300-410 Mock Exam 93 — 25 Questions

Question 1

Examine the following EIGRP configuration on Router R6:

interface GigabitEthernet0/2
 ip hello-interval eigrp 100 15
 ip hold-time eigrp 100 45

What is the effect of these commands?

Accepted Answer

EIGRP will send hello packets every 15 seconds and wait 45 seconds before declaring a neighbor down.. The commands set a non-default hello interval of 15 seconds and a hold time of 45 seconds for EIGRP AS 100 on GigabitEthernet0/2. EIGRP uses the hello interval to determine how often it sends hello packets, and the hold time is the duration the router waits without receiving a hello before declaring the neighbor down. Option A correctly describes this behavior.

Answer

EIGRP will send hello packets every 45 seconds and wait 15 seconds.

Answer

EIGRP will use the default hello interval of 5 seconds and hold time of 15 seconds.

Answer

EIGRP will not form neighbor adjacencies because the hold time is not a multiple of the hello interval.

Question 2

In an extended IPv4 ACL, what is the default action if only a source and destination are specified without a protocol?

Accepted Answer

The command is rejected by the IOS parser.. In an extended IPv4 ACL, the protocol keyword is mandatory. If you omit it, the IOS parser rejects the command because it cannot determine which protocol to filter. The correct syntax requires a protocol (e.g., ip, tcp, udp) after the permit or deny keyword; without it, the parser returns an error.

Answer

The ACL matches all IP traffic.

Answer

The ACL matches only TCP traffic.

Answer

The ACL matches only UDP traffic.

Question 3

DMVPN phase 2 network: spoke-to-spoke tunnels fail. Router Spoke1 has: tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp nhs 10.0.0.1. Router Spoke2 shows: show dmvpn includes Spoke1 in NHRP cache but no spoke-to-spoke tunnel. What is the root cause?

Accepted Answer

The hub is not configured with ip nhrp redirect, preventing shortcut initiation.. In a DMVPN Phase 2 network, spoke-to-spoke tunnels require the hub to send NHRP redirect messages to inform spokes of the shortcut path. Without the 'ip nhrp redirect' command on the hub, spokes will not attempt to build direct tunnels, even if they have each other's NHRP cache entries. This is the root cause because Spoke1 and Spoke2 can see each other in the NHRP cache but lack the trigger to initiate the spoke-to-spoke GRE tunnel.

Answer

Spoke1 and Spoke2 have different NHRP network IDs.

Answer

Spoke1 has a firewall blocking GRE traffic.

Answer

The tunnel mode should be point-to-point for spoke-to-spoke.

Question 4

Drag and drop the steps to troubleshoot EIGRP neighbor adjacency formation into the correct order, from first to last.

Accepted Answer

Verify Layer 1 and Layer 2 connectivity between routers. The correct order ensures that you first verify the physical and data link layer, then check IP connectivity, confirm EIGRP is enabled on the correct interfaces, verify the autonomous system number matches, and finally check for any passive interface configuration that might block adjacency.

Question 5

Which THREE commands are used to troubleshoot and verify device access control when using TACACS+ authentication on a Cisco IOS router? (Choose THREE.)

Accepted Answer

debug tacacs. The 'debug tacacs' command enables real-time logging of TACACS+ authentication, authorization, and accounting transactions, allowing you to observe the exact packets exchanged between the router and the TACACS+ server, including authentication failures or successes. Option B is correct because 'show tacacs' displays the current TACACS+ server statistics, including the number of successful and failed authentication attempts, server status, and the number of pending requests, which is essential for verifying connectivity and performance. Option C is correct because 'test aaa group tacacs+ ' directly tests the TACACS+ authentication process by sending a simulated authentication request to the configured TACACS+ server group, confirming whether the server is reachable and the credentials are valid.

Answer

debug radius authentication

Answer

show aaa method-list

Question 6

A network engineer runs the following command on Router R1:

R1# show ip ospf database external 10.1.1.0

OSPF Router with ID (1.1.1.1) (Process ID 1)

Type-5 AS External Link States (Area 0)

LS age: 120
  Options: (No TOS-capability, DC)
  LS Type: AS External Link
  Link State ID: 10.1.1.0 (External Network Number)
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0x1234
  Length: 36
  Network Mask: /24
        Metric Type: 2 (Larger than any link state path)
        TOS: 0
        Metric: 20
        Forward Address: 0.0.0.0
        External Route Tag: 100

Based on this output, which statement is correct?

Accepted Answer

The route 10.1.1.0/24 is redistributed into OSPF from another protocol with a route-map setting the tag to 100.. The output shows an OSPF Type-5 external LSA for 10.1.1.0/24 with Metric Type 2 and Metric 20. The default metric for redistributed routes in OSPF is 20 for Type 2. The External Route Tag of 100 indicates a redistribution tag, often used for filtering or route-maps.

Answer

The route 10.1.1.0/24 is an OSPF inter-area route from area 0.

Answer

The metric of 20 indicates the route is redistributed with a default metric of 20, which is correct for Type 1 external routes.

Answer

The forward address of 0.0.0.0 indicates that the next hop is the advertising router 2.2.2.2.

Question 7

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show ip eigrp topology 10.10.10.0/24 all-links

P 10.10.10.0/24, 1 successors, FD is 1310720
        via 10.1.1.2 (1310720/1310720), GigabitEthernet0/0
        via 10.1.2.2 (1310720/1310720), GigabitEthernet0/1

What does this output indicate?

Accepted Answer

There are two equal-cost paths to 10.10.10.0/24, and EIGRP will load balance across them.. The output shows two EIGRP routes to 10.10.10.0/24 with identical Feasible Distances (FD) of 1310720, indicating equal-cost paths. EIGRP installs up to four equal-cost routes by default and performs per-destination load balancing across them, so both paths are active and used.

Answer

Only the first path via 10.1.1.2 is installed because the second path has a higher FD.

Answer

The path via 10.1.2.2 is a feasible successor but is not used because it has a higher RD.

Answer

The router has no route to 10.10.10.0/24 because the FD is the same as the RD.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip route vrf CUSTOMER_A

Routing Table: CUSTOMER_A
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
B       10.10.10.0/24 [200/0] via 192.168.1.2, 00:10:00
B       10.20.20.0/24 [200/0] via 192.168.1.2, 00:10:00

R1# show ip bgp vpnv4 vrf CUSTOMER_A
BGP table version is 6, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:1 (default for vrf CUSTOMER_A)
*> 10.10.10.0/24    192.168.1.2              0             0 65001 i
*> 10.20.20.0/24    192.168.1.2              0             0 65001 i
*> 10.30.30.0/24    192.168.1.2              0             0 65001 i

Based on this output, what is the likely issue?

Accepted Answer

A route-map is filtering the route 10.30.30.0/24 from the VRF routing table.. The VRF routing table shows only two routes, but the BGP table shows three routes for the VRF. This indicates that a route-map is filtering one of the routes from being installed in the routing table. The correct answer is that a route-map is filtering the route 10.30.30.0/24.

Answer

The VRF is not properly configured.

Answer

The BGP session is down.

Answer

The route distinguisher is misconfigured.

Question 9

An engineer is troubleshooting an EIGRP issue where a router is not learning a specific route from a neighbor, but other routes from the same neighbor are being learned. The engineer checks the EIGRP topology table and sees that the route is not present. The engineer also checks the neighbor's routing table and confirms that the route exists. What is the most likely cause?

Accepted Answer

A distribute-list in is applied on the local router that filters the specific route.. A distribute-list in applied on the local router can filter specific incoming routes from an EIGRP neighbor while allowing others. Since the neighbor has the route in its routing table and other routes from the same neighbor are learned, the most likely cause is an inbound filter that explicitly denies that particular prefix.

Answer

The neighbor is configured as a stub router.

Answer

The route is a summary route that is being suppressed by the 'summary-address' command.

Answer

The EIGRP metric for the route is too high, so it is not considered feasible.

Question 10

A network uses Control Plane Policing (CoPP) to protect the router. Router R1 has CoPP policy applied that rate-limits all traffic to 1 Mbps. R1 shows: 'show policy-map control-plane' indicates drops for EIGRP packets. R1's EIGRP neighbor R2 is flapping. What is the root cause?

Accepted Answer

The CoPP policy rate-limits EIGRP packets to 1 Mbps, but EIGRP hellos are small and frequent; the rate-limit may still drop them if the policer is not properly configured for burst.. EIGRP hello packets are small and sent frequently (every 5 seconds on most LAN interfaces by default). A CoPP policer that rate-limits all traffic to 1 Mbps without an adequate burst parameter will treat the burst of small hello packets as exceeding the committed burst (Bc), causing drops. These drops prevent EIGRP neighbor keepalives from reaching the control plane, leading to neighbor flapping. The root cause is not the total bandwidth but the policer's inability to accommodate the packet-per-second (PPS) burst of small EIGRP hellos.

Answer

R2 is sending too many EIGRP packets, exceeding the rate-limit.

Answer

R1 has an ACL that blocks EIGRP packets before they reach the control plane.

Answer

The CoPP policy is applied to the wrong interface.

Question 11

A network engineer runs the following command to verify NAT after a fix:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.1        10.1.1.1           192.168.1.1        192.168.1.1
--- 203.0.113.2        10.1.1.2           192.168.1.2        192.168.1.2

What is the most likely configuration?

Accepted Answer

Dynamic NAT without overload, using a pool of addresses.. The output shows two inside local addresses (10.1.1.1 and 10.1.1.2) translated to two different inside global addresses (203.0.113.1 and 203.0.113.2), with no port numbers listed in the 'Pro' column. This indicates a one-to-one mapping without port address translation, which is characteristic of dynamic NAT using a pool of addresses (not overloaded).

Answer

Static NAT for each host.

Answer

PAT with a single address.

Answer

NAT is not configured.

Question 12

A network engineer runs the following command on Router R1:

R1# show route-map TEST
route-map TEST, permit, sequence 10
  Match clauses:
    ip address (access-lists): 100
  Set clauses:
    metric 50
  Policy routing matches: 0 packets, 0 bytes
route-map TEST, deny, sequence 20
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, which statement is correct?

Accepted Answer

The route-map is applied to an interface but no traffic has matched it yet.. The output shows 'Policy routing matches: 0 packets, 0 bytes' for both sequences, which indicates the route-map has been applied to an interface (for policy-based routing) but no traffic has matched any of the match clauses yet. This is the only conclusion that can be drawn from the provided data.

Answer

The route-map is misconfigured because sequence 20 does not have a set clause.

Answer

The route-map will set the metric to 50 for all packets.

Answer

The route-map is applied globally and is affecting all routing decisions.

Question 13

A network engineer is troubleshooting an MPLS L3VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are using eBGP with the CEs. On PE1, the show ip bgp vpnv4 vrf CUSTOMER command shows the route for 10.2.2.0/24 with a next-hop of 192.168.1.2, and the show ip route vrf CUSTOMER command shows the route. However, traffic from CE1 to CE2 fails. The show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 shows the route is received and best, but the show ip bgp vpnv4 vrf CUSTOMER 10.2.2.0/24 command on PE1 also shows the route has the 'r' flag (RIB-failure). What is the most likely cause?

Accepted Answer

There is a static route in the VRF for 10.2.2.0/24 with a lower administrative distance.. A RIB-failure indicates that the route is received and best in BGP but is not installed in the routing table because another route with a lower administrative distance exists. This could be due to a static route or an IGP route for the same prefix in the VRF.

Answer

The route-target import on PE1 is misconfigured.

Answer

The MP-BGP session is not using the loopback interface.

Answer

The VRF on PE1 has a different route-target export.

Question 14

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# debug nhrp

NHRP: Receive Resolution Request via Tunnel0 10.1.1.2, target 192.168.1.1
NHRP: Send Resolution Reply via Tunnel0 to 10.1.1.2, target 192.168.1.1

What does this output indicate?

Accepted Answer

The router is acting as a NHRP server and successfully resolves the NBMA address for the target.. The debug output shows the router receiving a Resolution Request and immediately sending a Resolution Reply, which is the behavior of a Next Hop Resolution Protocol (NHRP) server (or hub) that has a mapping for the target 192.168.1.1. The router successfully resolves the Non-Broadcast Multiple Access (NBMA) address (10.1.1.2) for the target, indicating it is acting as a server in a DMVPN or similar overlay network.

Answer

The router is a NHRP client and is requesting resolution for target 192.168.1.1.

Answer

The router is unable to resolve the target address because it does not have a mapping.

Answer

The NHRP process is failing due to a misconfigured authentication key.

Question 15

Which TWO statements correctly describe the behavior of automatic 6to4 tunneling? (Choose TWO.)

Accepted Answer

The 6to4 prefix is 2002::/16, where the next 32 bits are the IPv4 address of the tunnel source in hexadecimal.. RFC 3056 defines the 6to4 prefix as 2002::/16, and the next 32 bits are the IPv4 address of the tunnel source converted to hexadecimal. This embeds the IPv4 address directly into the IPv6 prefix, allowing automatic tunnel creation without explicit peer configuration.

Answer

6to4 tunnels can use private IPv4 addresses as the tunnel source.

Answer

The 6to4 prefix is 2001::/16, and the IPv4 address is embedded in the interface ID.

Answer

The tunnel interface must be configured with tunnel mode ipv6ip.

Question 16

Which of the following is a mandatory condition for a route to be considered a feasible successor in EIGRP?

Accepted Answer

The reported distance must be less than the feasible distance.. In EIGRP, a feasible successor is a backup route that can be used immediately if the successor fails. The mandatory condition for a route to be considered a feasible successor is that its reported distance (RD) must be less than the feasible distance (FD) of the current successor. This ensures the backup route is loop-free, as per the Diffusing Update Algorithm (DUAL).

Answer

The metric must be equal to the successor's metric.

Answer

The next-hop router must be directly connected.

Answer

The route must be learned from the same AS.

Question 17

A network engineer runs the following command on Router R1:

R1# show snmp host

Host: 192.168.1.100
Port: 162
Timeout: 1.5 seconds
Retries: 3
Version: 2c
Community: PUBLIC

Host: 192.168.1.200
Port: 162
Timeout: 3 seconds
Retries: 5
Version: 3
User: admin
Security level: authPriv

Based on this output, which statement is correct?

Accepted Answer

SNMP traps sent to 192.168.1.200 will be encrypted.. The SNMPv3 security level 'authPriv' for the host at 192.168.1.200 means authentication and privacy (encryption) are both enabled. SNMPv3 with authPriv uses the User-based Security Model (USM) to encrypt the entire SNMP packet payload, including the trap data, using protocols like AES or DES. This ensures that traps sent to 192.168.1.200 are encrypted.

Answer

Both hosts use the same SNMP version.

Answer

The host at 192.168.1.100 uses SNMPv3 with user 'admin'.

Answer

Traps to 192.168.1.200 will be sent with community string 'admin'.

Question 18

Which DHCPv6 option carries the DNS recursive name server information?

Accepted Answer

Option 23 (DNS Recursive Name Server). DHCPv6 Option 23 (DNS Recursive Name Server) is specifically defined in RFC 3646 to carry the IPv6 addresses of DNS recursive name servers to DHCPv6 clients. This is the standard mechanism for IPv6 hosts to learn DNS server addresses via DHCPv6, analogous to DHCPv4 Option 6 for IPv4.

Answer

Option 6 (Domain Name Server)

Answer

Option 24 (Domain Search List)

Answer

Option 21 (SIP Server Domain Name)

Question 19

Which TWO configuration steps are required to enable NETCONF over SSH on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

Issue the command 'netconf ssh' in global configuration mode.. 'netconf ssh' is the command that enables the NETCONF-over-SSH subsystem on a Cisco IOS-XE device, binding the NETCONF protocol to the SSH transport. Option C is correct because 'netconf-yang' in global configuration mode enables the NETCONF YANG data model service, which is a prerequisite for NETCONF operations. Both steps are required: the feature must be enabled, and the SSH transport must be explicitly configured.

Answer

Configure 'netconf-yang' under the 'router' configuration mode.

Answer

Configure 'ip ssh version 2' to ensure SSH is available.

Answer

Issue the command 'netconf' in global configuration mode.

Question 20

A redistribution setup between OSPF and EIGRP is causing a routing loop for subnet 10.1.1.0/24. Router R1 runs OSPF and EIGRP with redistribution. R1's configuration:
router ospf 1
 redistribute eigrp 100 subnets
!
router eigrp 100
 redistribute ospf 1 metric 10000 100 255 1 1500
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip summary-address eigrp 100 10.1.0.0 255.255.255.0
!
Router R2 (EIGRP neighbor) shows:
R2# show ip route 10.1.1.0
Routing entry for 10.1.0.0/24, supernet
  Known via "eigrp 100", distance 90, metric 30720, type internal
  Last update from 10.1.1.1 on GigabitEthernet0/0, 00:00:05 ago
What is the root cause?

Accepted Answer

The summary route 10.1.0.0/24 is less specific and can cause routing loops when combined with redistribution because R2 may send traffic for 10.1.1.0/24 back to R1.. The summary route 10.1.0.0/24 is being advertised via EIGRP, but it is a less specific prefix than the actual /24. When R1 redistributes OSPF into EIGRP, the summary may cause R2 to prefer the summary over a more specific route, and if R2 sends traffic back to R1 for 10.1.1.0/24, R1 might forward it to R2 again if the OSPF route is not present, creating a loop. The summary should match the exact subnet or be more specific to avoid loops.

Answer

The redistribution metric is too high, causing EIGRP to prefer the OSPF route via another path.

Answer

OSPF does not support subnets keyword, so the route is not redistributed correctly.

Answer

EIGRP is not enabled on the interface, so the summary is not advertised.