300-410 Mock Exam 90 — 25 Questions

Question 1

Which THREE symptoms indicate that Control Plane Policing (CoPP) might be misconfigured or causing connectivity issues? (Choose THREE.)

Accepted Answer

OSPF or BGP neighbors are flapping, with log messages indicating adjacency timeouts.. CoPP is designed to protect the control plane by rate-limiting traffic. If CoPP is misconfigured with overly restrictive policies, it can drop OSPF or BGP hello packets, causing neighbor adjacencies to time out and flap. Log messages showing adjacency timeouts directly point to control plane packet loss, a classic symptom of CoPP misconfiguration.

Answer

CPU utilization is consistently low, and all control plane traffic is passing without drops.

Answer

Throughput on data interfaces increases significantly.

Question 2

Drag and drop the steps to set up a PE-CE BGP session in an MPLS L3VPN into the correct order, from first to last.

Accepted Answer

Configure VRF with route distinguisher and route-target. The correct order starts with defining the VRF and its RD/RT on the PE, then assigning the VRF to the CE-facing interface. After that, the PE interface is configured with an IP address and BGP is enabled in the VRF address-family. Finally, the BGP neighbor is activated under the VRF address-family to establish the PE-CE session.

Question 3

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Accepted Answer

Initiate IKE_SA_INIT exchange. IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.

Question 4

A network uses PBR to route traffic from a specific host (10.1.1.1) through a VPN tunnel (next-hop 10.10.10.2). After a VPN tunnel failure, traffic from this host is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2', but 'show ip route 10.10.10.2' shows a route via a different interface. What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.. PBR requires the next-hop to be directly reachable (i.e., on a directly connected subnet). If the next-hop is reachable via a route (e.g., through another router), PBR will not use it because it expects a direct connection. In this case, 10.10.10.2 is reachable via a route, not directly connected, so PBR drops the traffic. The solution is to ensure the next-hop is directly connected or use a different next-hop that is directly connected.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.

Answer

The routing table on R1 has a better route to the destination via the VPN tunnel, overriding PBR.

Answer

The VPN tunnel is down, causing the next-hop to be unreachable.

Question 5

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-EIGRP (match-all)
      200 packets, 12000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: access-group 150
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 200 packets, 12000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime    SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0            13 00:10:00    1   200  0  5

Based on this output, which statement is correct?

Accepted Answer

EIGRP traffic is being rate-limited but no packets are dropped.. The output shows that the CoPP policy 'CoPP-IN' matches EIGRP packets (via access-group 150) and applies a police rate of 16,000 bps. The 'conformed' counter shows 200 packets transmitted, while 'exceeded' and 'violated' counters are zero, indicating no packets have been dropped. The 'show ip eigrp neighbors' output confirms the neighbor is established with an uptime of 10 minutes, so EIGRP traffic is being rate-limited but not dropped, making option B correct.

Answer

EIGRP packets are being dropped, causing neighbor flapping.

Answer

The police rate is set to 8000 bps.

Answer

The EIGRP neighbor is not established.

Question 6

A network engineer configures BGP on router R4:

router bgp 65004
 bgp router-id 4.4.4.4
 neighbor 10.4.4.3 remote-as 65003
 neighbor 10.4.4.3 password BGPsecret
!

What is the effect of the password command?

Accepted Answer

It enables MD5 authentication for the TCP session; the neighbor must also have the same password.. The password command enables MD5 authentication for the TCP connection between BGP peers. Both peers must have the same password; otherwise, the session will not establish.

Answer

It encrypts the BGP updates using the password as a key.

Answer

It sets a simple password that is sent in clear text with each BGP update.

Answer

It has no effect unless the neighbor is configured with the same password.

Question 7

Examine this CoPP configuration:

ip access-list extended COPP-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit icmp any any echo
!
class-map match-all COPP-CLASS
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class COPP-CLASS
  police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is the effect of the police command in class COPP-CLASS?

Accepted Answer

Traffic is limited to 10000 bps with a burst of 1500 bytes; excess traffic is dropped.. The police command in class COPP-CLASS uses a committed information rate (CIR) of 10000 bps, a normal burst (Bc) of 1500 bytes, and an excess burst (Be) of 1500 bytes. The conform-action transmit, exceed-action drop, and violate-action drop ensure that any traffic exceeding the rate and burst limits is dropped, effectively limiting the matched traffic (SSH, Telnet, ICMP echo) to 10000 bps with a burst of 1500 bytes.

Answer

Traffic is limited to 10000 bps with a burst of 3000 bytes; excess traffic is dropped.

Answer

The police command is invalid because it uses three parameters after the rate.

Answer

Traffic is limited to 10000 bps, but the burst values are ignored because they are not configured in bytes.

Question 8

What is the default action for a CoPP policy-map class that does not have an explicit 'police' command?

Accepted Answer

Transmit all packets in that class. In Control Plane Policing (CoPP), if a class within a policy-map does not contain an explicit 'police' command, the default action is to transmit all packets matching that class. This is because CoPP operates on a permit-by-default model; only classes with a configured policer will have traffic rate-limited or dropped. The absence of a police action means no restriction is applied, so packets are allowed through to the control plane.

Answer

Drop all packets in that class

Answer

Log all packets in that class

Answer

Apply the default aggregate policer

Question 9

A network engineer runs the following command on Router R1:

R1# show ip dhcp conflict
IP address       Detection method     Detection time        VRF
192.168.1.20     Ping                 Mar 01 2020 01:00 AM  
192.168.1.21     Gratuitous ARP       Mar 01 2020 01:05 AM

Based on this output, what is the problem?

Accepted Answer

The DHCP server has detected IP address conflicts, meaning another device on the network is using the same IP addresses.. The `show ip dhcp conflict` command displays IP addresses that the DHCP server has detected as already in use on the network. The detection methods (Ping and Gratuitous ARP) confirm that another device is responding to these addresses, indicating a conflict. This output directly shows that the DHCP server is functioning but has identified conflicts, meaning another host is using the same IP addresses.

Answer

The DHCP server is working normally; conflicts are automatically resolved.

Answer

The DHCP server is not responding to client requests.

Answer

The DHCP pool is misconfigured with overlapping subnets.

Question 10

An engineer is troubleshooting a BGP route advertisement issue. Which TWO commands can be used to verify whether a prefix is being advertised to a specific BGP neighbor? (Choose TWO.)

Accepted Answer

show ip bgp . To verify BGP advertisement to a neighbor, 'show ip bgp neighbors advertised-routes' shows all routes advertised to that neighbor. 'show ip bgp ' includes an entry for each neighbor the route is advertised to. 'show ip bgp neighbors routes' shows routes received from the neighbor, not advertised. 'debug ip bgp updates' is a debug command, not a verification command. 'show ip bgp summary' shows neighbor states and counts, not specific prefix advertisement.

Answer

show ip bgp neighbors <neighbor> routes

Answer

debug ip bgp updates

Answer

show ip bgp summary

Question 11

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

Accepted Answer

It specifies the action for packets that exceed both the conform rate and the excess burst.. In a Control Plane Policing (CoPP) policy, the 'violate-action' parameter in the police command specifies the action taken for packets that exceed both the conform rate and the excess burst (i.e., packets that are beyond the peak rate). This is part of a three-color policer (conform, exceed, violate), where violate-action handles the most severe traffic violations, such as dropping or remarking packets that exceed the excess burst.

Answer

It specifies the action for packets that exceed the conform rate but are within the excess burst.

Answer

It specifies the action for packets that are below the conform rate.

Answer

It is only used in two-rate policers and is ignored in single-rate policers.

Question 12

A network engineer is troubleshooting a connectivity issue between two branches connected via a WAN link. Router R1 (10.1.0.0/16) is summarizing its directly connected subnets (10.1.1.0/24, 10.1.2.0/24, 10.1.3.0/24) as a single 10.1.0.0/16 route to Router R2 via EIGRP. Users at R2 report that they cannot reach the 10.1.4.0/24 subnet, which was recently added to R1. What is the most likely cause of the problem?

Accepted Answer

The new subnet 10.1.4.0/24 was not advertised because the summary address command suppresses more specific routes, but the summary itself is not being generated due to a missing network statement under the EIGRP process.. The summary route 10.1.0.0/16 includes the new subnet 10.1.4.0/24, but the issue indicates that the summary is not being updated or is too broad, causing a mismatch. The most likely cause is that the summary address was configured manually and does not automatically include new subnets unless the summary range is adjusted.

Answer

The summary route 10.1.0.0/16 was configured manually, and the new subnet 10.1.4.0/24 is not within the summary range because the mask is too specific.

Answer

The WAN link is down, causing R2 to lose the summary route.

Answer

The engineer forgot to configure the summary address on the interface facing R2 for the new subnet.

Question 13

An engineer configures route redistribution from EIGRP into OSPF. The redistributed routes appear in the OSPF database but are not installed in the routing table of other OSPF routers. Which is the most likely explanation?

Accepted Answer

The redistributed routes have a metric of 0, which OSPF treats as unreachable.. When redistributing into OSPF, a seed metric must be specified. If not, OSPF defaults to a metric of 20 for external type 2 routes, but if the metric-type is set to 1, the default metric is 0, which may cause the route to be considered unreachable or not installed.

Answer

The OSPF process on the redistributing router does not have a router-id configured.

Answer

The administrative distance of OSPF external routes (110) is higher than EIGRP (90), so the EIGRP routes are preferred.

Answer

The redistribute command is missing the subnets keyword, causing only classful routes to be redistributed.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip route 10.1.1.0
Routing entry for 10.1.1.0/24
  Known via "eigrp 100", distance 170, metric 2560000
  Redistributing via eigrp 100
  Advertised by eigrp 100 (self originated)
  Last update from 10.2.2.2 on GigabitEthernet0/1, 00:00:10 ago
  Routing Descriptor Blocks:
  * 10.2.2.2, from 10.2.2.2, 00:00:10 ago, via GigabitEthernet0/1
      Route metric is 2560000, traffic share count is 1
      Total delay is 100 microseconds, minimum bandwidth is 100000 Kbit
      Reliability 255/255, minimum MTU 1500
      Loading 1/255, Hops 1

Based on this output, what is the problem?

Accepted Answer

The route is redistributed into EIGRP from another protocol, as indicated by the distance of 170 and the 'self originated' message.. The output shows a route learned via EIGRP with an administrative distance of 170, which is the default for external EIGRP routes. The route is marked as 'Redistributing via eigrp 100' and 'Advertised by eigrp 100 (self originated)', indicating that this route was redistributed into EIGRP from another protocol. The problem is that the route is both learned and redistributed by the same router, which could cause a routing loop if not filtered.

Answer

The route 10.1.1.0/24 is an internal EIGRP route because the administrative distance is 90.

Answer

The route is learned from a neighbor with a metric of 2560000, which is the default for redistributed routes.

Answer

The route is not being advertised to any EIGRP neighbors because it is marked as 'self originated'.

Question 15

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check tunnel interface status with 'show ipv6 interface brief'. The troubleshooting process follows a logical progression: first verify the tunnel interface is up/up, then check the IPv6 routing table for the destination prefix, inspect the tunnel source and destination IPs for correctness, verify IPv4 reachability to the tunnel destination, and finally examine ACLs or firewall rules that might block GRE protocol 47 traffic.

Question 16

Which TWO statements about the 'ip access-list resequence' command are true? (Choose TWO.)

Accepted Answer

The default starting sequence number for the resequence command is 10, and the default increment is 10.. The default starting sequence number for the 'ip access-list resequence' command is 10, and the default increment is also 10. This allows you to renumber the Access Control Entries (ACEs) within an ACL so that you can later insert new entries between existing ones without having to remove and re-add the entire list.

Answer

The 'ip access-list resequence' command can be applied to both numbered and named ACLs.

Answer

The resequence command changes the order in which ACL entries are evaluated.

Answer

The resequence command can only be used on extended named ACLs, not standard named ACLs.

Question 17

A network engineer runs the following command to verify MPLS L3VPN operation:

R1# show ip route vrf CUSTOMER-A summary

Output:
Route Source    Networks    Subnets    Overhead    Memory (bytes)
connected       2           0          48          288
static          1           0          24          144
ospf 100        5           2          168         1008
bgp 65000       10          3          312         1872
  External: 10, Internal: 0, Local: 0
Total           18          5          552         3312

What does this output indicate?

Accepted Answer

The VRF has 23 total routes. The show ip route vrf summary command provides a summary of routes in the VRF. It shows the number of networks and subnets from each routing source, along with overhead and memory usage. For BGP, it also breaks down external vs internal routes. This output indicates the VRF has 18 networks and 5 subnets total, with BGP as the primary source.

Answer

The VRF has 10 BGP routes

Answer

The VRF is using OSPF as the only IGP

Answer

The VRF has no external BGP routes

Question 18

A network engineer is troubleshooting a sudden drop in NetFlow data on a Cisco router running IOS-XE 17.x. The engineer verifies that 'ip flow-export destination 10.1.1.100 2055' is configured, and the collector is reachable. However, 'show ip flow export' shows zero packets exported. What is the most likely cause?

Accepted Answer

No flow monitor is applied to any interface.. The issue is that NetFlow generation requires at least one monitor or flow record to be applied to an interface. Without a 'ip flow monitor' or 'ip route-cache flow' command on an interface, no flows are created and thus nothing is exported.

Answer

The collector IP address is incorrect.

Answer

The export version is set to 9 but the collector expects version 5.

Answer

The router is in a VRF that is not configured for NetFlow export.

Question 19

Given the following configuration:
```
interface GigabitEthernet0/2
 ip access-group FILTER_SSH in
!
ip access-list extended FILTER_SSH
 permit tcp any host 192.168.1.10 eq 22
 permit udp any host 192.168.1.10 eq 22
```
What is the issue with this ACL?

Accepted Answer

The ACL permits UDP port 22, which is not used by SSH; this could allow unwanted UDP traffic.. The ACL permits both TCP and UDP traffic to destination port 22. SSH uses only TCP port 22; UDP port 22 is not used by SSH. The second permit statement allows any UDP traffic to port 22, which could be unwanted (e.g., UDP-based attacks or non-SSH services). This is the issue.

Answer

The ACL is missing a deny statement at the end to block other traffic.

Answer

The ACL should use the 'established' keyword to allow return traffic.

Answer

The ACL should be applied outbound instead of inbound.

Question 20

A network engineer runs the following command to troubleshoot SNMPv3 group configuration:

R1# show snmp group
group name: admin-group
security model: v3 auth priv
read view: v1default
write view: v1default
notify view: v1default

Group name: monitor-group
security model: v3 auth no priv
read view: v1default
write view: none
notify view: v1default

What does this output indicate?

Accepted Answer

The 'admin-group' requires authentication and encryption, while 'monitor-group' requires only authentication.. The output shows that 'admin-group' uses security model 'v3 auth priv', which requires both authentication and encryption (privacy). 'monitor-group' uses 'v3 auth no priv', which requires authentication but no encryption. This matches option A exactly.

Answer

Both groups require authentication and encryption.

Answer

The 'monitor-group' has read-write access.

Answer

The groups use SNMPv2c security model.