300-410 Mock Exam 83 — 25 Questions

Question 1

Examine this partial configuration on router R5:

flow record RECORD-3
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect routing source as
 collect routing destination as
!
flow monitor MONITOR-5
 record RECORD-3
 cache timeout active 60
!
interface GigabitEthernet0/5
 ip flow monitor MONITOR-5 input
!

What is missing or incorrect in this configuration?

Accepted Answer

The router must have BGP configured and the flow record must include 'match ipv4 bgp source-as' and 'match ipv4 bgp destination-as' to collect AS numbers.. This question tests knowledge of BGP AS number collection requirements in Flexible NetFlow.

Answer

The flow record is missing 'match ipv4 source prefix-length' and 'match ipv4 destination prefix-length' to collect AS numbers.

Answer

The flow monitor is missing the 'cache timeout inactive' command to properly age out flows.

Answer

The configuration is correct; AS numbers will be collected automatically from the routing table.

Question 2

Which TWO statements correctly describe the verification of route summarization using Cisco IOS commands? (Choose TWO.)

Accepted Answer

The 'show ip route' command displays the summary route with a next-hop of Null0 for EIGRP and OSPF summarization.. To verify route summarization, engineers use 'show ip route' to see the summary route and discard entry, 'show ip protocols' to view configured summary addresses, and 'show ip ospf database' to see Type 3 summary LSAs. The 'show ip eigrp topology' command does not show summary routes by default, and 'debug ip routing' shows routing table changes but not summary-specific events.

Answer

The 'show ip eigrp topology' command displays all configured summary addresses and their metrics.

Answer

The 'debug ip routing' command provides detailed information about summary route creation and suppression.

Question 3

Consider the following partial configuration on router R6:

flow exporter EXPORTER-3
 destination 192.168.2.200
 source Loopback0
 transport udp 2055
 template data timeout 120
!
flow monitor MONITOR-6
 exporter EXPORTER-3
 record netflow ipv4 original-input
!
interface GigabitEthernet0/6
 ip flow monitor MONITOR-6 input
!

What is the effect of the 'template data timeout 120' command?

Accepted Answer

The router will resend the NetFlow v9 template to the collector every 120 seconds to ensure the collector has the latest template.. This question tests understanding of template refresh timing in NetFlow v9 export.

Answer

The router will wait 120 seconds before sending any flow data after the first template is sent.

Answer

The router will export flow data only if the template has been successfully acknowledged by the collector within 120 seconds.

Answer

The router will store flow data for 120 seconds before exporting to allow batching.

Question 4

Which TWO statements correctly describe the behavior of route summarization in RIP? (Choose TWO.)

Accepted Answer

RIPv2 automatically summarizes routes to their classful boundary by default, and this behavior can be disabled with the 'no auto-summary' command.. RIP version 2 supports automatic summarization by default (enabled with 'auto-summary'), which summarizes networks at classful boundaries. This can be disabled with 'no auto-summary'. Manual summarization is configured using 'ip summary-address rip' under an interface. The summary route is advertised with the metric of the best component route, and a discard route is automatically installed to prevent loops. RIP does not support VLSM summarization by default unless auto-summary is disabled.

Answer

Manual route summarization in RIP is configured using the 'network' command under the RIP process.

Answer

The summary route in RIP is advertised with a metric equal to the lowest hop count among the component routes.

Answer

RIP supports both automatic and manual summarization only for classful networks.

Question 5

What is the default active flow timeout value in Cisco IOS Flexible NetFlow?

Accepted Answer

1800 seconds. This question tests recall of default timer values in Flexible NetFlow.

Answer

60 seconds

Answer

300 seconds

Answer

30 seconds

Question 6

An engineer configures OSPF on two routers connected via a point-to-point link. The routers are stuck in EXSTART state. 'show ip ospf neighbor' shows neighbor state EXSTART/EXCHANGE. Which is the most likely explanation?

Accepted Answer

The MTU on the interfaces is mismatched.. In OSPF, the EXSTART state involves negotiating the master/slave relationship and the Database Description (DBD) packet size. If the MTU on the interfaces differs, the larger DBD packet from the router with the larger MTU will be dropped by the router with the smaller MTU, causing the adjacency to remain stuck in EXSTART. This is a common edge case that is often overlooked.

Answer

The OSPF network type is mismatched (point-to-point vs broadcast).

Answer

The OSPF router IDs are identical.

Answer

The hello/dead intervals are mismatched.

Question 7

In Flexible NetFlow, which of the following is true regarding the 'match' and 'collect' commands in a flow record?

Accepted Answer

The 'match' command defines fields that are used to identify unique flows, while 'collect' defines additional fields to include in the exported record.. This question tests understanding of the difference between match and collect in flow record definition.

Answer

Both 'match' and 'collect' define key fields; the difference is that 'match' fields are required and 'collect' fields are optional.

Answer

The 'match' command is used for input flows, and 'collect' is used for output flows.

Answer

The 'collect' command is used to aggregate flows, while 'match' is used to filter them.

Question 8

An engineer configures EIGRP named mode on a router. After configuration, a directly connected EIGRP neighbor is not forming an adjacency. 'show ip eigrp neighbors' shows nothing. Which is the most likely explanation?

Accepted Answer

The 'network' command was used under the EIGRP process, but the 'af-interface' configuration was omitted.. In EIGRP named mode, the network statement is not used. Instead, the 'af-interface' configuration under the address-family is mandatory to enable EIGRP on an interface. If the engineer only uses the classic 'network' command under the router eigrp process (which is still accepted in named mode for backward compatibility but does not activate the interface), the interface will not be enabled for EIGRP.

Answer

The EIGRP autonomous system number is mismatched.

Answer

The K-values are mismatched between the routers.

Answer

The passive-interface default command is configured.

Question 9

Which NetFlow version is the default export format when using Flexible NetFlow with the 'record netflow ipv4 original-input' command?

Accepted Answer

NetFlow version 9. This question tests knowledge of the default export version for Flexible NetFlow predefined records.

Answer

NetFlow version 5

Answer

IPFIX (NetFlow version 10)

Answer

NetFlow version 1

Question 10

An engineer configures a BGP route reflector in a network. After configuration, some iBGP routes are being dropped, causing routing loops. Which is the most likely explanation?

Accepted Answer

The route reflector is configured with the same cluster ID as another route reflector in the same AS.. BGP route reflectors use the ORIGINATOR_ID and CLUSTER_LIST attributes to prevent loops. If a route reflector receives a route with its own CLUSTER_LIST or ORIGINATOR_ID, it will drop the route. This can happen if there is a misconfiguration where the route reflector's cluster ID is not unique, or if a route reflector reflects a route back to the client that originated it, causing a loop.

Answer

The next-hop-self command is not configured on the route reflector.

Answer

The BGP synchronization rule is enabled.

Answer

The route reflector is not a client of itself.

Question 11

Which TWO statements about Flexible NetFlow flow records are true? (Choose TWO.)

Accepted Answer

A flow record defines which fields are matched (key fields) and which fields are collected (non-key fields).. Flexible NetFlow allows user-defined flow records that can match on Layer 2, 3, and 4 fields, such as MAC addresses, IP addresses, and TCP/UDP ports. Additionally, flow records can collect non-key fields like packet and byte counts, timestamps, and interface counters. Option B is false because Flexible NetFlow can also match on Layer 2 fields. Option C is false because flow records can include both key and non-key fields. Option E is false because Flexible NetFlow records are not limited to IPv4; they can also support IPv6 and MPLS.

Answer

Flexible NetFlow flow records can only match on Layer 3 and Layer 4 fields.

Answer

A flow record must contain at least one key field and cannot contain non-key fields.

Answer

Flexible NetFlow flow records are only supported for IPv4 traffic.

Question 12

An engineer configures mutual redistribution between OSPF and EIGRP on a router. After configuration, routing loops occur. Which is the most likely explanation?

Accepted Answer

The administrative distance of the redistributed routes is not modified, causing the redistributed route to be preferred over the original.. Mutual redistribution without route tagging or filtering can cause routing loops. When a route redistributed from OSPF into EIGRP is then redistributed back into OSPF, it can be preferred over the original route if the administrative distance is lower, creating a loop. This is a classic edge case that requires careful use of route tags and distribute-lists.

Answer

The seed metric is not configured for EIGRP redistribution.

Answer

The OSPF process ID is mismatched.

Answer

The redistribute command is missing the subnets keyword.

Question 13

A large enterprise network is experiencing intermittent loss of NetFlow data from multiple routers. Router R1 has the following relevant configuration: flow exporter EXPORTER-1 destination 10.1.1.1 source Loopback0 transport udp 2055 export-protocol netflow-v9. Router R2 shows: R2# show flow exporter EXPORTER-1 statistics | include (Packets|Errors) Packets exported: 0, Errors: 0. The network uses OSPF, and R1's Loopback0 is reachable via a summary route. What is the root cause?

Accepted Answer

The collector IP is not reachable due to a missing route; the summary route for Loopback0's subnet does not include the /32 host route.. The issue is that the NetFlow exporter's source interface (Loopback0) is not the same as the interface used to reach the collector (10.1.1.1). OSPF summarization may cause the source IP to be unreachable from the collector's perspective due to routing asymmetry or the summary route not including the specific /32. The correct fix is to ensure the source interface is the one with a route to the collector, or to use a loopback that is explicitly advertised.

Answer

The flow exporter is misconfigured with the wrong export protocol; it should be netflow-v5.

Answer

The UDP port 2055 is blocked by an ACL on R1's outbound interface.

Answer

The flow monitor is not applied to any interface, so no flows are being exported.

Question 14

An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels are not forming. Which is the most likely explanation?

Accepted Answer

NHRP redirect is not configured on the hub.. In DMVPN Phase 2, spoke-to-spoke tunnels require that the spoke routers have a route to the destination network via the tunnel interface, and that NHRP redirect is enabled on the hub. Without NHRP redirect, the hub will not send redirect messages to the spoke, and the spoke will not initiate a direct tunnel to the other spoke.

Answer

The spoke routers have different tunnel keys.

Answer

The NHRP authentication string is mismatched.

Answer

The IPsec transform-set is mismatched.

Question 15

A company uses EIGRP with route redistribution from OSPF. After configuring Flexible NetFlow to monitor traffic, engineers notice that some routes are missing from the routing table. Router R1 has: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 route-map FILTER-OSPF. The route-map FILTER-OSPF uses a match ip address prefix-list ALLOWED. The prefix-list ALLOWED permits 10.0.0.0/8 le 24. However, a specific route 10.1.0.0/16 is not being redistributed. What is the root cause?

Accepted Answer

The route-map includes a match flow monitor statement that only matches NetFlow monitored traffic, not routing prefixes, causing the route to be denied.. The prefix-list permits 10.0.0.0/8 le 24, meaning it allows prefixes with a length up to /24. The route 10.1.0.0/16 has a prefix length of /16, which is less than 24, so it should be permitted. However, the issue may be that the route-map also has a match statement for a flow monitor or NetFlow parameters that inadvertently filter the route. Alternatively, the redistribution may be affected by the order of operations: the route-map is applied to redistribution, but if the route-map also references a flow monitor (e.g., match flow monitor), it will not match routes. The correct answer is that the route-map includes a match flow monitor statement that only matches traffic flows, not routes, causing the route to be denied.

Answer

The prefix-list is misconfigured; it should be permit 10.0.0.0/8 le 16 to include /16 prefixes.

Answer

The EIGRP metric is too high, causing the route to be suppressed.

Answer

The OSPF route is not in the routing table due to a missing network statement.

Question 16

An engineer configures IPsec between two routers. The tunnel does not come up. 'show crypto isakmp sa' shows MM_NO_STATE. Which is the most likely explanation?

Accepted Answer

The IKE mode is mismatched: the initiator is using aggressive mode, but the responder expects main mode.. MM_NO_STATE indicates that IKE Phase 1 has not started. In aggressive mode, the initiator sends all IKE parameters in the first packet, and if the responder does not have a matching policy, the exchange fails. However, a common edge case is that the responder is configured for main mode while the initiator is configured for aggressive mode, causing the exchange to fail before any state is established.

Answer

The pre-shared key is mismatched.

Answer

The transform-set is mismatched.

Answer

The access-list for interesting traffic is misconfigured.

Question 17

A DMVPN network uses FlexVPN with BGP as the routing protocol. Spoke routers are configured with Flexible NetFlow to monitor traffic. After a configuration change, spoke-to-spoke tunnels fail to establish. Router R1 (spoke) shows: show dmvpn detail | include (State|Tunnel) State: NHRP, Tunnel: Tunnel0. The BGP neighbor to the hub is up, but no BGP routes are received for the remote spoke's LAN. What is the root cause?

Accepted Answer

The flow exporter's source interface is set to Tunnel0, but the tunnel is not yet established, so BGP updates sourced from Tunnel0 are unreachable.. Flexible NetFlow can be applied to the tunnel interface, but if the flow monitor is configured with a sampler or a flow record that changes the interface behavior, it might interfere with NHRP or BGP. Specifically, if the flow monitor is configured to use a flow record that includes the 'input interface' field and is applied in the input direction, it may cause the router to process packets differently, potentially dropping NHRP packets or BGP updates. However, the most likely issue is that the flow monitor is configured with a match statement that inadvertently matches BGP packets and applies an action (like drop) or that the flow exporter is misconfigured to use the tunnel interface as source, causing BGP updates to be sourced from the tunnel IP, which is not reachable. The correct answer is that the flow exporter's source interface is set to Tunnel0, which is not reachable from the hub until the tunnel is up, creating a chicken-and-egg problem.

Answer

The flow monitor is applied to the tunnel interface in the input direction and uses a flow record that matches on BGP port 179, causing BGP packets to be dropped.

Answer

The BGP neighbor is configured with a password that does not match the hub.

Answer

The NHRP authentication key is missing, preventing spoke-to-spoke communication.

Question 18

An engineer configures Control Plane Policing (CoPP) on a router. After configuration, OSPF neighbors are flapping. Which is the most likely explanation?

Accepted Answer

The class-default is configured with a police action that drops OSPF packets exceeding the rate.. CoPP applies a policy-map to the control plane. If the default class-default is used without an explicit permit for OSPF packets, the implicit deny at the end of the policy-map will drop OSPF packets. The default class-default action is 'drop' if not explicitly configured, but even if a 'police' action is configured, the default behavior is to drop packets that exceed the rate.

Answer

The CoPP policy is applied to the wrong direction (input vs output).

Answer

The access-list used to classify OSPF packets is missing the 'permit' statement for OSPF protocol.

Answer

The CoPP policy uses 'drop' action for OSPF class.

Question 19

An MPLS network uses LDP for label distribution. After enabling Flexible NetFlow on the core routers, some LDP sessions fail to establish. Router R1 shows: show mpls ldp neighbor | include (Peer|State) Peer LDP Ident: 10.0.0.2:0, State: OPERATIONAL. Router R2 shows: show mpls ldp neighbor | include (Peer|State) Peer LDP Ident: 10.0.0.1:0, State: INIT. What is the root cause?

Accepted Answer

The flow monitor is using a sampler that samples only 1 out of 100 packets, causing LDP hello messages to be missed.. Flexible NetFlow can consume CPU resources or change the way packets are processed. In this case, the LDP session is stuck in INIT state, which typically indicates a problem with the transport connection or hello messages. If a flow monitor is applied to the interface used for LDP (e.g., the core-facing interface), it might be using a sampler that samples only a fraction of packets, causing LDP hello messages to be missed. Alternatively, the flow monitor might be configured to use a flow record that includes the 'ipv4 ttl' field, which could cause the router to process LDP packets differently. The correct answer is that a flow sampler is configured on the interface, causing LDP hello packets to be sampled and potentially dropped, preventing the LDP session from moving to OPERATIONAL.

Answer

The LDP router-id is misconfigured, causing a conflict with the flow exporter.

Answer

The MPLS MTU is set too low, causing LDP packets to be fragmented.

Answer

The flow exporter is configured to use TCP port 646, conflicting with LDP.

Question 20

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After configuration, legitimate traffic from a directly connected network is being dropped. Which is the most likely explanation?

Accepted Answer

Asymmetric routing is causing the return path to use a different interface.. Strict uRPF checks that the source IP address of incoming packets has a route in the routing table that points back to the same interface. If there is asymmetric routing where the return path uses a different interface, strict uRPF will drop the traffic. This is a common edge case in networks with multiple paths.

Answer

The 'allow-default' option is not configured, and a default route exists.

Answer

The interface is configured with an IP address that is not in the routing table.

Answer

The routing table has a more specific route for the source network via a different interface.