300-410 Mock Exam 71 — 25 Questions

Question 1

What is the default administrative distance for routes learned via OSPF in Cisco IOS?

Accepted Answer

110. OSPF has a default administrative distance of 110, as defined in Cisco IOS. This is used for route selection when multiple routing protocols provide the same prefix.

Answer

90

Answer

100

Answer

120

Question 2

A network engineer configures PBR on a router to route traffic from subnet 10.1.1.0/24 via next-hop 192.168.1.2. The route-map uses match ip address and set ip next-hop commands. However, traffic sourced from 10.1.1.5 still follows the routing table instead of the PBR policy. What is the most likely cause?

Accepted Answer

The router is generating the traffic locally (e.g., ping from the router), and PBR does not apply to local packets without 'ip local policy route-map'.. PBR processes only transit traffic; locally generated packets (e.g., from the router itself) are not affected by PBR unless the 'ip local policy route-map' command is used. The engineer must apply PBR globally for local packets.

Answer

The route-map is applied to the wrong interface (outbound instead of inbound).

Answer

The ACL in the route-map is missing a permit statement for subnet 10.1.1.0/24.

Answer

The next-hop 192.168.1.2 is not reachable via any directly connected interface.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip sla summary

IPSLAs Latest Operation Summary

Codes: * active, ^ inactive, ~ pending

ID       Type            Destination       Stats          Return Code      Last
1        icmp-echo       192.168.1.1       RTT=50ms       OK               1s ago
2        icmp-echo       192.168.1.2       RTT=2000ms     Over threshold   2s ago
3        icmp-echo       192.168.1.3       RTT=100ms      OK               3s ago

Based on this output, which statement is correct?

Accepted Answer

IP SLA operation 2 is experiencing high latency, exceeding the configured threshold.. The 'Return Code' column shows 'Over threshold' for ID 2, meaning the RTT exceeded the configured threshold. The other operations are OK. This output does not indicate failure or timeout unless the return code says so.

Answer

IP SLA operation 2 has failed because the destination is unreachable.

Answer

IP SLA operation 1 is not active because it shows 'OK'.

Answer

IP SLA operation 3 has a pending status.

Question 4

Examine this partial configuration:
```
interface GigabitEthernet0/0
 ip vrf forwarding CUSTOMER_F
 ip address 10.10.10.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip vrf forwarding CUSTOMER_G
 ip address 10.10.20.1 255.255.255.0
```
What is required to enable communication between VRF CUSTOMER_F and VRF CUSTOMER_G?

Accepted Answer

Add static routes with the 'vrf' keyword to point to the other VRF's next hop.. By default, VRFs are isolated. To enable communication between them, route leaking must be configured, typically using static routes with the 'vrf' keyword or using route-replicate commands.

Answer

No additional configuration is needed; VRFs can communicate by default.

Answer

Configure a route-map and import/export route-targets between the VRFs.

Answer

Use the 'ip route vrf' command to create a global route that points to the VRF interface.

Question 5

Examine the following configuration:
```
interface GigabitEthernet0/1
 ip vrf forwarding CUSTOMER_C
 ip address 10.1.1.1 255.255.255.0
 no shutdown
```
What is missing from this configuration to ensure that routes from VRF CUSTOMER_C are properly isolated?

Accepted Answer

Nothing is missing; this configuration provides proper VRF isolation.. The configuration is complete for basic VRF-Lite. VRF isolation is achieved by associating the interface with a VRF, which creates a separate routing table. No additional commands are required for isolation.

Answer

A route-target import/export statement under the VRF definition.

Answer

The command 'ip vrf forwarding CUSTOMER_C' must be preceded by 'no ip address' to avoid IP address removal.

Answer

A 'vrf definition CUSTOMER_C' must be used instead of 'ip vrf' on newer IOS versions.

Question 6

An engineer configures IPsec between two VRF-Lite routers using a site-to-site VPN. The tunnel is established, but no traffic is encrypted. The engineer verifies that the crypto map is applied to the correct interface and that the ACL for interesting traffic matches the VRF traffic. Which is the most likely explanation?

Accepted Answer

The ACL for interesting traffic is not matching the VRF traffic because the ACL is evaluated in the global routing table, not the VRF.. In VRF-Lite, traffic is forwarded based on the VRF routing table. However, IPsec crypto maps operate on the global routing table by default. If the traffic is in a VRF, the crypto map must be applied with the VRF keyword or the traffic must be redirected using a policy-based route (PBR) to the global table. Without this, the crypto engine does not see the traffic as interesting, so it is not encrypted.

Answer

The crypto map is applied to the wrong interface; it should be applied to the VRF interface, not the physical interface.

Answer

The IPsec transform set has a mismatch in the encryption algorithm, causing the tunnel to fail to establish.

Answer

The 'crypto isakmp key' command is missing the VRF keyword, causing IKE to fail.

Question 7

In a VRF-Lite scenario with OSPF, what is the default network type on a physical Ethernet interface?

Accepted Answer

Broadcast. By default, OSPF sets the network type to broadcast on Ethernet interfaces, which enables DR/BDR election.

Answer

Point-to-point

Answer

Non-broadcast

Answer

Point-to-multipoint

Question 8

A network uses PBR to load-balance traffic from two subnets (10.1.1.0/24 and 10.2.2.0/24) across two ISPs (next-hops 100.64.1.1 and 100.64.2.2). After a routing change, traffic from 10.1.1.0/24 is being sent to both ISPs intermittently. Router R1 shows: 'show route-map' shows the route-map with two match clauses, 'debug ip policy' shows traffic from 10.1.1.0/24 being sent to both next-hops. What is the root cause?

Accepted Answer

The route-map has a match clause that matches both subnets, causing traffic to be load-balanced across both next-hops. Use specific ACLs or separate route-map entries.. PBR route-maps can have multiple match clauses, but if the route-map does not have a 'sequence' number or if the match clauses are not mutually exclusive, traffic can match multiple clauses. In this case, the route-map likely has a match clause that matches both subnets (e.g., using a less specific ACL), causing traffic from 10.1.1.0/24 to match both clauses and be load-balanced. The solution is to ensure the ACLs in the route-map are mutually exclusive or use separate route-map entries with sequence numbers.

Answer

The 'set ip next-hop' command is missing the 'load-balance' keyword, causing PBR to use both next-hops by default.

Answer

The routing table on R1 has equal-cost routes to both ISPs, causing PBR to be overridden by the routing table.

Answer

The interface where PBR is applied is in a VRF, causing the route-map to be applied incorrectly.

Question 9

An engineer configures EIGRP named mode with an offset-list applied to the EIGRP topology table. The offset-list increases the metric of a route learned from a neighbor. However, the route is still used as the successor even though the offset-list increased its metric above the feasible distance (FD) of another route. Which is the most likely explanation?

Accepted Answer

The offset-list only affects the advertised distance (AD), not the feasible distance (FD).. In EIGRP named mode, the offset-list is applied to the route's metric in the topology table, but it does not affect the feasible distance (FD) calculation. The FD is computed from the original metric before the offset. The successor is chosen based on the FD, not the offset metric, so the route remains the successor.

Answer

The offset-list is applied to the wrong interface; it must be applied to the outgoing interface.

Answer

The offset-list is applied in classic mode, but the router is running named mode.

Answer

The offset-list value is too small to change the successor; a larger value is needed.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip dhcp database
URL : flash:/dhcpdb
Read/write : Read/Write
Last updated : Mar 01 2020 00:00:00
Status : Last read succeeded. Next write scheduled in 0 seconds.

Based on this output, which statement is correct?

Accepted Answer

The DHCP database is stored in flash and is functioning correctly.. The output shows the DHCP database is stored in flash (URL: flash:/dhcpdb) with read/write access, and the status indicates the last read succeeded with a write scheduled in 0 seconds. This confirms the database is functioning correctly, as the router can read and write DHCP bindings to flash memory, which is the default storage location for DHCP database persistence.

Answer

The DHCP database is stored in NVRAM and is read-only.

Answer

The DHCP database write failed and needs to be rescheduled.

Answer

The DHCP database is empty because no bindings exist.

Question 11

Which TWO statements about DHCPv6 prefix delegation are true? (Choose TWO.)

Accepted Answer

The delegating router must have a DHCPv6 pool configured with a prefix-delegation statement.. The delegating router (DHCPv6 server) must have a DHCPv6 pool configured with a prefix-delegation statement to define the prefix pool from which it can assign prefixes to requesting routers. This is a mandatory configuration for the server to provide prefix delegation as per RFC 3633.

Answer

The requesting router uses the IA_NA option to request a prefix.

Answer

The delegating router must be configured with 'ipv6 dhcp server' under the downstream interface facing the requesting router.

Answer

The requesting router can only use the delegated prefix on the interface that received it.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip vrf interfaces
Interface   VRF          IP Address    Protocol
GigabitEthernet0/0   BLUE         10.1.1.1      up
GigabitEthernet0/1   BLUE         10.1.2.1      up
GigabitEthernet0/2   RED          192.168.1.1   up
Loopback0            BLUE         10.0.0.1      up
Loopback1            RED          192.168.0.1   up

Based on this output, which statement is correct?

Accepted Answer

GigabitEthernet0/2 is in VRF RED with IP address 192.168.1.1.. The 'show ip vrf interfaces' command displays all interfaces assigned to VRFs and their IP addresses. The output shows that GigabitEthernet0/0, GigabitEthernet0/1, and Loopback0 are in VRF BLUE, while GigabitEthernet0/2 and Loopback1 are in VRF RED. There are no interfaces in the global routing table shown here, but that is normal for VRF-Lite.

Answer

All interfaces are in the global routing table.

Answer

Loopback0 is in VRF RED.

Answer

GigabitEthernet0/1 has IP address 10.1.2.2.

Question 13

Drag and drop the steps to verify and validate Policy-Based Routing (PBR) operational state into the correct order, from first to last.

Accepted Answer

Check interface for PBR enablement (show ip policy). First, check if PBR is enabled on the interface. Then view the route map statistics and hit counts. Examine the set actions and next-hop status. Use 'show ip policy' to confirm policy map. Finally, use 'show route-map' to validate sequence and matches.

Question 14

A network engineer runs the following command to verify BFD operation:

R1# show bfd neighbors detail

IPv4 Sessions
NeighAddr      LD/RD         RH/RS     State     Int
10.1.1.2      1/2           Up        Up        Gi0/0
Session state is UP and not using echo function.
Session type: single-hop
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 0 (0), Hello (hits): 1000/5
Rx Count: 1000, Rx Interval (ms) min/max/avg: 900/1100/1000
Tx Count: 1000, Tx Interval (ms) min/max/avg: 900/1100/1000

What does this output indicate?

Accepted Answer

BFD session is operating with async mode, intervals at 1 second.. The output shows a BFD session in UP state with consistent transmit and receive intervals around 1000 ms, no echo function, and a multiplier of 3. The session is healthy.

Answer

BFD session is using echo mode for fast failure detection.

Answer

BFD session is down and not sending hellos.

Answer

BFD session has a holddown timer of 3 seconds.

Question 15

In a DMVPN phase 3 network, Router R1 (hub) and R2 (spoke) have an mGRE tunnel. R1 has EIGRP configured over the tunnel with 'no ip split-horizon' and 'distance eigrp 90 100'. R2 has default EIGRP configuration. R2 learns a route to 192.168.1.0/24 via the tunnel with AD 90. Later, R2 also learns the same route via a physical interface from another spoke R3 using EIGRP with AD 90. R2's 'show ip route 192.168.1.0' shows the route via R3. What is the root cause?

Accepted Answer

The route via R3 has a better metric (lower composite) than the route via R1, so it is preferred.. EIGRP uses metric (composite) to choose between routes with equal AD. The route via R3 might have a better metric. However, if the distance is changed on R1 to 100 for external routes, the route via R1 might have AD 100, but the question says AD 90. The correct answer is that the route via R3 is an internal route (AD 90) with a lower metric than the route via R1 (also AD 90), so metric decides. But the trick is that the tunnel interface on R2 might have a higher delay, causing a worse metric.

Answer

R2's EIGRP process has 'variance 2' configured, causing load balancing.

Answer

The route via R1 is an external route (AD 100) due to redistribution, so it is less preferred.

Answer

R2 has a static route with AD 1 that overrides both.

Question 16

Which THREE symptoms indicate a potential IPsec site-to-site VPN failure due to mismatched IKE parameters? (Choose THREE.)

Accepted Answer

The 'show crypto isakmp sa' output shows 'MM_NO_STATE'.. The 'show crypto isakmp sa' output showing 'MM_NO_STATE' indicates that the IKE Phase 1 negotiation has failed to progress past the Main Mode initial exchange. This typically occurs when IKE parameters such as encryption, hash, Diffie-Hellman group, or authentication method do not match between the two VPN peers, preventing the establishment of an ISAKMP security association.

Answer

The 'show crypto ipsec sa' output shows packet errors.

Answer

The 'show crypto isakmp sa' output shows 'ACTIVE' state.

Question 17

Which TWO statements about IPv6 First Hop Security (FHS) Source Guard are true? (Choose TWO.)

Accepted Answer

IPv6 Source Guard uses the IPv6 binding table to permit or deny traffic based on source address.. IPv6 Source Guard uses the IPv6 binding table (populated by ND snooping and/or DHCPv6 snooping) to permit or deny traffic based on the source IPv6 address in the packet. This prevents spoofing attacks by ensuring that only traffic from legitimate, learned source addresses is forwarded, similar to IPv4 Source Guard.

Answer

IPv6 Source Guard dynamically creates binding entries for all IPv6 addresses learned via ND.

Answer

IPv6 Source Guard filters traffic based on the destination IPv6 address in the packet.

Answer

IPv6 Source Guard only works with addresses learned via DHCPv6.

Question 18

A network engineer runs the following command to troubleshoot a route filtering issue:

R1# debug ip bgp updates
BGP(0): 10.1.1.2 rcvd UPDATE w/ attr: nexthop 10.1.1.2, origin i, metric 0, path 65001 65002
BGP(0): 10.1.1.2 rcvd UPDATE about 192.168.100.0/24 -- DENIED due to: community no-export;

What does this output indicate?

Accepted Answer

The prefix 192.168.100.0/24 is denied because of the no-export community.. The debug output shows that BGP received an update for prefix 192.168.100.0/24 from neighbor 10.1.1.2, but the update was denied because the prefix has the community 'no-export'. This indicates that an inbound route-map or filter is configured to deny routes with the no-export community.

Answer

The prefix 192.168.100.0/24 is being accepted and installed in the BGP table.

Answer

The prefix 192.168.100.0/24 is denied because of an AS_PATH filter.

Answer

The prefix 192.168.100.0/24 is accepted but not advertised to any neighbor.

Question 19

Which TWO commands can be used to verify IP SLA operations on a Cisco IOS device? (Choose TWO.)

Accepted Answer

show ip sla statistics. The 'show ip sla statistics' command displays the latest statistics for each IP SLA operation, and 'show ip sla reaction-configuration' shows the threshold and reaction settings. 'show ip sla configuration' shows the configuration but not live statistics. 'show ip sla monitor' is a legacy command not used in modern IOS. 'show ip sla summary' is not a valid command.

Answer

show ip sla configuration

Answer

show ip sla monitor

Answer

show ip sla summary

Question 20

Which THREE symptoms indicate that an administrative distance misconfiguration might be causing routing issues? (Choose THREE.)

Accepted Answer

The router prefers a route learned via a less reliable protocol over a more reliable one.. When AD is misconfigured, the router may prefer a less reliable route, causing suboptimal or intermittent connectivity. Common symptoms include incorrect route selection, flapping routes, and traffic taking unexpected paths. These are all signs that the AD values should be reviewed.

Answer

Routes are flapping in the routing table due to metric changes.

Answer

The routing table shows two routes to the same network with different AD values.