300-410 Practice Test 8 — 10 Questions

Question 1

What is the default lease duration for a DHCPv4 address pool on a Cisco IOS router?

Accepted Answer

1 day. The default lease duration for a DHCPv4 address pool on a Cisco IOS router is 1 day (86400 seconds). This is defined by the Cisco IOS DHCP server implementation, which uses a 24-hour lease as the default when no lease duration is explicitly configured under the DHCP pool configuration.

Answer

7 days

Answer

30 minutes

Answer

Infinite

Question 2

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:1::1                              0   aaaa.bbbb.cccc  REACH  Gi0/0/0
2001:DB8:1::2                             10   aaaa.bbbb.cccd  STALE  Gi0/0/0
2001:DB8:1::3                              -   aaaa.bbbb.ccce  DELAY  Gi0/0/1
FE80::1                                    0   aaaa.bbbb.cccf  REACH  Gi0/0/0

Based on this output, which statement is correct?

Accepted Answer

The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.. The DELAY state in IPv6 Neighbor Discovery (ND) indicates that a neighbor has not been confirmed reachable within the last 5 seconds, and the router will send a Neighbor Solicitation (NS) message after the DELAY timer expires (default 5 seconds) to verify reachability. The entry for 2001:DB8:1::3 shows a hyphen in the Age column, meaning it was just created or refreshed, and it is in DELAY, so an NS will be sent soon.

Answer

All neighbors are in a stable state.

Answer

The neighbor 2001:DB8:1::2 is unreachable.

Answer

The link-local address FE80::1 is not valid.

Question 3

R1 and R2 are OSPF neighbors over a tunnel interface with BFD enabled. R1#show ip ospf interface tunnel0 shows 'BFD is enabled' but R1#show bfd neighbors shows the session as 'Down'. R2#show bfd neighbors shows the session as 'Down'. The tunnel is up and OSPF adjacency is full. R1 has 'bfd interval 100 min_rx 100 multiplier 3' under tunnel0. R2 has same. What is the root cause?

Accepted Answer

BFD is not supported over tunnel interfaces; it requires physical interfaces.. BFD over tunnel interfaces requires that the underlying transport (e.g., GRE) supports BFD. BFD cannot be established over a tunnel if the tunnel endpoint IP addresses are not directly connected; BFD requires physical connectivity. Since OSPF is full, the tunnel is working, but BFD fails because the tunnel is considered a virtual interface and BFD expects a direct physical link.

Answer

The tunnel mode must be changed to 'ipsec' for BFD to work.

Answer

OSPF must be configured with 'bfd all-interfaces' to work over tunnels.

Answer

The BFD timers must be increased for tunnel interfaces.

Question 4

In Cisco IOS, what is the default encryption algorithm for IKEv1 phase 1 if not specified in the ISAKMP policy?

Accepted Answer

DES. In Cisco IOS, when an IKEv1 ISAKMP policy is configured without specifying an encryption algorithm, the default encryption algorithm is DES (Data Encryption Standard). This is because Cisco IOS defaults to DES for IKEv1 phase 1 if no encryption is explicitly defined in the ISAKMP policy, as per the default policy parameters. DES uses a 56-bit key and is considered weak by modern standards, but it remains the default for backward compatibility.

Answer

AES 256

Answer

3DES

Answer

AES 128

Question 5

Drag and drop the steps to verify and validate IP SLA operational state into the correct order, from first to last.

Accepted Answer

Check 'show ip sla configuration' for operation details. Begin by checking the overall IP SLA configuration to confirm the operation is defined, then review the latest statistics for RTT and success rate, examine the reaction configuration if tracking is used, verify the tracking object status, and finally confirm that tracked objects are influencing routing or policy.

Question 6

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::1
  DUID: 0003000100AABBCCDDEE
  Username: unknown
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::100/128
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The client has been assigned an IPv6 address via DHCPv6.. The output shows a DHCPv6 binding entry with an IA NA (Identity Association for Non-temporary Addresses) containing an assigned IPv6 address (2001:DB8:1::100/128) along with preferred and valid lifetimes. This confirms that the client with DUID 0003000100AABBCCDDEE successfully obtained an IPv6 address via stateful DHCPv6, not through SLAAC or any other method.

Answer

The client is using SLAAC instead of DHCPv6.

Answer

The client's lease has expired.

Answer

The client is not authorized.

Question 7

R1 and R2 are connected via an IPsec VPN tunnel. R1 has a static route to 10.10.10.0/24 pointing to the tunnel interface. R2 has a static route to 192.168.1.0/24 pointing to the tunnel interface. Both routers have BGP configured between loopback addresses over the tunnel. BGP peering is established, but R1 cannot ping 10.10.10.1 (R2's loopback) from its loopback. R1's show ip bgp shows the route as valid but not best. What is the root cause?

Accepted Answer

The static route to 10.10.10.0/24 via tunnel causes recursive routing failure because the tunnel destination is not reachable.. R1's static route to 10.10.10.0/24 points to the tunnel interface, but the tunnel destination (the remote peer's public IP) is not reachable via a valid routing path. This creates a recursive routing failure: the router tries to resolve the tunnel interface's next-hop (the tunnel destination) but cannot find a route to it, causing the BGP route to be marked as valid but not best. Without a reachable tunnel destination, the IPsec VPN cannot forward traffic, so pings from R1's loopback to 10.10.10.1 fail.

Answer

BGP next-hop-self is not configured on R2.

Answer

The IPsec tunnel is not encrypting BGP traffic.

Answer

The BGP network statement for 10.10.10.0/24 is missing on R2.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---

R1# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 1
   map-id 1
   [Id] ip nat inside source list ACL1 pool POOL1
   refcount 1

Based on this output, what is the problem?

Accepted Answer

The NAT translation exists but no traffic is being translated (0 hits, 0 misses), indicating a possible idle translation or no matching traffic.. The output shows a single dynamic NAT translation with zero hits and zero misses, meaning no traffic has attempted to traverse the NAT process. This indicates the translation entry exists (likely from a previous or idle session) but no packets have matched the access list or triggered translation since the counters were cleared. The problem is that the NAT configuration is in place but not actively translating any traffic.

Answer

The NAT pool is exhausted.

Answer

PAT is misconfigured.

Answer

The inside and outside interfaces are reversed.

Question 9

An engineer configures DHCPv4 on a router with multiple pools for different subnets. Clients in subnet A receive addresses correctly, but clients in subnet B receive addresses from subnet A's pool. The router has 'ip dhcp relay' configured. Which is the most likely explanation?

Accepted Answer

The DHCP server selects the pool based on the giaddr; if the relay agent does not set the giaddr correctly, the server may use the first matching pool.. When a DHCP relay agent forwards a client's request to the server, it inserts its own IP address (the interface address on the client's subnet) into the giaddr (gateway IP address) field. The DHCP server uses this giaddr to select the appropriate pool. If the relay agent fails to set the giaddr correctly—for example, due to misconfiguration or the relay interface not being on the correct subnet—the server may receive a giaddr of 0.0.0.0 or an incorrect address, causing it to fall back to the first configured pool that matches, which in this case is subnet A's pool.

Answer

The pools are configured in the wrong order; the server uses the first pool that matches the client's MAC address.

Answer

The router has 'ip dhcp smart-relay' enabled, which overrides pool selection.

Answer

The DHCP server is configured with 'network' statements that overlap.

Question 10

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show snmp. The `show snmp` command displays the overall SNMP agent configuration, including contact, location, community strings, and SNMP version. The `show snmp host` command lists the configured SNMP notification receivers (trap or inform destinations) and verifies that the router is correctly configured to send SNMP messages to the management station. Together, these two commands confirm both the agent's operational state and its connectivity to remote hosts.

Answer

show snmp group

Answer

show snmp user

Answer

debug snmp packets