300-410 Mock Exam 91 — 25 Questions

Question 1

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are established, but traffic between spokes is intermittently dropped. The engineer captures packets and sees that IPsec packets are being fragmented. The tunnel interface MTU is set to 1400 bytes, and the physical interface MTU is 1500 bytes. The engineer also notices that the IPsec transform set uses ESP with AES-256 and SHA-256. What is the most likely cause of the intermittent drops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The tunnel MTU is set too high for the IPsec overhead, causing fragmentation and potential drops.. IPsec adds overhead (ESP header, trailer, and authentication data). With AES-256 and SHA-256, the overhead can be around 50-60 bytes. If the tunnel MTU is set to 1400, the effective payload MTU is lower. Fragmentation can cause drops if the DF bit is set or if intermediate routers drop fragments. The issue is that the tunnel MTU is too high for the IPsec overhead, causing fragmentation.

Answer

The IPsec transform set uses AES-256, which requires more CPU and causes performance drops.

Answer

The physical interface MTU is set to 1500, which is too high for DMVPN.

Answer

The spokes have different IPsec transform sets configured.

Question 2

R1 and R2 are eBGP peers. R1 advertises a summary route 10.0.0.0/8 via aggregate-address 10.0.0.0 255.0.0.0 summary-only. R2 receives the summary but also expects to receive more specific routes (e.g., 10.1.0.0/16) for traffic engineering. R2's BGP table shows only the summary, and the more specific routes are missing. R1's configuration includes: router bgp 65001, network 10.1.0.0 mask 255.255.0.0, and aggregate-address 10.0.0.0 255.0.0.0 summary-only. What is the root cause?

Accepted Answer

The summary-only keyword suppresses all more specific routes, including the network 10.1.0.0/16, from being advertised to R2.. The aggregate-address with summary-only suppresses all more specific routes from being advertised to neighbors. Even though the network 10.1.0.0/16 is injected into BGP, the summary-only keyword causes it to be suppressed from advertisements. To allow the more specific route to be advertised alongside the summary, the summary-only keyword should be removed, or the more specific route should be explicitly permitted via a route-map. The root cause is that summary-only suppresses the more specific routes.

Answer

The network 10.1.0.0/16 is not in the routing table of R1, so it cannot be advertised.

Answer

R2 must have a route-map to accept the more specific route.

Answer

The aggregate-address should be configured with the as-set keyword to include more specifics.

Question 3

Which TWO statements correctly describe the behavior of BGP conditional route injection? (Choose TWO.)

Accepted Answer

The condition for injection is defined by an exist-map, which must match a less specific prefix in the BGP table.. BGP conditional route injection allows a router to inject a more specific prefix into BGP when a condition (the existence of a less specific prefix) is met. The injected route is sourced from a route-map that defines the inject-map, and the condition is checked via an exist-map. The injected route is not automatically redistributed into other protocols unless explicitly configured. The 'show ip bgp neighbors' command does not display injection statistics; instead, 'show ip bgp injected-paths' is used. The injected prefix must be in the BGP table of the injecting router, but not necessarily learned from the neighbor specified in the inject-map.

Answer

The injected route is automatically redistributed into connected and static routes.

Answer

The 'show ip bgp neighbors' command displays the number of injected prefixes per neighbor.

Answer

The injected prefix must be learned from the neighbor specified in the inject-map.

Question 4

Which THREE commands can be used to verify the operation and effectiveness of a CoPP policy on a Cisco IOS router? (Choose THREE.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays the applied policy map for the control plane, including class maps, match criteria, and action statistics (e.g., packets dropped or permitted). This directly verifies that the CoPP policy is active and how it is treating traffic.

Answer

show ip route

Answer

show interfaces

Question 5

An engineer configures OSPFv2 with a route-map to set the metric on redistributed routes. After redistribution, the metric is not being set as expected. Which is the most likely explanation?

Accepted Answer

The route-map does not have a match statement, so it applies to no routes.. When redistributing routes into OSPF, the metric is set using the 'metric' keyword in the redistribution command or via a route-map. However, if the route-map does not explicitly match the routes, the default metric (20 for external type 2) is used. Additionally, if the route-map uses 'set metric' but the redistribution command also has a 'metric' keyword, the route-map overrides the redistribution command.

Answer

The redistribution command uses the 'subnets' keyword, which overrides the route-map.

Answer

The route-map is applied to the wrong direction.

Answer

The OSPF process is configured with 'default-metric' command, which overrides the route-map.

Question 6

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp neighbors 10.1.1.2 advertised-routes
BGP table version is 14, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.0.0.0/24      0.0.0.0                  0         32768 i
*> 192.168.1.0/24   0.0.0.0                  0         32768 i

Total number of prefixes 2

What does this output indicate?

Accepted Answer

R1 is advertising two routes to neighbor 10.1.1.2, both originated locally.. The show bgp neighbors advertised-routes command shows routes that R1 is advertising to neighbor 10.1.1.2. The output lists two prefixes: 10.0.0.0/24 and 192.168.1.0/24. The next hop of 0.0.0.0 indicates these are locally originated routes (e.g., via network statement or redistribution).

Answer

R1 is receiving two routes from neighbor 10.1.1.2.

Answer

R1 is advertising two routes, but one is suppressed due to dampening.

Answer

R1 is advertising two routes, but the neighbor is not receiving them due to filtering.

Question 7

A network engineer runs the following command on Router R8:

R8# show logging | include %LDP-5-NBRCHG

*Mar  1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN
*Mar  1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The LDP session is flapping due to an unstable IGP route to 10.0.0.2.. The output shows LDP neighbor 10.0.0.2 flapping between UP and DOWN. This indicates instability in the LDP session, often due to a flapping IGP route (since LDP depends on IGP reachability), or a misconfiguration of LDP parameters such as hello interval or hold time.

Answer

The MPLS label space is exhausted.

Answer

The router has a mismatched LDP router ID.

Answer

The LDP hello interval is set too high, causing slow detection.

Question 8

Examine the following partial configuration on a PE router:

interface GigabitEthernet0/1
 ip vrf forwarding CUSTOMER-A
 ip address 10.1.1.1 255.255.255.252
!
router bgp 65000
 neighbor 192.168.1.1 remote-as 65000
 neighbor 192.168.1.1 update-source Loopback0
!
 address-family ipv4 vrf CUSTOMER-A
  neighbor 10.1.1.2 remote-as 65001
  neighbor 10.1.1.2 activate
 exit-address-family

What is the effect of this configuration?

Accepted Answer

The eBGP session between PE and CE will be established successfully.. The configuration correctly assigns the interface to a VRF, then in BGP the neighbor under the VRF address-family is activated. However, the neighbor is directly connected on a /30 link, so a remote-as of 65001 is valid for an eBGP session. The configuration is correct and will establish an eBGP session with the CE router.

Answer

The BGP session will fail because the neighbor must be configured under the global BGP process.

Answer

The BGP session will fail because the neighbor remote-as must match the AS of the PE router.

Answer

The BGP session will fail because the update-source is not specified for the VRF neighbor.

Question 9

Which THREE symptoms indicate that Control Plane Policing (CoPP) might be misconfigured or causing connectivity issues? (Choose THREE.)

Accepted Answer

OSPF or BGP neighbors are flapping, with log messages indicating adjacency timeouts.. CoPP is designed to protect the control plane by rate-limiting traffic. If CoPP is misconfigured with overly restrictive policies, it can drop OSPF or BGP hello packets, causing neighbor adjacencies to time out and flap. Log messages showing adjacency timeouts directly point to control plane packet loss, a classic symptom of CoPP misconfiguration.

Answer

CPU utilization is consistently low, and all control plane traffic is passing without drops.

Answer

Throughput on data interfaces increases significantly.

Question 10

Drag and drop the steps to set up a PE-CE BGP session in an MPLS L3VPN into the correct order, from first to last.

Accepted Answer

Configure VRF with route distinguisher and route-target. The correct order starts with defining the VRF and its RD/RT on the PE, then assigning the VRF to the CE-facing interface. After that, the PE interface is configured with an IP address and BGP is enabled in the VRF address-family. Finally, the BGP neighbor is activated under the VRF address-family to establish the PE-CE session.

Question 11

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are established, but traffic between spokes is intermittently dropped. The engineer captures packets and sees that IPsec packets are being fragmented. The tunnel interface MTU is set to 1400 bytes, and the physical interface MTU is 1500 bytes. The engineer also notices that the IPsec transform set uses ESP with AES-256 and SHA-256. What is the most likely cause of the intermittent drops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'snmp-server trap-source' command is missing, causing traps to use an incorrect source IP.. The most likely cause is that the 'snmp-server trap-source' command is missing. Without this command, the router uses the IP address of the outbound interface (e.g., a loopback or WAN interface) as the source for SNMP traps. If the NMS server expects traps from a specific source IP (e.g., the router's management IP), it may drop or ignore them, even though the router can ping the NMS. The 'show snmp' output confirms SNMP is enabled, and the ping test rules out basic reachability, pointing to a source IP mismatch as the root cause.

Answer

The NMS server is not listening on UDP port 162.

Answer

The SNMP community string 'public' is not configured on the router.

Answer

The router's ACL is blocking outbound UDP traffic to port 162.

Question 12

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Accepted Answer

Initiate IKE_SA_INIT exchange. IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.

Question 13

A network uses PBR to route traffic from a specific host (10.1.1.1) through a VPN tunnel (next-hop 10.10.10.2). After a VPN tunnel failure, traffic from this host is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2', but 'show ip route 10.10.10.2' shows a route via a different interface. What is the root cause?

Accepted Answer

The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.. PBR requires the next-hop to be directly reachable (i.e., on a directly connected subnet). If the next-hop is reachable via a route (e.g., through another router), PBR will not use it because it expects a direct connection. In this case, 10.10.10.2 is reachable via a route, not directly connected, so PBR drops the traffic. The solution is to ensure the next-hop is directly connected or use a different next-hop that is directly connected.

Answer

The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.

Answer

The routing table on R1 has a better route to the destination via the VPN tunnel, overriding PBR.

Answer

The VPN tunnel is down, causing the next-hop to be unreachable.

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-EIGRP (match-all)
      200 packets, 12000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: access-group 150
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 200 packets, 12000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime    SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0            13 00:10:00    1   200  0  5

Based on this output, which statement is correct?

Accepted Answer

EIGRP traffic is being rate-limited but no packets are dropped.. The output shows that the CoPP policy 'CoPP-IN' matches EIGRP packets (via access-group 150) and applies a police rate of 16,000 bps. The 'conformed' counter shows 200 packets transmitted, while 'exceeded' and 'violated' counters are zero, indicating no packets have been dropped. The 'show ip eigrp neighbors' output confirms the neighbor is established with an uptime of 10 minutes, so EIGRP traffic is being rate-limited but not dropped, making option B correct.

Answer

EIGRP packets are being dropped, causing neighbor flapping.

Answer

The police rate is set to 8000 bps.

Answer

The EIGRP neighbor is not established.

Question 15

A network engineer configures BGP on router R4:

router bgp 65004
 bgp router-id 4.4.4.4
 neighbor 10.4.4.3 remote-as 65003
 neighbor 10.4.4.3 password BGPsecret
!

What is the effect of the password command?

Accepted Answer

It enables MD5 authentication for the TCP session; the neighbor must also have the same password.. The password command enables MD5 authentication for the TCP connection between BGP peers. Both peers must have the same password; otherwise, the session will not establish.

Answer

It encrypts the BGP updates using the password as a key.

Answer

It sets a simple password that is sent in clear text with each BGP update.

Answer

It has no effect unless the neighbor is configured with the same password.

Question 16

Examine this CoPP configuration:

ip access-list extended COPP-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit icmp any any echo
!
class-map match-all COPP-CLASS
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class COPP-CLASS
  police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is the effect of the police command in class COPP-CLASS?

Accepted Answer

Traffic is limited to 10000 bps with a burst of 1500 bytes; excess traffic is dropped.. The police command in class COPP-CLASS uses a committed information rate (CIR) of 10000 bps, a normal burst (Bc) of 1500 bytes, and an excess burst (Be) of 1500 bytes. The conform-action transmit, exceed-action drop, and violate-action drop ensure that any traffic exceeding the rate and burst limits is dropped, effectively limiting the matched traffic (SSH, Telnet, ICMP echo) to 10000 bps with a burst of 1500 bytes.

Answer

Traffic is limited to 10000 bps with a burst of 3000 bytes; excess traffic is dropped.

Answer

The police command is invalid because it uses three parameters after the rate.

Answer

Traffic is limited to 10000 bps, but the burst values are ignored because they are not configured in bytes.

Question 17

What is the default action for a CoPP policy-map class that does not have an explicit 'police' command?

Accepted Answer

Transmit all packets in that class. In Control Plane Policing (CoPP), if a class within a policy-map does not contain an explicit 'police' command, the default action is to transmit all packets matching that class. This is because CoPP operates on a permit-by-default model; only classes with a configured policer will have traffic rate-limited or dropped. The absence of a police action means no restriction is applied, so packets are allowed through to the control plane.

Answer

Drop all packets in that class

Answer

Log all packets in that class

Answer

Apply the default aggregate policer

Question 18

A network engineer runs the following command on Router R1:

R1# show ip dhcp conflict
IP address       Detection method     Detection time        VRF
192.168.1.20     Ping                 Mar 01 2020 01:00 AM  
192.168.1.21     Gratuitous ARP       Mar 01 2020 01:05 AM

Based on this output, what is the problem?

Accepted Answer

The DHCP server has detected IP address conflicts, meaning another device on the network is using the same IP addresses.. The `show ip dhcp conflict` command displays IP addresses that the DHCP server has detected as already in use on the network. The detection methods (Ping and Gratuitous ARP) confirm that another device is responding to these addresses, indicating a conflict. This output directly shows that the DHCP server is functioning but has identified conflicts, meaning another host is using the same IP addresses.

Answer

The DHCP server is working normally; conflicts are automatically resolved.

Answer

The DHCP server is not responding to client requests.

Answer

The DHCP pool is misconfigured with overlapping subnets.

Question 19

An engineer is troubleshooting a BGP route advertisement issue. Which TWO commands can be used to verify whether a prefix is being advertised to a specific BGP neighbor? (Choose TWO.)

Accepted Answer

show ip bgp . To verify BGP advertisement to a neighbor, 'show ip bgp neighbors advertised-routes' shows all routes advertised to that neighbor. 'show ip bgp ' includes an entry for each neighbor the route is advertised to. 'show ip bgp neighbors routes' shows routes received from the neighbor, not advertised. 'debug ip bgp updates' is a debug command, not a verification command. 'show ip bgp summary' shows neighbor states and counts, not specific prefix advertisement.

Answer

show ip bgp neighbors <neighbor> routes

Answer

debug ip bgp updates

Answer

show ip bgp summary

Question 20

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

Accepted Answer

It specifies the action for packets that exceed both the conform rate and the excess burst.. In a Control Plane Policing (CoPP) policy, the 'violate-action' parameter in the police command specifies the action taken for packets that exceed both the conform rate and the excess burst (i.e., packets that are beyond the peak rate). This is part of a three-color policer (conform, exceed, violate), where violate-action handles the most severe traffic violations, such as dropping or remarking packets that exceed the excess burst.

Answer

It specifies the action for packets that exceed the conform rate but are within the excess burst.

Answer

It specifies the action for packets that are below the conform rate.

Answer

It is only used in two-rate policers and is ignored in single-rate policers.