300-410 Mock Exam 73 — 25 Questions

Question 1

A network engineer runs the following command to verify DHCPv4 server conflict detection on router R1:

R1# show ip dhcp conflict

Output:
 IP address       Detection method   Detection time        VRF
 192.168.1.50     Ping               Mar 01 2025 10:00 AM  default
 192.168.1.75     Gratuitous ARP     Mar 01 2025 11:00 AM  default

What does this output indicate?

Accepted Answer

The DHCP server has detected two IP address conflicts on the network.. The 'show ip dhcp conflict' command displays IP addresses that the DHCP server has detected as conflicting with another device on the network. The output shows two entries, each with a detection method (Ping or Gratuitous ARP), indicating that the DHCP server identified conflicts for 192.168.1.50 and 192.168.1.75. This confirms that two IP address conflicts have been detected and logged in the DHCP conflict database.

Answer

The DHCP server has successfully assigned IP addresses 192.168.1.50 and 192.168.1.75.

Answer

The DHCP server uses only ping to detect conflicts.

Answer

The DHCP server has cleared all conflicts from the database.

Question 2

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# debug ip packet 100 detail
IP packet debugging is on for access list 100
*Mar  1 00:12:34.567: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto UDP, flags 0x0, sport 12345, dport 80, access list 100: matched line 10 permit udp host 10.1.1.1 host 10.2.2.2 eq 80
*Mar  1 00:12:35.123: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x2, sport 12346, dport 443, access list 100: matched line 20 deny tcp host 10.1.1.1 host 10.2.2.2 eq 443
*Mar  1 00:12:35.124: IP: s=10.1.1.1 (GigabitEthernet0/0), d=10.2.2.2, len 100, proto TCP, flags 0x10, sport 12346, dport 443, access list 100: matched line 20 deny tcp host 10.1.1.1 host 10.2.2.2 eq 443

What does this output indicate?

Accepted Answer

The ACL is applied inbound on GigabitEthernet0/0 and is permitting UDP traffic to port 80 while denying TCP traffic to port 443.. The debug output shows packets entering GigabitEthernet0/0 (source interface) and matching ACL 100. The first packet (UDP to port 80) matches line 10 (permit), while subsequent TCP packets to port 443 match line 20 (deny). Since the source interface is the inbound interface, the ACL is applied inbound. This confirms Option A: the ACL permits UDP to port 80 and denies TCP to port 443.

Answer

The ACL is applied outbound on GigabitEthernet0/0 and is permitting all traffic.

Answer

The ACL is misconfigured because TCP traffic to port 443 should be permitted.

Answer

The ACL is not applied to any interface because debug ip packet shows only the ACL number.

Question 3

A network administrator configures 'ipv6 dhcp guard' on a switch and sets the policy to 'allow only' for a specific DHCPv6 server. However, clients are still receiving DHCPv6 replies from a rogue server on the same VLAN. The engineer verifies that the rogue server's port is not trusted. What is the most likely reason the rogue server's advertisements are not being blocked?

Accepted Answer

IPv6 snooping is not enabled globally, so DHCPv6 Guard cannot inspect DHCPv6 messages.. DHCPv6 Guard relies on IPv6 snooping (also known as DHCPv6 snooping) to inspect DHCPv6 messages and enforce policies. If IPv6 snooping is not enabled globally on the switch, DHCPv6 Guard has no binding database or inspection mechanism to identify and block rogue DHCPv6 replies, even if the policy is configured and the rogue port is untrusted. The 'ipv6 dhcp guard' command alone is insufficient without the underlying snooping framework.

Answer

The rogue server is using a different UDP port for DHCPv6.

Answer

The 'allow only' policy only works for DHCPv6 requests, not replies.

Answer

The rogue server is on a trunk port, and DHCPv6 Guard does not apply to trunk ports.

Question 4

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto ipsec sa detail

interface: Tunnel0
    Crypto map tag: CMAP, local addr 192.168.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   current_peer 192.168.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

local crypto endpt.: 192.168.1.1, remote crypto endpt.: 192.168.2.2
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0/0
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none

inbound esp sas:
      spi: 0x0(0)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 0, flow_id: 0, sibling_flags 80000000, crypto map: CMAP
        sa timing: remaining key lifetime (k/sec): (0/0)
        IV size: 8 bytes
        replay detection support: N

outbound esp sas:
      spi: 0x0(0)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 0, flow_id: 0, sibling_flags 80000000, crypto map: CMAP
        sa timing: remaining key lifetime (k/sec): (0/0)
        IV size: 8 bytes
        replay detection support: N

What does this output indicate?

Accepted Answer

The IPsec SA is in a pending state; the SPI is 0, meaning the SA negotiation is incomplete or the SA has been deleted.. The output shows SPI values of 0x0 for both inbound and outbound ESP SAs, with zero packet encapsulation and encryption counts. This indicates that the IPsec Security Association (SA) negotiation is incomplete or the SA has been deleted, as a valid SA would have a non-zero SPI and active packet counters. The 'current_peer' and crypto map are present, but the SA is not operational.

Answer

The IPsec SA is fully established and encrypting traffic.

Answer

The IPsec SA is using PFS, which is causing the SA to be rekeyed frequently.

Answer

The crypto map is not applied to the interface, so the SA is not used.

Question 5

What is the default administrative distance for OSPF routes in a VRF when OSPF is used as the PE-CE routing protocol in MPLS L3VPN?

Accepted Answer

110. OSPF routes have a default administrative distance of 110, which applies both in the global table and within a VRF.

Answer

90

Answer

115

Answer

120

Question 6

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:1::1                              0   aaaa.bbbb.cccc  REACH  Gi0/0/0
2001:DB8:1::2                             10   aaaa.bbbb.cccd  STALE  Gi0/0/0
2001:DB8:1::3                              -   aaaa.bbbb.ccce  DELAY  Gi0/0/1
FE80::1                                    0   aaaa.bbbb.cccf  REACH  Gi0/0/0

Based on this output, which statement is correct?

Accepted Answer

The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.. The DELAY state in IPv6 Neighbor Discovery (ND) indicates that a neighbor has not been confirmed reachable within the last 5 seconds, and the router will send a Neighbor Solicitation (NS) message after the DELAY timer expires (default 5 seconds) to verify reachability. The entry for 2001:DB8:1::3 shows a hyphen in the Age column, meaning it was just created or refreshed, and it is in DELAY, so an NS will be sent soon.

Answer

All neighbors are in a stable state.

Answer

The neighbor 2001:DB8:1::2 is unreachable.

Answer

The link-local address FE80::1 is not valid.

Question 7

Which TWO configuration steps are required to enable MPLS on a Cisco IOS-XE router using LDP? (Choose TWO.)

Accepted Answer

Configure 'mpls ip' on the desired interfaces.. To enable MPLS with LDP, you must configure 'mpls ip' on the interface and also enable a routing protocol (like OSPF or IS-IS) to provide reachability. The 'mpls label protocol ldp' command is optional as LDP is the default, and 'mpls ldp router-id' is optional. 'mpls forwarding-table' is not a configuration command.

Answer

Configure 'mpls label protocol ldp' globally.

Answer

Configure 'mpls forwarding-table' to allocate labels.

Answer

Configure 'mpls ldp router-id' to set the LDP router ID.

Question 8

In DHCPv6, what is the purpose of the SOLICIT message?

Accepted Answer

To discover available DHCPv6 servers. In DHCPv6, the SOLICIT message is sent by a client to locate available DHCPv6 servers on the link. This is the first message in the DHCPv6 four-message exchange (Solicit, Advertise, Request, Reply) used for stateful address assignment, as defined in RFC 3315.

Answer

To request a renewal of an existing lease

Answer

To confirm a previously allocated prefix

Answer

To release an IP address

Question 9

An engineer is troubleshooting an MPLS LDP session that fails to establish between two directly connected routers. Which TWO commands can be used to verify LDP operation? (Choose TWO.)

Accepted Answer

show mpls ldp neighbor. LDP session establishment can be verified using 'show mpls ldp neighbor' to see the state of the session and 'show mpls ldp discovery' to see if LDP hello packets are being exchanged. Option A is correct: 'show mpls ldp neighbor' shows the LDP session state (e.g., OPERATIONAL). Option B is correct: 'show mpls ldp discovery' shows LDP hello adjacency details. Option C is false: 'show mpls ldp bindings' shows label bindings, not session state. Option D is false: there is no 'show mpls ldp session' command; the correct command is 'show mpls ldp neighbor'. Option E is false: 'show ip route' does not show LDP information.

Answer

show mpls ldp bindings

Answer

show mpls ldp session

Answer

show ip route

Question 10

An engineer is troubleshooting BGP convergence issues. Which THREE commands can be used to verify BGP path selection and best path criteria? (Choose THREE.)

Accepted Answer

show ip bgp . Option A, `show ip bgp `, is correct because it displays all BGP paths for a specific prefix along with the best-path marker (`>`), the locally generated marker (`*`), and the BGP attributes (weight, local preference, AS path, origin, MED) used in the best-path selection algorithm. Option C, `show ip bgp neighbors routes`, is correct because it lists the routes advertised by or received from a specific neighbor, letting the engineer verify which paths that neighbor is contributing to the BGP table and how they factor into path selection. Option D, `show ip bgp`, is correct because it dumps the entire BGP table with best-path indicators and attributes, which is the primary command for inspecting path selection and best-path criteria across all prefixes. Option B, `show ip route bgp`, only shows the BGP routes already installed in the routing table (post-selection), so it does not reveal the candidate paths or the attributes used to choose the best path. Option E, `show ip bgp community `, filters the BGP table by community value and is useful for community-based policy verification, but it does not directly show best-path criteria or path selection details.

Answer

show ip route bgp

Answer

show ip bgp community <community>

Question 11

Which TWO statements about DHCP IPv6 (DHCPv6) operation are true? (Choose TWO.)

Accepted Answer

DHCPv6 servers listen on UDP port 547.. Option A is correct because DHCPv6 servers receive client messages on UDP port 547, while DHCPv6 clients listen on UDP port 546, so the server-side port is indeed 547. Option B is correct because stateless DHCPv6 (configured via the M and O flags in Router Advertisement, with O=1 and M=0) is specifically designed to supply additional configuration such as DNS server addresses (RFC 3646) to hosts that already obtained their IPv6 address through SLAAC. Option C is wrong because DHCPv6 supports both stateful mode (address assignment, M flag set) and stateless mode (other configuration only). Option D is wrong because UDP ports 67 and 68 belong to DHCPv4; DHCPv6 uses 546 and 547. Option E is wrong because IPv6 does not use ARP—DHCPv6 servers are discovered via the multicast address FF02::1:2 (All_DHCP_Relay_Agents_and_Servers) and ICMPv6 Neighbor Discovery instead.

Answer

DHCPv6 can only be used in stateless mode.

Answer

DHCPv6 uses UDP ports 67 and 68, just like DHCPv4.

Answer

DHCPv6 relies on ARP to discover DHCPv6 servers.

Question 12

An engineer configures IPv6 uRPF strict mode on an interface that is used for both IPv6 traffic and OSPFv3 routing. The router is an ABR with multiple areas. OSPFv3 adjacencies form correctly, but some IPv6 data traffic is dropped. The show ipv6 interface command shows uRPF is enabled. Which is the most likely explanation?

Accepted Answer

The router has a default route pointing to a different interface, and uRPF strict mode without 'allow-default' drops packets whose source address is reachable via the default route.. URPF strict mode on an interface checks that the source address of incoming packets is reachable via the same interface. If the router has a default route pointing to a different interface, packets sourced from addresses that are only reachable via that default route will fail the RPF check and be dropped. The 'allow-default' keyword is required to exempt packets whose source is reachable via a default route from this check.

Answer

OSPFv3 adjacencies use link-local addresses, which are not checked by uRPF, but data traffic uses global addresses that are incorrectly filtered by the OSPFv3 process.

Answer

The router has 'ipv6 uRPF allow-default' configured, but the default route is not installed, causing all traffic to be dropped.

Answer

The interface has an IPv6 ACL that denies traffic from certain prefixes, overriding uRPF.

Question 13

An engineer configures an IPv6 ACL on a router interface to permit only specific ICMPv6 types (e.g., echo request and echo reply) and deny all other IPv6 traffic. After applying the ACL inbound, the router stops forming IPv6 neighbor discoveries (ND) and the interface loses IPv6 connectivity. Which is the most likely explanation?

Accepted Answer

The ACL denies ICMPv6 types 133-137, which are required for Neighbor Discovery, causing the router to fail to resolve neighbors.. The ACL denies ICMPv6 types 133-137, which are essential for Neighbor Discovery (ND) processes such as Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). Without permitting these types, the router cannot resolve IPv6 neighbors or maintain IPv6 connectivity, as ND is fundamental to IPv6 operation.

Answer

The ACL must be applied outbound, not inbound, to allow ND packets to be sent.

Answer

The router needs to have 'ipv6 nd suppress' configured to bypass ACL filtering for ND packets.

Answer

The ACL should use 'permit ipv6 any any' before the deny statements to allow ND, but the engineer placed it after.

Question 14

Examine this configuration on Router R4:
```
interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 ipv6 address 2001:DB8:6::1/64
 tunnel source GigabitEthernet0/0
 tunnel destination 172.16.1.2
 tunnel mode gre ip
```
What will be the effect?

Accepted Answer

The tunnel will successfully encapsulate both IPv4 and IPv6 payloads over IPv4.. The 'tunnel mode gre ip' command creates a generic routing encapsulation (GRE) tunnel over IPv4. GRE is protocol-agnostic and can encapsulate any Layer 3 protocol, including IPv4 and IPv6. The IPv6 address configured on the tunnel interface allows IPv6 traffic to be routed into the tunnel, where it is encapsulated in IPv4 packets and sent to the tunnel destination. Therefore, the tunnel will successfully carry both IPv4 and IPv6 payloads.

Answer

The tunnel will only carry IPv4 traffic because the mode is 'gre ip'.

Answer

The tunnel will fail because the tunnel source is an interface, not an IP address.

Answer

The tunnel mode should be 'ipv6ip' to carry IPv6 traffic.

Question 15

Which TWO statements about AAA authentication on Cisco IOS-XE are true? (Choose TWO.)

Accepted Answer

The 'aaa authentication login default local' command creates a default method list that uses the local user database for login authentication.. The 'aaa authentication login default local' command explicitly configures the default method list to use the local user database for login authentication. This is the standard way to define a fallback or primary local authentication method for all lines that do not have a named method list applied.

Answer

If no AAA authentication method list is explicitly configured, the default method list uses the local user database.

Answer

The 'aaa authentication login default group radius local' command will first try RADIUS, and if RADIUS fails (not just rejects), it will fall back to local.

Answer

The 'aaa authentication login default method' command creates a method list with no authentication methods, which denies all login attempts.

Question 16

What is the default behavior of EIGRP auto-summary in IOS-XE 15.x and later?

Accepted Answer

Auto-summary is disabled by default. In IOS-XE 15.x and later, EIGRP auto-summary is disabled by default. This change was introduced to align with modern network designs that require classless routing and to prevent unintended route summarization at classful boundaries, which can cause routing loops or suboptimal path selection in discontiguous networks.

Answer

Auto-summary is enabled by default

Answer

Auto-summary is enabled only for connected routes

Answer

Auto-summary is disabled only for point-to-point links

Question 17

A network engineer is troubleshooting a redistribution issue between OSPF and EIGRP. Router R3 is redistributing OSPF routes into EIGRP, but some OSPF external routes are not appearing in the EIGRP topology table. The engineer checks the redistribute command under EIGRP and sees a route-map named RM-OSPF that uses a prefix-list to match specific prefixes. The missing routes are permitted by the prefix-list. What is the most likely cause?

Accepted Answer

The route-map is missing a 'set metric' command; EIGRP requires a metric for redistributed routes.. The route-map may have a 'set metric' command that is misconfigured, or the route-map may be missing the 'set metric' command entirely, causing EIGRP to reject the route because it requires a metric for redistributed routes. Alternatively, the route-map might have a 'match route-type' that excludes external type-2 routes.

Answer

The prefix-list is using the wrong sequence number and is being overridden by a later deny statement.

Answer

The OSPF routes are type-5 LSAs, which cannot be redistributed into EIGRP.

Answer

The route-map is applied to the OSPF process instead of the EIGRP process.

Question 18

A network engineer is troubleshooting a VRF-Lite deployment where a router is configured with VRF_ORANGE. The engineer attempts to configure a static route in VRF_ORANGE using the command 'ip route vrf VRF_ORANGE 192.168.10.0 255.255.255.0 10.1.1.1', but the route does not appear in the routing table. The 'show ip route vrf VRF_ORANGE' does not show the static route. What is the most likely cause?

Accepted Answer

The next-hop IP address 10.1.1.1 is not reachable in VRF_ORANGE.. In VRF-Lite, a static route configured inside a VRF is only installed if the next-hop address is resolvable within that same VRF's routing table. If 10.1.1.1 is not reachable via an interface assigned to VRF_ORANGE (or via a route learned in that VRF), the static route remains inactive and does not appear in 'show ip route vrf VRF_ORANGE'.

Answer

The 'ip classless' command is disabled.

Answer

The static route is missing the 'permanent' keyword.

Answer

The router has 'no ip routing' configured.

Question 19

A network engineer runs the following command to verify NAT on a VRF:

R1# show ip nat translations vrf CUSTOMER
Pro Inside global      Inside local       Outside local      Outside global
--- 10.2.2.2           10.1.1.1           192.168.1.1        192.168.1.1

What is the purpose of the 'vrf CUSTOMER' parameter?

Accepted Answer

It filters translations for a specific VRF, allowing per-customer NAT.. The 'vrf CUSTOMER' parameter filters the output of 'show ip nat translations' to display only the NAT entries associated with the specified VRF (CUSTOMER). This allows per-customer NAT visibility in MPLS VPN or multi-VRF environments, where each VRF maintains its own separate NAT translation table. Without this parameter, the command would show all NAT translations across all VRFs, which is not the intended behavior.

Answer

It shows all translations across all VRFs.

Answer

It enables NAT on the VRF interface.

Answer

It creates a new VRF for NAT.

Question 20

According to RFC 3164, which facility code is used by default for Cisco IOS syslog messages?

Accepted Answer

Local7. RFC 3164 defines syslog facility codes, and Cisco IOS devices use facility local7 (code 23) by default for logging messages. This means when a Cisco router or switch sends syslog messages to a server, they are tagged with the local7 facility unless explicitly changed. The default is set in the logging configuration and can be verified with the show logging command, which displays 'Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)' and includes the facility. Local7 is chosen to allow administrators to separate Cisco device logs from other system logs on a syslog server.

Answer

Local0

Answer

User

Answer

Syslog