300-410 Practice Exam 69 — 20 Questions

Question 1

An engineer configures an EEM applet to monitor DMVPN tunnel events using the event syslog pattern 'NHRP-3-REGISTRATION'. The applet is supposed to send an email when a spoke registers with the NHS. The DMVPN network uses Phase 2 with spoke-to-spoke tunnels. A spoke registers successfully, but the EEM applet does not trigger. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Successful NHRP registration generates a syslog message with severity 6 (informational), not severity 3 (error).. In DMVPN Phase 2, spoke-to-spoke tunnels are established dynamically, but the NHRP registration event generates a syslog message only when the spoke registers with the NHS. However, the syslog pattern 'NHRP-3-REGISTRATION' is for error-level messages, while successful registration generates an informational message (NHRP-6-REGISTRATION). The EEM applet is looking for severity level 3, but the actual syslog is severity level 6, so the pattern does not match.

Answer

The EEM applet must be configured with 'event nhrp' to capture NHRP events.

Answer

The DMVPN Phase 2 does not generate syslog messages for spoke registration.

Answer

The NHS must be configured with 'ip nhrp registration no-syslog' to suppress messages.

Question 2

A network engineer configures CoPP to protect the control plane, but after redistributing routes, some legitimate routing updates are dropped. Router R1 config:
control-plane
 service-policy input COPP
!
class-map match-all ROUTING
 match access-group name ROUTING
!
policy-map COPP
 class ROUTING
  police 100000 15000 15000 conform-action transmit exceed-action drop
!
access-list ROUTING permit tcp any any eq bgp
access-list ROUTING permit udp any any eq 520
access-list ROUTING permit ospf any any

R1# show policy-map control-plane input
  Class-map: ROUTING (match-all)
    100 packets, 10000 bytes
    5 minute offered rate 0 bps
    drop rate 0 bps
  Match: access-group name ROUTING
  police:
      cir 100000 bps, bc 15000 bytes, be 15000 bytes
    conformed 90 packets, 9000 bytes; actions: transmit
    exceeded 10 packets, 1000 bytes; actions: drop

What is the root cause?

Accepted Answer

The CoPP police rate is too low for the volume of routing updates during redistribution, causing drops.. The CoPP policy is policing routing protocol traffic at 100 kbps, which may be insufficient during redistribution bursts. The exceeded drops indicate that some packets are being dropped, likely due to the burst size being too small. The fix is to increase the police rate or burst size to accommodate the redistribution traffic.

Answer

The access-list is missing EIGRP protocol, causing EIGRP packets to be dropped.

Answer

The class-map is match-all, which requires all conditions to match, but only one ACL is present.

Answer

The policy-map is applied to the input of the control-plane, but redistribution uses output.

Question 3

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop 10.1.1.2
    ip next-hop verify-availability
  Policy routing matches: 0 packets, 0 bytes

What does this output indicate?

Accepted Answer

The route-map is correctly configured but no traffic has matched it yet.. The output shows that the route-map PBR-MAP has a match clause referencing access-list 101 and a set clause with next-hop 10.1.1.2 and next-hop verify-availability. The packet counter is 0, meaning no packets have been policy-routed yet.

Answer

The next-hop 10.1.1.2 is unreachable, causing PBR to fail.

Answer

The access-list 101 is misconfigured and blocking all traffic.

Answer

The verify-availability feature is preventing any matches.

Question 4

A network engineer runs the following command to troubleshoot a Route Redistribution issue:

R1# show bgp ipv4 unicast 192.168.10.0/24

And sees the following output:

BGP routing table entry for 192.168.10.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    0.0.0.0 from 0.0.0.0 (1.1.1.1)
      Origin incomplete, metric 0, localpref 100, weight 32768, valid, sourced, best
      rx pathid: 0, tx pathid: 0x0

What does this output indicate?

Accepted Answer

The route is redistributed into BGP from another protocol, as indicated by origin incomplete and weight 32768.. The show bgp ipv4 unicast output shows a route with next hop 0.0.0.0, origin incomplete, and weight 32768. This indicates the route is locally originated, likely via redistribution or network command. Origin incomplete (incomplete) suggests the route was redistributed from another protocol.

Answer

The route 192.168.10.0/24 is learned from an EBGP neighbor.

Answer

The route is injected into BGP via the network command, as shown by origin incomplete.

Answer

The route is a default route injected into BGP.

Question 5

Drag and drop the steps to perform mutual redistribution between OSPF and EIGRP into the correct order, from first to last.

Accepted Answer

Identify OSPF and EIGRP domains and interfaces. The correct order ensures that route filtering is applied before redistribution to prevent routing loops, and that redistribution is configured on both protocols symmetrically. First, identify the routing domains and interfaces. Second, configure route filtering using distribute-lists or route-maps to control which routes are exchanged. Third, configure redistribution of EIGRP into OSPF. Fourth, configure redistribution of OSPF into EIGRP. Finally, verify the redistribution using show commands to confirm routes are exchanged correctly.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
O        172.16.0.0/24 [110/100] via 172.16.0.2, 00:00:15, Tunnel0
O        172.16.0.0/24 [110/100] via 172.16.0.3, 00:00:10, Tunnel0

Based on this output, what is the problem?

Accepted Answer

OSPF is learning the same subnet from multiple spokes, indicating a misconfiguration.. The output shows OSPF routes for the same network 172.16.0.0/24 via two different next hops (172.16.0.2 and 172.16.0.3). This indicates that OSPF is seeing the same subnet from multiple spokes, which is incorrect because the tunnel network should be unique per spoke. This suggests a misconfiguration where the tunnel IP addresses are overlapping or OSPF is not properly filtering.

Answer

The OSPF cost is 100, which is high.

Answer

The routes are learned via EIGRP.

Answer

The tunnel interface is down.

Question 7

A network engineer notices that after redistributing EIGRP into OSPF, a routing loop occurs between two routers. Router R1 config:
router ospf 1
 redistribute eigrp 100 subnets
!
router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500

R1# show ip route 192.168.1.0
Routing entry for 192.168.1.0/24
  Known via "eigrp 100", distance 90, metric 128256
  Redistributing via eigrp 100
  Last update from 10.1.1.2 on GigabitEthernet0/0

R2# show ip route 192.168.1.0
Routing entry for 192.168.1.0/24
  Known via "ospf 1", distance 110, metric 20
  Redistributing via ospf 1
  Last update from 10.1.1.1 on GigabitEthernet0/0

What is the root cause?

Accepted Answer

The redistribute commands are missing route-map filters, causing mutual redistribution and a loop.. Mutual redistribution between EIGRP and OSPF without route filtering causes a routing loop. R1 learns the route via EIGRP and redistributes into OSPF; R2 learns via OSPF and redistributes back into EIGRP, creating a loop. The fix is to use route-maps to filter redistributed routes or set administrative distance to prefer one source.

Answer

The EIGRP metric is too low, causing OSPF to prefer the redistributed route.

Answer

The OSPF administrative distance is higher than EIGRP, causing suboptimal path selection.

Answer

The subnets keyword under OSPF redistribution is causing classful behavior.

Question 8

Drag and drop the steps to configure inter-VRF route leaking using static routes in VRF-Lite into the correct order, from first to last.

Accepted Answer

Define VRFs and assign route distinguisher. First, define both VRFs and assign a route distinguisher (RD). Then assign interfaces to the respective VRFs. After that, configure static routes with the VRF keyword to leak routes between VRFs. Finally, verify the leaked routes are present in the VRF routing table. Note that import/export route targets are not used in VRF-Lite; they are only required for MPLS VPN scenarios.

Answer

Configure import and export route targets

Question 9

Review the following OSPF configuration on router R4:

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
 area 1 range 10.0.0.0 255.255.255.0

What is missing or incorrect in this configuration for proper route summarization?

Accepted Answer

The router must have interfaces in area 1 for the summarization to take effect.. The area range command is used on an ABR to summarize routes from one area into another. Here, area 1 is specified, but router R4 only has network statements in area 0, so it is not an ABR for area 1. The command will have no effect.

Answer

The mask should be 0.0.0.255 instead of 255.255.255.0.

Answer

The command should be 'summary-address' instead of 'area range'.

Answer

The network statement should include area 1.

Question 10

A network engineer configures IP SLA with a UDP echo operation to monitor a remote server. The IP SLA responder is configured on the remote router. The engineer notices that the operation shows 'Timeout' intermittently, but standard UDP connectivity tests from the router to the server succeed. The engineer checks the IP SLA responder configuration and finds that the control port is set to a non-default value. Which is the most likely explanation?

Accepted Answer

The IP SLA initiator must be configured with the 'control' keyword to match the non-default control port on the responder.. IP SLA UDP echo operations require the IP SLA responder to be configured with the correct control port. If the responder uses a non-default control port, the initiator must be configured to use that port using the 'control' keyword under the IP SLA operation. Without this, the initiator uses the default control port (1967), causing communication failures and intermittent timeouts.

Answer

The IP SLA responder is not configured to respond to UDP echo requests from the initiator.

Answer

The UDP echo operation uses a different protocol than standard UDP, causing packet drops.

Answer

The IP SLA operation has a threshold that is too low, causing the operation to time out.

Question 11

A network engineer configures IP SLA with an HTTP GET operation to monitor a web server. The operation shows 'Success' but the response time is extremely high. The engineer checks the web server and finds it is overloaded. The engineer wants to configure a threshold so that the IP SLA operation triggers a track object when the response time exceeds 500 ms. Which configuration change is required?

Accepted Answer

Configure the 'threshold' command under the IP SLA operation and use the 'track' command with 'threshold' keyword in the track object.. IP SLA HTTP operations measure response time, but to trigger a track object based on threshold violation, the engineer must configure the 'threshold' command under the IP SLA operation and then configure the track object to react to the 'threshold' state, not just the 'up/down' state. By default, track objects only track up/down, not threshold violations.

Answer

Configure the 'timeout' command to 500 ms; the track object will automatically react to timeouts.

Answer

Use the 'reaction' command under the IP SLA operation to trigger a trap; the track object cannot react to thresholds.

Answer

Configure the IP SLA operation with a lower frequency to get more samples; the track object will average the response time.

Question 12

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.1.0/24 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is applied to interface GigabitEthernet0/0. The engineer notices that the PBR policy is not working at all. The engineer checks the route map configuration and sees 'match ip address 110' and 'set ip next-hop 10.10.10.2'. The engineer also checks the ACL 110 and confirms it matches 172.16.1.0/24. The engineer then checks the interface configuration and sees 'ip policy route-map PBR-172' applied. What should the engineer do next to isolate the issue?

Accepted Answer

Check if the next-hop 10.10.10.2 is reachable via the routing table.. The engineer should verify that the next-hop 10.10.10.2 is reachable via a directly connected interface or a static route. PBR will not forward traffic to a next-hop that is not in the routing table or not directly connected, and will fall back to the routing table. The engineer can use 'show ip route 10.10.10.2' to check reachability.

Answer

Add the 'set ip default next-hop' command to the route map.

Answer

Change the route map to use 'set interface' instead of 'set ip next-hop'.

Answer

Apply the route map to the outgoing interface instead of the incoming interface.

Question 13

A network engineer runs the following command on switch SW4:

SW4# show monitor session 6
Session 6
---------
Type : Local Session
Source Ports :
    Both : Gi0/8, Gi0/9
Destination Ports : Gi0/10
    Encapsulation : Native
    Ingress : Enabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session is configured correctly and will forward traffic received on Gi0/10 into the network.. This is a local SPAN session with source ports Gi0/8 and Gi0/9, and destination port Gi0/10. The destination port has ingress enabled, which means traffic received on Gi0/10 will be processed and forwarded by the switch. This is unusual because SPAN destination ports typically have ingress disabled to prevent loops and forwarding of mirrored traffic. This configuration can cause network issues.

Answer

The SPAN session is misconfigured because source ports cannot be monitored in both directions.

Answer

The SPAN session is using RSPAN because the destination port has ingress enabled.

Answer

The SPAN session is disabled because the destination port has ingress enabled.

Question 14

A network engineer runs the following command to debug MPLS LDP errors:

R1# debug mpls ldp errors

Output:
*Mar  1 00:01:23.456: LDP: Received malformed hello from 10.0.0.2
*Mar  1 00:01:23.789: LDP: Received malformed initialization from 10.0.0.2
*Mar  1 00:01:24.012: LDP: Session with 10.0.0.2:0 (0x1234) is DOWN

What does this output indicate?

Accepted Answer

The LDP session with 10.0.0.2 failed due to malformed messages from the neighbor. The debug output shows LDP errors. R1 received malformed hello and initialization messages from neighbor 10.0.0.2, causing the LDP session to go down. This indicates a configuration mismatch or software bug on the neighbor.

Answer

The LDP session with 10.0.0.2 is up and stable

Answer

R1 is sending malformed messages to 10.0.0.2

Answer

The LDP session is using incorrect transport address

Question 15

A network engineer configured IP SLA 30 to monitor the reachability of a server (10.10.10.10) using ICMP echo probes. The IP SLA is linked to a track object that is used in a static default route. The engineer notices that the IP SLA state is 'Active', but the static route is not present in the routing table. The track object shows 'Up'. What should the engineer check first?

Accepted Answer

Verify that the static route includes the 'track' keyword and references the correct track object number.. If the track object is up and the static route is not installed, the issue is likely that the static route configuration does not properly reference the track object, or the route is being overridden by another route with lower administrative distance.

Answer

Check if the server is responding to ICMP echo requests.

Answer

Ensure the IP SLA probe is configured with a timeout value less than the frequency.

Answer

Reboot the router to clear any routing table inconsistencies.

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 eigrp neighbors

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   FE80::A8BB:CCFF:FE00:2  Tunnel0          13 00:23:45   10   200  0  12
1   FE80::A8BB:CCFF:FE00:3  Tunnel1          12 00:22:10   15   200  0  15

Based on this output, which statement is correct?

Accepted Answer

EIGRP for IPv6 adjacencies are established over the tunnels.. The output shows two IPv6 EIGRP neighbors with link-local addresses (FE80::/10) on interfaces Tunnel0 and Tunnel1, and the adjacency is established and exchanging routes (Seq Num increasing). This confirms that EIGRP for IPv6 adjacencies are formed over these tunnel interfaces, making option C correct.

Answer

EIGRP is not configured for IPv6.

Answer

The neighbors are using global unicast addresses.

Answer

The tunnels are using GRE encapsulation.

Question 17

Examine the following partial MPLS configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/0
 ip address 10.0.1.1 255.255.255.252
 mpls ip
 mpls label protocol ldp
!
router ospf 1
 network 10.0.1.0 0.0.0.3 area 0
!
mpls ldp router-id Loopback0 force

What is the effect of this configuration?

Accepted Answer

LDP will establish a session with the neighbor on GigabitEthernet0/0, using Loopback0 as the transport address.. The configuration enables LDP on the interface and globally via 'mpls ip'. The 'mpls label protocol ldp' is default but explicit. The 'mpls ldp router-id Loopback0 force' ensures LDP uses Loopback0 as the router ID, overriding any other interface. OSPF advertises the /30 link. This is a correct minimal MPLS configuration.

Answer

LDP will use the IP address of GigabitEthernet0/0 as the router ID because 'force' is not valid.

Answer

LDP sessions will fail because OSPF is not redistributed into LDP.

Answer

MPLS forwarding will not occur because 'mpls label protocol ldp' is redundant and causes a conflict.

Question 18

An engineer configured IP SLA 60 to monitor the reachability of a WAN link's next-hop (203.0.113.1) using ICMP echo. The IP SLA is used in a track object for a floating static route. The engineer notices that the primary route (EIGRP) is present, but the floating static route is not installed when the primary fails. The track object shows 'Down' after the primary fails. What should the engineer check?

Accepted Answer

Verify that the static route's administrative distance is higher than the EIGRP route (e.g., 170 vs 90).. A floating static route with tracking requires the administrative distance to be higher than the primary route. If the AD is lower or equal, the static route will not be installed as a backup. Also, the track object must be correctly referenced.

Answer

Check if the IP SLA probe is configured with a timeout greater than the frequency.

Answer

Ensure the primary route is removed from the routing table before the static route is installed.

Answer

Reboot the router to clear the routing table.

Question 19

An engineer configured IP SLA 20 to monitor the reachability of a next-hop router (192.168.1.1) using UDP jitter probes. The goal is to use the IP SLA with a track object to influence EIGRP route selection. However, the EIGRP route is not being affected by the IP SLA state. The engineer verifies that the IP SLA is 'Active' and the track object shows 'Up'. What is the most likely misconfiguration?

Accepted Answer

The track object is not configured to influence the EIGRP route; EIGRP does not support direct tracking of IP SLA for route metrics.. EIGRP does not natively react to IP SLA track objects unless the route is redistributed or a static route with tracking is used. The engineer likely expected EIGRP to automatically adjust metric based on IP SLA, which is not supported.

Answer

The IP SLA probe type (UDP jitter) is not supported for tracking EIGRP routes.

Answer

The EIGRP route has a higher administrative distance than the tracked route.

Answer

The IP SLA threshold is set too low, causing flapping.

Question 20

An engineer applies a Control Plane Policing (CoPP) policy to a router. After applying, OSPF adjacencies go down. The policy has a class that matches OSPF traffic with a police rate of 1000 pps. The 'show policy-map control-plane' shows no drops. Which is the most likely explanation?

Accepted Answer

The CoPP policy uses 'match protocol ospf' but the router runs OSPFv3, which is not matched by that statement.. CoPP policies have an implicit 'deny all' at the end. If the OSPF traffic is not matched by any class, it will be dropped by the implicit deny. However, the engineer may have configured a class that matches OSPF but the police rate is in bps, not pps, causing OSPF hellos to be dropped if they exceed the rate. But the question states no drops, so the issue is likely that the OSPF class is not matching due to incorrect match criteria (e.g., match protocol ospf vs match access-group).

Answer

The police rate is configured in bps instead of pps, causing OSPF hellos to be dropped.

Answer

The 'class class-default' is configured with a police rate that drops all traffic.

Answer

The CoPP policy is applied to the input direction, but OSPF packets are sent from the router.