300-410 Mock Exam 71 — 25 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show route-map
route-map FILTER_OSPF, permit, sequence 10
  Match clauses:
    ip address prefix-list OSPF_ROUTES
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes
route-map FILTER_OSPF, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, which statement is correct?

Accepted Answer

The route-map will permit all routes that match the prefix-list OSPF_ROUTES and deny all others.. The route-map FILTER_OSPF has two sequences: sequence 10 permits routes matching prefix-list OSPF_ROUTES, and sequence 20 denies all other routes (since no match clause). The match counters show 0 packets/bytes, indicating no traffic has been matched yet, but this is a route-map used for route filtering, not policy routing. The correct answer is that the route-map will deny all routes not matching the prefix-list.

Answer

The route-map will permit all routes because sequence 20 has no match clause.

Answer

The route-map is used for policy-based routing and has matched 0 packets.

Answer

The route-map will deny only routes matching the prefix-list OSPF_ROUTES.

Question 2

A network engineer runs the following command to troubleshoot IPsec with route-maps:

R1# show crypto ipsec transform-set
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Transport, }

Transform set ESP-AES: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel, }

What does this output indicate?

Accepted Answer

There are two transform sets configured, one using transport mode and one using tunnel mode.. The output shows two IPsec transform sets: 'combined' and 'ESP-AES'. The 'combined' set uses transport mode, while 'ESP-AES' uses tunnel mode. This indicates that different transform sets are configured for different purposes.

Answer

The transform set 'combined' is not valid.

Answer

IPsec is not configured because no transform set is active.

Answer

The transform set 'ESP-AES' is used for route-map filtering.

Question 3

A network engineer runs the following command to troubleshoot a VRF-Lite IPsec issue:

R1# show crypto ipsec transform-set vrf CUSTOMER_H

Output:
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel,  }

What does this output indicate?

Accepted Answer

The transform set uses ESP with AES 256 and SHA-HMAC in tunnel mode.. The 'show crypto ipsec transform-set vrf' command displays the IPsec transform set for a specific VRF. The output shows a transform set named 'combined' that uses ESP with AES 256-bit encryption and SHA-HMAC authentication. It will negotiate a tunnel mode (as opposed to transport mode).

Answer

The transform set uses ESP with AES 256 and SHA-HMAC in transport mode.

Answer

The transform set uses AH with AES 256 and MD5.

Answer

The transform set does not specify any encryption or authentication.

Question 4

Drag and drop the steps to verify and validate VRF-Lite operational state into the correct order, from first to last.

Accepted Answer

Display all VRFs with show vrf brief. Begin by listing all configured VRFs. Then confirm which interfaces belong to each VRF. Next, check the VRF-specific routing table for expected routes. After that, test reachability to a remote destination within the VRF. Finally, validate end-to-end connectivity with extended ping or traceroute using the VRF.

Question 5

A network engineer configures iBGP within a VRF-Lite environment. The VRF has an IGP (OSPF) running, and BGP is used to exchange customer routes. The engineer notices that BGP routes are not being installed in the VRF routing table, even though they are present in the BGP table. The 'bgp redistribute-internal' command is not configured. Which is the most likely explanation?

Accepted Answer

The next-hop of the iBGP route is not reachable via any route in the VRF routing table, so the route is not installed.. In iBGP, the next-hop for a route learned from an iBGP peer must be reachable via an IGP or static route. If the next-hop is not reachable, the route is not installed in the routing table. Additionally, if the IGP does not carry the next-hop route (e.g., because it is a loopback not advertised), the route remains hidden. This is a common edge case where synchronization is not the issue, but next-hop reachability is.

Answer

The BGP synchronization rule is enabled, and the IGP does not have a route for the prefix, so BGP does not advertise the route.

Answer

The 'maximum-paths' command is set to 1, and there is already a route with a lower administrative distance.

Answer

The BGP table shows the route as 'rR' (rIBGP and RIB-failure), indicating a RIB failure due to a higher metric.

Question 6

A network engineer is troubleshooting a BGP route-map that is supposed to prepend AS-path to routes from a specific neighbor. The engineer configures a route-map with 'set as-path prepend 65001' and applies it outbound to the neighbor. After the configuration, the engineer checks the BGP table on the neighbor and sees that the AS-path does not include the prepended AS. What is the most likely cause?

Accepted Answer

The route-map is missing a 'match' statement; without it, the set command is not applied to any routes.. The 'set as-path prepend' command must be used with 'ip as-path access-list' or in a route-map, but the route-map must be applied in the correct direction. If the route-map is applied outbound, it modifies the AS-path before sending. However, if the neighbor is an eBGP neighbor, the router will not prepend its own AS unless the AS is different from the neighbor's AS. Also, the route-map must have a 'match' statement that matches the routes.

Answer

The AS 65001 is the same as the neighbor's AS, so BGP ignores the prepend.

Answer

The route-map is applied inbound instead of outbound.

Answer

The neighbor has 'soft-reconfiguration inbound' which prevents AS-path changes.

Question 7

Consider the following configuration on R5:

!--- R5 configuration
ip prefix-list PL-2 seq 5 permit 10.0.0.0/8 ge 16 le 24
!
route-map RMAP permit 10
 match ip address prefix-list PL-2
 set community 100:100
!
router bgp 65200
 neighbor 192.168.1.2 route-map RMAP out
!

What is the effect of this configuration?

Accepted Answer

Only routes with prefix 10.0.0.0/8 and mask length between 16 and 24 are sent to neighbor with community 100:100.. The prefix-list PL-2 permits prefixes that match 10.0.0.0/8 with a mask length greater than or equal to 16 and less than or equal to 24. So, for example, 10.1.0.0/16, 10.1.1.0/24 are permitted, but 10.0.0.0/8 itself (mask 8) is not. The route-map RMAP sets community 100:100 on matching routes. Routes that do not match the prefix-list are not processed by this route-map (since there is only one sequence), so they are denied (not sent to neighbor).

Answer

All routes with prefix 10.0.0.0/8 are sent to neighbor; routes with mask length between 16 and 24 get community 100:100.

Answer

Routes that match the prefix-list are sent with community 100:100; all other routes are sent without any community.

Answer

The configuration is invalid because the prefix-list uses ge and le together; only one can be used.

Question 8

Which TWO statements correctly describe the behavior of VRF-Lite when using OSPF as the IGP? (Choose TWO.)

Accepted Answer

The OSPF process must be configured with the 'vrf ' keyword to associate it with a specific VRF.. In VRF-Lite, OSPF can be configured per VRF, and the OSPF process uses the VRF's routing table. The 'router ospf vrf ' command creates a VRF-aware OSPF process. By default, OSPF uses the VRF's route table, not the global table. The 'network' statement under the OSPF process is still used to enable OSPF on interfaces, but the interface must be in the same VRF. Option A is correct because the OSPF process is VRF-specific. Option D is correct because the 'network' command is still valid. Option B is incorrect because OSPF does not require BGP; it can run directly. Option C is incorrect because OSPF does not automatically redistribute connected routes; a redistribution command is needed. Option E is incorrect because OSPF LSA types are the same in VRF-Lite.

Answer

OSPF in VRF-Lite requires an MP-BGP session to exchange routes between VRFs.

Answer

By default, OSPF automatically redistributes all connected routes in the VRF into OSPF.

Answer

OSPF in VRF-Lite uses different LSA types compared to global OSPF.

Question 9

In a VRF-Lite network, redistribution is configured between OSPF and EIGRP. The engineer notices that some routes are being redistributed in a loop, causing instability. The network uses route tagging, but the loop persists. Which is the most likely explanation?

Accepted Answer

The seed metric for EIGRP is set to a low value (e.g., 1), causing the redistributed route to be preferred over the original OSPF route, leading to a loop.. Mutual redistribution can cause routing loops if routes are not properly tagged and filtered. However, even with tags, if the seed metric is not set correctly, the redistributed route may have a lower metric than the original, causing it to be preferred and re-redistributed. The edge case here is that the seed metric for EIGRP (default is infinity) must be set, but if set too low, it can cause loops. Additionally, if the same prefix exists in both protocols, the administrative distance comparison may cause the redistributed route to be preferred over the original, leading to a loop.

Answer

The route tag is not being propagated correctly because OSPF uses a 32-bit tag and EIGRP uses a 32-bit tag, but the tag is lost during redistribution.

Answer

The administrative distance of OSPF (110) is lower than EIGRP (90), so the redistributed route is always preferred.

Answer

The 'redistribute connected' command is used under OSPF, which redistributes all connected interfaces, including the loopback used for router ID.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 2

Round Trip Time (RTT) for Index 2
   Latest RTT: No connection
   Latest RTT (milliseconds): No connection
   Latest RTT (microseconds): No connection
   Number of successes: 0
   Number of failures: 100
   Operation time to live: Forever
   Output: No connection

Based on this output, which statement is correct?

Accepted Answer

The target device is not responding to ICMP echo requests, or there is a routing problem.. The output shows 'No connection' for RTT and 'Output: No connection'. This indicates that the IP SLA operation cannot reach the target. The 100 failures confirm this. This is a clear sign of a connectivity issue.

Answer

The IP SLA operation is working correctly but the RTT is too high to measure.

Answer

The IP SLA operation has been manually disabled.

Answer

The IP SLA responder is misconfigured on the source router.

Question 11

Which TWO statements about VRF-Lite and DHCP are true? (Choose TWO.)

Accepted Answer

The 'ip dhcp relay' command can be configured with the 'vrf' keyword to forward DHCP requests from a VRF to a DHCP server in a different VRF.. In VRF-Lite, DHCP can be configured to operate within a specific VRF. The 'ip dhcp relay' command can be used with the 'vrf' keyword to relay DHCP requests from a VRF to a DHCP server in another VRF or the global table. Option A is correct because the relay can forward to a server in a different VRF. Option D is correct because the DHCP server can be in the global routing table and still serve clients in a VRF if the relay is configured correctly. Option B is incorrect because DHCP clients can obtain addresses from a server in the same VRF without relay. Option C is incorrect because the 'ip dhcp pool' command does not have a 'vrf' keyword; pools are global. Option E is incorrect because DHCP snooping is not required for VRF-Lite DHCP to work.

Answer

DHCP clients in a VRF cannot obtain an IP address from a DHCP server that is in the same VRF.

Answer

The 'ip dhcp pool' command supports a 'vrf' keyword to associate the pool with a specific VRF.

Answer

DHCP snooping must be enabled globally for DHCP to work across VRFs.

Question 12

An engineer configures IPsec between two VRF-Lite routers using a site-to-site VPN. The tunnel is established, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the correct interface and that the ACL for interesting traffic matches the VRF traffic. Which is the most likely explanation?

Accepted Answer

The ACL for interesting traffic is not matching the VRF traffic because the ACL is evaluated in the global routing table, not the VRF.. In VRF-Lite, traffic is forwarded based on the VRF routing table. However, IPsec crypto maps operate on the global routing table by default. If the traffic is in a VRF, the crypto map must be applied with the VRF keyword or the traffic must be redirected using a policy-based route (PBR) to the global table. Without this, the crypto engine does not see the traffic as interesting, so it is not encrypted.

Answer

The crypto map is applied to the wrong interface; it should be applied to the VRF interface, not the physical interface.

Answer

The IPsec transform set has a mismatch in the encryption algorithm, causing the tunnel to fail to establish.

Answer

The 'crypto isakmp key' command is missing the VRF keyword, causing IKE to fail.

Question 13

In OSPF, what is the default hello interval on a point-to-point network type?

Accepted Answer

10 seconds. OSPF default hello interval is 10 seconds for broadcast and point-to-point networks, and 30 seconds for NBMA networks. This is defined in RFC 2328.

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 14

Which TWO statements about using prefix-lists in conjunction with route-maps for filtering IPv4 routes are true? (Choose TWO.)

Accepted Answer

A prefix-list entry with "ge 24" matches any prefix with a subnet mask greater than or equal to 24 bits.. Prefix-lists can match on prefix length and subnet mask using ge and le operators. A prefix-list entry can be configured to permit or deny. When used in a route-map, the match ip address prefix-list command references the prefix-list. If the prefix-list denies, the route-map clause is not matched, and the route falls to the next clause. The prefix-list can also be used directly in a distribute-list without a route-map.

Answer

A prefix-list can be used directly in a route-map without a match command.

Answer

The le operator in a prefix-list matches prefixes with a mask length less than the specified value.

Answer

A prefix-list can only be used with route-maps, not with distribute-lists.

Question 15

An engineer configures a BGP route reflector with a route map that sets a higher local preference on routes received from a client. The route map is applied to the neighbor statement for the client. Unexpectedly, the route reflector does not reflect the modified local preference to other clients. Which is the most likely explanation?

Accepted Answer

The route map is applied outbound, not inbound, so the local preference is set after the route is reflected.. When a route map is applied to a BGP neighbor inbound, it modifies the route before it is installed in the BGP table. However, route reflectors reflect routes based on the best path selection, and if the local preference is set, it should be reflected. The issue is that the route map is applied outbound instead of inbound, or the route map does not explicitly set the local preference before the route is processed. The most common edge case is that the route map is applied outbound, which does not affect the route before reflection.

Answer

Route reflectors do not modify local preference; only the route reflector itself can set local preference.

Answer

The route map must be applied to the route reflector's cluster list, not the neighbor.

Answer

The local preference is overridden by the next-hop-self command.

Question 16

In a VRF-Lite environment, EIGRP is configured between two routers. The engineer notices that the EIGRP neighbor relationship is flapping intermittently. Debug output shows 'dually' messages and the route is occasionally marked as 'stuck-in-active' (SIA). The link is Ethernet with no errors. Which is the most likely explanation?

Accepted Answer

A unidirectional link issue is present, where EIGRP packets are successfully sent but not received, causing the query process to time out.. EIGRP uses the Reliable Transport Protocol (RTP) for updates, queries, and replies. If there is a unidirectional link issue (e.g., one direction has high latency or packet loss), the query process may not receive replies in time, causing the route to become SIA. This is a classic edge case where the link appears operational but is unidirectional for EIGRP packets.

Answer

The EIGRP K-values are mismatched between the two routers, causing the neighbor to reset.

Answer

The EIGRP stub routing feature is enabled on one router, preventing query propagation and causing the active process to hang.

Answer

The 'eigrp log-neighbor-changes' command is causing excessive logging, which delays EIGRP processing.

Question 17

An enterprise is using CoPP to protect the control plane. R1 has the following configuration: access-list 100 permit udp any any eq 179 class-map match-any BGP match access-group 100 policy-map COPP class BGP police 100000 20000 conform-action transmit exceed-action drop. Router R2 shows: 'show ip bgp summary' indicates the BGP session to R1 is flapping every 30 seconds. R1's 'show policy-map control-plane' shows drops for class BGP. What is the root cause?

Accepted Answer

The CoPP policy is rate-limiting BGP traffic too aggressively, causing BGP packets to be dropped and the session to flap.. CoPP is rate-limiting BGP traffic (TCP port 179) to 100 kbps with a burst of 20 kbps. BGP keepalives and updates can exceed this rate, especially if there are many prefixes or if the session is flapping. The drops cause BGP packets to be lost, leading to hold timer expiry and session flapping. The root cause is that the police rate is too low for the BGP traffic volume. The correct fix is to increase the police rate or add a more specific match to only rate-limit certain BGP packets.

Answer

The police rate is set too high, causing the router to drop all BGP traffic.

Answer

The class-map is not applied to the control-plane, so the policy has no effect.

Question 18

What is the default administrative distance for routes learned via OSPF in Cisco IOS?

Accepted Answer

110. OSPF has a default administrative distance of 110, as defined in Cisco IOS. This is used for route selection when multiple routing protocols provide the same prefix.

Answer

90

Answer

100

Answer

120

Question 19

An engineer configures EIGRP named mode with an offset-list applied to the EIGRP topology table. The offset-list increases the metric of a route learned from a neighbor. However, the route is still used as the successor even though the offset-list increased its metric above the feasible distance (FD) of another route. Which is the most likely explanation?

Accepted Answer

The offset-list only affects the advertised distance (AD), not the feasible distance (FD).. In EIGRP named mode, the offset-list is applied to the route's metric in the topology table, but it does not affect the feasible distance (FD) calculation. The FD is computed from the original metric before the offset. The successor is chosen based on the FD, not the offset metric, so the route remains the successor.

Answer

The offset-list is applied to the wrong interface; it must be applied to the outgoing interface.

Answer

The offset-list is applied in classic mode, but the router is running named mode.

Answer

The offset-list value is too small to change the successor; a larger value is needed.

Question 20

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 3

Round Trip Time (RTT) for Index 3
   Latest RTT: 150 ms
   Latest RTT (milliseconds): 150
   Latest RTT (microseconds): 150000
   Number of successes: 80
   Number of failures: 20
   Operation time to live: Forever
   Output: OK

R1# show track 1
Track 1
  IP SLA 3 reachability
  Reachability is Up
    2 changes, last change 00:00:10
  Latest operation return code: OK
  Latest RTT (milliseconds): 150
  Tracked by:
    ip route 0.0.0.0 0.0.0.0 192.168.1.1 track 1

Based on this output, which statement is correct?

Accepted Answer

The IP SLA operation is considered reachable, and the tracked static route is active.. The track shows 'Reachability is Up' based on IP SLA 3. The IP SLA statistics show successes and failures, but the latest return code is OK, so the track is up. This means the static route is active. The failures (20) indicate some probes failed, but the track still considers it reachable because the threshold for reachability is likely based on a percentage or consecutive failures.

Answer

The static route is removed because the IP SLA operation has failures.

Answer

The IP SLA operation has a 20% failure rate, so the track should be down.

Answer

The IP SLA operation is using a wrong source address.