300-410 Practice Exam 64 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 3 detail
Session 3
---------
Type                   : ERSPAN Source Session
Source Ports           : 
    Both               : Gi0/0
Destination IP         : 10.1.1.1
ERSPAN ID              : 100

What does this output indicate?

Accepted Answer

The session is correctly configured as an ERSPAN source session.. The output shows a valid ERSPAN source session configuration: it specifies a source port (Gi0/0), a destination IP (10.1.1.1), and an ERSPAN ID (100). ERSPAN encapsulates mirrored traffic in GRE and sends it to a destination IP address, so the presence of a destination IP is correct and expected. The session type is explicitly 'ERSPAN Source Session', confirming the intended role. No misconfiguration is evident from the displayed parameters.

Answer

The session is misconfigured because the destination must be a VLAN, not an IP.

Answer

The session is misconfigured because the source port must be a VLAN.

Answer

The session is misconfigured because the ERSPAN ID must match on both source and destination.

Question 2

When redistributing OSPF into EIGRP, which EIGRP metric components are used to calculate the default metric?

Accepted Answer

No default metric is assigned; redistribution fails unless a metric is configured.. When redistributing OSPF into EIGRP, no default metric is assigned; redistribution fails unless a metric is explicitly configured. EIGRP requires five metric components (bandwidth, delay, reliability, load, MTU) to calculate its composite metric, and there is no automatic conversion from OSPF cost. Therefore, the administrator must specify a seed metric using the 'default-metric' command or per-redistribution metric.

Answer

Bandwidth and delay only

Answer

Bandwidth, delay, reliability, load, and MTU

Answer

The OSPF cost is converted to an EIGRP metric using a default formula.

Question 3

Given this partial configuration on router R6:

router bgp 65000
 neighbor 192.168.1.1 remote-as 65001
 address-family ipv4
  network 172.16.0.0 mask 255.255.0.0
  aggregate-address 172.16.0.0 255.255.0.0

What is missing if the administrator wants to ensure that only the aggregate route is advertised to neighbor 192.168.1.1?

Accepted Answer

The 'summary-only' keyword is missing from the aggregate-address command.. The 'aggregate-address' command without the 'summary-only' keyword advertises both the aggregate and the more-specific routes. To advertise only the aggregate, the 'summary-only' keyword must be added. The network statement is needed to inject the component route into BGP.

Answer

The 'network' command should be removed.

Answer

The 'synchronization' command must be enabled.

Answer

The 'neighbor 192.168.1.1 route-map' command is needed.

Question 4

Drag and drop the steps to verify and validate the operational state of an IPsec site-to-site VPN into the correct order, from first to last.

Accepted Answer

Check IKEv2 SA using show crypto ikev2 sa. Begin by checking the IKE Phase 1 SA to ensure the control plane is established, then verify the IPsec Phase 2 SA for data-plane encryption. Confirm the tunnel interface is up/up, examine the crypto map to ensure it is active, and finally test traffic flow with a ping or extended ping.

Question 5

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Session_Reset

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:02:00 UTC Mar 1  syslog              BGP_Session_Reset
2    00:02:05 UTC Mar 1  syslog              BGP_Session_Reset
3    00:02:10 UTC Mar 1  syslog              BGP_Session_Reset

Based on this output, which statement is correct?

Accepted Answer

The BGP session reset event has occurred three times.. The 'show event manager history events' output lists three syslog events with the name BGP_Session_Reset, indicating that the EEM policy has triggered three times. Each entry corresponds to an event occurrence, so the BGP session reset event has occurred three times. This is a direct interpretation of the event history output.

Answer

The EEM policy is not triggering any events.

Answer

The BGP session is stable.

Answer

The EEM policy is disabled.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail Gi0/0
EIGRP-IPv4 Interfaces for AS(100)
Interface: GigabitEthernet0/0
  Peers: 1
  Xmit Queue Un/Reliable: 0/0
  Mean SRTT: 12
  Pacing Time Un/Reliable: 0/10
  Multicast Flow Timer: 50
  Pending Routes: 0
  Hello interval: 5
  Hold time: 15
  Split horizon: Enabled
  Next multicast: 0.0.0.0
  Next broadcast: 0.0.0.0

Based on this output, what is the problem?

Accepted Answer

Split horizon is enabled, which is a normal and expected configuration.. Split horizon is a default and expected behavior in EIGRP for most interface types, including GigabitEthernet. The output shows 'Split horizon: Enabled', which is normal and prevents routing loops by ensuring that routing information learned on an interface is not advertised back out of that same interface. There is no problem indicated by this setting.

Answer

Split horizon is disabled, which could cause routing loops.

Answer

The hold time of 15 seconds is too short and may cause instability.

Answer

The interface has no peers, indicating a problem.

Question 7

In an extended IPv4 ACL, what is the default action if only a source and destination are specified without a protocol?

Accepted Answer

The command is rejected by the IOS parser.. In an extended IPv4 ACL, the protocol keyword is mandatory. If you omit it, the IOS parser rejects the command because it cannot determine which protocol to filter. The correct syntax requires a protocol (e.g., ip, tcp, udp) after the permit or deny keyword; without it, the parser returns an error.

Answer

The ACL matches all IP traffic.

Answer

The ACL matches only TCP traffic.

Answer

The ACL matches only UDP traffic.

Question 8

Given the partial configuration:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
!
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of the 'crypto isakmp key' command with address 0.0.0.0 0.0.0.0?

Accepted Answer

The key will be accepted from any peer, creating a security vulnerability.. The `crypto isakmp key` command with address `0.0.0.0 0.0.0.0` acts as a wildcard, meaning the pre-shared key will be accepted from any peer IP address during IKE Phase 1 authentication. This effectively disables peer-specific validation, allowing any device that knows the key to establish an ISAKMP SA, which is a significant security vulnerability.

Answer

The key will be used only for peer 192.168.1.2 because the crypto map specifies that peer.

Answer

The configuration will fail because the key must specify a specific peer address.

Answer

The key will be ignored because there is no ISAKMP policy with a lifetime.

Question 9

R1 and R2 have an IPsec VPN tunnel between their physical interfaces. They are running BGP over the tunnel interface. R1's show ip bgp summary shows the BGP session with R2 as established, but R1's show ip bgp shows no routes from R2. R2's show ip bgp shows routes from R1. What is the root cause?

Accepted Answer

R1 has a route-map applied to the BGP neighbor inbound that denies all routes.. R1's BGP session is established (TCP port 179 is up), but no routes are received from R2. This indicates that an inbound route-map on R1 is filtering all incoming BGP updates. The route-map is applied to the neighbor inbound direction, which matches the symptom: R1 sees the session as established but has zero routes from R2, while R2 sees routes from R1 (since outbound filtering on R2 is not the issue).

Answer

BGP next-hop-self is missing on R2.

Answer

The IPsec tunnel is not encrypting BGP traffic.

Answer

R2 is not advertising any networks.

Question 10

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto isakmp

*Mar  1 00:01:23.456: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (N) NEW SA
*Mar  1 00:01:23.457: ISAKMP: Created a peer struct for 192.168.1.2, peer port 500
*Mar  1 00:01:23.457: ISAKMP: New peer created peer = 0x12345678 peer_handle = 0x80000001
*Mar  1 00:01:23.457: ISAKMP: Locking peer struct 0x12345678, refcount 1 for crypto_isakmp_process_block
*Mar  1 00:01:23.457: ISAKMP (0:0): SA request profile is (default)
*Mar  1 00:01:23.457: ISAKMP: local port 500, remote port 500
*Mar  1 00:01:23.458: ISAKMP (0:0): found peer pre-shared-key matching 192.168.1.2
*Mar  1 00:01:23.458: ISAKMP (0:0): constructed NAT-T vendor ID
*Mar  1 00:01:23.458: ISAKMP (0:0): sending packet to 192.168.1.2 my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar  1 00:01:23.458: ISAKMP (0:0): received packet from 192.168.1.2 dport 500 sport 500 Global (I) MM_NO_STATE
*Mar  1 00:01:23.459: ISAKMP (0:0): processing SA payload. message ID = 0
*Mar  1 00:01:23.459: ISAKMP (0:0): Checking ISAKMP transform 1 against priority 1 policy
*Mar  1 00:01:23.459: ISAKMP:      encryption DES-CBC
*Mar  1 00:01:23.459: ISAKMP:      hash SHA
*Mar  1 00:01:23.459: ISAKMP:      default group 2
*Mar  1 00:01:23.459: ISAKMP:      auth pre-share
*Mar  1 00:01:23.459: ISAKMP (0:0): atts are not acceptable. Next transforms are not acceptable
*Mar  1 00:01:23.460: ISAKMP (0:0): no offers accepted!

What does this output indicate?

Accepted Answer

The ISAKMP transform set proposal is rejected due to a mismatch in encryption, hash, or DH group between peers.. The debug output shows that the router received an ISAKMP proposal from the peer (192.168.1.2) and checked it against its own configured policy. The line 'atts are not acceptable' followed by 'no offers accepted' indicates that the transform set attributes (encryption DES-CBC, hash SHA, DH group 2) did not match any of the router's ISAKMP policies. This is a classic proposal mismatch, preventing the ISAKMP SA from being established.

Answer

The ISAKMP SA is established successfully using pre-shared key authentication.

Answer

The router is receiving the packet from an incorrect source IP address.

Answer

The router is unable to find a pre-shared key for the peer.

Question 11

Given this configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What will happen when traffic from 10.1.1.0/24 to 10.2.2.0/24 is generated?

Accepted Answer

The traffic will be forwarded normally without encryption.. The crypto map is not applied to any interface. Without the `crypto map CMAP` command under GigabitEthernet0/1, the router has no IPsec policy to enforce on that interface. Traffic matching access-list 101 will simply be forwarded normally as clear-text IP packets, since no encryption is triggered.

Answer

The traffic will be dropped because the ACL denies it.

Answer

The router will attempt to establish an IPsec tunnel but fail because the crypto map is missing.

Answer

The router will create a dynamic crypto map entry automatically.

Question 12

An engineer configures mutual redistribution between OSPF and EIGRP on a router that is part of an IPsec site-to-site VPN. After the configuration, routing loops occur intermittently. The engineer has not used any route tagging. What is the most likely cause of the routing loops?

Accepted Answer

Routes redistributed from OSPF into EIGRP are re-distributed back into OSPF because there is no route tagging to identify them as OSPF-originated.. Without route tagging, routes redistributed from OSPF into EIGRP are not marked as OSPF-originated. When EIGRP redistributes these routes back into OSPF, OSPF accepts them as external routes, creating a mutual redistribution loop. This occurs because OSPF has no mechanism to distinguish between its own routes and those learned from EIGRP without explicit tagging (e.g., using a route-map with a tag).

Answer

The seed metric for EIGRP redistribution is set to a low value, causing EIGRP routes to be preferred over OSPF routes.

Answer

The IPsec tunnel is using transport mode, which causes routing protocol packets to be dropped.

Answer

The OSPF process has a higher administrative distance than EIGRP, causing route flapping.

Question 13

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

Accepted Answer

The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.. The debug output shows that the IPsec SA request is generated, but the transform proposal (esp-3des esp-sha-hmac) is rejected with 'not supported for proxy'. This indicates that the remote peer does not support or is configured with a different transform set, causing the proposal to fail validation. The SA is created with placeholder SPIs (0x1234, 0x5678) but no actual inbound/outbound SPI, confirming negotiation failure due to transform set mismatch.

Answer

The IPsec SA is established successfully with ESP 3DES and SHA.

Answer

The ACL for the crypto map is misconfigured, causing the traffic to not match.

Answer

The IKE phase 1 SA is not established before IPsec negotiation.

Question 14

In Cisco IOS, what is the default encryption algorithm for IKEv1 phase 1 if not specified in the ISAKMP policy?

Accepted Answer

DES. In Cisco IOS, when an IKEv1 ISAKMP policy is configured without specifying an encryption algorithm, the default encryption algorithm is DES (Data Encryption Standard). This is because Cisco IOS defaults to DES for IKEv1 phase 1 if no encryption is explicitly defined in the ISAKMP policy, as per the default policy parameters. DES uses a 56-bit key and is considered weak by modern standards, but it remains the default for backward compatibility.

Answer

AES 256

Answer

3DES

Answer

AES 128

Question 15

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto map

Crypto Map "CMAP" 10 ipsec-isakmp
    Peer = 192.168.2.2
    Extended IP access list 101
        access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    Current peer: 192.168.2.2
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={myset, }
    Interfaces using crypto map CMAP:
        Tunnel0

What does this output indicate?

Accepted Answer

The crypto map is correctly configured for a site-to-site VPN with the peer 192.168.2.2.. The output shows a properly configured IPsec site-to-site VPN crypto map. It includes a peer (192.168.2.2), an extended ACL (101) that correctly matches the local and remote subnets (192.168.1.0/24 and 192.168.2.0/24), a transform set (myset), and is applied to Tunnel0, which is typical for a site-to-site VPN. The security association lifetime and PFS settings are also present, confirming a valid configuration.

Answer

The crypto map is misconfigured because it uses an extended ACL with source and destination subnets.

Answer

The crypto map is missing the transform set.

Answer

The crypto map should be applied to the physical interface instead of the tunnel.

Question 16

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto engine connections active

Crypto Engine Connections

ID  Type    Algorithm           Encrypt  Decrypt LastSeqNo
    1  IPsec   ESP-3DES+SHA           0        0         0
    2  IPsec   ESP-3DES+SHA           0        0         0
    3  IPsec   ESP-AES+SHA            0        0         0

What does this output indicate?

Accepted Answer

The IPsec SAs are established but no traffic is flowing, possibly due to routing or ACL issues.. The output shows three IPsec Security Associations (SAs) with zero encrypted and zero decrypted packets, and a LastSeqNo of 0. This indicates the SAs are established (the tunnels are up) but no traffic is being processed through them. The most common causes are routing issues preventing traffic from reaching the tunnel interface, or ACLs that do not match the interesting traffic for encryption.

Answer

The IPsec VPN is actively encrypting and decrypting traffic.

Answer

The crypto engine is overloaded and cannot process packets.

Answer

The IPsec SAs are using the wrong transform set.

Question 17

Examine the following partial configuration on Router R1:
```
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel destination 2001:DB8:2::2
 tunnel mode ipv6ip
```
What is the effect of this configuration?

Accepted Answer

The tunnel will not come up because the tunnel destination is an IPv6 address instead of an IPv4 address.. The tunnel mode ipv6ip requires an IPv4 address as the tunnel destination because it encapsulates IPv6 packets inside IPv4 packets for transport over an IPv4 network. In this configuration, the tunnel destination is set to an IPv6 address (2001:DB8:2::2), which is invalid for this tunnel mode, preventing the tunnel interface from coming up.

Answer

The tunnel will successfully encapsulate IPv6 packets in IPv4 and forward them.

Answer

The tunnel will use IPv6 as the transport protocol, encapsulating IPv4 packets.

Answer

The configuration is correct for a 6to4 tunnel.

Question 18

A network engineer runs the following command on Router R1:

R1# show ipv6 bgp summary

BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
5 network entries using 720 bytes of memory
5 path entries using 400 bytes of memory
3/2 BGP path/bestpath attribute entries using 456 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1600 total bytes of memory
BGP activity 10/5 prefixes, 10/5 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
2001:DB8::2     4        65002   100     99       10    0    0 00:45:12        3

Based on this output, which statement is correct?

Accepted Answer

BGP is peering over IPv6 and 3 prefixes are learned from the neighbor.. The output shows that the neighbor 2001:DB8::2 (IPv6 address) is in state '3' under 'State/PfxRcd', which indicates the BGP session is established and 3 IPv6 prefixes have been received from that neighbor. The 'Up/Down' time of 00:45:12 confirms the session is active, and the 'MsgRcvd/MsgSent' counters show bidirectional communication. Therefore, BGP is peering over IPv6 and has learned 3 prefixes from the neighbor, making option C correct.

Answer

BGP is not configured for IPv6.

Answer

The BGP session is down.

Answer

The router is in AS 65002.

Question 19

Which statement correctly describes the behavior of ISATAP tunneling regarding host configuration?

Accepted Answer

ISATAP embeds the IPv4 address into the interface identifier (last 64 bits) of the IPv6 address.. ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) automatically generates the IPv6 address by embedding the host's IPv4 address into the interface identifier (the last 64 bits of the IPv6 address). This allows hosts to obtain a complete IPv6 address without manual configuration of the full 128-bit address, as the IPv4 address is used to form the unique interface ID. Option C correctly describes this behavior.

Answer

ISATAP requires manual configuration of the entire IPv6 address on each host.

Answer

ISATAP uses the prefix 2002::/16 for global addresses.

Answer

ISATAP is only used for site-to-site tunnels.

Question 20

Review this configuration:

route-map RMAP permit 10
 match ipv6 address prefix-list PREFIX
 set interface null0
!
ipv6 prefix-list PREFIX seq 5 permit 2001:db8:5::/48
!
interface GigabitEthernet0/6
 ipv6 verify unicast source reachable-via any allow-default

What is the purpose of the 'allow-default' keyword?

Accepted Answer

It allows uRPF to use the default route as a valid path for source reachability.. The 'allow-default' keyword in the 'ipv6 verify unicast source reachable-via any' command modifies Unicast Reverse Path Forwarding (uRPF) behavior. By default, uRPF checks the FIB for a matching route to the source address, but it excludes the default route. Adding 'allow-default' permits uRPF to consider the default route (::/0) as a valid path for source reachability, ensuring that traffic with source addresses that only match the default route is not dropped.

Answer

It allows the router to accept packets with source addresses from the default prefix.

Answer

It disables uRPF for packets matching the default route.

Answer

It is used to allow multicast traffic through uRPF.