hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A network uses PBR to route traffic from a…
A network uses PBR to route traffic from a specific host (10.1.1.1) through a VPN tunnel (next-hop 10.10.10.2). After a VPN tunnel failure, traffic from this host is being dropped. Router R1 shows: 'show ip policy' shows PBR applied, 'debug ip policy' shows 'PBR: no route to next-hop 10.10.10.2', but 'show ip route 10.10.10.2' shows a route via a different interface. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.
PBR requires the next-hop to be directly reachable (i.e., on a directly connected subnet). If the next-hop is reachable via a route (e.g., through another router), PBR will not use it because it expects a direct connection. In this case, 10.10.10.2 is reachable via a route, not directly connected, so PBR drops the traffic. The solution is to ensure the next-hop is directly connected or use a different next-hop that is directly connected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The next-hop 10.10.10.2 is not directly connected; it is reachable via a route. PBR requires the next-hop to be directly connected. Use a directly connected next-hop or configure a static route to make it directly connected.
Why this is correct
Policy-Based Routing (PBR) mandates that the specified next-hop IP address must be directly connected to the router. The `debug ip policy` output, showing "no route to next-hop 10.10.10.2", indicates this constraint is not met. Even though `show ip route` displays a route to 10.10.10.2 via a different interface, PBR's lookup mechanism specifically requires a directly connected entry for the next-hop. When the VPN tunnel fails, the directly connected path to 10.10.10.2 is lost, causing PBR to fail and traffic to be dropped.
- ✗
The route-map is missing a 'set ip next-hop verify-availability' command, causing PBR to use the next-hop even when it is not reachable.
Why it's wrong here
The debug output shows 'no route to next-hop', not that the next-hop is unreachable. The issue is that the next-hop is not directly connected, not that it is unreachable.
- ✗
The routing table on R1 has a better route to the destination via the VPN tunnel, overriding PBR.
Why it's wrong here
PBR overrides the routing table for matched traffic. The debug output shows PBR is trying to forward traffic but cannot find a route to the next-hop, so the routing table is not the issue.
- ✗
The VPN tunnel is down, causing the next-hop to be unreachable.
Why it's wrong here
The 'show ip route 10.10.10.2' shows a route via a different interface, indicating the next-hop is reachable, but not directly connected. The VPN tunnel failure is not the root cause.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.