300-410 Mock Exam 80 — 25 Questions

Question 1

An engineer configures IPsec between two PE routers in an MPLS L3VPN using a site-to-site VPN. The engineer configures a transform-set with ESP encryption (AES-256) and ESP authentication (SHA-256). The engineer also configures an ACL to define interesting traffic. The VPN tunnel comes up, but no traffic is encrypted. The engineer verifies that the ACL is correct and that the crypto map is applied to the interface. What is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL for interesting traffic is not mirrored on the remote router; it only permits traffic in one direction.. A common edge case with IPsec is that the ACL for interesting traffic must be mirrored on both sides. If the ACL on one side permits traffic from source to destination, the other side must permit traffic from destination to source. If the ACLs are not mirrored, the tunnel may come up (due to IKE) but no traffic will be encrypted because the router does not consider the traffic as interesting. Another edge case is that the crypto map is applied to the wrong interface or that the ACL is using the wrong protocol (e.g., TCP instead of IP). However, the most likely explanation here is that the ACL is not correctly matching the traffic in both directions.

Answer

The transform-set uses AES-256, which is not supported on the remote router.

Answer

The 'crypto map' is applied to the wrong interface, such as the loopback instead of the physical interface.

Answer

The 'ipsec-over-tcp' command is missing, causing the IPsec packets to be dropped.

Question 2

An engineer configures iBGP between two PE routers in an MPLS L3VPN. The PE routers are in the same AS and are directly connected. The engineer configures 'neighbor x.x.x.x next-hop-self' on the route reflector (RR) but notices that the RR is not sending the VPNv4 routes to the client PE with the next-hop set to itself. The client PE receives the routes but the next-hop remains the original PE. What is the most likely explanation?

Accepted Answer

The 'next-hop-self' command is not applied to the route-reflector client session; it must be applied to the client's neighbor statement on the RR, but it is ignored for reflected routes.. In BGP, the 'next-hop-self' command is only effective for eBGP sessions or for iBGP sessions when the neighbor is not a route-reflector client. When a route reflector sends a route to a client, it does not change the next-hop attribute by default, even if 'next-hop-self' is configured. This is because the route reflector is expected to preserve the next-hop as learned from the original router. To change the next-hop on a route reflector, the engineer must use 'neighbor x.x.x.x next-hop-self' on the RR for the client, but this command is ignored for routes that are reflected from another iBGP speaker. This is a known edge case that can cause reachability issues if the client cannot reach the original next-hop.

Answer

The 'next-hop-self' command is only applicable to eBGP sessions, not iBGP.

Answer

The 'next-hop-self' command requires the 'soft-reconfiguration inbound' to be configured to take effect.

Answer

The 'next-hop-self' command is overridden by the 'next-hop-unchanged' command on the route reflector.

Question 3

A network engineer runs the following command to debug NAT with overload:

R1# debug ip nat overload
NAT: overload: s=10.1.1.1:1234->203.0.113.1:5678, d=192.168.1.1:80 [50]
NAT: overload: s=10.1.1.1:1235->203.0.113.1:5679, d=192.168.1.1:80 [51]
NAT: overload: s=10.1.1.2:80->203.0.113.1:5680, d=192.168.1.1:1024 [52]

What does this output indicate?

Accepted Answer

PAT is working correctly, translating multiple inside hosts to one outside IP.. The debug output shows PAT (Port Address Translation) functioning correctly: three distinct inside local addresses (10.1.1.1:1234, 10.1.1.1:1235, 10.1.1.2:80) are being translated to the same outside global address (203.0.113.1) but with unique port numbers (5678, 5679, 5680). This is the essence of NAT with overload, where multiple inside hosts share a single public IP by multiplexing on Layer 4 ports.

Answer

NAT is failing because the outside address is the same for all.

Answer

The translations are static.

Answer

The inside hosts are using the same port numbers.

Question 4

A network engineer is troubleshooting OSPFv2 route redistribution. R1 is an ASBR redistributing static routes into OSPF. R2, an internal router, receives the redistributed routes but they appear as O E2 routes. However, R1 also has a directly connected network 10.1.1.0/24 that is not being advertised as an OSPF route. 'show ip ospf database external' on R2 shows the redistributed static routes but not the connected network. What is the most likely cause?

Accepted Answer

The ASBR is missing the 'redistribute connected' command under the OSPF process.. By default, OSPF does not redistribute connected routes unless explicitly configured. The ASBR must use the 'redistribute connected' command under the OSPF process to advertise directly connected networks. The static routes are being redistributed because they are matched by the 'redistribute static' command, but the connected network is not part of the static route set unless it is also a static route. The engineer likely forgot to add 'redistribute connected' or use the 'subnets' keyword.

Answer

The connected network is not included in the redistribution because the engineer used 'redistribute static' without the 'subnets' keyword.

Answer

The connected network is not being advertised because it is not part of the OSPF process; the engineer must configure 'network 10.1.1.0 0.0.0.255 area 0' under router ospf.

Answer

The connected network is a loopback interface, and OSPF does not advertise loopback networks by default.

Question 5

Which THREE symptoms indicate that a route-map applied to a redistribution configuration is not working as intended? (Choose THREE.)

Accepted Answer

Routes that should be filtered are still present in the routing table of the receiving router.. Common symptoms of misconfigured route-maps include missing routes in the routing table, routes with wrong metrics, and no change after modifying the route-map (due to route-map caching or not reapplying). Routes with correct next hops but wrong administrative distance usually indicate a different issue. Routes appearing in the routing table with correct attributes suggest the route-map is working.

Answer

Routes have the correct next-hop but an incorrect administrative distance.

Answer

Routes appear in the routing table with the correct attributes as defined in the route-map.

Question 6

Consider the following DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp authentication cisco123
 ip nhrp map multicast dynamic
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
!
router eigrp 100
 network 10.0.0.0 0.0.0.255
!

What is a potential issue with this configuration?

Accepted Answer

EIGRP split-horizon is enabled by default on the tunnel interface, preventing spokes from learning routes from other spokes.. EIGRP over DMVPN requires split-horizon to be disabled on the hub's tunnel interface to allow spokes to learn routes from other spokes.

Answer

The NHRP authentication is missing on the spokes.

Answer

The tunnel mode should be 'gre ip' instead of 'gre multipoint'.

Answer

The EIGRP network statement is too broad.

Question 7

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp traffic

IP-EIGRP Traffic Statistics for process 100
  Hellos sent/received: 500/495
  Updates sent/received: 10/8
  Queries sent/received: 2/1
  Replies sent/received: 1/2
  Acks sent/received: 8/10
  Input queue high water mark: 2, Input queue depth: 0
  Total packets sent: 521, received: 516

What does this output indicate?

Accepted Answer

The EIGRP process is functioning normally with no signs of congestion or issues.. The output shows a balanced exchange of EIGRP packets with no retransmissions, a low input queue depth of 0, and a high water mark of only 2. These metrics indicate the EIGRP process is stable, with no congestion, packet loss, or neighbor issues. The slight difference between hellos sent (500) and received (495) is normal due to timing or asymmetric paths and does not indicate a problem.

Answer

The network is experiencing a high number of queries, indicating instability.

Answer

There is a problem with packet loss because more hellos were sent than received.

Answer

The router is not receiving acknowledgments for its updates.

Question 8

A network engineer runs the following command to troubleshoot IPsec on a DMVPN tunnel:

R1# debug crypto isakmp

ISAKMP: received peer 192.168.1.2, port 500, local 192.168.1.1
ISAKMP: SA created, initiating IKE Main Mode
ISAKMP: sent MM_SA proposal to 192.168.1.2
ISAKMP: received MM_SA response from 192.168.1.2
ISAKMP: Main Mode complete, starting Quick Mode
ISAKMP: sent QM_SA request to 192.168.1.2
ISAKMP: received QM_SA response from 192.168.1.2
ISAKMP: Quick Mode done, IPsec SA established

What does this output indicate?

Accepted Answer

IKE negotiation succeeded and an IPsec SA is now active.. The debug shows successful IKE Main Mode and Quick Mode exchanges, resulting in an established IPsec SA between 192.168.1.1 and 192.168.1.2.

Answer

IKE negotiation failed; no IPsec SA was established.

Answer

The peer 192.168.1.2 is not responding to IKE requests.

Answer

IKE is using Aggressive Mode instead of Main Mode.

Question 9

Which statement about RSPAN VLAN is correct?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches in the network.. An RSPAN VLAN is a dedicated VLAN used to carry mirrored traffic from source switches to a destination switch. It must be configured as a remote-span VLAN, and no end devices should be connected to it.

Answer

The RSPAN VLAN must be the same as the native VLAN on the trunk.

Answer

The RSPAN VLAN can be used for normal user traffic if needed.

Answer

The RSPAN VLAN must be pruned from all trunk links to avoid unnecessary flooding.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail Gi0/0
EIGRP-IPv4 Interfaces for AS(100)
Interface: GigabitEthernet0/0
  Peers: 1
  Xmit Queue Un/Reliable: 0/0
  Mean SRTT: 12
  Pacing Time Un/Reliable: 0/10
  Multicast Flow Timer: 50
  Pending Routes: 0
  Hello interval: 5
  Hold time: 15
  Split horizon: Enabled
  Next multicast: 0.0.0.0
  Next broadcast: 0.0.0.0

Based on this output, what is the problem?

Accepted Answer

Split horizon is enabled, which is a normal and expected configuration.. Split horizon is a default and expected behavior in EIGRP for most interface types, including GigabitEthernet. The output shows 'Split horizon: Enabled', which is normal and prevents routing loops by ensuring that routing information learned on an interface is not advertised back out of that same interface. There is no problem indicated by this setting.

Answer

Split horizon is disabled, which could cause routing loops.

Answer

The hold time of 15 seconds is too short and may cause instability.

Answer

The interface has no peers, indicating a problem.

Question 11

Which THREE symptoms indicate that IPv6 First Hop Security features are misconfigured or not functioning correctly? (Choose THREE.)

Accepted Answer

IPv6 hosts on a segment are unable to obtain a global unicast address via SLAAC, even though a legitimate router is present.. SLAAC relies on Router Advertisements (RAs) to provide the prefix and other configuration information. If IPv6 First Hop Security features such as RA Guard or RA snooping are misconfigured, they may block or drop legitimate RAs, preventing hosts from generating a global unicast address via SLAAC even though a valid router is present.

Answer

IPv6 pings between two hosts on the same VLAN succeed, but pings to the router fail.

Answer

The switch logs show frequent 'IPv6 address collision' messages.

Question 12

Consider the following partial DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp authentication cisco123
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map multicast dynamic
!

What is the effect of this configuration?

Accepted Answer

The hub will dynamically register spoke NHRP addresses and forward multicast traffic to all registered spokes.. The command 'ip nhrp map multicast dynamic' allows the hub to dynamically learn spoke NHRP addresses for multicast replication, which is essential for routing protocols (e.g., EIGRP, OSPF) that use multicast.

Answer

The hub will only forward multicast traffic to spokes that are statically mapped.

Answer

The hub will not forward multicast traffic at all because dynamic mapping is not supported.

Answer

The hub will use broadcast instead of multicast for all traffic.

Question 13

Router R1 is configured as an ERSPAN source to monitor traffic on interface Tunnel0 (a DMVPN tunnel). The destination is a collector at 172.16.0.100. R1's configuration: monitor session 1 type erspan-source source interface Tunnel0 both destination erspan-id 4 ip address 172.16.0.100 origin ip address 10.0.0.1. The collector receives no packets. The Tunnel0 interface is up/up and has an IP of 10.0.0.1/30. The tunnel destination is 192.168.1.1. The router has a route to 172.16.0.100 via 10.0.0.2. What is the root cause?

Accepted Answer

The ERSPAN destination IP is routed via the tunnel interface, causing the encapsulated packets to be sent into the tunnel and double-encapsulated, leading to drop.. ERSPAN monitors traffic on the source interface. When the source is a tunnel interface, the mirrored traffic is the original IP packets before encapsulation. The ERSPAN process then encapsulates these packets with a new IP header. However, the encapsulated packets are sent using the routing table. If the destination IP is reachable via a route that points to the tunnel interface itself (e.g., via 10.0.0.2, which is the tunnel's peer), the encapsulated packets may be sent into the tunnel, causing them to be encapsulated again. This double encapsulation can cause issues. But the more likely root cause is that the ERSPAN session is configured to monitor the tunnel interface, but the tunnel interface itself may not be able to generate the encapsulated packets correctly because the tunnel is used for the destination. The correct answer is that the ERSPAN source IP is the same as the tunnel interface IP, and the destination is routed via the tunnel, causing a recursive routing loop similar to the first question.

Answer

The ERSPAN source interface is a tunnel, which is not supported for ERSPAN.

Answer

The tunnel interface is not in the same VRF as the collector.

Answer

The ERSPAN session ID 4 conflicts with the tunnel key.

Question 14

A DMVPN Phase 3 network with BGP as the routing protocol experiences high CPU usage on the hub router R1. The 'show process cpu' command shows high usage by the 'BGP Scanner' process. What is the root cause?

Accepted Answer

R1 is receiving a large number of BGP updates from many spokes, causing the BGP Scanner to process many prefixes and consume high CPU.. High BGP Scanner CPU usage can be caused by a large number of prefixes being processed, especially if there are many updates or flapping routes. In a DMVPN network, if spokes are configured to advertise many prefixes or if there is route instability (e.g., due to flapping tunnels), the BGP Scanner process can consume high CPU. Another common cause is that the hub is processing many BGP updates from multiple spokes without proper route filtering or aggregation.

Answer

R1 has a CoPP policy that rate-limits BGP traffic, causing packet drops and retransmissions.

Answer

R1's BGP table is fragmented due to memory issues.

Answer

R1 has 'bgp update-delay' configured, causing delayed processing of updates.

Question 15

An engineer configures Control Plane Policing (CoPP) on a router to protect the control plane. After applying the policy, the router becomes unreachable via SSH and SNMP. The engineer checks the policy and confirms that the class-map for SSH and SNMP traffic is set to 'permit'. What is the most likely explanation?

Accepted Answer

The class-default is set to 'drop', causing all unmatched traffic to be dropped, including SSH and SNMP if they are not correctly classified.. A common edge case with CoPP is that the default class class-default is often set to 'drop' or 'police' with a very low rate, which can drop all traffic not explicitly matched by other classes. Even if SSH and SNMP are permitted, if the class-default is set to drop, any traffic that does not match the explicit classes (e.g., due to a misclassification) will be dropped. Additionally, the order of class-maps matters; if a broader class matches before the specific one, the traffic may be policed incorrectly.

Answer

The 'rate-limit' is configured in bps instead of pps, causing excessive policing.

Answer

The 'service-policy' is applied to the control-plane input direction, but SSH and SNMP are output traffic.

Answer

The class-map for SSH and SNMP uses a 'match-all' condition, but the access-list has multiple entries that are ORed.

Question 16

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: DMVPN, local addr 10.1.1.1

protected vrf: (none)
   local  ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0)
   remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150
    #pkts decaps: 145, #pkts decrypt: 145, #pkts verify: 145
    #send errors 0, #recv errors 0

local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2
   path mtu 1500, ip mtu 1500, ip mtu idb Tunnel0
   current outbound spi: 0x12345678(305419896)
   PFS (Y/N): N, DH group: none

Based on this output, what is the problem?

Accepted Answer

There is packet loss on the IPsec tunnel.. The output shows IPsec SA details for a DMVPN tunnel. The protect identity uses GRE protocol (47) and the SA is between two spoke routers (172.16.0.0/24). The packet counts show 150 encapsulated but only 145 decapsulated, indicating packet loss on the tunnel. This could be due to MTU issues or routing problems.

Answer

The IPsec SA is using PFS.

Answer

The tunnel is not encrypting traffic.

Answer

The remote peer is 10.1.1.1.

Question 17

In DMVPN Phase 3, which NHRP feature allows spokes to learn the NBMA address of other spokes without sending a resolution request?

Accepted Answer

NHRP redirect. NHRP redirect is used in Phase 3 to inform spokes about better paths. The hub sends a redirect message to a spoke when it forwards a packet to another spoke, allowing the first spoke to learn the NBMA address of the second spoke.

Answer

NHRP shortcut

Answer

NHRP registration

Answer

NHRP resolution

Question 18

Which THREE symptoms indicate that IPv6 unicast RPF is misconfigured or failing on an interface? (Choose THREE.)

Accepted Answer

Traffic from a valid source IP is being dropped on the interface.. IPv6 unicast RPF (uRPF) drops traffic when the source address is not reachable via the incoming interface according to the FIB. If a valid source IP is being dropped, it indicates that the RPF check is failing, often due to asymmetric routing or a missing route in the FIB for that source prefix.

Answer

The command 'ipv6 verify unicast source reachable-via any' is present in the running config.

Answer

High CPU utilization is observed due to RPF processing.

Question 19

A network engineer runs the following command to verify EIGRP routes over DMVPN:

R1# show ip eigrp topology all-links

P 10.10.10.0/24, 1 successors, FD is 128256
        via 10.0.0.2 (128256/128256), Tunnel0
        via 10.0.0.3 (131072/128256), Tunnel0

What does this output indicate?

Accepted Answer

The route has a successor via 10.0.0.2 and a feasible successor via 10.0.0.3.. The output shows two paths for 10.10.10.0/24: one via 10.0.0.2 with feasible distance 128256 (successor), and one via 10.0.0.3 with reported distance 128256 (feasible successor).

Answer

The route 10.10.10.0/24 has two equal-cost paths via Tunnel0.

Answer

Both paths are in active state and being queried.

Answer

The route is not reachable because both paths are down.

Question 20

Which TWO statements about the operation of DMVPN Phase 2 are true? (Choose TWO.)

Accepted Answer

Spoke routers can dynamically establish direct tunnels with each other.. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically using NHRP redirect and shortcut routes. The spoke router learns the NBMA address of another spoke via an NHRP redirect from the hub, and then initiates a direct tunnel. Phase 2 uses the 'ip nhrp redirect' command on the hub and 'ip nhrp shortcut' on spokes. The other statements are incorrect: Phase 2 does not require a multipoint GRE tunnel on the hub (it can be point-to-multipoint), and spoke-to-spoke traffic does not always go through the hub after the shortcut is established.

Answer

The hub router must use a point-to-point GRE tunnel interface.

Answer

All spoke-to-spoke traffic must traverse the hub router.

Answer

NHRP is not required for Phase 2 operation.