300-410 Practice Exam 62 — 20 Questions

Question 1

Given the following BGP configuration on router R1:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 route-map SET-MED out
!
route-map SET-MED permit 10
 match ip address prefix-list LOOPBACKS
 set metric 100
!
route-map SET-MED permit 20
!
ip prefix-list LOOPBACKS permit 192.168.0.0/24

What is the effect of this configuration?

Accepted Answer

All routes are advertised to 10.1.1.2; the 192.168.0.0/24 route has MED 100, others have no MED.. The route-map SET-MED has two permit statements: sequence 10 matches the LOOPBACKS prefix-list and sets MED 100, while sequence 20 is an empty permit that matches everything else and applies no metric change. Because route-maps have an implicit deny at the end, the empty permit 20 is essential to allow all other routes through. The result is that all routes are advertised, but only 192.168.0.0/24 carries MED 100.

Answer

Only the 192.168.0.0/24 route is advertised to 10.1.1.2, with MED 100.

Answer

All routes are advertised with MED 100 because the route-map is applied outbound.

Answer

Only the 192.168.0.0/24 route is advertised with no MED because the set metric is ignored.

Question 2

A network administrator is configuring a GRE tunnel between two Cisco IOS routers. The tunnel must support multicast traffic and be protected by IPsec. Which two statements about the configuration are true? (Choose two.)

Accepted Answer

The tunnel interface must be configured with a unique IP subnet that is not used elsewhere.. A GRE tunnel requires reachable source and destination addresses for the tunnel to become operational. Additionally, the tunnel interface needs a unique IP subnet to route traffic and run dynamic routing protocols. While IPsec can protect GRE traffic, it is not automatically encrypting multicast, and transport mode is not mandatory. GRE multipoint is an option for hub-and-spoke but not a requirement for multicast support.

Answer

The tunnel mode must be set to gre multipoint to support multicast.

Answer

IPsec transport mode is required to encrypt the GRE traffic.

Answer

Multicast traffic is automatically encrypted by IPsec without additional configuration.

Question 3

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.3.3.0/24
BGP routing table entry for 10.3.3.0/24, version 10
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65003 65004
    10.1.13.3 from 10.1.13.3 (10.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, external
      rx pathid: 0, tx pathid: 0
  Refresh Epoch 1
  65005
    10.1.15.5 from 10.1.15.5 (10.5.5.5)
      Origin IGP, metric 0, localpref 200, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, why is the path via 10.1.15.5 chosen as best?

Accepted Answer

Because it has a higher local preference of 200.. BGP best path selection prefers the path with the highest local preference value. In the output, the path via 10.1.15.5 has a local preference of 200, while the path via 10.1.13.3 has 100. Since local preference is evaluated before AS path length, the higher local preference wins, making the 10.1.15.5 path best.

Answer

Because it has a shorter AS path (65005 vs 65003 65004).

Answer

Because it has a lower metric (0 vs 0).

Answer

Because it was learned from a lower neighbor IP address.

Question 4

An engineer configures a distribute-list on an OSPF router to filter routes. However, the routes are still being advertised to neighbors. Which is the most likely explanation?

Accepted Answer

The distribute-list filters routes in the routing table, not the LSAs sent in OSPF updates.. In OSPF, a distribute-list applied under the OSPF process filters routes from being installed in the local routing table (or from being redistributed), but it does not filter LSAs from being flooded to neighbors. OSPF is a link-state protocol; once an LSA is originated, it is flooded throughout the area regardless of local distribute-list filtering. Therefore, routes still appear in neighbors' LSAs and can be installed if the SPF calculation permits.

Answer

The distribute-list is applied to the wrong interface.

Answer

The distribute-list uses an incorrect prefix-list.

Answer

The OSPF process needs to be restarted for the distribute-list to take effect.

Question 5

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy active

No.  Class        Type    Version   Time Created          Name
  1  applet       system  1.0       Mar 1 00:00:12 2025  TRACK-INTERFACE
  Event Type: syslog (pattern OSPF-5-ADJCHG)
  Action: cli command 'show ip route'

What does this output indicate?

Accepted Answer

The EEM applet 'TRACK-INTERFACE' is active and will execute 'show ip route' when a syslog message matching 'OSPF-5-ADJCHG' is generated.. The output shows the EEM applet 'TRACK-INTERFACE' is active (registered) with a syslog event pattern 'OSPF-5-ADJCHG' and an action to run 'show ip route'. This means it will execute that CLI command when a matching syslog message is generated. The 'policy active' command lists registered policies, not execution history.

Answer

The EEM applet 'TRACK-INTERFACE' is currently executing and has run 'show ip route'.

Answer

The EEM applet 'TRACK-INTERFACE' has been triggered and the output of 'show ip route' is displayed.

Answer

The EEM applet 'TRACK-INTERFACE' is inactive and needs to be enabled.

Question 6

An engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 to next-hop 192.168.1.2. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for multicast traffic from that subnet. What is the most likely explanation?

Accepted Answer

PBR is not supported for multicast traffic; multicast uses its own forwarding mechanisms.. PBR does not process multicast traffic by default. Multicast packets are forwarded using multicast routing protocols (e.g., PIM) and are not subject to PBR. To apply PBR to multicast, special configuration (e.g., 'ip multicast policy route-map') is required.

Answer

The ACL in the route-map is blocking multicast addresses.

Answer

The next-hop 192.168.1.2 is not a multicast-capable router.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command.

Question 7

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show ip bgp vpnv4 vrf CUSTOMER routes
BGP table version is 10, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:1 (default for vrf CUSTOMER)
*> 10.0.0.0/24      10.1.1.2                 0    100      0 65001 i
*> 192.168.1.0/24   10.1.1.2                 0    100      0 65001 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

The VRF CUSTOMER has two routes, both learned via BGP from AS 65001.. The output shows two prefixes (10.0.0.0/24 and 192.168.1.0/24) in the VRF CUSTOMER's VPNv4 BGP table, both marked with '*' (valid) and '>' (best), with next hop 10.1.1.2 and AS path 65001. This confirms both routes were learned via eBGP from AS 65001 and are valid and selected as best. The Route Distinguisher 100:1 is the default for the VRF, which is normal and correct.

Answer

The VRF CUSTOMER is not receiving any routes because the RD is incorrect.

Answer

The VRF CUSTOMER has two routes, but they are not installed in the routing table.

Answer

The VRF CUSTOMER has two routes, but they are filtered by RT import policy.

Question 8

What is the default BGP hold timer value in Cisco IOS-XE?

Accepted Answer

180 seconds. Cisco IOS-XE uses a default BGP hold timer of 180 seconds, with the keepalive timer defaulting to 60 seconds (one-third of the hold time). These defaults follow RFC 4271, which specifies a hold time of 90 seconds or greater, and Cisco's implementation standardizes on 180/60. The hold timer is reset each time a KEEPALIVE or UPDATE message is received; if it expires, the session is torn down.

Answer

90 seconds

Answer

120 seconds

Answer

240 seconds

Question 9

Consider the following BGP configuration on router R5:

router bgp 65005
 bgp router-id 5.5.5.5
 neighbor 10.5.5.6 remote-as 65006
 neighbor 10.5.5.6 route-map SET-LP in
!
route-map SET-LP permit 10
 set local-preference 150
!

What is the result of this configuration?

Accepted Answer

All routes from 10.5.5.6 have their local preference set to 150, making them more preferred.. The route-map SET-LP is applied inbound on neighbor 10.5.5.6, and it contains a single permit statement with no match clauses. Therefore, all routes received from that neighbor match the route-map and have their local preference set to 150. Since the default local preference is 100, these routes become more preferred in BGP best-path selection.

Answer

Only routes that match a prefix-list are affected; otherwise, default local preference is used.

Answer

Local preference is set to 150 for routes sent to 10.5.5.6.

Answer

The route-map is ignored because local-preference can only be set outbound.

Question 10

An engineer configures OSPF on two routers connected via a serial link. Both routers show the neighbor state as EXSTART/EXSTART, and no LSAs are exchanged. The engineer verifies that the OSPF process IDs are the same, areas match, and authentication is correct. Which is the most likely explanation?

Accepted Answer

MTU mismatch between the two routers. OSPF neighbors stuck in EXSTART/EXSTART indicate a failure during database description (DBD) packet exchange, most commonly caused by an MTU mismatch on the interface. The master/slave negotiation cannot complete because the routers cannot agree on the initial DBD sequence, often due to differing MTU values. The fix is to match MTU on both interfaces or use 'ip ospf mtu-ignore'.

Answer

OSPF network type mismatch (e.g., point-to-point vs broadcast)

Answer

OSPF hello interval mismatch

Answer

OSPF dead interval mismatch

Question 11

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# debug ip ospf adj

Output:
OSPF: 2 Way Communication to 10.0.0.2 on GigabitEthernet0/0, state 2WAY
OSPF: Send hello to 224.0.0.5 on GigabitEthernet0/0
OSPF: Rcv DBD from 10.0.0.2 on GigabitEthernet0/0 seq 0x1E opt 0x52 flag 0x7 len 32
OSPF: NBR negotiation done. We are the SLAVE
OSPF: Exchange done with 10.0.0.2 on GigabitEthernet0/0
OSPF: Build router LSA for area 0, router ID 10.0.0.1

What does this output indicate?

Accepted Answer

The router is successfully forming an OSPF adjacency with neighbor 10.0.0.2.. The debug output shows the full OSPF adjacency progression: 2-Way state, DBD exchange with master/slave negotiation ('We are the SLAVE'), 'Exchange done', and router LSA generation. These messages confirm the neighbor relationship advanced past EXSTART/EXCHANGE into LOADING/FULL, indicating a successful adjacency formation. No authentication errors or MTU-related stalls appear in the output.

Answer

The router is experiencing an OSPF authentication failure.

Answer

The router is stuck in the EXSTART state due to MTU mismatch.

Answer

The router is flooding LSAs to all neighbors.

Question 12

A network engineer is configuring policy-based routing (PBR) on a Cisco IOS router. The engineer wants to route traffic from subnet 10.1.1.0/24 to a specific next-hop 192.168.1.1, while all other traffic uses the default route. The engineer configures a route map named PBR with a match statement for the subnet and a set statement for the next-hop, and applies it to the inbound interface of the subnet. However, traffic from 10.1.1.0/24 is still following the default route. What is the most likely reason?

Accepted Answer

The 'ip policy route-map' command is missing on the interface.. Policy-based routing requires the route map to be applied to an interface using the 'ip policy route-map' command. Without this command, the route map is not evaluated, and traffic follows the standard routing table. The engineer created the route map but likely did not apply it to the interface. Applying it to the inbound interface is correct for matching traffic from the subnet. The next-hop reachability is important but not the primary cause if PBR is not enabled.

Answer

The next-hop 192.168.1.1 is not reachable, so PBR is ignored.

Answer

The route map must be applied to the outbound interface instead of the inbound interface.

Answer

The route map is missing a 'permit' statement, causing all traffic to be denied.

Question 13

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001, (received & used)
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: 100:200

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a community attribute of 100:200, which may affect routing decisions.. The output line 'Community: 100:200' confirms that the prefix 192.168.1.0/24 carries the BGP community attribute 100:200. Communities are transitive optional attributes used to tag routes so that route-maps and policies on this or downstream routers can match them and influence selection, filtering, or propagation. The route is also marked 'valid, external, best', so it is installed and usable — the community is simply metadata that may drive routing decisions.

Answer

The prefix 192.168.1.0/24 is not installed in the routing table.

Answer

The prefix 192.168.1.0/24 is being filtered due to the community value.

Answer

The community 100:200 indicates the prefix is from a confederation.

Question 14

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show ip access-lists CoPP-ACL

Extended IP access list CoPP-ACL
    10 permit tcp host 10.1.1.1 any eq bgp (100 matches)
    20 permit udp any any eq 67 (50 matches)
    30 permit icmp any any echo (200 matches)
    40 deny ip any any (500 matches)

What does this output indicate?

Accepted Answer

The ACL is permitting DHCP and ICMP echo traffic, but dropping all other traffic.. The ACL shows that lines 10, 20, and 30 have match counts, indicating that BGP from 10.1.1.1, DHCP (UDP port 67), and ICMP echo are being permitted. Line 40 is a deny all with 500 matches, meaning all other traffic is being dropped. This confirms that the ACL is permitting only the specified traffic (DHCP and ICMP echo) while dropping everything else, making option B correct.

Answer

The ACL is blocking all BGP traffic from 10.1.1.1.

Answer

The ACL is applied to the control plane interface and is dropping all traffic.

Answer

The ACL has a misconfiguration because the deny statement should be at the top.

Question 15

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' event detector in EEM requires a 'pattern' keyword to specify the syslog message string to match; without it, the applet is incomplete and will not compile or will not trigger as intended. The correct syntax is 'event syslog pattern <regex>' (optionally with 'occurs' and 'period' for rate-based triggering). The configuration shown is missing that mandatory pattern argument.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.

Question 16

What is the default LDP keepalive timer value on Cisco IOS-XE routers?

Accepted Answer

180 seconds. The default LDP keepalive timer is 180 seconds, which is used to maintain the LDP session if no other messages are exchanged.

Answer

120 seconds

Answer

60 seconds

Answer

300 seconds

Question 17

A network engineer runs the following command on Router R1:

R1# show bfd neighbors detail

IPv4 Sessions
NeighborAddr      LD/RD         Int        State         Holdown(mult)  Intf
10.1.1.2          1/3           Gi0/0      Down          0(0)          Gi0/0

Session state is DOWN
OurAddr: 10.1.1.1
Handle: 1
Local Diag: 1, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 0(0)
Rx Count: 0, Tx Count: 50

Based on this output, what is the most likely cause of the BFD session being down?

Accepted Answer

The BFD session is down because the neighbor is not responding to BFD packets, likely due to a network connectivity issue or neighbor misconfiguration.. The Local Diag field shows 1, which indicates 'Control Detection Time Expired'. This means the local router did not receive BFD control packets from the neighbor within the expected time. The Rx Count is 0, confirming no packets were received. Tx Count is 50, so the local router is sending packets but not receiving any.

Answer

The neighbor router is not configured for BFD.

Answer

The BFD session is down because the local router is not sending BFD packets.

Answer

The BFD session is down because the multiplier is set too low.

Question 18

An engineer is troubleshooting a DHCPv4 issue where a Cisco router acting as a DHCP client on interface Gi0/0 is not receiving an IP address from an ISP modem. The router has 'ip address dhcp' on the interface. The engineer sees that the interface is up/up, but no IP address is assigned. Debug shows that the router is sending DHCP DISCOVER messages but receives no OFFER. The ISP modem is known to work with other devices. What is the most likely cause?

Accepted Answer

The router is sending the client identifier as the MAC address in a non-standard format; the modem expects the client identifier to be the MAC address only.. The router is sending DHCP DISCOVER messages but receiving no OFFER, indicating the ISP modem is ignoring the requests. By default, Cisco routers send the client identifier in DHCP packets as a concatenation of the hardware type (1 for Ethernet) and the MAC address (e.g., '0100.1122.3344'). Many ISP modems expect the client identifier to be just the MAC address (without the hardware type prefix), or they may not use client identifier matching at all. The 'ip dhcp client client-id' command can be used to override this behavior, making the router send only the MAC address as the client identifier, which resolves the incompatibility.

Answer

The router needs the 'ip dhcp client broadcast-flag' command.

Answer

The router's interface is in a VRF, and the DHCP client needs VRF awareness.

Answer

The ISP modem requires DHCP Option 82 to be present.

Question 19

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          1000
High Watermark:                           1000

Flows added:                              50000
Flows aged:                               49000
  - Active timeout (1800 secs)           40000
  - Inactive timeout (15 secs)           8000
  - Event aged                           0
  - Watermark aged                       1000
  - Emergency aged                       0

Based on this output, what is the most likely issue?

Accepted Answer

The cache size is too small, causing watermark aging and potential loss of flow data.. The cache is full (1000 current entries, high watermark 1000), and watermark aging has occurred (1000 flows aged due to watermark). This indicates the cache is overflowing, causing flows to be aged prematurely to make room for new flows. This can lead to incomplete data.

Answer

The active timeout is set too low at 1800 seconds.

Answer

The inactive timeout is set too low at 15 seconds.

Answer

The flow exporter is not configured.

Question 20

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: CoPP-SSH (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 110
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      1250 packets, 75000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: any

Based on this output, which statement is correct?

Accepted Answer

The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.. The output shows that the CoPP-ICMP and CoPP-SSH class-maps have zero packets matched (0 packets, 0 bytes), indicating that no traffic has been classified into these classes. This means the policy is not matching any ICMP or SSH packets, likely because the access-lists (100 and 110) are not correctly defined or applied, or the traffic is not reaching the control plane. Option B correctly identifies this lack of matching.

Answer

The CoPP policy is dropping all ICMP packets to the control plane.

Answer

The CoPP policy is rate-limiting SSH traffic to 16000 bps.

Answer

The CoPP policy is applied to the output direction.