300-410 Practice Exam 66 — 20 Questions

Question 1

An engineer must ensure that all syslog messages with severity level 4 (warning) and higher are sent to a remote syslog server at 10.1.1.100, while also logging messages of severity 6 (informational) to the console. Which TWO configuration commands are required? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

logging host 10.1.1.100 trap 4. The 'logging host' command with the 'trap' keyword sets the severity filter for remote logging; default trap level is 6 (informational), so to limit to level 4 and higher, the trap level must be set to 4. The 'logging console' command controls console logging; default is level 7 (debugging), so setting it to 6 allows informational and higher (0-6). The 'logging buffered' command affects buffer logging, not console. The 'logging source-interface' sets the source IP but does not filter severity. The 'logging monitor' affects terminal lines, not console.

Answer

logging buffered 6

Answer

logging source-interface Loopback0

Answer

logging monitor 4

Question 2

Which TWO commands can be used to verify OSPFv3 interface parameters and troubleshoot adjacency issues? (Choose TWO.)

Accepted Answer

show ipv6 ospf interface. The 'show ipv6 ospf interface' command displays OSPFv3 interface parameters, and 'debug ipv6 ospf hello' can be used to troubleshoot hello packet issues. The other commands are either invalid or for OSPFv2 only.

Answer

show ip ospf interface

Answer

debug ip ospf adj

Answer

show ipv6 ospf database

Question 3

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 4

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Accepted Answer

The BGP neighbor is up and the EEM policy has not been triggered.. The EEM policy BGP_Neighbor_Down is registered, but the BGP neighbor is in Established state. The correct answer is that the BGP neighbor is up and the EEM policy has not been triggered.

Answer

The BGP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is disabled.

Question 5

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show crypto isakmp sa detail

Codes: C - IKE configuration mode, D - Dead Peer Detection
       I - IKE Initiatior, R - IKE Responder

C-id  Local           Remote          I-VRF     Status Encr Hash Auth DH Lifetime Cap.
1001  10.1.1.1        10.1.1.2                  ACTIVE aes  sha  md5  2  86400 D

What does this output indicate?

Accepted Answer

An IKE Phase 1 SA is established with the remote peer using AES encryption and SHA hash.. The output from 'show crypto isakmp sa detail' displays an IKE Phase 1 (ISAKMP) security association with status 'ACTIVE', indicating successful Phase 1 negotiation. The 'Encr' column shows 'aes', 'Hash' shows 'sha', and 'Auth' shows 'md5', confirming AES encryption and SHA hash are used. This matches option A, which correctly identifies an established IKE Phase 1 SA with those parameters.

Answer

The IKE Phase 1 SA is in a failed state because the authentication method is MD5.

Answer

The IKE Phase 2 SA is established with the remote peer.

Answer

The router is the initiator of the IKE Phase 1 SA.

Question 6

An engineer is troubleshooting a BGP peering issue between two routers, R1 and R2, connected via a serial link. The BGP session is established, but routes are not being exchanged. The engineer checks the BGP configuration and sees that both routers have the 'neighbor' commands correctly configured. The output of 'show ip bgp summary' shows the session is in the Established state, but the prefix counts are zero. What is the most likely cause?

Accepted Answer

Neither router has any network statements or redistribution commands configured to inject prefixes into BGP.. If the BGP session is established but no prefixes are exchanged, the most common cause is that there are no networks configured under the BGP process or no redistribution. Alternatively, outbound filters could be blocking all prefixes. The stem says routes are not being exchanged, so the issue is on the advertisement side.

Answer

The BGP session is using MD5 authentication, but the passwords do not match.

Answer

The routers have mismatched BGP versions.

Answer

The update-source command is missing, causing the session to use the wrong interface.

Question 7

What is the default OSPF reference bandwidth used in the metric calculation on Cisco IOS-XE?

Accepted Answer

100 Mbps. Cisco IOS-XE uses a default reference bandwidth of 100 Mbps for OSPF metric calculation (cost = reference bandwidth / interface bandwidth).

Answer

1000 Mbps

Answer

10 Mbps

Answer

10000 Mbps

Question 8

What is the default size of the logging buffer in Cisco IOS-XE when 'logging buffered' is enabled without specifying a size?

Accepted Answer

4096 bytes. The default logging buffer size is 4096 bytes (4 KB) on most Cisco IOS-XE platforms.

Answer

1024 bytes

Answer

8192 bytes

Answer

16384 bytes

Question 9

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 in AS 65001 is configured to redistribute connected routes into BGP. The route 10.10.10.0/24 is learned via BGP on R2 (AS 65002), but R2's iBGP neighbor R3 (AS 65002) does not receive this route. R2 and R3 have a full iBGP mesh, and the BGP session is established. The output of 'show ip bgp' on R2 shows the route with the 'r' flag (RIB-failure). What is the most likely cause?

Accepted Answer

The route is marked as RIB-failure because a route with a lower administrative distance already exists in the routing table for the same prefix.. RIB-failure indicates that BGP learned a route but it was not installed in the routing table because a better route (e.g., from an IGP or static) already exists. This prevents the route from being advertised to iBGP peers.

Answer

The route is marked as RIB-failure because the next-hop is unreachable.

Answer

The route is marked as RIB-failure because BGP synchronization is enabled and the IGP does not have the route.

Answer

The route is marked as RIB-failure because the prefix is being filtered by an outbound route map.

Question 10

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 11

Which TWO statements about the 'logging rate-limit' command and its effects are correct? (Choose TWO.)

Accepted Answer

The command 'logging rate-limit 200 all' limits all syslog messages to 200 messages per second.. The 'logging rate-limit' command limits the number of syslog messages per second to prevent CPU overload. It can be applied globally or per interface. The 'all' option applies the limit to all messages, while 'except' allows certain severities to bypass the limit. The default rate is not unlimited; it depends on the IOS version but typically no rate limit is applied by default. The command does not affect console logging rate by default; it primarily affects logging to buffer and remote servers. The 'show logging' command displays the current rate-limit configuration.

Answer

By default, Cisco IOS applies a rate limit of 100 messages per second to all logging destinations.

Answer

The 'logging rate-limit' command only affects messages sent to the console port.

Answer

The 'show logging rate-limit' command displays the current rate-limit configuration.

Question 12

An engineer configures a distribute-list on an OSPF router to filter routes. However, the routes are still being advertised to neighbors. Which is the most likely explanation?

Accepted Answer

The distribute-list filters routes in the routing table, not the LSAs sent in OSPF updates.. A distribute-list in OSPF filters routes in the inbound or outbound direction of the routing table, but it does not filter the actual LSA advertisements. OSPF uses LSAs to propagate routes; filtering with distribute-list only affects the local routing table, not the LSAs sent to neighbors.

Answer

The distribute-list is applied to the wrong interface.

Answer

The distribute-list uses an incorrect prefix-list.

Answer

The OSPF process needs to be restarted for the distribute-list to take effect.

Question 13

Which TWO configuration steps are required to troubleshoot and fix a BGP route that is not being advertised to an EBGP neighbor due to the next-hop-self issue? (Choose TWO.)

Accepted Answer

Apply the neighbor next-hop-self command under the BGP router configuration for the EBGP neighbor.. The next-hop-self command on the EBGP neighbor or the IBGP peer (if the route is from IBGP) ensures the next hop is set to the local router's address. Alternatively, if the next hop is reachable via an IGP, no change is needed. Option A is incorrect because network statements do not affect next-hop. Option C is incorrect because EBGP multihop is for TTL issues. Option E is incorrect because the update-source command sets the source IP, not the next hop.

Answer

Configure a network statement under BGP to advertise the prefix.

Answer

Increase the EBGP multihop TTL using the neighbor ebgp-multihop command.

Answer

Use the neighbor update-source command to change the source IP of BGP updates.

Question 14

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) is an eBGP peer of R2 (AS 65002). R1 is advertising the prefix 10.0.0.0/8 to R2. R2 has an iBGP session with R3 (AS 65002). R3's BGP table shows the prefix 10.0.0.0/8 with next-hop 10.1.1.1 (R1's interface). However, R3 does not install this route in its routing table. The output of 'show ip route 10.0.0.0' on R3 shows no route. The engineer checks the routing table on R3 and sees that the interface connected to 10.1.1.0/24 is down. What is the most likely cause?

Accepted Answer

The next-hop 10.1.1.1 is not reachable because the directly connected interface is down.. For BGP to install a route, the next-hop must be reachable. If the interface to the next-hop is down, the route is considered unreachable and will not be installed.

Answer

The route is not installed because BGP synchronization is enabled.

Answer

The route is not installed because the prefix is being filtered by an inbound route-map on R3.

Answer

The route is not installed because the administrative distance of the route is too high.

Question 15

An engineer is troubleshooting an OSPFv2 adjacency that remains stuck in EXSTART state. Which TWO actions should the engineer take to resolve the issue? (Choose TWO.)

Accepted Answer

Verify that the MTU on both interfaces is identical.. An EXSTART state indicates a problem with the Database Description (DD) packet exchange, often due to MTU mismatch or mismatched interface MTU values. Also, mismatched OSPF network types can cause DD packet issues. The other options are either unrelated or incorrect.

Answer

Ensure that the OSPF hello and dead intervals match on both routers.

Answer

Confirm that the OSPF router IDs are unique across the network.

Answer

Increase the OSPF retransmit interval on both routers.

Question 16

An engineer configures OSPFv2 on two routers with a direct Ethernet link. The routers are stuck in the EXSTART state. Which is the most likely explanation?

Accepted Answer

The interface MTU on one router is 1500, and on the other is 1400.. OSPF neighbors can become stuck in EXSTART when there is a mismatch in the interface MTU. The DBD packet size is based on the interface MTU; if the receiving interface has a smaller MTU, the DBD packet is dropped, preventing the adjacency from progressing.

Answer

The OSPF hello and dead intervals are mismatched.

Answer

One router has OSPF authentication configured, and the other does not.

Answer

The OSPF network type is point-to-point on one router and broadcast on the other.

Question 17

According to RFC 5424, which syslog severity level corresponds to 'Critical' conditions?

Accepted Answer

Severity 2. RFC 5424 defines severity level 2 as 'Critical' conditions.

Answer

Severity 0

Answer

Severity 1

Answer

Severity 3

Question 18

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is also being used for other VLAN traffic due to misconfiguration.. RSPAN VLANs should be used exclusively for RSPAN traffic and should not have any other VLANs mapped to them. If the RSPAN VLAN is also used for other purposes, it may carry unintended traffic.

Answer

The source VLAN is not configured correctly on the source switch.

Answer

The destination port is in the wrong VLAN.

Answer

The trunk is not pruning VLAN 200 correctly.

Question 19

snmp-server ifindex persist

What is the effect of this configuration?

Accepted Answer

Interface indices are preserved after a device reload.. The `snmp-server ifindex persist` command configures the router to save interface index (ifIndex) values in non-volatile memory (the private configuration or NVRAM) so that after a reload, each interface retains its original ifIndex. This is critical for SNMP management systems that rely on stable ifIndex values to correlate interface statistics across reboots, as the default behavior is to assign ifIndex values dynamically based on the order interfaces are discovered, which can change after a reload.

Answer

Interface statistics are cleared on reload.

Answer

SNMP traps are sent for interface state changes.

Answer

The ifIndex is based on the interface name.

Question 20

An engineer configures mutual redistribution between OSPF and EIGRP. After a few minutes, the network becomes unstable with routing loops. The engineer checks the routing tables and notices that the same prefix is being learned from both protocols with different administrative distances. Which is the most likely explanation?

Accepted Answer

Routes are redistributed back and forth between OSPF and EIGRP without any filtering or tagging. Mutual redistribution without proper route tagging can cause routing loops because each protocol redistributes routes back into the other, creating a feedback loop. The administrative distance of the redistributed routes may cause one protocol to prefer the redistributed route over the original, leading to instability. Using route tags and filtering can prevent this, but without them, loops are common.

Answer

The seed metric for OSPF redistribution into EIGRP is not configured

Answer

The administrative distance of OSPF is lower than EIGRP, causing OSPF routes to be preferred

Answer

The redistribute command is missing the subnets keyword under OSPF