300-410 Timed Hard Questions — 25 Difficult Questions

Question 1

On a DMVPN Phase 2 hub-and-spoke network, an engineer applies an inbound IPv4 ACL on the tunnel interface of a spoke router to permit only traffic from specific spoke IPs. After the ACL is applied, the spoke cannot establish a direct spoke-to-spoke tunnel with another spoke, even though NHRP resolution succeeds. What is the most likely explanation?

15 minute time limit — choose an answer to begin.

Accepted Answer

The ACL is filtering the outer IP header of the mGRE tunnel, blocking spoke-to-spoke traffic.. In a DMVPN Phase 2 network, spoke-to-spoke traffic is encapsulated in a new IP header with the destination IP set to the target spoke's public address. When an inbound ACL is applied to the spoke's tunnel interface, it filters traffic after decapsulation, meaning it inspects the inner (original) IP header. However, the ACL is applied on the physical interface or the tunnel interface in a way that inadvertently filters the outer IP header of the mGRE tunnel, blocking the encapsulated spoke-to-spoke packets before they can be processed. Since NHRP resolution succeeds, the spoke knows the peer's address, but the actual data traffic is dropped because the ACL denies the outer encapsulation.

Answer

The ACL is filtering NHRP packets, preventing spoke-to-spoke resolution.

Answer

The spoke has a misconfigured NHRP authentication key.

Answer

The ACL is applied outbound, filtering outgoing traffic.

Question 2

A DMVPN network with hub R1 and spokes R2 and R3 is configured with mGRE and NHRP. Spoke-to-spoke tunnels fail to form. R1 configuration: interface Tunnel0, ip address 10.0.0.1 255.255.255.0, tunnel source GigabitEthernet0/0, tunnel mode gre multipoint, ip nhrp network-id 1, ip nhrp map multicast dynamic. R2 shows: 'show dmvpn' shows no dynamic sessions. R3 shows: 'show ip nhrp' shows no entries for R2. What is the root cause?

Accepted Answer

The spokes are missing the 'ip nhrp nhs' command to point to the hub, preventing registration and resolution of spoke-to-spoke addresses.. In a DMVPN network, spokes must use the 'ip nhrp nhs' command to register their real (physical) IP addresses with the hub (NHS). Without this command, the hub never learns the spokes' addresses, so it cannot provide NHRP resolution replies to other spokes attempting to form spoke-to-spoke tunnels. The absence of dynamic sessions on R2 and no NHRP entries for R2 on R3 directly indicate that R2 never registered with the hub.

Answer

The tunnel mode is mGRE, but the spokes are configured with point-to-point GRE tunnels.

Answer

The NHRP network-id is different on R2 and R3, preventing communication.

Answer

The tunnel source interface is not reachable between spokes.

Question 3

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Accepted Answer

The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.. When the RSPAN VLAN is also configured as the native VLAN on a trunk, mirrored frames are sent untagged on that trunk. Intermediate switches may treat untagged frames as belonging to the native VLAN rather than the RSPAN VLAN, causing them to be forwarded incorrectly or dropped, resulting in intermittent traffic at the destination.

Answer

VTP transparent mode prevents RSPAN from working correctly.

Answer

The source VLAN 50 is not allowed on the trunk ports.

Answer

The monitor session 2 is missing the 'no shutdown' command.

Question 4

An engineer configures CoPP on a router with the following policy: class-map match-any PROTECT, match protocol ospf, police 1000 pps; class class-default, police 500 pps. After applying, OSPF neighbors form, but the router's CPU utilization remains high. Which is the most likely explanation?

Accepted Answer

The class-default police rate is too low, causing ARP packets to be dropped, but CPU is high due to the policing overhead.. The class-default police rate of 500 pps is too low to handle essential control-plane traffic like ARP, which falls into class-default. When ARP packets are dropped, the router must retry ARP resolution, generating additional CPU overhead from policing and retransmissions, keeping CPU utilization high. OSPF neighbors form because OSPF traffic is explicitly protected in the PROTECT class with a 1000 pps policer, but the underlying ARP starvation causes CPU strain.

Answer

OSPF traffic is being policed to 1000 pps, which is too high, causing CPU overload.

Answer

CoPP only works on hardware-switched platforms, not software.

Answer

The class-default should have a higher rate than the OSPF class.

Question 5

An engineer configures OSPF on a link with an MTU of 1500 on one side and 1400 on the other. The OSPF neighbor state is stuck in EXSTART. What is the most likely explanation?

Accepted Answer

The router with the smaller MTU (1400) rejects DBD packets from the neighbor with MTU 1500 because they exceed the interface MTU, causing the EXSTART state.. OSPF uses the MTU of the interface to determine the maximum size of Database Description (DBD) packets. If the MTU mismatches, the router with the smaller MTU will reject DBD packets that exceed its MTU, causing the neighbor to remain in EXSTART.

Answer

The router with the larger MTU (1500) cannot process the smaller DBD packets from the neighbor.

Answer

The OSPF network type is point-to-point, which ignores MTU mismatches.

Answer

The 'ip ospf mtu-ignore' command is needed on both sides to bypass the MTU check.

Question 6

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 7

What is the default ERSPAN ID range on Cisco IOS-XE devices?

Accepted Answer

1 to 1023. ERSPAN sessions use an ID from 1 to 1023 (or 1 to 256 on some platforms) to identify the session. The default is 1 if not specified.

Answer

1 to 256

Answer

1 to 4096

Answer

1 to 65535

Question 8

What is the maximum hop count for an EIGRP route?

Accepted Answer

224. EIGRP uses a maximum hop count of 224, not 255 like RIPv2 or other distance-vector protocols. This limit is hard-coded in the EIGRP protocol to prevent routing loops and excessive path lengths, and it is enforced by the EIGRP update process. Routes with a hop count exceeding 224 are considered unreachable and are not installed in the routing table.

Answer

15

Answer

255

Answer

Unlimited

Question 9

A DMVPN network with NHRP is configured for spoke-to-spoke tunnels. Spoke routers R1 and R2 are both connected to a hub router H1. Spoke-to-spoke traffic is not working. R1's show dmvpn shows a dynamic NHRP mapping for R2's tunnel IP to R2's physical IP, but ping from R1's tunnel IP to R2's tunnel IP fails. R1's show ip nhrp shows the mapping as 'dynamic' with no flags. The hub has no special configuration. What is the root cause?

Accepted Answer

The hub is missing the ip nhrp redirect command, and the spokes are missing ip nhrp shortcut, preventing spoke-to-spoke direct communication.. In a DMVPN phase 3 network, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to process them via the `ip nhrp shortcut` command. Without `ip nhrp redirect` on the hub, the hub forwards traffic between spokes without signaling them to establish a direct tunnel. The dynamic NHRP mapping on R1 for R2's tunnel IP indicates that R1 has learned R2's physical address via NHRP registration, but without the shortcut flag, R1 will not use that mapping to send traffic directly; instead, it continues to send traffic through the hub, which fails if the hub does not have a route or if the spoke-to-spoke tunnel is not triggered.

Answer

The spoke routers have incorrect NHRP authentication, causing the mapping to be invalid.

Answer

The tunnel interface on R1 is not in the correct VRF.

Answer

The IPsec transform set is mismatched between spokes.

Question 10

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 11

A network engineer configures an IPv6 over IPv4 GRE tunnel with IPsec protection. The tunnel works for IPv6 traffic, but when the engineer tries to run EIGRP for IPv6 over the tunnel, the neighbor relationship forms but routes are not exchanged. The engineer checks the EIGRP configuration and sees that the tunnel interface is included in the EIGRP process. What is the most likely explanation?

Accepted Answer

EIGRP for IPv6 requires the 'no shutdown' command under the address-family; without it, the process is administratively down.. EIGRP for IPv6 requires the 'no shutdown' command under the address-family configuration to activate the routing process. Without it, the EIGRP process remains administratively down, which prevents route exchange even though the neighbor relationship forms (since EIGRP hellos are sent but routes are not advertised or processed). This is a common misconfiguration when transitioning from EIGRP for IPv4, which does not require an explicit 'no shutdown'.

Answer

The tunnel interface is not configured with 'ipv6 eigrp' under the interface.

Answer

The IPsec transform set does not allow multicast traffic, which EIGRP uses for hellos.

Answer

The GRE tunnel does not support EIGRP for IPv6; only OSPFv3 is supported.

Question 12

A network engineer runs the following command to troubleshoot a BGP Troubleshooting issue:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 12
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1          
  Refresh Epoch 1
  65001
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, external
  Refresh Epoch 2
  65002
    10.2.2.2 from 10.2.2.2 (10.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best

What does this output indicate?

Accepted Answer

The path from AS 65002 is best due to a tie-breaking rule, such as lower neighbor router ID.. The output shows two paths with equal local preference and metric. The best path is from AS 65002, likely due to a tie-breaking rule such as lower router ID or older route. The path from AS 65001 is valid but not best.

Answer

Both paths are equally preferred, and BGP load-balances traffic.

Answer

The path from AS 65002 is best because it has a higher local preference.

Answer

The path from AS 65001 is best because it was received first.

Question 13

An engineer configures a DHCP server on a Cisco router to assign IP addresses from a pool. Clients receive addresses, but when the engineer checks 'show ip dhcp binding', no bindings are displayed. Which is the most likely explanation?

Accepted Answer

The 'ip dhcp excluded-address' command includes the entire pool range, so no addresses are assigned and no bindings are created.. The 'show ip dhcp binding' command only displays bindings that are currently active. If the lease time is very short or the clients release addresses, bindings may not appear. However, a more subtle edge case is when the DHCP server is configured with 'ip dhcp excluded-address' that includes the pool range, causing the server to not assign addresses but still respond with NAKs.

Answer

The DHCP pool is configured with 'lease infinite', causing bindings to be stored in a different database.

Answer

The router's DHCP server is configured in 'database' mode, which stores bindings externally.

Answer

The clients are using DHCPv6, not DHCPv4.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor detail

Neighbor 10.1.1.4, interface address 192.168.14.4
    In the area 0 via interface GigabitEthernet0/2
    Neighbor priority is 1, State is 2WAY, 2 state changes
    DR is 10.1.1.1, BDR is 10.1.1.4
    Options is 0x12 (L L S R)
    Dead timer due in 00:00:38
    Neighbor is up for 00:05:22
    Index 1/1/1, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)
    Last retransmission scan length is 0, time is 0 msec
    Last retransmission scan time is 0 msec

Based on this output, what is the problem?

Accepted Answer

The neighbor is in 2WAY state, meaning the adjacency is not fully established.. The neighbor state is 2WAY, not FULL. This indicates that the neighbor relationship has not progressed to full adjacency. On a broadcast network, routers in 2WAY state have exchanged hello packets but have not completed database exchange. This could be due to mismatched MTU, authentication, or other issues, but the key observation is that the state is not FULL.

Answer

Router R1 is the DR and the neighbor is the BDR, so the state is correct.

Answer

The dead timer is about to expire, causing the neighbor to go down.

Answer

The neighbor has a lower priority than R1, so it remains in 2WAY.

Question 15

An engineer configures CoPP on a router running EIGRP. The policy includes a class-map matching EIGRP traffic with a police rate of 1000 pps. After applying the policy, EIGRP neighbors form but occasionally go active and become stuck-in-active (SIA). Which is the most likely explanation?

Accepted Answer

The police rate in pps is too low, causing EIGRP reliable packets (queries/replies) to be dropped, leading to SIA.. EIGRP uses RTP (Reliable Transport Protocol) for certain packets like queries and replies. These reliable packets require acknowledgment; if the CoPP police rate of 1000 pps is too low, EIGRP queries or replies may be dropped. Missing acknowledgments cause the neighbor to be declared active, and if the query process is not completed within the active timer, the route becomes stuck-in-active (SIA).

Answer

EIGRP uses multicast, and CoPP cannot police multicast traffic.

Answer

CoPP only affects incoming traffic, but EIGRP SIA is caused by outgoing packet drops.

Answer

EIGRP uses TCP, and CoPP only polices UDP.

Question 16

An engineer configures an IPsec site-to-site VPN between two routers. The tunnel comes up, but traffic is not encrypted. Which is the most likely explanation?

Accepted Answer

The crypto ACL does not match the traffic that is being sent.. The most likely reason traffic is not encrypted despite the tunnel being up is that the crypto ACL (access-list) applied to the IPsec configuration does not match the actual traffic being sent. The crypto ACL defines which traffic should be protected by IPsec; if the ACL does not permit the specific source/destination or protocol/port of the traffic, the router will not attempt to encrypt it, even though the IKE and IPsec security associations (SAs) are established.

Answer

The transform set uses ESP with null encryption.

Answer

The ISAKMP policy has the wrong authentication method.

Answer

The pre-shared key is incorrect.

Question 17

What is the default SNMP community string on a Cisco IOS device that has not been configured with any SNMP commands?

Accepted Answer

No default community string exists; SNMP is disabled.. By default, Cisco IOS devices have no SNMP community strings configured because SNMP is disabled until explicitly enabled with the 'snmp-server community' command. Without any SNMP configuration, the device does not respond to SNMP requests, making option D correct. This aligns with Cisco's security best practices to avoid exposing management access unintentionally.

Answer

public

Answer

private

Answer

cisco

Question 18

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

Accepted Answer

Auto-summary is disabled by default, preventing classful summarization.. In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Answer

Auto-summary is enabled by default and summarizes routes at classful boundaries.

Answer

Auto-summary is enabled by default but only for tunnel interfaces.

Answer

Auto-summary is disabled by default but can be enabled only for DMVPN.

Question 19

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify EEM policy registration and enable state. Start by verifying the EEM policy is registered and enabled, then check for any connectivity issues using ping or traceroute, review syslog or debug output for event triggers, examine the policy logic for errors, and finally test the policy manually to confirm resolution.

Question 20

A network engineer is troubleshooting IPv6 DMVPN phase 2 spoke-to-spoke tunnel failures. Spoke routers are able to communicate with the hub, but direct spoke-to-spoke traffic is not working. Router R1 (spoke) has the following relevant configuration:
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ipv6 nhrp network-id 1
 ipv6 nhrp nhs 2001:DB8:1::2
 ipv6 nhrp map multicast dynamic
!
Router R2 (hub) shows: show ipv6 nhrp brief output indicates that both spokes are registered. What is the root cause?

Accepted Answer

The hub is missing the 'ipv6 nhrp redirect' command, and the spokes are missing 'ipv6 nhrp shortcut'.. In DMVPN Phase 2, spoke-to-spoke traffic requires the hub to send NHRP redirect messages and the spokes to use NHRP shortcuts. Without 'ipv6 nhrp redirect' on the hub and 'ipv6 nhrp shortcut' on the spokes, the spokes will forward all inter-spoke traffic through the hub instead of establishing a direct tunnel. The hub's NHRP brief shows both spokes are registered, confirming NHRP registration works, but the missing redirect/shortcut mechanism prevents direct spoke-to-spoke communication.

Answer

The tunnel mode is multipoint, but the spokes need to be configured with 'tunnel mode gre ip' for direct communication.

Answer

The spokes have different NHRP network IDs, preventing registration.

Answer

The IPv6 addresses on the tunnel interfaces are in different subnets.