Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 1951–1966

1966 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 26

Page 27 of 27

1951
MCQmedium

A network engineer configures a DMVPN spoke with OSPF as the routing protocol: interface Tunnel0 ip address 10.0.0.2 255.255.255.0 ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp map 10.0.0.1 192.168.1.1 ip nhrp map multicast 192.168.1.1 ! router ospf 1 network 10.0.0.0 0.0.0.255 area 0 ! What is a common issue with OSPF in this DMVPN Phase 2 configuration?

A.OSPF will elect a DR/BDR on the hub, which can cause suboptimal routing and adjacency issues.
B.OSPF will not form adjacencies because of NHRP authentication.
C.OSPF will use point-to-point network type by default.
D.OSPF will automatically adjust to the DMVPN environment.
AnswerA

By default, OSPF over a multipoint interface uses broadcast network type, leading to DR/BDR elections that may not work well with DMVPN.

Why this answer

OSPF over DMVPN Phase 2 requires the hub to be configured as an OSPF point-to-multipoint network type to avoid issues with DR/BDR elections and to allow spoke-to-spoke adjacencies.

Full explanation →
1952
MCQmedium

A network engineer runs the following command to troubleshoot DMVPN NHRP: R1# debug nhrp NHRP: Registration request sent to 10.0.0.1 via GigabitEthernet0/0 NHRP: Registration reply received from 10.0.0.1 Holding time: 3600 sec Flags: 0x0000 NHRP: Cache added 10.1.1.1/32 via 10.0.0.1, non-caching What does this output indicate?

A.NHRP registration to the hub is successful.
B.NHRP registration failed because no reply was received.
C.NHRP registration is pending due to authentication failure.
D.NHRP registration is rejected by the hub.
AnswerA

Registration request sent and reply received, with a cache entry added.

Why this answer

The debug output shows that the spoke sent a registration request to the hub at 10.0.0.1 and received a registration reply with a holding time of 3600 seconds and flags set to 0x0000. The flags value of 0x0000 indicates that the hub accepted the registration without any errors or special conditions, and the subsequent cache addition confirms successful NHRP registration. Therefore, option A is correct.

Exam trap

Cisco often tests the interpretation of NHRP flags, where candidates mistakenly assume that any reply indicates success, but the flags field (e.g., 0x0000 vs. 0x8000) is the actual indicator of acceptance or rejection.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'Registration reply received from 10.0.0.1', indicating a reply was received, not that it failed. Option C is wrong because there is no indication of authentication failure; authentication issues would typically result in a reply with flags indicating rejection or no reply at all, and the flags are 0x0000 (no errors). Option D is wrong because the flags value of 0x0000 means the registration was accepted, not rejected; a rejection would show flags like 0x8000 or similar error codes.

Full explanation →
1953
MCQhard

A network engineer runs the following command on Router R1: R1# show ip sla statistics 4 Round Trip Time (RTT) for Index 4 Latest RTT: 300 ms Latest RTT (milliseconds): 300 Latest RTT (microseconds): 300000 Number of successes: 45 Number of failures: 55 Operation time to live: Forever Output: Over threshold R1# show track 2 Track 2 IP SLA 4 reachability Reachability is Down 5 changes, last change 00:00:05 Latest operation return code: Over threshold Latest RTT (milliseconds): 300 Tracked by: ip route 0.0.0.0 0.0.0.0 192.168.2.1 track 2 Based on this output, which statement is correct?

A.The IP SLA operation is failing because the target is unreachable.
B.The tracked static route is active because the IP SLA has successes.
C.The IP SLA threshold has been exceeded, causing the track to go down and the static route to be removed.
D.The IP SLA operation has a 55% failure rate, but the track is still up.
AnswerC

The track is down due to 'Over threshold', which means the static route is no longer installed.

Why this answer

The track shows 'Down' because the IP SLA return code is 'Over threshold'. This means the threshold was exceeded, and the track has brought down the static route. The failures (55) are high, but the key is that the track is down due to the threshold violation.

Full explanation →
1954
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip vrf detail RED VRF RED (VRF Id = 1); default RD <not set> Interfaces: GigabitEthernet0/2 Loopback1 Address family IPV4 (Table ID = 1): No Export VPN route-target communities No Import VPN route-target communities No import route-map No export route-map VRF label distribution protocol: not configured Address family IPV6 (Table ID = 0x1E000001): No Export VPN route-target communities No Import VPN route-target communities No import route-map No export route-map VRF label distribution protocol: not configured Based on this output, which statement is correct?

A.The VRF RED has a Route Distinguisher configured.
B.The VRF RED includes two interfaces: GigabitEthernet0/2 and Loopback1.
C.The VRF RED has an export route-map configured.
D.The VRF RED is configured for MPLS label distribution.
AnswerB

The output lists these two interfaces under VRF RED.

Why this answer

The 'show ip vrf detail RED' command shows detailed VRF information. It lists interfaces GigabitEthernet0/2 and Loopback1. The RD is not set, which is common for VRF-Lite (no MPLS).

There are no route-target communities, which is expected for VRF-Lite.

Full explanation →
1955
MCQhard

In OSPF, what is the default behavior for auto-summary on Cisco IOS-XE?

A.Auto-summary is enabled by default
B.Auto-summary is disabled by default
C.Auto-summary is only enabled for external routes
D.Auto-summary is enabled only for inter-area routes
AnswerB

Correct. Auto-summary is disabled by default for OSPF in Cisco IOS-XE.

Why this answer

Cisco IOS-XE has auto-summary disabled by default for OSPF, meaning that redistributed routes are not summarized to their classful boundaries unless explicitly configured.

Full explanation →
1956
MCQhard

How does BFD prevent loops in a network where multiple BFD sessions might exist between the same pair of routers?

A.By using TTL values to limit packet propagation
B.By requiring authentication in all BFD packets
C.By matching the Your Discriminator field against the local discriminator
D.By using sequence numbers in BFD Control packets
AnswerC

The Your Discriminator field must match the receiver's local discriminator for the packet to be accepted, preventing loops from misrouted packets.

Why this answer

BFD uses a mandatory Your Discriminator field in Control packets; a router will only accept a BFD Control packet if the Your Discriminator matches its own local discriminator, preventing misdirected packets from creating loops.

Full explanation →
1957
MCQhard

An engineer is troubleshooting a network where R1 and R2 are running EIGRP, and R2 redistributes a static route for 192.168.1.0/24 into EIGRP. R1 also learns the same prefix via OSPF from R3 with an AD of 110. The engineer observes that R1 prefers the EIGRP external route (AD 170) over the OSPF route. What configuration change would cause this behavior?

A.The OSPF route is a type 5 LSA, which has a higher AD than type 3 LSAs.
B.The engineer applied the distance eigrp 90 100 command under EIGRP, lowering the AD for external routes to 100.
C.The OSPF route has a metric of 20, while the EIGRP route has a metric of 2560.
D.The static route was redistributed with a route-map that sets the EIGRP metric to 1.
AnswerB

This sets the AD for EIGRP internal routes to 90 and external to 100, making the external route (AD 100) preferred over OSPF (AD 110).

Why this answer

By default, EIGRP external routes have an AD of 170, and OSPF has AD 110, so OSPF should be preferred. If the EIGRP external route is preferred, the AD must have been lowered, likely via the distance command under EIGRP.

Full explanation →
1958
MCQmedium

Consider the following EEM applet configuration: !--- event manager applet CHECK_OSPF event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected." !--- What is the effect of this configuration?

A.The applet will send an email to the administrator whenever an OSPF adjacency change occurs.
B.The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.
C.The applet will fail because the 'event syslog pattern' must be configured with a regular expression.
D.The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.
AnswerA

Correct. The applet triggers on the OSPF adjacency change syslog message and sends an email with the specified details.

Why this answer

The EEM applet triggers on a syslog message matching the pattern "OSPF-5-ADJCHG". When triggered, it sends an email notification to the administrator. The 'cli command' actions are executed but their output is not used; the email is sent regardless.

The applet does not require any additional configuration to send the email, provided the mail server is reachable.

Full explanation →
1959
MCQmedium

A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 4 detail Session 4 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi0/2 Encapsulation : Native Ingress : Disabled What does this output indicate?

A.The session is correctly configured as an RSPAN destination session.
B.The session is misconfigured because the source must be a port, not a VLAN.
C.The session is misconfigured because the destination port must have ingress enabled.
D.The session is misconfigured because the RSPAN VLAN must be the same as the source VLAN.
AnswerA

The output confirms an RSPAN destination session with a source RSPAN VLAN and destination port.

Why this answer

The output shows an RSPAN destination session with source RSPAN VLAN 100 and destination port Gi0/2. This is the destination side of an RSPAN configuration.

Full explanation →
1960
MCQhard

A network engineer runs the following command to troubleshoot an EEM issue: R1# debug event manager action cli EEM Action CLI debugging is on R1# Mar 1 00:10:15.123: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli command: 'show ip int brief' executed Mar 1 00:10:15.456: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli output: 'Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES NVRAM up up GigabitEthernet0/1 10.0.0.1 YES NVRAM up up Loopback0 1.1.1.1 YES NVRAM up up' What does this output indicate?

A.The EEM applet 'TRACK-INTERFACE' executed the command 'show ip int brief' and the output was displayed.
B.The EEM applet 'TRACK-INTERFACE' failed to execute the command 'show ip int brief'.
C.The debug output shows the EEM applet configuration for 'TRACK-INTERFACE'.
D.The command 'show ip int brief' was executed manually by the engineer.
AnswerA

Correct. The debug output shows the applet executing the command and the resulting output.

Why this answer

The debug output shows the execution of CLI actions within an EEM applet. It displays the applet name, the CLI command being executed, and the output of that command. This is useful for verifying that CLI actions are working correctly and seeing the exact output returned.

Full explanation →
1961
MCQmedium

What is the default DHCPv4 renewal time (T1) as a percentage of the lease time?

A.25%
B.50%
C.75%
D.87.5%
AnswerB

T1 is 50% of the lease time per RFC 2131.

Why this answer

(50%) because RFC 2131 defines the DHCPv4 renewal time (T1) as 50% of the lease duration. When the T1 timer expires, the client attempts to renew its lease by sending a unicast DHCPREQUEST to the server that originally granted the lease.

Exam trap

Cisco often tests the distinction between T1 (renewal at 50%) and T2 (rebinding at 87.5%), and the trap here is that candidates confuse the two percentages or assume the renewal time is a higher value like 75%.

How to eliminate wrong answers

Option A (25%) is wrong because 25% is not defined as any DHCP timer in RFC 2131; it is a common distractor that might be confused with the rebinding time (T2), which defaults to 87.5%. Option C (75%) is wrong because 75% is not a standard DHCP timer value; it is often mistakenly thought to be the renewal time due to a misunderstanding of the rebinding percentage. Option D (87.5%) is wrong because 87.5% is the default rebinding time (T2), not the renewal time (T1); T2 is the point at which the client broadcasts to any available DHCP server if renewal with the original server fails.

Full explanation →
1962
MCQeasy

In MPLS L3VPN, what is the purpose of the Route Distinguisher (RD)?

A.To make IPv4 prefixes unique across different VRFs in the MPLS network.
B.To control which VRFs import routes from other PEs.
C.To specify the VPN label that is used for forwarding.
D.To identify the VRF on the local PE router.
AnswerA

The RD creates a globally unique VPNv4 prefix by combining with the IPv4 address, preventing route ambiguity.

Why this answer

The RD is an 8-byte value prepended to an IPv4 prefix to create a unique VPNv4 prefix. This allows overlapping IPv4 addresses from different VRFs to be carried in the same BGP table without conflict.

Full explanation →
1963
MCQhard

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

A.The 'logging source-interface' is configured to an interface that is administratively down.
B.The 'logging on' command is missing from the configuration.
C.The syslog server is using TCP, but the router is configured for UDP.
D.The logging buffer is full, preventing new messages from being generated.
AnswerA

Correct because if the source interface is down, the router cannot use its IP address, and the syslog server may drop messages from an unexpected source IP or the packets may be routed incorrectly.

Why this answer

The 'show logging' output shows that syslog is enabled but no messages are being sent. A common reason is that the 'logging source-interface' is set to an interface that is down or not reachable, causing the router to use an incorrect source IP that the server may filter or that routing may not support. Alternatively, the server may be configured to accept messages only from specific source IPs.

Full explanation →
1964
MCQeasy

In OSPF, what is the default hello interval on a point-to-point network type?

A.10 seconds
B.30 seconds
C.40 seconds
D.20 seconds
AnswerA

This is the standard default for point-to-point and broadcast networks.

Why this answer

The default hello interval for OSPF on point-to-point networks is 10 seconds, as per RFC 2328.

Full explanation →
1965
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type Hardware address/ User name 192.168.1.10 0063.6973.636f.2e30. Mar 01 2020 12:00 AM Automatic 3030.3030.2e30.3030 312e.3130.3030.2e30 3030.312d.4574.682d 302f.31 192.168.1.11 0063.6973.636f.2e30. Mar 01 2020 12:00 AM Automatic 3030.3030.2e30.3030 312e.3130.3030.2e30 3030.312d.4574.682d 302f.31 Based on this output, which statement is correct?

A.The DHCP server is functioning correctly with two unique bindings.
B.The DHCP server has a duplicate client-id issue, likely caused by two clients using the same client identifier.
C.The DHCP server has run out of addresses in the pool.
D.The DHCP server is not assigning addresses because the lease time is set to 0.
AnswerB

The hex client-id is identical for both bindings, indicating a duplicate.

Why this answer

The output shows two DHCP bindings with identical client identifiers (the long hexadecimal string). This indicates that two clients are using the same client-ID, which violates RFC 2131 and causes the DHCP server to treat them as the same client, leading to duplicate address assignments or conflicts. Option B correctly identifies this duplicate client-id issue.

Exam trap

Cisco often tests the distinction between a duplicate client-ID and a normal DHCP binding, where candidates mistakenly assume two different IP addresses mean two unique clients, ignoring the identical client-ID field in the output.

How to eliminate wrong answers

Option A is wrong because the DHCP server is not functioning correctly; it has two bindings with the same client-ID, which indicates a misconfiguration or duplicate client identifier, not a healthy state. Option C is wrong because there is no evidence of address exhaustion; the pool still has addresses available (only two bindings are shown, and no 'out of addresses' message appears). Option D is wrong because the lease expiration is set to 'Mar 01 2020 12:00 AM', which is a valid date, not a lease time of 0; a lease time of 0 would show 'Infinite' or '0' explicitly, not a specific date.

Full explanation →
1966
MCQmedium

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

A.RA Guard
B.DHCPv6 Guard
C.ND Snooping
D.Source Guard
AnswerC

Correct. ND Snooping monitors ND messages to prevent DAD attacks and other ND-based threats.

Why this answer

C is correct because ND Snooping (Neighbor Discovery Snooping) is the IPv6 First Hop Security feature that prevents duplicate address detection (DAD) attacks by inspecting Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages. It builds a binding table of valid IPv6-to-MAC address mappings and drops any NS messages that attempt to claim an address already in use by another device, thereby blocking DAD-based spoofing attacks.

Exam trap

The trap here is that candidates often confuse ND Snooping with RA Guard or DHCPv6 Guard, thinking any 'Guard' feature handles DAD attacks, but only ND Snooping directly inspects Neighbor Discovery messages used in the DAD process.

How to eliminate wrong answers

Option A is wrong because RA Guard (Router Advertisement Guard) is designed to block unauthorized Router Advertisement messages to prevent rogue router attacks, not to prevent DAD attacks. Option B is wrong because DHCPv6 Guard filters DHCPv6 server messages to prevent rogue DHCPv6 servers, and does not inspect Neighbor Discovery messages for DAD protection. Option D is wrong because Source Guard (IPv6 Source Guard) filters traffic based on the source IPv6 address against the ND Snooping binding table, but it does not directly prevent DAD attacks; it prevents source address spoofing after the binding is established.

Full explanation →
Page 26

Page 27 of 27

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →