300-410 Timed Practice Test 3 — 10 Questions

Question 1

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order begins with entering global configuration mode, then defining the EEM applet and its syslog trigger, followed by configuring the action to execute, and finally exiting configuration mode to register the applet.

Question 2

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# debug crypto ipsec

*Mar  1 00:02:34.567: IPSEC(sa_request): , (key eng. msg.) src=10.0.0.1, dst=10.0.0.2, src_proxy=192.168.1.0/255.255.255.0/0/0, dst_proxy=192.168.2.0/255.255.255.0/0/0, 
*Mar  1 00:02:34.567: IPSEC(validate_proposal): transform proposal (esp-3des esp-sha-hmac) not supported for proxy 192.168.1.0/255.255.255.0/0/0
*Mar  1 00:02:34.567: IPSEC(validate_proposal): proposal doesn't match!
*Mar  1 00:02:34.568: IPSEC(create_sa): SA created with (0x1234, 0x5678) but no inbound or outbound SPI

What does this output indicate?

Accepted Answer

The transform set on the remote peer does not match the local transform set, causing IPsec SA negotiation to fail.. The debug output shows that the IPsec SA request is generated, but the transform proposal (esp-3des esp-sha-hmac) is rejected with 'not supported for proxy'. This indicates that the remote peer does not support or is configured with a different transform set, causing the proposal to fail validation. The SA is created with placeholder SPIs (0x1234, 0x5678) but no actual inbound/outbound SPI, confirming negotiation failure due to transform set mismatch.

Answer

The IPsec SA is established successfully with ESP 3DES and SHA.

Answer

The ACL for the crypto map is misconfigured, causing the traffic to not match.

Answer

The IKE phase 1 SA is not established before IPsec negotiation.

Question 3

A network engineer runs the following command to verify IPv6 uRPF operation:

R1# show ipv6 interface GigabitEthernet0/0 | include verify
  IPv6 verify source: strict

What does this output indicate?

Accepted Answer

Strict uRPF is enabled, so the router will drop packets if the source address is not in the routing table or if the best return path is not through the receiving interface.. The output 'IPv6 verify source: strict' indicates that strict unicast Reverse Path Forwarding (uRPF) is enabled on the interface. Strict uRPF verifies that the source IPv6 address of an incoming packet is reachable via the routing table AND that the best return path to that source uses the same interface on which the packet was received. If either condition fails, the packet is dropped. This matches option A exactly.

Answer

Strict uRPF is enabled, but it only checks if the source address is in the routing table, regardless of interface.

Answer

Loose uRPF is enabled, which only checks if the source address is in the routing table.

Answer

uRPF is disabled on this interface.

Question 4

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 5

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.. The IPsec SA is present but the packet counters are all zero. This indicates that the tunnel is established but no interesting traffic is being sent through it. The likely cause is that the crypto ACL does not match the actual traffic or routing is not directing traffic into the tunnel.

Answer

The IPsec SA is not established; phase 1 is still pending.

Answer

The remote peer is unreachable; the SA is in a dead state.

Answer

The tunnel interface is down; the SA cannot be used.

Question 6

A network engineer runs the following command to troubleshoot an IP SLA issue:

R1# debug ip sla trace

IP SLAs trace debugging is on

*Mar  1 12:34:56.789: IP SLAs: Starting operation 10
*Mar  1 12:34:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:34:56.790: IP SLAs: RTT = 12 ms
*Mar  1 12:34:56.790: IP SLAs: Operation 10 completed successfully
*Mar  1 12:35:56.789: IP SLAs: Starting operation 10
*Mar  1 12:35:56.789: IP SLAs: Sending ICMP echo request to 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: Received ICMP echo reply from 192.168.1.1
*Mar  1 12:35:56.790: IP SLAs: RTT = 14 ms
*Mar  1 12:35:56.790: IP SLAs: Operation 10 completed successfully

What does this output indicate?

Accepted Answer

The IP SLA operation is successfully completing each probe cycle.. This debug output shows the IP SLA trace for operation 10 (newer command). It confirms successful ICMP echo probes with RTT values, indicating the operation is functioning correctly.

Answer

The IP SLA operation is failing because the RTT values are too high.

Answer

The IP SLA operation is not configured because no configuration is shown.

Answer

The IP SLA operation is timing out because no reply is received.

Question 7

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Accepted Answer

Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.. To stop sending debug messages to the remote server without affecting local logging, the engineer should change the remote logging severity to a higher level (e.g., 'logging host 10.1.1.100 trap notifications' to set severity 5). This will exclude debug (severity 7) messages from being sent to that specific host. The local buffer can remain at debugging level.

Answer

Configure 'no logging trap debugging' globally.

Answer

Use 'undebug all' to stop all debug output.

Answer

Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.

Question 8

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Accepted Answer

Configure 'event cli pattern "write memory" sync no' under the applet.. The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'. The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.

Answer

Define the applet using the 'event manager policy' command instead of 'event manager applet'.

Answer

Add an 'event syslog pattern "WRITE"' to detect the write memory operation.

Answer

Include an 'action cli command "enable"' before the copy command to ensure privileged access.

Question 9

Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)

Accepted Answer

A time-range can include both absolute and periodic statements simultaneously.. The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.

Answer

The time-range is applied to the entire ACL, not individual ACEs.

Answer

If the router's clock is not set, the time-range will be considered active at all times.

Answer

The time-range feature can only be used with extended named ACLs, not standard ACLs.

Question 10

What is the maximum hop count for an EIGRP route?

Accepted Answer

224. EIGRP uses a maximum hop count of 224, not 255 like RIPv2 or other distance-vector protocols. This limit is hard-coded in the EIGRP protocol to prevent routing loops and excessive path lengths, and it is enforced by the EIGRP update process. Routes with a hop count exceeding 224 are considered unreachable and are not installed in the routing table.

Answer

15

Answer

255

Answer

Unlimited