300-410 Practice Exam 70 — 20 Questions

Question 1

What is the default EIGRP hold time multiplier relative to the hello interval?

Accepted Answer

Hold time is three times the hello interval. By default, EIGRP sets the hold time to three times the hello interval. This ensures that a few missed hellos do not immediately cause neighbor loss.

Answer

Hold time equals hello interval

Answer

Hold time is twice the hello interval

Answer

Hold time is four times the hello interval

Question 2

An engineer is troubleshooting a route redistribution issue between OSPF and EIGRP. R1 runs both protocols and redistributes OSPF into EIGRP. The engineer notices that OSPF routes redistributed into EIGRP have an AD of 170, but some routes from OSPF are not being redistributed. What is the most likely cause?

Accepted Answer

The OSPF routes are not in the routing table because they are overridden by a static route with AD 1.. Route redistribution only advertises routes that are present in the routing table. If an OSPF route is overridden by a static route with AD 1 (static routes have AD 1 by default, which is better than OSPF's 110), the OSPF route is not installed in the RIB. Consequently, the redistribution process has nothing to redistribute for that prefix, and it will not appear in EIGRP. This is a classic redistribution gotcha: the source protocol must have the route in its routing table for redistribution to work.

Answer

The OSPF routes have a higher metric than the EIGRP routes.

Answer

The redistribute ospf 1 metric 10000 command is missing.

Answer

The OSPF routes are external type 2, which are not redistributed by default.

Question 3

Given the following partial configuration on a router:

ip access-list standard FILTER_SNMP
 permit 192.168.1.0 0.0.0.255
 deny any
!
snmp-server community public RO FILTER_SNMP
snmp-server location DataCenter
snmp-server contact admin@example.com

What is the effect of this configuration?

Accepted Answer

Only SNMP requests from the 192.168.1.0/24 network are allowed with the community string 'public'.. The configuration applies the standard ACL 'FILTER_SNMP' to the SNMP community string 'public' with read-only (RO) access. The ACL permits only the 192.168.1.0/24 network, so SNMP requests (e.g., GET, GETNEXT) from that subnet are allowed, while all other sources are denied. This is the intended effect of using an ACL to restrict SNMP access by source IP.

Answer

SNMP requests from any source are allowed because the ACL is not applied correctly.

Answer

The community string 'public' allows read-write access.

Answer

The ACL is applied outbound, so SNMP responses are filtered.

Question 4

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.52868
        State: Oper; Msgs sent/rcvd: 123/120; Downstream
        Up time: 02:15:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 192.168.1.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.1.2

Based on this output, which statement is correct?

Accepted Answer

The LDP session is established and operational.. The output shows a single LDP neighbor with state 'Oper' (operational), indicating the LDP session is up. The 'Downstream' mode is default. The peer LDP Ident is 10.0.0.2:0, and the local LDP Ident is 10.0.0.1:0. The addresses bound include the peer's router-id and the interface IP. No problems are indicated.

Answer

The LDP session is down because the state is 'Oper'.

Answer

The LDP neighbor is using upstream label distribution.

Answer

The LDP session is using TCP port 179.

Question 5

A network engineer runs the following command to troubleshoot IPv6 ND inspection:

R1# debug ipv6 nd inspection

*Mar  1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, options: SLLA 0011.2233.4455
*Mar  1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, SLLA 0011.2233.4455 is allowed by policy INSPECT
*Mar  1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, options: TLLA 00aa.bbcc.ddee
*Mar  1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, TLLA 00aa.bbcc.ddee is blocked by policy INSPECT

What does this output indicate?

Accepted Answer

ND inspection is allowing NS messages but blocking NA messages from fe80::2, likely due to a MAC address mismatch or policy violation.. The debug output shows that the Neighbor Solicitation (NS) from fe80::1 is allowed by policy INSPECT, while the Neighbor Advertisement (NA) from fe80::2 is blocked by the same policy. This indicates that IPv6 ND inspection is selectively permitting NS messages but denying NA messages from fe80::2, likely due to a MAC address mismatch (the TLLA in the NA does not match the expected binding) or a policy violation, making option A correct.

Answer

ND inspection is blocking all NS and NA messages, indicating a misconfiguration.

Answer

ND inspection is allowing all messages but logging them for analysis.

Answer

ND inspection is not configured; the debug output is from default ND behavior.

Question 6

A network engineer runs the following command to troubleshoot DHCPv6 guard:

R1# debug ipv6 dhcp guard

*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3, client DUID 00010001abcd1234
*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3 is allowed by policy DHCP-POLICY
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4, server DUID 0001000156789012
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4 is blocked by policy DHCP-POLICY

What does this output indicate?

Accepted Answer

DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.. The debug output shows that DHCPv6 SOLICIT messages from client fe80::3 are allowed by policy DHCP-POLICY, while DHCPv6 ADVERTISE messages from server fe80::4 are blocked by the same policy. This is the expected behavior of DHCPv6 guard: it permits client messages (SOLICIT, REQUEST, etc.) to reach potential servers, but it blocks server messages (ADVERTISE, REPLY, etc.) from untrusted ports to prevent rogue DHCPv6 servers from assigning malicious configurations. Option A correctly identifies this selective filtering.

Answer

DHCPv6 guard is blocking all DHCPv6 messages, indicating a misconfiguration.

Answer

DHCPv6 guard is allowing all messages but logging them for analysis.

Answer

DHCPv6 guard is not configured; the debug output is from default DHCPv6 behavior.

Question 7

Router R5 has this DHCP configuration:

ip dhcp pool POOL3
 network 172.16.0.0 255.255.255.0
 default-router 172.16.0.1
 option 150 ip 10.10.10.10
!
interface GigabitEthernet0/0
 ip address 172.16.0.1 255.255.255.0
 no shutdown

What is the purpose of the option 150 command?

Accepted Answer

It provides the IP address of a TFTP server to DHCP clients, typically used by VoIP phones.. Option 150 is a DHCP option that specifies the IP address of a TFTP server. Cisco IP phones use this option to locate the TFTP server from which they download their configuration and firmware files. The correct answer is A because this is the standard purpose of option 150 in a Cisco VoIP environment.

Answer

It sets the DNS server for the DHCP pool.

Answer

It defines a custom option that is ignored by standard DHCP clients.

Answer

It specifies the default gateway for the clients.

Question 8

An engineer configures OSPFv3 with a filter-list on an ABR to filter prefixes. After configuration, the routes are still being advertised. Which is the most likely explanation?

Accepted Answer

The filter-list only filters inter-area prefixes, not external routes.. OSPFv3 filter-lists applied with the 'area filter-list' command only filter inter-area (Type 3) LSAs, not external (Type 5/7) routes. If the engineer is trying to filter external prefixes redistributed into OSPFv3, the filter-list will have no effect, which explains why routes are still advertised.

Answer

The filter-list is applied to the wrong area.

Answer

The filter-list uses an incorrect prefix-list.

Answer

The OSPFv3 process needs to be restarted.

Question 9

An engineer is troubleshooting an EIGRP issue where a router is not learning a specific route from a neighbor, but other routes from the same neighbor are being learned. The engineer checks the EIGRP topology table and sees that the route is not present. The engineer also checks the neighbor's routing table and confirms that the route exists. What is the most likely cause?

Accepted Answer

A distribute-list in is applied on the local router that filters the specific route.. A distribute-list in applied on the local router can filter specific incoming routes from an EIGRP neighbor while allowing others. Since the neighbor has the route in its routing table and other routes from the same neighbor are learned, the most likely cause is an inbound filter that explicitly denies that particular prefix.

Answer

The neighbor is configured as a stub router.

Answer

The route is a summary route that is being suppressed by the 'summary-address' command.

Answer

The EIGRP metric for the route is too high, so it is not considered feasible.

Question 10

An engineer configures mutual redistribution between EIGRP and OSPF on a router. EIGRP routes are redistributed into OSPF with a route-map that sets metric-type type-1, and OSPF routes are redistributed into EIGRP with default metric 10000 100 255 1 1500. Unexpectedly, the router starts flapping routes between the two protocols, causing instability. Which is the most likely explanation?

Accepted Answer

The redistribution is not using route tags, so routes are being re-redistributed back and forth, causing route flapping.. Mutual redistribution without route tagging causes routes to be redistributed back and forth between EIGRP and OSPF, creating a feedback loop. A route learned from OSPF is redistributed into EIGRP, then learned back from EIGRP into OSPF, and so on, causing the route to flap as metrics and path attributes change. Route tags are the standard mechanism to prevent this by marking routes with a tag on redistribution and denying routes with that tag on the reverse redistribution.

Answer

The OSPF metric-type type-1 is incompatible with EIGRP, causing the route to be rejected.

Answer

The EIGRP default metric is missing the reliability and load values, so redistribution fails.

Answer

The router must have `redistribute connected` under both protocols to avoid flapping.

Question 11

A network engineer runs the following command to troubleshoot OSPF route redistribution:

R1# show ip ospf database external 5.5.5.5

OSPF Router with ID (1.1.1.1) (Process ID 1)

Type-5 AS External Link States

LS age: 120
  Options: (No TOS-capability, DC, Upward)
  LS Type: AS External Link
  Link State ID: 5.5.5.5 (External Network Number)
  Advertising Router: 3.3.3.3
  LS Seq Number: 80000001
  Checksum: 0xABCD
  Length: 36
  Network Mask: /32
    Metric Type: 2 (Larger than any link state path)
    TOS: 0
    Metric: 20
    Forward Address: 0.0.0.0
    External Route Tag: 0

What does this output indicate?

Accepted Answer

The route was redistributed into OSPF by router 3.3.3.3 with a metric of 20.. The output shows a Type-5 AS External LSA for 5.5.5.5/32, advertised by router 3.3.3.3, with Metric Type 2 and a metric of 20. This means 3.3.3.3 (an ASBR) redistributed the external prefix into OSPF, and the cost of 20 is the external metric carried in the LSA. The Forward Address of 0.0.0.0 indicates the route should be reached via the advertising ASBR itself.

Answer

The prefix 5.5.5.5/32 is a network inside the OSPF domain.

Answer

The forward address indicates the next-hop is 5.5.5.5.

Answer

This is a Type 4 Summary ASBR LSA.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-DEFAULT

R1# show route-map PBR-DEFAULT
route-map PBR-DEFAULT, permit, sequence 10
  Match clauses:
    ip address (access-lists): 150
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-DEFAULT, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 150
Extended IP access list 150
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely problem?

Accepted Answer

No traffic matching ACL 150 is arriving on GigabitEthernet0/0.. The most likely problem is that no traffic matching ACL 150 is arriving on GigabitEthernet0/0. The route map PBR-DEFAULT has a match clause for ACL 150, but the policy routing matches count is 0 packets, indicating that no packets have matched the ACL. Since the ACL permits traffic from 192.168.1.0/24, it suggests that no such traffic is being received on the interface.

Answer

The deny sequence 20 is blocking all traffic from being policy-routed.

Answer

The next-hop 10.0.0.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 13

Which statement about PBR and the 'match ip address' command is correct?

Accepted Answer

It can reference a named or numbered ACL.. The 'match ip address' command references an access-list (standard or extended) to match packets based on source/destination IP addresses.

Answer

It can only match on source IP addresses.

Answer

It can match on MAC addresses.

Answer

It matches packets before routing table lookup.

Question 14

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:02:00   40   200  0  5

Based on this output, what is the most likely problem?

Accepted Answer

The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.. The 'show ip eigrp neighbors' output shows a neighbor with an uptime of 00:02:00 and a hold time of 13 seconds, meaning the adjacency is currently up and stable. The EEM applet named EIGRP_Neighbor_Down is registered and waiting; it has not fired because the neighbor has not gone down. Therefore the neighbor is up and the policy is armed to trigger only if the adjacency fails.

Answer

The EIGRP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 15

Which OSPF packet type is used to send link-state advertisements (LSAs) and is acknowledged by the receiver?

Accepted Answer

Link State Update (type 4). OSPF Link State Update (LSU) packets, type 4, are used to send link-state advertisements (LSAs) to neighboring routers. The receiver acknowledges receipt of LSUs with Link State Acknowledgment (LSAck) packets, ensuring reliable flooding of LSAs. This reliable flooding mechanism is fundamental to OSPF's link-state database synchronization.

Answer

Hello (type 1)

Answer

Database Description (type 2)

Answer

Link State Request (type 3)

Question 16

What is the default behavior of an IPv4 ACL regarding the order of evaluation when multiple entries match a packet?

Accepted Answer

The first matching entry in the list is applied.. Cisco IOS processes IPv4 ACL entries in sequential order, from top to bottom. When a packet matches an entry, the associated permit or deny action is applied immediately, and no further entries are evaluated. This first-match rule is fundamental to ACL design and troubleshooting.

Answer

The most specific entry is used regardless of order.

Answer

All matching entries are evaluated and the most permissive action is taken.

Answer

The last matching entry in the list overrides earlier ones.

Question 17

What is the default maximum number of NAT translations that can be created in Cisco IOS?

Accepted Answer

Unlimited, limited only by available memory. Cisco IOS does not impose a fixed upper limit on the number of NAT translations; instead, translations are dynamically allocated from router memory. The only constraint is the available DRAM and the size of the NAT translation table, making option C correct.

Answer

512 translations

Answer

1024 translations

Answer

4096 translations

Question 18

R1 and R2 are iBGP peers. R1 has: neighbor 10.1.1.2 route-map RM_SET in. The route-map RM_SET sets community 100:100. R2 advertises a prefix 172.16.1.0/24 with community 200:200. R1 receives the prefix and the community is changed to 100:100. However, R1's BGP table shows the prefix with community 100:100, but R1 does not propagate this prefix to its other iBGP peer R3. R3 has no special configuration. What is the root cause?

Accepted Answer

iBGP split-horizon rule prevents R1 from advertising routes learned from an iBGP peer to another iBGP peer.. By default, iBGP learned routes are not advertised to other iBGP peers to prevent loops, unless the router is a route reflector or confederation. R1 is not a route reflector, so it will not advertise the prefix learned from R2 to R3. The community manipulation is irrelevant to the propagation issue. The root cause is that iBGP split-horizon prevents R1 from advertising the prefix to R3.

Answer

The community 100:100 is being filtered by R3's inbound policy.

Answer

The route-map RM_SET should have been applied outbound on R2 instead.

Answer

R1 must have a network statement for 172.16.1.0/24 to advertise it.

Question 19

A network engineer runs the following command to troubleshoot SNMPv3:

R1# show snmp user
User name: admin
Engine ID: 800000090300001122334455
Storage-type: nonvolatile
Authentication Protocol: SHA
Privacy Protocol: AES128
Group: admin-group

User name: monitor
Engine ID: 800000090300001122334455
Storage-type: nonvolatile
Authentication Protocol: MD5
Privacy Protocol: DES
Group: monitor-group

What does this output indicate?

Accepted Answer

Two SNMPv3 users are configured: 'admin' with SHA/AES128 and 'monitor' with MD5/DES.. The output from 'show snmp user' displays two SNMPv3 users: 'admin' with SHA authentication and AES128 privacy, and 'monitor' with MD5 authentication and DES privacy. This confirms that both users are configured with different security levels, making option A correct.

Answer

SNMPv3 is not configured because no users are shown.

Answer

Both users use the same authentication and privacy protocols.

Answer

The users are in the same SNMP group.

Question 20

Which TWO statements about the limitations of local SPAN are correct? (Choose TWO.)

Accepted Answer

A local SPAN session can only monitor traffic on the same switch where the session is configured.. Local SPAN has several restrictions: it cannot send traffic across Layer 3 boundaries, it can only use interfaces on the same switch, and it has limitations on the number of sessions and the types of traffic that can be mirrored (e.g., control plane traffic is not included).

Answer

A local SPAN destination port can be a routed port or a switchport in trunk mode.

Answer

A local SPAN session can include a VLAN as a source, which monitors all traffic in that VLAN except the control plane traffic.

Answer

A local SPAN session can have multiple destination ports to send the mirrored traffic to multiple analyzers.