300-410 Mock Exam 92 — 25 Questions

Question 1

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel over IPsec. The GRE tunnel is up/up, but the routing protocol (EIGRP) running over the GRE tunnel is not forming an adjacency. The engineer checks the tunnel configuration and sees that the tunnel source and destination are correct. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The crypto map access list does not match GRE protocol (47) traffic.. For a GRE over IPsec tunnel, the GRE tunnel must be protected by the crypto map. If the crypto map is applied to the physical interface but the GRE tunnel traffic is not matched by the crypto map's access list, the GRE packets will be sent unencrypted and the remote router will drop them, preventing the routing protocol from forming an adjacency.

Answer

The EIGRP hello timer is set too high.

Answer

The tunnel interface is not configured with an IP address.

Answer

The IPsec transform set does not include ESP encryption.

Question 2

An engineer applies the following configuration to an interface:

interface GigabitEthernet0/5
 ipv6 dhcp guard attach-policy DHCP_GUARD
 ipv6 snooping database file nvram:ipv6-snoop.db

Which statement is true?

Accepted Answer

The DHCP guard policy is applied to the interface, and the snooping database is stored in NVRAM.. The 'ipv6 dhcp guard attach-policy DHCP_GUARD' command applies the DHCP Guard policy to the interface, and the 'ipv6 snooping database file nvram:ipv6-snoop.db' command configures the snooping database to be stored in NVRAM. These two commands operate independently; the DHCP Guard policy is enforced immediately upon attachment, regardless of the database's presence or population state.

Answer

The DHCP guard policy is applied only if the snooping database is present.

Answer

The interface will not forward any DHCP messages until the database is populated.

Answer

The snooping database is used to validate DHCP server messages.

Question 3

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic | include tunnel

0 tunnel packets received
  0 tunnel packets sent
  0 tunnel packets dropped

Based on this output, what can be concluded?

Accepted Answer

The tunnel is not carrying any IPv6 traffic.. The 'show ipv6 traffic | include tunnel' command filters the output to show only lines containing 'tunnel'. The counters for packets received, sent, and dropped are all zero, which indicates that no IPv6 packets have been encapsulated or decapsulated by any tunnel interface. This means the tunnel is not carrying any IPv6 traffic, making option B correct.

Answer

The tunnel is passing traffic normally.

Answer

The tunnel is dropping all packets.

Answer

The tunnel is using IPsec encryption.

Question 4

Which statement about the Next Hop Resolution Protocol (NHRP) in DMVPN is correct regarding the purpose of NHRP Registration Request packets?

Accepted Answer

They are used to register the spoke's tunnel IP and NBMA address with the hub.. NHRP Registration Request packets are sent from spoke routers to the hub to register their tunnel IP address (NHS) and corresponding NBMA address. This allows the hub to build a mapping database for forwarding.

Answer

They are used to resolve the NBMA address of a destination tunnel IP address.

Answer

They are used to purge outdated NHRP cache entries on the hub.

Answer

They are used to establish an IPsec security association between spokes.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-SET

R1# show route-map PBR-SET
route-map PBR-SET, permit, sequence 10
  Match clauses:
    ip address (access-lists): 160
  Set clauses:
    ip next-hop 192.168.1.2
    ip tos 184
  Policy routing matches: 300 packets, 24000 bytes

R1# show access-lists 160
Extended IP access list 160
    10 permit ip 10.0.0.0 0.255.255.255 any

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.0.0.1/24

Based on this output, a packet from source 10.0.0.5 to destination 8.8.8.8 arrives on GigabitEthernet0/0. What is the most likely behavior?

Accepted Answer

The packet is forwarded to 192.168.1.2 with the ToS field set to 184.. The packet matches ACL 160 (source 10.0.0.0/8). The route map sets both next-hop and ToS. The next-hop 192.168.1.2 must be reachable for PBR to apply. Assuming it is reachable (not shown but implied by matches), the packet will be forwarded to 192.168.1.2 with ToS set to 184 (which is 0xB8, or IP precedence 5, DSCP 46).

Answer

The packet is forwarded using the routing table because the next-hop is not specified correctly.

Answer

The packet is dropped because the ToS value is invalid.

Answer

The packet is forwarded to 192.168.1.2 but the ToS is not changed.

Question 6

An engineer is troubleshooting an EIGRP network where some routers are not learning all routes, and suspects a route filtering issue. Which TWO statements about EIGRP route filtering are true? (Choose TWO.)

Accepted Answer

A distribute-list configured under the EIGRP process using an ACL will filter routes based on the source IP address of the EIGRP update, not the route prefix.. A is correct because a distribute-list using an ACL matches the source IP of the EIGRP update, not the route prefix. B is correct because a prefix-list can use ge and le operators to match both prefix and prefix length. C is false because an outbound distribute-list filters routes before sending to neighbors, not local installation. D is false because an interface-specific distribute-list takes precedence over a process-level one. E is false because the distance command sets administrative distance; while a value of 255 prevents route installation, it is not considered a route filtering method in the context of EIGRP distribute-lists. Thus, only A and B are true.

Answer

An outbound distribute-list on an EIGRP router will prevent the router from installing filtered routes in its own routing table.

Answer

If a distribute-list is applied both at the EIGRP process level and on a specific interface, the process-level distribute-list takes precedence for that interface.

Answer

The 'distance' command configured under EIGRP can be used to filter routes by setting the administrative distance to 255, which prevents the route from being installed.

Question 7

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp interfaces detail

Interface GigabitEthernet0/0
  EIGRP interface state: Enabled, Up
  Hello interval: 5 sec, Hold time: 15 sec
  Split horizon: Enabled
  Next multicast: 0.0.0.0, Next update: 0.0.0.0
  Bandwidth: 10000 Kbit, Delay: 100 us
  Reliability: 255/255, Load: 1/255, MTU: 1500
  Packets sent: 100, received: 95
  Authentication: MD5, key chain: EIGRP-KEY
  Passive interface: No

What does this output indicate?

Accepted Answer

EIGRP is using MD5 authentication with key chain EIGRP-KEY, and the interface is actively sending and receiving EIGRP packets.. The output shows the interface is enabled and up, with MD5 authentication configured using key chain EIGRP-KEY. The 'Packets sent: 100, received: 95' indicates active packet exchange, and 'Passive interface: No' confirms hellos are being sent. This means EIGRP is actively sending and receiving packets with MD5 authentication.

Answer

EIGRP is configured as a passive interface, so no hellos are sent.

Answer

Split horizon is disabled, allowing route advertisement back to the source.

Answer

The interface is using plain-text authentication.

Question 8

A network engineer runs the following command on Router R1:

R1# show bgp neighbors 10.1.12.2 advertised-routes
BGP table version is 15, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      10.1.12.2                0             0 65002 i

Total number of prefixes 2

Based on this output, what can be concluded about the route 10.2.2.0/24?

Accepted Answer

The route 10.2.2.0/24 is being advertised back to the neighbor from which it was learned, which is incorrect.. The route 10.2.2.0/24 is being advertised to the neighbor 10.1.12.2 with next hop 10.1.12.2 itself. This indicates that R1 is advertising a route it learned from the same neighbor back to it, which is a classic case of BGP split-horizon or route advertisement causing a potential loop. However, since it is advertised, it may be due to missing AS-path filtering or a misconfiguration.

Answer

The route 10.2.2.0/24 is locally originated.

Answer

The route 10.2.2.0/24 has a weight of 0.

Answer

The route 10.2.2.0/24 is not valid.

Question 9

Examine the following configuration snippet:
```
interface GigabitEthernet0/0
 ip access-group BLOCK_TELNET out
!
ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
```
What is the effect of applying this ACL outbound on GigabitEthernet0/0?

Accepted Answer

It blocks Telnet traffic leaving the interface, but permits all other IP traffic.. The ACL is applied outbound on GigabitEthernet0/0, meaning it filters traffic as it leaves the interface. The first rule denies TCP traffic destined for port 23 (Telnet), and the second rule permits all other IP traffic. Therefore, Telnet sessions initiated from inside the network and exiting this interface are blocked, while all other traffic is allowed.

Answer

It blocks Telnet traffic entering the interface from the network.

Answer

It permits Telnet traffic and blocks all other IP traffic.

Answer

It has no effect because the ACL is missing a sequence number.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)
                       Xmit Queue   Mean   Pacing Time   Multicast    Pending
Interface        Peers  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0              1       0/0       12       0/10         50           0
Gi0/1              1       0/0       15       0/10         50           0
Gi0/2              1       0/0       18       0/10         50           0
Gi0/3              1       0/0       20       0/10         50           0
Gi0/4              0       0/0        0       0/10         50           0

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/4 has no EIGRP neighbor, which may indicate a configuration issue or lack of connectivity.. The output shows that interface Gi0/4 has 0 peers, while all other interfaces have 1 peer. In EIGRP, a peer count of 0 indicates that no neighbor adjacency has been formed on that interface. This could be due to a configuration mismatch (e.g., different AS numbers, passive interface, or authentication) or a Layer 1/2 connectivity issue. Therefore, option A is correct.

Answer

All interfaces have at least one EIGRP neighbor.

Answer

The mean SRTT on Gi0/2 is 18 ms, which is too high and indicates a problem.

Answer

The pending routes count of 0 on all interfaces indicates a routing loop.

Question 11

A VRF-aware network uses route leaking between VRF A and VRF B. After configuring Flexible NetFlow to monitor traffic in VRF A, some routes that were previously leaked to VRF B disappear. Router R1 has: ip route vrf A 10.0.0.0 255.0.0.0 Null0. route-map LEAK permit 10 match ip address prefix-list GLOBAL. The prefix-list GLOBAL permits 10.0.0.0/8. The flow monitor is applied to the VRF A interface. What is the root cause?

Accepted Answer

The flow monitor is configured with a match ip address prefix-list that references the same prefix-list as the route-map, but the flow monitor's action is to drop packets matching that prefix, causing the route to be withdrawn.. Flexible NetFlow is a traffic monitoring tool and does not affect routing tables, route leaking, or cause route withdrawal. The scenario described is not technically valid; applying a flow monitor cannot cause routes to disappear. None of the provided options offer a correct root cause.

Answer

The route-map LEAK is also applied to the flow monitor as a filter, and the flow monitor's match statement is misconfigured to deny the route, preventing the route from being leaked.

Answer

The VRF A interface has a flow monitor applied that uses a flow record with the 'vrf' field, causing the router to ignore the route leaking configuration.

Answer

The route leaking configuration requires a next-hop that is not reachable due to the flow monitor consuming bandwidth.

Question 12

An OSPF network has a multi-access link between routers R1 and R2. R1 is configured with 'ip ospf network point-to-point' on the interface, while R2 uses the default broadcast network type. R1 shows: 'show ip ospf neighbor' lists R2 as FULL/DR, but R2 shows: 'show ip ospf neighbor' lists R1 as FULL/DROTHER. Traffic from R1 to R2's loopback is fine, but from R2 to R1's loopback is intermittent. What is the root cause?

Accepted Answer

R1's point-to-point configuration disables DR/BDR election, but R2 still expects it, causing R1 to ignore R2's LSUs.. R1's 'ip ospf network point-to-point' command disables DR/BDR election on its interface, meaning R1 will not participate in the election and will not form a full adjacency with a DR or BDR. However, R2, using the default broadcast network type, expects a DR/BDR election and elects itself as DR (likely due to higher router ID). R1 sees R2 as FULL/DR because R1 still receives Hellos and forms a neighbor relationship, but R1 ignores LSUs from R2 because R1's point-to-point logic does not recognize the DR as a valid next hop for flooding, causing intermittent reachability to R1's loopback.

Answer

R2's DR election is incorrect because it has a higher router ID, but R1 should be the DR.

Answer

R1's interface has an MTU mismatch that causes OSPF packets to be dropped.

Answer

R2 has a firewall that blocks OSPF packets from R1.

Question 13

Which TWO statements about the 'ip nat outside source' feature are true? (Choose TWO.)

Accepted Answer

It translates the source IP address of packets arriving on an interface configured as 'ip nat outside'.. The 'ip nat outside source' command translates the source IP address of packets that arrive on an interface configured as 'ip nat outside'. This is used when an external host's source address needs to be translated to a different address, typically to allow inside routers to route return traffic to a private address that the external host is mapped to.

Answer

It requires the 'overload' keyword to perform Port Address Translation.

Answer

It translates the destination IP address of packets leaving the inside network.

Answer

The translation is unidirectional; return traffic is not translated back.

Question 14

What is the default BGP keepalive interval and hold time for eBGP peers in Cisco IOS?

Accepted Answer

Keepalive 60 seconds, hold time 180 seconds. The default keepalive interval is 60 seconds, and the hold time is 180 seconds (three times the keepalive).

Answer

Keepalive 30 seconds, hold time 90 seconds

Answer

Keepalive 10 seconds, hold time 30 seconds

Answer

Keepalive 120 seconds, hold time 360 seconds

Question 15

Which THREE commands can be used to verify IPv6 First Hop Security (FHS) bindings or operations? (Choose THREE.)

Accepted Answer

show ipv6 neighbors. The 'show ipv6 neighbors' command displays the IPv6 neighbor cache, which is populated by the Neighbor Discovery Protocol (NDP). In IPv6 FHS, this cache is used to verify bindings between IPv6 addresses and MAC addresses, and it is directly affected by features like RA Guard and ND Inspection, which monitor and filter NDP messages to ensure only legitimate neighbors are learned.

Answer

show ipv6 route

Answer

show ipv6 traffic

Question 16

Which DHCPv6 message is used by a server to respond to a SOLICIT with available configuration parameters?

Accepted Answer

ADVERTISE. In DHCPv6, when a client sends a SOLICIT message to discover available DHCPv6 servers, each server that can provide configuration parameters responds with an ADVERTISE message. This ADVERTISE message contains the server's preference and available configuration options, allowing the client to select the appropriate server. This process is defined in RFC 8415 and mirrors the DHCPv4 OFFER step.

Answer

REPLY

Answer

RECONFIGURE

Answer

INFORMATION-REQUEST

Question 17

A network engineer configures a DMVPN spoke with the following:

interface Tunnel0
 ip address 10.0.0.3 255.255.255.0
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map 10.0.0.1 192.168.1.1
 ip nhrp map multicast 192.168.1.1
!

What will happen when the spoke tries to send traffic to another spoke (10.0.0.4)?

Accepted Answer

The spoke will send traffic directly to 10.0.0.4 if it has a cached NHRP mapping, otherwise through the hub.. In DMVPN Phase 2/3, spokes initially send traffic through the hub. The hub then uses NHRP redirect (if configured) to tell the spoke to establish a direct tunnel. Without NHRP redirect on the hub, traffic always goes through the hub.

Answer

The spoke will always send traffic through the hub because of the static multicast map.

Answer

The spoke will send traffic directly to 10.0.0.4 without using the hub.

Answer

The spoke will drop the traffic because it does not have a route to 10.0.0.4.

Question 18

A network engineer runs the following command to troubleshoot a Route Redistribution issue:

R1# debug ip ospf adj

And sees the following output:

*Mar  1 00:20:11.456: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1
*Mar  1 00:20:11.457: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1

What does this output indicate?

Accepted Answer

OSPF authentication is misconfigured; the neighbor is not using authentication while this router is.. The debug ip ospf adj output shows authentication type mismatch. The router expects type 1 (plaintext authentication) but the received packet has type 0 (no authentication). This prevents the OSPF adjacency from forming, which would affect route redistribution if OSPF is not learning routes.

Answer

OSPF adjacency is forming successfully with authentication.

Answer

OSPF is redistributing routes correctly but authentication is failing.

Answer

The OSPF process is using MD5 authentication and the neighbor is using plaintext.

Question 19

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:02:00   40   200  0  5

Based on this output, what is the most likely problem?

Accepted Answer

The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.. The EEM policy EIGRP_Neighbor_Down is registered, but the EIGRP neighbor is present with an uptime of 2 minutes. The correct answer is that the EEM policy has not been triggered because the neighbor is up; however, the policy is ready to act if the neighbor goes down.

Answer

The EIGRP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 20

A network engineer runs the following command to troubleshoot an MPLS Operations issue:

R1# debug mpls ldp transport 10.1.1.1

Output:
*Mar  1 00:01:23.456: LDP: Sent hello to 10.1.1.1 (UDP 646) on GigabitEthernet0/0
*Mar  1 00:01:23.789: LDP: Received hello from 10.1.1.1 (UDP 646) on GigabitEthernet0/0
*Mar  1 00:01:24.012: LDP: Opened TCP connection to 10.1.1.1:646
*Mar  1 00:01:24.345: LDP: Initialization msg sent to 10.1.1.1
*Mar  1 00:01:24.678: LDP: Initialization msg received from 10.1.1.1
*Mar  1 00:01:25.001: LDP: Session with 10.1.1.1:0 (0x1234) is UP

What does this output indicate?

Accepted Answer

LDP session with neighbor 10.1.1.1 is successfully established. The debug output shows the LDP transport session establishment process. The sequence of events indicates a successful LDP session establishment: hello exchange, TCP connection, initialization messages, and session UP.

Answer

LDP discovery via multicast hello failed

Answer

TCP connection to 10.1.1.1 was refused

Answer

LDP session is stuck in initialization state