300-410 Mock Exam 74 — 25 Questions

Question 1

Which TWO statements about BFD echo mode are true? (Choose TWO.)

Accepted Answer

Echo packets are generated by the sending router and forwarded back by the remote router.. Option A is correct because in BFD echo mode the local (sending) router originates echo packets with its own address as the destination, and the remote router simply loops them back along the reverse path without processing them as BFD control packets. Option B is correct because the remote router only has to forward the echoed packet at the data plane, so it does not run BFD state-machine processing, which reduces the load on its control plane. Option C is incorrect because echo mode still uses a single BFD session; the echo function is an addition to that session, not a separate per-direction session. Option D is incorrect because echo mode actually reduces the number of BFD control packets exchanged, since the echo packets replace frequent control-packet transmission. Option E is incorrect because BFD echo mode is not enabled by default on interfaces; it must be explicitly configured.

Answer

Echo mode requires a separate BFD session for each direction.

Answer

Echo mode increases the number of BFD control packets sent between routers.

Answer

Echo mode is enabled by default on all interfaces.

Question 2

An experienced network engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes to the same prefix, but after redistribution, a routing loop occurs. The engineer did not use route tagging. Which is the most likely explanation?

Accepted Answer

The redistribute command without route-map or tag allows routes to be re-advertised back into the source protocol, creating a loop.. When mutual redistribution is configured without route tagging or filtering, routes learned from OSPF can be redistributed into EIGRP and then redistributed back into OSPF (and vice versa). Because each protocol treats the redistributed route as a new external route, the metric and administrative distance can cause the router to prefer the re-injected path, creating a feedback loop. Route tagging (with a route-map that denies routes carrying the tag) is the standard method to prevent this two-way redistribution loop.

Answer

The seed metric for EIGRP was not configured, causing routes to be rejected.

Answer

OSPF has a lower administrative distance than EIGRP, so OSPF routes are always preferred.

Answer

EIGRP stub configuration on the redistributing router prevents routes from being advertised.

Question 3

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify
  IPv6 verify source: strict

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.. The output 'IPv6 verify source: strict' indicates that strict unicast Reverse Path Forwarding (uRPF) is enabled on the interface. Strict uRPF verifies that the source IPv6 address of an incoming packet is reachable via the routing table AND that the best return path to that source uses the same interface on which the packet was received. If either condition fails, the packet is dropped. This matches option A exactly.

Answer

Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.

Answer

Loose uRPF is enabled, which only checks if the source address is in the routing table.

Answer

uRPF is disabled on this interface.

Question 4

Consider the following configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

If the remote peer has an ISAKMP policy with encryption 3des, what will happen?

Accepted Answer

IKE phase 1 will fail due to encryption algorithm mismatch.. IKE phase 1 requires both peers to have a matching ISAKMP policy, including the encryption algorithm. Since R1 is configured with AES 256 and the remote peer uses 3DES, there is no common proposal, causing phase 1 to fail. Cisco IOS does not automatically negotiate or fall back to a different encryption algorithm; the mismatch results in a failed IKE SA.

Answer

The tunnel will use 3DES because the remote peer's policy is accepted.

Answer

The router will automatically adjust to use 3DES.

Answer

The tunnel will establish but use AES 256 anyway.

Question 5

Which IP SLA operation type is used to monitor the availability of a TCP-based service by attempting a three-way handshake?

Accepted Answer

TCP Connect. The TCP Connect operation (type 5) attempts to establish a TCP connection to a specified port. Success indicates the service is reachable; failure indicates a problem.

Answer

UDP Jitter

Answer

ICMP Echo

Answer

HTTP

Question 6

Which OSPF LSA type is used to advertise a summary route for a network outside the area but within the same OSPF domain?

Accepted Answer

Type 3. OSPF Type 3 LSAs (Summary LSAs) are generated by Area Border Routers (ABRs) to advertise networks from one area into another area within the same OSPF domain. They describe inter-area routes, which are routes to networks outside the local area but still within the OSPF autonomous system. Therefore, a summary route for a network outside the area but within the same OSPF domain is advertised via Type 3 LSA.

Answer

Type 1

Answer

Type 2

Answer

Type 5

Question 7

What is the default active flow timeout value in Cisco IOS Flexible NetFlow?

Accepted Answer

1800 seconds. Cisco IOS Flexible NetFlow uses a default active timeout of 1800 seconds (30 minutes), after which an active flow entry is exported even if traffic is still ongoing. This ensures long-lived flows are periodically reported rather than held indefinitely. The inactive timeout default is 15 seconds.

Answer

60 seconds

Answer

300 seconds

Answer

30 seconds

Question 8

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP
    class-map: MANAGEMENT (match-all)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 100 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Based on this output, which statement is correct?

Accepted Answer

All management traffic has been transmitted without any drops.. The output shows that all 100 packets matched by the MANAGEMENT class-map were conformed (100 packets, 10000 bytes) and the action for conformed traffic is 'transmit', with zero exceeded packets. This indicates that the policing rate of 8000 bps (CIR) was sufficient for the offered traffic, and no packets were dropped. The 'exceeded 0 packets' field confirms no drops occurred.

Answer

Management traffic is being dropped because the police rate is too low.

Answer

The CoPP policy is not applied because the control plane is not specified.

Answer

The class-map MANAGEMENT is not matching any traffic.

Question 9

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# debug ip policy
Policy routing debugging is on
R1#
*Mar  1 00:10:45.456: IP: s=172.16.1.5 (FastEthernet0/0), d=8.8.8.8, len 64, policy match
*Mar  1 00:10:45.456: IP: s=172.16.1.5 (FastEthernet0/0), d=8.8.8.8, len 64, policy routed
*Mar  1 00:10:45.456: IP: FastEthernet0/0 to Serial0/0 10.1.1.2

What does this output indicate?

Accepted Answer

The packet was successfully policy-routed to 10.1.1.2 via Serial0/0.. The debug shows a packet from 172.16.1.5 to 8.8.8.8 that matched the policy and was routed out of Serial0/0 to next-hop 10.1.1.2. This indicates successful PBR operation.

Answer

The packet was dropped due to no matching route.

Answer

The next-hop 10.1.1.2 is unreachable.

Answer

The route-map is misconfigured with wrong ACL.

Question 10

OSPF network type mismatch on a multi-access link is causing route summarization issues. Router R1 and R2 are connected via Ethernet, but R1 has:
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
!
Router R2 has default OSPF network type (broadcast). R1 is configured with:
router ospf 1
 area 0 range 10.0.0.0 255.255.255.0
!
R2 shows:
R2# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.1          0   FULL/  -        00:00:30    10.0.0.1        GigabitEthernet0/0
But R2 does not have the summary route in its routing table. What is the root cause?

Accepted Answer

R1 is not an ABR (only area 0), so the area range command does not generate a summary route.. The area range command is used on an Area Border Router (ABR) to summarize Type-3 LSAs between areas. R1 is only in area 0 (backbone), so it is not an ABR and cannot generate inter-area summary routes. Therefore, the area range command has no effect, and R2 will not receive a summary route. The network type mismatch does not prevent LSA exchange because the neighbor relationship is FULL, as shown in the output.

Answer

The network type mismatch causes OSPF to not exchange LSAs correctly, preventing the summary.

Answer

The summary route is suppressed because the interface is point-to-point.

Answer

R2 has a static route that overrides the summary.

Question 11

A network engineer runs the following command to debug IPv6 uRPF:

R1# debug ipv6 verify
IPv6 verify debugging is on

*Mar 1 00:02:34.567: IPv6 verify: source 2001:DB8:4::1 on GigabitEthernet0/0
*Mar 1 00:02:34.567:   no route to source

What does this output indicate?

Accepted Answer

The packet will be dropped because uRPF cannot find a route to the source address.. The debug output shows that uRPF (unicast Reverse Path Forwarding) checked the source address 2001:DB8:4::1 on the incoming interface GigabitEthernet0/0 and found no route to that source in the IPv6 routing table. When uRPF is enabled and a packet arrives on an interface, the router performs a reverse path lookup: it checks whether the best return route to the source address points back to the same interface. If no route exists at all, the lookup fails, and uRPF considers the source as unreachable, causing the packet to be dropped. This is a strict-mode uRPF behavior, and the debug message 'no route to source' confirms the packet will be discarded.

Answer

The packet will be forwarded because uRPF only checks the destination.

Answer

The packet will be forwarded because the source is on the same interface.

Answer

The router will add a route to the source address.

Question 12

An engineer configures an IPv4 ACL on a router's interface to permit only HTTP traffic (TCP port 80) from a specific subnet. The ACL is applied inbound. After applying, the router's web interface (HTTPS) becomes unreachable from the same subnet. What is the most likely explanation?

Accepted Answer

The ACL denies HTTPS traffic because it is not explicitly permitted.. The ACL is applied inbound on the router interface and only permits TCP port 80 (HTTP). HTTPS uses TCP port 443, which is not explicitly permitted. Since IPv4 ACLs end with an implicit deny any, all traffic not matching a permit statement, including HTTPS, is denied. This causes the router's web interface (HTTPS) to become unreachable from the subnet.

Answer

The ACL is applied outbound, filtering traffic to the web server.

Answer

The router's web server uses HTTP, not HTTPS.

Answer

The ACL is blocking TCP port 80 due to a typo.

Question 13

Which TWO commands would a network engineer use to verify that syslog messages are being sent to a remote syslog server? (Choose TWO.)

Accepted Answer

show logging. Option A, 'show logging', is correct because on Cisco IOS this command displays the local logging configuration (including the syslog server host address set with 'logging host') and the status of logging to that host, confirming whether messages are being sent to the remote syslog server. Option C, 'show running-config | include logging', is correct because it filters the running configuration for all logging-related lines, revealing the configured 'logging host ' and 'logging trap' level that determine whether and where syslog messages are forwarded. Option B, 'debug logging', is not a valid verification command and would only generate additional debug output rather than confirm the syslog destination. Option D, 'ping ', only tests IP reachability to the server and does not verify that syslog messages are actually being sent or logged. Option E, 'show ip route', merely displays the routing table and provides no information about syslog configuration or message transmission.

Answer

debug logging

Answer

ping <syslog-server-ip>

Answer

show ip route

Question 14

An EIGRP network is experiencing a stuck-in-active (SIA) condition for a route 192.168.1.0/24. R1 has the following configuration: router eigrp 100 network 10.0.0.0 distribute-list prefix PL-FILTER in. R2 shows: 'show ip eigrp topology 192.168.1.0/24' is in active state, and 'show ip eigrp events' shows that R1 sent a query but never received a reply. R1's prefix-list PL-FILTER permits only 10.0.0.0/8. What is the root cause?

Accepted Answer

The distribute-list inbound on R1 filters the EIGRP query for 192.168.1.0/24, preventing R1 from replying and causing SIA on R2.. The distribute-list prefix PL-FILTER in on R1 filters incoming routes, but it also affects queries. When R2 sends a query for 192.168.1.0/24, R1 receives it but the distribute-list filters the query (since the prefix is not permitted), so R1 does not process it and does not send a reply. This causes R2 to wait indefinitely for a reply, leading to an SIA condition. The distribute-list should be applied outbound or should permit the necessary prefixes to allow queries to be processed.

Answer

The EIGRP K-values are mismatched between R1 and R2.

Answer

The route 192.168.1.0/24 is not in R1's topology table, so it cannot reply.

Answer

The EIGRP timers on R1 are set too high, causing a delay in reply.

Question 15

Which TWO statements about NetFlow version 9 and Flexible NetFlow are true? (Choose TWO.)

Accepted Answer

Flexible NetFlow is built upon the NetFlow version 9 template architecture.. Option B is correct because Flexible NetFlow is Cisco's implementation that directly builds on the NetFlow version 9 export architecture, reusing its template-based mechanism to define and export flow data. Option D is correct because NetFlow version 9 introduced templates that allow user-defined flow records, enabling customizable field sets (such as IPv6 fields, MPLS labels, or BGP attributes) rather than a fixed record layout. Option A is incorrect because NetFlow version 9 does not use a fixed-format packet structure; that describes NetFlow version 5, whereas version 9 uses templates to define record formats dynamically. Option C is incorrect because Flexible NetFlow can export data using multiple protocols, including NetFlow version 9 and IPFIX (NetFlow version 10), not exclusively version 9. Option E is incorrect because Flexible NetFlow supports both IPv4 and IPv6 traffic monitoring, along with other protocols such as MPLS and multicast.

Answer

NetFlow version 9 uses a fixed-format packet structure for flow export.

Answer

Flexible NetFlow can only export data using NetFlow version 9.

Answer

Flexible NetFlow only supports IPv4 traffic monitoring.

Question 16

Consider the following BGP configuration on router R2:

router bgp 65002
 bgp router-id 2.2.2.2
 neighbor 10.2.2.1 remote-as 65001
 neighbor 10.2.2.1 route-map FILTER in
!
route-map FILTER deny 10
 match ip address prefix-list BLOCKED
!
route-map FILTER permit 20
!
ip prefix-list BLOCKED permit 10.0.0.0/8 le 32

Which statement is true about routes received from 10.2.2.1?

Accepted Answer

Routes with prefix 10.0.0.0/8 or more specific are denied; all others are permitted.. The prefix-list BLOCKED uses 'permit 10.0.0.0/8 le 32', which matches the 10.0.0.0/8 network and any more specific prefix (up to /32) within that range. The route-map FILTER denies any route matching this prefix-list in sequence 10, and permits all other routes in sequence 20. Since the route-map is applied inbound on neighbor 10.2.2.1, routes from that neighbor matching 10.0.0.0/8 or more specific are denied, while all other routes are accepted.

Answer

All routes are accepted because the deny statement is misconfigured.

Answer

Only routes exactly matching 10.0.0.0/8 are denied; other 10.x.x.x routes are permitted.

Answer

The route-map is applied outbound, so it affects routes sent to 10.2.2.1.

Question 17

A network administrator is configuring a Cisco IOS router to authenticate login users against a TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, the router falls back to the local username database for authentication. Which configuration should be applied?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration must specify TACACS+ as the primary authentication method and local as the fallback. The order of methods in the AAA authentication list determines the sequence: the router tries each method in turn until one succeeds or all fail. Placing 'group tacacs+' before 'local' ensures TACACS+ is attempted first, and if unreachable, local authentication is used.

Answer

aaa authentication login default group tacacs+

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group radius local

Question 18

A network engineer is implementing route redistribution between OSPF and EIGRP on a Cisco IOS router. The engineer wants to prevent routing loops and ensure that routes redistributed from OSPF into EIGRP are not redistributed back into OSPF. Which mechanism should be used?

Accepted Answer

Configure a route map with a tag on OSPF routes and deny tagged routes when redistributing EIGRP into OSPF.. Route tagging is the most effective way to prevent routing loops during mutual redistribution. By assigning a tag to routes when they are redistributed from one protocol into another, you can later match and deny those tagged routes when redistributing back. This ensures that routes do not oscillate between protocols, maintaining a loop-free topology.

Answer

Set the administrative distance of EIGRP to a lower value than OSPF.

Answer

Use the default-metric command under the EIGRP process.

Answer

Apply a distribute-list to filter OSPF routes from being installed in the routing table.

Question 19

A network engineer is deploying MPLS Layer 3 VPNs on Cisco IOS routers. The engineer must ensure that customer routes are properly propagated across the MPLS core and that labels are correctly assigned. Which two protocols are used within the MPLS core to distribute labels and VPNv4 routes? (Choose two.)

Accepted Answer

LDP. In an MPLS L3VPN, LDP is used to distribute labels for core routing, creating LSPs between PE routers. MP-BGP is used to distribute VPNv4 routes and their associated VPN labels between PE routers. Together, they enable the forwarding of customer traffic across the MPLS core with proper VPN isolation. OSPF, RSVP, and BGP-LU are not the standard protocols for these specific functions.

Answer

RSVP

Answer

OSPF

Answer

BGP-LU

Question 20

A network administrator is configuring AAA on a Cisco IOS router using TACACS+. The requirement is that if the TACACS+ server is unreachable, the router should allow administrative access using the local username and password configured on the router. Which configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. To configure AAA authentication with TACACS+ and a fallback to the local username database, you use the 'aaa authentication login default group tacacs+ local' command. The 'local' keyword specifies that the router should use its local username and password configuration if the TACACS+ server does not respond. This provides a secure fallback method, ensuring administrative access is not lost during server outages.

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default group tacacs+ if-needed

Answer

aaa authentication login default group tacacs+ none