes, not redistributed routes from other protocols. 'show ip route' shows all routes in the routing table. 'debug eigrp fsm' tracks EIGRP events. 'show ip protocols' shows redistribution configuration. 'ping' verifies reachability but not redistribution.

Answer

'show ip eigrp topology'

Answer

'ping'

Question 17

A network engineer runs the following command on Router R4:

R4# show logging | include %BGP-3-NOTIFICATION

*Mar  1 00:01:05.123: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:02:10.456: %BGP-3-NOTIFICATION: received from neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:03:15.789: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes

Based on this output, what is the most likely problem?

Accepted Answer

There is a connectivity issue causing keepalive packets to be lost.. The output shows BGP notifications for hold timer expiration between R4 and neighbor 10.0.0.2. This indicates that keepalive messages are not being exchanged in time, causing the BGP session to reset repeatedly. This is typically due to a flapping link, high CPU load, or mismatched hold timers.

Answer

The BGP neighbor has a mismatched autonomous system number.

Answer

The BGP update interval is too short, causing excessive updates.

Answer

The router is configured with soft-reconfiguration inbound, causing memory issues.

Question 18

An engineer enables uRPF (unicast Reverse Path Forwarding) in strict mode on an interface connected to a DMVPN spoke. The spoke has multiple tunnels and receives traffic from the hub with a source IP that is not the best reverse path. Unexpectedly, the spoke drops all traffic from the hub, even though the hub is reachable via the tunnel. Which is the most likely explanation?

Accepted Answer

uRPF strict mode requires the reverse path to be via the same interface; asymmetric routing causes drops.. uRPF strict mode checks that the source IP of incoming packets has a route back to the source via the same interface. In DMVPN, the hub's source IP may be reachable via a different interface (e.g., physical interface) than the tunnel interface where the packet arrives. This asymmetric routing causes uRPF strict mode to drop the packets. The solution is to use loose mode or allow-default.

Answer

The hub's IP address is not in the routing table, so uRPF drops the packet.

Answer

uRPF must be configured with the `allow-default` option to accept packets with default route.

Answer

uRPF is not supported on tunnel interfaces; it must be applied on the physical interface.

Question 19

Which TWO statements correctly describe the behavior of EIGRP stub routing and its impact on troubleshooting? (Choose TWO.)

Accepted Answer

A stub router configured with the 'leak-map' option can advertise specific routes learned from other EIGRP neighbors beyond the stub restrictions.. EIGRP stub routing restricts the types of queries sent to a stub router and prevents it from acting as a transit router. Leak-map allows selective leaking of routes. The stub router does not send queries to its neighbors, but it can still receive queries from them. 'show ip eigrp topology' shows all routes, not just stub-learned ones. The 'connected' keyword only advertises connected routes, not summary or static unless specified.

Answer

When a router is configured as an EIGRP stub with the 'connected' keyword, it automatically advertises all connected interfaces, including passive interfaces, to its neighbors.

Answer

The command 'show ip eigrp topology all-links' on a stub router displays only the routes that are in the routing table, as stub routers do not store feasible successors.

Answer

An EIGRP stub router configured with the 'static' keyword will automatically redistribute all static routes into EIGRP, even if the 'redistribute static' command is not present.

Question 20

In DMVPN, what is the default holdtime value for NHRP mappings on a spoke router?

Accepted Answer

7200 seconds. The default NHRP holdtime is 7200 seconds (2 hours) for mappings learned from the hub. This can be changed with the 'ip nhrp holdtime' command.

Answer

300 seconds

Answer

600 seconds

Answer

3600 seconds