300-410 Mock Exam 96 — 25 Questions

Question 1

A network engineer is troubleshooting a DMVPN phase 2 network where spoke-to-spoke tunnels are not being established. The hub router has 'ip nhrp redirect' enabled, and spokes have 'ip nhrp shortcut' enabled. The engineer notices that when a spoke sends traffic to another spoke, the hub forwards the traffic correctly, but the spoke does not initiate an NHRP resolution request to the destination spoke. The spoke's routing table shows the destination subnet via the hub. What is the most likely cause?

Accepted Answer

The spoke's tunnel interface does not have 'ip nhrp shortcut' enabled.. In DMVPN phase 2, spoke-to-spoke tunnels are triggered by the spoke sending an NHRP resolution request to the hub. The spoke will only send this request if it has a route to the destination subnet via the tunnel interface. If the spoke's routing table shows the route via the hub (next-hop is the hub's tunnel IP), the spoke should send a resolution request. However, if the spoke's 'ip nhrp shortcut' is not enabled, it will not attempt to create a shortcut. The issue is that 'ip nhrp shortcut' is missing on the spoke.

Answer

The hub's tunnel interface does not have 'ip nhrp redirect' enabled.

Answer

The spoke's routing table has a static route to the destination subnet via the hub.

Answer

The hub's NHRP authentication is configured but the spoke's is not.

Question 2

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Accepted Answer

The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.. RSPAN traffic is flooded across the RSPAN VLAN. If the RSPAN VLAN is used as the native VLAN on trunk ports, the switch may treat the RSPAN frames as untagged. However, RSPAN expects the frames to be tagged with the RSPAN VLAN ID. When the native VLAN is the same as the RSPAN VLAN, the frames may be sent untagged on the trunk, but the receiving switch may interpret them as belonging to the native VLAN, causing them to be dropped or misdirected. This can lead to intermittent loss because the native VLAN handling may vary. The correct fix is to ensure the RSPAN VLAN is not the native VLAN on any trunk.

Answer

VTP transparent mode prevents RSPAN from working correctly.

Answer

The source VLAN 50 is not allowed on the trunk ports.

Answer

The monitor session 2 is missing the 'no shutdown' command.

Question 3

A network engineer runs the following command on Router R1:

R1# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
        N: NATed, L: Local, X: No Socket
        #Ent -> Number of NHRP entries with same NBMA peer
        NHS Status: E => Expecting Replies, R => Responding, W => Waiting
        UpDn Time -> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Addr State  UpDn Tm Attrb
 ----- --------------- ---------------- ----- -------- -----
     1 10.1.1.2        172.16.0.2        UP    00:02:15 D
     1 10.1.1.3        172.16.0.3        UP    00:01:45 D

Based on this output, which statement is correct?

Accepted Answer

Router R1 is a hub with two dynamically registered spokes.. The show dmvpn command displays NHRP peers. The output shows two dynamic peers (D) with their NBMA and tunnel addresses. The hub has two spokes registered, both in UP state. The correct answer identifies the role and peer count.

Answer

Router R1 is a spoke with two hub peers.

Answer

The NHRP peers are static and not dynamic.

Answer

One spoke is experiencing a registration failure.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip nhrp
192.168.1.0/24 via 172.16.0.2
   Tunnel0 created 00:00:15, expire 00:01:45
   Type: dynamic, Flags: unique
   NBMA address: 10.1.1.2
192.168.2.0/24 via 172.16.0.3
   Tunnel0 created 00:00:10, expire 00:01:50
   Type: dynamic, Flags: unique
   NBMA address: 10.1.1.3

Based on this output, what is the problem?

Accepted Answer

The NHRP holdtime is too short, causing frequent re-registrations.. The output shows NHRP cache entries for remote networks. The expire time is decreasing, indicating these are dynamic entries learned via NHRP. The problem is that the NHRP holdtime is set to 2 minutes (120 seconds), as seen from the expire time starting at 2 minutes. This is a short holdtime that may cause frequent re-registrations.

Answer

The NHRP entries are static and will not expire.

Answer

The tunnel interface is down.

Answer

The NBMA addresses are incorrect.

Question 5

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        MM_ACTIVE      1       0     ACTIVE
10.1.1.3        10.1.1.1        MM_ACTIVE      2       0     ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete for both peers.. The show crypto isakmp sa command shows IKE phase 1 security associations. The state MM_ACTIVE indicates that IKE phase 1 is complete and active. The output shows two active SAs with the local router (10.1.1.1) and two remote peers (10.1.1.2 and 10.1.1.3).

Answer

IKE phase 2 is complete for both peers.

Answer

The IPsec tunnels are established.

Answer

The peers are not responding.

Question 6

Router R1 is configured as an ERSPAN source to monitor traffic on interface GigabitEthernet0/0/0. The destination is a collector at 10.10.10.10. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 3 ip address 10.10.10.10 origin ip address 192.168.1.1. The router has an ACL applied to the interface Gi0/0/0 that denies all IP traffic from source 192.168.1.1. The collector receives no packets. What is the root cause?

Accepted Answer

The ACL on Gi0/0/0 blocks the encapsulated ERSPAN packets because the source IP 192.168.1.1 is denied.. ERSPAN encapsulates the mirrored packets with a new IP header that has the source IP address specified in the 'origin ip address' command. The encapsulated packet is then sent out of the router using the routing table. However, the ACL on the source interface Gi0/0/0 is applied to the original traffic entering the interface, not to the encapsulated packets. The encapsulated packets are generated by the router and are not subject to the ACL on the source interface. The ACL would affect the original traffic being mirrored, but the symptom is that the collector receives no packets. The correct root cause is that the ACL is blocking the original traffic, so there is nothing to mirror. But the scenario says the collector receives no packets, meaning the mirrored packets are not being sent. The more likely issue is that the ACL is applied to the outgoing direction on the interface that sends the encapsulated packets, but the scenario says the ACL is applied to Gi0/0/0, which is the source interface. The encapsulated packets are sent out of a different interface (the one that has the route to the collector). The ACL on Gi0/0/0 does not affect the encapsulated packets. However, if the router uses the same interface to send the encapsulated packets, the ACL might block them. The correct answer is that the ACL is applied to the source interface and may block the encapsulated packets if they are sent out that interface.

Answer

The ACL on Gi0/0/0 blocks the original traffic, so there is no traffic to mirror.

Answer

The ERSPAN session is missing the 'no shutdown' command.

Answer

The destination IP 10.10.10.10 is not reachable.

Question 7

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: DMVPN, local addr 10.1.1.1

protected vrf: (none)
   local  ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0)
   remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/47/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150
    #pkts decaps: 145, #pkts decrypt: 145, #pkts verify: 145
    #send errors 0, #recv errors 0

local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2
   path mtu 1500, ip mtu 1500, ip mtu idb Tunnel0
   current outbound spi: 0x12345678(305419896)
   PFS (Y/N): N, DH group: none

Based on this output, what is the problem?

Accepted Answer

There is packet loss on the IPsec tunnel.. The output shows IPsec SA details for a DMVPN tunnel. The protect identity uses GRE protocol (47) and the SA is between two spoke routers (172.16.0.0/24). The packet counts show 150 encapsulated but only 145 decapsulated, indicating packet loss on the tunnel. This could be due to MTU issues or routing problems.

Answer

The IPsec SA is using PFS.

Answer

The tunnel is not encrypting traffic.

Answer

The remote peer is 10.1.1.1.

Question 8

A switch is configured with SPAN to monitor traffic on interface Gi0/0/0 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source interface Gi0/0/0 both monitor session 1 destination interface Gi0/1. The analyzer sees only half of the traffic (only incoming or outgoing). The switch also has an EtherChannel configured on Gi0/0/0 as part of a port-channel. The port-channel is up/up. What is the root cause?

Accepted Answer

The SPAN source is a physical interface that is part of an EtherChannel; SPAN should be configured on the port-channel interface instead.. When a source interface is part of an EtherChannel, SPAN must be configured on the port-channel interface, not on the individual physical interface. If SPAN is configured on a physical interface that is part of a port-channel, the switch may only monitor traffic on that specific physical link, not the entire EtherChannel. This can result in only a portion of the traffic being mirrored. The fix is to use the port-channel interface as the source.

Answer

The destination interface Gi0/1 is not in the same VLAN as the source.

Answer

The monitor session is missing the 'no shutdown' command.

Answer

The EtherChannel load-balancing algorithm causes some traffic to be missed.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks
O        172.16.0.0/24 [110/100] via 172.16.0.2, 00:00:15, Tunnel0
O        172.16.0.0/24 [110/100] via 172.16.0.3, 00:00:10, Tunnel0

Based on this output, what is the problem?

Accepted Answer

OSPF is learning the same subnet from multiple spokes, indicating a misconfiguration.. The output shows OSPF routes for the same network 172.16.0.0/24 via two different next hops (172.16.0.2 and 172.16.0.3). This indicates that OSPF is seeing the same subnet from multiple spokes, which is incorrect because the tunnel network should be unique per spoke. This suggests a misconfiguration where the tunnel IP addresses are overlapping or OSPF is not properly filtering.

Answer

The OSPF cost is 100, which is high.

Answer

The routes are learned via EIGRP.

Answer

The tunnel interface is down.

Question 10

A network engineer runs the following command on Router R1:

R1# show dmvpn detail
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
        N: NATed, L: Local, X: No Socket
        #Ent -> Number of NHRP entries with same NBMA peer
        NHS Status: E => Expecting Replies, R => Responding, W => Waiting
        UpDn Time -> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
Type:Spoke, NHRP Peers:1,

# Ent  Peer NBMA Addr Peer Tunnel Addr State  UpDn Tm Attrb
 ----- --------------- ---------------- ----- -------- -----
     1 10.1.1.1        172.16.0.1        UP    00:10:00 S

Based on this output, what is the problem?

Accepted Answer

The spoke has a static NHRP mapping for the hub, which is correct for phase 1 DMVPN.. The output shows a spoke router with one NHRP peer (the hub) marked as static (S). The spoke is only seeing the hub, which is normal for a spoke. However, the problem is that the spoke is not seeing any other spokes, which is expected in a DMVPN phase 2 or 3 where spokes should see each other dynamically. But here the peer is static, indicating the spoke is configured with a static NHRP mapping for the hub, and no dynamic spoke-to-spoke tunnels are established.

Answer

The spoke has dynamically learned the hub.

Answer

The hub is not reachable.

Answer

The spoke is configured as a hub.

Question 11

Router R1 is configured as an ERSPAN source to monitor traffic on interface Tunnel0 (a DMVPN tunnel). The destination is a collector at 172.16.0.100. R1's configuration: monitor session 1 type erspan-source source interface Tunnel0 both destination erspan-id 4 ip address 172.16.0.100 origin ip address 10.0.0.1. The collector receives no packets. The Tunnel0 interface is up/up and has an IP of 10.0.0.1/30. The tunnel destination is 192.168.1.1. The router has a route to 172.16.0.100 via 10.0.0.2. What is the root cause?

Accepted Answer

The ERSPAN destination IP is routed via the tunnel interface, causing the encapsulated packets to be sent into the tunnel and double-encapsulated, leading to drop.. ERSPAN monitors traffic on the source interface. When the source is a tunnel interface, the mirrored traffic is the original IP packets before encapsulation. The ERSPAN process then encapsulates these packets with a new IP header. However, the encapsulated packets are sent using the routing table. If the destination IP is reachable via a route that points to the tunnel interface itself (e.g., via 10.0.0.2, which is the tunnel's peer), the encapsulated packets may be sent into the tunnel, causing them to be encapsulated again. This double encapsulation can cause issues. But the more likely root cause is that the ERSPAN session is configured to monitor the tunnel interface, but the tunnel interface itself may not be able to generate the encapsulated packets correctly because the tunnel is used for the destination. The correct answer is that the ERSPAN source IP is the same as the tunnel interface IP, and the destination is routed via the tunnel, causing a recursive routing loop similar to the first question.

Answer

The ERSPAN source interface is a tunnel, which is not supported for ERSPAN.

Answer

The tunnel interface is not in the same VRF as the collector.

Answer

The ERSPAN session ID 4 conflicts with the tunnel key.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip nhrp nhs
NHS: 172.16.0.1   Tunnel0   status: registered
NHS: 172.16.0.2   Tunnel0   status: not registered

Based on this output, what is the problem?

Accepted Answer

Router R1 is not registered with the second NHS, indicating a registration failure.. The show ip nhrp nhs command displays the NHRP server (NHS) registrations. The output shows that R1 is registered with NHS 172.16.0.1 but not registered with NHS 172.16.0.2. This indicates a problem with the registration to the second NHS, possibly due to authentication mismatch, reachability issues, or configuration error.

Answer

Both NHS are registered successfully.

Answer

The tunnel interface is down.

Answer

The NHS addresses are swapped.

Question 13

A network engineer runs the following command to troubleshoot a SPAN issue:

R1# show monitor session 1 detail
Session 1
---------
Type                   : Local Session
Source Ports           : 
    Both               : Gi0/0
Destination Ports      : Gi0/1
    Encapsulation      : Native
    Ingress            : Disabled

What does this output indicate?

Accepted Answer

The session is correctly configured to send traffic from Gi0/0 to Gi0/1.. The output shows a local SPAN session with source port Gi0/0 (both directions) and destination port Gi0/1. The destination port is configured with native encapsulation and no ingress traffic is allowed.

Answer

The session is misconfigured because the destination port should have ingress enabled.

Answer

The session is misconfigured because the source port must be a VLAN.

Answer

The session is misconfigured because encapsulation must be set to 'replicate'.

Question 14

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Accepted Answer

Configure source interface and direction. First, you must define the source interface and traffic direction. Next, specify the ERSPAN ID and destination IP address. Then, configure the ERSPAN origin IP address on the source switch. After that, enable the ERSPAN session globally. Finally, verify the session is active.

Question 15

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKE, M - IKEv2, P - IPsec

C-id  Local           Remote          I-VRF      Status Encr Hash Auth DH Lifetime Cap.
1     10.1.1.1        10.1.1.2                  ACTIVE aes  sha  md5  2  86400
2     10.1.1.1        10.1.1.3                  ACTIVE aes  sha  md5  2  86400

Based on this output, what is the problem?

Accepted Answer

The IKE policy uses weak authentication (MD5) and DH group 2.. The output shows IKE phase 1 SAs with encryption aes, hash sha, authentication md5, and DH group 2. The problem is that MD5 is used for authentication, which is considered weak and insecure. Modern DMVPN deployments should use stronger algorithms like SHA-256. Additionally, DH group 2 is weak.

Answer

The IKE SAs are not active.

Answer

The IPsec SAs are missing.

Answer

The lifetime is too short.

Question 16

A network engineer runs the following command to troubleshoot an RSPAN issue:

R1# show monitor session 2 detail
Session 2
---------
Type                   : Remote Source Session
Source Ports           : 
    Both               : Gi0/0
Destination RSPAN VLAN : 100

What does this output indicate?

Accepted Answer

The session is correctly configured as an RSPAN source session.. The output shows an RSPAN source session with source port Gi0/0 and destination RSPAN VLAN 100. This is the source side of an RSPAN configuration.

Answer

The session is misconfigured because the destination must be a port, not a VLAN.

Answer

The session is misconfigured because the source port must be a VLAN.

Answer

The session is misconfigured because the RSPAN VLAN must be configured as a remote-span VLAN.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip nhrp traffic
NHRP Traffic Statistics
    Sent: 100 requests, 50 replies
    Received: 50 requests, 100 replies

Based on this output, what is the problem?

Accepted Answer

There is a mismatch between sent requests and received replies, indicating packet loss.. The output shows NHRP traffic statistics. The router sent 100 requests but received only 50 replies, indicating that half of the requests are not being answered. This could be due to network issues, misconfiguration, or packet loss.

Answer

The router is receiving more replies than requests.

Answer

The NHRP process is functioning normally.

Answer

The router is configured as a hub.

Question 18

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 3 detail
Session 3
---------
Type                   : ERSPAN Source Session
Source Ports           : 
    Both               : Gi0/0
Destination IP         : 10.1.1.1
ERSPAN ID              : 100

What does this output indicate?

Accepted Answer

The session is correctly configured as an ERSPAN source session.. The output shows an ERSPAN source session with source port Gi0/0, destination IP 10.1.1.1, and ERSPAN ID 100. This is the source side of an ERSPAN configuration.

Answer

The session is misconfigured because the destination must be a VLAN, not an IP.

Answer

The session is misconfigured because the source port must be a VLAN.

Answer

The session is misconfigured because the ERSPAN ID must match on both source and destination.

Question 19

Consider the following partial DMVPN configuration on a hub router:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp authentication cisco123
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map multicast dynamic
!

What is the effect of this configuration?

Accepted Answer

The hub will dynamically register spoke NHRP addresses and forward multicast traffic to all registered spokes.. The command 'ip nhrp map multicast dynamic' allows the hub to dynamically learn spoke NHRP addresses for multicast replication, which is essential for routing protocols (e.g., EIGRP, OSPF) that use multicast.

Answer

The hub will only forward multicast traffic to spokes that are statically mapped.

Answer

The hub will not forward multicast traffic at all because dynamic mapping is not supported.

Answer

The hub will use broadcast instead of multicast for all traffic.

Question 20

A spoke router has the following DMVPN configuration:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp map 10.0.0.1 192.168.1.1
!

What is missing from this configuration?

Accepted Answer

The spoke is missing the 'ip nhrp map multicast dynamic' command to register with the hub.. In DMVPN Phase 2/3, spokes need to register with the NHS. The command 'ip nhrp map multicast dynamic' or a static multicast map is required for the spoke to send NHRP registration and receive multicast from the hub.

Answer

The spoke is missing the 'ip nhrp authentication' command.

Answer

The spoke is missing the 'tunnel key' command.

Answer

The spoke is missing the 'ip nhrp holdtime' command.