300-410 Practice Exam 66 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp neighbors detail

IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                           (sec)         (ms)       Cnt Num
0   10.1.2.2                Gi0/0            13 00:12:34   12   200  0  145
   Version 12.4/1.2, Retrans: 0, Retries: 0, Prefixes: 5
   Topology-ids from peer - 0
   Stub Peer Advertising (CONNECTED STATIC) Routes
   Suppressing queries

What does this output indicate?

Accepted Answer

The neighbor is a stub router that only advertises connected and static routes, and it does not participate in query propagation.. The output shows 'Stub Peer Advertising (CONNECTED STATIC) Routes' and 'Suppressing queries', which indicates the neighbor is configured as an EIGRP stub router. A stub router advertises only connected and static routes (as specified) and does not participate in query propagation, meaning it will not forward queries from other routers, reducing the query domain and improving convergence.

Answer

The neighbor is a normal EIGRP peer that forwards all routes and queries.

Answer

The neighbor is not forming an adjacency due to a version mismatch.

Answer

The neighbor is using a different autonomous system number.

Question 2

Which TWO statements about IPsec transform sets and security associations (SAs) are true? (Choose TWO.)

Accepted Answer

A transform set can specify ESP encryption and ESP authentication simultaneously.. Option A is correct because an IPsec transform set is precisely the construct that bundles the security protocols and algorithms for a single SA proposal, and it commonly pairs an ESP encryption algorithm (e.g., esp-aes) with an ESP authentication algorithm (e.g., esp-sha256-hmac) so the payload is both encrypted and integrity-protected. Option B is correct because in tunnel mode the entire original IP packet (original IP header plus payload) is encapsulated and a brand-new outer IP header is prepended, which is what allows site-to-site VPN endpoints to route the encapsulated traffic across an untrusted network. Option C is wrong because transport mode does not add a new IP header; it inserts the IPsec header between the original IP header and the transport-layer payload, leaving the original IP header intact. Option D is wrong because 'crypto ipsec security-association lifetime' configures the lifetime of the IPsec SA (data SA), whereas IKE SA lifetimes are configured with 'crypto isakmp policy' / 'crypto ikev2 policy' lifetime settings. Option E is wrong because an IPsec SA is unidirectional, so secure bidirectional communication requires a pair of SAs, one for each direction.

Answer

Transport mode adds a new IP header to the packet.

Answer

The command 'crypto ipsec security-association lifetime' sets the IKE SA lifetime.

Answer

A single IPsec SA provides bidirectional secure communication.

Question 3

Which RFC defines the IPv6 Neighbor Discovery Protocol that is the basis for many First Hop Security features?

Accepted Answer

RFC 4861. RFC 4861 defines the IPv6 Neighbor Discovery Protocol (NDP), which is the foundation for IPv6 First Hop Security (FHS) features. NDP replaces ARP in IPv6 and provides address resolution, router discovery, neighbor unreachability detection, and redirect functions, all of which are leveraged by FHS mechanisms like RA Guard, DHCPv6 Guard, and Source Address Validation Improvement (SAVI).

Answer

RFC 2460

Answer

RFC 4291

Answer

RFC 4443

Question 4

A network engineer runs the following command to troubleshoot an EEM issue:

R1# debug event manager action syslog

EEM Action Syslog debugging is on

R1#
Mar  1 00:20:45.789: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action syslog msg: 'OSPF adjacency change detected'

What does this output indicate?

Accepted Answer

The EEM applet 'TRACK-INTERFACE' executed a syslog action and generated the message 'OSPF adjacency change detected'.. The debug output shows that the EEM applet named 'TRACK-INTERFACE' executed a syslog action, which generated the message 'OSPF adjacency change detected'. The log line %HA_EM-6-ACTION indicates that an Embedded Event Manager (EEM) action was triggered, and the action was to send a syslog message with that specific text. This confirms that the applet performed the action.

Answer

The EEM applet 'TRACK-INTERFACE' received a syslog message 'OSPF adjacency change detected'.

Answer

The debug output shows the configuration of the syslog action for applet 'TRACK-INTERFACE'.

Answer

The syslog message was generated by the system, not by the EEM applet.

Question 5

Which TWO commands can be used to verify the operational status of a manually configured IPv6 tunnel on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show interfaces tunnel 0. Option A, `show interfaces tunnel 0`, is correct because it displays the operational state (up/up or down/down) of the tunnel interface, along with line protocol status, encapsulation type, and packet counters, directly verifying whether the manually configured tunnel is functioning. Option B, `show ipv6 interface tunnel 0`, is correct because it confirms the tunnel interface's IPv6 configuration and operational status, including the link-local address, global IPv6 address, and whether IPv6 is enabled and up on that interface. Option C, `show ipv6 route`, only displays the IPv6 routing table and does not confirm the tunnel interface's operational state. Option D, `show ipv6 tunnel 0`, is not a valid Cisco IOS command for verifying tunnel status. Option E, `show running-config interface tunnel 0`, only shows the configured commands in the running configuration and does not reflect the current operational status of the tunnel.

Answer

show ipv6 route

Answer

show ipv6 tunnel 0

Answer

show running-config interface tunnel 0

Question 6

Which TWO statements correctly describe the use of IKEv2 for IPsec site-to-site VPNs? (Choose TWO.)

Accepted Answer

IKEv2 uses UDP port 500 and 4500 for NAT traversal.. Option A is correct because IKEv2 negotiates its IKE_SA_INIT exchanges over UDP port 500, and when a NAT device is detected between the peers it switches to UDP port 4500 (NAT-Traversal encapsulation) for the IKE_AUTH and subsequent exchanges. Option D is correct because IKEv2 natively supports EAP as an authentication method (EAP-IKEv2, EAP-MSCHAPv2, EAP-TLS, etc.), which is one of its key enhancements over IKEv1 and enables flexible user/device authentication for site-to-site and remote-access IPsec. Option B is wrong because IKEv2 supports multiple authentication methods including pre-shared keys, RSA/ECDSA digital signatures, and EAP, not PSK only. Option C is wrong because aggressive mode is an IKEv1 main-mode alternative; IKEv2 replaced it with a simpler two-exchange (IKE_SA_INIT and IKE_AUTH) process and does not use aggressive mode. Option E is wrong because the default IKEv2 SA (IKE SA) lifetime is typically 24 hours (86400 seconds) on many implementations, not 3600 seconds, which is a common default for the IPsec child SA (Phase 2) lifetime.

Answer

IKEv2 supports only pre-shared keys for authentication.

Answer

IKEv2 uses aggressive mode to establish the IKE SA.

Answer

The default IKEv2 SA lifetime is 3600 seconds.

Question 7

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Accepted Answer

The regex pattern in the applet does not match the syslog message.. The EEM applet uses a regex pattern to match the syslog message, and if the pattern does not exactly match the interface name or the message format, the applet will not trigger. The syslog message shows 'GigabitEthernet0/1', but the regex might be expecting a different format (e.g., 'Gi0/1' or missing the full name), causing a mismatch. Therefore, the most likely cause is that the regex pattern does not match the syslog message.

Answer

The EEM applet is disabled.

Answer

The syslog message is not being sent to the EEM server due to logging level restrictions.

Answer

The interface is not being monitored because it is a subinterface.

Question 8

A network engineer runs the following command to troubleshoot a VRF route issue:

R1# show ip route vrf CUSTOMER summary
IP routing table name is CUSTOMER (0x1)
IP routing table maximum-paths is 32
Route Source    Networks    Subnets    Overhead    Memory (bytes)
connected       2           0          0           320
static          1           0          0           160
eigrp 100       3           0          0           480
  Internal      3
Total           6           0          0           960

What does this output indicate?

Accepted Answer

The VRF CUSTOMER routing table has 6 routes, including static and EIGRP routes.. The output shows the VRF CUSTOMER routing table summary, listing 2 connected routes, 1 static route, and 3 EIGRP routes, totaling 6 routes. This confirms that the VRF contains routes from multiple sources, including static and EIGRP, making option A correct.

Answer

The VRF CUSTOMER routing table is empty.

Answer

The VRF CUSTOMER has only connected routes.

Answer

The VRF CUSTOMER routing table has an error due to overlapping subnets.

Question 9

Examine this BGP configuration on router R3:

router bgp 65001
 neighbor 10.1.1.1 remote-as 65002
 address-family ipv4
  network 192.168.0.0 mask 255.255.252.0
  aggregate-address 192.168.0.0 255.255.252.0 summary-only

What is the effect of the 'aggregate-address' command with the 'summary-only' keyword?

Accepted Answer

It advertises the aggregate 192.168.0.0/22 and suppresses all more specific routes from being advertised to neighbor 10.1.1.1.. The aggregate-address command creates an aggregate route in BGP. The summary-only keyword suppresses more specific routes from being advertised.

Answer

It advertises both the aggregate and all more specific routes.

Answer

It creates a static route for the aggregate.

Answer

It removes all more specific routes from the BGP table.

Question 10

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The CoPP configuration matches SSH (TCP/22), Telnet (TCP/23), and ICMP echo (ping) traffic via ACL 100 and class-map COPP-MGMT, then applies a police rate of 8000 bps to that class. All other control-plane traffic falls into class-default and is policed at 64000 bps. The 'conform-action transmit exceed-action drop' statements enforce rate-limiting, not blocking, so the correct effect is that SSH, Telnet, and ICMP echo are rate-limited to 8000 bps, while all other control-plane traffic is rate-limited to 64000 bps.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 11

What is the default behavior of a route-map when a route does not match any match clause in any sequence?

Accepted Answer

The route is denied by default.. A route-map consists of sequences with permit or deny actions. If a route does not match any match clause in any sequence, it is implicitly denied. This is similar to an access-list: there is an implicit deny at the end of the route-map.

Answer

The route is permitted by default.

Answer

The route is processed by the last sequence regardless of match.

Answer

The route is forwarded to the next route-map if one exists.

Question 12

Consider this configuration on router R2:
```
interface GigabitEthernet0/0
 ip access-group RESTRICT_ACCESS in
!
ip access-list extended RESTRICT_ACCESS
 permit ip 10.0.0.0 0.255.255.255 any
 deny   ip any any
```
What traffic will be permitted inbound on GigabitEthernet0/0?

Accepted Answer

All traffic from the 10.0.0.0/8 network.. The access list RESTRICT_ACCESS uses a wildcard mask of 0.255.255.255, which matches the first octet exactly and ignores the remaining three octets. This effectively permits all traffic from the 10.0.0.0/8 network (10.0.0.0 through 10.255.255.255). The explicit deny ip any any at the end blocks all other traffic, so only traffic sourced from the 10.0.0.0/8 range is permitted inbound on GigabitEthernet0/0.

Answer

Only traffic from source 10.0.0.0/24.

Answer

All traffic from any source.

Answer

Only traffic from source 10.0.0.0/16.

Question 13

Which statement about the SPAN destination port behavior is correct?

Accepted Answer

The SPAN destination port is automatically placed in a forwarding state and does not run STP.. The SPAN destination port is designed to receive a copy of traffic from source ports or VLANs. By default, it does not participate in normal switching, including Spanning Tree Protocol (STP). It is placed in a forwarding state and does not run STP to avoid interfering with the mirrored traffic. This behavior ensures that the destination port can receive mirrored packets without being blocked by STP or causing loops.

Answer

The SPAN destination port operates in full-duplex mode by default.

Answer

The SPAN destination port can participate in Spanning Tree Protocol (STP) if configured.

Answer

The SPAN destination port can be used as a normal switch port after removing the SPAN configuration.

Question 14

Examine this configuration snippet:
```
router rip
 distance 120
```
Which statement is true about the effect of this command?

Accepted Answer

It changes the administrative distance for RIP routes to 120, which is the same as the default, so no change occurs.. The `distance` command under RIP sets the administrative distance for all RIP routes to 120, overriding the default of 120? Actually default is 120, so this command would have no effect if set to the same value.

Answer

It changes the administrative distance for RIP routes to 120, which is lower than the default of 130.

Answer

It changes the administrative distance for RIP routes to 120, but only for routes learned from RIP neighbors.

Answer

It changes the administrative distance for RIP routes to 120, but only for routes with a hop count greater than 1.

Question 15

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1
  FNF: monitor
    Monitor: FLOW-MONITOR-1
      direction: Input
      traffic-statistics:  enabled

Based on both outputs, what is the most likely problem?

Accepted Answer

The flow monitor is attached, but no traffic is flowing through the interface.. The 'show flow monitor ... cache format table' output shows Current entries: 0, Flows added: 0, and all aging counters at 0, meaning no flows have ever been recorded. The 'show flow interface' output confirms the monitor FLOW-MONITOR-1 is attached to GigabitEthernet0/1 in the Input direction with traffic-statistics enabled. Since the monitor is properly attached but no flows exist, the most likely cause is that no traffic is traversing the interface.

Answer

The flow monitor is not attached to the interface.

Answer

The cache size is too small.

Answer

The flow exporter is misconfigured.

Question 16

Which TWO statements correctly describe the behavior of Control Plane Policing (CoPP) when applied to a Cisco IOS router? (Choose TWO.)

Accepted Answer

CoPP policies are applied using the Modular QoS CLI (MQC) and can be attached to the control-plane interface with the 'service-policy input' command.. CoPP uses the Modular QoS CLI (MQC) framework, where a policy-map is created with class-maps and actions, and then applied to the control-plane interface using the 'service-policy input' command. This attaches the policy to the control plane, filtering traffic destined to the router's CPU before it is process-switched.

Answer

CoPP policies are applied using the 'policy-map' command under the interface configuration mode for each physical interface.

Answer

CoPP polices all traffic that enters the router, including traffic that is process-switched after being forwarded.

Answer

CoPP uses the 'class-map' command to match traffic based on ACLs, NBAR, or DSCP values, and the 'police' command to enforce rate limits.

Question 17

Given this configuration on Router R3:
```
interface Tunnel0
 no ip address
 ipv6 address 2001:DB8:5::1/64
 tunnel source 192.168.1.1
 tunnel destination 192.168.2.2
 tunnel mode ipv6ip
```
What is missing or incorrect?

Accepted Answer

The configuration is correct and will function as an IPv6 over IPv4 tunnel.. The configuration uses 'tunnel mode ipv6ip', which is a valid manual IPv6-over-IPv4 tunnel. The source and destination are IPv4 addresses, as required for this tunnel mode. No changes are needed; the tunnel will function correctly for IPv6 over IPv4 transport.

Answer

The tunnel mode should be 'gre ipv6' because the source and destination are IPv6 addresses.

Answer

The tunnel interface must have an IPv4 address.

Answer

The tunnel source should be an interface, not an IP address.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
O        10.1.1.0/24 [110/20] via 192.168.1.2, 00:15:30, GigabitEthernet0/0
O        10.2.2.0/24 [110/30] via 192.168.1.2, 00:15:30, GigabitEthernet0/0

Based on this output, which statement is correct?

Accepted Answer

The router has two OSPF routes to different subnets.. The output shows two OSPF-learned routes: 10.1.1.0/24 with metric 20 and 10.2.2.0/24 with metric 30, both via 192.168.1.2 on GigabitEthernet0/0. These are two distinct OSPF routes to different subnets, which matches option B. The 'O' code confirms intra-area OSPF routes, and the timers (00:15:30) indicate the routes have been stable for over 15 minutes.

Answer

The router has a default route via OSPF.

Answer

The OSPF neighbor is down.

Answer

The metric for 10.2.2.0/24 is 20.

Question 19

Which THREE commands are used to troubleshoot VRF-Lite connectivity issues on a Cisco IOS-XE router? (Choose THREE.)

Accepted Answer

show ip route vrf <vrf-name>. These three commands provide essential troubleshooting information: 'show ip route vrf' displays the VRF routing table, 'ping vrf' tests connectivity from within a VRF, and 'show vrf' shows VRF status and interfaces. The other options: 'traceroute' without VRF context may not work correctly, and 'show ip cef' without VRF shows global CEF, not VRF-specific.

Answer

traceroute <destination>

Answer

show ip cef

Question 20

A network engineer configures an EEM applet to monitor redistribution events using the event syslog pattern 'IP-4-ROUTING'. The applet is intended to log when a route is redistributed from OSPF into EIGRP. The redistribution is configured without a seed metric for EIGRP, and the route is not redistributed. The EEM applet does not trigger. Which is the most likely explanation?

Accepted Answer

Redistribution into EIGRP without a seed metric fails silently, and no syslog message is generated.. When redistributing routes into EIGRP without a seed metric (the default-metric command or a metric on the redistribute statement), EIGRP cannot compute a metric and the routes are not redistributed. Critically, this failure is silent — no syslog message is generated, so the EEM applet watching for 'IP-4-ROUTING' never fires. The absence of the log is the expected behavior, not an EEM misconfiguration.

Answer

The EEM applet must use 'event routing' to capture redistribution events.

Answer

The syslog pattern 'IP-4-ROUTING' is incorrect; it should be 'IP-5-ROUTING'.

Answer

The redistribution is blocked by route tagging, preventing the syslog.