300-410 Practice Questions

Question 1

Drag and drop the steps to establish a DMVPN Phase 2 spoke-to-spoke tunnel into the correct order, from first to last.

Accepted Answer

Configure NHRP and mGRE on hub and spokes. In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically. First, the spoke must have a valid NHRP registration to the hub. When traffic from one spoke to another triggers an NHRP resolution request, the hub forwards it to the target spoke, which replies. The spoke then initiates a direct mGRE tunnel, and finally, the spoke-to-spoke IPsec session is established.

Question 2

A network engineer runs the following command to troubleshoot a Control Plane Policing (CoPP) issue:

R1# show bgp neighbors 10.1.1.2 received-routes

BGP table version is 10, local router ID is 10.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.3.3.0/24      10.1.1.2                 0    100      0 i

Total number of prefixes 1

What does this output indicate?

Accepted Answer

BGP is receiving routes correctly, and CoPP is not interfering with inbound updates.. The output shows a single BGP prefix (10.3.3.0/24) received from neighbor 10.1.1.2, with the route marked as valid (*) and best (>). This confirms that BGP is successfully receiving and processing the update, and the route is eligible for installation in the routing table. Since the route appears in the received-routes output, CoPP is not dropping the inbound BGP update packets, as CoPP would prevent the packets from reaching the BGP process entirely.

Answer

BGP is not receiving any routes due to CoPP dropping updates.

Answer

BGP is receiving routes but not installing them in the routing table due to CoPP.

Answer

BGP session is flapping due to CoPP.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)
                       Xmit Queue   Mean   Pacing Time   Multicast    Pending
Interface        Peers  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0              1       0/0       12       0/10         50           0
Gi0/1              1       0/0       15       0/10         50           0
Gi0/2              1       0/0       18       0/10         50           0
Gi0/3              1       0/0       20       0/10         50           0
Gi0/4              0       0/0        0       0/10         50           0

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/4 has no EIGRP neighbor, which may indicate a configuration issue or lack of connectivity.. The output shows that interface Gi0/4 has 0 peers, while all other interfaces have 1 peer. In EIGRP, a peer count of 0 indicates that no neighbor adjacency has been formed on that interface. This could be due to a configuration mismatch (e.g., different AS numbers, passive interface, or authentication) or a Layer 1/2 connectivity issue. Therefore, option A is correct.

Answer

All interfaces have at least one EIGRP neighbor.

Answer

The mean SRTT on Gi0/2 is 18 ms, which is too high and indicates a problem.

Answer

The pending routes count of 0 on all interfaces indicates a routing loop.

Question 4

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Accepted Answer

The RSPAN VLAN 200 is also the native VLAN on some trunks, causing the mirrored frames to be sent untagged and possibly dropped.. When the RSPAN VLAN is also configured as the native VLAN on a trunk, mirrored frames are sent untagged on that trunk. Intermediate switches may treat untagged frames as belonging to the native VLAN rather than the RSPAN VLAN, causing them to be forwarded incorrectly or dropped, resulting in intermittent traffic at the destination.

Answer

VTP transparent mode prevents RSPAN from working correctly.

Answer

The source VLAN 50 is not allowed on the trunk ports.

Answer

The monitor session 2 is missing the 'no shutdown' command.

Question 5

Which of the following is a mandatory condition for a route to be considered a feasible successor in EIGRP?

Accepted Answer

The reported distance must be less than the feasible distance.. In EIGRP, a feasible successor is a backup route that can be used immediately if the successor fails. The mandatory condition for a route to be considered a feasible successor is that its reported distance (RD) must be less than the feasible distance (FD) of the current successor. This ensures the backup route is loop-free, as per the Diffusing Update Algorithm (DUAL).

Answer

The metric must be equal to the successor's metric.

Answer

The next-hop router must be directly connected.

Answer

The route must be learned from the same AS.

Question 6

Drag and drop the steps to troubleshoot Policy-Based Routing (PBR) adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify PBR application on interface (show ip policy). Start by checking if PBR is applied on the correct interface. Then verify the route map sequence and match statements. Check the set next-hop reachability via routing table. Use 'debug ip policy' to see packet matches. Finally, test with extended ping or traceroute to confirm path.

Question 7

A network engineer runs the following command to verify BFD with MPLS LDP:

R1# show mpls ldp neighbor 10.6.6.2 detail

Peer LDP Ident: 10.6.6.2:0, Local LDP Ident: 10.6.6.1:0
        TCP connection: 10.6.6.2.646 - 10.6.6.1.53456
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:10:00
        LDP discovery sources:
          GigabitEthernet0/2, hello interval: 5 s, hello hold: 15 s
        Addresses bound to peer LDP ident:
          10.6.6.2        10.7.7.2
        BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BFD is enabled for LDP, allowing faster LDP session failure detection.. The output shows 'BFD enabled, BFD state: UP', indicating that BFD is operational for this LDP session, which allows faster failure detection than LDP hello timers alone.

Answer

BFD is disabled for this LDP session.

Answer

LDP is using BFD only for IPv6.

Answer

BFD state is DOWN, so LDP uses its own hello timers.

Question 8

A network administrator is configuring a Cisco IOS router to authenticate administrative logins using TACACS+ with a fallback to local authentication. The TACACS+ server is reachable, but the administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used. The router currently has the following configuration:

aaa new-model
aaa authentication login default group tacacs+ local

tacacs server TAC1
 address ipv4 10.1.1.1
 key cisco

What additional configuration is required to ensure that the router falls back to local authentication when the TACACS+ server does not respond?

Accepted Answer

No additional configuration is required; the existing configuration already provides fallback to local authentication.. The AAA authentication method list specifies the order of authentication methods. When 'group tacacs+' is followed by 'local', the router tries TACACS+ first. If the TACACS+ server does not respond (e.g., timeout), the router proceeds to the next method, local authentication. Thus, the existing configuration already ensures fallback. The other options either do not enable fallback or are redundant.

Answer

Configure aaa authentication login default group tacacs+ local

Answer

Configure tacacs server TAC1 with the timeout 5 command

Answer

Configure aaa authentication login default group tacacs+ local-case

Question 9

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Option A is correct because static NAT is created with the global configuration command ip nat inside source static

, which permanently maps one inside local address to one inside global address. Option B is correct because the router must know which interface is the internal side, and that is done by entering the interface configuration and issuing the ip nat inside command on the interface facing the internal network. Option C is wrong because ip nat outside must be applied to the external-facing interface, not the internal one. Option D is wrong because an access list is used for dynamic NAT or PAT with the pool/overload syntax, not for a static one-to-one mapping. Option E is wrong because there is no global ip nat service command required to activate NAT on Cisco IOS; NAT is enabled by the inside/outside interface designations and the translation statements themselves.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 10

What is the default administrative distance for OSPF routes on a Cisco IOS-XE router?

Accepted Answer

110. The default administrative distance for OSPF is 110.

Answer

90

Answer

100

Answer

120

Question 11

Examine the following partial configuration:

username admin privilege 15 secret 5 $1$abcdefg$hashedvalue
username operator privilege 1 password cisco
!
line console 0
 login local
!
line vty 0 4
 login local
 transport input ssh

What is a potential security issue with this configuration?

Accepted Answer

The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.. The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Answer

The 'admin' user has privilege 15, which is too high for administrative access.

Answer

The console line is missing the 'transport input' command.

Answer

The VTY lines should use 'login' without 'local' to allow remote authentication.

Question 12

A network engineer runs the following command to verify IPv6 traffic filtering with logging:

R1# show logging | include FILTER
*Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet

What does this output indicate?

Accepted Answer

A TCP packet from 2001:DB8:2::1 to destination 2001:DB8:3::1 port 80 was denied by the access list.. The log message shows an IPv6 ACL (named FILTER) logging a denied TCP packet from source 2001:DB8:2::1 port 12345 to destination 2001:DB8:3::1 port 80. The keyword 'denied' in the log entry confirms the packet was blocked by the access list, making option A correct.

Answer

A TCP packet was permitted by the access list.

Answer

The access list is not applied to any interface.

Answer

The packet was dropped due to uRPF.

Question 13

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 14

Which DHCP message type is used by a client to renew its lease before it expires?

Accepted Answer

DHCPREQUEST. When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Answer

DHCPDISCOVER

Answer

DHCPACK

Answer

DHCPRELEASE

Question 15

A network engineer runs the following command to verify DHCPv4 server statistics on router R1:

R1# show ip dhcp server statistics

Output:
 Memory usage: 12345
 Address pools: 2
 Database agents: 0
 Automatic bindings: 150
 Manual bindings: 5
 Expired bindings: 10
 Malformed messages: 0

Message    Received
 BOOTREQUEST    0
 DHCPDISCOVER   200
 DHCPREQUEST    180
 DHCPDECLINE    2
 DHCPRELEASE    5
 DHCPINFORM     10

What does this output indicate?

Accepted Answer

The DHCP server has 150 active automatic bindings and 5 manual bindings.. The 'Automatic bindings: 150' and 'Manual bindings: 5' fields directly indicate the number of active leases assigned dynamically (via DHCP) and statically (via manual configuration), respectively. These represent the current active bindings on the DHCP server, with no other interpretation needed.

Answer

The DHCP server has received 200 DHCPREQUEST messages.

Answer

The DHCP server has 10 malformed messages, indicating a configuration issue.

Answer

The DHCP server has 2 database agents configured.

Cisco CCNP ENARSI 300-410 practice test

Three ways to study

Study 300-410 by domain

Study 300-410 by topic

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Top 300-410 questions

Cisco CCNP ENARSI 300-410 practice questions