300-410 Practice Exam 68 — 20 Questions

Question 1

A network engineer runs the following command to troubleshoot an MPLS LDP issue:

R1# debug mpls ldp transport
LDP: Transport connection to 2.2.2.2:0 via TCP (passive)
LDP: Connection from 2.2.2.2:0 to 1.1.1.1:646
LDP: Transport connection to 2.2.2.2:0 via TCP (active)
LDP: Connection from 1.1.1.1:646 to 2.2.2.2:0
LDP: Hold timer expired for peer 2.2.2.2:0
LDP: Closing transport connection to 2.2.2.2:0

What does this output indicate?

Accepted Answer

LDP session is flapping due to hold timer expiration.. The output shows the LDP hold timer expiring for peer 2.2.2.2, followed by the transport connection being closed. This indicates the LDP session is repeatedly going up and down (flapping) because the hold timer expires before the session can stabilize, often due to network congestion, high CPU, or mismatched hello/hold timers. Option B correctly identifies this flapping behavior caused by hold timer expiration.

Answer

LDP session is established and stable.

Answer

LDP session is down because of authentication failure.

Answer

LDP session is down because of a transport address mismatch.

Question 2

A network engineer runs the following command on Router R1:

R1# show bfd neighbors detail

IPv4 Sessions
NeighborAddr      LD/RD         Int        State         Holdown(mult)  Intf
10.1.1.2          1/3           Gi0/0      Up            1500(3)        Gi0/0

Session state is UP and not using echo function.
OurAddr: 10.1.1.1
Handle: 1
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 1500(0)
Rx Count: 120, Tx Count: 150

Based on this output, which statement is correct?

Accepted Answer

The BFD session is up and the holddown timer is 1500 ms, which is correct based on the configured multiplier and MinRxInt.. The output shows BFD session details. The Holddown value of 1500 ms is calculated as MinRxInt * Multiplier (1000 ms * 3 = 3000 ms), but the output shows 1500 ms. This discrepancy indicates a misconfiguration or a bug, but the key point is that the session is UP and the holddown timer is 1500 ms, which is half of the expected value. However, the correct interpretation is that the BFD session is established and operating, and the holddown timer is 1500 ms as shown.

Answer

The BFD session is down because the holddown timer is incorrect.

Answer

The BFD session is using echo mode, which is why the holddown timer is 1500 ms.

Answer

The BFD session is up but the multiplier is set to 1, causing the holddown timer to be 1500 ms.

Question 3

An engineer configures ERSPAN on a Cisco router to send mirrored traffic to a remote collector via IP. The collector receives the ERSPAN packets, but the payload appears truncated or malformed. What is the most likely cause?

Accepted Answer

The ERSPAN GRE encapsulation adds overhead exceeding the path MTU, causing fragmentation or drop.. ERSPAN encapsulates mirrored packets in GRE with an additional ERSPAN header. The MTU of the path between the source and collector must accommodate the extra overhead (typically 50 bytes for GRE + ERSPAN). If the path MTU is too small, packets are fragmented or dropped, causing truncation.

Answer

The collector is not configured to reassemble IP fragments.

Answer

The ERSPAN session is configured with the wrong source interface, causing incorrect IP headers.

Answer

The router has IPsec configured on the egress interface, encrypting the ERSPAN packets.

Question 4

What is the default CoPP policer action for packets that exceed the committed information rate (CIR)?

Accepted Answer

Drop. The default action for a Control Plane Policing (CoPP) policy-map class when traffic exceeds the committed information rate (CIR) is to drop the excess packets. This is because CoPP uses a single-rate, two-color policer by default, where packets conforming to the CIR are marked as 'conform' and transmitted, while packets exceeding the CIR are marked as 'exceed' and dropped. No default 'violate' action exists unless explicitly configured.

Answer

Transmit with best-effort

Answer

Set DSCP to 0

Answer

Queue for later transmission

Question 5

A network engineer runs the following command on Router PE2:

PE2# show ip bgp vpnv4 vrf CUSTOMER_A 10.10.10.0 24
BGP routing table entry for 10.10.10.0/24, version 15
Paths: (1 available, best #1, table CUSTOMER_A)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  Local, imported path from 10.10.10.0/24
    10.1.1.1 (metric 20) from 10.1.1.1 (10.1.1.1)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:100:100
      mpls labels in/out 18/19

Based on this output, what is the problem?

Accepted Answer

The route is functioning correctly with no issues.. The output shows a valid BGP VPNv4 route in the VRF CUSTOMER_A. The route is marked as 'best' and has the extended community RT:100:100, which is the route target. It is advertised to update-groups, and MPLS labels are present. There is no indication of a problem; the route is functioning correctly.

Answer

The route is not being advertised to any BGP peer.

Answer

The route is missing the required Route Target community.

Answer

The route has an incorrect label binding.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip bgp vpnv4 vrf RED summary

BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 5, main routing table version 5
4 network entries using 576 bytes of memory
4 path entries using 320 bytes of memory
2/1 BGP path/bestpath attribute entries using 320 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1216 total bytes of memory
BGP activity 4/0 prefixes, 4/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4        65001      23      25        5    0    0 00:12:34        2
10.1.2.2        4        65002      18      20        5    0    0 00:10:15        1

Based on this output, which statement is correct?

Accepted Answer

Both BGP neighbors are in the Established state.. The 'show bgp vpnv4 vrf RED summary' command displays BGP neighbors for VRF RED. It shows two neighbors: 10.1.1.2 (AS 65001) and 10.1.2.2 (AS 65002). Both are in the Established state with prefixes received. The neighbor 10.1.1.2 has received 2 prefixes, and 10.1.2.2 has received 1 prefix.

Answer

Neighbor 10.1.2.2 is in the Idle state.

Answer

The local AS number is 65002.

Answer

Neighbor 10.1.1.2 is in AS 65002.

Question 7

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. Duplicate SNMP traps are being generated because two EEM applets are both triggered by the same syslog pattern and both execute an SNMP trap action. Removing one of the duplicate applets eliminates the redundant trigger and restores a single trap per event. This is the direct, root-cause fix.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip dhcp server statistics
Memory usage         26140
Address conflicts    0

Pool statistics

Pool              IP addresses    Requests     Offers      Acks     Naks     Declines     Releases
  POOL1             10-20           50           45          40       5        2            3

Based on this output, which statement is correct?

Accepted Answer

The DHCP server is rejecting requests (Naks) and clients are declining offers, indicating possible pool exhaustion or address conflicts.. The output shows 5 NAKs and 2 Declines, indicating that the DHCP server is rejecting requests (NAKs) and clients are declining offers (Declines). NAKs typically occur when a client requests an IP address that is no longer valid or available, while Declines happen when a client detects an address conflict via ARP. This combination strongly suggests pool exhaustion or address conflicts, making option B correct.

Answer

The DHCP server is operating without any issues.

Answer

The DHCP server has a memory problem.

Answer

The DHCP server has no address conflicts.

Question 9

Router R9 is configured with SNMP and NetFlow. The NMS uses SNMP to poll NetFlow statistics. The configuration includes: snmp-server community public RO, snmp-server enable traps netflow. However, the NMS cannot poll NetFlow MIB objects. The router's show snmp mib shows that the NetFlow MIB is not loaded. What is the root cause?

Accepted Answer

The NetFlow MIB is not loaded because NetFlow data export is not configured; the 'ip flow-export' command is missing.. The NetFlow MIB is only loaded into the router's SNMP agent when NetFlow data export is actively configured. Without the 'ip flow-export' command, the router does not instantiate the NetFlow MIB objects, so 'show snmp mib' reports the MIB as not loaded. The NMS cannot poll statistics that do not exist in the SNMP agent's MIB tree.

Answer

The SNMP community string does not have read access to the NetFlow MIB.

Answer

The router's SNMP agent is not compatible with the NetFlow MIB.

Answer

The NMS is using an incorrect OID for NetFlow statistics.

Question 10

By default in Cisco IOS-XE, what is the behavior of an IPv4 ACL when no entries match and the ACL is applied to an inbound interface?

Accepted Answer

The packet is denied.. By default, Cisco IOS-XE applies an implicit 'deny any' statement at the end of every IPv4 ACL. If no entries match the packet, the implicit deny triggers, and the packet is dropped. This behavior is consistent for ACLs applied to inbound interfaces, ensuring that only explicitly permitted traffic is allowed.

Answer

The packet is permitted.

Answer

The packet is forwarded based on routing table lookup.

Answer

The ACL logs the packet and continues.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip dhcp relay information trusted
Interface                Trusted
GigabitEthernet0/1       Yes
GigabitEthernet0/2       No

Based on this output, which statement is correct?

Accepted Answer

DHCP relay information is trusted on GigabitEthernet0/1, so option 82 packets are accepted on that interface.. The command 'show ip dhcp relay information trusted' displays the trust status of each interface for DHCP relay information (option 82). When an interface is marked as 'Yes' under the Trusted column, it means the router will accept and forward DHCP packets that already contain option 82 information from that interface. Therefore, on GigabitEthernet0/1, option 82 packets are accepted.

Answer

DHCP relay information is trusted on both interfaces.

Answer

DHCP relay information is not configured on any interface.

Answer

DHCP relay information is trusted on GigabitEthernet0/2, so option 82 packets are dropped.

Question 12

Router R4 has the following DHCPv6 configuration:

ipv6 dhcp pool DHCP6_POOL2
 address prefix 2001:db8:2::/64
 dns-server 2001:db8::1
!
interface GigabitEthernet0/1
 ipv6 address 2001:db8:2::1/64
 ipv6 dhcp server DHCP6_POOL2
 ipv6 nd managed-config-flag
 no shutdown

What is the effect of this configuration?

Accepted Answer

Hosts will use DHCPv6 to obtain both their IPv6 address and other configuration parameters like DNS.. The configuration uses the `ipv6 nd managed-config-flag` command, which sets the Managed Address Configuration flag (M flag) in Router Advertisement (RA) messages. When the M flag is set to 1, hosts are instructed to use DHCPv6 (stateful DHCPv6) to obtain their IPv6 addresses, not SLAAC. Additionally, the DHCPv6 pool provides DNS server information, so hosts will use DHCPv6 for both addressing and other configuration parameters like DNS. This matches option A.

Answer

Hosts will use SLAAC for addressing and DHCPv6 for DNS only.

Answer

The DHCPv6 pool is missing a domain-name, so it will not provide any configuration.

Answer

The ipv6 nd managed-config-flag command is incompatible with the DHCPv6 server and will cause an error.

Question 13

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp interface GigabitEthernet0/1
GigabitEthernet0/1 is in server mode
  Using pool: POOL6
  Preference value: 0
  Hint from client: ignored
  Rapid-Commit: disabled

Based on this output, which statement is correct?

Accepted Answer

The interface is configured as a DHCPv6 server using pool POOL6.. The command output explicitly states 'GigabitEthernet0/1 is in server mode' and 'Using pool: POOL6', which confirms that the interface is acting as a DHCPv6 server. The DHCPv6 server assigns IPv6 addresses and other configuration parameters from the specified pool to requesting clients.

Answer

The interface is configured as a DHCPv6 client.

Answer

The interface is using rapid-commit for faster address assignment.

Answer

The interface is in DHCPv6 relay mode.

Question 14

A network engineer configures CoPP on a router that is a DMVPN hub. The policy includes a class-map to match NHRP traffic and police it. After deployment, spoke-to-spoke tunnels fail to establish, although spoke-to-hub tunnels work. Which is the most likely explanation?

Accepted Answer

The CoPP policy polices NHRP traffic, causing NHRP redirect packets from the hub to be dropped, so spokes cannot learn each other's addresses.. In a DMVPN hub-and-spoke topology, spoke-to-spoke tunnels rely on NHRP redirect messages from the hub to learn each other's public addresses. If CoPP polices NHRP traffic too aggressively, the hub may drop NHRP redirect packets before they reach the spokes. Without these redirects, spokes cannot initiate direct tunnels, even though spoke-to-hub communication (which uses the hub as a relay) remains functional.

Answer

The CoPP policy drops IPsec packets, which are used for spoke-to-spoke encryption.

Answer

The CoPP policy is applied to the tunnel interface, not the control plane.

Answer

The CoPP policy uses the default class class-default, which blocks NHRP.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TRACK

R1# show route-map PBR-TRACK
route-map PBR-TRACK, permit, sequence 10
  Match clauses:
    ip address (access-lists): 170
  Set clauses:
    ip next-hop verify-availability 10.0.0.2 10 track 2
  Policy routing matches: 100 packets, 8000 bytes

R1# show track 2
Track 2
  IP SLA 2 reachability
  Reachability is Up
    2 changes, last change 00:01:30
  Latest operation return code: ok
  Tracked by:
    ROUTE-MAP 0

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely behavior for packets matching ACL 170?

Accepted Answer

Packets are forwarded to 10.0.0.2.. The route-map PBR-TRACK sets the next-hop to 10.0.0.2 with verify-availability and track 2. The show track 2 output indicates that IP SLA 2 reachability is Up, meaning the tracked object is available. Therefore, the policy-based routing will forward matching packets to 10.0.0.2. The route to 10.0.0.2 exists via EIGRP, confirming reachability.

Answer

Packets are forwarded using the routing table because the next-hop is not reachable.

Answer

Packets are dropped because the track object is not configured correctly.

Answer

Packets are load-balanced between the next-hop and the routing table.

Question 16

A network engineer is troubleshooting a route redistribution issue between RIP and OSPF. Router R1 runs both RIP and OSPF, and redistributes RIP routes into OSPF. The engineer notices that RIP routes are not appearing in the OSPF database on neighboring routers. The show ip ospf database external command on a neighbor shows no external routes from R1. The redistribute rip command is configured under OSPF on R1. What is the most likely cause?

Accepted Answer

The redistribute rip command under OSPF is missing the subnets keyword.. When redistributing routes into OSPF, the subnets keyword is required to include subnetted routes. Without it, only classful network routes are redistributed, so RIP routes that are subnetted (e.g., /24) will not appear as external LSAs in the OSPF database. The symptom of no external routes in the OSPF database on neighbors, despite the redistribute rip command, points directly to the missing subnets keyword.

Answer

RIP has a higher administrative distance than OSPF.

Answer

The OSPF process on R1 has a distribute-list blocking these routes.

Answer

The RIP process on R1 is not running.

Question 17

What is the default value for the 'active flow timeout' in a Flexible NetFlow monitor on Cisco IOS-XE?

Accepted Answer

30 minutes. The default active flow timeout is 30 minutes, after which long-lived flows are exported regardless of activity.

Answer

15 minutes

Answer

60 minutes

Answer

5 minutes

Question 18

Router R2 has the following configuration:
```
interface GigabitEthernet0/2
 ip address 10.2.2.2 255.255.255.0
 ip policy route-map CHECK
!
route-map CHECK permit 10
 match ip address 101
 set interface GigabitEthernet0/3
!
access-list 101 permit tcp any any eq 80
```
What is the effect of this configuration?

Accepted Answer

Incoming TCP packets with destination port 80 on G0/2 are forwarded out G0/3, overriding the routing table.. The route-map matches TCP traffic with destination port 80 (HTTP) and sets the output interface to GigabitEthernet0/3. This is applied inbound on GigabitEthernet0/2.

Answer

Outgoing TCP packets with source port 80 on G0/2 are forwarded out G0/3.

Answer

All TCP traffic is forwarded out G0/3 regardless of port.

Answer

The configuration is invalid because 'set interface' cannot be used with a route-map.

Question 19

Consider this partial configuration:

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/2
 ip address 172.16.0.1 255.255.255.0
 ip nat inside

What is true about traffic from the 172.16.0.0/24 network?

Accepted Answer

It is not translated and will be forwarded with its original source IP.. The NAT configuration uses an access-list (list 1) that only matches traffic from the 192.168.1.0/24 network. Traffic sourced from the 172.16.0.0/24 network does not match this access-list, so it is not subject to NAT translation. As a result, the router forwards packets from 172.16.0.0/24 with their original source IP address unchanged.

Answer

It is translated using PAT to 203.0.113.1.

Answer

It is dropped because NAT is required for all inside interfaces.

Answer

It is translated using a different pool because it is on a separate inside interface.

Question 20

A network engineer runs the following command on Router R6:

R6# show logging | include %SEC-6-IPACCESSLOGP

*Mar  1 00:01:15.123: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12345) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:20.456: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12346) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:25.789: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12347) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:30.012: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12348) -> 192.168.1.1(80), 1 packet

Based on this output, what is the most likely problem?

Accepted Answer

A host at 10.0.0.100 is attempting to access a web server at 192.168.1.1 and is being blocked by the ACL.. The output shows repeated denied packets from source 10.0.0.100 to destination 192.168.1.1 on port 80 (HTTP). This indicates that a host at 10.0.0.100 is trying to access a web server at 192.168.1.1 but is being blocked by ACL ACL_INBOUND. The pattern suggests a possible scan or attack, or a legitimate access that is being denied due to misconfiguration.

Answer

The ACL ACL_INBOUND is permitting traffic from 10.0.0.100 to 192.168.1.1 on port 80.

Answer

The router is experiencing a DoS attack from 192.168.1.1.

Answer

The ACL ACL_INBOUND is not configured on any interface.