300-410 Practice Exam 67 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 1
IPSLAs Latest Operation Statistics
IPSLA operation id: 1
Type of operation: icmp-echo
Latest RTT: 10 milliseconds
Latest operation start time: 00:15:30 UTC Mon Mar 1 2021
Latest operation return code: OK
Number of successes: 100
Number of failures: 0
Operation time to live: Forever

Based on this output, which statement is correct?

Accepted Answer

The IP SLA operation is successful and has a low RTT.. The output shows an IP SLA operation of type icmp-echo with a return code 'OK', 100 successes, and 0 failures. This indicates the operation is functioning correctly.

Answer

The IP SLA operation has failed 100 times.

Answer

The IP SLA operation type is udp-jitter.

Answer

The IP SLA operation has expired.

Question 2

A network engineer is troubleshooting a PBR route-map that is supposed to set the next-hop for traffic from a specific source to a different next-hop. The route-map is applied to the incoming interface, and the ACL matches the traffic. However, the engineer notices that the traffic is still being forwarded using the routing table. The engineer checks the route-map and sees that the 'set ip next-hop' command points to an IP address that is not reachable. What is the most likely result?

Accepted Answer

PBR will fall back to the routing table and forward the packet normally.. If the next-hop in a PBR set command is not reachable (i.e., not in the routing table), PBR will fall back to the routing table for forwarding. PBR does not drop the packet; it uses the default routing decision.

Answer

The packet will be dropped because PBR cannot forward it.

Answer

The router will send an ICMP unreachable message to the source.

Answer

The route-map will be ignored and all traffic will be dropped.

Question 3

Examine the following configuration on R3:

!--- R3 configuration
access-list 10 permit 192.168.0.0 0.0.255.255
access-list 10 deny   any
!
route-map OSPF-REDIST permit 10
 match ip address 10
 set metric-type type-1
!
router ospf 1
 redistribute eigrp 100 subnets route-map OSPF-REDIST
!

What is the effect of this configuration?

Accepted Answer

Only EIGRP routes in the 192.168.0.0/16 range are redistributed into OSPF as type-1 external routes.. The route-map OSPF-REDIST uses ACL 10 to match routes. ACL 10 permits 192.168.0.0/16 (with wildcard 0.0.255.255) and denies all else. The route-map then sets metric-type type-1 for matched routes. Therefore, only EIGRP routes within 192.168.0.0/16 are redistributed into OSPF as type-1 external routes. The implicit deny at the end of the ACL means other routes are not redistributed.

Answer

All EIGRP routes are redistributed into OSPF as type-1 external routes.

Answer

EIGRP routes in 192.168.0.0/16 are redistributed as type-2 by default; the set metric-type is ignored.

Answer

The configuration is invalid because the route-map uses an ACL that ends with deny any; a prefix-list must be used instead.

Question 4

A router configured as a DHCPv4 server uses a pool with 'bootfile' and 'next-server' options for PXE boot. Clients receive the DHCP offer with the correct bootfile, but they fail to download it. Which is the most likely explanation?

Accepted Answer

The 'next-server' is configured with a hostname, but the client does not have DNS resolution capabilities at boot time.. During PXE boot, the client does not yet have an IP address or DNS resolver configured. When the DHCP server specifies a hostname in the 'next-server' option, the client cannot resolve that hostname to an IP address to initiate the TFTP download. The client requires the TFTP server's IP address directly, not a DNS name, at this stage of the boot process.

Answer

The 'bootfile' name is case-sensitive, and the client is requesting a different case.

Answer

The DHCP server is not configured with the 'option 150' for TFTP server.

Answer

The client's subnet does not have a route to the TFTP server, but the DHCP server cannot control that.

Question 5

Analyze the following partial configuration:

access-list 101 permit tcp any any eq 179
access-list 101 permit udp any any eq 646
access-list 101 permit ospf any any
!
class-map match-all COPP-BGP
 match access-group 101
!
policy-map COPP-POLICY
 class COPP-BGP
  police 48000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
!
control-plane
 service-policy input COPP-POLICY

Which statement is true?

Accepted Answer

The ACL matches OSPF, BGP, and LDP traffic, and all are rate-limited to 48000 bps.. The ACL permits TCP port 179 (BGP), UDP port 646 (LDP), and OSPF (protocol 89). The class-map COPP-BGP matches all three protocols via the match-all keyword, and the policy-map applies a police rate of 48000 bps to this class. Since the policy is applied to the control-plane input, all matched traffic (BGP, LDP, OSPF) is rate-limited to 48000 bps.

Answer

The ACL is missing 'permit eigrp any any' to include EIGRP traffic.

Answer

The class-map must use 'match-all' to match all protocols simultaneously, but the ACL uses 'permit' which is OR logic, so the class-map will not work.

Answer

The policy-map should be applied to the interface, not the control-plane.

Question 6

An engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers have MP-BGP peering and the VRF is configured with route-target import 100:100. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2 (the PE2 loopback), but the show ip route vrf CUSTOMER command does not have this route. The show mpls forwarding-table on PE1 does not show a label for 192.168.1.2. What is the most likely cause?

Accepted Answer

LDP is not enabled on the core-facing interfaces of PE1 or the P routers.. The most likely cause is that LDP is not enabled on the core-facing interfaces of PE1 or the P routers. For an MPLS L3VPN, the transport label (outer label) is distributed via LDP. Without LDP, PE1 cannot learn a label for the next-hop 192.168.1.2 (PE2's loopback), so the BGP VPNv4 route cannot be installed in the VRF routing table because there is no valid label stack. The show mpls forwarding-table confirms the absence of a label for that next-hop.

Answer

The VRF route-target import is missing on PE2.

Answer

The MP-BGP session is not using the loopback interface.

Answer

The VRF on PE1 has the wrong route-target export.

Question 7

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto ipsec transform-set

Transform set combined-des-sha: { esp-des esp-sha-hmac  } 
   will negotiate = { Tunnel,  },
Transform set myset: { esp-3des esp-sha-hmac  } 
   will negotiate = { Tunnel,  },
Transform set strong: { esp-aes 256 esp-sha-hmac  } 
   will negotiate = { Tunnel,  },

What does this output indicate?

Accepted Answer

The transform set 'combined-des-sha' uses DES, which is not recommended due to security vulnerabilities.. The output shows three transform sets, including 'combined-des-sha', which uses DES (Data Encryption Standard) with a 56-bit key. DES is considered cryptographically weak and has been deprecated due to known vulnerabilities, such as susceptibility to brute-force attacks. Cisco recommends using AES or 3DES as a minimum for production IPsec VPNs, making option B correct.

Answer

All transform sets are using strong encryption and are acceptable for production.

Answer

The transform sets are not configured correctly because they do not specify the mode.

Answer

The transform set 'strong' is not supported because it uses AES 256.

Question 8

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::A8BB:CCFF:FE01:0200
  DUID: 00030001AABBCC010200
  Username: unassigned
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::1000
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Mar 08 2020 12:00 AM (2592000 seconds)
Client: FE80::A8BB:CCFF:FE01:0300
  DUID: 00030001AABBCC010300
  Username: unassigned
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::1001
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Mar 08 2020 12:00 AM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The DHCPv6 server is functioning correctly with two active bindings.. The output shows two DHCPv6 clients with unique link-local addresses and DUIDs, each assigned a distinct IPv6 address from the 2001:DB8:1::/64 prefix. The presence of valid lifetimes and T1/T2 timers indicates the DHCPv6 server is operating normally, maintaining two active bindings. Option B correctly identifies this as proper server behavior.

Answer

The DHCPv6 server has assigned duplicate addresses to the clients.

Answer

The DHCPv6 server is not using a pool; addresses are statically assigned.

Answer

The DHCPv6 server has a DUID conflict.

Question 9

An engineer must configure a Cisco IOS router to log messages to a syslog server at 192.168.1.100 with a severity level of 3 (errors) and above, while also ensuring that console messages are limited to severity 5 (notifications) and above. Which TWO configuration changes are required? (Choose TWO.)

Accepted Answer

Configure 'logging host 192.168.1.100' and 'logging trap errors'.. Option A is correct because 'logging host 192.168.1.100' defines the syslog server destination and 'logging trap errors' sets the syslog severity threshold to level 3 (errors), so messages at severity 3 and above are sent to the server. Option C is correct because 'logging console notifications' sets the console logging severity to level 5 (notifications), which limits console output to severity 5 and above as required. Option B is incorrect because 'logging console debugging' sets the console to level 7, which would show all messages rather than limiting them to severity 5 and above. Option D is incorrect because 'logging buffered errors' configures local buffered logging, not the syslog server or console severity requirements. Option E is incorrect because 'logging source-interface Loopback0' only sets the source IP for syslog messages and is not required by the stated scenario.

Answer

Configure 'logging console debugging' to ensure all messages are seen on console.

Answer

Configure 'logging buffered errors' to store logs locally.

Answer

Configure 'logging source-interface Loopback0' to use a specific source IP.

Question 10

What is the maximum hop count for a route in RIP?

Accepted Answer

15. RIP (Routing Information Protocol) uses a maximum hop count of 15 to prevent routing loops. A route with a hop count of 16 is considered unreachable (infinite metric). This limit is defined in RFC 1058 for RIPv1 and RFC 2453 for RIPv2, ensuring that the network diameter remains small and loop-free.

Answer

16

Answer

255

Answer

32

Question 11

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Accepted Answer

'show crypto session' displays the IKEv2 SA status and the IPsec SA status.. Option A is correct because 'show crypto session' reports both the IKE (IKEv2) SA state and the IPsec SA state for each peer, giving a quick view of whether the control-plane tunnel and data-plane SAs are up. Option B is correct because 'show crypto ipsec sa' includes per-SA counters such as '#pkts encaps' and '#pkts decaps', which reflect the number of packets encrypted (encapsulated) and decrypted (decapsulated). Option C is wrong because 'show crypto isakmp sa' displays ISAKMP/IKEv1 SAs, not IKEv2 SAs; IKEv2 SAs are viewed with 'show crypto ikev2 sa'. Option D is wrong because the 'pkts encaps' counter increments on the outbound SA as packets are encrypted, while inbound traffic increments the decapsulation counter. Option E is wrong because 'show crypto map' displays crypto map configuration and matching details, not per-SA packet counters.

Answer

'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

Answer

The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.

Answer

'show crypto map' displays the current packet count for each IPsec SA.

Question 12

Which EIGRP packet type is used to acknowledge receipt of a reliable packet?

Accepted Answer

Ack. D is correct because the EIGRP Ack (Acknowledgement) packet is a special packet used exclusively to confirm the reliable delivery of EIGRP packets such as Update, Query, and Reply. Ack packets are sent as unicast to the source router and contain no data, serving only as a delivery confirmation. This mechanism ensures that EIGRP's Reliable Transport Protocol (RTP) can guarantee ordered and guaranteed delivery of critical routing information.

Answer

Hello

Answer

Update

Answer

Reply

Question 13

Which TWO statements about DHCPv4 option 82 are true? (Choose TWO.)

Accepted Answer

The relay agent must be configured with the 'ip dhcp relay information option' command to insert option 82.. Option B is correct because on Cisco IOS relay agents, the 'ip dhcp relay information option' command enables the relay agent to insert the DHCPv4 option 82 (Relay Agent Information option) into client messages before forwarding them to the server. Option C is correct because the DHCP server can inspect the sub-options of option 82, such as the Circuit ID and Remote ID, and use them to select an address from a specific pool, enabling location-based address assignment. Option A is incorrect because option 82 is inserted by the relay agent, not by the DHCP client, which typically has no knowledge of the relay agent information. Option D is incorrect because option 82 is defined for DHCPv4 (RFC 3046); DHCPv6 uses a different relay mechanism with Relay-Forward/Relay-Reply messages and Interface-ID options. Option E is incorrect because 'ip dhcp relay information trusted' is used on the relay agent or a switch port to accept and forward option 82 from untrusted sources without dropping it, not to insert option 82.

Answer

Option 82 is inserted by the DHCP client to identify itself to the server.

Answer

Option 82 is only supported in DHCPv6.

Answer

The 'ip dhcp relay information trusted' command must be configured on the relay agent to insert option 82.

Question 14

Which TWO statements about NAT overload (PAT) are true? (Choose TWO.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. Option A is correct because PAT (Port Address Translation) multiplexes many inside local addresses onto one inside global address by translating the source port (and IP) so each session is uniquely identified in the NAT translation table. Option C is correct because PAT is commonly called NAT overload and is formally described in RFC 2663 as 'Network Address Port Translation' (NAPT). Option B is wrong because PAT can use a pool of public addresses, not only a single outside-interface address. Option D is wrong because PAT handles well-known/static ports fine; it translates the source port of the initiating host, and static mappings can be used for inbound services like HTTP or DNS. Option E is wrong as a general truth because the overload keyword appears with 'ip nat inside source list ... interface ... overload' or '... pool ... overload', but the statement omits the required interface or pool argument, so it is not a complete/valid command.

Answer

PAT is only supported with a single public IP address configured on the outside interface.

Answer

PAT cannot translate traffic for protocols that use static port numbers, such as DNS or HTTP.

Answer

PAT requires the ip nat inside source list command with the overload keyword.

Question 15

What is the default CoPP policy on a Cisco IOS-XE router if no service-policy is applied to the control-plane?

Accepted Answer

No CoPP policy is applied; all control-plane traffic is processed without rate-limiting.. C is correct because Cisco IOS-XE routers do not apply any default CoPP policy to the control-plane. Without an explicit 'service-policy' configuration under the 'control-plane' configuration mode, all control-plane traffic (including routing protocols, management traffic, and keepalives) is processed by the route processor without any rate-limiting or filtering. CoPP is an optional feature that must be manually configured to protect the control plane from excessive traffic.

Answer

All control-plane traffic is rate-limited to 64000 bps.

Answer

Only management traffic (SSH, Telnet) is rate-limited to 32000 bps.

Answer

A default policy is applied that drops all traffic exceeding 128000 bps.

Question 16

What is the default hello interval for the Label Distribution Protocol (LDP) on a Cisco IOS-XE router?

Accepted Answer

5 seconds. LDP hello messages are sent every 5 seconds by default on Cisco IOS-XE routers to discover and maintain adjacencies.

Answer

10 seconds

Answer

15 seconds

Answer

3 seconds

Question 17

A network engineer runs the following command on Router PE4:

PE4# show bgp vpnv4 unicast all summary
BGP router identifier 10.0.0.4, local AS number 65001
BGP table version is 25, main routing table version 25
5 network prefixes using 640 bytes of memory
5 path entries using 400 bytes of memory
3/3 BGP path/bestpath attribute entries using 360 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1424 total bytes of memory
BGP activity 15/10 prefixes, 20/15 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.5        4        65001    1020    1015       25    0    0 00:12:34        5
10.0.0.6        4        65002     500     495       25    0    0 00:06:20        0

Based on this output, what is the problem?

Accepted Answer

Neighbor 10.0.0.6 is not sending any prefixes.. The output shows neighbor 10.0.0.6 with a PfxRcd count of 0, meaning zero prefixes have been received from that neighbor, while the session is Established (Up/Down 00:06:20). Neighbor 10.0.0.5 shows 5 prefixes received, so it is exchanging prefixes normally. The problem is that 10.0.0.6 is not advertising any VPNv4 prefixes to PE4.

Answer

Neighbor 10.0.0.5 is not exchanging prefixes.

Answer

Both neighbors are in the Idle state.

Answer

The BGP table is empty.

Question 18

What is the default administrative distance for a route learned via the Border Gateway Protocol (BGP) from an external peer (eBGP)?

Accepted Answer

20. The default administrative distance (AD) for eBGP routes is 20. Administrative distance is a Cisco-proprietary metric used to rank the trustworthiness of routing information sources; lower values are preferred. eBGP is considered highly reliable because it is an exterior gateway protocol used between autonomous systems, so it is assigned a low AD of 20, second only to directly connected (0) and static routes (1).

Answer

200

Answer

170

Answer

1

Question 19

What is the default timer value for the EEM environment variable 'timer watchdog'?

Accepted Answer

60 seconds. The EEM 'timer watchdog' environment variable, when set, causes the EEM policy to be aborted if it runs longer than the specified time. Cisco IOS XE documentation specifies the default value as 60 seconds, and it can be tuned with the event manager environment timer_watchdog command. This prevents runaway policies from consuming CPU indefinitely.

Answer

30 seconds

Answer

120 seconds

Answer

180 seconds

Question 20

What is the default frequency (in seconds) for an IP SLA operation when no frequency is explicitly configured?

Accepted Answer

60 seconds. The default frequency for an IP SLA operation is 60 seconds. This means the probe is sent every 60 seconds unless a different frequency is configured under the IP SLA configuration.

Answer

10 seconds

Answer

30 seconds

Answer

120 seconds