300-410 Mock Exam 96 — 25 Questions

Question 1

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a service provider. The router has a default route pointing to the ISP. Traffic from the ISP is being dropped by uRPF. Which is the most likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Strict mode uRPF does not use the default route for verification unless the 'allow-default' option is enabled.. Strict mode uRPF checks that the source IP of incoming packets has a matching route in the routing table that points back to the same interface. If the router has a default route, it may not match the specific source IP, causing drops. However, the edge case is that the default route is not considered by strict mode unless the 'allow-default' option is configured. Without 'allow-default', strict mode requires a specific route back to the interface.

Answer

The interface is configured with the wrong IP address, causing uRPF to fail.

Answer

uRPF should be configured in loose mode to work with default routes.

Answer

The router has multiple default routes, causing uRPF to fail.

Question 2

What is the default administrative distance for OSPF routes in Cisco IOS?

Accepted Answer

110. OSPF has a default administrative distance (AD) of 110 in Cisco IOS. This value is used by the router to select the best route when multiple routing protocols provide a route to the same destination, with lower AD values being preferred. OSPF's AD of 110 is higher than that of static routes (1) and EIGRP (90/170), but lower than RIP (120) and IS-IS (115).

Answer

90

Answer

100

Answer

120

Question 3

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_CUSTOMER_A and VRF_CUSTOMER_B). The engineer notices that traffic from VRF_CUSTOMER_A is being routed to the wrong next-hop, causing connectivity issues. The 'show ip route vrf VRF_CUSTOMER_A' shows a route to the destination via a next-hop that belongs to VRF_CUSTOMER_B. What is the most likely cause?

Accepted Answer

The 'route-target import' command in VRF_CUSTOMER_A is importing routes from VRF_CUSTOMER_B.. This issue is typically caused by route leaking between VRFs, which can happen if the route-target import/export commands are misconfigured or if there is a shared interface with incorrect VRF assignment.

Answer

The router has a default route that points to the next-hop in VRF_CUSTOMER_B.

Answer

The 'ip cef' command is disabled globally.

Answer

The 'ip vrf forwarding' command is applied to the same physical interface for both VRFs.

Question 4

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp topology 10.1.1.0/24 detail

IP-EIGRP (AS 100): Topology entry for 10.1.1.0/24
  State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072
  Routing Descriptor Blocks:
  10.1.2.2 (GigabitEthernet0/0), from 10.1.2.2, Send flag: 0x0
      Composite metric: (131072/130816), Route is Internal
      Vector metric:
        Minimum bandwidth is 10000 Kbit
        Total delay is 100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
      Originating router: 10.1.2.2
      External data: Not advertised
      Protocol: EIGRP
      Route tag: 0
      Extended community: None

What does this output indicate?

Accepted Answer

The route is learned from a single neighbor and is in a stable state.. The output shows detailed information about the EIGRP topology entry for 10.1.1.0/24. The route is internal, with a single successor via 10.1.2.2. The FD is 131072, and the RD is 130816. The route is in Passive state.

Answer

The route is an external EIGRP route redistributed from another protocol.

Answer

The route has multiple successors and is load-balanced.

Answer

The route is in Active state, meaning a query is in progress.

Question 5

Which SNMPv3 security model provides both authentication and encryption by default?

Accepted Answer

User-based Security Model (USM) with authPriv. SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The User-based Security Model (USM) with the authPriv security level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or CFB-AES). This is the only default combination within SNMPv3 that offers both services, making option B correct.

Answer

Community-based Security Model (CSM)

Answer

View-based Access Control Model (VACM)

Answer

Transport Layer Security (TLS) model

Question 6

A network engineer runs the following command to troubleshoot route redistribution:

R1# debug ip routing
IP: route table insert (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]
IP: route table delete (10.10.10.0/24 via 192.168.1.1, ospf 1) metric [110/20]
IP: route table insert (10.10.10.0/24 via 10.1.1.2, eigrp 100) metric [90/158720]

What does this output indicate?

Accepted Answer

The EIGRP route replaces the OSPF route due to lower administrative distance.. The debug output shows the OSPF route (AD 110) being inserted first, then the EIGRP route (AD 90) being inserted, followed by the deletion of the OSPF route and re-insertion of the EIGRP route. This sequence indicates that the EIGRP route replaces the OSPF route because EIGRP has a lower administrative distance (90 vs. 110), making it more trustworthy. The routing table only keeps the best route based on AD, not metric, when comparing routes from different protocols.

Answer

The router is load-balancing between OSPF and EIGRP routes.

Answer

The OSPF route is preferred due to lower metric.

Answer

Both routes are installed in the routing table.

Question 7

A network engineer runs the following command to verify MPLS LDP discovery sources:

R1# show mpls ldp discovery detail

Output:
  Local LDP Identifier: 10.0.0.1:0
    Discovery Sources:
      Interfaces:
        GigabitEthernet0/0 (hello interval 5 s, targeted hello interval 10 s)
          LDP Id: 10.0.0.2:0, transport address: 10.0.0.2
          Hold time: 15 s (local: 15, peer: 15)
        GigabitEthernet0/1 (hello interval 5 s, targeted hello interval 10 s)
          LDP Id: 10.0.0.3:0, transport address: 10.0.0.3
          Hold time: 15 s (local: 15, peer: 15)

What does this output indicate?

Accepted Answer

R1 has discovered two LDP neighbors via link hellos on two different interfaces. The output shows LDP discovery sources. R1 has discovered two LDP neighbors via link hellos on interfaces GigabitEthernet0/0 and GigabitEthernet0/1. Both neighbors have a hold time of 15 seconds.

Answer

R1 is using targeted hellos only

Answer

R1 has no LDP neighbors

Answer

The LDP session with 10.0.0.2 is down

Question 8

A network engineer runs the following command to troubleshoot IPsec IKE phase 1:

R1# debug crypto isakmp
ISAKMP: (0:0:N/A:0) Starting aggressive mode exchange
ISAKMP: (0:0:N/A:0) processing SA payload
ISAKMP: (0:0:N/A:0) Checking ISAKMP transform 1 against priority 1 policy
ISAKMP: (0:0:N/A:0) encryption 3DES
ISAKMP: (0:0:N/A:0) hash SHA
ISAKMP: (0:0:N/A:0) group 2
ISAKMP: (0:0:N/A:0) auth pre-share
ISAKMP: (0:0:N/A:0) life type in seconds
ISAKMP: (0:0:N/A:0) life duration (basic) of 86400
ISAKMP: (0:0:N/A:0) atts are not acceptable

What does this output indicate?

Accepted Answer

IKE phase 1 fails due to transform set mismatch.. The debug output shows that the ISAKMP transform (3DES, SHA, group 2, pre-share) is being checked against the local policy, and the message 'atts are not acceptable' indicates a mismatch. This means the proposed transform set does not match any configured IKE policy on the responder, causing IKE phase 1 to fail. The failure is specifically due to a transform set mismatch, not authentication or lifetime issues.

Answer

IKE phase 1 is successful; the transform set is accepted.

Answer

IKE phase 1 fails due to authentication failure.

Answer

IKE phase 1 fails due to lifetime mismatch.

Question 9

Consider the following partial configuration on router R6:

flow exporter EXPORTER-3
 destination 192.168.2.200
 source Loopback0
 transport udp 2055
 template data timeout 120
!
flow monitor MONITOR-6
 exporter EXPORTER-3
 record netflow ipv4 original-input
!
interface GigabitEthernet0/6
 ip flow monitor MONITOR-6 input
!

What is the effect of the 'template data timeout 120' command?

Accepted Answer

The router will resend the NetFlow v9 template to the collector every 120 seconds to ensure the collector has the latest template.. This question tests understanding of template refresh timing in NetFlow v9 export.

Answer

The router will wait 120 seconds before sending any flow data after the first template is sent.

Answer

The router will export flow data only if the template has been successfully acknowledged by the collector within 120 seconds.

Answer

The router will store flow data for 120 seconds before exporting to allow batching.

Question 10

A DMVPN network uses PBR to route traffic from spoke routers to specific hubs based on source IP. After a hub failure, traffic from spoke 1 (source 192.168.1.0/24) is being sent to a backup hub, but the backup hub drops the traffic. Router R1 (spoke) shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to next-hop 10.1.1.2 (backup hub). Router R2 (backup hub) shows: 'show ip route 192.168.1.0' returns no route. What is the root cause?

Accepted Answer

The backup hub does not have a route to the source subnet, causing it to drop traffic. Add a static route or enable routing protocol on the backup hub for the spoke subnet.. PBR on the spoke forwards traffic to the backup hub, but the backup hub does not have a route back to the source subnet (192.168.1.0/24). This causes asymmetric routing, where the backup hub drops the traffic because it cannot find a return route. The solution is to ensure the backup hub has a route to the spoke subnet, either via dynamic routing or a static route.

Answer

The PBR route-map on the spoke is missing a 'set ip next-hop verify-availability' command, causing it to use the backup hub even when it is not fully reachable.

Answer

The spoke's routing table has a better route to the destination via the backup hub, overriding PBR.

Answer

The backup hub has a route to the source subnet but with a higher administrative distance, causing it to be ignored.

Question 11

In an iBGP network, router R1 has:
router bgp 65000
 bgp bestpath as-path multipath-relax
 neighbor 10.1.1.2 route-map SET-MED in
route-map SET-MED permit 10
 set metric 50
 neighbor 10.1.1.3 route-map SET-MED2 in
route-map SET-MED2 permit 10
 set metric 100
Router R2 shows:
R2# show ip bgp 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 2
Paths: (2 available, best #2)
  Path #1: via 10.1.1.1, metric 50
  Path #2: via 10.1.1.4, metric 100
R2# show ip route 192.168.1.0
Routing entry for 192.168.1.0/24
  Known via "bgp 65000", distance 200, metric 100
  Last update from 10.1.1.4 00:00:10 Serial0/0/1
R2 is choosing the path with higher metric. What is the root cause?

Accepted Answer

The path with lower MED is from a different AS, so MED is not compared.. BGP best path selection compares MED only if paths come from the same AS. If the paths have different AS_PATH lengths, MED is ignored. The output shows two paths, but the path via 10.1.1.1 might have a different AS_PATH length. The 'bgp bestpath as-path multipath-relax' allows multipath but does not affect MED comparison. The higher metric path is chosen due to a different tie-breaker (e.g., lower neighbor IP).

Answer

The route-map on R1 is misconfigured; it should set metric on the neighbor statement.

Answer

R2 has a higher local preference for the path via 10.1.1.4.

Answer

The 'bgp bestpath as-path multipath-relax' command causes MED to be ignored.

Question 12

Two routers are configured with EIGRP and have a neighbor relationship. One router has a route to 192.168.1.0/24 with metric 100. The other router has a route to the same prefix with metric 200. An engineer configures an offset-list on the first router to increase the metric of 192.168.1.0/24 by 50, expecting the second router to prefer its own route. Unexpectedly, the second router still prefers the first router's route after the offset. Which is the most likely explanation?

Accepted Answer

The offset-list increased the metric from 100 to 150, which is still lower than the second router's metric of 200, so the second router still prefers the first router's route.. The offset-list affects the metric of the route as advertised to the neighbor. However, if the offset-list is applied inbound on the second router, it increases the metric of the received route, making it less preferred. But if the offset-list is applied outbound on the first router, it increases the metric of the route sent to the second router. The second router then compares the received metric (150) with its own metric (200) and still prefers the lower metric (150). The engineer likely applied the offset-list outbound on the first router, but the increase was insufficient to make the second router's route better.

Answer

The offset-list must be applied inbound on the second router to increase the metric of the received route.

Answer

The offset-list command only affects feasible distance, not advertised distance, so the second router ignores it.

Answer

The second router has a higher administrative distance for the route, so it always prefers the first router's route.

Question 13

Which TWO statements about TACACS+ and RADIUS are true? (Choose TWO.)

Accepted Answer

TACACS+ encrypts the entire packet body, including the username and password, using a shared secret.. A is correct because TACACS+ encrypts the entire packet body, including the username and password, using a shared secret. This provides confidentiality for all authentication and authorization data, unlike RADIUS which only encrypts the password field.

Answer

RADIUS encrypts the entire packet payload, including the username and password, using a shared secret.

Answer

TACACS+ uses UDP port 49 by default for communication.

Answer

Both TACACS+ and RADIUS support per-command authorization for exec sessions.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail GigabitEthernet0/1
IP-EIGRP interfaces for process 100

Xmit Queue   Mean   Pacing Time   Multicast    Pending
Interface        Peers  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/1              1       0/0       10       0/10         50           0
  Hello interval is 5 sec
  Next xmit serial <none>
  Un/reliable mcasts: 0/0  Un/reliable ucasts: 0/0
  Mcast exceptions: 0  CR packets: 0  ACKs suppressed: 0
  Retransmissions: 0  Out of sequence: 0
  Authentication mode: none
  Redistribution: redistributed

Based on this output, what is the problem?

Accepted Answer

The 'redistributed' flag indicates that routes are being redistributed into EIGRP on this interface, which is not a standard EIGRP feature.. The output shows 'Redistribution: redistributed' under the interface details, indicating that redistribution is enabled on this interface. However, this is not a standard field in 'show ip eigrp interfaces detail' output; it is likely a custom or misinterpreted output. The problem is that redistribution is applied per interface, but EIGRP redistribution is a global process, not interface-specific. This could cause confusion or misconfiguration.

Answer

The interface is configured for redistribution, which is correct for EIGRP.

Answer

The interface has one EIGRP neighbor, and redistribution is working correctly.

Answer

The output shows that redistribution is enabled, but the interface is not sending hellos.

Question 15

A network administrator notices that SSH access to router R1 from a management station 10.10.10.10 is failing intermittently. R1 has the following configuration: access-list 100 permit tcp 10.10.10.0 0.0.0.255 host 192.168.1.1 eq 22, line vty 0 4 access-class 100 in, and control-plane host control-plane security copp policy-map COPP class MANAGEMENT police cir 8000 bc 1500 conform-action transmit exceed-action drop. The management station is on a different subnet than the management interface. The failure occurs during peak hours. What is the root cause?

Accepted Answer

The CoPP policy is rate-limiting SSH traffic to 8 kbps, and during peak hours, the traffic exceeds this rate, causing drops.. The CoPP policy-map COPP class MANAGEMENT applies a police rate of 8000 bps (8 kbps) with a burst of 1500 bytes to SSH traffic destined for the control plane. During peak hours, the SSH traffic from the management station exceeds this rate, causing packets to be dropped by the exceed-action drop. This intermittent failure aligns with the rate-limiting behavior of CoPP, not with access-list or routing issues.

Answer

The access-class on the VTY lines is incorrectly configured, blocking SSH traffic from the management station.

Answer

The management station is not reachable due to a routing issue.

Answer

The SSH server on R1 has a maximum session limit that is being reached.

Question 16

Which loop prevention mechanism does RIP use to avoid routing loops?

Accepted Answer

Maximum hop count of 15. RIP uses a maximum hop count of 15 to prevent routing loops by ensuring that a route cannot be advertised beyond 15 hops, effectively limiting the propagation of routing information and breaking loops. When a router receives a route with a hop count of 16, it marks the route as unreachable (poison reverse), which stops the loop from continuing. This is a fundamental loop prevention mechanism specific to distance-vector protocols like RIP.

Answer

TTL expiration in IP header

Answer

DUAL algorithm

Answer

LSA aging

Question 17

A network engineer runs the following command to troubleshoot an IPv4 Access Control Lists issue:

R1# debug ip packet 150
IP packet debugging is on for access list 150
*Mar  1 00:25:45.678: IP: s=192.168.1.1 (GigabitEthernet0/0), d=10.1.1.1, len 100, proto UDP, flags 0x0, sport 12345, dport 53, access list 150: matched line 10 permit udp host 192.168.1.1 host 10.1.1.1 eq 53
*Mar  1 00:25:45.679: IP: s=192.168.1.1 (GigabitEthernet0/0), d=10.1.1.1, len 100, proto TCP, flags 0x2, sport 12346, dport 53, access list 150: matched line 20 permit tcp host 192.168.1.1 host 10.1.1.1 eq 53

What does this output indicate?

Accepted Answer

DNS traffic from 192.168.1.1 to 10.1.1.1 is being permitted by ACL 150.. The debug output shows that packets from source 192.168.1.1 to destination 10.1.1.1 with destination port 53 (DNS) are matching permit statements in ACL 150 (line 10 for UDP and line 20 for TCP). Since the ACL is permitting these packets, DNS traffic is allowed through the interface where the ACL is applied.

Answer

DNS traffic from 192.168.1.1 to 10.1.1.1 is being denied by ACL 150.

Answer

ACL 150 is applied outbound on GigabitEthernet0/0.

Answer

ACL 150 has no line 10 or 20.

Question 18

A network engineer is troubleshooting a Cisco router that is configured for RADIUS authentication. The engineer issues 'debug radius authentication' and sees that the RADIUS server is not responding. The router can ping the RADIUS server. What is the most likely cause?

Accepted Answer

UDP port 1812 is blocked between the router and the RADIUS server.. The RADIUS protocol uses UDP port 1812 for authentication. Since the router can ping the RADIUS server, network-layer connectivity exists, but the lack of response in the debug output indicates that the UDP packets are not reaching the server. A firewall or ACL blocking UDP 1812 between the router and the server is the most likely cause, as it prevents the RADIUS request from being received while ICMP (ping) traffic is permitted.

Answer

The RADIUS server shared key is incorrect.

Answer

The router's IP address is not in the RADIUS server's client list.

Answer

The RADIUS server is down.

Question 19

Router R1 and R2 are running OSPF in area 0. R1 has a loopback interface with IP 192.168.1.1/32 advertised into OSPF. R2 learns this route as an intra-area route (AD 110). R2 also runs RIP and learns the same prefix from R3 with AD 120. R2's 'show ip route 192.168.1.1' shows the RIP route. What is the root cause?

Accepted Answer

R2's OSPF process has 'distance 130' configured, making OSPF routes have AD 130, which is higher than RIP's AD 120.. RIP has AD 120, OSPF has AD 110, so OSPF should be preferred. If the OSPF route is not installed, it could be due to a higher metric or a filter. The correct answer is that the OSPF route is an external route (type-5) because it was redistributed from another protocol, not an intra-area route. The scenario says intra-area, but if the loopback is not directly connected to OSPF (e.g., it is in a different VRF), it might be redistributed as external. The question states it is advertised into OSPF, but the AD for external is 110, same as intra-area. The trick is that the OSPF route might have a higher metric than the RIP route, but AD is checked first. The most likely cause is that the OSPF route is not in the routing table due to a distribute-list or because the OSPF process has 'distance 130' configured for all routes.

Answer

The RIP route has a better metric than the OSPF route.

Answer

R2 has a static route with AD 1 that overrides both.

Answer

The OSPF route is an external route with AD 170 due to redistribution.

Question 20

Which TWO configuration steps are required to change the administrative distance for routes learned from a specific neighbor in EIGRP? (Choose TWO.)

Accepted Answer

Configure a prefix list to match the routes from the neighbor.. To change the AD for routes from a specific EIGRP neighbor, you must first configure a prefix list to match the routes, then apply it using the distance command in EIGRP router configuration mode. The distance command can specify a different AD for routes matching a prefix list from a specific neighbor.

Answer

Use the distance eigrp command in router configuration mode.

Answer

Configure an access list to permit the routes from the neighbor.

Answer

Use the redistribute command to change the administrative distance.