300-410 Practice Exam 69 — 20 Questions

Question 1

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic matching ACL 100. The engineer also configures 'set ip default next-hop 10.0.0.3' in the same route-map sequence. Traffic that matches ACL 100 is forwarded to 10.0.0.2, but traffic that does not match ACL 100 is forwarded to 10.0.0.3 only if there is no route in the routing table. However, the engineer expects all unmatched traffic to go to 10.0.0.3 regardless of the routing table. What is the misunderstanding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'set ip default next-hop' command overrides the routing table only when no route exists; the engineer wants unconditional forwarding.. The 'set ip default next-hop' command is used only when the packet does not have a matching route in the routing table. If a route exists (even a default route), the packet follows the routing table. The engineer should use 'set ip next-hop' instead of 'set ip default next-hop' to force all unmatched traffic to the next-hop.

Answer

The route-map sequence order is incorrect; the default next-hop should be in a separate sequence.

Answer

The ACL 100 is blocking all traffic, so no traffic matches the set commands.

Answer

The 'set ip default next-hop' command requires a 'set interface' command to work.

Question 2

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Accepted Answer

The 'clock timezone' command is not configured on the router.. The 'service timestamps log datetime msec' command tells the router to timestamp syslog messages with the date and time, including milliseconds. However, 'datetime' uses the router's configured time zone, which is set by the 'clock timezone' command. If 'clock timezone' is not configured, the router defaults to UTC, so the timestamps appear in UTC even though NTP has set the clock correctly. Therefore, the most likely cause is that the time zone has not been explicitly configured.

Answer

The NTP server is not providing timezone information.

Answer

The 'service timestamps log' command should use 'localtime' instead of 'datetime'.

Answer

The syslog server is overwriting the timestamps with its own.

Question 3

Which TWO commands can be used to troubleshoot EIGRP route redistribution issues when routes are not appearing in the routing table? (Choose TWO.)

Accepted Answer

show ip protocols. Option A, 'show ip protocols', is correct because it displays the configured routing protocols, their redistribution settings (including which protocols are redistributed into EIGRP and the associated metrics), and the networks being advertised, allowing you to verify that redistribution is properly configured. Option C, 'show ip eigrp topology all-links', is correct because it shows all EIGRP topology entries, including feasible successors and routes that are not installed in the routing table, helping you determine whether redistributed routes are present in the EIGRP topology database but failing to meet feasibility or administrative distance requirements. Option B, 'show ip route', only shows the final routing table and cannot reveal whether redistribution or EIGRP topology processing is the root cause. Option D, 'show ip ospf database', is irrelevant because the issue concerns EIGRP, not OSPF. Option E, 'debug ip routing', can show routing table changes but does not specifically verify EIGRP redistribution configuration or topology entries, making it less targeted for this troubleshooting scenario.

Answer

show ip route

Answer

show ip ospf database

Answer

debug ip routing

Question 4

Consider the following EIGRP configuration on Router R1:

router eigrp 100
 network 10.0.0.0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of this configuration?

Accepted Answer

EIGRP will form neighbor adjacencies only on GigabitEthernet0/0.. The 'passive-interface default' command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets on them. The 'no passive-interface GigabitEthernet0/0' command then overrides this default for that specific interface, allowing EIGRP to send and receive hellos and thus form neighbor adjacencies only on GigabitEthernet0/0.

Answer

EIGRP will form neighbor adjacencies on all interfaces.

Answer

EIGRP will not form any neighbor adjacencies.

Answer

EIGRP will form neighbor adjacencies on all interfaces except GigabitEthernet0/0.

Question 5

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp traffic

IP-EIGRP Traffic Statistics for process 100
  Hellos sent/received: 500/495
  Updates sent/received: 10/8
  Queries sent/received: 2/1
  Replies sent/received: 1/2
  Acks sent/received: 8/10
  Input queue high water mark: 2, Input queue depth: 0
  Total packets sent: 521, received: 516

What does this output indicate?

Accepted Answer

The EIGRP process is functioning normally with no signs of congestion or issues.. The output shows a balanced exchange of EIGRP packets with no retransmissions, a low input queue depth of 0, and a high water mark of only 2. These metrics indicate the EIGRP process is stable, with no congestion, packet loss, or neighbor issues. The slight difference between hellos sent (500) and received (495) is normal due to timing or asymmetric paths and does not indicate a problem.

Answer

The network is experiencing a high number of queries, indicating instability.

Answer

There is a problem with packet loss because more hellos were sent than received.

Answer

The router is not receiving acknowledgments for its updates.

Question 6

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp interfaces detail

Interface GigabitEthernet0/0
  EIGRP interface state: Enabled, Up
  Hello interval: 5 sec, Hold time: 15 sec
  Split horizon: Enabled
  Next multicast: 0.0.0.0, Next update: 0.0.0.0
  Bandwidth: 10000 Kbit, Delay: 100 us
  Reliability: 255/255, Load: 1/255, MTU: 1500
  Packets sent: 100, received: 95
  Authentication: MD5, key chain: EIGRP-KEY
  Passive interface: No

What does this output indicate?

Accepted Answer

EIGRP is using MD5 authentication with key chain EIGRP-KEY, and the interface is actively sending and receiving EIGRP packets.. The output shows the interface is enabled and up, with MD5 authentication configured using key chain EIGRP-KEY. The 'Packets sent: 100, received: 95' indicates active packet exchange, and 'Passive interface: No' confirms hellos are being sent. This means EIGRP is actively sending and receiving packets with MD5 authentication.

Answer

EIGRP is configured as a passive interface, so no hellos are sent.

Answer

Split horizon is disabled, allowing route advertisement back to the source.

Answer

The interface is using plain-text authentication.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 5

Round Trip Time (RTT) for Index 5
   Latest RTT: 50 ms
   Latest RTT (milliseconds): 50
   Latest RTT (microseconds): 50000
   Number of successes: 100
   Number of failures: 0
   Operation time to live: Forever
   Output: OK

R1# show track 3
Track 3
  IP SLA 5 reachability
  Reachability is Up
    1 change, last change 00:10:00
  Latest operation return code: OK
  Latest RTT (milliseconds): 50
  Tracked by:
    ip route 0.0.0.0 0.0.0.0 192.168.3.1 track 3

R1# show ip route 0.0.0.0 0.0.0.0
Routing entry for 0.0.0.0/0, supernet
  Known via "static", distance 1, metric 0, candidate default path
  Last update from 192.168.3.1 on GigabitEthernet0/0
  Routing Descriptor Blocks:
  * 192.168.3.1, via GigabitEthernet0/0
      Route metric is 0, traffic share count is 1

Based on this output, which statement is correct?

Accepted Answer

The static route is active and reachable via 192.168.3.1.. The track is up, and the static route is present in the routing table. The IP SLA has 100% success. This indicates everything is working correctly.

Answer

The static route is not installed because the track is up.

Answer

The IP SLA operation is failing, causing the track to go down.

Answer

The IP SLA operation has a threshold violation.

Question 8

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume limit

What does this output indicate?

Accepted Answer

The IKE policy is correctly configured with strong encryption and DH group.. The output shows a global IKE policy with priority 10 using AES-256 encryption, SHA hash, Pre-Shared Key authentication, and Diffie-Hellman group 5 (1536-bit). These parameters represent a strong and secure IKE policy configuration suitable for a production IPsec VPN. The default protection suite is irrelevant unless the peer does not match the higher-priority policy, so the active policy is the one configured with priority 10.

Answer

The IKE policy uses DES, which is insecure and should be changed.

Answer

The IKE policy is missing the authentication method.

Answer

The IKE policy lifetime is set to 86400 seconds, which is too short.

Question 9

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.1.2:0, Local LDP Ident: 192.168.0.1:0
        TCP connection: 192.168.1.2.646 - 192.168.0.1.49876
        State: Oper; Msgs sent/rcvd: 100/105; Downstream on demand
        Up time: 00:10:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 192.168.1.2
        Addresses bound to peer LDP Ident:
          192.168.1.2        10.1.1.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which means the LDP session is operational. The 'Downstream on demand' label distribution mode is a valid mode (RFC 5036) and does not indicate a problem. The session is exchanging label information, as evidenced by the 'Oper' state and the presence of peer addresses.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The LDP session is in the process of being established.

Answer

The LDP session is using downstream on demand mode, which is a problem.

Question 10

Which DHCPv4 option is used by a client to request a specific IP address in the DHCPREQUEST message?

Accepted Answer

Option 50 (Requested IP Address). DHCPv4 Option 50 (Requested IP Address) is specifically used by a client in the DHCPREQUEST message to request a previously offered IP address or to attempt to renew a specific address. This option allows the client to indicate which IP address it wants to use, ensuring the server can confirm or deny the request based on availability and policy.

Answer

Option 12 (Host Name)

Answer

Option 54 (Server Identifier)

Answer

Option 51 (IP Address Lease Time)

Question 11

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/0
Interface GigabitEthernet0/0
  FNF: enabled
  Ingress IPV4/IPV6 flow monitoring: enabled
    Exporter: EXPORTER1
    Monitor: MONITOR1
  Egress IPV4/IPV6 flow monitoring: disabled
  Ingress MPLS flow monitoring: disabled
  Egress MPLS flow monitoring: disabled

Based on this output, what is the state of NetFlow on this interface?

Accepted Answer

NetFlow is only monitoring incoming traffic on this interface.. The output shows that ingress IPv4/IPv6 flow monitoring is enabled with an exporter and monitor configured, while egress IPv4/IPv6 flow monitoring is disabled. This means NetFlow is only monitoring incoming traffic on the interface, not outgoing traffic. The FNF (Flexible NetFlow) status confirms NetFlow is operational, but only for ingress direction.

Answer

NetFlow is fully enabled for both ingress and egress traffic.

Answer

NetFlow is not configured on this interface.

Answer

NetFlow is only monitoring MPLS traffic.

Question 12

What is the default DHCPv4 renewal time (T1) as a percentage of the lease time?

Accepted Answer

50%. (50%) because RFC 2131 defines the DHCPv4 renewal time (T1) as 50% of the lease duration. When the T1 timer expires, the client attempts to renew its lease by sending a unicast DHCPREQUEST to the server that originally granted the lease.

Answer

25%

Answer

75%

Answer

87.5%

Question 13

Which syslog severity level is used for informational messages that are not errors but may be useful for monitoring?

Accepted Answer

Severity 6 (Informational). Syslog severity level 6 is Informational, used for messages that are not errors but provide useful monitoring information. This matches the question's description exactly. Severity 5 is Notice, which is more significant than informational, and severity 7 is Debug, which is more verbose.

Answer

Severity 5 (Notice)

Answer

Severity 7 (Debug)

Answer

Severity 0 (Emergency)

Question 14

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

Accepted Answer

It denies all traffic not explicitly permitted and is always present.. Every IPv4 ACL has an implicit deny any statement at the end that denies all traffic not explicitly permitted by earlier entries. This implicit rule is always present and cannot be removed, ensuring that only traffic matching a permit entry is allowed through the ACL.

Answer

It can be overridden by adding a permit any at the end.

Answer

It is invisible and applies only to TCP traffic.

Answer

It is always present and cannot be removed or overridden.

Question 15

snmp-server community public RO
snmp-server community private RW
snmp-server community secret RW

What is wrong with this configuration?

Accepted Answer

There is no access list to restrict SNMP access.. The configuration lacks an access control list (ACL) to restrict which SNMP managers can use the community strings. Without an ACL, any device that can reach the router can query or modify the SNMP agent using the 'public' or 'private' strings, creating a severe security vulnerability. Cisco SNMP best practices mandate that each community string should be paired with an ACL to limit source IP addresses.

Answer

The community strings must be at least 8 characters.

Answer

Only one read-write community is allowed.

Answer

The 'public' community should be read-write.

Question 16

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

Accepted Answer

iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors. The most likely explanation is the iBGP split-horizon rule, which states that routes learned from an iBGP neighbor are not advertised to other iBGP neighbors. This is a fundamental rule to prevent routing loops within an AS. Therefore, even though the next-hop is reachable and the session is established, the route will not be propagated to another iBGP peer unless a route reflector or full mesh is used.

Answer

The next-hop-self command is required for iBGP

Answer

The BGP synchronization rule is enabled

Answer

The routes are not valid because the next-hop is not reachable

Question 17

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The traffic has a source IP that belongs to the customer's prefix, which is reachable via a different interface on the router. Which is the most likely explanation?

Accepted Answer

The customer traffic is arriving on an interface where the return path to the source is via a different interface, violating strict uRPF.. Strict uRPF requires that the source IP of an incoming packet be reachable via the same interface on which the packet arrived. In this scenario, the customer's source prefix is reachable via a different interface, so strict uRPF drops the legitimate traffic. This is the expected behavior of strict mode when routing is asymmetric.

Answer

The 'ip verify unicast source reachable-via any' command was used instead of 'rx'.

Answer

The router has a default route pointing out the same interface, causing uRPF to pass all traffic.

Answer

The 'ip urpf allow-default' command is missing, causing default routes to be ignored.

Question 18

Examine the following EIGRP configuration on Router R6:

interface GigabitEthernet0/2
 ip hello-interval eigrp 100 15
 ip hold-time eigrp 100 45

What is the effect of these commands?

Accepted Answer

EIGRP will send hello packets every 15 seconds and wait 45 seconds before declaring a neighbor down.. The commands set a non-default hello interval of 15 seconds and a hold time of 45 seconds for EIGRP AS 100 on GigabitEthernet0/2. EIGRP uses the hello interval to determine how often it sends hello packets, and the hold time is the duration the router waits without receiving a hello before declaring the neighbor down. Option A correctly describes this behavior.

Answer

EIGRP will send hello packets every 45 seconds and wait 15 seconds.

Answer

EIGRP will use the default hello interval of 5 seconds and hold time of 15 seconds.

Answer

EIGRP will not form neighbor adjacencies because the hold time is not a multiple of the hello interval.

Question 19

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-OSPF (match-all)
      1000 packets, 60000 bytes
      5 minute offered rate 2000 bps, drop rate 0000 bps
      Match: access-group 140
      police:
          cir 64000 bps, bc 12000 bytes, be 12000 bytes
        conformed 1000 packets, 60000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, which statement is correct?

Accepted Answer

OSPF traffic is being transmitted without any drops.. The output shows that under the CoPP-OSPF class, 1000 packets have been conformed and transmitted, with zero exceeded or violated packets. This means all OSPF traffic matched by access-group 140 has been within the police rate of 64000 bps, so no packets have been dropped. Therefore, OSPF traffic is being transmitted without any drops.

Answer

OSPF packets are being dropped due to exceeding the police rate.

Answer

The police rate is set to 32000 bps.

Answer

The class-default is matching OSPF traffic.

Question 20

When redistributing routes into OSPF, which OSPF metric value is assigned by default if none is specified?

Accepted Answer

20. When redistributing routes into OSPF without specifying a metric, Cisco IOS assigns a default metric of 20. This default value is used for routes redistributed from all sources except BGP, which has a default of 1. The metric is used as the OSPF cost for the external route and is critical for path selection.

Answer

1

Answer

10

Answer

100