300-410 Practice Exam 68 — 20 Questions

Question 1

Which BGP message type is sent when a fatal error is detected, causing the BGP session to close?

Accepted Answer

NOTIFICATION. NOTIFICATION messages are sent to report errors and terminate the BGP session.

Answer

OPEN

Answer

UPDATE

Answer

KEEPALIVE

Question 2

A network engineer runs the following command on Router PE5:

PE5# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.7          1   FULL/DR        00:00:32    10.1.1.7        GigabitEthernet0/0
10.0.0.8          1   FULL/BDR       00:00:35    10.2.2.8        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

Both OSPF adjacencies are fully established.. The show ip ospf neighbor output displays two OSPF neighbors in FULL state, one as DR and one as BDR. This indicates that OSPF adjacencies are fully established and functioning correctly.

Answer

One neighbor is in the EXSTART state.

Answer

The router is not the DR for any segment.

Answer

There is a mismatch in OSPF area IDs.

Question 3

Consider the following EEM applet configuration:

!---
event manager applet INTERFACE_DOWN
event syslog pattern "%LINEPROTO-5-UPDOWN"
action 1.0 if $syslog_severity eq 5
action 2.0 cli command "enable"
action 3.0 cli command "clear counters"
!---

What will happen when a syslog message matching the pattern is generated?

Accepted Answer

The applet will execute the CLI commands unconditionally because the 'if' action is misconfigured.. The applet uses an 'if' action to check the syslog severity. If the severity is 5 (notification), the CLI commands are executed. However, the 'if' action is not closed with an 'end' statement, which is required. As a result, the applet will encounter a syntax error and may not execute correctly, or the CLI commands may be executed unconditionally depending on the IOS version.

Answer

The applet will execute the CLI commands only if the syslog severity is exactly 5.

Answer

The applet will fail to register because the 'if' action requires an 'else' clause.

Answer

The applet will clear the counters only for the interface that generated the syslog message.

Question 4

Consider the following EEM applet configuration:

!---
event manager applet HIGH_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt entry-val 90 poll-interval 10
action 1.0 syslog msg "CPU utilization exceeded 90%"
!---

What is the problem with this configuration?

Accepted Answer

The OID is a scalar, so 'entry-op' and 'entry-val' cannot be used; they are only for table entries.. The 'event snmp oid' command requires a 'get-type' of 'exact' or 'next', but the OID specified is for a specific instance (cpmCPUTotal5sec). However, the OID is not complete; it should include the instance index. Additionally, the 'entry-op' and 'entry-val' are used for table entries, but this OID is a scalar. The correct approach is to use 'event snmp oid' with a scalar OID and use 'poll-interval' with 'entry-op' and 'entry-val' only for table entries. This configuration may cause the applet to not trigger correctly.

Answer

The 'poll-interval' is too short and will cause high CPU usage.

Answer

The applet will work correctly and generate a syslog message when CPU exceeds 90%.

Answer

The 'get-type exact' is incorrect; it should be 'get-type next'.

Question 5

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy registered

No.  Class        Type    Version   Time Created          Name
  1  applet       system  1.0       Mar 1 00:00:12 2025  TRACK-INTERFACE
  2  applet       system  1.0       Mar 1 00:00:15 2025  BGP-RESET
  3  applet       user    1.0       Mar 1 00:02:30 2025  LOG-ERROR

What does this output indicate?

Accepted Answer

Three EEM applets are registered, including two system-defined and one user-defined.. The output shows three registered EEM applets. The 'Class' column indicates whether the applet is system-defined or user-defined. 'Type' is always 'applet' for EEM applets. 'Time Created' shows when the applet was registered. The 'Name' is the applet name. This output confirms that the applets are registered and available for execution.

Answer

Three EEM applets are registered, all user-defined.

Answer

Three EEM applets are registered, all system-defined.

Answer

The output shows the EEM applets that are currently executing.

Question 6

A network engineer configures EEM to monitor CPU usage on R1. R1 has: event manager applet CPU-MONITOR event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 80 poll-interval 5 action 1.0 cli command "enable" action 2.0 cli command "show processes cpu sorted" action 3.0 syslog msg "High CPU usage detected". After a few hours, the engineer notices that the applet triggers repeatedly, but the show command output is truncated. Router R2 shows: no issues. What is the root cause?

Accepted Answer

The EEM applet runs too frequently (every 5 seconds), consuming CPU and causing output truncation.. The EEM applet triggers every 5 seconds when CPU exceeds 80%, and each execution runs the show command, which itself consumes CPU. This can create a feedback loop where the applet increases CPU usage, causing more triggers. Additionally, the show command output may be truncated if the applet runs too frequently or the buffer is insufficient. The correct fix is to increase the poll interval or add a throttle.

Answer

The SNMP OID is for 5-second CPU, not 1-minute average, causing false positives.

Answer

The 'show processes cpu sorted' command requires a terminal length setting.

Answer

The applet should use 'event manager applet CPU-MONITOR trigger' to start.

Question 7

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Accepted Answer

The EIGRP neighbor down event has occurred once.. The output shows one registered EEM applet policy and one triggered event. The correct answer is that the EIGRP neighbor down event has occurred once.

Answer

The EIGRP neighbor is currently down.

Answer

The EEM policy is disabled.

Answer

The EIGRP neighbor is flapping.

Question 8

Which THREE symptoms indicate a BGP route dampening issue that is causing routes to be suppressed? (Choose THREE.)

Accepted Answer

The show ip bgp command displays the route with a 'd' status code.. Route dampening suppresses routes that flap frequently. Symptoms include routes showing as 'dampened' in the BGP table, routes being absent from the routing table despite being in the BGP table, and the show ip bgp dampened-paths command listing those routes. Option A is incorrect because dampening does not affect the neighbor state. Option E is incorrect because the prefix-list is not directly related to dampening.

Answer

The BGP neighbor state flaps between Established and Idle.

Answer

The show ip prefix-list command indicates that routes are being filtered.

Question 9

Drag and drop the steps to establish an eBGP session between two IOS routers into the correct order, from first to last.

Accepted Answer

Configure BGP router ID under router bgp. The correct order starts with configuring the BGP router ID, then the local AS and neighbor remote AS, followed by specifying the neighbor update source, enabling the neighbor, and finally verifying the session.

Question 10

Which TWO statements about IP SLA responder configuration are true? (Choose TWO.)

Accepted Answer

The 'ip sla responder' command must be configured on the destination device for UDP jitter probes to obtain accurate round-trip time.. The IP SLA responder is a component that listens for probe requests and sends replies. It is required for certain probe types like UDP jitter and TCP connect to ensure accurate measurements. The responder must be enabled on the destination device with the 'ip sla responder' global command. It does not require a specific port for ICMP echo, and it does not automatically adjust timestamps without the 'timestamp' option.

Answer

The responder is automatically enabled on all Cisco routers running IOS 15.0 or later.

Answer

The ICMP echo probe type requires the responder to be configured on the destination for accurate results.

Answer

The responder can provide hardware-based timestamping to improve accuracy when the 'timestamp' option is configured.

Question 11

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Accepted Answer

The EEM policy is registered but not yet triggered because the OSPF neighbor is up.. The EEM policy OSPF_Neighbor_Down is registered, but the OSPF neighbor is in FULL state. The correct answer is that the EEM policy has not been triggered because the OSPF neighbor is up.

Answer

The OSPF neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 12

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?

Accepted Answer

The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.. The EEM applet triggers on any BGP notification syslog and then executes a clear ip bgp * command, which resets all BGP sessions. This creates a loop: a BGP notification causes a clear, which causes more notifications, leading to persistent flapping. The correct fix is to make the applet more specific or avoid clearing all sessions.

Answer

The BGP keepalive timer is set too low on R1.

Answer

The syslog pattern is incorrect and matches unrelated messages.

Answer

There is an MTU mismatch between R1 and R2.

Question 13

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern occurs period '.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.

Question 14

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001, (received & used)
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: 100:200

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a community attribute of 100:200, which may affect routing decisions.. The show bgp output for a specific prefix shows one path with community 100:200 attached. The community is a BGP community value that can be used for route tagging and policy enforcement. The path is valid and best.

Answer

The prefix 192.168.1.0/24 is not installed in the routing table.

Answer

The prefix 192.168.1.0/24 is being filtered due to the community value.

Answer

The community 100:200 indicates the prefix is from a confederation.

Question 15

An engineer enables unicast RPF (uRPF) in strict mode on an interface. Afterward, some legitimate traffic from a BGP neighbor is dropped. The neighbor has two paths to the router, and traffic may arrive on a different interface than the return path. What is the most likely explanation?

Accepted Answer

Strict uRPF drops packets if the source IP is not reachable via the receiving interface, which fails in asymmetric routing scenarios.. Strict uRPF checks that the source IP of incoming packets matches the routing table entry for the interface it arrived on. If asymmetric routing occurs, packets from a valid neighbor may arrive on a different interface than the return path, causing them to be dropped.

Answer

The uRPF 'allow-default' option was not configured, so default routes are ignored.

Answer

The neighbor's BGP updates have a source IP that is not in the routing table.

Answer

Loose mode should be used instead, but strict mode was configured by mistake.

Question 16

A network engineer is troubleshooting a route redistribution issue between two OSPF processes. Router R1 runs OSPF process 1 and OSPF process 2, and redistributes routes between them. The engineer notices that routes from OSPF process 1 are not appearing in the OSPF database of process 2, even though the redistribute command is configured. The show ip ospf database command on R1 for process 2 shows no external routes. What is the most likely cause?

Accepted Answer

The redistribute ospf 1 command under OSPF process 2 is missing the subnets keyword.. When redistributing between OSPF processes, the redistribute command must include the subnets keyword to redistribute classless subnets. Without it, only classful networks are redistributed, which may cause many routes to be missing.

Answer

OSPF process 1 has a higher administrative distance than OSPF process 2.

Answer

The redistribute ospf 1 command under OSPF process 2 is missing the match internal keyword.

Answer

OSPF process 2 has a route map applied that is filtering all routes.

Question 17

An engineer configures BFD on an OSPF link that is part of a virtual link. The BFD session between the two endpoints of the virtual link is up, but OSPF adjacency over the virtual link is not forming. What is the most likely explanation?

Accepted Answer

BFD cannot be used with OSPF virtual links; BFD only works on physical interfaces.. BFD does not support virtual links in OSPF. BFD can only be configured on physical interfaces or subinterfaces, not on virtual links. Therefore, even if BFD is up on the underlying physical link, it will not help detect failures of the virtual link. The virtual link adjacency may fail due to other issues, such as mismatched area IDs or authentication.

Answer

The virtual link is configured with a different hello interval than the BFD interval, causing a mismatch.

Answer

The 'bfd all-interfaces' command is not configured under the OSPF process, so OSPF ignores BFD for virtual links.

Answer

The virtual link is using a different authentication type than the BFD session.

Question 18

Which TWO commands can be used to troubleshoot an Embedded Event Manager (EEM) applet that is not triggering as expected? (Choose TWO.)

Accepted Answer

debug event manager action all. The 'debug event manager action all' command provides detailed logs of EEM actions, while 'show event manager detector all' shows the status of all EEM detectors (including whether they are registered). The other options are either not valid or not useful for troubleshooting trigger issues.

Answer

show event manager policy registered

Answer

show event manager environment all

Answer

debug event manager all

Question 19

A service provider network is experiencing MPLS label distribution failures between R1 and R2. R1 has: event manager applet LDP-MONITOR event syslog pattern "%LDP-4-ERROR" action 1.0 cli command "enable" action 2.0 cli command "clear mpls ldp neighbor *" action 3.0 syslog msg "Cleared LDP neighbors". Router R2 shows: LDP session is down, and logs show repeated LDP errors. What is the root cause?

Accepted Answer

The EEM applet clears all LDP neighbors upon any LDP error, preventing the session from stabilizing.. The EEM applet triggers on any LDP error and clears all LDP neighbors. This removes the LDP session, causing more errors when the session tries to re-establish, leading to a cycle of failures. The correct fix is to clear only the affected neighbor or address the underlying LDP issue.

Answer

The LDP router-id is misconfigured on R1.

Answer

The syslog pattern matches only severity 4, but LDP errors are severity 3.

Answer

The MPLS label range is exhausted on R1.

Question 20

A network engineer runs the following command on Router R1:

R1# show route-map REDISTRIBUTE
route-map REDISTRIBUTE, permit, sequence 10
  Match clauses:
    ip address prefix-list EIGRP_ROUTES
  Set clauses:
    metric 100
    metric-type type-1
    tag 200
  Policy routing matches: 0 packets, 0 bytes

route-map REDISTRIBUTE, deny, sequence 20
  Match clauses:
    ip address prefix-list DENY_ALL
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, what is the problem?

Accepted Answer

The route-map has a deny sequence that may block all routes if prefix-list DENY_ALL is configured to permit all.. The route-map has a deny sequence 20 that matches prefix-list DENY_ALL. If DENY_ALL is configured to permit all (e.g., permit 0.0.0.0/0 le 32), then all routes will be denied after sequence 10, effectively blocking redistribution. The problem is that the deny sequence may unintentionally block routes that should be redistributed.

Answer

The route-map will redistribute all routes that match prefix-list EIGRP_ROUTES with metric 100 and type-1.

Answer

The route-map will only redistribute routes with tag 200.

Answer

The route-map is not applied to any redistribution command, so it has no effect.