300-410 Mock Exam 82 — 25 Questions

Question 1

Which TWO statements about IP SLA ICMP echo operations are true? (Choose TWO.)

Accepted Answer

It measures round-trip time (RTT) between the source and destination.. IP SLA ICMP echo measures round-trip time (RTT) by sending ICMP echo requests and waiting for replies. It does not measure jitter (that requires UDP jitter operations). It can be configured with a frequency and a timeout, and the operation must be started with the 'ip sla schedule' command. The source IP can be specified, but the destination must be an IP address, not a hostname unless DNS resolution is configured.

Answer

It measures jitter in the network path.

Answer

The destination can be specified as a hostname without any additional configuration.

Answer

The operation runs continuously by default after configuration.

Question 2

An engineer configures IPsec between two routers using a site-to-site VPN. The tunnel is established, but traffic is not encrypted. The engineer checks the crypto map and sees that the ACL for interesting traffic is configured correctly. Which is the most likely explanation?

Accepted Answer

The ACL on the remote router does not mirror the local ACL, so the remote router does not initiate an SA for the return traffic.. A common edge case is that the ACL for interesting traffic is applied to the wrong interface or in the wrong direction. In site-to-site VPNs, the crypto map is applied to the outbound interface of the traffic. However, if the ACL is configured with the wrong source/destination (e.g., using the tunnel IP instead of the real IP), traffic will not match. Another less obvious issue is that the ACL must be symmetric; if the ACL on one router permits traffic from A to B, the other router must permit traffic from B to A. If one side is missing, the traffic may be sent but not encrypted because the other side does not have a matching SA.

Answer

The crypto map is applied to the wrong interface (e.g., the inside interface instead of the outside interface).

Answer

The transform set uses ESP with authentication only, which does not provide encryption.

Answer

The IKE policy uses aggressive mode, which does not support encryption.

Question 3

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up and traffic is flowing, but the engineer notices that the 'show crypto ipsec sa' output shows the 'pkts encaps failed' counter incrementing slowly over time. The tunnel remains up. What is the most likely cause?

Accepted Answer

There is a floating static route that points to the physical interface instead of the tunnel for some subnets.. A slow but steady increase in 'pkts encaps failed' indicates that some packets that should be encrypted are not being encrypted. This is often caused by a routing issue where some traffic to the remote LAN is being routed out an interface that does not have the crypto map, bypassing encryption.

Answer

The crypto map is applied to the tunnel interface instead of the physical interface.

Answer

The IPsec SA lifetime is set too high.

Answer

The access list in the crypto map is too restrictive and missing some subnets.

Question 4

Examine this BGP configuration on router R3:

router bgp 65001
 neighbor 10.1.1.1 remote-as 65002
 address-family ipv4
  network 192.168.0.0 mask 255.255.252.0
  aggregate-address 192.168.0.0 255.255.252.0 summary-only

What is the effect of the 'aggregate-address' command with the 'summary-only' keyword?

Accepted Answer

It advertises the aggregate 192.168.0.0/22 and suppresses all more specific routes from being advertised to neighbor 10.1.1.1.. The aggregate-address command creates an aggregate route in BGP. The summary-only keyword suppresses more specific routes from being advertised.

Answer

It advertises both the aggregate and all more specific routes.

Answer

It creates a static route for the aggregate.

Answer

It removes all more specific routes from the BGP table.

Question 5

MPLS LDP neighbors are not forming between two directly connected routers. Router R1 has the following relevant configuration: interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.252 mpls ip Router R2 shows: show mpls ldp neighbor No LDP neighbors show mpls ldp discovery Local LDP Identifier: 10.1.1.1:0 Discovery Sources: Interfaces: GigabitEthernet0/0 (ldp): xmit/recv LDP: no Hello adjacencies What is the root cause?

Accepted Answer

An ACL or CoPP is blocking LDP UDP port 646 or TCP session.. LDP hello packets are being sent and received (xmit/recv), but no adjacency forms. This could be due to ACL blocking UDP 646, or CoPP rate-limiting LDP packets. The correct fix is to check ACLs and CoPP policies that may drop LDP hello or session packets.

Answer

The mpls ip command is missing on R2's interface.

Answer

The LDP router ID is not reachable; check loopback interfaces.

Answer

The label distribution method is different; use 'label distribution cdp' instead.

Question 6

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up, but the engineer notices that the 'show crypto ipsec sa' output shows that the number of packets encrypted is much higher than the number of packets decrypted on the remote side. What is the most likely cause?

Accepted Answer

The remote router has a misconfigured route that sends return traffic out the wrong interface.. A significant mismatch between encrypted and decrypted packet counts suggests that some packets are being lost or dropped after encryption. The most common cause is a routing issue where the return traffic from the remote side is not taking the VPN tunnel, so the remote router does not decrypt those packets.

Answer

The IPsec SA lifetime is set too low, causing frequent rekeying.

Answer

The crypto map on the local router is applied to the wrong interface.

Answer

The access list in the crypto map on the remote router is too permissive, encrypting extra traffic.

Question 7

An engineer configures OSPF on a DMVPN Phase 1 network with a single hub and multiple spokes. The hub is configured with 'ip ospf network broadcast' and the spokes with 'ip ospf network point-to-multipoint'. The hub's OSPF priority is set to 255, and all spokes have priority 0. Unexpectedly, the hub does not become the DR, and no OSPF adjacency is formed. Which is the most likely explanation?

Accepted Answer

The OSPF network type mismatch causes the hub to send multicast Hellos, but the spokes expect unicast Hellos, so no adjacency forms.. In OSPF, the DR election is based on priority and Router ID. However, on a broadcast network, all routers must have the same network type to participate in the election. With a mix of broadcast and point-to-multipoint, the point-to-multipoint routers do not participate in the DR election, and the broadcast router may still attempt to elect a DR. But if the hub is the only router with broadcast network type, it will become the DR (since no other routers participate). However, the adjacency may still fail because the point-to-multipoint routers do not respond to multicast Hellos from the hub. The corner case is that the hub's OSPF interface is configured as broadcast, but the spokes are point-to-multipoint, which means the spokes send unicast Hellos and expect unicast Hellos in return. The hub sends multicast Hellos, which the spokes ignore, and vice versa, leading to no adjacency.

Answer

The hub's OSPF priority of 255 ensures it becomes the DR, but the spokes with priority 0 cannot become BDR, causing the election to fail.

Answer

The spokes are configured with 'ip ospf network point-to-multipoint' but the hub is broadcast; the hub will still form adjacencies with the spokes if the MTU matches.

Answer

The OSPF process on the hub has a lower Router ID than the spokes, causing the spokes to become DR instead of the hub.

Question 8

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The tunnel is up, but traffic intermittently drops. The engineer notices that the 'show crypto ipsec sa' output shows the packet counters incrementing for both encrypt and decrypt, but the 'pkts encaps failed' counter is also increasing. What is the most likely cause?

Accepted Answer

The crypto map is not applied to the correct interface.. The 'pkts encaps failed' counter indicates that the router is unable to encrypt packets that should be encrypted. This typically happens when the crypto map's access list matches traffic, but the route to the remote LAN points out an interface that does not have the crypto map applied, causing the router to try to send the packet without encryption.

Answer

The IPsec transform set is misconfigured with incompatible algorithms.

Answer

The IKE keepalive timer is too short, causing frequent rekeying.

Answer

The MTU on the outside interface is too small, causing fragmentation.

Question 9

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is not coming up. The engineer runs 'show crypto isakmp sa' and sees no active IKE SAs. The peer IP address is correctly configured. What should the engineer check first?

Accepted Answer

Check the IP connectivity between the two public IP addresses using ping.. The absence of IKE SAs indicates that IKE phase 1 negotiation has not started or failed. The first step is to verify that the routers can reach each other at the IP layer, as a connectivity issue will prevent any IKE exchange.

Answer

Verify that the crypto map is correctly applied to the outside interface.

Answer

Check the IPsec transform set configuration on both routers.

Answer

Verify the pre-shared key is identical on both routers.

Question 10

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp ipv4 unicast 10.1.1.0/24

BGP routing table entry for 10.1.1.0/24, version 10
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Last update: Mon Mar  1 00:05:23 2024

What does this output indicate?

Accepted Answer

BGP is functioning correctly, and CoPP is not interfering with BGP sessions.. The output shows a valid BGP route for 10.1.1.0/24 with the path marked as 'valid, external, best' and a recent last update time. This indicates that the BGP session is established, updates are being received, and the route is being installed in the routing table. Since CoPP drops packets only when control plane traffic exceeds configured rate limits, the presence of a healthy BGP route with current timestamps confirms that CoPP is not interfering with BGP sessions.

Answer

BGP is not receiving updates due to CoPP dropping packets.

Answer

BGP is stuck in idle state due to CoPP.

Answer

BGP is only advertising routes locally.

Question 11

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)
  Inbound access list: FILTER-IPv6

Based on this output, which two features are configured on this interface?

Accepted Answer

uRPF in strict mode and inbound IPv6 ACL. The output shows 'IPv6 uRPF: strict mode (drop invalid packets)' and 'Inbound access list: FILTER-IPv6', confirming that unicast Reverse Path Forwarding in strict mode and an inbound IPv6 ACL are both configured on the interface. Strict uRPF verifies that the source address of incoming packets has a matching route in the FIB pointing back to the same interface, dropping packets that fail this check. The inbound ACL filters traffic before any routing decision, as indicated by the 'Inbound access list' line.

Answer

uRPF in loose mode and outbound IPv6 ACL

Answer

uRPF disabled and inbound IPv6 ACL

Answer

uRPF in strict mode and outbound IPv6 ACL

Question 12

A network engineer runs the following command on Router R1:

R1# show ip ospf database

OSPF Router with ID (10.1.1.1) (Process ID 1)

Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
10.1.1.1        10.1.1.1        100         0x80000001 0x00A0B0 1
10.2.2.2        10.2.2.2        200         0x80000003 0x00C0D0 2

Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.1.2        10.1.1.2        150         0x80000001 0x00E0F0

R1# show ip route ospf
     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
O       10.2.2.0/24 [110/20] via 10.1.1.2, 00:10:00, FastEthernet0/0

Based on this output, what is a likely issue?

Accepted Answer

A route-map is filtering OSPF routes, causing only one route to be installed.. The OSPF database shows two routers and a net link, but only one OSPF route is in the routing table. This could be due to a route-map filtering OSPF routes. The correct answer is that a route-map may be filtering some OSPF routes from being installed.

Answer

OSPF is not running on any interface.

Answer

The router ID is misconfigured.

Answer

The area is not configured correctly.

Question 13

What is the default SNMPv2c community string on most Cisco IOS devices?

Accepted Answer

public. The default SNMPv2c community string on most Cisco IOS devices is 'public' for read-only access. This is a well-known default that allows basic SNMP polling without additional configuration, as defined in Cisco's default configuration for SNMP agents.

Answer

private

Answer

cisco

Answer

No default community string is configured.

Question 14

An engineer wants to ensure that OSPF-learned routes are preferred over EIGRP-learned routes for a specific destination prefix, without affecting other routes. Which TWO actions will accomplish this? (Choose TWO.)

Accepted Answer

Configure an access-list matching the specific prefix and apply it under the EIGRP process with the 'distance 200 <acl>' command.. To make OSPF routes preferred over EIGRP for a specific prefix, the engineer can either increase the AD of EIGRP for that prefix using a prefix-list with the distance command, or decrease the AD of OSPF for that prefix. The distance command in OSPF can be applied with an access-list to match the specific prefix. Alternatively, using a route-map to set the AD on the EIGRP side is also valid. Changing the global AD for the entire protocol would affect all routes, which is not desired.

Answer

Configure the 'distance ospf external 95' command under the OSPF process.

Answer

Use the 'maximum-paths' command to increase the number of equal-cost paths, allowing both routes to be installed.

Answer

Remove the EIGRP process and redistribute EIGRP routes into OSPF with a lower metric.

Question 15

What is the default tunnel mode for a tunnel interface on Cisco IOS?

Accepted Answer

tunnel mode gre ip. The default tunnel mode on Cisco IOS is GRE (Generic Routing Encapsulation) over IPv4, configured with the command `tunnel mode gre ip`. This mode encapsulates packets using the GRE protocol (RFC 2784) with an IPv4 transport header, and it is the default when no explicit tunnel mode is specified. GRE ip supports multiprotocol payloads (IPv4, IPv6, etc.) and is widely used for site-to-site VPNs and overlay networks.

Answer

tunnel mode ipv6ip

Answer

tunnel mode gre ipv6

Answer

tunnel mode mpls traffic-eng

Question 16

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa | include pkts
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

Based on this output, what is the problem?

Accepted Answer

No interesting traffic is being sent through the tunnel; check the crypto ACL and routing.. All packet counters are zero, indicating no traffic has been encrypted or decrypted. This could be due to a misconfigured crypto ACL that does not match the actual traffic, or routing issues preventing traffic from reaching the tunnel.

Answer

The IPsec SA is not established; the tunnel is down.

Answer

The tunnel is working correctly; all packets are being encrypted.

Answer

The remote peer is not responding; the SA is in MM_NO_STATE.

Question 17

A network engineer runs the following command on Router R1:

R1# show crypto ipsec transform-set
Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Based on this output, which statement is correct?

Accepted Answer

Both transform sets use tunnel mode; ESP-AES256-SHA uses stronger encryption.. The output shows two transform sets configured. The first uses AES-256 with SHA256 HMAC, the second uses AES-128 with SHA256 HMAC. Both use tunnel mode.

Answer

The transform sets use transport mode.

Answer

The transform sets use MD5 for hashing.

Answer

The transform sets are not compatible with IKEv2.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip sla statistics 2

Round Trip Time (RTT) for Index 2
   Latest RTT: No connection
   Latest RTT (milliseconds): No connection
   Latest RTT (microseconds): No connection
   Number of successes: 0
   Number of failures: 100
   Operation time to live: Forever
   Output: No connection

Based on this output, which statement is correct?

Accepted Answer

The target device is not responding to ICMP echo requests, or there is a routing problem.. The output shows 'No connection' for RTT and 'Output: No connection'. This indicates that the IP SLA operation cannot reach the target. The 100 failures confirm this. This is a clear sign of a connectivity issue.

Answer

The IP SLA operation is working correctly but the RTT is too high to measure.

Answer

The IP SLA operation has been manually disabled.

Answer

The IP SLA responder is misconfigured on the source router.

Question 19

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa peer 10.1.1.2
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The remote peer is not sending traffic back; check routing on the remote router.. The outbound packet count (encaps) is 100, but inbound (decaps) is 0. This suggests that traffic is being sent through the tunnel but no responses are being received, possibly due to a routing issue on the remote side or a firewall blocking return traffic.

Answer

The tunnel is working correctly; all packets are being encrypted and decrypted.

Answer

The local crypto ACL is misconfigured; it is not matching traffic.

Answer

The IPsec SA is not established; the tunnel is down.

Question 20

Given this configuration on Router R6:
```
interface Tunnel0
 ipv6 address 2001:DB8:8::1/64
 tunnel source 2001:DB8:9::1
 tunnel destination 2001:DB8:10::2
 tunnel mode gre ipv6
 tunnel path-mtu-discovery
```
What is the effect?

Accepted Answer

The tunnel will dynamically adjust the MTU based on the path MTU discovery.. The `tunnel path-mtu-discovery` command enables Path MTU Discovery (PMTUD) for the GRE tunnel, which dynamically determines the maximum MTU along the path to the tunnel destination and adjusts the tunnel interface's MTU accordingly. This prevents fragmentation issues by allowing the tunnel to use the smallest MTU in the path. Option B correctly identifies this behavior.

Answer

The tunnel will not work because path-mtu-discovery is not supported with GRE.

Answer

The tunnel mode should be 'ipv6ip' for IPv6 transport.

Answer

The tunnel source and destination must be IPv4 addresses.