300-410 Practice Exam 67 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy registered

No.  Class        Type    Version   Time Created          Name
  1  applet       system  1.0       Mar 1 00:00:12 2025  TRACK-INTERFACE
  2  applet       system  1.0       Mar 1 00:00:15 2025  BGP-RESET
  3  applet       user    1.0       Mar 1 00:02:30 2025  LOG-ERROR

What does this output indicate?

Accepted Answer

Three EEM applets are registered, including two system-defined and one user-defined.. The output shows three registered EEM applets. The 'Class' column indicates whether the applet is system-defined or user-defined. 'Type' is always 'applet' for EEM applets. 'Time Created' shows when the applet was registered. The 'Name' is the applet name. This output confirms that the applets are registered and available for execution.

Answer

Three EEM applets are registered, all user-defined.

Answer

Three EEM applets are registered, all system-defined.

Answer

The output shows the EEM applets that are currently executing.

Question 2

A network engineer configures EEM to monitor CPU usage on R1. R1 has: event manager applet CPU-MONITOR event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 80 poll-interval 5 action 1.0 cli command "enable" action 2.0 cli command "show processes cpu sorted" action 3.0 syslog msg "High CPU usage detected". After a few hours, the engineer notices that the applet triggers repeatedly, but the show command output is truncated. Router R2 shows: no issues. What is the root cause?

Accepted Answer

The EEM applet runs too frequently (every 5 seconds), consuming CPU and causing output truncation.. The EEM applet triggers every 5 seconds when CPU exceeds 80%, and each execution runs the show command, which itself consumes CPU. This can create a feedback loop where the applet increases CPU usage, causing more triggers. Additionally, the show command output may be truncated if the applet runs too frequently or the buffer is insufficient. The correct fix is to increase the poll interval or add a throttle.

Answer

The SNMP OID is for 5-second CPU, not 1-minute average, causing false positives.

Answer

The 'show processes cpu sorted' command requires a terminal length setting.

Answer

The applet should use 'event manager applet CPU-MONITOR trigger' to start.

Question 3

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Accepted Answer

The EIGRP neighbor down event has occurred once.. The output shows one registered EEM applet policy and one triggered event. The correct answer is that the EIGRP neighbor down event has occurred once.

Answer

The EIGRP neighbor is currently down.

Answer

The EEM policy is disabled.

Answer

The EIGRP neighbor is flapping.

Question 4

Which THREE symptoms indicate a BGP route dampening issue that is causing routes to be suppressed? (Choose THREE.)

Accepted Answer

The show ip bgp command displays the route with a 'd' status code.. Route dampening suppresses routes that flap frequently. Symptoms include routes showing as 'dampened' in the BGP table, routes being absent from the routing table despite being in the BGP table, and the show ip bgp dampened-paths command listing those routes. Option A is incorrect because dampening does not affect the neighbor state. Option E is incorrect because the prefix-list is not directly related to dampening.

Answer

The BGP neighbor state flaps between Established and Idle.

Answer

The show ip prefix-list command indicates that routes are being filtered.

Question 5

Drag and drop the steps to establish an eBGP session between two IOS routers into the correct order, from first to last.

Accepted Answer

Configure BGP router ID under router bgp. The correct order starts with configuring the BGP router ID, then the local AS and neighbor remote AS, followed by specifying the neighbor update source, enabling the neighbor, and finally verifying the session.

Question 6

Which TWO statements about IP SLA responder configuration are true? (Choose TWO.)

Accepted Answer

The 'ip sla responder' command must be configured on the destination device for UDP jitter probes to obtain accurate round-trip time.. The IP SLA responder is a component that listens for probe requests and sends replies. It is required for certain probe types like UDP jitter and TCP connect to ensure accurate measurements. The responder must be enabled on the destination device with the 'ip sla responder' global command. It does not require a specific port for ICMP echo, and it does not automatically adjust timestamps without the 'timestamp' option.

Answer

The responder is automatically enabled on all Cisco routers running IOS 15.0 or later.

Answer

The ICMP echo probe type requires the responder to be configured on the destination for accurate results.

Answer

The responder can provide hardware-based timestamping to improve accuracy when the 'timestamp' option is configured.

Question 7

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Accepted Answer

The EEM policy is registered but not yet triggered because the OSPF neighbor is up.. The EEM policy OSPF_Neighbor_Down is registered, but the OSPF neighbor is in FULL state. The correct answer is that the EEM policy has not been triggered because the OSPF neighbor is up.

Answer

The OSPF neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 8

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?

Accepted Answer

The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.. The EEM applet triggers on any BGP notification syslog and then executes a clear ip bgp * command, which resets all BGP sessions. This creates a loop: a BGP notification causes a clear, which causes more notifications, leading to persistent flapping. The correct fix is to make the applet more specific or avoid clearing all sessions.

Answer

The BGP keepalive timer is set too low on R1.

Answer

The syslog pattern is incorrect and matches unrelated messages.

Answer

There is an MTU mismatch between R1 and R2.

Question 9

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern occurs period '.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.

Question 10

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001, (received & used)
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: 100:200

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a community attribute of 100:200, which may affect routing decisions.. The show bgp output for a specific prefix shows one path with community 100:200 attached. The community is a BGP community value that can be used for route tagging and policy enforcement. The path is valid and best.

Answer

The prefix 192.168.1.0/24 is not installed in the routing table.

Answer

The prefix 192.168.1.0/24 is being filtered due to the community value.

Answer

The community 100:200 indicates the prefix is from a confederation.

Question 11

An engineer enables unicast RPF (uRPF) in strict mode on an interface. Afterward, some legitimate traffic from a BGP neighbor is dropped. The neighbor has two paths to the router, and traffic may arrive on a different interface than the return path. What is the most likely explanation?

Accepted Answer

Strict uRPF drops packets if the source IP is not reachable via the receiving interface, which fails in asymmetric routing scenarios.. Strict uRPF checks that the source IP of incoming packets matches the routing table entry for the interface it arrived on. If asymmetric routing occurs, packets from a valid neighbor may arrive on a different interface than the return path, causing them to be dropped.

Answer

The uRPF 'allow-default' option was not configured, so default routes are ignored.

Answer

The neighbor's BGP updates have a source IP that is not in the routing table.

Answer

Loose mode should be used instead, but strict mode was configured by mistake.

Question 12

A network engineer is troubleshooting a route redistribution issue between two OSPF processes. Router R1 runs OSPF process 1 and OSPF process 2, and redistributes routes between them. The engineer notices that routes from OSPF process 1 are not appearing in the OSPF database of process 2, even though the redistribute command is configured. The show ip ospf database command on R1 for process 2 shows no external routes. What is the most likely cause?

Accepted Answer

The redistribute ospf 1 command under OSPF process 2 is missing the subnets keyword.. When redistributing between OSPF processes, the redistribute command must include the subnets keyword to redistribute classless subnets. Without it, only classful networks are redistributed, which may cause many routes to be missing.

Answer

OSPF process 1 has a higher administrative distance than OSPF process 2.

Answer

The redistribute ospf 1 command under OSPF process 2 is missing the match internal keyword.

Answer

OSPF process 2 has a route map applied that is filtering all routes.

Question 13

An engineer configures BFD on an OSPF link that is part of a virtual link. The BFD session between the two endpoints of the virtual link is up, but OSPF adjacency over the virtual link is not forming. What is the most likely explanation?

Accepted Answer

BFD cannot be used with OSPF virtual links; BFD only works on physical interfaces.. BFD does not support virtual links in OSPF. BFD can only be configured on physical interfaces or subinterfaces, not on virtual links. Therefore, even if BFD is up on the underlying physical link, it will not help detect failures of the virtual link. The virtual link adjacency may fail due to other issues, such as mismatched area IDs or authentication.

Answer

The virtual link is configured with a different hello interval than the BFD interval, causing a mismatch.

Answer

The 'bfd all-interfaces' command is not configured under the OSPF process, so OSPF ignores BFD for virtual links.

Answer

The virtual link is using a different authentication type than the BFD session.

Question 14

Which TWO commands can be used to troubleshoot an Embedded Event Manager (EEM) applet that is not triggering as expected? (Choose TWO.)

Accepted Answer

debug event manager action all. The 'debug event manager action all' command provides detailed logs of EEM actions, while 'show event manager detector all' shows the status of all EEM detectors (including whether they are registered). The other options are either not valid or not useful for troubleshooting trigger issues.

Answer

show event manager policy registered

Answer

show event manager environment all

Answer

debug event manager all

Question 15

A service provider network is experiencing MPLS label distribution failures between R1 and R2. R1 has: event manager applet LDP-MONITOR event syslog pattern "%LDP-4-ERROR" action 1.0 cli command "enable" action 2.0 cli command "clear mpls ldp neighbor *" action 3.0 syslog msg "Cleared LDP neighbors". Router R2 shows: LDP session is down, and logs show repeated LDP errors. What is the root cause?

Accepted Answer

The EEM applet clears all LDP neighbors upon any LDP error, preventing the session from stabilizing.. The EEM applet triggers on any LDP error and clears all LDP neighbors. This removes the LDP session, causing more errors when the session tries to re-establish, leading to a cycle of failures. The correct fix is to clear only the affected neighbor or address the underlying LDP issue.

Answer

The LDP router-id is misconfigured on R1.

Answer

The syslog pattern matches only severity 4, but LDP errors are severity 3.

Answer

The MPLS label range is exhausted on R1.

Question 16

A network engineer runs the following command on Router R1:

R1# show route-map REDISTRIBUTE
route-map REDISTRIBUTE, permit, sequence 10
  Match clauses:
    ip address prefix-list EIGRP_ROUTES
  Set clauses:
    metric 100
    metric-type type-1
    tag 200
  Policy routing matches: 0 packets, 0 bytes

route-map REDISTRIBUTE, deny, sequence 20
  Match clauses:
    ip address prefix-list DENY_ALL
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, what is the problem?

Accepted Answer

The route-map has a deny sequence that may block all routes if prefix-list DENY_ALL is configured to permit all.. The route-map has a deny sequence 20 that matches prefix-list DENY_ALL. If DENY_ALL is configured to permit all (e.g., permit 0.0.0.0/0 le 32), then all routes will be denied after sequence 10, effectively blocking redistribution. The problem is that the deny sequence may unintentionally block routes that should be redistributed.

Answer

The route-map will redistribute all routes that match prefix-list EIGRP_ROUTES with metric 100 and type-1.

Answer

The route-map will only redistribute routes with tag 200.

Answer

The route-map is not applied to any redistribution command, so it has no effect.

Question 17

A network engineer configures BGP synchronization on an iBGP router. The IGP (OSPF) does not carry the BGP routes. Unexpectedly, the router does not advertise these iBGP routes to eBGP neighbors. What is the most likely explanation?

Accepted Answer

The router has 'bgp synchronization' enabled, and the iBGP route is not in the OSPF routing table, so it is not considered valid for advertisement.. BGP synchronization requires that an iBGP route must be present in the IGP before it can be advertised to eBGP neighbors. If the IGP does not carry the route, the router will not advertise it, even if it is in the BGP table.

Answer

The router has 'bgp bestpath as-path multipath-relax' configured, which suppresses eBGP advertisements for iBGP routes.

Answer

The iBGP session is not using 'next-hop-self', so the next hop is unreachable.

Answer

The router has 'bgp suppress-duplicates' enabled, which drops identical routes.

Question 18

Which TWO configuration steps are required to enable an Embedded Event Manager (EEM) applet that sends an SNMP trap when a specific OID is polled? (Choose TWO.)

Accepted Answer

Configure 'event snmp oid 1.3.6.1.4.1.9.9.117.1.1.2.1.1 get-type exact' within the applet.. To trigger an EEM applet on an SNMP OID poll, you must configure the 'event snmp oid' command and ensure SNMP is enabled globally. The other options are either unnecessary (like configuring a community for the applet itself) or incorrect (like using 'event syslog' or 'event cli').

Answer

Configure 'event syslog pattern "SNMP"' to capture the SNMP poll.

Answer

Configure an SNMP community string with read-write access inside the applet using 'action snmp-community'.

Answer

Configure 'event cli command "snmpwalk" sync yes' to trigger on SNMP walks.

Question 19

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

Accepted Answer

event cli. EEM provides the 'event cli' event type to match on CLI commands. The syntax is 'event cli pattern <string>' where the pattern can be a regular expression to match the command. Other event types like 'event syslog' match syslog messages, not CLI commands.

Answer

event syslog

Answer

event snmp

Answer

event timer

Question 20

What is the default maximum hop count for RIP routes in Cisco IOS?

Accepted Answer

15. RIP uses a hop count metric with a maximum of 15 hops; 16 indicates an unreachable route. This is a fundamental loop prevention mechanism.

Answer

16

Answer

255

Answer

10