Courseiva
← 300-410
Full test
hardMultiple ChoiceObjective-mapped

300-410 Practice Question: A network uses PBR to route traffic from a…

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall policy change, traffic from this VLAN is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows traffic being forwarded to 192.168.1.1, but 'debug ip packet' on R1 shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but 'show access-lists' on the firewall shows an ACL that denies traffic from 10.10.10.0/24. What is the root cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall has an ACL that denies traffic from 10.10.10.0/24. Update the ACL to allow this traffic.

PBR forwards traffic to the firewall, but the firewall has an ACL that denies traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall ACL to allow traffic from the source subnet.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    The firewall has an ACL that denies traffic from 10.10.10.0/24. Update the ACL to allow this traffic.

    Why this is correct

    PBR successfully forwards traffic to the firewall, but the firewall drops it due to an ACL. The routing is correct, but the firewall policy is blocking the traffic.

  • ✗

    The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.

    Why it's wrong here

    The debug output shows packets being sent to 192.168.1.1, indicating the next-hop is reachable. The issue is on the firewall side.

  • ✗

    The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.

    Why it's wrong here

    The next-hop is reachable, as evidenced by the debug output. The 'verify-availability' command would not help here because the firewall is reachable but drops the traffic.

  • ✗

    The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.

    Why it's wrong here

    If an ACL were blocking traffic on R1, the debug output would show packets being dropped before PBR. The debug shows packets being sent to the firewall, so no ACL is blocking on R1.

Visual reference

Switch VLAN 10 Sales (192.168.10.0/24) PC-A PC-B VLAN 20 HR (192.168.20.0/24) PC-C PC-D Router VLANs isolate traffic — inter-VLAN routing requires a Layer 3 device

About these practice questions

One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on 300-410

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?

hard
  • ✓ A.The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.
  • B.The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.
  • C.The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.
  • D.The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.

Why A: PBR forwards traffic to the firewall, but the firewall is configured to drop traffic from the source subnet (10.10.10.0/24). This is a policy issue on the firewall, not a routing issue. The solution is to update the firewall policy to allow traffic from the source subnet.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.