300-410 Mock Exam 71 — 25 Questions

Question 1

An engineer configures iBGP between two PE routers in an MPLS L3VPN. The PE routers are in the same AS and are directly connected. The engineer configures 'neighbor x.x.x.x next-hop-self' on the route reflector (RR) but notices that the RR is not sending the VPNv4 routes to the client PE with the next-hop set to itself. The client PE receives the routes but the next-hop remains the original PE. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'next-hop-self' command is not applied to the route-reflector client session; it must be applied to the client's neighbor statement on the RR, but it is ignored for reflected routes.. In BGP, the 'next-hop-self' command is only effective for eBGP sessions or for iBGP sessions when the neighbor is not a route-reflector client. When a route reflector sends a route to a client, it does not change the next-hop attribute by default, even if 'next-hop-self' is configured. This is because the route reflector is expected to preserve the next-hop as learned from the original router. To change the next-hop on a route reflector, the engineer must use 'neighbor x.x.x.x next-hop-self' on the RR for the client, but this command is ignored for routes that are reflected from another iBGP speaker. This is a known edge case that can cause reachability issues if the client cannot reach the original next-hop.

Answer

The 'next-hop-self' command is only applicable to eBGP sessions, not iBGP.

Answer

The 'next-hop-self' command requires the 'soft-reconfiguration inbound' to be configured to take effect.

Answer

The 'next-hop-self' command is overridden by the 'next-hop-unchanged' command on the route reflector.

Question 2

A router is configured with PBR using a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also configures 'ip policy route-map' on the same interface. The engineer notices that PBR is working for TCP traffic but not for UDP traffic from the same subnet. What is the most likely cause?

Accepted Answer

The ACL in the route-map is configured to match only TCP traffic, so UDP packets are not policy-routed.. PBR itself is protocol-agnostic — it operates on IP packets regardless of whether they carry TCP, UDP, ICMP, or other protocols. If TCP traffic is policy-routed but UDP traffic from the same subnet is not, the most likely cause is that the ACL referenced by the route-map matches only TCP (e.g., 'permit tcp any any' or a specific port), so UDP packets fail the match and fall through to normal routing. The fix is to broaden the ACL to match all IP traffic or explicitly include UDP.

Answer

UDP traffic is not supported by PBR.

Answer

The next-hop 10.0.0.2 does not have a route for UDP traffic.

Answer

The route-map is missing a 'set ip next-hop' command for UDP.

Question 3

A network engineer configures EEM to monitor memory usage on R1. R1 has: event manager applet MEM-MONITOR event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 cli command "enable" action 2.0 cli command "show processes memory" action 3.0 syslog msg "High memory usage detected". After a few days, the engineer notices that the applet never triggers, even though memory usage exceeds 90%. Router R2 shows: memory usage is at 95%, but no syslog from EEM. What is the root cause?

Accepted Answer

The SNMP OID is for free memory, and the condition checks if free memory is greater than 90%, which is not met when memory is low.. The SNMP OID used (1.3.6.1.4.1.9.9.48.1.1.1.6.1) is for the free memory, not used memory. The applet checks if free memory is greater than 90%, which is false when memory is low. The correct OID should be for used memory or the comparison operator should be 'lt' for free memory below 10%.

Answer

The poll-interval of 10 seconds is too short and causes the applet to be suppressed.

Answer

The SNMP community string is not configured, so the OID cannot be polled.

Answer

The applet requires 'event manager applet MEM-MONITOR trigger' to start.

Question 4

What is the maximum hop count for a route in RIPv2 by default?

Accepted Answer

15. RIP uses a maximum hop count of 15, with 16 considered unreachable, to prevent routing loops.

Answer

16

Answer

255

Answer

32

Question 5

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Accepted Answer

The EEM applets are not registered due to a syntax error in the configuration.. If EEM applets are configured and enabled but not triggering despite events occurring, the most likely cause is that the applets failed to register due to a syntax error in the configuration. EEM applets must be successfully parsed and registered with the EEM server; a syntax error prevents registration, so the applet never runs. The engineer should check 'show event manager policy registered' to confirm.

Answer

The EEM server is not listening for syslog events.

Answer

The router's logging level is set to emergencies only.

Answer

The EEM applets are configured with 'event none' and need manual triggering.

Question 6

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        QM_IDLE           1    0    ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete; the ISAKMP SA is established.. QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.

Answer

IKE phase 2 is complete; the IPsec SA is active.

Answer

The ISAKMP SA is in MM_NO_STATE; negotiation has failed.

Answer

The tunnel is down; the SA is in a dead state.

Question 7

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

Accepted Answer

The flow monitor is not associated with any flow exporter.. The flow exporter statistics showing 'Export packets sent: 0' while the monitor cache contains flows indicates the monitor is collecting data but never invoking the exporter. In Flexible NetFlow, the flow monitor must reference a flow exporter via the 'exporter EXPORTER' command under flow monitor configuration; without that association, the monitor has no destination to send records to. This is the most direct cause of zero exports despite a populated cache.

Answer

The flow exporter is configured with the wrong destination IP address.

Answer

The flow exporter is missing the 'source' interface command.

Answer

The flow cache is full, preventing new exports.

Question 8

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 statistics

Monitor: FLOW-MONITOR-1
  Record: netflow-original
  Exporter: EXPORTER-1
  Cache size: 1000
  Current entries: 0
  Flows exported: 0
  Packets exported: 0

Sampler: Not configured

Flow Monitor is not attached to any interface

Based on this output, what action should the engineer take to resolve the issue?

Accepted Answer

Apply the flow monitor to an interface using the 'ip flow monitor FLOW-MONITOR-1 input' command.. The output explicitly states 'Flow Monitor is not attached to any interface'. The solution is to apply the flow monitor to an interface using the 'ip flow monitor' command.

Answer

Configure a sampler on the flow monitor.

Answer

Increase the cache size to 2000 entries.

Answer

Change the record type to netflow ipv4 original.

Question 9

A network engineer configures IP SLA tracking for a static route on a Cisco router. The IP SLA operation is configured with a threshold of 100 ms and a timeout of 5000 ms. The tracked object is configured with a delay of 5 seconds for both up and down transitions. The engineer notices that when the remote host becomes unreachable, the static route is not removed from the routing table immediately. Which is the most likely explanation?

Accepted Answer

The tracked object delay of 5 seconds for down transition causes a 5-second wait before the route is removed.. The IP SLA tracking delay configuration introduces a delay before the tracked object changes state; this is designed to prevent route flapping but can cause the static route to remain in the routing table for the configured delay period after the IP SLA operation fails.

Answer

The IP SLA operation is still in the 'pending' state and has not yet timed out.

Answer

The static route has a higher administrative distance than the IP SLA tracked route, so it remains preferred.

Answer

The IP SLA operation is configured with a frequency that is too low, causing a delay in detection.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto ipsec transform-set
Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Based on this output, which statement is correct?

Accepted Answer

Both transform sets use tunnel mode; ESP-AES256-SHA uses stronger encryption.. The output shows two transform sets configured. The first uses AES-256 with SHA256 HMAC, the second uses AES-128 with SHA256 HMAC. Both use tunnel mode.

Answer

The transform sets use transport mode.

Answer

The transform sets use MD5 for hashing.

Answer

The transform sets are not compatible with IKEv2.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip vrf CUSTOMER
  Name                             Default RD           Interfaces
  CUSTOMER                         65001:100             Gi0/0.100
                                                        Gi0/1.100

Based on this output, which statement is correct?

Accepted Answer

The VRF CUSTOMER is configured with two subinterfaces.. The output of 'show ip vrf CUSTOMER' displays the VRF name, its default route distinguisher (RD) of 65001:100, and the interfaces assigned to it. The interfaces listed are Gi0/0.100 and Gi0/1.100, which are both subinterfaces (indicated by the .100 suffix). Therefore, the VRF CUSTOMER is correctly configured with two subinterfaces.

Answer

The VRF CUSTOMER has no route distinguisher configured.

Answer

The VRF CUSTOMER is not active because no routes are shown.

Answer

The VRF CUSTOMER is using OSPF as the routing protocol.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 2

Round Trip Time (RTT) for Index 2
   Latest RTT: No connection
   Latest RTT (milliseconds): No connection
   Latest RTT (microseconds): No connection
   Number of successes: 0
   Number of failures: 100
   Operation time to live: Forever
   Output: No connection

Based on this output, which statement is correct?

Accepted Answer

The target device is not responding to ICMP echo requests, or there is a routing problem.. The output shows 'No connection' for RTT and 'Output: No connection'. This indicates that the IP SLA operation cannot reach the target. The 100 failures confirm this. This is a clear sign of a connectivity issue.

Answer

The IP SLA operation is working correctly but the RTT is too high to measure.

Answer

The IP SLA operation has been manually disabled.

Answer

The IP SLA responder is misconfigured on the source router.

Question 13

What is the default NHRP holdtime value on a Cisco router?

Accepted Answer

3600 seconds. The default NHRP holdtime is 3600 seconds (1 hour). This value can be modified with the 'ip nhrp holdtime' command.

Answer

1800 seconds

Answer

7200 seconds

Answer

600 seconds

Question 14

Which BGP attribute is used for loop prevention in eBGP?

Accepted Answer

AS_PATH. The AS_PATH attribute contains the list of AS numbers a route has traversed. If a BGP router receives a route with its own AS number in the AS_PATH, it discards the route to prevent loops.

Answer

NEXT_HOP

Answer

LOCAL_PREF

Answer

MED

Question 15

A network engineer runs the following command on Router R1:

R1# show ip vrf interfaces
Interface   VRF          IP Address    Protocol
GigabitEthernet0/0   BLUE         10.1.1.1      up
GigabitEthernet0/1   BLUE         10.1.2.1      up
GigabitEthernet0/2   RED          192.168.1.1   up
Loopback0            BLUE         10.0.0.1      up
Loopback1            RED          192.168.0.1   up

Based on this output, which statement is correct?

Accepted Answer

GigabitEthernet0/2 is in VRF RED with IP address 192.168.1.1.. The 'show ip vrf interfaces' command displays all interfaces assigned to VRFs and their IP addresses. The output shows that GigabitEthernet0/0, GigabitEthernet0/1, and Loopback0 are in VRF BLUE, while GigabitEthernet0/2 and Loopback1 are in VRF RED. There are no interfaces in the global routing table shown here, but that is normal for VRF-Lite.

Answer

All interfaces are in the global routing table.

Answer

Loopback0 is in VRF RED.

Answer

GigabitEthernet0/1 has IP address 10.1.2.2.

Question 16

Examine the partial BFD configuration on a router:

interface GigabitEthernet0/0
 bfd interval 100 min_rx 100 multiplier 3
!
interface GigabitEthernet0/1
 bfd interval 200 min_rx 200 multiplier 3
!
router ospf 1
 bfd all-interfaces
!

The router has OSPF neighbors on both interfaces. Which statement is true?

Accepted Answer

The BFD session on GigabitEthernet0/0 will detect failures in 300 ms, and on GigabitEthernet0/1 in 600 ms.. BFD timers are configured per interface. Each BFD session independently uses the timers configured on its respective interface. The multiplier is applied per session.

Answer

Both BFD sessions will use the same timer values because OSPF is configured with 'bfd all-interfaces'.

Answer

The BFD session on GigabitEthernet0/1 will not form because the interval is too high.

Answer

The router will use the minimum interval across all interfaces for consistency.

Question 17

Which THREE commands would a network engineer use to troubleshoot an MPLS L3VPN issue where a CE router cannot reach a remote CE? (Choose THREE.)

Accepted Answer

show ip route vrf CUSTOMER_A. Option A, 'show ip route vrf CUSTOMER_A', is correct because it verifies whether the CE prefix is present in the correct VRF routing table on the PE, confirming that the PE has learned the remote CE route via MP-BGP and installed it. Option B, 'show ip bgp vpnv4 vrf CUSTOMER_A', is correct because it displays the VPNv4 BGP table for that VRF, showing whether the remote CE prefix was received with the proper route target and extended community, which is essential for L3VPN reachability. Option C, 'show mpls forwarding-table vrf CUSTOMER_A', is correct because it confirms that the PE has an MPLS label binding and outgoing label/next-hop for the VRF prefix, proving the data plane can forward labeled packets toward the remote PE. Option D is not among the marked correct answers because a ping only tests end-to-end reachability and does not isolate whether the fault is in the VRF routing table, BGP VPNv4, or MPLS forwarding. Option E is not among the marked correct answers because 'show mpls ldp neighbor' only verifies the LDP session state on the core-facing interfaces and does not directly validate VRF-specific route or label information for the L3VPN customer.

Answer

ping vrf CUSTOMER_A <remote-ce-ip>

Answer

show mpls ldp neighbor

Question 18

Which TWO statements about MPLS Traffic Engineering (MPLS-TE) are true? (Choose TWO.)

Accepted Answer

MPLS-TE uses RSVP-TE to signal label-switched paths (LSPs) and reserve bandwidth.. Option A is correct because MPLS-TE relies on RSVP-TE (Resource Reservation Protocol with Traffic Engineering extensions) as its signaling protocol to establish label-switched paths (LSPs) and reserve bandwidth along the explicit path, using objects such as SESSION_ATTRIBUTE and EXPLICIT_ROUTE. Option B is correct because on Cisco IOS/IOS-XE the privileged EXEC command 'show mpls traffic-eng tunnels' displays the operational status of MPLS-TE tunnels, including tunnel state (up/down), LSP ID, signalled bandwidth, and path information. Option C is incorrect because LDP distributes labels for hop-by-hop IGP-based LSPs and does not carry TE attributes or perform bandwidth reservation; TE tunnels are signaled by RSVP-TE, not LDP. Option D is incorrect because TE attributes such as bandwidth and affinity are carried by IGP extensions (OSPF-TE or IS-IS-TE) and signaled by RSVP-TE, not by BGP. Option E is incorrect because MPLS-TE does not require a full mesh of IBGP sessions; it requires IGP TE extensions and RSVP-TE enabled on the relevant interfaces, and IBGP full-mesh is a BGP requirement for other purposes such as MPLS L3VPN route distribution.

Answer

MPLS-TE uses LDP to distribute labels for the TE tunnels.

Answer

MPLS-TE requires BGP to carry the TE attributes across the network.

Answer

MPLS-TE requires a full mesh of IBGP sessions between all routers.

Question 19

Which TWO statements correctly describe the behavior of BGP conditional route injection? (Choose TWO.)

Accepted Answer

The condition for injection is defined by an exist-map, which must match a less specific prefix in the BGP table.. Option B is correct because conditional route injection uses an exist-map that references a less specific (covering) prefix which must already be present in the BGP table for the injection to occur. Option C is correct because the inject-map defines the more specific prefix (or prefixes) to be conditionally injected, along with any optional BGP attributes such as community or local preference. Option A is wrong because conditional injection does not automatically redistribute connected or static routes; it injects a specific prefix defined in the inject-map. Option D is wrong because 'show ip bgp neighbors' does not display a count of injected prefixes per neighbor; verification is done with commands like 'show ip bgp injected-paths' or 'show ip bgp'. Option E is wrong because the injected prefix does not need to be learned from the neighbor referenced in the inject-map; the exist-map only requires the less specific prefix to exist in the BGP table.

Answer

The injected route is automatically redistributed into connected and static routes.

Answer

The 'show ip bgp neighbors' command displays the number of injected prefixes per neighbor.

Answer

The injected prefix must be learned from the neighbor specified in the inject-map.

Question 20

A network engineer runs the following command on Router R1:

R1# show ip eigrp vrf RED neighbors

EIGRP-IPv4 Neighbors for AS(100) VRF RED
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/2                   13  00:15:30   12   200  0  45
1   192.168.2.2             Gi0/3                   12  00:14:20   15   200  0  32

Based on this output, what is the problem?

Accepted Answer

The EIGRP adjacency is functioning correctly.. The output shows two EIGRP neighbors in VRF RED with valid Hold times (13 and 12 seconds, well above zero), non-zero Uptime (00:15:30 and 00:14:20), and Q Cnt of 0, meaning no queued packets. The Seq Num values (45 and 32) are simply the last sequence numbers received from each neighbor and are not an indicator of a problem. All fields are consistent with a healthy, stable EIGRP adjacency.

Answer

The EIGRP neighbors are not exchanging routes because the Seq numbers are low.

Answer

Both neighbors are in the Init state.

Answer

The hold time of 13 seconds indicates a problem.