300-410 Mock Exam 90 — 25 Questions

Question 1

An engineer configures Control Plane Policing (CoPP) on a router to protect the management plane. After applying the policy, the router becomes unreachable via SSH, but the console is still accessible. The engineer checks the CoPP policy and sees that SSH traffic is permitted. Which is the most likely explanation?

Accepted Answer

The class-map for SSH uses 'match protocol ssh' but the SSH server is configured on a non-default port, so the traffic is not matched and is dropped by the default class.. CoPP policies have an implicit deny at the end. If the class-map for SSH does not match the traffic correctly (e.g., using the wrong protocol or port), SSH packets will fall through to the default class, which may have a deny action. Additionally, the default class behavior is to permit traffic if not explicitly configured, but if the default class is configured with a drop action, all unmatched traffic is dropped. A common edge case is when the class-map uses 'match protocol ssh' but the router uses a different port for SSH (e.g., port 2222), so the traffic is not matched and is dropped by the default class.

Answer

The CoPP policy is applied in the input direction, but SSH traffic is generated by the router itself, so it is not affected by input policing.

Answer

The CoPP policy uses 'rate-limit' in bps instead of pps, causing all traffic to be dropped due to a misconfiguration.

Answer

The CoPP policy has an explicit deny statement before the permit statement for SSH, so SSH traffic is denied.

Question 2

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer verifies that the customer's IP prefix is in the routing table. Which is the most likely explanation?

Accepted Answer

The router has multiple equal-cost paths to the customer network, and the return path uses a different interface, causing strict uRPF to drop the packet.. Strict uRPF checks that the source IP of incoming packets has a route back to the same interface. If there is asymmetric routing, where the return path goes out a different interface, strict uRPF will drop the packets. A common edge case is when the router has multiple equal-cost paths to the source network, and the return traffic uses a different interface than the one the packet arrived on. In such cases, uRPF strict mode will fail because it only checks the best route, not all routes.

Answer

The customer network uses private IP addresses that are not routable, so uRPF drops them.

Answer

The interface is configured with 'ip verify unicast source reachable-via any', which is loose mode, not strict mode.

Answer

The routing table has a default route that points to a different interface, causing uRPF to use the default route for verification.

Question 3

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

Accepted Answer

The destination port is in a blocking state due to Spanning Tree Protocol.. SPAN destination ports must be configured with the 'spanning-tree portfast' command to avoid being blocked by Spanning Tree Protocol (STP). Without this, the destination port may remain in a blocking state.

Answer

The destination port is not in the same VLAN as the source port.

Answer

The destination port is configured as a trunk port.

Answer

The source interface is not in the same VLAN as the destination interface.

Question 4

In an MPLS network, OSPF network type mismatch causes routing issues. Router R1 and R2 are connected via a multi-access Ethernet link. R1 has 'interface GigabitEthernet0/0 ip ospf network point-to-point', while R2 has default OSPF network type broadcast. R1 shows 'show ip ospf neighbor' output: 'Neighbor 10.0.0.2, interface address 10.0.0.2, state FULL' but 'show ip route' does not include routes from R2. What is the root cause?

Accepted Answer

The OSPF network type mismatch causes R1 to ignore Type 2 LSAs from R2, preventing route installation.. OSPF network type mismatch on a multi-access link can cause adjacency to form but with different DR/BDR election behavior. With point-to-point on R1, it expects no DR/BDR, while broadcast on R2 expects DR election. The adjacency forms as FULL, but R1 does not accept routes from R2 because R2's LSA may have a different link type or R1 ignores them due to mismatch in network type handling.

Answer

The MTU mismatch between R1 and R2 causes OSPF database synchronization failure.

Answer

R1 has a distribute-list blocking routes from R2.

Answer

R2 is not advertising any routes; need 'network' statement.

Question 5

EIGRP stuck-in-active (SIA) occurs in a large network. Router R1 shows 'show ip eigrp topology 10.0.0.0/24' output: 'P 10.0.0.0/24, 1 successors, FD is 128000, Q is 0, SIA is 00:01:00' and 'show ip eigrp neighbors' shows neighbor R2 in state 'Active'. R1 configuration includes 'router eigrp 100 network 10.0.0.0 passive-interface default'. What is the root cause?

Accepted Answer

R2 has 'passive-interface default' configured, which prevents it from sending query replies back to R1.. EIGRP SIA occurs when a query is not replied within the active timer. The 'passive-interface default' command makes all interfaces passive, preventing EIGRP hellos and queries from being sent on those interfaces. If R1 has a passive interface to R2, no queries are sent, but if R1 is the query originator and R2 is not responding due to passive interface on R2's side, SIA can occur. However, the scenario shows R1's neighbor R2 is in Active state, meaning R1 sent a query to R2 but R2 did not reply. This could be because R2 has a passive interface to R1, blocking the query reply.

Answer

R1 has a route-map that filters the query for prefix 10.0.0.0/24.

Answer

The EIGRP K-values mismatch between R1 and R2 causes neighbor relationship issues.

Answer

The network 10.0.0.0 is not directly connected; need redistribution.

Question 6

BGP attribute manipulation causes unexpected path selection. Router R1 and R2 are eBGP peers. R1 receives prefix 172.16.0.0/16 from R2 with MED 50 and from another peer R3 with MED 100. R1 has configuration: 'route-map SET-MED permit 10 set metric 200' applied to neighbor R2 inbound. R1 shows 'show ip bgp 172.16.0.0' output: 'BGP routing table entry for 172.16.0.0/16, version 2, Paths: (2 available, best #2) Path #1: from R2 with MED 200, Path #2: from R3 with MED 100'. The best path is via R3, but the network expects R2 to be preferred. What is the root cause?

Accepted Answer

The 'bgp always-compare-med' command is missing, causing MED to be ignored for paths from different ASes.. BGP best path selection uses MED only if paths are from the same AS (if 'bgp always-compare-med' is not configured). Since R2 and R3 are different ASes, MED is not compared; instead, the next tie-breaker (e.g., IGP metric to next-hop) selects R3. The route-map sets MED on R2's routes, but it does not affect the comparison because of AS path difference.

Answer

The route-map SET-MED should be applied outbound on R2, not inbound.

Answer

R2's next-hop is unreachable via IGP, causing R1 to ignore R2's path.

Answer

R1 has 'bgp bestpath med missing-as-worst' configured, causing missing MED to be treated as worst.

Question 7

An engineer configures RSPAN on a Cisco switch to monitor traffic from VLAN 10 across multiple switches. The engineer creates an RSPAN VLAN (VLAN 100) on the source switch and configures the source as VLAN 10. On the remote switch, the engineer configures the destination port as GigabitEthernet0/1 in VLAN 100. However, the destination port does not forward any monitored traffic. What is the most likely cause?

Accepted Answer

The RSPAN VLAN is not allowed on the trunk links between the switches.. RSPAN requires that the RSPAN VLAN be allowed on all trunk links between the source and destination switches. If the RSPAN VLAN is not allowed on the trunk, the traffic will not reach the destination.

Answer

The destination port is configured as an access port in VLAN 100.

Answer

The source switch does not have the RSPAN VLAN configured as a remote-span VLAN.

Answer

The destination port is not configured with 'monitor session' on the remote switch.

Question 8

CoPP (Control Plane Policing) rate-limit impacts legitimate traffic. Router R1 has CoPP policy applied: 'class-map match-all BGP class-map match-all SSH match protocol bgp match protocol ssh policy-map COPP class BGP police 10000 conform-action transmit exceed-action drop'. Network engineers cannot SSH to R1, but BGP sessions are stable. 'show policy-map control-plane' output shows 'BGP class: 0 packets, 0 bytes' and 'SSH class: 0 packets, 0 bytes'. What is the root cause?

Accepted Answer

The class-map uses 'match-all' instead of 'match-any', causing SSH traffic not to match the class and be dropped by default action.. The class-map uses 'match protocol bgp' and 'match protocol ssh' with match-all, meaning both conditions must be true for a packet to match. SSH packets do not match protocol bgp, so they fall through to the default class, which may have a drop policy. The class-map should be match-any or separate classes for each protocol.

Answer

The police rate is too low for SSH traffic; need to increase.

Answer

ACL on the interface blocks SSH before CoPP is applied.

Answer

CoPP is applied to the wrong direction; should be input.

Question 9

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

Accepted Answer

The ERSPAN session is missing a tunnel interface configuration.. ERSPAN requires a tunnel interface to encapsulate the monitored traffic. Without configuring a tunnel interface, the ERSPAN session cannot encapsulate the packets for transport to the remote destination.

Answer

The monitoring server is not listening on the correct UDP port.

Answer

The source interface is not in the same subnet as the destination IP.

Answer

The ERSPAN session is configured with the wrong source IP address.

Question 10

A network engineer runs the following command on switch SW2:

SW2# show monitor session 2
Session 2
---------
Type : Remote Source Session
Source Ports :
    Both : Gi0/4
Source VLANs :
    RX Only : 100
Destination Ports : Gi0/5
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN source session, and the mirrored traffic is sent to Gi0/5.. This is a remote source session (RSPAN source session). It monitors source port Gi0/4 and source VLAN 100 (RX only), and sends the mirrored traffic to destination port Gi0/5, which is typically configured as a trunk port carrying the RSPAN VLAN. The session is correctly configured for RSPAN.

Answer

The session is an ERSPAN source session because it monitors VLAN 100.

Answer

The session is a local SPAN session with source VLAN.

Answer

The session is misconfigured because source VLANs cannot be combined with source ports.

Question 11

Route summarization blocks specific routes in an MPLS network. Router R1 is a PE router that summarizes routes from a VRF into BGP. Configuration: 'router bgp 65000 address-family ipv4 vrf CUSTOMER network 10.0.0.0 255.255.252.0' and 'aggregate-address 10.0.0.0 255.255.252.0 summary-only'. A specific prefix 10.0.3.0/24 is not reachable from the MPLS core. 'show ip bgp vpnv4 vrf CUSTOMER 10.0.3.0/24' output: 'Not in table'. What is the root cause?

Accepted Answer

The 'summary-only' keyword suppresses more specific routes, so 10.0.3.0/24 is not advertised.. The 'summary-only' keyword in aggregate-address suppresses all more specific routes, including 10.0.3.0/24, from being advertised. This causes the specific prefix to be missing from the BGP table, leading to unreachability if the summary route does not have a valid next-hop or if the specific route is needed for traffic engineering.

Answer

The VRF CUSTOMER does not have the route 10.0.3.0/24 in its routing table.

Answer

The aggregate-address command is missing the 'as-set' keyword, causing routing loops.

Answer

The network statement for 10.0.0.0/22 is missing; need to advertise the aggregate.

Question 12

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

Accepted Answer

The SPAN session is configured to monitor only ingress traffic by default.. By default, SPAN monitors only ingress traffic on the source VLAN. To capture both directions, the command must specify 'both' for the source. The default is 'rx' only.

Answer

The destination port is in a different VLAN than the source VLAN.

Answer

The switch does not support SPAN on VLANs.

Answer

The laptop is not configured to accept tagged traffic.

Question 13

A network engineer runs the following command on switch SW3:

SW3# show monitor session 3
Session 3
---------
Type : Remote Destination Session
Source Ports :
    RX Only : Gi0/6
Destination Ports : Gi0/7
    Encapsulation : Native
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The session is an RSPAN destination session, and traffic from the RSPAN VLAN is received on Gi0/6 and sent to Gi0/7.. This is an RSPAN destination session. It receives mirrored traffic from the RSPAN VLAN via source port Gi0/6 (RX only) and sends it to destination port Gi0/7 for analysis. The source port is typically a trunk port carrying the RSPAN VLAN.

Answer

The session is an ERSPAN destination session because it uses RX only.

Answer

The session is a local SPAN session with source port Gi0/6.

Answer

The session is misconfigured because the destination port has ingress disabled.

Question 14

A network engineer runs the following command to troubleshoot an MPLS Operations issue:

R1# debug mpls ldp transport 10.1.1.1

Output:
*Mar  1 00:01:23.456: LDP: Sent hello to 10.1.1.1 (UDP 646) on GigabitEthernet0/0
*Mar  1 00:01:23.789: LDP: Received hello from 10.1.1.1 (UDP 646) on GigabitEthernet0/0
*Mar  1 00:01:24.012: LDP: Opened TCP connection to 10.1.1.1:646
*Mar  1 00:01:24.345: LDP: Initialization msg sent to 10.1.1.1
*Mar  1 00:01:24.678: LDP: Initialization msg received from 10.1.1.1
*Mar  1 00:01:25.001: LDP: Session with 10.1.1.1:0 (0x1234) is UP

What does this output indicate?

Accepted Answer

LDP session with neighbor 10.1.1.1 is successfully established. The debug output shows the LDP transport session establishment process. The sequence of events indicates a successful LDP session establishment: hello exchange, TCP connection, initialization messages, and session UP.

Answer

LDP discovery via multicast hello failed

Answer

TCP connection to 10.1.1.1 was refused

Answer

LDP session is stuck in initialization state

Question 15

A network engineer runs the following command to verify MPLS LDP label bindings:

R1# show mpls ldp bindings 192.168.1.0 255.255.255.0

Output:
  lib entry: 192.168.1.0/24, rev 8
    local binding:  label: 101
    remote binding: lsr: 10.0.0.2:0, label: 201
    remote binding: lsr: 10.0.0.3:0, label: 301

What does this output indicate?

Accepted Answer

The prefix 192.168.1.0/24 has a local label of 101 and two remote labels from LDP neighbors. The output shows the label bindings for the prefix 192.168.1.0/24 in the Label Information Base (LIB). The local label is 101, and two remote labels (201 from 10.0.0.2, 301 from 10.0.0.3) have been received from LDP neighbors.

Answer

The prefix 192.168.1.0/24 is not reachable via any LDP neighbor

Answer

Label 101 is the only label assigned to this prefix in the network

Answer

The LDP session with 10.0.0.2 is down

Question 16

A network engineer runs the following command to examine MPLS LDP neighbor details:

R1# show mpls ldp neighbor detail

Output:
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.55432
        State: Oper; Msgs sent/rcvd: 123/456; Downstream on demand
        Up time: 1w2d
        LDP discovery sources:
          GigabitEthernet0/0, hello interval: 5 s, targeted: no
        Addresses bound to peer LDP Ident:
          10.0.0.2        10.0.1.2        192.168.1.1

What does this output indicate?

Accepted Answer

The LDP session with 10.0.0.2 is operational and was discovered via link hello on GigabitEthernet0/0. The output shows detailed LDP neighbor information. The session is operational (State: Oper) for 1 week 2 days. The neighbor is directly connected via GigabitEthernet0/0 (non-targeted hello). The peer has multiple addresses bound to its LDP identifier.

Answer

The LDP session is using targeted hello

Answer

The LDP session has been up for 1 minute and 2 seconds

Answer

The neighbor is using downstream-on-demand label advertisement mode

Question 17

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

Accepted Answer

Verify that the RSPAN VLAN is configured with the 'remote-span' command on both switches.. RSPAN requires that the RSPAN VLAN be configured with the 'remote-span' command on all switches that participate. Without this, the VLAN may not be treated as an RSPAN VLAN and traffic may not be forwarded correctly.

Answer

Check that the destination port is not in a shutdown state.

Answer

Ensure that the source interface is not configured with 'no monitor session'.

Answer

Confirm that the trunk between switches is configured as a dot1q trunk.

Question 18

A network engineer runs the following command on router R2:

R2# show monitor session 4
Session 4
---------
Type : ERSPAN Source Session
Status : Admin Enabled
Source Ports :
    Both : Gi0/0
Destination IP : 192.168.1.10
Origin IP : 10.0.0.2
ERSPAN ID : 100

Based on this output, which statement is correct?

Accepted Answer

The ERSPAN session is mirroring traffic from Gi0/0 to IP address 192.168.1.10 using ERSPAN ID 100.. This is an ERSPAN source session. It mirrors traffic from source port Gi0/0 and encapsulates it with an ERSPAN header, sending it to destination IP 192.168.1.10 with origin IP 10.0.0.2 and ERSPAN ID 100. The session is administratively enabled.

Answer

The ERSPAN session is mirroring traffic from IP 192.168.1.10 to Gi0/0.

Answer

The ERSPAN session is using RSPAN encapsulation.

Answer

The ERSPAN session is disabled because the status is 'Admin Enabled'.

Question 19

A network engineer runs the following command to debug MPLS LDP label advertisements:

R1# debug mpls ldp labels

Output:
*Mar  1 00:01:23.456: LDP: Sent label mapping for 192.168.1.0/24, label 101
*Mar  1 00:01:23.789: LDP: Received label mapping for 192.168.2.0/24, label 201
*Mar  1 00:01:24.012: LDP: Sent label mapping for 10.0.0.0/8, label 102
*Mar  1 00:01:24.345: LDP: Received label mapping for 10.0.0.0/8, label 202

What does this output indicate?

Accepted Answer

LDP label bindings are being exchanged between R1 and its LDP neighbor. The debug output shows label mappings being exchanged between LDP peers. R1 is sending its own label bindings (e.g., label 101 for 192.168.1.0/24) and receiving label bindings from its neighbor (e.g., label 201 for 192.168.2.0/24).

Answer

R1 is only receiving label mappings, not sending any

Answer

The LDP session is down

Answer

R1 is using implicit null label for 10.0.0.0/8

Question 20

What is the default hello interval for the Label Distribution Protocol (LDP) on a Cisco IOS-XE router?

Accepted Answer

5 seconds. LDP hello messages are sent every 5 seconds by default on Cisco IOS-XE routers to discover and maintain adjacencies.

Answer

10 seconds

Answer

15 seconds

Answer

3 seconds