300-410 Mock Exam 85 — 25 Questions

Question 1

Which statement correctly describes the behavior of ISATAP tunneling regarding host configuration?

Accepted Answer

ISATAP embeds the IPv4 address into the interface identifier (last 64 bits) of the IPv6 address.. ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) automatically generates the IPv6 address by embedding the host's IPv4 address into the interface identifier (the last 64 bits of the IPv6 address). This allows hosts to obtain a complete IPv6 address without manual configuration of the full 128-bit address, as the IPv4 address is used to form the unique interface ID. Option C correctly describes this behavior.

Answer

ISATAP requires manual configuration of the entire IPv6 address on each host.

Answer

ISATAP uses the prefix 2002::/16 for global addresses.

Answer

ISATAP is only used for site-to-site tunnels.

Question 2

An engineer configures NAT overload on a router. The inside network uses 172.16.0.0/16, and the outside interface is 198.51.100.1. The engineer uses 'ip nat inside source list 1 interface GigabitEthernet0/0 overload'. ACL 1 permits 172.16.0.0 0.0.255.255. Traffic works, but the engineer notices that the router's CPU utilization is high, and 'show ip nat translations' shows thousands of entries. What is the most likely cause?

Accepted Answer

The NAT translation timeout is set too high, causing old entries to remain.. The high CPU utilization and thousands of NAT translations indicate that the router is maintaining an excessive number of translation entries. The default NAT timeout for TCP is 86400 seconds (24 hours) and for UDP is 300 seconds. If the timeout is set too high, old entries are not cleared promptly, causing the translation table to grow large and consuming CPU resources for lookups and maintenance. This is the most likely cause given the symptoms.

Answer

The router is under a DDoS attack generating many NAT translations.

Answer

The ACL is too permissive, allowing traffic from outside to initiate NAT.

Answer

The outside interface is using a different IP than configured.

Question 3

Which DHCPv4 option is used by a client to request a specific IP address in the DHCPREQUEST message?

Accepted Answer

Option 50 (Requested IP Address). DHCPv4 Option 50 (Requested IP Address) is specifically used by a client in the DHCPREQUEST message to request a previously offered IP address or to attempt to renew a specific address. This option allows the client to indicate which IP address it wants to use, ensuring the server can confirm or deny the request based on availability and policy.

Answer

Option 12 (Host Name)

Answer

Option 54 (Server Identifier)

Answer

Option 51 (IP Address Lease Time)

Question 4

What is the default number of packets sent per IP SLA UDP Jitter operation?

Accepted Answer

10. The default number of packets per UDP Jitter operation is 10. This is the number of UDP packets sent in each probe interval to measure jitter and packet loss.

Answer

1

Answer

20

Answer

100

Question 5

A network engineer runs the following command on Router R1:

R1# show ipv6 nd raguard policy
Interface                      Policy                      Role            State
Gi0/0/0                        RA_GUARD                    router          ACTIVE
Gi0/0/1                        RA_GUARD                    host            ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/0 is allowed to send Router Advertisements.. The 'show ipv6 nd raguard policy' output shows that interface Gi0/0/0 is configured with the RA_GUARD policy in the 'router' role and is ACTIVE. In IPv6 RA Guard, a port in the 'router' role is explicitly permitted to send Router Advertisements (RAs), while ports in the 'host' role are blocked from sending RAs. Therefore, only Gi0/0/0 is allowed to send RAs, making option A correct.

Answer

Interface Gi0/0/1 is allowed to send Router Advertisements.

Answer

Interface Gi0/0/2 is allowed to send Router Advertisements.

Answer

All interfaces are blocked from sending Router Advertisements.

Question 6

A network engineer runs the following command to troubleshoot DHCPv6 guard:

R1# debug ipv6 dhcp guard

*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3, client DUID 00010001abcd1234
*Mar  1 00:03:45.678: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 SOLICIT from fe80::3 is allowed by policy DHCP-POLICY
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4, server DUID 0001000156789012
*Mar  1 00:03:46.901: IPv6-DHCP-Guard: R1, Fa0/0, DHCPv6 ADVERTISE from fe80::4 is blocked by policy DHCP-POLICY

What does this output indicate?

Accepted Answer

DHCPv6 guard is allowing client messages but blocking server messages from untrusted sources, preventing rogue DHCPv6 servers.. The debug output shows that DHCPv6 SOLICIT messages from client fe80::3 are allowed by policy DHCP-POLICY, while DHCPv6 ADVERTISE messages from server fe80::4 are blocked by the same policy. This is the expected behavior of DHCPv6 guard: it permits client messages (SOLICIT, REQUEST, etc.) to reach potential servers, but it blocks server messages (ADVERTISE, REPLY, etc.) from untrusted ports to prevent rogue DHCPv6 servers from assigning malicious configurations. Option A correctly identifies this selective filtering.

Answer

DHCPv6 guard is blocking all DHCPv6 messages, indicating a misconfiguration.

Answer

DHCPv6 guard is allowing all messages but logging them for analysis.

Answer

DHCPv6 guard is not configured; the debug output is from default DHCPv6 behavior.

Question 7

A network engineer runs the following command to verify NAT on an interface:

R1# show ip nat interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  NAT: inside, active
  NAT: outside, active
  NAT: overload, active

What is the issue with this configuration?

Accepted Answer

The interface is configured as both inside and outside, which is invalid.. The command output shows that GigabitEthernet0/1 is configured as both 'inside' and 'active' and 'outside' and 'active' simultaneously. In Cisco IOS NAT, an interface can be either a NAT inside interface or a NAT outside interface, but not both. This misconfiguration causes ambiguous NAT behavior because the router cannot determine whether traffic entering or leaving the interface should be translated from inside to outside or vice versa, leading to translation failures.

Answer

The interface is correctly configured for NAT.

Answer

The interface is down.

Answer

Overload is not active.

Question 8

Drag and drop the steps to verify and validate Device Access Control operational state into the correct order, from first to last.

Accepted Answer

Check AAA server reachability. First, check the AAA server reachability to ensure the backend is accessible. Then verify the active authentication method list applied globally. Next, confirm the authorization method list for exec or commands. After that, validate the accounting configuration to track access. Finally, test the actual access control by attempting a remote login.

Question 9

Drag and drop the steps to troubleshoot Device Management adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Ping the management IP address from the management station. Troubleshooting starts with checking basic IP connectivity, then verifying the management protocol (e.g., NETCONF/RESTCONF) status, ensuring the correct port is open, checking AAA/authorization, and finally reviewing logs for errors.

Question 10

A network engineer runs the following command to troubleshoot a Flexible NetFlow issue:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
  Cache size:                                 1000
  Current entries:                              25
  High Watermark:                               50

Flows added:                                1234
  Flows aged:                                 1209
  - Active timeout (  1800 secs):             100
  - Inactive timeout (   15 secs):           1100
  - Event aged:                                 9
  - Watermark aged:                             0
  - Emergency aged:                            0

What does the output indicate?

Accepted Answer

The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.. The output shows the current state of the Flexible NetFlow cache. The high number of flows aged due to inactive timeout (1100 out of 1209) indicates that most flows are short-lived. The cache is not full (25 out of 1000 entries used), and no watermark or emergency aging has occurred. This is normal for traffic with many brief connections.

Answer

The cache is experiencing watermark aging, indicating memory pressure.

Answer

Most flows are being aged due to the active timeout, suggesting long-lived flows.

Answer

Emergency aging is occurring, which means the cache is full.

Question 11

A network engineer is troubleshooting a BGP route advertisement issue. Router R1 (AS 65001) has an eBGP session with R2 (AS 65002). R1 is advertising the prefix 192.168.1.0/24 to R2. On R2, the route appears in the BGP table but is not installed in the routing table. The output of 'show ip bgp 192.168.1.0/24' on R2 shows the route as valid, best, but with the 'r' flag (RIB-failure). The routing table on R2 shows a static route for 192.168.1.0/24 with administrative distance 1. What is the most likely cause?

Accepted Answer

The BGP route is not installed because a static route with a lower administrative distance exists for the same prefix.. RIB-failure occurs when BGP tries to install a route but a route with a lower administrative distance already exists. Here, the static route (AD 1) is preferred over the eBGP route (AD 20).

Answer

The BGP route is not installed because the next-hop is unreachable.

Answer

The BGP route is not installed because BGP synchronization is enabled.

Answer

The BGP route is not installed because the prefix length is too long.

Question 12

Which TWO statements about SNMPv3 engine ID configuration are true? (Choose TWO.)

Accepted Answer

If the engine ID is changed, all existing SNMPv3 users must be reconfigured.. The SNMPv3 engine ID is a key component in generating the authentication and encryption keys for each user. If the engine ID changes, the keys derived from it become invalid, requiring all existing SNMPv3 users to be reconfigured with new passwords or keys to re-establish secure communication.

Answer

The engine ID must be manually configured for SNMPv3 to function.

Answer

The engine ID can be up to 64 octets in length.

Answer

The engine ID is automatically generated based on the router's serial number.

Question 13

An engineer configures EIGRP named mode on two routers. The engineer notices that route summarization configured under the interface does not generate a summary route in the routing table, even though the component routes are present. The engineer confirms that the summary address is correct and the interface is up. Which is the most likely explanation?

Accepted Answer

The interface is not configured under the EIGRP address-family in named mode. In EIGRP named mode, route summarization is configured under the interface configuration mode using the 'summary-address' command, but it requires that the interface is part of the EIGRP address-family under that named mode. If the interface is not explicitly configured under the address-family, the summary-address command is accepted but does not take effect. This is a common edge case because the CLI accepts the command without error, but the summary is not generated.

Answer

The summary-address command must be configured under the EIGRP process, not the interface

Answer

The component routes have a higher administrative distance than the summary

Answer

The summary-address command requires the 'leak-map' option to be specified

Question 14

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_RED and VRF_BLUE) configured with OSPF as the routing protocol. The engineer notices that OSPF neighborships are not forming between routers in VRF_RED. The 'show ip ospf neighbor' command shows no neighbors. What is the most likely cause?

Accepted Answer

The OSPF process is not configured with the 'vrf VRF_RED' command.. OSPF neighborships in VRF-Lite require that the OSPF process is associated with the correct VRF and that interfaces are placed in the correct VRF. Missing VRF association in the OSPF process or incorrect interface VRF assignment are common issues.

Answer

The OSPF process ID is not unique across VRFs.

Answer

The interfaces in VRF_RED are missing the 'ip ospf network point-to-point' command.

Answer

The 'router-id' command is missing in the OSPF process.

Question 15

A network engineer is troubleshooting a VRF-Lite setup where two customer VRFs (VRF_A and VRF_B) are configured on a router. The engineer notices that routes from VRF_A are appearing in the routing table of VRF_B, causing traffic misdirection. The router is running IOS-XE 17.3. What is the most likely cause of this issue?

Accepted Answer

The 'route-target import' and 'route-target export' commands are misconfigured, causing VRF_A routes to be imported into VRF_B.. The issue is caused by route leaking between VRFs, which can occur if VRF route import/export configurations are misapplied or if routes are accidentally redistributed between VRFs. In VRF-Lite, VRFs are isolated by default, and any cross-VRF route sharing must be explicitly configured.

Answer

The router has 'ip routing' disabled globally.

Answer

The 'ip vrf forwarding' command is missing on the interfaces.

Answer

The router is running OSPF with the same process ID in both VRFs.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---
--- 192.0.2.12         10.0.0.12          ---                ---

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 45  Misses: 0
CEF Translated packets: 45, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 3
   map-id 1
   overload
   [Id] ip nat inside source list ACL1 pool POOL1 overload
   refcount 3

Based on this output, which statement is correct?

Accepted Answer

PAT is working correctly; translations are dynamic and overload is enabled.. The output shows three dynamic translations from the inside local addresses (10.0.0.10–12) to inside global addresses (192.0.2.10–12) using the pool POOL1 (192.0.2.10–20). The 'overload' keyword in the NAT configuration enables Port Address Translation (PAT), allowing multiple inside hosts to share a single global IP by using unique port numbers. The 'refcount 3' and the presence of three active translations confirm that PAT is working correctly.

Answer

NAT is failing because the pool is exhausted.

Answer

Static NAT is configured, but dynamic NAT is not working.

Answer

The inside and outside interfaces are reversed.

Question 17

Which loop prevention mechanism is used by default when redistributing between two OSPF processes?

Accepted Answer

Route tagging with default tag 0. When redistributing between OSPF processes, Cisco IOS uses route tagging (tag field in the OSPF external LSA) to prevent loops, but the default tag value is 0 unless explicitly set.

Answer

Split horizon

Answer

Poison reverse

Answer

Hold-down timers

Question 18

An engineer is troubleshooting an IPv6 manual tunnel between two routers that are not directly connected (the tunnel endpoints are separated by an IPv4 network). The tunnel is up, but the engineer notices that the tunnel interface flaps every few minutes. The show interfaces tunnel output shows input errors and CRC errors. What is the most likely cause?

Accepted Answer

The IPv4 path between the tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (IP header), causing fragmentation and packet loss.. The tunnel interface shows input errors and CRC errors, which are classic signs of fragmentation and reassembly issues. When the IPv4 path between tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (the IPv4 header), packets exceeding the path MTU are fragmented. Fragmentation increases the risk of packet loss and CRC errors, causing the tunnel to flap as the interface resets or routing reconverges.

Answer

The tunnel keepalive is set too low, causing the tunnel to go down when a keepalive is lost.

Answer

The tunnel source interface is a loopback that is not reachable from the remote router.

Answer

The tunnel is using GRE encapsulation, but the remote router is configured for ipv6ip.

Question 19

In a DMVPN Phase 2 network with EIGRP, R1 (hub) and R2 (spoke) are configured. R2's tunnel interface has 'ip nhrp redirect' enabled. R3 (another spoke) can ping R2's tunnel IP, but when R3 tries to reach a subnet behind R2, traffic is forwarded to R1 instead of directly to R2. What is the root cause?

Accepted Answer

R1 (hub) does not have 'ip nhrp redirect' enabled on its tunnel interface, so it does not send redirect messages to R3, preventing direct spoke-to-spoke tunnel establishment.. In DMVPN Phase 2, spoke-to-spoke tunnels are established using NHRP redirect. However, if the hub does not have 'ip nhrp redirect' enabled, it will not send redirect messages to spokes. Without redirect, spokes will not learn the direct path to other spokes and will forward traffic through the hub.

Answer

R2 has 'ip nhrp shortcut' disabled, preventing direct tunnel establishment.

Answer

R3 has a static route pointing to R1 for the subnet behind R2.

Answer

EIGRP is not redistributing the subnet behind R2 to R3.

Question 20

A network engineer notices that BGP sessions between two directly connected routers are flapping every few minutes. The routers are running IOS-XE 17.3 and have CoPP enabled. The engineer checks the CoPP policy and sees a class-map matching BGP packets with a police rate of 8000 bps. The BGP session uses MD5 authentication and the routers exchange a full BGP table with 500,000 prefixes. What is the most likely cause of the BGP session flapping?

Accepted Answer

The CoPP police rate of 8000 bps is too low for the BGP keepalive and update traffic, causing packet drops.. The CoPP police rate of 8000 bps is insufficient for the BGP traffic generated by exchanging a full BGP table of 500,000 prefixes. BGP updates for such a large table can easily exceed 8000 bps, especially when combined with keepalive messages. When the police rate is exceeded, CoPP drops BGP packets, causing the session to flap as the hold timer expires due to missing keepalives or updates.

Answer

The BGP MD5 authentication is causing excessive CPU utilization, triggering CoPP drops.

Answer

The CoPP class-map is not matching BGP packets correctly because it uses a wrong access-list.

Answer

The BGP hold timer is set too low, causing the session to reset before CoPP drops are noticed.