300-410 Practice Exam 64 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot a Network Logging and Syslog issue:

R1# debug ip ospf adj

Output:
OSPF: 2 Way Communication to 10.0.0.2 on GigabitEthernet0/0, state 2WAY
OSPF: Send hello to 224.0.0.5 on GigabitEthernet0/0
OSPF: Rcv DBD from 10.0.0.2 on GigabitEthernet0/0 seq 0x1E opt 0x52 flag 0x7 len 32
OSPF: NBR negotiation done. We are the SLAVE
OSPF: Exchange done with 10.0.0.2 on GigabitEthernet0/0
OSPF: Build router LSA for area 0, router ID 10.0.0.1

What does this output indicate?

Accepted Answer

The router is successfully forming an OSPF adjacency with neighbor 10.0.0.2.. The debug output shows the OSPF adjacency formation process, including the exchange of database descriptors and LSA building. This indicates successful adjacency formation.

Answer

The router is experiencing an OSPF authentication failure.

Answer

The router is stuck in the EXSTART state due to MTU mismatch.

Answer

The router is flooding LSAs to all neighbors.

Question 2

Which THREE commands can be used to verify the current syslog configuration and message flow on a Cisco IOS device? (Choose THREE.)

Accepted Answer

show logging. The 'show logging' command displays the logging configuration, buffer contents, and statistics. The 'debug logging' command is not a verification command; it enables debugging of logging itself. The 'terminal monitor' command allows a user to see syslog messages on their terminal session. The 'show running-config | include logging' filters the running configuration for logging-related lines. The 'show log' command is not valid in Cisco IOS; the correct command is 'show logging'.

Answer

debug logging

Answer

show log

Question 3

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla monitor configuration 10

IP SLAs Monitor, Infrastructure Engine-II.
Entry number: 10
Owner: 
Tag: 
Type of operation to perform: icmp-echo
Target address: 192.168.1.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already occurred
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday): FALSE
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
   Number of history intervals kept: 0
   Number of history buckets kept: 15
   History Statistics:
      Number of history Lives kept: 0

What does this output indicate?

Accepted Answer

The IP SLA monitor operation is configured as an ICMP echo probe with a 60-second frequency and 5-second timeout.. This is the older 'ip sla monitor' configuration output, identical to 'ip sla configuration'. It shows an ICMP echo probe to 192.168.1.1, active status, 60-second frequency, and 5-second timeout.

Answer

The IP SLA monitor operation is configured as a UDP jitter probe to 192.168.1.1.

Answer

The IP SLA monitor operation has a frequency of 5 seconds and a timeout of 60 seconds.

Answer

The IP SLA monitor operation is in a 'Pending' state.

Question 4

Which THREE are valid syslog severity levels defined in RFC 5424? (Choose THREE.)

Accepted Answer

Emergency (0). RFC 5424 defines eight severity levels from 0 to 7. Levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), 4 (Warning), 5 (Notice), 6 (Informational), and 7 (Debug). 'Fatal' is not a standard level; it is sometimes used informally. 'Trace' is not a standard level. 'Severe' is not a standard level.

Answer

Fatal (1)

Answer

Trace (8)

Question 5

Consider the configuration snippet:

logging 192.168.1.10 vrf Mgmt-intf
logging source-interface Vlan1
logging trap 6

What is the effect of the 'logging trap 6' command?

Accepted Answer

Messages of severity 0 through 6 are sent to the syslog server.. The 'logging trap' command accepts either a severity level name or number. Level 6 corresponds to 'informational'. This means messages with severity 0-6 are sent to the syslog server.

Answer

Only messages of severity 6 are sent to the syslog server.

Answer

Messages of severity 6 through 7 are sent to the syslog server.

Answer

The number 6 is invalid; only named levels are accepted.

Question 6

What is the default severity level for syslog messages sent to the console on a Cisco IOS device?

Accepted Answer

Debugging (level 7). By default, the console logging level is 'debugging' (severity 7), meaning all messages from 0 to 7 are displayed on the console. This is a common fact for ENARSI.

Answer

Informational (level 6)

Answer

Warnings (level 4)

Answer

Notifications (level 5)

Question 7

DMVPN spoke-to-spoke tunnel is not forming between two spokes. Hub router R1 has the following relevant configuration: interface Tunnel0 ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 ip nhrp map multicast dynamic ip ospf 1 area 0 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint Spoke R2 shows: show dmvpn Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, NHRP Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.168.1.1 10.0.0.1 UP 00:10:00 D Spoke R3 shows similar, but no spoke-to-spoke tunnel. What is the root cause?

Accepted Answer

Missing ip nhrp redirect on hub and ip nhrp shortcut on spokes.. Spoke-to-spoke tunnel requires NHRP redirect and shortcut route. Without ip nhrp redirect on hub and ip nhrp shortcut on spokes, traffic between spokes goes through hub. OSPF over DMVPN may also need mtu or ipsec issues. The correct fix is to enable NHRP redirect on hub and shortcut on spokes.

Answer

OSPF network type is broadcast; change to point-to-multipoint.

Answer

IPsec is not configured; DMVPN requires encryption.

Answer

The tunnel key is mismatched; configure tunnel key on all routers.

Question 8

A network engineer notices that an SNMPv3 poll from the NMS to router R1 fails with an authentication error. The engineer has configured 'snmp-server group ADMIN v3 priv' and 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456'. The NMS is configured with the same credentials. What is the most likely cause of the failure?

Accepted Answer

The 'priv' keyword in the group definition should be 'auth' instead to match the user's authentication settings.. The SNMP group ADMIN is configured with 'v3 priv', which requires both authentication and encryption. The user admin is correctly configured with authentication and privacy. However, the NMS may be sending only authentication without privacy, which leads to an authentication error because the group expects privacy. The most likely cause is a mismatch between the group's required security level and the NMS's actual request. To resolve this, either the NMS should be configured to use privacy, or the group should be changed to 'v3 auth' to only require authentication. Given the options, changing the group to 'auth' (Option D) would align the group with the NMS's authentication-only behavior, allowing the poll to succeed. Option A is incorrect because the absence of an access-list in the group configuration defaults to permitting all hosts. Option B is incorrect as there is no minimum length requirement beyond 8 characters. Option C is incorrect because the scenario explicitly involves SNMPv3.

Answer

The SNMP group is missing the 'access' ACL that permits the NMS IP address.

Answer

The SNMP user password must be at least 8 characters; 'cisco123' is only 8, but the hash algorithm requires a minimum of 12 characters.

Answer

The NMS is using SNMPv2c, which is incompatible with SNMPv3 configuration.

Question 9

Examine this OSPF configuration snippet on router R3:

router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 default-information originate always

What is the effect of the default-information originate always command?

Accepted Answer

R3 will unconditionally advertise a default route into OSPF as an external LSA type 5.. The command injects a default route (0.0.0.0/0) into the OSPF domain as an external LSA type 5, regardless of whether the router has a default route in its routing table. The 'always' keyword forces advertisement even without a default route.

Answer

R3 will advertise a default route into OSPF only if it has a default route in its routing table.

Answer

R3 will advertise a default route only if it is an ASBR.

Answer

The command is invalid because default-information originate requires a route-map.

Question 10

A network engineer is troubleshooting a BGP peering issue between two directly connected routers, R1 and R2. R1 is configured with 'neighbor 10.1.1.2 remote-as 65002' and 'neighbor 10.1.1.2 update-source Loopback0', while R2 uses 'neighbor 10.1.1.1 remote-as 65001' and 'neighbor 10.1.1.1 update-source Loopback0'. The loopback interfaces are not advertised into any IGP, and there is no static route for the loopback addresses. The BGP session remains in Idle state. What is the most likely cause?

Accepted Answer

The BGP session is stuck in Idle because the neighbor statements reference loopback interfaces that are not reachable.. BGP requires reachability to the neighbor's update-source address. Since the loopback addresses are not reachable via any routing protocol or static route, the TCP connection fails, keeping the session in Idle state.

Answer

The BGP session is stuck in Idle because the remote-as values are mismatched.

Answer

The BGP session is stuck in Idle because the update-source command is not allowed on directly connected interfaces.

Answer

The BGP session is stuck in Idle because the neighbor statements must use the directly connected interface IP addresses.

Question 11

Given the following BGP configuration on router R1:

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 route-map SET-MED out
!
route-map SET-MED permit 10
 match ip address prefix-list LOOPBACKS
 set metric 100
!
route-map SET-MED permit 20
!
ip prefix-list LOOPBACKS permit 192.168.0.0/24

What is the effect of this configuration?

Accepted Answer

All routes are advertised to 10.1.1.2; the 192.168.0.0/24 route has MED 100, others have no MED.. The route-map SET-MED has two sequences. Sequence 10 matches prefix-list LOOPBACKS (192.168.0.0/24) and sets MED to 100. Sequence 20 permits everything else without setting MED, so other routes are advertised with their original MED.

Answer

Only the 192.168.0.0/24 route is advertised to 10.1.1.2, with MED 100.

Answer

All routes are advertised with MED 100 because the route-map is applied outbound.

Answer

Only the 192.168.0.0/24 route is advertised with no MED because the set metric is ignored.

Question 12

An engineer configures syslog logging to a remote server using the 'logging host' command. The engineer notices that syslog messages are not being received on the server, but the router can ping the server successfully. The engineer verifies that the logging level is set to debugging and that the server is configured to receive syslog messages. Which is the most likely explanation?

Accepted Answer

An ACL on the router is blocking UDP port 514 outbound. A common edge case is that the syslog messages are sent via UDP port 514, but the router may have a firewall or ACL that blocks UDP traffic. Additionally, the 'logging source-interface' command might be configured, but if the source interface is not reachable from the server (e.g., due to routing issues), the server may drop the messages. Another possibility is that the server is listening on a different port or the router is using a different port due to configuration. However, a less obvious issue is that the 'logging monitor' or 'logging buffered' commands can interfere if the logging process is overwhelmed, but the most likely is that the syslog messages are being sent but the server's firewall or the router's own ACL is blocking them.

Answer

The logging host command requires the 'transport tcp' option to work

Answer

The syslog server is not configured to accept messages from the router's IP

Answer

The logging level is set to emergencies only

Question 13

Examine this BGP configuration on router R3:

router bgp 65003
 bgp router-id 3.3.3.3
 neighbor 10.3.3.2 remote-as 65002
 neighbor 10.3.3.2 ebgp-multihop 2
 neighbor 10.3.3.2 update-source Loopback0
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255

What is the likely issue with this configuration?

Accepted Answer

The neighbor 10.3.3.2 must be reachable via the loopback address 3.3.3.3; otherwise, the session will not come up.. The ebgp-multihop 2 allows the neighbor to be two hops away, but the update-source is set to Loopback0 (3.3.3.3). The neighbor 10.3.3.2 must be reachable via the loopback. If 10.3.3.2 is not reachable from 3.3.3.3, the session will not establish.

Answer

The ebgp-multihop value should be 1 for directly connected neighbors.

Answer

The remote-as 65002 should be the same as the local AS for eBGP.

Answer

The update-source command is not needed when using ebgp-multihop.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.3.3.0/24
BGP routing table entry for 10.3.3.0/24, version 10
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65003 65004
    10.1.13.3 from 10.1.13.3 (10.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, external
      rx pathid: 0, tx pathid: 0
  Refresh Epoch 1
  65005
    10.1.15.5 from 10.1.15.5 (10.5.5.5)
      Origin IGP, metric 0, localpref 200, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, why is the path via 10.1.15.5 chosen as best?

Accepted Answer

Because it has a higher local preference of 200.. BGP selects the best path based on several criteria. Here, both paths are external, valid, and have the same weight (default 0). The path via 10.1.15.5 has a higher local preference (200 vs 100), which is the first tiebreaker after weight. Therefore, it is chosen as best.

Answer

Because it has a shorter AS path (65005 vs 65003 65004).

Answer

Because it has a lower metric (0 vs 0).

Answer

Because it was learned from a lower neighbor IP address.

Question 15

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Accepted Answer

Modify the EEM applet trigger to match only the specific interfaces of interest.. The EEM applet is too broadly triggered, causing unnecessary syslog messages that may be interpreted as traps. The engineer should narrow the trigger condition to match only specific interfaces or use a more specific event filter.

Answer

Remove the EEM applet entirely.

Answer

Increase the debounce timer on the interface to reduce flapping.

Answer

Disable SNMP traps for interface state changes.

Question 16

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down
2    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Accepted Answer

Two EEM applet policies are registered and active.. The 'show event manager policy registered' command lists all EEM policies registered on the device. The output shows two applet policies registered, but no trigger events are shown. The correct answer is that two EEM applet policies are registered, but the output does not indicate whether they are enabled or disabled; registration means they are loaded and ready to trigger.

Answer

Two EEM applet policies are registered but disabled.

Answer

Only one EEM applet policy is registered.

Answer

The EEM applet policies are triggered by syslog events.

Question 17

An engineer must ensure that all syslog messages with severity level 4 (warning) and higher are sent to a remote syslog server at 10.1.1.100, while also logging messages of severity 6 (informational) to the console. Which TWO configuration commands are required? (Choose TWO.)

Accepted Answer

logging host 10.1.1.100 trap 4. The 'logging host' command with the 'trap' keyword sets the severity filter for remote logging; default trap level is 6 (informational), so to limit to level 4 and higher, the trap level must be set to 4. The 'logging console' command controls console logging; default is level 7 (debugging), so setting it to 6 allows informational and higher (0-6). The 'logging buffered' command affects buffer logging, not console. The 'logging source-interface' sets the source IP but does not filter severity. The 'logging monitor' affects terminal lines, not console.

Answer

logging buffered 6

Answer

logging source-interface Loopback0

Answer

logging monitor 4

Question 18

Which TWO commands can be used to verify OSPFv3 interface parameters and troubleshoot adjacency issues? (Choose TWO.)

Accepted Answer

show ipv6 ospf interface. The 'show ipv6 ospf interface' command displays OSPFv3 interface parameters, and 'debug ipv6 ospf hello' can be used to troubleshoot hello packet issues. The other commands are either invalid or for OSPFv2 only.

Answer

show ip ospf interface

Answer

debug ip ospf adj

Answer

show ipv6 ospf database

Question 19

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 20

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Accepted Answer

The BGP neighbor is up and the EEM policy has not been triggered.. The EEM policy BGP_Neighbor_Down is registered, but the BGP neighbor is in Established state. The correct answer is that the BGP neighbor is up and the EEM policy has not been triggered.

Answer

The BGP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is disabled.