300-410 Mock Exam 89 — 25 Questions

Question 1

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The flow record does not include any VLAN match fields.. To capture VLAN information in Flexible NetFlow, the flow record must include 'match dot1q vlan' or 'match vlan' fields. Without these, the VLAN ID is not recorded, and the collector may show a default or incorrect value.

Answer

The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.

Answer

The flow monitor is applied only to the physical interface, not the subinterfaces.

Answer

The collector does not support VLAN fields.

Question 2

A network engineer runs the following command to troubleshoot a Route Redistribution issue:

R1# show ip bgp vpnv4 vrf CUSTOMER routes

And sees the following output:

Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:1 (default for vrf CUSTOMER)
*> 192.168.10.0/24  10.1.1.2                 0    100      0 65001 i
*> 192.168.20.0/24  10.1.1.2                 0    100      0 65001 i

What does this output indicate?

Accepted Answer

The VRF CUSTOMER has two routes learned via BGP from AS 65001.. The show ip bgp vpnv4 vrf output shows routes in a VRF. The routes are learned from neighbor 10.1.1.2 with AS path 65001. This indicates that the VRF is receiving routes via BGP, possibly from a PE router. If redistribution is expected from another protocol into BGP within the VRF, these routes may be the result.

Answer

The routes are redistributed from OSPF into BGP within the VRF.

Answer

The VRF is not receiving any routes because of a redistribution issue.

Answer

The routes are locally originated within the VRF.

Question 3

A network engineer runs the following command on Router R1:

R1# show bfd neighbors detail

IPv4 Sessions
NeighborAddr      LD/RD         Int        State         Holdown(mult)  Intf
10.1.1.2          1/3           Gi0/0      Up            1500(3)        Gi0/0

Session state is UP and not using echo function.
OurAddr: 10.1.1.1
Handle: 1
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 1500(0)
Rx Count: 120, Tx Count: 150

Based on this output, which statement is correct?

Accepted Answer

The BFD session is up and the holddown timer is 1500 ms, which is correct based on the configured multiplier and MinRxInt.. The output shows BFD session details. The Holddown value of 1500 ms is calculated as MinRxInt * Multiplier (1000 ms * 3 = 3000 ms), but the output shows 1500 ms. This discrepancy indicates a misconfiguration or a bug, but the key point is that the session is UP and the holddown timer is 1500 ms, which is half of the expected value. However, the correct interpretation is that the BFD session is established and operating, and the holddown timer is 1500 ms as shown.

Answer

The BFD session is down because the holddown timer is incorrect.

Answer

The BFD session is using echo mode, which is why the holddown timer is 1500 ms.

Answer

The BFD session is up but the multiplier is set to 1, causing the holddown timer to be 1500 ms.

Question 4

A network engineer runs the following command to troubleshoot a VRF-Lite issue:

R1# show ip route vrf CUSTOMER_A summary

Output:
IP routing table name: CUSTOMER_A (0x00000001)
IP routing table maximum-paths: 32
Route Source    Networks    Subnets     Replicates  Overhead    Memory (bytes)
connected       2           0           0           0           576
static          1           0           0           0           288
eigrp 100       3           0           0           0           864
  Internal      3       0       0       0       864
  External      0       0       0       0       0
ospf 200        0           0           0           0           0
  Intra-area    0       0       0       0       0
  Inter-area    0       0       0       0       0
  External-1    0       0       0       0       0
  External-2    0       0       0       0       0
  NSSA-1        0       0       0       0       0
  NSSA-2        0       0       0       0       0
bgp 65000       0           0           0           0           0
  Internal      0       0       0       0       0
  External      0       0       0       0       0
Total           6           0           0           0           1728

What does this output indicate?

Accepted Answer

The VRF CUSTOMER_A has 6 routes, with EIGRP 100 providing 3 internal routes.. The 'show ip route vrf summary' command displays the routing table summary for a specific VRF. It shows the number of routes from each routing protocol source. In this output, the VRF CUSTOMER_A has 6 total routes: 2 connected, 1 static, and 3 from EIGRP 100. OSPF and BGP have 0 routes, indicating they are not contributing to the VRF's routing table.

Answer

The VRF CUSTOMER_A has 6 routes, all redistributed from BGP 65000.

Answer

The VRF CUSTOMER_A has 6 routes, with OSPF 200 providing 3 external routes.

Answer

The VRF CUSTOMER_A has 6 routes, all from connected and static only.

Question 5

Which TWO statements about route redistribution between EIGRP and OSPF are true? (Choose TWO.)

Accepted Answer

When redistributing EIGRP into OSPF, the OSPF metric must be explicitly configured if the default metric of 20 is not desired.. When redistributing between EIGRP and OSPF, the seed metric must be explicitly set for the receiving protocol. EIGRP uses a composite metric (bandwidth, delay, reliability, load, MTU) and OSPF uses a metric of type 1 or type 2. By default, OSPF assigns a metric of 20 to redistributed routes unless specified otherwise. Option A is correct because OSPF requires a seed metric for redistributed routes. Option D is correct because EIGRP redistributed routes default to an infinite metric (effectively not advertised) unless a seed metric is provided. Option B is incorrect because OSPF default metric is 20, not 1. Option C is incorrect because the default metric for EIGRP is not 100. Option E is incorrect because route-maps can be used to filter redistributed routes.

Answer

When redistributing OSPF into EIGRP, the default EIGRP metric is 1.

Answer

When redistributing OSPF into EIGRP, the default EIGRP metric is 100.

Answer

Route-maps cannot be used to filter routes during redistribution between EIGRP and OSPF.

Question 6

In a VRF-Lite environment running EIGRP, what is the default hello timer value on a Frame Relay multipoint interface?

Accepted Answer

60 seconds. By default, EIGRP uses a hello timer of 60 seconds on NBMA networks with bandwidth less than T1, including Frame Relay multipoint interfaces, and 5 seconds on high-speed NBMA links.

Answer

5 seconds

Answer

10 seconds

Answer

30 seconds

Question 7

What is the default timeout value for a NAT translation entry that is not using Port Address Translation (PAT) in Cisco IOS?

Accepted Answer

86400 seconds. The default timeout for a NAT translation entry without Port Address Translation (PAT) in Cisco IOS is 86400 seconds (24 hours). This is because a one-to-one NAT mapping is expected to remain stable for extended periods, unlike PAT entries which time out quickly (e.g., 60 seconds for UDP, 86400 seconds for TCP) due to port reuse. The 86400-second value ensures that the translation persists for long-lived sessions without unnecessary churn.

Answer

60 seconds

Answer

300 seconds

Answer

3600 seconds

Question 8

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# debug ip bgp 10.1.1.2 updates
BGP: 10.1.1.2 sending UPDATE with 2 prefixes, 0 withdrawn
BGP: 10.1.1.2 sending UPDATE with 0 prefixes, 1 withdrawn

What does this output indicate?

Accepted Answer

The neighbor 10.1.1.2 is receiving two new routes and one route withdrawal.. The debug ip bgp updates with neighbor IP shows updates sent to the neighbor. The first line indicates an update with two prefixes advertised. The second line indicates an update with one prefix withdrawn. This is normal BGP operation.

Answer

The neighbor 10.1.1.2 is sending two new routes and one route withdrawal.

Answer

The BGP session with 10.1.1.2 is flapping.

Answer

The neighbor 10.1.1.2 is not reachable.

Question 9

A company uses IP SLA to track a route to a remote network via a DMVPN tunnel. Router R1 (hub) has:

ip sla 5
 icmp-echo 172.16.0.1 source-ip 10.0.0.1
 frequency 10
ip sla schedule 5 life forever start-time now

track 5 ip sla 5 reachability

ip route 192.168.1.0 255.255.255.0 Tunnel0 track 5

Tunnel0 is a DMVPN tunnel to spoke R2. The tunnel is up, but the route is intermittently removed. Show output on R1:

show ip route 192.168.1.0
% Subnet not in table

show track 5
Track 5
  IP SLA 5 reachability
  Reachability is Down
  2 changes, last change 00:00:05

What is the root cause?

Accepted Answer

The source IP of the IP SLA probe is not the tunnel source, so the probe is sent out the physical interface and does not reach the destination.. The IP SLA probe is sent to 172.16.0.1, which is the tunnel IP of R2. However, the DMVPN tunnel might be using a different encapsulation (e.g., mGRE) and the probe might be sent over the physical interface instead of the tunnel, or the tunnel might be in a VRF. The correct answer is that the IP SLA probe is sourced from 10.0.0.1, which is not the tunnel source, so the probe goes out the physical interface and may not reach 172.16.0.1, causing the track to go down.

Answer

The DMVPN tunnel is down because the spoke is not reachable.

Answer

The IP SLA frequency is too low, causing the track to go down after 10 seconds of no response.

Answer

The route is removed because the track is down, but the track is down due to a routing loop in the DMVPN network.

Question 10

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Accepted Answer

The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.. With uRPF strict mode enabled, the router checks that the source address of the incoming packet is reachable via the same interface on which the packet was received. Since the route to 2001:db8:1::1 points out a different interface, the uRPF check fails and the packet is dropped before any multicast forwarding can occur. This explains why the multicast traffic is not forwarded to downstream receivers despite the ACL permitting the group address.

Answer

The ACL is blocking the multicast traffic because the source address is not permitted.

Answer

The multicast routing is not enabled globally.

Answer

The downstream receivers are not in the multicast group.

Question 11

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

Accepted Answer

The ACE is invalid and ignored.. In IPv6, an access-list entry (ACE) that does not specify a protocol is considered invalid and is ignored by the router. This is because the IPv6 access-list syntax requires a protocol keyword (e.g., tcp, udp, icmp, or a protocol number) to define the match criteria; without it, the ACE cannot be parsed correctly and is treated as a configuration error, not a default permit or deny.

Answer

The ACE defaults to 'permit ipv6'.

Answer

The ACE defaults to 'deny ipv6'.

Answer

The ACE matches all IPv6 traffic.

Question 12

Which TWO statements about IPv6 First Hop Security (FHS) Device Tracking are true? (Choose TWO.)

Accepted Answer

Device Tracking uses Neighbor Discovery (ND) probes to determine if a host is still reachable.. Device Tracking uses Neighbor Discovery (ND) probes (e.g., Neighbor Solicitations) to actively verify whether a host is still reachable on the link. This mechanism allows the switch to detect host movement or disconnection and update its binding table accordingly, ensuring that security features like RA Guard and DHCP Guard apply to the correct host state.

Answer

Device Tracking relies on DHCPv6 lease expiration to remove stale bindings.

Answer

Device Tracking creates binding entries for hosts that are discovered via ND.

Answer

Device Tracking only supports IPv6 hosts.

Question 13

Which TWO commands verify the operational status and packet statistics of a Control Plane Policing (CoPP) policy on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays the applied CoPP policy, including per-class match counters and action statistics (e.g., number of packets dropped or forwarded). This directly verifies that the policy is active and processing traffic as configured.

Answer

show ip interface brief

Answer

show access-lists

Answer

show running-config | section policy-map

Question 14

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3
Session 3
---------
Type : Remote Destination Session
Source Ports :
    RX Only : Gi0/6
Destination Ports : Gi0/7
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.. This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.

Answer

The session is an ERSPAN destination session because it uses RX only.

Answer

The session is a local SPAN session with source port Gi0/6.

Answer

The session is misconfigured because the destination port has ingress disabled.

Question 15

In Cisco IOS, what is the default IKEv1 phase 1 authentication method when using a pre-shared key and no explicit authentication is configured?

Accepted Answer

Pre-shared key. When no explicit authentication method is configured for IKEv1 phase 1 and a pre-shared key is used, Cisco IOS defaults to 'pre-shared key' authentication. This is because the pre-shared key itself defines the authentication mechanism; the router automatically selects the appropriate authentication method based on the configured key material.

Answer

RSA encrypted nonces

Answer

Digital signatures (RSA-SIG)

Answer

No default; authentication must be explicitly set

Question 16

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology summary

IP-EIGRP Topology Table for AS(100)/ID(1.1.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.0.0.0/8, 1 successors, FD is 2812416, serno 10
    via Summary (2812416/0), Null0
P 10.0.0.0/24, 1 successors, FD is 2172416, serno 5
    via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0
P 10.0.1.0/24, 1 successors, FD is 2172416, serno 6
    via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0

Based on this output, what is the purpose of the route 10.0.0.0/8 via Null0?

Accepted Answer

It is a discard route to prevent routing loops.. The route 10.0.0.0/8 via Null0 is a summary route created by the 'summary-address' command in EIGRP, used to prevent routing loops by discarding packets that do not match more specific routes.

Answer

It is a default route for unknown destinations.

Answer

It is a route learned from a neighbor.

Answer

It is a connected route.

Question 17

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The CoPP configuration matches SSH (TCP/22), Telnet (TCP/23), and ICMP echo (ping) traffic via ACL 100 and class-map COPP-MGMT, then applies a police rate of 8000 bps to that class. All other control-plane traffic falls into class-default and is policed at 64000 bps. The 'conform-action transmit exceed-action drop' statements enforce rate-limiting, not blocking, so the correct effect is that SSH, Telnet, and ICMP echo are rate-limited to 8000 bps, while all other control-plane traffic is rate-limited to 64000 bps.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 18

An engineer is troubleshooting why the NMS is not receiving SNMP traps from router R8 after a recent configuration change. The engineer added 'snmp-server host 10.1.1.100 version 2c public' and 'snmp-server enable traps' but forgot to remove the old 'snmp-server host 10.1.1.200 version 2c public' command. The NMS at 10.1.1.100 can receive traps from other devices. What is the most likely cause?

Accepted Answer

The engineer did not configure the SNMP community string 'public' on the router.. The router's SNMP agent will not send traps to any host unless the community string referenced in the 'snmp-server host' command is first defined with an 'snmp-server community' command. Without 'snmp-server community public ro' (or rw), the router has no valid community string to include in the trap PDU, so the NMS at 10.1.1.100 will never receive traps from R8, even though the host and enable commands are present.

Answer

The old 'snmp-server host' command for 10.1.1.200 is causing a conflict, preventing traps to the new host.

Answer

The engineer needs to remove the old host command before adding the new one.

Answer

The router requires a reload after adding a new 'snmp-server host' command.

Question 19

Which TWO configuration changes are required to enable inter-VRF route leaking between VRF A and VRF B using static routes? (Choose TWO.)

Accepted Answer

Configure a static route in VRF B with the 'vrf A' keyword to specify the source VRF for the next-hop.. Route leaking between VRFs can be done using static routes with the 'global' or 'vrf' keywords. To leak a route from VRF A to VRF B, you configure a static route in VRF B pointing to the next-hop in VRF A, and use the 'vrf' keyword to specify the source VRF. Option A is correct because the static route must specify the source VRF. Option D is correct because the next-hop must be reachable in the source VRF. Option B is incorrect because the 'ip route' command does not use 'source-vrf'; it uses 'vrf'. Option C is incorrect because the destination network is the one being leaked, not the next-hop. Option E is incorrect because route leaking does not require a routing protocol; static routes are sufficient.

Answer

Use the 'ip route vrf B

source-vrf A' command syntax.

Answer

The next-hop IP address must be the interface address of the destination VRF.

Answer

A dynamic routing protocol must be configured in both VRFs to redistribute the leaked routes.

Question 20

Which TWO statements correctly describe the behavior of Control Plane Policing (CoPP) when applied to a Cisco IOS router? (Choose TWO.)

Accepted Answer

CoPP policies are applied using the Modular QoS CLI (MQC) and can be attached to the control-plane interface with the 'service-policy input' command.. CoPP uses the Modular QoS CLI (MQC) framework, where a policy-map is created with class-maps and actions, and then applied to the control-plane interface using the 'service-policy input' command. This attaches the policy to the control plane, filtering traffic destined to the router's CPU before it is process-switched.

Answer

CoPP policies are applied using the 'policy-map' command under the interface configuration mode for each physical interface.

Answer

CoPP polices all traffic that enters the router, including traffic that is process-switched after being forwarded.

Answer

CoPP uses the 'class-map' command to match traffic based on ACLs, NBAR, or DSCP values, and the 'police' command to enforce rate limits.