300-410 Mock Exam 79 — 25 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1:
  Description: Exports to collector
  Export protocol: NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.1.100
    Source IP address: 10.0.0.1
    Transport Protocol: UDP
    Destination Port: 2055
    Source Port: 0
  Collector Configuration:
    VRFs:
      Default
  Options Configuration:
    Sampler: Not configured
  Export Statistics:
    Number of Flows exported: 0
    Number of Packets exported: 0
    Number of Source IP address unreachable: 0
    Number of Packets dropped: 0

Based on this output, what is the most likely reason that no flows are being exported?

Accepted Answer

The flow exporter is not referenced in any flow monitor applied to an interface.. The output shows 0 flows exported, but no errors. This often indicates that the flow monitor is not applied to an interface or the exporter is not referenced in a flow monitor. The exporter itself is configured correctly with a valid destination.

Answer

The destination port is incorrect; NetFlow version 9 requires port 9996.

Answer

The source IP address is not reachable from the destination.

Answer

The sampler is not configured, causing all packets to be dropped.

Question 2

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# show ip sla statistics 10 detail

Round Trip Time (RTT) for Index 10
   Latest RTT: 12 ms
   Latest RTT (milliseconds): 12
   Latest RTT (microseconds): 12000
   Last operation start time: 12:34:56.789 UTC Mon Mar 1 2021
   Last operation return code: OK
   Number of successes: 100
   Number of failures: 0
   Operation time to live: Forever
   Last operation response time: 12 ms
   Latest operation start time: 12:34:56.789 UTC Mon Mar 1 2021
   Latest operation return code: OK
   Over thresholds occurred: FALSE
   Threshold (milliseconds): 5000
   RTT Values:
      RTTAvg: 12
      RTTMin: 10
      RTTMax: 15
      RTTNum: 100
      RTTStdDev: 1

What does this output indicate?

Accepted Answer

The IP SLA operation shows stable performance with low jitter and no threshold violations.. This detailed output shows RTT statistics including average, minimum, maximum, and standard deviation. The low standard deviation (1 ms) and no thresholds exceeded indicate stable performance.

Answer

The IP SLA operation has high jitter because the RTT standard deviation is 1 ms.

Answer

The IP SLA operation is experiencing packet loss because the number of failures is 0.

Answer

The IP SLA operation has exceeded the threshold because the RTTMax is 15 ms.

Question 3

Drag and drop the steps to verify and validate the MPLS L3VPN operational state into the correct order, from first to last.

Accepted Answer

Display VRF routing table for CE routes. Start by checking the VRF routing table with 'show ip route vrf ' to confirm CE routes are present. Then verify that VPNv4 routes are installed using 'show bgp vpnv4 unicast all'. Next, confirm the MPLS forwarding entry for a specific prefix with 'show mpls forwarding-table'. After that, test end-to-end connectivity with a ping from the CE to a remote CE. Finally, validate that the label stack is correctly imposed using 'show ip cef vrf '.

Question 4

In an MPLS L3VPN environment, what is the default maximum number of routes that can be installed from a single BGP peer?

Accepted Answer

Unlimited. By default, there is no maximum limit on the number of routes from a BGP peer. The 'maximum-prefix' command is optional and not configured by default.

Answer

1000

Answer

10000

Answer

5000

Question 5

Which THREE statements about IPv6 Source Guard are true? (Choose THREE.)

Accepted Answer

It filters IPv6 traffic based on the source IPv6 address of incoming packets.. IPv6 Source Guard filters incoming IPv6 traffic on a per-port basis by examining the source IPv6 address of packets and comparing it against the IPv6 snooping binding table. If the source address does not match a valid binding, the packet is dropped, preventing spoofing attacks.

Answer

It filters both incoming and outgoing IPv6 traffic on a port.

Answer

It requires DHCPv6 snooping to be enabled on the VLAN to function.

Question 6

A network engineer runs the following command to troubleshoot an MPLS L3VPN issue:

R1# debug mpls ldp transport

Output:
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is accepted
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is established
*Mar  1 00:01:23.456: mpls_ldp_transport: LDP transport connection from 10.0.0.2:646 to 10.0.0.1:1025 is up

What does this output indicate?

Accepted Answer

LDP session is being established between 10.0.0.1 and 10.0.0.2. The debug output shows LDP transport connections between two routers. The messages indicate that a TCP connection from 10.0.0.2 (LDP port 646) to 10.0.0.1 (ephemeral port 1025) was accepted, established, and is now up. This confirms LDP adjacency is forming at the transport layer.

Answer

LDP session is being torn down between 10.0.0.1 and 10.0.0.2

Answer

LDP is using UDP for transport

Answer

LDP label bindings are being exchanged

Question 7

In MPLS L3VPN, which LSA type is used by OSPF to advertise prefix information from a PE router into a customer VRF instance?

Accepted Answer

Type 3 (Summary LSA). When OSPF is used as the PE-CE protocol, the PE router redistributes VPN routes into OSPF as Type 3 LSAs (Summary LSAs) by default, unless the 'capability vrf-lite' command is configured.

Answer

Type 1 (Router LSA)

Answer

Type 2 (Network LSA)

Answer

Type 5 (External LSA)

Question 8

Which BGP path attribute is used as the tie-breaker after the local preference and AS-path length in the BGP best path selection algorithm?

Accepted Answer

Origin type. After comparing local preference (highest wins) and AS-path length (shortest wins), the next tie-breaker is the origin type, where IGP is preferred over EGP, and EGP over incomplete.

Answer

MED (Multi-Exit Discriminator)

Answer

Neighbor IP address

Answer

Router ID

Question 9

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show policy-map control-plane input class CoPP-Class

Class-map: CoPP-Class (match-all)
  1500 packets, 120000 bytes
  5 minute offered rate 10000 bps, drop rate 5000 bps
  Match: access-group name CoPP-ACL
  police:
      cir 8000 bps, bc 1500 bytes, be 1500 bytes
    conformed 1000 packets, 80000 bytes; actions:
      transmit
    exceeded 500 packets, 40000 bytes; actions:
      drop
    conformed 8000 bps, exceed 2000 bps, violated 0 bps

What does this output indicate?

Accepted Answer

The CoPP policy is causing packet loss for traffic that exceeds the 8 kbps rate, which may impact legitimate control plane traffic.. The output shows that the CoPP policy uses a CIR of 8000 bps with a conformed rate of 8000 bps and an exceed rate of 2000 bps. The drop rate of 5000 bps indicates that traffic exceeding the CIR is being dropped, which can include legitimate control plane traffic (e.g., routing protocol packets) if they are classified under the CoPP-Class. This confirms that the policy is causing packet loss for traffic that exceeds the 8 kbps rate, potentially impacting critical control plane operations.

Answer

The CoPP policy is dropping all traffic because the CIR is too low.

Answer

The CoPP policy is not applied correctly because the drop rate is higher than the conform rate.

Answer

The CoPP policy is working as intended with no issues.

Question 10

Drag and drop the steps to troubleshoot an MPLS L3VPN adjacency or connectivity failure into the correct order, from first to last.

Accepted Answer

Check PE-CE BGP adjacency state. Troubleshooting begins by verifying the PE-CE adjacency with 'show ip bgp vpnv4 vrf <name> summary'. If the adjacency is down, check the VRF interface status and IP connectivity using ping. Then verify that the VRF is correctly configured with 'show vrf'. Next, confirm that the MPLS LSP to the remote PE is functional using 'show mpls lsp'. Finally, check that the VPNv4 routes are being exchanged between PEs with 'show bgp vpnv4 unicast all'.

Question 11

Which TWO commands can be used to verify the MPLS L3VPN label forwarding table on a PE router? (Choose TWO.)

Accepted Answer

show mpls forwarding-table. The 'show mpls forwarding-table' displays the LFIB with labels and next hops for all VPNv4 prefixes. The 'show ip bgp vpnv4 vrf labels' shows the label assigned by the local PE for prefixes in a specific VRF. 'show mpls ldp bindings' shows LDP label bindings, not VPN labels. 'show ip route vrf ' shows the routing table, not labels. 'show bgp vpnv4 unicast all labels' is a valid alternative but not listed; 'show ip bgp vpnv4 vrf' with labels is correct.

Answer

show mpls ldp bindings

Answer

show ip route vrf CUSTOMER_A

Answer

show mpls ldp neighbor

Question 12

What is the default BGP update timer (advertisement interval) for eBGP peers in Cisco IOS-XE?

Accepted Answer

30 seconds. The default eBGP advertisement interval is 30 seconds, meaning that after sending an update to an eBGP peer, the router waits at least 30 seconds before sending another update.

Answer

0 seconds

Answer

15 seconds

Answer

60 seconds

Question 13

In MPLS L3VPN, what is the default behavior when a PE router receives a VPNv4 route with a Route Target that does not match any import RT on any VRF?

Accepted Answer

The route is stored in the BGP table but not installed in any VRF routing table.. The PE will still store the route in its BGP table (since BGP accepts all routes by default), but it will not install it into any VRF routing table because the import filter rejects it.

Answer

The route is discarded and not stored in the BGP table.

Answer

The route is installed in the global routing table.

Answer

The route is advertised to all other PEs.

Question 14

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.0.0.2
  BGP state = Idle
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Accepted Answer

The BGP neighbor is down, and the EEM policy may have been triggered.. The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Answer

The BGP neighbor is up and running.

Answer

The EEM policy is not registered.

Answer

The BGP session is established.

Question 15

An engineer configures DMVPN Phase 2 on a hub-and-spoke network for an MPLS L3VPN customer. The spokes are configured with a single tunnel interface and use NHRP to register with the hub. The engineer notices that spoke-to-spoke traffic is not being established, even though the spokes have each other's NHRP mappings. The engineer verifies that the tunnel interfaces are up and that the hub can reach all spokes. What is the most likely explanation?

Accepted Answer

The spokes have a default route pointing to the hub, which prevents them from using the direct spoke-to-spoke tunnel.. In DMVPN Phase 2, spoke-to-spoke tunnels are established dynamically using NHRP redirect and shortcut. However, a common edge case is that the spokes must have a route that points to the destination network via the tunnel interface. If the spokes have a default route or a summary route that points to the hub (Phase 1 behavior), they will not use the direct spoke-to-spoke tunnel. In Phase 2, the hub must send an NHRP redirect to the source spoke, and the source spoke must then send an NHRP resolution request to the destination spoke. If the spokes have a static route that forces traffic through the hub, the NHRP redirect will not work. Additionally, the 'ip nhrp redirect' command must be configured on the hub, and 'ip nhrp shortcut' on the spokes.

Answer

The 'ip nhrp authentication' string is mismatched between the spokes.

Answer

The tunnel mode is set to 'gre multipoint' on the spokes, which is not supported in Phase 2.

Answer

The 'ip nhrp map multicast' command is missing on the spokes, preventing multicast traffic.

Question 16

An engineer configures OSPF between two PE routers in an MPLS L3VPN backbone. Both routers are directly connected via a GigabitEthernet link. The OSPF adjacency forms and then repeatedly flaps between FULL and EXSTART. The engineer verifies that both routers have matching OSPF network types (broadcast), matching area IDs, and no authentication mismatch. What is the most likely cause of the flapping?

Accepted Answer

The MTU on one of the interfaces is lower than the other, causing DBD packet fragmentation.. In OSPF, if the MTU of the interface on one side is smaller than the size of a Database Description (DBD) packet, the neighbor will be stuck in EXSTART or the adjacency will flap. This is because OSPF uses the interface MTU to determine the maximum size of DBD packets, and if a router receives a DBD packet larger than its interface MTU, it drops it and the neighbor relationship cannot progress. This is a common edge case when one interface has a reduced MTU (e.g., due to MPLS overhead or misconfiguration) while the other uses the default 1500 bytes.

Answer

The OSPF hello interval is mismatched between the two routers.

Answer

The OSPF dead interval is too short, causing the neighbor to be declared dead prematurely.

Answer

The OSPF router ID is duplicated on the segment.

Question 17

Examine the following configuration on R6:

!--- R6 configuration
route-map FILTER deny 10
 match tag 50
!
route-map FILTER permit 20
!
router eigrp 200
 distribute-list route-map FILTER in
!

What is the effect of this configuration?

Accepted Answer

All routes with tag 50 are denied; all other routes are permitted.. The distribute-list route-map FILTER in is applied to EIGRP updates received on all interfaces (since no interface is specified). Sequence 10 denies any route with tag 50. Sequence 20 permits all other routes. Therefore, routes with tag 50 are filtered out (not installed in the routing table), while all other routes are accepted.

Answer

Routes with tag 50 are permitted; all other routes are denied.

Answer

The distribute-list is applied only to the first interface; routes with tag 50 are filtered on that interface.

Answer

The configuration is invalid because route-maps cannot be used with distribute-list in EIGRP.

Question 18

What is the default behavior of the 'logging buffered' command in Cisco IOS-XE when no severity level is specified?

Accepted Answer

It captures messages of severity 0 through 7.. When 'logging buffered' is configured without a severity level, it defaults to severity 7 (debugging), capturing all messages.

Answer

It captures only messages of severity 0 through 4.

Answer

It captures only messages of severity 0 through 5.

Answer

It captures only messages of severity 0 through 6.

Question 19

Which TWO statements about the 'show ip bgp vpnv4 vrf <vrf-name>' command output are correct? (Choose TWO.)

Accepted Answer

The output includes the Route Distinguisher (RD) for each prefix.. The command 'show ip bgp vpnv4 vrf <vrf-name>' displays the BGP table for the specified VRF, including VPNv4 routes that have been imported. It shows the RD, the next-hop, and the route label. It does not show the full VRF routing table (which is seen with 'show ip route vrf'), nor does it show the CEF forwarding table. The output includes both locally originated and remote routes that have been accepted. The label information is present in the output.

Answer

The output displays only routes that are locally originated by the PE router.

Answer

The output is equivalent to 'show ip route vrf <vrf-name>'.

Answer

The output provides the CEF forwarding information for each prefix.

Question 20

A network engineer runs the following command on Router R1:

R1# show access-lists 100

Extended IP access list 100
    10 permit icmp any any echo
    20 permit icmp any any echo-reply
    30 permit icmp any any time-exceeded
    40 permit icmp any any unreachable

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what is the most likely problem?

Accepted Answer

The access-list does not include all ICMP types that may be sent to the control plane.. The access list 100 only permits four specific ICMP types (echo, echo-reply, time-exceeded, unreachable), but the control plane may receive many other ICMP types (e.g., parameter problem, redirect, timestamp, address mask request) that are not explicitly permitted. Since the class-map CoPP-ICMP matches all traffic that hits access-group 100, any ICMP packet with a type not listed will not match the class and will be handled by the default control-plane policy, which typically drops or polices such traffic, leading to legitimate ICMP packets being dropped.

Answer

The class-map uses 'match-all' instead of 'match-any'.

Answer

The police rate is too low and is dropping all packets.

Answer

The policy-map is applied to the wrong direction.