300-410 Mock Exam 86 — 25 Questions

Question 1

Consider the following partial configuration on a Cisco IOS-XE router:
```
router eigrp 100
 network 10.0.0.0
 distance eigrp 90 170
```
What is the effect of the `distance eigrp 90 170` command?

Accepted Answer

It sets the administrative distance for EIGRP internal routes to 90 and external routes to 170.. This command sets the administrative distance for EIGRP internal routes to 90 and external routes to 170.

Answer

It sets the administrative distance for all EIGRP routes to 90.

Answer

It sets the administrative distance for EIGRP routes to 170 for all routes learned from neighbors with an AS of 100.

Answer

It sets the metric weights for EIGRP to 90 and 170.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0                  13   00:12:34  1      200  0  45
1   10.2.2.2                Gi0/1                  12   00:11:20  2      200  0  67
2   10.3.3.2                Gi0/2                  10   00:10:15  1      200  0  89

Based on this output, which statement is correct?

Accepted Answer

All EIGRP neighbors are fully operational with no issues.. The output shows all three EIGRP neighbors with hold timers above 0, low SRTT values (1-2 ms), RTO at 200 ms, and a Q count of 0, indicating no queued packets. These metrics confirm that the neighbors are fully operational and stable, with no packet loss, congestion, or routing issues.

Answer

The neighbor on Gi0/2 is experiencing packet loss because its hold timer is 10 seconds.

Answer

The neighbor on Gi0/0 has a high SRTT, indicating congestion.

Answer

The neighbor on Gi0/1 has a sequence number of 67, which is higher than others, indicating a routing loop.

Question 3

Which THREE symptoms indicate a problem with route redistribution causing suboptimal routing or routing loops? (Choose THREE.)

Accepted Answer

Routing loops occur where packets traverse multiple routers repeatedly.. Route redistribution issues often manifest as routing loops, suboptimal paths, or missing routes. A routing loop (option A) occurs when redistributed routes are re-injected back into the source protocol. Suboptimal routing (option B) happens when a router prefers a redistributed route over a more direct one. Missing routes (option D) can occur if redistribution is not configured or if filters block routes. Option C is incorrect because high CPU may indicate many things, not specifically redistribution. Option E is incorrect because a stable routing table does not indicate a problem.

Answer

CPU utilization on the redistribution router is consistently below 50%.

Answer

The routing table on all routers is stable and converges quickly after a topology change.

Question 4

A network engineer is troubleshooting a BGP route reachability issue. R1 learns the prefix 10.1.1.0/24 via eBGP from R2 with an AD of 20, and via OSPF from R3 with an AD of 110. The engineer notices that R1 installs the OSPF route in the routing table instead of the eBGP route, even though the eBGP route is preferred by default. What is the most likely cause of this behavior?

Accepted Answer

The distance bgp 20 200 200 command is configured under the BGP process, increasing the AD of eBGP routes to 200.. The default administrative distance for eBGP is 20, and for OSPF is 110, so eBGP should be preferred. However, if the distance command is applied to the eBGP neighbor or the BGP process, it can increase the AD of eBGP routes, making them less preferred than OSPF.

Answer

The OSPF route has a lower metric than the eBGP route.

Answer

The OSPF route is an inter-area route, which has a lower AD than intra-area routes.

Answer

The eBGP route is not the best path because the next-hop is unreachable.

Question 5

A network engineer runs the following command to troubleshoot an IPv6 First Hop Security issue:

R1# debug ipv6 nd raguard

*Mar  1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::1, dst ff02::1
*Mar  1 00:01:23.456: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::1 is allowed by policy TRUSTED
*Mar  1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA received on port Fa0/0, src fe80::2, dst ff02::1
*Mar  1 00:01:24.789: IPv6-ND-RA-Guard: R1, Fa0/0, RA from fe80::2 is blocked by policy UNTRUSTED

What does this output indicate?

Accepted Answer

RA Guard is configured with a policy that trusts fe80::1 and blocks fe80::2, preventing rogue RA attacks.. The debug output shows that RA Guard is actively filtering Router Advertisement (RA) messages on interface Fa0/0. The first RA from fe80::1 is explicitly allowed by a policy named TRUSTED, while the second RA from fe80::2 is blocked by a policy named UNTRUSTED. This confirms that RA Guard is correctly configured to permit only authorized routers (fe80::1) and block potential rogue RA sources (fe80::2), preventing RA-based attacks in an IPv6 First Hop Security deployment.

Answer

RA Guard is blocking all RAs regardless of source, indicating a misconfiguration.

Answer

RA Guard is allowing all RAs but logging them for analysis.

Answer

RA Guard is not configured; the debug output is from default IPv6 ND behavior.

Question 6

An engineer configures IPv6 uRPF loose mode on an interface that connects to a DMVPN spoke. The spoke router uses NHRP to register with the hub and establishes a tunnel. Traffic from the spoke to destinations behind the hub is dropped. Which is the most likely explanation?

Accepted Answer

The spoke's tunnel IPv6 address is not in the global routing table because it is only known via NHRP, causing uRPF loose mode to drop packets sourced from that address.. In IPv6 uRPF loose mode, the router checks that the source address of an incoming packet is present in the routing table (any route, not necessarily via the incoming interface). On a DMVPN spoke, the tunnel IPv6 address is typically learned only via NHRP and is not installed in the global IPv6 routing table. Therefore, when the spoke sends traffic sourced from its tunnel address, uRPF loose mode drops the packet because the source address is not found in the routing table.

Answer

The hub has uRPF strict mode configured, which breaks the DMVPN tunnel because of asymmetric routing.

Answer

The spoke's NHRP registration packets are filtered by the uRPF check because they use multicast destination.

Answer

The tunnel interface has an IPv6 ACL that denies traffic from the spoke's tunnel address, overriding uRPF.

Question 7

Which TWO statements about NAT overload (PAT) are true? (Choose TWO.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. A is correct because PAT (Port Address Translation) allows multiple internal hosts to share a single public IP address by assigning unique source port numbers to each session. This multiplexing technique enables many concurrent connections from different inside hosts to appear as if they originate from the same public IP, with the NAT device tracking each session by the combination of source IP and source port.

Answer

PAT is only supported with a single public IP address configured on the outside interface.

Answer

PAT cannot translate traffic for protocols that use static port numbers, such as DNS or HTTP.

Answer

PAT requires the ip nat inside source list command with the overload keyword.

Question 8

Router R1 is configured for VRF-Lite with MPLS. The interface Gig0/0 is in VRF-A and is running LDP. The LDP neighbor with R2 is not establishing. R1 configuration: mpls ip, mpls label protocol ldp, interface Gig0/0, ip vrf forwarding VRF-A, ip address 10.0.0.1 255.255.255.252. R2 has similar configuration without VRF. The LDP hello packets are sent but not received. What is the root cause?

Accepted Answer

LDP cannot form a session between a VRF interface and a global interface; both must be in the same VRF or both in the global table.. LDP uses UDP and TCP, and the transport address is typically the router ID. In a VRF, the LDP session must be established within the same VRF. If R1 has VRF-A and R2 does not, the LDP hellos are sent in the VRF context, but R2's LDP process is in the global table. The hellos are not recognized because the VRF label space is different. LDP requires matching VRF or global configuration.

Answer

The MPLS label protocol must be TDP on both sides.

Answer

The interface IP addresses must be in the same subnet.

Answer

The mpls ip command must be applied under the VRF address-family.

Question 9

A router has a CoPP policy that includes a class-map matching all TCP traffic with a police rate of 5000 bps. The engineer notices that Telnet sessions to the router are timing out, but SSH sessions work fine. The router is configured to accept both Telnet and SSH. What is the most likely cause?

Accepted Answer

The CoPP policy has a separate class for Telnet with a lower police rate or a drop action.. The CoPP policy likely includes a separate class-map that matches Telnet traffic (TCP port 23) and applies a police rate lower than 5000 bps or a drop action, causing Telnet sessions to time out. Since the existing class-map matches all TCP traffic with a 5000 bps police rate, and SSH (TCP port 22) works fine, the issue is not with the general TCP rate limit but with a more specific Telnet class that overrides or preempts the general TCP class. This is a common CoPP misconfiguration where a more specific class with a restrictive action is placed before a broader class in the policy-map.

Answer

The SSH traffic is encrypted, so it uses less bandwidth than Telnet.

Answer

The Telnet server on the router is not responding due to a configuration error.

Answer

The CoPP policy is rate-limiting TCP traffic to 5000 bps, which is enough for SSH but not for Telnet.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip dhcp server statistics
Memory usage         26140
Address conflicts    0

Pool statistics

Pool              IP addresses    Requests     Offers      Acks     Naks     Declines     Releases
  POOL1             10-20           50           45          40       5        2            3

Based on this output, which statement is correct?

Accepted Answer

The DHCP server is rejecting requests (Naks) and clients are declining offers, indicating possible pool exhaustion or address conflicts.. The output shows 5 NAKs and 2 Declines, indicating that the DHCP server is rejecting requests (NAKs) and clients are declining offers (Declines). NAKs typically occur when a client requests an IP address that is no longer valid or available, while Declines happen when a client detects an address conflict via ARP. This combination strongly suggests pool exhaustion or address conflicts, making option B correct.

Answer

The DHCP server is operating without any issues.

Answer

The DHCP server has a memory problem.

Answer

The DHCP server has no address conflicts.

Question 11

Which BGP attribute is used for loop prevention in eBGP?

Accepted Answer

AS_PATH. The AS_PATH attribute contains the list of AS numbers a route has traversed. If a BGP router receives a route with its own AS number in the AS_PATH, it discards the route to prevent loops.

Answer

NEXT_HOP

Answer

LOCAL_PREF

Answer

MED

Question 12

A network engineer runs the following command to troubleshoot IPv6 ND inspection:

R1# debug ipv6 nd inspection

*Mar  1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, options: SLLA 0011.2233.4455
*Mar  1 00:02:34.567: IPv6-ND-Inspection: R1, Fa0/0, NS from fe80::1 to ff02::1, target 2001:db8::1, SLLA 0011.2233.4455 is allowed by policy INSPECT
*Mar  1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, options: TLLA 00aa.bbcc.ddee
*Mar  1 00:02:35.890: IPv6-ND-Inspection: R1, Fa0/0, NA from fe80::2 to fe80::1, target 2001:db8::2, TLLA 00aa.bbcc.ddee is blocked by policy INSPECT

What does this output indicate?

Accepted Answer

ND inspection is allowing NS messages but blocking NA messages from fe80::2, likely due to a MAC address mismatch or policy violation.. The debug output shows that the Neighbor Solicitation (NS) from fe80::1 is allowed by policy INSPECT, while the Neighbor Advertisement (NA) from fe80::2 is blocked by the same policy. This indicates that IPv6 ND inspection is selectively permitting NS messages but denying NA messages from fe80::2, likely due to a MAC address mismatch (the TLLA in the NA does not match the expected binding) or a policy violation, making option A correct.

Answer

ND inspection is blocking all NS and NA messages, indicating a misconfiguration.

Answer

ND inspection is allowing all messages but logging them for analysis.

Answer

ND inspection is not configured; the debug output is from default ND behavior.

Question 13

An engineer is troubleshooting a network where IPv6 hosts cannot obtain IP addresses via DHCPv6. The switch is configured with DHCPv6 Guard to prevent rogue DHCP servers. The legitimate DHCPv6 server is connected to port GigabitEthernet1/0/1. The engineer sees that DHCPv6 Solicit messages from hosts reach the server, but the server's Advertise and Reply messages are not reaching the hosts. What is the most likely root cause?

Accepted Answer

The DHCPv6 Guard policy is applied globally, and the port connected to the DHCP server is not configured as a trusted port for DHCPv6 server messages.. DHCPv6 Guard is a First Hop Security feature that blocks DHCPv6 server messages (Advertise, Reply) on untrusted ports. When the policy is applied globally, all ports are untrusted by default unless explicitly configured as trusted. Since the legitimate DHCPv6 server is connected to GigabitEthernet1/0/1, that port must be configured as a trusted port using the `ipv6 dhcp guard trust` interface command. Without this, the switch drops the server's Advertise and Reply messages, preventing hosts from receiving valid DHCPv6 responses.

Answer

RA Guard is blocking the DHCPv6 server's Router Advertisements, causing hosts to not send Solicit messages.

Answer

IPv6 Source Guard is filtering the server's responses because the server's IPv6 address is not in the binding table.

Answer

The switch has DHCP snooping enabled for IPv4, which is interfering with IPv6 DHCPv6 operation.

Question 14

What is the default DHCPv4 server lease time on a Cisco IOS-XE router configured as a DHCP server?

Accepted Answer

86400 seconds (1 day). The default DHCPv4 lease time on a Cisco IOS-XE router configured as a DHCP server is 86400 seconds (1 day). This is defined in the Cisco IOS DHCP server configuration and is the standard default value used when no lease duration is explicitly specified in the DHCP pool configuration.

Answer

3600 seconds (1 hour)

Answer

43200 seconds (12 hours)

Answer

604800 seconds (7 days)

Question 15

What is the default tunnel mode for an IPv6 tunnel configured on Cisco IOS-XE?

Accepted Answer

GRE. The default tunnel mode for an IPv6 tunnel on Cisco IOS-XE is GRE (Generic Routing Encapsulation), as specified by the 'tunnel mode gre ipv6' command. When you create a tunnel interface and configure an IPv6 tunnel source and destination without explicitly setting the tunnel mode, the router defaults to GRE encapsulation, which provides a multiprotocol transport capable of carrying both IPv4 and IPv6 payloads.

Answer

IPv6IP

Answer

ISATAP

Answer

6to4

Question 16

An engineer configures mutual redistribution between OSPF and EIGRP on a PE router in an MPLS L3VPN. The engineer does not configure any route tagging or filtering. After a few minutes, the OSPF and EIGRP domains become unstable, with routes flapping and high CPU usage. What is the most likely explanation?

Accepted Answer

The mutual redistribution creates a routing loop because routes are redistributed back into the original protocol without any loop-prevention mechanism.. Mutual redistribution without route tagging or filtering can cause a routing loop. When OSPF routes are redistributed into EIGRP, and then those EIGRP routes are redistributed back into OSPF, the same prefixes can be learned from both protocols. Without a route tag or a filter to prevent re-redistribution, the router will continuously re-advertise the same routes, causing route flapping and high CPU. This is a classic edge case in redistribution. The solution is to use route tags and filtering to prevent loops.

Answer

The OSPF and EIGRP administrative distances conflict, causing the router to prefer the wrong route.

Answer

The 'default-information originate' command is missing, so the redistributed routes are not advertised.

Answer

The 'subnets' keyword is missing in the OSPF redistribution command, causing only classful routes to be advertised.

Question 17

What is the default value of the 'hold-down' timer in IPv6 FHS's ND Snooping feature on Cisco IOS-XE?

Accepted Answer

10 seconds. The default hold-down timer for IPv6 First Hop Security's Neighbor Discovery (ND) Snooping feature on Cisco IOS-XE is 10 seconds. This timer defines how long the device maintains a binding entry in the ND snooping database after the last valid advertisement is received, preventing rapid flapping and ensuring stability in the binding table.

Answer

5 seconds

Answer

15 seconds

Answer

20 seconds

Question 18

A service provider is using 6rd (IPv6 Rapid Deployment) tunnels to provide IPv6 to customers. Customer router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel mode ipv6ip 6rd ipv6 6rd prefix 2001:DB8::/32 6rd-br 198.51.100.1. Router R2 (BR) shows: R2# show ipv6 route 2001:DB8:1::/64 % Route not found. What is the root cause?

Accepted Answer

The 6rd prefix on R1 should match the BR's configured 6rd prefix, and the BR must have a route for the customer's delegated prefix.. The 6rd (IPv6 Rapid Deployment) tunnel requires both the customer router (R1) and the border relay (BR, R2) to agree on the same 6rd prefix. R1 is configured with prefix 2001:DB8::/32, but the BR has no route for the delegated prefix 2001:DB8:1::/64, which is derived from R1's IPv4 address (192.0.2.1) and the 6rd prefix. Without this route in the BR's IPv6 routing table, the BR cannot forward traffic to the customer's 6rd tunnel, causing the 'Route not found' error.

Answer

The tunnel mode should be ipv6ip 6rd on both ends, but the BR is missing the 6rd configuration.

Answer

The customer's IPv4 address is not reachable from the BR.

Answer

The 6rd prefix length should be /64 instead of /32.

Question 19

A network engineer is troubleshooting a BGP session that is dropping intermittently. The routers are connected via a Layer 2 switch. BFD is configured for the BGP session. The engineer notices that the BFD session goes down briefly, causing the BGP session to reset. The BFD timers are set to 100 ms interval with a multiplier of 3. The switch is not configured for BFD. What is the most likely cause?

Accepted Answer

The BFD timers are too aggressive for the switch's processing capabilities, causing BFD packets to be dropped during high traffic.. BFD sessions can be affected by congestion or processing delays in the Layer 2 switch, especially with aggressive timers. The switch not supporting BFD does not inherently cause issues, but high CPU or buffer drops can cause BFD packets to be dropped.

Answer

The BGP session is not configured with the 'bfd' command under the neighbor statement.

Answer

The switch is running Spanning Tree Protocol (STP) and causing delays.

Answer

One router has 'bfd slow-timers' configured, causing a mismatch.

Question 20

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1:

R1# debug ipv6 dhcp relay

Output:
 IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0
 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCPv6 relay agent is successfully forwarding messages between the client and server.. The debug output shows a complete DHCPv6 four-message exchange (SOLICIT-ADVERTISE-REQUEST-REPLY) being relayed between the client (FE80::1) and the server (2001:DB8:2::1). Each message is received on one interface and forwarded out the other, confirming the relay agent is functioning correctly. Therefore, option B is correct.

Answer

The DHCPv6 relay agent is not functioning because messages are not being forwarded.

Answer

The DHCPv6 server is unreachable because no REPLY is received.

Answer

The DHCPv6 client is using a global unicast address as its link-local address.