300-410 Practice Test 7 — 10 Questions

Question 1

Which statement is true about the implicit deny any at the end of an IPv4 ACL?

Accepted Answer

It denies all traffic not explicitly permitted and is always present.. Every IPv4 ACL has an implicit deny any statement at the end that denies all traffic not explicitly permitted by earlier entries. This implicit rule is always present and cannot be removed, ensuring that only traffic matching a permit entry is allowed through the ACL.

Answer

It can be overridden by adding a permit any at the end.

Answer

It is invisible and applies only to TCP traffic.

Answer

It is always present and cannot be removed or overridden.

Question 2

Given this partial configuration:

ip nat pool MYPOOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool MYPOOL
access-list 1 permit 192.168.1.0 0.0.0.255

What is the effect?

Accepted Answer

Inside hosts are dynamically mapped to a pool address; if the pool is exhausted, new translations fail.. The configuration uses a standard ACL to match inside hosts (192.168.1.0/24) and dynamically assigns them a unique address from the pool 203.0.113.10–203.0.113.20. Because no 'overload' keyword is present, PAT is not enabled; each translation consumes a pool address, and once all 11 addresses are used, new translations fail until an existing translation times out or is cleared.

Answer

Inside hosts are translated to addresses in the pool using PAT.

Answer

The router uses the pool address as the source for all outbound traffic, regardless of ACL.

Answer

This configuration requires the 'ip nat outside' interface command to function.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor vrf BLUE

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR        00:00:32    10.1.1.2        GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER   00:00:35    10.1.2.2        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

The OSPF adjacencies are functioning normally.. The output shows two OSPF neighbors for VRF BLUE. Neighbor 10.0.0.2 is in FULL state and is the DR on GigabitEthernet0/0. Neighbor 10.0.0.3 is in 2WAY state and is a DROTHER on GigabitEthernet0/1. The 2WAY state is normal for neighbors that are not DR/BDR on a multi-access network. No problem is evident.

Answer

Neighbor 10.0.0.3 is not forming a full adjacency because it is a DROTHER.

Answer

Neighbor 10.0.0.2 is the Backup Designated Router.

Answer

Both neighbors are in the FULL state.

Question 4

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Accepted Answer

IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.. The `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Answer

IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

Answer

IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

Answer

IPv6 ACLs support the remark keyword for documentation.

Question 5

An engineer configures iBGP between two routers in the same AS. The engineer notices that routes learned from one iBGP neighbor are not being advertised to another iBGP neighbor, even though the next-hop is reachable. The engineer verifies that the BGP session is established and that the routes are present in the BGP table. Which is the most likely explanation?

Accepted Answer

iBGP split-horizon rule prevents advertising iBGP-learned routes to other iBGP neighbors. By default, iBGP routers do not advertise routes learned from one iBGP neighbor to another iBGP neighbor because of the split-horizon rule. This is a fundamental behavior to prevent routing loops, but it often catches engineers who expect iBGP to behave like eBGP. To overcome this, a route reflector or confederation must be used.

Answer

The next-hop-self command is required for iBGP

Answer

The BGP synchronization rule is enabled

Answer

The routes are not valid because the next-hop is not reachable

Question 6

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows that BFD is enabled for the LDP session and the BFD state is UP, providing fast failure detection for MPLS LDP neighbor.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 7

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 8

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

Accepted Answer

The local enable password is not configured.. The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password. If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Answer

The RADIUS server is not configured to provide the enable password.

Answer

The 'aaa authentication enable default' command is missing the 'local' keyword.

Answer

The router's enable secret is set to a different password.

Question 9

Two VRFs on router R1: VRF A and VRF B. R1 has:
ip vrf A
 rd 100:1
 route-target export 100:1
 route-target import 100:2
ip vrf B
 rd 100:2
 route-target export 100:2
 route-target import 100:1
R1 shows:
R1# show ip route vrf A
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
R1# show ip route vrf B
B       10.1.1.0/24 [200/0] via 10.2.2.2, 00:00:10
Router R2 (in VRF A) can ping 10.1.1.1, but router R3 (in VRF B) cannot. What is the root cause?

Accepted Answer

The next hop 10.2.2.2 is not reachable from VRF B due to missing interface in VRF B.. The route targets are misconfigured for route leaking. VRF A exports with RT 100:1 and imports RT 100:2. VRF B exports with RT 100:2 and imports RT 100:1. This creates a two-way leak, but the route 10.1.1.0/24 is learned via BGP from R2. If R2 is in VRF A, the route is exported with RT 100:1. VRF B imports RT 100:1, so VRF B should have the route. However, the issue might be that the route is not being advertised to R3 due to BGP next-hop resolution or VRF interface issues. The output shows both VRFs have the route, so the problem is likely that R3 cannot reach the next hop 10.2.2.2 because it is in a different VRF or the interface is not in VRF B. The root cause is that the next hop is not reachable from VRF B.

Answer

The route targets are reversed, causing VRF B to not import the route.

Answer

BGP is not configured to advertise VPNv4 routes.

Answer

R3 has a firewall blocking ICMP.

Question 10

What is the default lease duration for a DHCPv4 address pool on a Cisco IOS router?

Accepted Answer

1 day. The default lease duration for a DHCPv4 address pool on a Cisco IOS router is 1 day (86400 seconds). This is defined by the Cisco IOS DHCP server implementation, which uses a 24-hour lease as the default when no lease duration is explicitly configured under the DHCP pool configuration.

Answer

7 days

Answer

30 minutes

Answer

Infinite