300-410 Mock Exam 84 — 25 Questions

Question 1

Management traffic is being dropped. Router R1 has: access-list 100 deny ip any any log, applied to VTY lines. Remote access via SSH fails, but console works. What is the root cause?

Accepted Answer

The ACL should permit SSH before the deny statement.. The ACL `access-list 100 deny ip any any log` applied to VTY lines denies all IP traffic, including SSH, before any permit statement can match. Since SSH traffic is denied, remote access fails. The correct fix is to add a `permit tcp any any eq 22` statement before the deny to allow SSH management traffic.

Answer

The VTY lines require transport input ssh, but the ACL is irrelevant.

Answer

The ACL is applied to the wrong interface.

Answer

The log keyword causes performance issues, not drops.

Question 2

In Cisco IOS, what is the default behavior of the ip nat service command?

Accepted Answer

It is used to configure NAT for specific application-layer protocols and is not enabled by default.. The `ip nat service` command in Cisco IOS is used to enable NAT for specific application-layer protocols (e.g., SIP, H.323, DNS) that embed IP addresses in their payloads, requiring the NAT router to perform deep packet inspection. By default, this command is not enabled; NAT only translates the IP header for TCP and UDP traffic without application-layer awareness. Option C correctly identifies that the command is not enabled by default and is used for specific protocol configuration.

Answer

It disables NAT for all protocols by default.

Answer

It enables NAT only for TCP and UDP by default.

Answer

It configures the NAT translation timeout for all services.

Question 3

In BGP, what is the default value of the keepalive timer?

Accepted Answer

60 seconds. In BGP, the default keepalive timer is 60 seconds, as specified in RFC 4271. This timer determines how often a BGP speaker sends Keepalive messages to its peer to maintain the session. The hold timer, which is three times the keepalive interval (default 180 seconds), triggers session teardown if no Keepalive or update is received within that period.

Answer

30 seconds

Answer

90 seconds

Answer

180 seconds

Question 4

A network engineer is troubleshooting an OSPFv3 adjacency issue between two routers over an IPv6-only link. The engineer configures OSPFv3 on both routers and sees that the adjacency is stuck in EXSTART state. 'debug ipv6 ospf packet' shows that the routers are exchanging DBD packets but not progressing. What is the most likely cause?

Accepted Answer

The OSPFv3 interface MTU is mismatched between the two routers.. The EXSTART state indicates that the routers are trying to establish the master/slave relationship and exchange DBD packets. If they are stuck, it is often due to a mismatch in the OSPF MTU or the interface MTU. If the MTU is mismatched, the DBD packets may be too large to be sent, causing the routers to keep retransmitting. Another cause could be a mismatch in the OSPF network type, but that usually causes issues earlier. The most likely cause is an MTU mismatch.

Answer

The routers have different OSPFv3 router IDs.

Answer

The OSPFv3 process is configured with 'ipv6 ospf 1 area 0' on the interface, but the interface is not IPv6-enabled.

Answer

The link is a point-to-point link, but the OSPF network type is set to broadcast.

Question 5

A network engineer is troubleshooting a router that is not allowing SSH connections from any management station. The router has 'ip domain-name example.com' and 'crypto key generate rsa' configured. 'line vty 0 4' has 'transport input ssh' and 'login local'. The engineer can ping the router from a management station. What is the most likely cause?

Accepted Answer

The RSA key was generated with a modulus less than 768 bits, causing SSH to fail.. The most likely cause is that the RSA key was generated with a modulus less than 768 bits. Cisco IOS requires an RSA key modulus of at least 768 bits for SSH to function; if the modulus is smaller (e.g., 512 bits), SSH will fail to start even though the key is generated successfully. The presence of 'ip domain-name', 'crypto key generate rsa', 'transport input ssh', and 'login local' on the VTY lines, combined with successful ping reachability, points to an SSH-specific configuration issue rather than connectivity or authentication problems.

Answer

The VTY lines are missing the 'login local' command.

Answer

The router has 'ip ssh version 1' configured, and the client only supports SSHv2.

Answer

The management station is using the wrong username or password.

Question 6

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

Accepted Answer

The SPAN session is configured to monitor only ingress traffic by default.. By default, SPAN monitors only ingress traffic on the source VLAN. To capture both directions, the command must specify 'both' for the source. The default is 'rx' only.

Answer

The destination port is in a different VLAN than the source VLAN.

Answer

The switch does not support SPAN on VLANs.

Answer

The laptop is not configured to accept tagged traffic.

Question 7

Consider the following configuration on router R2:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 3600
!
crypto isakmp key secretkey address 192.168.1.1
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.2 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Which statement is true?

Accepted Answer

The IKE phase 1 will fail due to ISAKMP lifetime mismatch.. The ISAKMP lifetime configured on R2 is 3600 seconds (1 hour), but the question implies the remote peer (192.168.1.1) has a different lifetime (likely the default of 86400 seconds). During IKE phase 1 negotiation, the peers propose their lifetimes, and if they do not match, the session fails because Cisco IOS requires identical lifetime values for successful phase 1 establishment. This mismatch causes the IKE phase 1 to fail, preventing the IPsec tunnel from forming.

Answer

The IPsec tunnel will establish successfully because the transform sets match.

Answer

The tunnel will work but will rekey every hour due to the shorter lifetime.

Answer

The pre-shared key mismatch will cause the tunnel to fail.

Question 8

What is the default value of the 'reachable time' in IPv6 Neighbor Discovery (ND) on Cisco IOS-XE?

Accepted Answer

0 milliseconds (unspecified). In IPv6 Neighbor Discovery (ND) on Cisco IOS-XE, the default value for the 'reachable time' is 0 milliseconds (unspecified). This means the router does not advertise a specific reachable time in its Router Advertisements (RAs), leaving the receiving hosts to use their own default value (typically 30,000 milliseconds as per RFC 4861). The 'reachable time' is the duration a node considers a neighbor reachable after confirming reachability via Neighbor Solicitation (NS) or Neighbor Advertisement (NA) messages.

Answer

30,000 milliseconds

Answer

60,000 milliseconds

Answer

10,000 milliseconds

Question 9

A DMVPN network uses FlexVPN with BGP as the routing protocol. Spoke routers are configured with Flexible NetFlow to monitor traffic. After a configuration change, spoke-to-spoke tunnels fail to establish. Router R1 (spoke) shows: show dmvpn detail | include (State|Tunnel) State: NHRP, Tunnel: Tunnel0. The BGP neighbor to the hub is up, but no BGP routes are received for the remote spoke's LAN. What is the root cause?

Accepted Answer

The flow exporter's source interface is set to Tunnel0, but the tunnel is not yet established, so BGP updates sourced from Tunnel0 are unreachable.. Flexible NetFlow can be applied to the tunnel interface, but if the flow monitor is configured with a sampler or a flow record that changes the interface behavior, it might interfere with NHRP or BGP. Specifically, if the flow monitor is configured to use a flow record that includes the 'input interface' field and is applied in the input direction, it may cause the router to process packets differently, potentially dropping NHRP packets or BGP updates. However, the most likely issue is that the flow monitor is configured with a match statement that inadvertently matches BGP packets and applies an action (like drop) or that the flow exporter is misconfigured to use the tunnel interface as source, causing BGP updates to be sourced from the tunnel IP, which is not reachable. The correct answer is that the flow exporter's source interface is set to Tunnel0, which is not reachable from the hub until the tunnel is up, creating a chicken-and-egg problem.

Answer

The flow monitor is applied to the tunnel interface in the input direction and uses a flow record that matches on BGP port 179, causing BGP packets to be dropped.

Answer

The BGP neighbor is configured with a password that does not match the hub.

Answer

The NHRP authentication key is missing, preventing spoke-to-spoke communication.

Question 10

Which CoPP mechanism prevents the CPU from being overwhelmed by control plane traffic?

Accepted Answer

Policing. CoPP uses a policer (typically a single-rate two-color or three-color marker) to rate-limit traffic destined to the control plane, dropping packets that exceed the configured rate.

Answer

Shaping

Answer

Queuing

Answer

Compression

Question 11

A network engineer runs the following command on Router R1:

R1# show route-map TEST
route-map TEST, permit, sequence 10
  Match clauses:
    ip address (access-lists): 10
  Set clauses:
    metric 50
route-map TEST, deny, sequence 20
  Match clauses:
    ip address (access-lists): 20
  Set clauses:

Based on this output, what is the effect of this route-map when applied to a redistribution command?

Accepted Answer

Routes matching ACL 10 are redistributed with metric 50; routes matching ACL 20 are denied; all other routes are also denied.. Route-map TEST processes sequences in order. Sequence 10 permits routes matching ACL 10 and sets their metric to 50. Sequence 20 denies routes matching ACL 20. Since there is no explicit permit for other routes, the implicit deny at the end of the route-map denies all unmatched routes. Thus, only routes matching ACL 10 are redistributed with metric 50.

Answer

All routes are redistributed with metric 50.

Answer

Routes matching ACL 20 are redistributed with default metric.

Answer

The route-map has no effect because set clauses are missing in sequence 20.

Question 12

What is the default metric for an IPv6 static route redistributed into OSPFv3?

Accepted Answer

20. When an IPv6 static route is redistributed into OSPFv3, OSPFv3 assigns a default metric of 20 to external routes (type E1 or E2). This is consistent with OSPFv2 behavior, where redistributed routes (including static routes) receive a default metric of 20 unless explicitly overridden with the `metric` keyword under the `redistribute` command. Option C is correct because the default metric for redistributed static routes in OSPFv3 is 20.

Answer

0

Answer

1

Answer

10

Question 13

snmp-server group MyGroup v3 priv
snmp-server user MyUser MyGroup v3 auth sha MyPassword priv aes 128 MyPrivKey

What is missing from this SNMPv3 configuration?

Accepted Answer

The group is missing a view definition to allow access to MIB objects.. The configuration creates an SNMPv3 group 'MyGroup' with priv security level and a user 'MyUser' with SHA authentication and AES 128 privacy, but it does not include a view definition for the group. Without a view (e.g., via the 'snmp-server group MyGroup v3 priv view MyView' command or a default view), the group has no access to any MIB objects, rendering the SNMPv3 configuration non-functional for queries or notifications.

Answer

The authentication protocol should be MD5 instead of SHA.

Answer

The privacy password must be at least 16 characters long.

Answer

The user must be configured under a different group name.

Question 14

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up but traffic from the remote LAN to the local LAN is not working. The engineer pings from the remote router to the local LAN IP and it succeeds. However, pings from a host on the remote LAN to a host on the local LAN fail. What is the most likely cause?

Accepted Answer

The local router does not have a route to the remote LAN subnet in its routing table.. The symptom indicates that the VPN tunnel is working for traffic sourced from the router itself, but not for traffic from the remote LAN. This is typically caused by a missing route on the local router for the remote LAN subnet, or a missing route on the remote router for the local LAN subnet, preventing the return traffic from being routed correctly.

Answer

The crypto map access list on the remote router does not include the remote LAN subnet.

Answer

The IPsec transform set is missing the esp-sha-hmac authentication.

Answer

The pre-shared key is mismatched between the two routers.

Question 15

Router R1 is configured with ip nat inside source list 100 interface GigabitEthernet0/1 overload. Internal host 192.168.1.10 can access the internet, but when it tries to connect to an internal server at 10.1.1.10 via its public IP 203.0.113.10, the connection fails. Router R1 shows: show ip nat translations: Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 10.1.1.10 --- ---. The host's traffic is being NATed to 203.0.113.1, but the server's response is sent to 203.0.113.1. What is the root cause?

Accepted Answer

Enable NAT hairpinning by configuring ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 80 and ensuring the router has a route to the public IP.. The root cause is that NAT hairpinning (also known as NAT reflection or NAT loopback) is not enabled. When an internal host (192.168.1.10) tries to reach an internal server (10.1.1.10) using the server's public IP (203.0.113.10), the router performs NAT for the host's traffic, translating its source to 203.0.113.1. The server's response is sent to 203.0.113.1 (the router's outside interface), but without hairpinning, the router does not know to forward this response back to the internal host because it expects the traffic to come from the outside. Option A corrects this by adding a static NAT for the server (mapping 10.1.1.10:80 to 203.0.113.10:80) and ensuring the router has a route to the public IP, which enables the router to perform the necessary NAT translation and forward the response back to the internal host.

Answer

Configure the host to use the private IP of the server instead of the public IP.

Answer

Add a static route on the router for 203.0.113.10 pointing to the server.

Answer

Use ip nat outside source list 100 interface GigabitEthernet0/1 overload.

Question 16

A network engineer runs the following command to verify IPv6 device tracking:

R1# show ipv6 device-tracking database

Interface  MAC Address       VLAN  IPv6 Address                    State         Age  Policy
  Fa0/0      0011.2233.4455   10    2001:db8::1                     ACTIVE        10   TRUSTED
  Fa0/0      00aa.bbcc.ddee   10    2001:db8::2                     ACTIVE        5    INSPECT
  Fa0/0      1111.2222.3333   10    2001:db8::3                     VERIFY        0    -

What does this output indicate?

Accepted Answer

Device tracking shows two devices in ACTIVE state and one in VERIFY state, indicating ongoing ND verification for the third device.. The output shows three entries: two in ACTIVE state (indicating successful ND verification) and one in VERIFY state (meaning the device is currently undergoing Neighbor Discovery verification). The VERIFY state with age 0 indicates that the device has been recently discovered and is being validated before transitioning to ACTIVE. This confirms that device tracking is actively monitoring IPv6 devices, with ongoing ND verification for the third device.

Answer

All devices are in ACTIVE state, indicating stable tracking.

Answer

Device tracking is disabled, and the database is empty.

Answer

Device tracking only tracks IPv4 addresses.

Question 17

A network engineer configures CoPP on a router to limit ICMP traffic to 5000 bps. After the policy is applied, the engineer notices that the router is not responding to ping requests from a remote network. However, the router can ping other devices successfully. The engineer checks the CoPP statistics and sees that the ICMP class has dropped packets. What is the most likely root cause?

Accepted Answer

The CoPP policy is dropping incoming ICMP echo requests because the police rate is too low.. The CoPP policy is applied to control plane traffic, which includes ICMP echo requests destined to the router itself. When the police rate is set to 5000 bps, incoming ICMP echo requests are rate-limited and dropped if they exceed this threshold, causing the router to stop responding to pings. The fact that the router can still ping other devices confirms that the data plane is unaffected, isolating the issue to control plane policing of inbound ICMP.

Answer

The CoPP policy is dropping outgoing ICMP echo replies because the police rate applies to both directions.

Answer

The router's interface ACL is blocking incoming ICMP traffic.

Answer

The router's ICMP rate-limit feature is enabled globally.

Question 18

An engineer configures EIGRP named mode with an offset-list that increases the metric of a route on Router A. The route is still selected as the best path on Router A's neighbor, Router B, because Router B learns the same prefix via another EIGRP neighbor with a higher metric. Which is the most likely explanation?

Accepted Answer

The offset-list only affects the feasible distance (FD) on Router A; the advertised distance (AD) sent to Router B remains unchanged.. The offset-list in EIGRP affects the composite metric (FD) of the route on the router where it is applied. However, the advertised distance (AD) sent to neighbors is not modified. Router B still sees the original AD from Router A and compares it with metrics from other neighbors.

Answer

The offset-list modifies the advertised distance (AD) sent to neighbors, but Router B ignores it.

Answer

The offset-list is applied to the wrong interface; it must be applied to the outgoing interface towards Router B.

Answer

EIGRP named mode does not support offset-list; only classic mode supports it.

Question 19

Router R4 has the following configuration:

!--- R4 configuration
route-map SETTAG permit 10
 match tag 100
 set tag 200
!
route-map SETTAG permit 20
!
router bgp 65100
 neighbor 10.0.0.1 route-map SETTAG in
!

What is the effect of this configuration?

Accepted Answer

All routes from neighbor 10.0.0.1 are permitted; routes with tag 100 have their tag changed to 200.. The route-map SETTAG has two permit sequences. Sequence 10 matches routes with tag 100 and sets the tag to 200. Sequence 20 is a catch-all permit with no match or set statements. Routes from neighbor 10.0.0.1 that have tag 100 will have their tag changed to 200; all other routes are permitted unchanged. No routes are filtered.

Answer

Routes with tag 100 are denied; all other routes are permitted.

Answer

Only routes with tag 100 are permitted; all other routes are denied.

Answer

The route-map is misconfigured because sequence 20 has no match statement; it should have a match any statement.

Question 20

Drag and drop the steps to verify and validate the operational state of Control Plane Policing (CoPP) into the correct order, from first to last.

Accepted Answer

Verify CoPP policy is applied to the control-plane. Verification starts with confirming the policy is applied globally, then checking per-class statistics for drops, using show commands to examine packet counters, testing reachability to the control plane, and finally reviewing logs for any CoPP-related messages. This ensures the policy is working as intended.