300-410 Mock Exam 77 — 25 Questions

Question 1

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.. RSPAN requires that the RSPAN VLAN be configured with the 'remote-span' command on all switches that participate. Without this, the VLAN may not be treated as an RSPAN VLAN and traffic may not be forwarded correctly.

Answer

Check that the destination port is not in a shutdown state.

Answer

Ensure that the source interface is not configured with 'no monitor session'.

Answer

Confirm that the trunk between switches is configured as a dot1q trunk.

Question 2

What is the default behavior of LDP when establishing a session between two directly connected routers?

Accepted Answer

LDP uses TCP port 646 for session establishment and UDP port 646 for hellos.. LDP uses hello messages to discover neighbors. By default, LDP hellos are sent to the multicast address 224.0.0.2 (all routers) on the local link. The session is established using the transport address, which by default is the router ID (usually the highest loopback or interface IP).

Answer

LDP sends hellos to the unicast address of each neighbor.

Answer

LDP hellos are sent to the all-OSPF-routers multicast address 224.0.0.5.

Answer

LDP sessions are established using UDP for reliability.

Question 3

An engineer configures Flexible NetFlow on a router to monitor traffic. Unexpectedly, the NetFlow exporter does not send any flow records to the collector. The engineer verifies that the monitor is applied to the correct interface and that the collector is reachable. Which is the most likely explanation?

Accepted Answer

The flow monitor references a record that does not include mandatory match fields, causing the monitor to remain inactive.. Flexible NetFlow requires a flow monitor to reference a record that defines the match and collect fields. If the record is not defined or is incomplete (e.g., missing key fields like source/destination IP), the monitor may not generate any flows. Additionally, the exporter configuration must include the correct source interface and transport protocol (UDP) to the collector. A common edge case is when the record is defined but uses 'match ipv4 protocol' without 'match ipv4 source address', causing the flow monitor to fail to create flows.

Answer

The exporter is configured with 'transport tcp' instead of 'transport udp', and the collector only accepts UDP.

Answer

The interface where the monitor is applied is in a VRF, and the exporter is not configured with the VRF name.

Answer

The flow monitor uses 'cache timeout inactive 60' which is too long, causing flows to be held until the cache is full.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip nhrp
10.0.0.2/32 via 10.0.0.2, Tunnel0 created 00:15:30, expire 01:44:30
    Type: dynamic, Flags: used
    NBMA address: 192.168.1.2
10.0.0.3/32 via 10.0.0.3, Tunnel0 created 00:10:20, expire 01:49:40
    Type: dynamic, Flags: used
    NBMA address: 192.168.1.3

Based on this output, which statement is correct?

Accepted Answer

Both NHRP entries are active and dynamically learned.. The output shows two NHRP entries with 'Type: dynamic', meaning they were learned dynamically (not statically configured). Both have 'Flags: used', indicating they are active. The expiration times show they will expire in about 1 hour 44 minutes and 1 hour 49 minutes, respectively.

Answer

Both NHRP entries are static.

Answer

The NHRP entries have expired.

Answer

The NBMA addresses are IPv6 addresses.

Question 5

Two OSPF domains are redistributed into each other on router R1. R1 has:
router ospf 1
 redistribute ospf 2 subnets
router ospf 2
 redistribute ospf 1 subnets
Router R2 (in OSPF 1) shows:
R2# show ip route ospf
O E2 10.1.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0
O E2 10.2.1.0/24 [110/20] via 10.2.1.1, 00:00:05, Serial0/0/0
R2# traceroute 10.1.1.1 source 10.2.1.2
Type escape sequence to abort.
Tracing the route to 10.1.1.1
  1 10.2.1.1 4 msec 4 msec 4 msec
  2 10.1.1.1 8 msec 8 msec 8 msec
R2# traceroute 10.2.1.1 source 10.1.1.2
Type escape sequence to abort.
Tracing the route to 10.2.1.1
  1 10.1.1.1 4 msec 4 msec 4 msec
  2 10.2.1.1 8 msec 8 msec 8 msec
Traffic between the two domains is taking suboptimal paths. What is the root cause?

Accepted Answer

The redistribution is mutual without any route filtering, causing routing loops.. Mutual redistribution without route filtering creates a routing loop. Routes from OSPF 1 are redistributed into OSPF 2, and then back into OSPF 1, causing suboptimal paths. The traceroute shows traffic going through R1 twice. The fix is to use route tagging and filtering to prevent re-redistribution.

Answer

The 'subnets' keyword is missing from one of the redistribute commands.

Answer

OSPF administrative distance is set incorrectly, preferring external routes.

Answer

R1 has a routing table entry for 10.1.1.0/24 pointing to R2.

Question 6

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

Accepted Answer

The ERSPAN session is missing a tunnel interface configuration.. ERSPAN requires a tunnel interface to encapsulate the monitored traffic. Without configuring a tunnel interface, the ERSPAN session cannot encapsulate the packets for transport to the remote destination.

Answer

The monitoring server is not listening on the correct UDP port.

Answer

The source interface is not in the same subnet as the destination IP.

Answer

The ERSPAN session is configured with the wrong source IP address.

Question 7

CoPP (Control Plane Policing) rate-limit impacts legitimate traffic. Router R1 has CoPP policy applied: 'class-map match-all BGP class-map match-all SSH match protocol bgp match protocol ssh policy-map COPP class BGP police 10000 conform-action transmit exceed-action drop'. Network engineers cannot SSH to R1, but BGP sessions are stable. 'show policy-map control-plane' output shows 'BGP class: 0 packets, 0 bytes' and 'SSH class: 0 packets, 0 bytes'. What is the root cause?

Accepted Answer

The class-map uses 'match-all' instead of 'match-any', causing SSH traffic not to match the class and be dropped by default action.. The class-map uses 'match protocol bgp' and 'match protocol ssh' with match-all, meaning both conditions must be true for a packet to match. SSH packets do not match protocol bgp, so they fall through to the default class, which may have a drop policy. The class-map should be match-any or separate classes for each protocol.

Answer

The police rate is too low for SSH traffic; need to increase.

Answer

ACL on the interface blocks SSH before CoPP is applied.

Answer

CoPP is applied to the wrong direction; should be input.

Question 8

A network engineer runs the following command to examine MPLS LDP neighbor details:

R1# show mpls ldp neighbor detail

Output:
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.55432
        State: Oper; Msgs sent/rcvd: 123/456; Downstream on demand
        Up time: 1w2d
        LDP discovery sources:
          GigabitEthernet0/0, hello interval: 5 s, targeted: no
        Addresses bound to peer LDP Ident:
          10.0.0.2        10.0.1.2        192.168.1.1

What does this output indicate?

Accepted Answer

The LDP session with 10.0.0.2 is operational and was discovered via link hello on GigabitEthernet0/0. The output shows detailed LDP neighbor information. The session is operational (State: Oper) for 1 week 2 days. The neighbor is directly connected via GigabitEthernet0/0 (non-targeted hello). The peer has multiple addresses bound to its LDP identifier.

Answer

The LDP session is using targeted hello

Answer

The LDP session has been up for 1 minute and 2 seconds

Answer

The neighbor is using downstream-on-demand label advertisement mode

Question 9

An engineer configures OSPF on two directly connected routers with MTU 1500 on one interface and MTU 1400 on the other. The OSPF adjacency forms but remains in EXSTART state. Which is the most likely explanation?

Accepted Answer

The router with the larger MTU sends DBD packets that exceed the smaller MTU, causing the receiver to drop them and remain in EXSTART.. OSPF uses the MTU of the interface to determine the maximum size of Database Description (DBD) packets. If the MTU mismatch is such that the DBD packet from the larger MTU side is fragmented or dropped by the smaller MTU interface, the adjacency will stall in EXSTART. OSPF does not negotiate MTU; it simply compares the MTU value in the DBD packet. If the receiving interface has a smaller MTU, it will reject the DBD packet, causing the neighbor to stay in EXSTART.

Answer

The router with the smaller MTU cannot send hello packets due to fragmentation, so the adjacency never forms.

Answer

OSPF uses TCP, and the MTU mismatch causes TCP segmentation issues, leading to EXSTART.

Answer

The MTU mismatch causes a routing loop, preventing the exchange of LSAs.

Question 10

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are expected to form dynamically. However, when a spoke tries to reach another spoke, traffic is still sent through the hub. The engineer verifies that NHRP is working and that the spoke-to-spoke tunnel is up. Which is the most likely explanation?

Accepted Answer

The spokes are missing the 'ip nhrp shortcut' command on the tunnel interface, so they do not install the direct route.. In DMVPN Phase 2, spoke-to-spoke tunnels require that the spokes have a direct route to each other's tunnel IP addresses. This is achieved through NHRP redirect and shortcut routes. However, a common edge case is that the spoke routers are configured with 'ip nhrp redirect' on the hub but the spokes are missing 'ip nhrp shortcut' on their tunnel interfaces. Without the shortcut command, the spoke will not install the NHRP-learned route into the routing table, so traffic continues to go through the hub.

Answer

The hub is configured with 'ip nhrp redirect' but the spokes are configured with 'ip nhrp server-only', which prevents them from sending redirects.

Answer

The tunnel interface has 'ip mtu' set too low, causing fragmentation and preventing the NHRP registration.

Answer

The spoke-to-spoke tunnel uses IPsec, and the transform set is mismatched, causing the tunnel to fail.

Question 11

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

Accepted Answer

The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.. ERSPAN encapsulates the original packet with a GRE header. If the monitoring server receives packets without GRE encapsulation, it means the router is not encapsulating the traffic correctly, possibly because the ERSPAN session is not configured with the correct tunnel source or destination.

Answer

The monitoring server is stripping the GRE headers before capturing.

Answer

The ERSPAN session is configured with the 'ip access-group' command that filters the encapsulated traffic.

Answer

The router is not running the correct IOS version that supports ERSPAN.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks
O        10.1.1.0/24 [110/20] via 192.168.1.2, 00:15:30, GigabitEthernet0/0
O        10.2.2.0/24 [110/30] via 192.168.1.2, 00:15:30, GigabitEthernet0/0

Based on this output, which statement is correct?

Accepted Answer

The router has two OSPF routes to different subnets.. The output shows two OSPF routes via the same next hop. The administrative distance is 110 (default for OSPF), and the metrics are 20 and 30. No problems are indicated; the routes are present and valid.

Answer

The router has a default route via OSPF.

Answer

The OSPF neighbor is down.

Answer

The metric for 10.2.2.0/24 is 20.

Question 13

Which THREE statements about the NetFlow flow cache and export timing are correct? (Choose THREE.)

Accepted Answer

A flow is exported when it has been idle for the inactive timeout period, which defaults to 15 seconds.. The NetFlow flow cache stores active flows. Flows are exported when they become inactive (no new packets for a timeout period) or when they are long-lived (active timeout). The default active timeout is 30 minutes, and the default inactive timeout is 15 seconds. When the cache is full, the router may force-export the oldest flows to make room. The cache size is configurable but has a hardware-dependent maximum. Flow export does not wait for the cache to be full before exporting.

Answer

Flows are only exported when the flow cache becomes 100% full.

Answer

The maximum number of flow cache entries is fixed at 64,000 and cannot be changed.

Question 14

A network engineer runs the following command to verify MPLS LDP label bindings for a specific prefix:

R1# show mpls ldp bindings 10.0.0.0 255.0.0.0

Output:
  lib entry: 10.0.0.0/8, rev 10
    local binding:  label: imp-null
    remote binding: lsr: 10.0.0.2:0, label: imp-null
    remote binding: lsr: 10.0.0.3:0, label: 302

What does this output indicate?

Accepted Answer

R1 will pop the label for 10.0.0.0/8 before forwarding to the next hop. The output shows label bindings for prefix 10.0.0.0/8. R1 has assigned implicit null label (label 3) locally, meaning it will pop the label before forwarding. Neighbor 10.0.0.2 also uses implicit null, while 10.0.0.3 uses label 302.

Answer

R1 will swap the label for 10.0.0.0/8

Answer

All neighbors are using implicit null for this prefix

Answer

The prefix 10.0.0.0/8 is not in the routing table

Question 15

A network engineer runs the following command on router R4:

R4# show monitor session 9
Session 9
---------
Type : ERSPAN Source Session
Status : Admin Disabled
Source Ports :
    Both : Gi0/2
Destination IP : 192.168.2.20
Origin IP : 10.0.0.3
ERSPAN ID : 200

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is configured but not currently active because it is administratively disabled.. This is an ERSPAN source session that is administratively disabled. The configuration is present but not active. To enable it, the engineer must use the 'no shutdown' command under the session configuration.

Answer

The ERSPAN session is actively mirroring traffic from Gi0/2 to 192.168.2.20.

Answer

The ERSPAN session is using RSPAN because the status is disabled.

Answer

The ERSPAN session is misconfigured because the origin IP is missing.

Question 16

A network engineer runs the following command to debug MPLS LDP label advertisements:

R1# debug mpls ldp labels

Output:
*Mar  1 00:01:23.456: LDP: Sent label mapping for 192.168.1.0/24, label 101
*Mar  1 00:01:23.789: LDP: Received label mapping for 192.168.2.0/24, label 201
*Mar  1 00:01:24.012: LDP: Sent label mapping for 10.0.0.0/8, label 102
*Mar  1 00:01:24.345: LDP: Received label mapping for 10.0.0.0/8, label 202

What does this output indicate?

Accepted Answer

LDP label bindings are being exchanged between R1 and its LDP neighbor. The debug output shows label mappings being exchanged between LDP peers. R1 is sending its own label bindings (e.g., label 101 for 192.168.1.0/24) and receiving label bindings from its neighbor (e.g., label 201 for 192.168.2.0/24).

Answer

R1 is only receiving label mappings, not sending any

Answer

The LDP session is down

Answer

R1 is using implicit null label for 10.0.0.0/8

Question 17

Which TWO statements about NetFlow version 9 and Flexible NetFlow export format are true? (Choose TWO.)

Accepted Answer

NetFlow version 9 uses a template-based architecture that allows the collector to dynamically learn the fields being exported.. NetFlow version 9 uses templates to define the format of exported data, which allows flexibility. Flexible NetFlow uses version 9 as its default export format. Version 5 has a fixed format and does not support templates. The exporter configuration includes the destination IP and UDP port (default 2055). The template refresh interval is configurable using the 'template timeout' command under the exporter. Version 9 supports both IPv4 and IPv6 in the same export stream via separate templates.

Answer

Flexible NetFlow can only export data using NetFlow version 5 format.

Answer

The template refresh interval is fixed at 20 minutes and cannot be changed.

Answer

NetFlow version 9 supports only IPv4 flow data; IPv6 requires version 5.

Question 18

Drag and drop the steps to troubleshoot NetFlow and Flexible NetFlow connectivity failures into the correct order, from first to last.

Accepted Answer

Ping collector IP from the exporter router. Troubleshooting connectivity failures starts with checking the exporter reachability using ping, then verifying the exporter configuration for correct IP and UDP port, then checking if the collector is listening on the expected port, then inspecting ACLs that might block the flow, and finally using debug ip flow export to see actual packet drops.

Question 19

A DMVPN network with EIGRP as the routing protocol experiences spoke-to-spoke tunnel failures. Hub router R1 has configuration: 'interface Tunnel0 ip nhrp network-id 1 ip nhrp map multicast dynamic ip nhrp redirect' and 'router eigrp 100 network 10.0.0.0'. Spoke router R2 shows 'show ip nhrp brief' output: '10.0.0.1/32 via 192.168.1.1, Tunnel0 created 00:10:00, dynamic' but 'show ip eigrp neighbors' shows only the hub. What is the root cause?

Accepted Answer

Spoke routers are missing 'ip nhrp shortcut' interface configuration, preventing dynamic spoke-to-spoke tunnel establishment.. Spoke-to-spoke tunnels require NHRP redirect and shortcut features to trigger direct communication. The hub has 'ip nhrp redirect' but spokes must have 'ip nhrp shortcut' to install direct routes. Without this, spokes only communicate via hub, causing suboptimal routing and potential failure if hub is overloaded.

Answer

EIGRP is not configured to advertise the tunnel network; need 'network 10.0.0.0' on spokes.

Answer

The hub router needs 'ip nhrp map multicast dynamic' to forward multicast for EIGRP; it is already present.

Answer

NHRP authentication mismatch between hub and spokes causes NHRP registration failure.

Question 20

A network engineer runs the following command to verify MPLS LDP label bindings:

R1# show mpls ldp bindings 192.168.1.0 255.255.255.0

Output:
  lib entry: 192.168.1.0/24, rev 8
    local binding:  label: 101
    remote binding: lsr: 10.0.0.2:0, label: 201
    remote binding: lsr: 10.0.0.3:0, label: 301

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a local label of 101 and two remote labels from LDP neighbors. The output shows the label bindings for the prefix 192.168.1.0/24 in the Label Information Base (LIB). The local label is 101, and two remote labels (201 from 10.0.0.2, 301 from 10.0.0.3) have been received from LDP neighbors.

Answer

The prefix 192.168.1.0/24 is not reachable via any LDP neighbor

Answer

Label 101 is the only label assigned to this prefix in the network

Answer

The LDP session with 10.0.0.2 is down