300-410 Hard Questions — 25 Difficult Questions

Question 1

When using the 'access-group' command to apply an ACL to an interface, what is the default direction if none is specified?

Accepted Answer

The command is rejected without a direction keyword.. The 'access-group' command in Cisco IOS requires a direction keyword (either 'in' or 'out') to specify whether the ACL filters inbound or outbound traffic. If no direction is provided, the command is rejected with an error message because the direction is a mandatory parameter. This behavior is consistent across all Cisco IOS versions and platforms.

Answer

Inbound

Answer

Outbound

Answer

The command defaults to inbound.

Question 2

An engineer configures an IPsec VPN between two routers using a transform-set with ESP encryption (AES 256) and ESP authentication (SHA-256). The engineer also applies an IPv4 ACL to define interesting traffic that matches all IP traffic. After configuration, the VPN tunnel comes up, but only ICMP traffic is encrypted; other traffic like HTTP is sent in clear text. What is the most likely explanation?

Accepted Answer

The ACL for interesting traffic only permits ICMP, so only ICMP is encrypted.. The most likely explanation is that the ACL for interesting traffic only permits ICMP, so only ICMP is encrypted. In Cisco IOS, the crypto map uses the ACL to identify which traffic should be protected by IPsec. If the ACL only matches ICMP (e.g., 'permit icmp any any'), then only ICMP packets trigger IPsec encryption; all other traffic, such as HTTP, is forwarded in clear text because it does not match the ACL and is therefore not subject to IPsec processing.

Answer

The transform-set does not support HTTP traffic due to port filtering.

Answer

The IPsec SA is only established for ICMP; other traffic requires a separate SA.

Answer

The router has a NAT rule that bypasses IPsec for HTTP traffic.

Question 3

On a DMVPN Phase 2 hub-and-spoke network, an engineer applies an inbound IPv4 ACL on the tunnel interface of a spoke router to permit only traffic from specific spoke IPs. After the ACL is applied, the spoke cannot establish a direct spoke-to-spoke tunnel with another spoke, even though NHRP resolution succeeds. What is the most likely explanation?

Accepted Answer

The ACL is filtering the outer IP header of the mGRE tunnel, blocking spoke-to-spoke traffic.. In a DMVPN Phase 2 network, spoke-to-spoke traffic is encapsulated in a new IP header with the destination IP set to the target spoke's public address. When an inbound ACL is applied to the spoke's tunnel interface, it filters traffic after decapsulation, meaning it inspects the inner (original) IP header. However, the ACL is applied on the physical interface or the tunnel interface in a way that inadvertently filters the outer IP header of the mGRE tunnel, blocking the encapsulated spoke-to-spoke packets before they can be processed. Since NHRP resolution succeeds, the spoke knows the peer's address, but the actual data traffic is dropped because the ACL denies the outer encapsulation.

Answer

The ACL is filtering NHRP packets, preventing spoke-to-spoke resolution.

Answer

The spoke has a misconfigured NHRP authentication key.

Answer

The ACL is applied outbound, filtering outgoing traffic.

Question 4

An MPLS network with EIGRP as the IGP is experiencing label distribution failures. Router R1 shows: 'show mpls ldp neighbor' does not list R2. R1's configuration: mpls ip on interfaces, but no router-id configured. R2's configuration: mpls ldp router-id Loopback0 force. R1 and R2 are directly connected. What is the root cause?

Accepted Answer

R1's LDP router-id is not configured, so it uses the IP of the interface facing R2, which may not be reachable from R2's loopback.. R1 has no explicit LDP router-id configured, so it defaults to the highest IP address on a loopback interface or, if none exists, the highest IP on a physical interface. Since R1 has no loopback, it uses the IP of the interface facing R2. R2's LDP router-id is forced to its Loopback0 address via the 'force' keyword. For LDP sessions to establish, each router must be able to reach the other's LDP router-id. R2's loopback may not be reachable from R1's interface IP, or R1's interface IP may not be reachable from R2's loopback, breaking the TCP transport required for LDP.

Answer

R2 has a loopback interface that is not advertised via EIGRP, so R1 cannot reach it.

Answer

R1 has an ACL that blocks LDP UDP packets (port 646).

Answer

R2's 'force' keyword causes it to use the loopback even if it is not reachable.

Question 5

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

Accepted Answer

The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.. In a DMVPN network, spokes must use the 'ip nhrp nhs' command to register their real (physical) IP addresses with the hub (NHS). Without this command, the hub never learns the spokes' addresses, so it cannot provide NHRP resolution replies to other spokes attempting to form spoke-to-spoke tunnels. The absence of dynamic sessions on R2 and no NHRP entries for R2 on R3 directly indicate that R2 never registered with the hub.

Answer

The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.

Answer

The NHRP network-id is different on R2 and R3, preventing communication.

Answer

The tunnel source interface is not reachable between spokes.

Question 6

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface connected to a customer network. The customer has a default route pointing to the router. After enabling uRPF, the router drops traffic from the customer that has a source IP address that is not in the routing table as a directly connected or static route. What is the most likely explanation?

Accepted Answer

Strict mode uRPF requires a specific route for the source IP; a default route is not sufficient.. Strict mode uRPF verifies that the source IP address of an incoming packet matches a specific route in the routing table, and that the interface used to reach that source IP is the same as the incoming interface. A default route (0.0.0.0/0) is a catch-all entry and does not provide a specific, directly connected or static route for the customer's source IP. Therefore, the router drops the traffic because it cannot find an exact match for the source IP in the routing table, which is a fundamental requirement of strict mode.

Answer

The customer's default route causes asymmetric routing, which breaks strict mode.

Answer

The uRPF mode should be loose mode to allow the default route.

Answer

The router has an ACL that is blocking the traffic before uRPF checks.

Question 7

An engineer configures mutual redistribution between OSPF and EIGRP on a router. Both protocols have routes for the same prefix. The engineer also applies an inbound ACL on the OSPF interface to deny certain routes from being learned via OSPF. After the ACL is applied, the router still has the prefix in the routing table, but it is learned via EIGRP instead of OSPF. What is the most likely explanation?

Accepted Answer

The ACL blocks OSPF updates, so the router learns the prefix via EIGRP with a lower AD.. The inbound ACL on the OSPF interface blocks the OSPF-learned route from being installed in the routing table. Since mutual redistribution is configured, the same prefix is also learned via EIGRP. EIGRP has a default administrative distance (AD) of 90 for internal routes, which is lower than OSPF's AD of 110. Therefore, the router selects the EIGRP route as the best path, and the prefix remains in the routing table but now points to the EIGRP next hop.

Answer

The ACL is applied outbound, so it filters OSPF routes being sent to the neighbor.

Answer

The router has a static route for the prefix with AD 1.

Answer

The OSPF process has a distribute-list that is filtering the route.

Question 8

An engineer is troubleshooting a DMVPN phase 3 network where spoke-to-spoke tunnels are established, but traffic between spokes is taking a suboptimal path through the hub. The engineer checks 'show ip nhrp shortcut' on the spoke and sees no shortcut entries. The hub has 'ip nhrp redirect' enabled, and the spoke has 'ip nhrp shortcut' enabled. The engineer also verifies that the spoke's routing table has a route to the remote spoke's LAN via the hub. What is the most likely cause?

Accepted Answer

The hub router does not have a route to the remote spoke's LAN subnet.. In DMVPN phase 3, for spoke-to-spoke shortcuts to be installed, the spoke must receive an NHRP redirect from the hub. If the hub does not send a redirect, the spoke will not create a shortcut. The hub sends a redirect only if it has a route to the destination subnet. If the hub does not have a route to the remote spoke's LAN, it will not send a redirect.

Answer

The spoke's 'ip nhrp shortcut' command is missing on the tunnel interface.

Answer

The spoke's routing table has a static route to the remote spoke's LAN via the hub.

Answer

The hub's tunnel interface has 'no ip nhrp redirect' configured.

Question 9

An engineer configures a DMVPN Phase 2 network. Spoke routers are configured with a route map that sets the next-hop to the tunnel interface for routes learned from the hub. This is intended to allow spoke-to-spoke direct communication. However, spoke-to-spoke traffic still goes through the hub. Which is the most likely explanation?

Accepted Answer

The route map is applied on the spoke router inbound from the hub, but it should be applied on the hub router outbound to the spokes.. In DMVPN Phase 2, spoke-to-spoke direct communication requires that the spoke routers have a route with the next-hop set to the tunnel interface of the remote spoke. However, if the route map is applied inbound on the spoke from the hub, it sets the next-hop to the hub's tunnel interface, not the remote spoke. The correct approach is to use a route map on the hub that sets the next-hop to the spoke's tunnel IP when advertising routes, or to use the 'next-hop-self' command incorrectly. The edge case is that the route map is applied on the spoke, not the hub.

Answer

The route map uses a prefix-list that does not match the spoke's subnet.

Answer

The spoke routers have NHRP authentication mismatch, preventing direct communication.

Answer

The tunnel mode is mGRE on the spokes, which does not support spoke-to-spoke.

Question 10

A DMVPN phase 3 network with IPv6 over IPv4 tunnels is experiencing spoke-to-spoke tunnel failures. Hub router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp network-id 1 ip nhrp map multicast dynamic ipv6 nhrp map multicast dynamic. Spoke router R2 shows: R2# show dmvpn detail Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete NHRP domain: 1 Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, Total NBMA Peers: 1 # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb 1 192.0.2.2 2001:DB8:1::2 UP 00:10:00 D. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command under Tunnel0.. In DMVPN Phase 3, spoke-to-spoke tunnels rely on the hub to send NHRP Redirect messages to trigger shortcut creation. The hub's configuration is missing the `ip nhrp redirect` command under Tunnel0, which prevents it from informing the spoke that a better path exists directly to another spoke. Without this redirect, the spoke never initiates an NHRP Resolution Request to build a direct tunnel, causing spoke-to-spoke communication to fail.

Answer

The spoke is missing the ip nhrp shortcut command under Tunnel0.

Answer

The tunnel mode should be gre multipoint on the spokes.

Answer

IPv6 NHRP is not supported on DMVPN phase 3.

Question 11

In a VRF-Lite setup, Router R1 and R2 are running OSPF in VRF-A. R1 has interface Gig0/0 in VRF-A with ip ospf network point-to-point. R2 has interface Gig0/1 in VRF-A with default network type (broadcast). The link between them is a direct Ethernet connection. OSPF neighbors are not forming. What is the root cause?

Accepted Answer

The OSPF network types are mismatched: one side is point-to-point, the other is broadcast, causing neighbor adjacency failure.. OSPF network type mismatch prevents neighbor formation. On a broadcast network, OSPF expects DR/BDR elections, while point-to-point expects no election. The mismatch causes hello packets to be ignored because the OSPF interface parameters (like hello interval, dead interval, and network type) differ. Specifically, on a point-to-point link, the neighbor state machine expects a different packet format and does not process broadcast hellos.

Answer

The VRF names must match for OSPF to form neighbors.

Answer

The OSPF process ID must be the same on both routers.

Answer

The interface must be configured with the same IP subnet mask.

Question 12

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 13

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Accepted Answer

Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.. To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Answer

Configure 'no logging trap debugging' globally.

Answer

Use 'undebug all' to stop all debug output.

Answer

Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

Question 14

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Accepted Answer

Configure 'event cli pattern "write memory" sync no' under the applet.. The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'. The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.

Answer

Define the applet using the 'event manager policy' command instead of 'event manager applet'.

Answer

Add an 'event syslog pattern "WRITE"' to detect the write memory operation.

Answer

Include an 'action cli command "enable"' before the copy command to ensure privileged access.

Question 15

Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)

Accepted Answer

A time-range can include both absolute and periodic statements simultaneously.. The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.

Answer

The time-range is applied to the entire ACL, not individual ACEs.

Answer

If the router's clock is not set, the time-range will be considered active at all times.

Answer

The time-range feature can only be used with extended named ACLs, not standard ACLs.

Question 16

What is the maximum hop count for an EIGRP route?

Accepted Answer

224. EIGRP uses a maximum hop count of 224, not 255 like RIPv2 or other distance-vector protocols. This limit is hard-coded in the EIGRP protocol to prevent routing loops and excessive path lengths, and it is enforced by the EIGRP update process. Routes with a hop count exceeding 224 are considered unreachable and are not installed in the routing table.

Answer

15

Answer

255

Answer

Unlimited

Question 17

An engineer redistributes OSPF routes into EIGRP. The OSPF routes have a metric of 20. After redistribution, the EIGRP topology table shows the routes but they are not installed in the routing table. The 'show ip eigrp topology' shows the route in active state. Which is the most likely explanation?

Accepted Answer

The EIGRP neighbor is stuck-in-active because a query was sent but no reply was received due to a unidirectional link.. When redistributing into EIGRP, a seed metric must be specified. If not, the routes are redistributed with an infinite metric (e.g., 4294967295) and are not installed. However, the question says the route is in active state, which indicates a query is pending. This is an edge case where the route is redistributed with a valid metric but the EIGRP process is stuck-in-active due to a unidirectional link or a neighbor not replying to queries.

Answer

The 'default-metric' command was not configured, so the routes are redistributed with an infinite metric.

Answer

The OSPF routes are external type 2, which are not redistributed by default.

Answer

The 'route-map' used for redistribution has a 'match ip address' that does not match the OSPF routes.

Question 18

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.. In a DMVPN phase 3 network, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to process them via the `ip nhrp shortcut` command. Without `ip nhrp redirect` on the hub, the hub forwards traffic between spokes without signaling them to establish a direct tunnel. The dynamic NHRP mapping on R1 for R2's tunnel IP indicates that R1 has learned R2's physical address via NHRP registration, but without the shortcut flag, R1 will not use that mapping to send traffic directly; instead, it continues to send traffic through the hub, which fails if the hub does not have a route or if the spoke-to-spoke tunnel is not triggered.

Answer

The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.

Answer

The tunnel interface on R1 is not in the correct VRF.

Answer

The IPsec transform set is mismatched between spokes.

Question 19

A network engineer notices that routes redistributed from EIGRP into OSPF are causing routing loops. Router R1 has the following relevant configuration: router eigrp 100 redistribute ospf 1 metric 10000 100 255 1 1500 router ospf 1 redistribute eigrp 100 subnets metric-type 1 Router R2 shows: show ip route 192.168.1.0 Routing entry for 192.168.1.0/24 Known via "ospf 1", distance 110, metric 20, type E1 Last update from 10.1.1.1, 00:01:30 ago Also, R2 has a default route via R1. What is the root cause?

Accepted Answer

Mutual redistribution without filtering causes a routing loop; apply distribute-list or route-map with tags.. The mutual redistribution between EIGRP and OSPF without route filtering can cause a routing loop. R1 redistributes OSPF into EIGRP, and EIGRP back into OSPF, creating a feedback loop. The E1 metric of 20 suggests the route was redistributed twice. The correct fix is to implement route tagging and filtering to prevent loop.

Answer

The metric-type 1 should be type 2 to avoid loops.

Answer

The EIGRP metric values are incorrect; they should match OSPF cost.

Answer

The subnets keyword is missing in the redistribute command for OSPF.

Question 20

EIGRP network is experiencing stuck-in-active (SIA) routes. Router R1 shows: show ip eigrp topology active includes 10.0.0.0/24. Router R2 has: interface GigabitEthernet0/0, ip summary-address eigrp 100 10.0.0.0 255.255.255.0. What is the root cause?

Accepted Answer

The summary address on R2 is causing a query for the specific route to be suppressed.. The summary address configured on R2 (ip summary-address eigrp 100 10.0.0.0 255.255.255.0) causes R2 to advertise a single summary route (10.0.0.0/24) to R1. When R1 loses its route to 10.0.0.0/24 and sends a query for the specific prefix, R2 does not reply because the summary address suppresses the query for the more specific route, leaving R1 stuck-in-active (SIA) waiting for a reply that never comes.

Answer

R1 has a stuck interface causing the SIA.

Answer

EIGRP is misconfigured with wrong autonomous system number.

Answer

The route 10.0.0.0/24 is flapping, causing continuous queries.