300-410 Practice Exam 63 — 20 Questions

Question 1

An engineer is troubleshooting a DHCPv6 prefix delegation scenario. The router (R1) is a DHCPv6 client on its WAN interface and is supposed to receive a /48 prefix from the ISP's DHCPv6 server to delegate to LAN interfaces. The WAN interface is configured with 'ipv6 address dhcp' and 'ipv6 dhcp client pd ISP-PREFIX'. The LAN interfaces have 'ipv6 address ISP-PREFIX 0:0:0:1::/64 eui-64'. The engineer sees that the WAN interface gets a global IPv6 address, but the LAN interfaces do not get any IPv6 address. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ISP's DHCPv6 server is not configured to delegate a prefix.. The WAN interface successfully obtains a global IPv6 address via DHCPv6, but the LAN interfaces lack IPv6 addresses because the DHCPv6 client process on R1 has not received a delegated prefix. The 'ipv6 dhcp client pd ISP-PREFIX' command requests a prefix delegation from the ISP's DHCPv6 server; if the server is not configured to delegate prefixes (e.g., missing the 'prefix-delegation' pool or 'ipv6 dhcp server' with prefix assignment), the client never receives a prefix to assign to LAN interfaces. This is the most likely cause given the symptom.

Answer

The LAN interfaces are missing the 'ipv6 enable' command.

Answer

The 'ipv6 dhcp client pd' command should be 'ipv6 dhcp client pd ISP-PREFIX hint ::/48'.

Answer

The WAN interface needs the 'ipv6 nd other-config-flag' command.

Question 2

According to RFC 5424, which syslog severity level corresponds to 'Critical' conditions?

Accepted Answer

Severity 2. RFC 5424 defines eight syslog severity levels numbered 0 through 7. Severity 2 is explicitly named 'Critical', indicating critical conditions such as hard device errors. This sits between Emergency (0) and Alert (1) on the more severe end, and Error (3) on the less severe end.

Answer

Severity 0

Answer

Severity 1

Answer

Severity 3

Question 3

A network engineer runs the following command to troubleshoot IPv6 source guard:

R1# debug ipv6 source-guard

*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, IPv6 packet from 2001:db8::5, src MAC 0011.2233.4455, dst 2001:db8::1
*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Binding lookup: 2001:db8::5 not found in binding table
*Mar  1 00:04:56.789: IPv6-Source-Guard: R1, Fa0/0, Packet dropped: source 2001:db8::5 not allowed

What does this output indicate?

Accepted Answer

IPv6 source guard is dropping packets from sources not in the binding table, preventing spoofing.. The debug output shows that IPv6 source guard is actively dropping a packet from source address 2001:db8::5 because that address is not found in the binding table. This is the core function of IPv6 source guard: it filters traffic based on the source IPv6 address and MAC address, using the binding table (populated by DHCPv6 snooping or ND snooping) to prevent spoofing attacks. The packet is dropped because the source address is not allowed, confirming that option A is correct.

Answer

IPv6 source guard is allowing the packet because the source MAC matches.

Answer

IPv6 source guard is not configured; the debug output is from default IPv6 forwarding.

Answer

IPv6 source guard is learning the binding from the packet and will allow future packets.

Question 4

Consider the following partial configuration on router R1:
```
interface GigabitEthernet0/1
 ip access-group MY_ACL in
!
ip access-list extended MY_ACL
 permit tcp 10.1.1.0 0.0.0.255 any eq 80
 permit icmp any any echo
 deny   ip any any
```
What is the effect of this ACL when applied inbound on GigabitEthernet0/1?

Accepted Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source; all other IP traffic is denied.. The ACL is applied inbound on GigabitEthernet0/1. The first permit statement allows TCP traffic from source network 10.1.1.0/24 to any destination on port 80 (HTTP). The second permit statement allows ICMP Echo requests (type 8) from any source. The final deny statement blocks all other IP traffic. Therefore, only HTTP requests from 10.1.1.0/24 and ICMP Echo requests from any source are permitted; all other IP traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and all ICMP traffic; all other IP traffic is denied.

Answer

It permits HTTP requests from any source to 10.1.1.0/24 and ICMP Echo requests; all other traffic is denied.

Answer

It permits HTTP requests from 10.1.1.0/24 and ICMP Echo replies; all other IP traffic is denied.

Question 5

Which statement correctly describes the behavior of the 'subnets' keyword when redistributing into OSPF?

Accepted Answer

It allows OSPF to redistribute subnetted routes in addition to classful networks.. The 'subnets' keyword in OSPF redistribution (e.g., 'redistribute connected subnets') instructs OSPF to include subnetted routes in the redistribution process. Without it, OSPF only redistributes classful network routes (major networks) and ignores any routes with a subnet mask longer than the classful default. This is a Cisco-specific behavior that ensures more specific routes are advertised into OSPF.

Answer

It causes OSPF to redistribute only classful network routes.

Answer

It changes the metric of redistributed routes to the interface cost.

Answer

It is required only when redistributing BGP routes into OSPF.

Question 6

In the context of NAT and PAT, what is the purpose of the ip nat translation timeout command?

Accepted Answer

It configures the timeout for all dynamic NAT translations globally.. The `ip nat translation timeout` command sets the global idle timeout for all dynamic NAT translations, including both TCP and UDP. When a dynamic translation is no longer active, this timer determines how long the NAT entry remains in the table before being removed, freeing resources. Static NAT entries are not affected by this command because they are manually configured and persist indefinitely unless explicitly removed.

Answer

It sets the timeout for static NAT entries.

Answer

It sets the timeout only for TCP translations.

Answer

It configures the timeout for translations on a specific interface.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          203.0.113.5        203.0.113.5
--- 192.0.2.11         10.0.0.11          203.0.113.5        203.0.113.5

R1# show ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 20  Misses: 0
CEF Translated packets: 20, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 2
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 2

Based on this output, which statement is correct?

Accepted Answer

NAT is configured without PAT; each inside host uses a unique global address.. The output shows two dynamic NAT translations, each with a unique inside global address (192.0.2.10 and 192.0.2.11) mapped to different inside local addresses (10.0.0.10 and 10.0.0.11). The absence of any port numbers in the 'Pro' column indicates that Port Address Translation (PAT) is not used; instead, each inside host receives a one-to-one mapping to a unique public IP from the pool. This confirms standard dynamic NAT without PAT.

Answer

PAT is enabled, but only two translations are active.

Answer

The pool is exhausted because two addresses are used.

Answer

Static NAT is configured for both hosts.

Question 8

Which BGP attribute is used as the first tie-breaker when selecting the best path in a VRF-Lite environment?

Accepted Answer

Weight. In Cisco IOS BGP best-path selection, weight is the first attribute evaluated, and it is locally significant to the router. A higher weight is preferred. This applies in VRF-Lite environments as well because weight is a per-router, per-neighbor attribute evaluated before local preference, AS path, and MED. Therefore weight is the first tie-breaker.

Answer

Local preference

Answer

AS path length

Answer

MED

Question 9

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# debug ip sla monitor trace

IP SLAs Monitor trace debugging is on

*Mar  1 12:34:56.789: IP SLAs Monitor: Starting operation 10
*Mar  1 12:34:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs Monitor: RTT = 12 ms
*Mar  1 12:34:56.790: IP SLAs Monitor: Operation 10 completed successfully
*Mar  1 12:35:56.789: IP SLAs Monitor: Starting operation 10
*Mar  1 12:35:56.789: IP SLAs Monitor: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs Monitor: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs Monitor: RTT = 14 ms
*Mar  1 12:35:56.790: IP SLAs Monitor: Operation 10 completed successfully

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is successfully sending and receiving ICMP echo probes.. The debug output shows IP SLA operation 10 successfully sending ICMP echo requests to 192.168.1.1 and receiving echo replies, with round-trip times of 12 ms and 14 ms, and each operation completing successfully. This confirms the IP SLA probe is functioning correctly and the target is reachable. The slight RTT variation between probes is normal jitter, not a failure condition.

Answer

The IP SLA monitor operation is failing because the RTT values are increasing.

Answer

The IP SLA monitor operation is not configured because no configuration is shown.

Answer

The IP SLA monitor operation is timing out because no reply is received.

Question 10

Which NetFlow version is the default export format when using Flexible NetFlow with the 'record netflow ipv4 original-input' command?

Accepted Answer

NetFlow version 9. Flexible NetFlow's 'record netflow ipv4 original-input' uses the predefined 'netflow ipv4 original-input' record, which exports in NetFlow version 9 format by default on Cisco IOS/IOS-XE platforms. Version 9 is template-based and is the native export for Flexible NetFlow; IPFIX must be explicitly configured with 'export-protocol ipfix'.

Answer

NetFlow version 5

Answer

IPFIX (NetFlow version 10)

Answer

NetFlow version 1

Question 11

A network engineer runs the following command on Router R1:

R1# show snmp trap

SNMP Trap: enabled

Trap receiver: 192.168.1.100
    Community: PUBLIC
    Version: 2c
    UDP port: 162
    Enable traps: snmp, interface, bgp

Trap receiver: 192.168.1.200
    Community: PRIVATE
    Version: 2c
    UDP port: 162
    Enable traps: snmp, ospf

Based on this output, which statement is correct?

Accepted Answer

BGP traps will be sent to 192.168.1.100 but not to 192.168.1.200.. The output shows that traps are configured per receiver. The first receiver (192.168.1.100) has 'Enable traps: snmp, interface, bgp', while the second receiver (192.168.1.200) has 'Enable traps: snmp, ospf'. Since BGP is not listed for the second receiver, BGP traps will only be sent to 192.168.1.100, making option A correct.

Answer

Both receivers will receive OSPF traps.

Answer

The traps are sent using SNMPv3.

Answer

Interface traps are sent to 192.168.1.200.

Question 12

A network engineer configures BGP synchronization on an iBGP router. The IGP (OSPF) does not carry the BGP routes. Unexpectedly, the router does not advertise these iBGP routes to eBGP neighbors. What is the most likely explanation?

Accepted Answer

The router has 'bgp synchronization' enabled, and the iBGP route is not in the OSPF routing table, so it is not considered valid for advertisement.. BGP synchronization requires that a route learned via iBGP must also be present in the IGP (OSPF) routing table before it can be advertised to eBGP neighbors. If OSPF does not carry the BGP routes, the iBGP route is not synchronized and is therefore not considered valid for advertisement to eBGP peers. This is the classic behaviour of the synchronization rule.

Answer

The router has 'bgp bestpath as-path multipath-relax' configured, which suppresses eBGP advertisements for iBGP routes.

Answer

The iBGP session is not using 'next-hop-self', so the next hop is unreachable.

Answer

The router has 'bgp suppress-duplicates' enabled, which drops identical routes.

Question 13

Which MPLS label is used for the Router Alert function, and what is its purpose?

Accepted Answer

Label 1; used to alert the router to examine the packet in the control plane.. MPLS label 1 is reserved for the Router Alert Label. When a packet carries this label, it indicates that the router should examine the packet in the control plane, typically for protocols like RSVP-TE or LDP that require hop-by-hop processing. This is defined in RFC 3032.

Answer

Label 0; used to alert the router to examine the packet.

Answer

Label 2; used to alert the router to examine the packet.

Answer

Label 3; used to alert the router to examine the packet.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.5.5.0/24
BGP routing table entry for 10.5.5.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65007
    10.1.17.7 from 10.1.17.7 (10.7.7.7)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what does the 'r' in the status codes indicate if present? (Not shown here, but the engineer notices a similar route with 'r' status.)

Accepted Answer

The route is a RIB-failure, meaning it is not installed in the routing table because another route with a lower administrative distance exists.. In Cisco BGP show output, the status code 'r' stands for RIB-failure, meaning the route was selected as best by BGP but was not installed in the IP routing table because another route (typically with a lower administrative distance, such as a static or IGP route) already occupies that prefix. The BGP route remains in the BGP table and is still advertised to peers, but it is not used for forwarding. This is a common troubleshooting scenario when a static route shadows a BGP-learned prefix.

Answer

The route is suppressed by a route-map.

Answer

The route is not valid due to next-hop unreachability.

Answer

The route is dampened.

Question 15

Which TWO statements about the 'show policy-map control-plane' command output are true? (Choose TWO.)

Accepted Answer

The output displays the number of packets that matched each class in the CoPP policy.. The 'show policy-map control-plane' command output displays per-class packet statistics, including the number of packets that matched each class in the Control Plane Policing (CoPP) policy. This allows administrators to verify which traffic types are being classified and how much traffic is hitting the control plane.

Answer

The output shows the routing table entries that are affected by the CoPP policy.

Answer

The output displays the CoPP policy applied to each physical interface.

Answer

The output includes the ARP cache entries that are protected by CoPP.

Question 16

Router R6 has the following DHCPv6 configuration:

ipv6 dhcp pool DHCP6_POOL3
 address prefix 2001:db8:3::/64 lifetime 3600 600
 dns-server 2001:db8::1
!
interface GigabitEthernet0/2
 ipv6 address 2001:db8:3::1/64
 ipv6 dhcp server DHCP6_POOL3
 ipv6 nd managed-config-flag
 no shutdown

What is the effect of the lifetime parameters 3600 and 600?

Accepted Answer

The preferred lifetime is 3600 seconds and the valid lifetime is 600 seconds, which is invalid because the valid lifetime must be greater than or equal to the preferred lifetime.. In the `ipv6 dhcp pool` configuration, the `lifetime` command specifies the preferred lifetime first (3600 seconds) and the valid lifetime second (600 seconds). According to RFC 4862, the valid lifetime must be greater than or equal to the preferred lifetime; otherwise, the configuration is invalid and will be rejected by the router. This mismatch causes the DHCPv6 pool to fail to apply the prefix.

Answer

The preferred lifetime is 600 seconds and the valid lifetime is 3600 seconds, which is a typical configuration.

Answer

The lifetimes are applied to the DNS server address, not the address prefix.

Answer

The configuration is valid and will work as expected.

Question 17

In an MPLS L3VPN environment, what is the default maximum number of routes that can be installed from a single BGP peer?

Accepted Answer

Unlimited. By default, Cisco IOS/IOS-XE does not impose a maximum prefix limit on routes received from a BGP peer — the default is unlimited. A limit is only enforced if the administrator explicitly configures 'neighbor x.x.x.x maximum-prefix <n>'. Therefore, absent any configuration, the peer can install an unlimited number of routes.

Answer

1000

Answer

10000

Answer

5000

Question 18

A network engineer runs the following command to troubleshoot IPsec on a DMVPN tunnel:

R1# debug crypto isakmp

ISAKMP: received peer 192.168.1.2, port 500, local 192.168.1.1
ISAKMP: SA created, initiating IKE Main Mode
ISAKMP: sent MM_SA proposal to 192.168.1.2
ISAKMP: received MM_SA response from 192.168.1.2
ISAKMP: Main Mode complete, starting Quick Mode
ISAKMP: sent QM_SA request to 192.168.1.2
ISAKMP: received QM_SA response from 192.168.1.2
ISAKMP: Quick Mode done, IPsec SA established

What does this output indicate?

Accepted Answer

IKE negotiation succeeded and an IPsec SA is now active.. The debug output shows that IKE Main Mode completed successfully, Quick Mode completed, and an IPsec SA was established. This indicates that the IKE negotiation succeeded and the tunnel is active.

Answer

IKE negotiation failed; no IPsec SA was established.

Answer

The peer 192.168.1.2 is not responding to IKE requests.

Answer

IKE is using Aggressive Mode instead of Main Mode.

Question 19

A network engineer runs the following command to troubleshoot BFD with OSPF:

R1# show ip ospf interface gigabitethernet 0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 10.1.1.1
  Backup Designated router (ID) 2.2.2.2, Interface address 10.1.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 25
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)
  BFD enabled, BFD interval 100 msec, BFD multiplier 3

What does this output indicate?

Accepted Answer

OSPF is using BFD with a 100 ms interval and multiplier 3, enabling sub-second failure detection.. The output shows that BFD is enabled on the OSPF interface with an interval of 100 ms and multiplier of 3. This provides fast failure detection for OSPF adjacency.

Answer

BFD is disabled on this OSPF interface.

Answer

BFD interval is set to 10 seconds, matching OSPF hello.

Answer

BFD session is down, causing OSPF to use dead timer.

Question 20

An engineer configures mutual redistribution between OSPF and EIGRP. After a few minutes, the network becomes unstable with routing loops. The engineer checks the routing tables and notices that the same prefix is being learned from both protocols with different administrative distances. Which is the most likely explanation?

Accepted Answer

Routes are redistributed back and forth between OSPF and EIGRP without any filtering or tagging. Mutual redistribution without route filtering or tagging causes routes to be fed from OSPF into EIGRP and then back from EIGRP into OSPF (and vice versa), creating a feedback loop. This results in inconsistent routing information, flapping, and potential loops. The fix is to use route maps with tags or distribute-lists to prevent re-advertisement of routes learned from the other protocol.

Answer

The seed metric for OSPF redistribution into EIGRP is not configured

Answer

The administrative distance of OSPF is lower than EIGRP, causing OSPF routes to be preferred

Answer

The redistribute command is missing the subnets keyword under OSPF