hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A network uses PBR to route traffic from a…
A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.
PBR forwards traffic to the firewall, but the firewall is configured to drop traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall policy to allow traffic from the source subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.
Why this is correct
PBR successfully forwards traffic to the firewall, but the firewall drops it due to its own security policy. The routing is correct, but the firewall policy is blocking the traffic.
- ✗
The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.
Why it's wrong here
The debug output confirms R1 successfully forwards packets to 192.168.1.1, proving the next-hop is reachable from R1; the failure occurs at R2, which drops traffic from 10.10.10.0/24 per its configured policy. This option is tempting because a missing route to the next-hop is a common PBR failure cause, and it would be correct if R1’s ‘debug ip packet’ showed no ARP reply or ICMP unreachable for 192.168.1.1, indicating a Layer 3 reachability problem.
- ✗
The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.
Why it's wrong here
The next-hop is reachable, as evidenced by the debug output. The 'verify-availability' command would not help here because the firewall is reachable but drops the traffic.
- ✗
The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.
Why it's wrong here
The debug output confirms packets reach 192.168.1.1, proving R1’s VLAN interface has no ACL blocking the source subnet; an ACL would drop packets before they leave R1, contradicting the debug evidence. This option is tempting because ACLs are commonly used to filter traffic from specific VLANs at the ingress interface, and in a scenario where packets never appear in debug output, an ACL would be the correct root cause.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.