hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer is troubleshooting a BGP peering…
An engineer is troubleshooting a BGP peering problem between two routers, R1 (AS 65001) and R2 (AS 65002), connected via a firewall. The BGP session is flapping every few seconds. The engineer notices that the TCP connection is established, but BGP OPEN messages are not exchanged. The firewall logs show that TCP port 179 is allowed, but packets with the BGP marker (0xFFFFFFFF) are being dropped. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.
BGP uses a 16-byte marker (all 0xFF) in its messages. Some firewalls or intrusion prevention systems may misinterpret this as a malformed packet and drop it, preventing BGP from establishing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall is dropping BGP packets because the BGP marker (0xFFFFFFFF) is being flagged as a potential attack or malformed packet.
Why this is correct
Correct because some security devices inspect BGP messages and may drop packets with the all-ones marker, especially if they are not configured to allow BGP properly.
- ✗
The BGP session is flapping because the keepalive timer is set too low on both routers.
Why it's wrong here
Incorrect because keepalive issues would cause the session to go down after it was established, not prevent OPEN messages.
- ✗
The BGP session is flapping because the routers have mismatched BGP AS numbers.
Why it's wrong here
Incorrect because mismatched AS numbers would cause a NOTIFICATION after the OPEN message is sent, not a drop of the OPEN itself.
- ✗
The BGP session is flapping because the firewall is performing TCP sequence number randomization, breaking the BGP session.
Why it's wrong here
Incorrect while TCP sequence randomization can cause issues, it would typically affect the TCP handshake, not the BGP OPEN message specifically.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.