300-410 Practice Exam 63 — 20 Questions

Question 1

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.0.0/16 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is configured with 'match ip address 140' and 'set ip next-hop 10.10.10.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 172.16.1.0/24 but not for traffic from 172.16.2.0/24. The engineer checks the ACL 140 and confirms it includes the entire 172.16.0.0/16 subnet. What is the most likely cause?

Accepted Answer

The route map has a sequence that matches 172.16.1.0/24 with a permit, and a later sequence that denies 172.16.2.0/24.. If PBR works for one subnet but not another within the same ACL, it could be due to the route map having multiple sequence statements with different match conditions, or the ACL having specific permit statements that are ordered incorrectly. However, a common cause is that the route map has a sequence with a more specific match that matches 172.16.1.0/24 and a subsequent sequence that denies 172.16.2.0/24. The engineer should check the route map sequence numbers and the ACL order.

Answer

The next-hop 10.10.10.2 is not reachable from the 172.16.2.0/24 subnet.

Answer

The 'ip policy route-map' command is applied to a subinterface that only receives traffic from 172.16.1.0/24.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/1      PBR-MAP

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop verify-availability 10.1.1.2 10 track 1
  Policy routing matches: 150 packets, 12000 bytes

R1# show track 1
Track 1
  IP SLA 1 reachability
  Reachability is Down
    1 change, last change 00:05:20
  Latest operation return code: timeout
  Tracked by:
    ROUTE-MAP 0

Based on this output, what is the most likely outcome?

Accepted Answer

Packets matching ACL 101 are routed normally via the routing table.. The route map uses 'ip next-hop verify-availability' with tracking. Track 1 is down because IP SLA 1 reports unreachability. Therefore, the set clause will not be applied, and packets matching ACL 101 will not be forwarded to 10.1.1.2; they will be routed normally via the routing table.

Answer

Packets matching ACL 101 are forwarded to 10.1.1.2 regardless.

Answer

Packets matching ACL 101 are dropped.

Answer

The route map is removed from the interface due to the track failure.

Question 3

When using 'set ip next-hop verify-availability', what mechanism does the router use to determine if the next-hop is reachable?

Accepted Answer

It uses a tracked object that can be based on IP SLA, interface state, or other criteria.. The 'verify-availability' option uses a tracked object (configured with the 'track' command) which can be based on IP SLA, interface line-protocol, or other criteria. It does not use ARP or ICMP by default.

Answer

It sends an ICMP echo request to the next-hop every 10 seconds.

Answer

It checks the ARP table for the next-hop MAC address.

Answer

It performs a recursive routing table lookup to see if the next-hop is reachable.

Question 4

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.50.0/24 should be forwarded to next-hop 10.50.50.2. The route map 'PBR-50' is configured with 'match ip address 160' and 'set ip next-hop 10.50.50.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.50.0/24, but the router is also policy-routing traffic from other subnets that should not be affected. The engineer checks the ACL 160 and confirms it only matches 192.168.50.0/24. What is the most likely cause?

Accepted Answer

The route map has a sequence with no match condition, which matches all traffic.. If PBR is affecting traffic from other subnets despite the ACL being correct, it could be because the route map has a permit statement without a match condition, or the route map is applied to multiple interfaces. However, a common cause is that the route map has a 'match ip address' that references an ACL with a 'permit ip any any' statement at the end, or the route map has a sequence that matches all traffic. The engineer should check the route map for any sequence that does not have a match statement.

Answer

The 'ip policy route-map' command is applied to multiple interfaces, and traffic from other subnets is entering those interfaces.

Answer

The router is using CEF switching, and PBR is applied to all traffic regardless of ACL.

Question 5

A network engineer runs the following command on Router R1:

R1# show route-map
route-map PBR-ROUTE, permit, sequence 10
  Match clauses:
    ip address (access-lists): ACL-PBR
  Set clauses:
    ip next-hop 192.168.1.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-ROUTE, permit, sequence 20
  Match clauses:
  Set clauses:
    ip next-hop 192.168.2.2
  Policy routing matches: 0 packets, 0 bytes

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-ROUTE

Based on this output, what is the most likely problem?

Accepted Answer

The access list ACL-PBR does not exist or matches no traffic.. The show route-map output shows zero policy routing matches. The route map is applied to the interface, but the access list ACL-PBR may not match any traffic, or traffic is not arriving on GigabitEthernet0/0. The set clause in sequence 20 is applied unconditionally (no match clause), which would normally match all traffic, but sequence 10 must be evaluated first; if ACL-PBR matches nothing, sequence 20 would match all, yet counters still show zero, indicating no traffic is being policy-routed at all.

Answer

The route map is not applied to an interface.

Answer

The next-hop 192.168.1.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 6

A network engineer configures an EEM applet to monitor uRPF (Unicast Reverse Path Forwarding) failures using the event syslog pattern 'IP-3-URPF'. The applet is designed to log when uRPF drops packets due to strict mode. The network has asymmetric routing, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

uRPF strict mode drops packets silently without generating a syslog message unless the 'log' keyword is used.. uRPF strict mode drops packets when the source IP address is not reachable via the incoming interface. However, the syslog message 'IP-3-URPF' is generated only when the 'ip verify unicast source reachable-via' command is configured with the 'allow-default' option or when the drop is logged explicitly. In strict mode without 'allow-default', the router may drop packets silently without generating a syslog message, especially if the drop is due to asymmetric routing. The EEM applet will not trigger because no syslog is generated for the drop.

Answer

The EEM applet must use 'event routing' to capture uRPF events.

Answer

Asymmetric routing causes uRPF to generate a different syslog pattern, such as 'IP-4-URPF'.

Answer

The uRPF must be configured in loose mode to generate syslog messages.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-QOS

R1# show route-map PBR-QOS
route-map PBR-QOS, permit, sequence 10
  Match clauses:
    ip address (access-lists): 120
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 500 packets, 45000 bytes

R1# show access-lists 120
Extended IP access list 120
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# debug ip policy
Policy routing debugging is on
*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy match
*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy rejected

Based on this output, what is the most likely problem?

Accepted Answer

The next-hop 10.0.0.2 is unreachable.. The debug output shows 'policy match' followed by 'policy rejected'. This indicates that the packet matched the route map, but the set clause was not applied because the next-hop is unreachable or the route map's set condition fails (e.g., verify-availability if used, or next-hop not in routing table). The show route-map shows matches, but the packet is rejected and forwarded normally.

Answer

The access list 120 is misconfigured.

Answer

The route map is applied to the wrong interface.

Answer

The route map sequence number is incorrect.

Question 8

Which THREE symptoms indicate that Policy-Based Routing (PBR) is not working as expected? (Choose THREE.)

Accepted Answer

Traffic that should be policy-routed follows the routing table instead.. If traffic that should be policy-routed follows the routing table instead, PBR may not be applied or the route-map may not match. High CPU usage can occur if PBR is process-switched and ACLs are large. If the 'set interface' specifies a down interface, packets are dropped. The 'show ip policy' command shows PBR application, not a symptom of failure. PBR does not affect routing table updates. A mismatch in ACLs can cause unintended forwarding.

Answer

The 'show ip policy' command shows the route-map applied to the interface.

Answer

The routing table is updated with new routes from PBR.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-VOICE

R1# show route-map PBR-VOICE
route-map PBR-VOICE, permit, sequence 10
  Match clauses:
    ip address (access-lists): 130
  Set clauses:
    ip next-hop 192.168.10.1
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 130
Extended IP access list 130
    10 permit udp any any range 16384 32767

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.1.1.1/24

R1# show ip route 192.168.10.1
% Network not in routing table

Based on this output, what is the most likely problem?

Accepted Answer

The next-hop 192.168.10.1 is not reachable.. The next-hop 192.168.10.1 is not in the routing table. For PBR to forward packets to a next-hop, that next-hop must be reachable (in the routing table). If it is not, packets that match the route map are forwarded using the normal routing table instead. The zero matches could be because no traffic matching ACL 130 has arrived, or because the next-hop is missing, but the missing route is a clear issue.

Answer

The access list 130 is not matching any traffic.

Answer

The interface GigabitEthernet0/0 is down.

Answer

The route map is missing a permit statement.

Question 10

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip policy
Interface   Route-map
FastEthernet0/0  PBR-MAP

What does this output indicate?

Accepted Answer

PBR is enabled on FastEthernet0/0 with route-map PBR-MAP.. The output shows that PBR is applied on FastEthernet0/0 using route-map PBR-MAP. This confirms the interface-level configuration.

Answer

The route-map PBR-MAP is not configured.

Answer

PBR is applied globally and on the interface.

Answer

The route-map is applied to all interfaces.

Question 11

What is the default action for a packet that does not match any route-map entry in a PBR policy?

Accepted Answer

The packet is forwarded using the routing table.. If no route-map entry matches, the packet is forwarded using the normal routing table lookup. PBR does not drop unmatched packets by default.

Answer

The packet is dropped.

Answer

The packet is sent to the CPU for processing.

Answer

The router sends an ICMP unreachable message.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-MULTI

R1# show route-map PBR-MULTI
route-map PBR-MULTI, permit, sequence 10
  Match clauses:
    ip address (access-lists): 140
  Set clauses:
    ip next-hop 10.0.0.2 10.0.0.3
  Policy routing matches: 200 packets, 18000 bytes

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

R1# show ip route 10.0.0.3
% Network not in routing table

Based on this output, what is the most likely behavior for packets matching ACL 140?

Accepted Answer

Packets are forwarded to 10.0.0.2.. When multiple next-hops are specified in a set clause, PBR tries them in order. The first reachable next-hop is used. Here, 10.0.0.2 is reachable, so packets are forwarded to 10.0.0.2. The second next-hop is not reachable, but that does not affect the first.

Answer

Packets are load-balanced between 10.0.0.2 and 10.0.0.3.

Answer

Packets are dropped because one next-hop is unreachable.

Answer

Packets are forwarded to 10.0.0.3 via a recursive lookup.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-DEFAULT

R1# show route-map PBR-DEFAULT
route-map PBR-DEFAULT, permit, sequence 10
  Match clauses:
    ip address (access-lists): 150
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-DEFAULT, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 150
Extended IP access list 150
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely problem?

Accepted Answer

No traffic matching ACL 150 is arriving on GigabitEthernet0/0.. The route map has a deny sequence 20 with no match clause, which means it matches all packets. Since route maps are processed in order, if sequence 10 does not match (zero matches), sequence 20 will match all remaining packets and deny them (i.e., not apply PBR), causing them to be routed normally. However, the counters show zero for both sequences, indicating no traffic is being processed at all, likely because no traffic matching ACL 150 arrives on the interface.

Answer

The deny sequence 20 is blocking all traffic from being policy-routed.

Answer

The next-hop 10.0.0.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 14

Router R2 has the following configuration:
```
interface GigabitEthernet0/2
 ip address 10.2.2.2 255.255.255.0
 ip policy route-map CHECK
!
route-map CHECK permit 10
 match ip address 101
 set interface GigabitEthernet0/3
!
access-list 101 permit tcp any any eq 80
```
What is the effect of this configuration?

Accepted Answer

Incoming TCP packets with destination port 80 on G0/2 are forwarded out G0/3, overriding the routing table.. The route-map matches TCP traffic with destination port 80 (HTTP) and sets the output interface to GigabitEthernet0/3. This is applied inbound on GigabitEthernet0/2.

Answer

Outgoing TCP packets with source port 80 on G0/2 are forwarded out G0/3.

Answer

All TCP traffic is forwarded out G0/3 regardless of port.

Answer

The configuration is invalid because 'set interface' cannot be used with a route-map.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-SET

R1# show route-map PBR-SET
route-map PBR-SET, permit, sequence 10
  Match clauses:
    ip address (access-lists): 160
  Set clauses:
    ip next-hop 192.168.1.2
    ip tos 184
  Policy routing matches: 300 packets, 24000 bytes

R1# show access-lists 160
Extended IP access list 160
    10 permit ip 10.0.0.0 0.255.255.255 any

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.0.0.1/24

Based on this output, a packet from source 10.0.0.5 to destination 8.8.8.8 arrives on GigabitEthernet0/0. What is the most likely behavior?

Accepted Answer

The packet is forwarded to 192.168.1.2 with the ToS field set to 184.. The packet matches ACL 160 (source 10.0.0.0/8). The route map sets both next-hop and ToS. The next-hop 192.168.1.2 must be reachable for PBR to apply. Assuming it is reachable (not shown but implied by matches), the packet will be forwarded to 192.168.1.2 with ToS set to 184 (which is 0xB8, or IP precedence 5, DSCP 46).

Answer

The packet is forwarded using the routing table because the next-hop is not specified correctly.

Answer

The packet is dropped because the ToS value is invalid.

Answer

The packet is forwarded to 192.168.1.2 but the ToS is not changed.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TRACK

R1# show route-map PBR-TRACK
route-map PBR-TRACK, permit, sequence 10
  Match clauses:
    ip address (access-lists): 170
  Set clauses:
    ip next-hop verify-availability 10.0.0.2 10 track 2
  Policy routing matches: 100 packets, 8000 bytes

R1# show track 2
Track 2
  IP SLA 2 reachability
  Reachability is Up
    2 changes, last change 00:01:30
  Latest operation return code: ok
  Tracked by:
    ROUTE-MAP 0

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely behavior for packets matching ACL 170?

Accepted Answer

Packets are forwarded to 10.0.0.2.. The route map uses 'ip next-hop verify-availability' with track 2. Track 2 is Up (IP SLA 2 reachability is ok). Therefore, the next-hop 10.0.0.2 is considered available, and packets matching ACL 170 are forwarded to 10.0.0.2.

Answer

Packets are forwarded using the routing table because the next-hop is not reachable.

Answer

Packets are dropped because the track object is not configured correctly.

Answer

Packets are load-balanced between the next-hop and the routing table.

Question 17

Router R4 has the following configuration:
```
interface GigabitEthernet0/5
 ip address 10.4.4.4 255.255.255.0
 ip policy route-map PBR-DEFAULT
!
route-map PBR-DEFAULT permit 10
 set ip default next-hop 192.168.3.1
```
What is the effect of this configuration?

Accepted Answer

All packets received on G0/5 are forwarded to 192.168.3.1 if they do not have a route in the routing table.. The 'set ip default next-hop' command is used for packets that do not match any explicit route in the routing table. It does not affect packets that have a matching route.

Answer

All packets received on G0/5 are forwarded to 192.168.3.1 regardless of the routing table.

Answer

The route-map is missing a match statement, so it does nothing.

Answer

The configuration is invalid because 'set ip default next-hop' requires an ACL.

Question 18

What is the default behavior of PBR when a 'set ip next-hop' is configured with an IP address that is not directly connected?

Accepted Answer

The packet is dropped.. By default, PBR requires the next-hop to be directly connected. If it is not directly connected, the packet is dropped unless 'set ip next-hop verify-availability' is used or the next-hop is reachable via a recursive lookup (which requires additional configuration).

Answer

The router performs a recursive lookup to find the next-hop.

Answer

The packet is forwarded using the routing table.

Answer

The router sends an ICMP redirect.

Question 19

Router R1 has the following configuration:
```
interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT
!
route-map PBR-OUT permit 10
 match ip address 100
 set ip next-hop 192.168.1.1
!
access-list 100 permit ip host 10.1.1.100 any
```
What is the effect of this configuration?

Accepted Answer

Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.. The route-map is applied as an inbound policy on the interface, but the name 'PBR-OUT' suggests outbound, which is misleading. However, the 'ip policy route-map' command applies to incoming packets on that interface. The ACL matches source 10.1.1.100 to any destination, and sets next-hop 192.168.1.1.

Answer

Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.

Answer

All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.

Answer

The configuration is invalid because the ACL must match destination, not source.

Question 20

A DMVPN network uses PBR to route traffic from spoke routers to specific hubs based on source IP. After a hub failure, traffic from spoke 1 (source 192.168.1.0/24) is being sent to a backup hub, but the backup hub drops the traffic. Router R1 (spoke) shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to next-hop 10.1.1.2 (backup hub). Router R2 (backup hub) shows: 'show ip route 192.168.1.0' returns no route. What is the root cause?

Accepted Answer

The backup hub does not have a route to the source subnet, causing it to drop traffic. Add a static route or enable routing protocol on the backup hub for the spoke subnet.. PBR on the spoke forwards traffic to the backup hub, but the backup hub does not have a route back to the source subnet (192.168.1.0/24). This causes asymmetric routing, where the backup hub drops the traffic because it cannot find a return route. The solution is to ensure the backup hub has a route to the spoke subnet, either via dynamic routing or a static route.

Answer

The PBR route-map on the spoke is missing a 'set ip next-hop verify-availability' command, causing it to use the backup hub even when it is not fully reachable.

Answer

The spoke's routing table has a better route to the destination via the backup hub, overriding PBR.

Answer

The backup hub has a route to the source subnet but with a higher administrative distance, causing it to be ignored.