300-410 Practice Test 9 — 10 Questions

Question 1

A network engineer runs the following command to troubleshoot a VRF-Lite IPsec issue:

R1# show crypto ipsec transform-set vrf CUSTOMER_H

Output:
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel,  }

What does this output indicate?

Accepted Answer

The transform set uses ESP with AES 256 and SHA-HMAC in tunnel mode.. The 'show crypto ipsec transform-set vrf' command displays the IPsec transform set for a specific VRF. The output shows a transform set named 'combined' that uses ESP with AES 256-bit encryption and SHA-HMAC authentication. It will negotiate a tunnel mode (as opposed to transport mode).

Answer

The transform set uses ESP with AES 256 and SHA-HMAC in transport mode.

Answer

The transform set uses AH with AES 256 and MD5.

Answer

The transform set does not specify any encryption or authentication.

Question 2

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Accepted Answer

The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.. Private VLAN (PVLAN) on VLAN 20 isolates ports within the same VLAN, preventing direct communication between hosts on isolated ports. Even though the hosts share the same VLAN, PVLAN restricts traffic so that isolated ports can only communicate with a promiscuous port (e.g., a router uplink), not with each other. This directly explains why IPv6 hosts on VLAN 20 cannot ping each other.

Answer

IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.

Answer

RA Guard is blocking Neighbor Advertisements between hosts.

Answer

DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Question 3

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor whether the packet loss stops. This isolation test directly correlates the applet's activity with the symptom. If packet loss ceases when the applet is disabled, it confirms the applet as the root cause.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 4

Which TWO statements correctly describe the behavior of OSPFv3 when troubleshooting neighbor adjacency issues on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

OSPFv3 neighbor adjacencies are formed using the link-local IPv6 address of the neighbor.. Option A is correct because OSPFv3 forms neighbor adjacencies over IPv6 link-local addresses, which are used as the source and next-hop for Hello packets on the link. Option D is correct because the 'show ipv6 ospf neighbor' command output includes the neighbor's link-local address, which is essential when troubleshooting adjacency issues. Option B is incorrect because the OSPFv3 router ID is a 32-bit value, not 128-bit, and is typically derived from an IPv4 address or manually configured. Option C is incorrect because OSPFv3 is enabled on an interface with the 'ipv6 ospf area ' command, while 'ipv6 router ospf' enters the OSPFv3 process configuration mode. Option E is incorrect because OSPFv3 network type is configured per interface, not globally under the OSPFv3 process.

Answer

The OSPFv3 router ID is a 128-bit value derived from the highest loopback IPv6 address.

Answer

The 'ipv6 router ospf' command is used to enable OSPFv3 on an interface.

Answer

OSPFv3 uses the network type configured under the OSPFv3 process globally, not per interface.

Question 5

Which TWO statements about the syslog message format and its fields are correct? (Choose TWO.)

Accepted Answer

The facility code in a syslog message identifies the type of process that generated the message, such as local7 (value 23).. The only correct statement is A. The facility code identifies the type of process that generated the message (local7 is facility 23). B is incorrect because severity 0 is Emergency, not Debugging. C is incorrect because Cisco IOS does not add sequence numbers by default; this requires the service sequence-numbers command. D is incorrect because the default Cisco syslog timestamp is not DD/MM/YYYY; the default format is typically *HH:MM:SS or MMM DD YYYY HH:MM:SS when timestamps are enabled. E is incorrect because the hostname field uses the device's configured hostname, not the IP address.

Answer

The severity level in a syslog message ranges from 0 (debugging) to 7 (emergency).

Answer

By default, Cisco IOS includes a sequence number in every syslog message when logging is enabled.

Answer

The timestamp in a syslog message from a Cisco device is formatted as DD/MM/YYYY HH:MM:SS by default.

Answer

The hostname field in a syslog message is derived from the IP address of the interface that sends the message.

Question 6

An engineer is troubleshooting an EIGRP issue where a router is not learning any routes from a neighbor, but the neighbor adjacency is up. The engineer checks the EIGRP topology table on the local router and sees that the neighbor is listed, but no routes from that neighbor are present. The engineer also verifies that the neighbor has routes to advertise. What is the most likely cause?

Accepted Answer

The neighbor is configured as an EIGRP stub router.. When an EIGRP neighbor adjacency is up but no routes are received from the neighbor, the most likely cause is that the neighbor is configured as an EIGRP stub router. A stub router advertises only a default route or its directly connected and summary routes, depending on the stub setting, and does not advertise all learned routes. Since the engineer confirmed the neighbor has routes to advertise, the stub configuration on the neighbor would prevent those routes from being sent, even though the adjacency remains established.

Answer

The local router has a distribute-list out applied to the neighbor.

Answer

The EIGRP metric weights are different on the two routers.

Answer

The local router has a route-map applied to the EIGRP process that is filtering all routes.

Question 7

Drag and drop the steps to verify and validate route redistribution operational state into the correct order, from first to last.

Accepted Answer

Check routing table for redistributed prefixes. Verification of redistribution starts with checking the routing table for redistributed routes, then examining the specific protocol database, followed by verifying the redistribution configuration, then checking for administrative distance issues, and finally using traceroute to validate the path. This order confirms routes are present, correctly sourced, and reachable.

Question 8

Examine the following configuration on a PE router:

ip vrf CUSTOMER-E
 rd 400:1
 route-target export 400:1
 route-target import 400:2
!
interface GigabitEthernet0/5
 ip vrf forwarding CUSTOMER-E
 ip address 10.4.4.1 255.255.255.252
!
router bgp 65000
 neighbor 10.0.0.1 remote-as 65000
 neighbor 10.0.0.1 update-source Loopback0
!
 address-family vpnv4
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community extended
 exit-address-family
!
 address-family ipv4 vrf CUSTOMER-E
  neighbor 10.4.4.2 remote-as 65003
  neighbor 10.4.4.2 activate
  neighbor 10.4.4.2 route-map SET-COMMUNITY in
 exit-address-family
!
route-map SET-COMMUNITY permit 10
 set community 100:100

What is the effect of the route-map on the incoming routes from the CE?

Accepted Answer

The route-map will set the standard community 100:100 on the routes received from the CE, but the RT is still determined by the route-target export command.. The route-map SET-COMMUNITY is applied inbound on the BGP session with the CE, so it sets the standard community 100:100 on routes received from the CE. However, the route-target (RT) for the VRF is determined by the route-target export command under the VRF configuration, not by the standard community set by the route-map. The RT is a BGP extended community used for VPN route distribution, and it is separate from standard communities.

Answer

The route-map will override the route-target export and set the RT to 100:100.

Answer

The route-map will cause the BGP session to reset because the community format is incorrect.

Answer

The route-map will have no effect because the community is not sent to the CE.

Question 9

What is the default action for a packet that does not match any route-map entry in a PBR policy?

Accepted Answer

The packet is forwarded using the routing table.. Policy-Based Routing (PBR) via route-maps uses an implicit deny at the end of the route-map, but 'deny' in a route-map used for PBR means 'do not policy-route this packet' — the packet is then forwarded normally using the routing table. This differs from route-maps used for route redistribution, where an implicit deny means the route is not redistributed. The key distinction is the context: PBR route-maps fall through to normal destination-based forwarding.

Answer

The packet is dropped.

Answer

The packet is sent to the CPU for processing.

Answer

The router sends an ICMP unreachable message.

Question 10

What is the default behavior of PBR when a 'set ip next-hop' and a 'set ip default next-hop' are both configured in the same route-map entry?

Accepted Answer

The 'set ip next-hop' is used if reachable; otherwise, the 'set ip default next-hop' is used if the routing table has no explicit route.. In PBR, 'set ip next-hop' and 'set ip default next-hop' have distinct semantics: 'set ip next-hop' is evaluated first and used if the specified next hop is reachable; 'set ip default next-hop' is only used when the routing table has no explicit route for the destination. When both are configured in the same route-map entry, the router prefers the explicit next-hop if reachable, falling back to the default next-hop only when no explicit route exists.

Answer

The 'set ip default next-hop' is always used first.

Answer

Both are used simultaneously, and the router load-balances.

Answer

The router ignores both and uses the routing table.