300-410 Mock Exam 88 — 25 Questions

Question 1

A company uses IP SLA to track a route to a remote network via a DMVPN tunnel. Router R1 (hub) has:

ip sla 5
 icmp-echo 172.16.0.1 source-ip 10.0.0.1
 frequency 10
ip sla schedule 5 life forever start-time now

track 5 ip sla 5 reachability

ip route 192.168.1.0 255.255.255.0 Tunnel0 track 5

Tunnel0 is a DMVPN tunnel to spoke R2. The tunnel is up, but the route is intermittently removed. Show output on R1:

show ip route 192.168.1.0
% Subnet not in table

show track 5
Track 5
  IP SLA 5 reachability
  Reachability is Down
  2 changes, last change 00:00:05

What is the root cause?

Accepted Answer

The source IP of the IP SLA probe is not the tunnel source, so the probe is sent out the physical interface and does not reach the destination.. The IP SLA probe is sent to 172.16.0.1, which is the tunnel IP of R2. However, the DMVPN tunnel might be using a different encapsulation (e.g., mGRE) and the probe might be sent over the physical interface instead of the tunnel, or the tunnel might be in a VRF. The correct answer is that the IP SLA probe is sourced from 10.0.0.1, which is not the tunnel source, so the probe goes out the physical interface and may not reach 172.16.0.1, causing the track to go down.

Answer

The DMVPN tunnel is down because the spoke is not reachable.

Answer

The IP SLA frequency is too low, causing the track to go down after 10 seconds of no response.

Answer

The route is removed because the track is down, but the track is down due to a routing loop in the DMVPN network.

Question 2

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Accepted Answer

The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.. With uRPF strict mode enabled, the router checks that the source address of the incoming packet is reachable via the same interface on which the packet was received. Since the route to 2001:db8:1::1 points out a different interface, the uRPF check fails and the packet is dropped before any multicast forwarding can occur. This explains why the multicast traffic is not forwarded to downstream receivers despite the ACL permitting the group address.

Answer

The ACL is blocking the multicast traffic because the source address is not permitted.

Answer

The multicast routing is not enabled globally.

Answer

The downstream receivers are not in the multicast group.

Question 3

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

Accepted Answer

The ACE is invalid and ignored.. In IPv6, an access-list entry (ACE) that does not specify a protocol is considered invalid and is ignored by the router. This is because the IPv6 access-list syntax requires a protocol keyword (e.g., tcp, udp, icmp, or a protocol number) to define the match criteria; without it, the ACE cannot be parsed correctly and is treated as a configuration error, not a default permit or deny.

Answer

The ACE defaults to 'permit ipv6'.

Answer

The ACE defaults to 'deny ipv6'.

Answer

The ACE matches all IPv6 traffic.

Question 4

Which TWO statements about IPv6 First Hop Security (FHS) Device Tracking are true? (Choose TWO.)

Accepted Answer

Device Tracking uses Neighbor Discovery (ND) probes to determine if a host is still reachable.. Device Tracking uses Neighbor Discovery (ND) probes (e.g., Neighbor Solicitations) to actively verify whether a host is still reachable on the link. This mechanism allows the switch to detect host movement or disconnection and update its binding table accordingly, ensuring that security features like RA Guard and DHCP Guard apply to the correct host state.

Answer

Device Tracking relies on DHCPv6 lease expiration to remove stale bindings.

Answer

Device Tracking creates binding entries for hosts that are discovered via ND.

Answer

Device Tracking only supports IPv6 hosts.

Question 5

Which TWO commands verify the operational status and packet statistics of a Control Plane Policing (CoPP) policy on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays the applied CoPP policy, including per-class match counters and action statistics (e.g., number of packets dropped or forwarded). This directly verifies that the policy is active and processing traffic as configured.

Answer

show ip interface brief

Answer

show access-lists

Answer

show running-config | section policy-map

Question 6

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3
Session 3
---------
Type : Remote Destination Session
Source Ports :
    RX Only : Gi0/6
Destination Ports : Gi0/7
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.. This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.

Answer

The session is an ERSPAN destination session because it uses RX only.

Answer

The session is a local SPAN session with source port Gi0/6.

Answer

The session is misconfigured because the destination port has ingress disabled.

Question 7

In Cisco IOS, what is the default IKEv1 phase 1 authentication method when using a pre-shared key and no explicit authentication is configured?

Accepted Answer

Pre-shared key. When no explicit authentication method is configured for IKEv1 phase 1 and a pre-shared key is used, Cisco IOS defaults to 'pre-shared key' authentication. This is because the pre-shared key itself defines the authentication mechanism; the router automatically selects the appropriate authentication method based on the configured key material.

Answer

RSA encrypted nonces

Answer

Digital signatures (RSA-SIG)

Answer

No default; authentication must be explicitly set

Question 8

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology summary

IP-EIGRP Topology Table for AS(100)/ID(1.1.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.0.0.0/8, 1 successors, FD is 2812416, serno 10
    via Summary (2812416/0), Null0
P 10.0.0.0/24, 1 successors, FD is 2172416, serno 5
    via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0
P 10.0.1.0/24, 1 successors, FD is 2172416, serno 6
    via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0

Based on this output, what is the purpose of the route 10.0.0.0/8 via Null0?

Accepted Answer

It is a discard route to prevent routing loops.. The route 10.0.0.0/8 via Null0 is a summary route created by the 'summary-address' command in EIGRP, used to prevent routing loops by discarding packets that do not match more specific routes.

Answer

It is a default route for unknown destinations.

Answer

It is a route learned from a neighbor.

Answer

It is a connected route.

Question 9

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The CoPP configuration matches SSH (TCP/22), Telnet (TCP/23), and ICMP echo (ping) traffic via ACL 100 and class-map COPP-MGMT, then applies a police rate of 8000 bps to that class. All other control-plane traffic falls into class-default and is policed at 64000 bps. The 'conform-action transmit exceed-action drop' statements enforce rate-limiting, not blocking, so the correct effect is that SSH, Telnet, and ICMP echo are rate-limited to 8000 bps, while all other control-plane traffic is rate-limited to 64000 bps.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 10

An engineer is troubleshooting why the NMS is not receiving SNMP traps from router R8 after a recent configuration change. The engineer added 'snmp-server host 10.1.1.100 version 2c public' and 'snmp-server enable traps' but forgot to remove the old 'snmp-server host 10.1.1.200 version 2c public' command. The NMS at 10.1.1.100 can receive traps from other devices. What is the most likely cause?

Accepted Answer

The engineer did not configure the SNMP community string 'public' on the router.. The router's SNMP agent will not send traps to any host unless the community string referenced in the 'snmp-server host' command is first defined with an 'snmp-server community' command. Without 'snmp-server community public ro' (or rw), the router has no valid community string to include in the trap PDU, so the NMS at 10.1.1.100 will never receive traps from R8, even though the host and enable commands are present.

Answer

The old 'snmp-server host' command for 10.1.1.200 is causing a conflict, preventing traps to the new host.

Answer

The engineer needs to remove the old host command before adding the new one.

Answer

The router requires a reload after adding a new 'snmp-server host' command.

Question 11

Which TWO configuration changes are required to enable inter-VRF route leaking between VRF A and VRF B using static routes? (Choose TWO.)

Accepted Answer

Configure a static route in VRF B with the 'vrf A' keyword to specify the source VRF for the next-hop.. Route leaking between VRFs can be done using static routes with the 'global' or 'vrf' keywords. To leak a route from VRF A to VRF B, you configure a static route in VRF B pointing to the next-hop in VRF A, and use the 'vrf' keyword to specify the source VRF. Option A is correct because the static route must specify the source VRF. Option D is correct because the next-hop must be reachable in the source VRF. Option B is incorrect because the 'ip route' command does not use 'source-vrf'; it uses 'vrf'. Option C is incorrect because the destination network is the one being leaked, not the next-hop. Option E is incorrect because route leaking does not require a routing protocol; static routes are sufficient.

Answer

Use the 'ip route vrf B

source-vrf A' command syntax.

Answer

The next-hop IP address must be the interface address of the destination VRF.

Answer

A dynamic routing protocol must be configured in both VRFs to redistribute the leaked routes.

Question 12

Which TWO statements correctly describe the behavior of Control Plane Policing (CoPP) when applied to a Cisco IOS router? (Choose TWO.)

Accepted Answer

CoPP policies are applied using the Modular QoS CLI (MQC) and can be attached to the control-plane interface with the 'service-policy input' command.. CoPP uses the Modular QoS CLI (MQC) framework, where a policy-map is created with class-maps and actions, and then applied to the control-plane interface using the 'service-policy input' command. This attaches the policy to the control plane, filtering traffic destined to the router's CPU before it is process-switched.

Answer

CoPP policies are applied using the 'policy-map' command under the interface configuration mode for each physical interface.

Answer

CoPP polices all traffic that enters the router, including traffic that is process-switched after being forwarded.

Answer

CoPP uses the 'class-map' command to match traffic based on ACLs, NBAR, or DSCP values, and the 'police' command to enforce rate limits.

Question 13

An engineer configures mutual redistribution between OSPF and EIGRP without route tagging. After convergence, some routes oscillate between the two protocols. What is the most likely explanation?

Accepted Answer

Routes redistributed from OSPF into EIGRP are re-redistributed back into OSPF, and the OSPF route is preferred over the original due to administrative distance, causing a loop.. Without route tagging, redistributed routes can be re-injected back into the original protocol, creating a routing loop. The administrative distance comparison can cause the route to be preferred from the wrong protocol, leading to oscillation.

Answer

The seed metric for EIGRP is not set, so redistributed routes are dropped.

Answer

OSPF has a higher administrative distance than EIGRP, so OSPF routes are always preferred.

Answer

The 'redistribute ospf' command under EIGRP automatically sets a tag, preventing loops.

Question 14

Which statement about the SPAN destination port behavior is correct?

Accepted Answer

The SPAN destination port is automatically placed in a forwarding state and does not run STP.. By default, a SPAN destination port does not participate in any Layer 2 protocols (like STP, CDP, DTP) and does not forward or receive normal traffic; it only transmits mirrored packets.

Answer

The SPAN destination port operates in full-duplex mode by default.

Answer

The SPAN destination port can participate in Spanning Tree Protocol (STP) if configured.

Answer

The SPAN destination port can be used as a normal switch port after removing the SPAN configuration.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip ospf interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet Address 10.1.1.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 10.1.1.1
  Backup Designated router (ID) 2.2.2.2, Interface address 10.1.1.2
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:03
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 25
  Last flood scan time is 0 msec, maximum is 4 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)

Based on this output, what is the problem?

Accepted Answer

The output shows no external routes are being redistributed, but this is a normal interface status.. The output shows R1 is the Designated Router (DR) on a broadcast network. The neighbor count is 1, which is normal. However, the problem might be that redistribution is not happening because the interface is in area 0, but no external routes are seen. The output itself does not show a direct problem; it is a normal OSPF interface state. The question likely expects the candidate to note that the interface is functioning correctly, but the context of redistribution might imply that redistribution is configured but not working due to other issues.

Answer

The router is the DR, which is normal, but the neighbor count of 1 indicates only one OSPF neighbor is present.

Answer

The interface is in area 0, but redistribution of external routes requires a route-map to set the metric.

Answer

The router ID is 1.1.1.1, which is not reachable from other routers.

Question 16

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1
  FNF: monitor
    Monitor: FLOW-MONITOR-1
      direction: Input
      traffic-statistics:  enabled

Based on both outputs, what is the most likely problem?

Accepted Answer

The flow monitor is attached, but no traffic is flowing through the interface.. The flow monitor is attached to the interface, but the cache shows 0 flows added. This suggests that no traffic is being received on that interface, or the flow record does not match any packets (e.g., record type mismatch).

Answer

The flow monitor is not attached to the interface.

Answer

The cache size is too small.

Answer

The flow exporter is misconfigured.

Question 17

A network engineer runs the following command to troubleshoot a Route Summarization issue:

R1# show ip eigrp topology 10.0.0.0/16
IP-EIGRP topology entry for 10.0.0.0/16
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 128576
  Routing Descriptor Blocks:
  10.1.1.2 (Serial0/0/0), from 10.1.1.2, Send flag is 0x0
      Composite metric is (128576/156160), Route is Internal
      Vector metric:
        Minimum bandwidth is 10000 Kbit
        Total delay is 2000 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 2

What does this output indicate?

Accepted Answer

The summary route 10.0.0.0/16 is installed in the routing table and reachable via 10.1.1.2.. This output shows the EIGRP topology table entry for the summary route 10.0.0.0/16. The state is Passive, meaning the route is stable and reachable. The presence of a successor and the metric details indicate that the summary route is being advertised and learned via EIGRP.

Answer

The summary route is in active state, indicating a query is in progress.

Answer

The summary route is not being advertised because the FD is too high.

Answer

The summary route is learned via redistribution, not summarization.

Question 18

Which TWO statements about IPsec transform sets and security associations (SAs) are true? (Choose TWO.)

Accepted Answer

A transform set can specify ESP encryption and ESP authentication simultaneously.. An IPsec transform set can specify both ESP encryption (e.g., AES) and ESP authentication (e.g., HMAC-SHA256) simultaneously. This is a standard configuration where ESP provides both confidentiality and integrity/authentication in a single transform set, as defined in RFC 4303.

Answer

Transport mode adds a new IP header to the packet.

Answer

The command 'crypto ipsec security-association lifetime' sets the IKE SA lifetime.

Answer

A single IPsec SA provides bidirectional secure communication.

Question 19

In a 6to4 tunnel, what is the default IPv6 prefix assigned to the tunnel interface?

Accepted Answer

2002:IPv4-address::/48. In a 6to4 tunnel, the default IPv6 prefix assigned to the tunnel interface is 2002:IPv4-address::/48, where the IPv4 address of the tunnel source is embedded in the prefix. This is defined in RFC 3056, which specifies that the 6to4 prefix is 2002::/16, and the next 32 bits are the tunnel source's IPv4 address, resulting in a /48 prefix for the 6to4 site.

Answer

2002::/16

Answer

2001::/32

Answer

3ffe::/16

Question 20

Consider the following configuration on Router R4:

router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500

router ospf 1
 redistribute eigrp 100 metric 20 metric-type 1 subnets

What is a potential issue with this configuration?

Accepted Answer

Mutual redistribution without route filtering can cause routing loops or suboptimal routing.. Mutual redistribution without route filtering or administrative distance adjustments can cause routing loops or suboptimal routing. The configuration does not include any route-maps or distribute-lists to control which routes are redistributed, which is a common pitfall.

Answer

The configuration is correct and will work without issues.

Answer

The 'metric-type 1' in OSPF redistribution may cause EIGRP routes to be preferred over OSPF routes.

Answer

The EIGRP metric values are invalid because load must be between 1 and 255.