300-410 Practice Exam 67 — 20 Questions

Question 1

A network engineer is troubleshooting a VRF-Lite setup where a router is configured with VRF_GREEN. The engineer pings the gateway IP of a host in VRF_GREEN from the router, but the ping fails. The 'show ip route vrf VRF_GREEN' command shows the connected network for the host's subnet. The 'show ip interface brief' shows the interface is up/up. What is the most likely cause?

Accepted Answer

The host's IP address is not in the same subnet as the router's interface IP in VRF_GREEN.. If the interface is up and the route is present, the issue might be with ARP resolution or the host's configuration. However, in VRF-Lite, the router might not be able to ping the gateway if the gateway IP is not in the same subnet as the interface IP, or if the host has a firewall blocking ICMP.

Answer

The host's default gateway is not set to the router's interface IP in VRF_GREEN.

Answer

The router's interface in VRF_GREEN has 'ip proxy-arp' disabled.

Answer

The 'ip routing' command is disabled in VRF_GREEN.

Question 2

Router R1 is running EIGRP in VRF-A with two neighbors: R2 and R3. R2 is a directly connected router, R3 is reachable via R2. The network is experiencing EIGRP stuck-in-active (SIA) routes for prefixes learned from R3. R1 configuration: router eigrp 100, address-family ipv4 vrf VRF-A, network 10.0.0.0. R2 is configured similarly. The link between R1 and R2 is a serial link with low bandwidth. What is the root cause?

Accepted Answer

The low-bandwidth serial link between R1 and R2 causes EIGRP query packets to be delayed, exceeding the active timer and resulting in SIA.. EIGRP SIA occurs when a query is sent to a neighbor and the reply is not received within the active timer (default 3 minutes). In a VRF-Lite scenario, if the query scope is not limited, the query may propagate to R3 via R2, but if the serial link has low bandwidth or high delay, the query may time out. However, the most common cause in VRF-Lite is that the query is sent to all neighbors, and if one neighbor (R2) does not reply due to a slow link, SIA occurs. The issue is that the query scope includes R2, but the link is slow, causing the active timer to expire.

Answer

The VRF configuration on R2 is missing the network statement for the link to R3.

Answer

EIGRP is not supported in VRF-Lite.

Answer

The active timer should be increased to prevent SIA.

Question 3

A network engineer is troubleshooting a route filtering problem with prefix-lists. Router R6 is using a prefix-list to filter routes from a BGP neighbor. The prefix-list is configured to permit only 192.168.0.0/16 and 192.168.1.0/24, but routes with prefix 192.168.2.0/24 are also being accepted. The engineer checks the prefix-list configuration and sees only two permit statements. What is the most likely cause?

Accepted Answer

The prefix-list is not applied to the BGP neighbor; the neighbor is using a different filter or no filter.. Prefix-lists have an implicit deny at the end, but if the prefix-list is not applied correctly (e.g., to the neighbor inbound direction), or if the prefix-list has a 'ge' or 'le' operator that is too broad, it could permit more than intended. However, the most common issue is that the prefix-list is not applied at all, or the neighbor is using a different filter.

Answer

The prefix-list has an implicit permit at the end for all routes.

Answer

The prefix-list is using 'ge 24' which permits any prefix with a mask >= 24, including 192.168.2.0/24.

Answer

The BGP neighbor is configured with 'soft-reconfiguration inbound' which overrides prefix-list filtering.

Question 4

Which TWO statements correctly describe the behavior of Policy-Based Routing (PBR) when using the 'set ip next-hop' and 'set ip default next-hop' commands? (Choose TWO.)

Accepted Answer

The 'set ip next-hop' command overrides the routing table only when the next-hop address is reachable; if unreachable, the packet is dropped unless a default route exists.. PBR uses route maps to override the routing table. The 'set ip next-hop' command is applied only if the packet matches the match criteria; if the next hop is unreachable, the packet is dropped (unless a default route exists). The 'set ip default next-hop' command is used only when the routing table has no explicit route for the destination. The 'set ip next-hop verify-availability' option tracks reachability using CEF. The 'set interface' command does not require a next-hop IP but can be used for directly connected networks.

Answer

The 'set ip default next-hop' command is used to forward packets that match the route-map permit statement, regardless of whether a route exists in the routing table.

Answer

The 'set ip next-hop verify-availability' feature uses ICMP echo requests to verify next-hop reachability before applying PBR.

Answer

If a route map with 'set ip next-hop' is applied inbound on an interface, PBR processes only the first packet of a flow; subsequent packets use the routing table.

Question 5

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The engineer also configures 'set ip default next-hop 10.0.0.3' in the same route-map sequence. Traffic that matches ACL 100 is forwarded to 10.0.0.2, but traffic that does not match ACL 100 is forwarded to 10.0.0.3 only if there is no route in the routing table. However, the engineer expects all unmatched traffic to go to 10.0.0.3 regardless of the routing table. What is the misunderstanding?

Accepted Answer

The 'set ip default next-hop' command overrides the routing table only when no route exists; the engineer wants unconditional forwarding.. The 'set ip default next-hop' command is used only when the packet does not have a matching route in the routing table. If a route exists (even a default route), the packet follows the routing table. The engineer should use 'set ip next-hop' instead of 'set ip default next-hop' to force all unmatched traffic to the next-hop.

Answer

The route-map sequence order is incorrect; the default next-hop should be in a separate sequence.

Answer

The ACL 100 is blocking all traffic, so no traffic matches the set commands.

Answer

The 'set ip default next-hop' command requires a 'set interface' command to work.

Question 6

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_RED and VRF_BLUE) configured with OSPF as the routing protocol. The engineer notices that OSPF neighborships are not forming between routers in VRF_RED. The 'show ip ospf neighbor' command shows no neighbors. What is the most likely cause?

Accepted Answer

The OSPF process is not configured with the 'vrf VRF_RED' command.. OSPF neighborships in VRF-Lite require that the OSPF process is associated with the correct VRF and that interfaces are placed in the correct VRF. Missing VRF association in the OSPF process or incorrect interface VRF assignment are common issues.

Answer

The OSPF process ID is not unique across VRFs.

Answer

The interfaces in VRF_RED are missing the 'ip ospf network point-to-point' command.

Answer

The 'router-id' command is missing in the OSPF process.

Question 7

An engineer configures PBR on a Cisco router using the following commands: 'route-map PBR permit 10', 'match ip address 100', 'set ip next-hop 10.1.1.1', and applies it inbound on interface GigabitEthernet0/1. Which TWO statements about this configuration are true? (Choose TWO.)

Accepted Answer

Packets that do not match ACL 100 will be forwarded using the normal routing table.. PBR is applied inbound on an interface. The route map matches packets using ACL 100. If the next hop is unreachable, the packet is forwarded using the routing table (if a default route exists) or dropped. PBR can be verified using 'show route-map' and 'debug ip policy'. The route map must be applied to the interface using 'ip policy route-map PBR'.

Answer

The command 'ip policy route-map PBR' must be applied under interface GigabitEthernet0/1 in global configuration mode.

Answer

If the next hop 10.1.1.1 becomes unreachable, packets that match ACL 100 will be dropped by default.

Answer

The route map must also include a 'match interface' statement to specify the incoming interface.

Question 8

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for traffic that is fragmented. What is the most likely reason?

Accepted Answer

PBR only matches the first fragment; subsequent fragments are forwarded based on the routing table because they lack Layer 4 headers.. PBR processes only the first fragment of a fragmented packet; subsequent fragments do not contain Layer 4 information (e.g., TCP/UDP ports) and may not match the ACL if it includes Layer 4 criteria. Additionally, PBR may not be applied to non-initial fragments by default, causing them to be forwarded normally.

Answer

The route-map is missing a 'match fragment' command.

Answer

Fragmented packets are always dropped by PBR.

Answer

The ACL in the route-map is using a 'deny' statement for fragmented packets.

Question 9

A network engineer is troubleshooting a VRF-Lite setup where two customer VRFs (VRF_A and VRF_B) are configured on a router. The engineer notices that routes from VRF_A are appearing in the routing table of VRF_B, causing traffic misdirection. The router is running IOS-XE 17.3. What is the most likely cause of this issue?

Accepted Answer

The 'route-target import' and 'route-target export' commands are misconfigured, causing VRF_A routes to be imported into VRF_B.. The issue is caused by route leaking between VRFs, which can occur if VRF route import/export configurations are misapplied or if routes are accidentally redistributed between VRFs. In VRF-Lite, VRFs are isolated by default, and any cross-VRF route sharing must be explicitly configured.

Answer

The router has 'ip routing' disabled globally.

Answer

The 'ip vrf forwarding' command is missing on the interfaces.

Answer

The router is running OSPF with the same process ID in both VRFs.

Question 10

Router R1 is leaking a summary route 10.0.0.0/8 from VRF-A into the global routing table, but hosts in the global table cannot reach subnet 10.1.1.0/24 within VRF-A. R1 configuration: ip vrf VRF-A, rd 100:1, route-target export 100:1, route-target import 100:1. Interface Gig0/0 in VRF-A has ip address 10.1.1.1 255.255.255.0. The leaking is done via route-map: route-map LEAK permit 10, match ip address prefix-list SUMMARY, set global. Prefix-list SUMMARY permits 10.0.0.0/8. What is the root cause?

Accepted Answer

The summary route 10.0.0.0/8 is being installed in the global table, but the more specific route 10.1.1.0/24 is not leaked, causing traffic to be dropped.. The summary route 10.0.0.0/8 covers the more specific subnet 10.1.1.0/24, but the route-map only leaks the summary, not the specific. When the global table has the summary, traffic to 10.1.1.0/24 is forwarded based on the summary, but since the specific route is not leaked, the packet may be dropped or sent to a null interface if the summary points to a discard. The issue is that the summary route does not provide reachability to the specific subnet because the specific route is not leaked.

Answer

The route-map should use match ip address prefix-list SPECIFIC instead of SUMMARY.

Answer

The VRF must have a default route to reach the global table.

Answer

The prefix-list should permit 10.1.1.0/24 only.

Question 11

What is the default administrative distance for OSPF routes in a VRF-Lite environment on Cisco IOS-XE?

Accepted Answer

110. OSPF has a default administrative distance of 110 for all routes (intra-area, inter-area, and external).

Answer

90

Answer

120

Answer

170

Question 12

Which TWO statements about PBR and the 'set ip tos' command are true? (Choose TWO.)

Accepted Answer

The 'set ip tos' command can use keywords such as 'min-delay', 'reliability', 'throughput', and 'low-cost' to set the ToS value.. PBR can modify the Type of Service (ToS) field in the IP header using 'set ip tos'. The ToS value can be specified as a decimal number (0-255) or using predefined keywords like 'min-delay', 'reliability', 'throughput', etc. The command affects only the ToS byte, not the entire DSCP field, though DSCP can be set using 'set ip dscp'. The ToS change is applied to packets that match the route-map permit sequence.

Answer

The 'set ip tos' command modifies the entire DSCP field in the IP header.

Answer

The 'set ip tos' command can be used in a route-map sequence with a 'deny' keyword to mark packets that are not policy-routed.

Answer

The 'set ip tos' command is applied to all packets that match the route-map, regardless of whether the packet is policy-routed or forwarded normally.

Question 13

A network engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 via next-hop 192.168.1.2. The route-map uses match ip address and set ip next-hop commands. However, traffic sourced from 10.1.1.5 still follows the routing table instead of the PBR policy. What is the most likely cause?

Accepted Answer

The router is generating the traffic locally (e.g., ping from the router), and PBR does not apply to local packets without 'ip local policy route-map'.. PBR processes only transit traffic; locally generated packets (e.g., from the router itself) are not affected by PBR unless the 'ip local policy route-map' command is used. The engineer must apply PBR globally for local packets.

Answer

The route-map is applied to the wrong interface (outbound instead of inbound).

Answer

The ACL in the route-map is missing a permit statement for subnet 10.1.1.0/24.

Answer

The next-hop 192.168.1.2 is not reachable via any directly connected interface.

Question 14

A network engineer is troubleshooting a VRF-Lite deployment where a router is configured with VRF_ORANGE. The engineer attempts to configure a static route in VRF_ORANGE using the command 'ip route vrf VRF_ORANGE 192.168.10.0 255.255.255.0 10.1.1.1', but the route does not appear in the routing table. The 'show ip route vrf VRF_ORANGE' does not show the static route. What is the most likely cause?

Accepted Answer

The next-hop IP address 10.1.1.1 is not reachable in VRF_ORANGE.. Static routes in VRF-Lite require that the next-hop IP address is reachable within the same VRF. If the next-hop is not in the VRF's routing table, the static route will not be installed.

Answer

The 'ip classless' command is disabled.

Answer

The static route is missing the 'permanent' keyword.

Answer

The router has 'no ip routing' configured.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip route vrf BLUE

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
C        10.1.2.0/24 is directly connected, GigabitEthernet0/1
O        10.2.0.0/16 [110/20] via 10.1.1.2, 00:00:15, GigabitEthernet0/0

Based on this output, what is the problem?

Accepted Answer

The OSPF route was learned 15 seconds ago, indicating a recent flap.. The output shows the routing table for VRF BLUE. It has two connected routes and one OSPF route. The OSPF route (10.2.0.0/16) has been learned recently (00:00:15), which may indicate a flapping neighbor or recent convergence. However, the key observation is that the OSPF route's next hop is 10.1.1.2, which is reachable via GigabitEthernet0/0. The output is normal; no problem is evident. But if the question implies a problem, it might be that the OSPF route age is very recent, suggesting instability. However, the correct answer here is that the VRF routing table is correctly populated.

Answer

The OSPF route 10.2.0.0/16 has a next hop of 10.1.1.2, which is unreachable.

Answer

The VRF BLUE has no default route, which is a problem.

Answer

The connected routes are not in the routing table.

Question 16

An engineer configures PBR with a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The route-map is applied inbound on interface GigabitEthernet0/1. Traffic from a host on that interface is forwarded via 10.0.0.2, but the engineer notices that packets with destination IP 10.0.0.2 itself are also being redirected, causing a loop. Why does this happen?

Accepted Answer

The set ip next-hop command does not check if the next-hop is the router itself, so packets destined to the router are forwarded instead of being processed locally.. PBR processes all incoming packets, including those destined to the router itself. If the set next-hop points to the router's own IP, packets to that IP are forwarded back out, creating a loop. The route-map should include a match clause to exclude traffic destined to the router.

Answer

The ACL 100 inadvertently matches the router's own IP address as source.

Answer

PBR is applied outbound, causing packets to the router to be re-routed.

Answer

The route-map has a default route that sends all traffic to 10.0.0.2.

Question 17

A network engineer runs the following command to troubleshoot a VRF-Lite CoPP issue:

R1# show policy-map control-plane input class CoPP-ACL vrf CUSTOMER_I

Output:
  Class-map: CoPP-ACL (match-all)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: access-group 100
    police:
        cir 8000 bps, bc 1500 bytes, be 1500 bytes
      conformed 0 packets, 0 bytes; actions:
        transmit
      exceeded 0 packets, 0 bytes; actions:
        drop
      violated 0 packets, 0 bytes; actions:
        drop

What does this output indicate?

Accepted Answer

The CoPP policy is rate-limiting traffic to 8000 bps, but no traffic has matched the class yet.. The 'show policy-map control-plane input class vrf' command displays CoPP policy statistics for a specific VRF. The output shows class CoPP-ACL matching access-group 100, with a police rate of 8000 bps. All counters are zero, indicating no traffic has matched this class. This could mean the ACL is not matching any packets, or no traffic is being sent to the control plane for this VRF.

Answer

The CoPP policy is dropping all packets that match access-group 100.

Answer

The CoPP policy has matched many packets and is dropping them due to exceeding the rate.

Answer

The CoPP policy is not applied to the control plane for this VRF.

Question 18

An engineer configures PBR with a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also enables 'ip cef' globally. Traffic from 192.168.1.0/24 is not being policy-routed; instead, it follows the routing table. What is the most likely cause?

Accepted Answer

The interface needs the 'ip route-cache policy' command to enable CEF support for PBR.. PBR and CEF interact in a specific way: PBR is processed in software (process switching) by default, but CEF-switched packets bypass PBR unless 'ip route-cache policy' is enabled on the interface. Without this command, CEF fast-switches packets, ignoring PBR.

Answer

CEF is disabled globally, causing PBR to fail.

Answer

The route-map is missing a 'set interface' command.

Answer

The ACL in the route-map is using a named ACL instead of a numbered one.

Question 19

An engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 to next-hop 192.168.1.2. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. However, the engineer notices that PBR is not working for multicast traffic from that subnet. What is the most likely explanation?

Accepted Answer

PBR is not supported for multicast traffic; multicast uses its own forwarding mechanisms.. PBR does not process multicast traffic by default. Multicast packets are forwarded using multicast routing protocols (e.g., PIM) and are not subject to PBR. To apply PBR to multicast, special configuration (e.g., 'ip multicast policy route-map') is required.

Answer

The ACL in the route-map is blocking multicast addresses.

Answer

The next-hop 192.168.1.2 is not a multicast-capable router.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command.

Question 20

A network engineer is troubleshooting a VRF-Lite scenario where a router is configured with two VRFs (VRF_X and VRF_Y). The engineer notices that routes from VRF_X are not being advertised to the neighbor router via eBGP. The BGP configuration includes 'neighbor 10.1.1.2 remote-as 65002' under the VRF_X BGP address-family. The 'show bgp vpnv4 unicast all neighbors' command shows the BGP session is established. What is the most likely cause?

Accepted Answer

The 'network' command for the prefix is configured under the global BGP configuration, not under the VRF address-family.. In VRF-Lite with BGP, routes must be explicitly injected into the VRF BGP table. Missing the 'network' command or redistribution under the VRF address-family is a common issue.

Answer

The BGP session is not using the correct update-source interface.

Answer

The 'maximum-paths' command is set to 1.

Answer

The 'bgp router-id' command is missing.