CISCO 300-410 Exam Questions 2025 | ENARSI Certification

On R1 the command ip summary-address rip 10.0.0.0 255.0.0.0 causes the router to advertise only the class-A summary 10.0.0.0/8 out that interface.

When a RIP manual summary is configured, all component routes that fall inside the summary—such as 10.0.1.0/24—are suppressed and therefore never appear in a neighbor’s RIP database.

Removing the summary statement (or disabling auto-summary and using more specific summaries) allows the individual 10.0.1.0/24 route to be advertised and learned, resolving the customer’s complaint.

B. ACL entries are evaluated after route generation; the route is never generated because it is suppressed by summarization, not filtered by an ACL.

C. No ACL filter is relevant—routes are absent before any distribute-list could match.

D. RIP network statements are classful; “network 10.0.0.0” already covers the 10.0.1.0/24 interface, but the specific /24 is hidden by the summary.

1. Cisco IOS IP Routing: RIP Command Reference

“ip summary-address rip

” Usage Guidelines: “When a summary address is configured

RIP advertises only the summary

and all more-specific routes are suppressed.” (Cisco IOS 15M&T

Section: ip summary-address rip).

2. Cisco

“RIP Configuration Guide

Cisco IOS Release 15

” Chapter ‘Configuring RIP

’ Example 5-3: “Manual route summarization… suppresses subordinate routes from the update.”

3. Cisco Press

CCNP Enterprise Advanced Routing ENARSI Official Cert Guide

1st ed.

Ch. 9 “RIP

” pp. 258-259: “A manual summary replaces the individual subnets in outgoing updates; neighbors therefore do not learn the specific subnets.”

The problem is that the inbound access list ipv6-firewall, applied via the ipv6 traffic-filter command, is blocking DNS response traffic. The ACL correctly permits initial DNS queries (permit udp any any eq domain), which have a destination port of 53. However, the DNS server's response will have a source port of 53 and a random high destination port. This return packet does not match the permit rule and is subsequently dropped by the deny ipv6 any any statement.

The stateful ipv6 inspect command is also present but is ineffective because the stateless ipv6 traffic-filter is processed first. To fix the issue, the ACL must be modified to permit the return traffic. Adding the command permit udp any eq domain any log allows packets from any source with a source port of 53 (domain), which correctly identifies and permits the DNS responses.

A. Removing the ipv6 inspect command does not resolve the issue because the flawed stateless ACL, which is the root cause of the block, remains in effect.

C. This command has incorrect syntax for a global inspection rule. Furthermore, fixing the inspection rule would not help as the stateless traffic-filter blocks the packet first.

D. This command has incorrect syntax. The protocol (e.g., udp, tcp) must be specified after permit, and any is not a valid protocol in this context.

1. Cisco IOS IPv6 Configuration Guide

Release 15M&T

"IPv6 Access Control Lists" section. This guide details the syntax for creating IPv6 ACLs. The format permit udp [operator port] [operator port] confirms that permit udp any eq domain any is the correct syntax to match traffic from a source port of 53 (domain).

2. Cisco IOS Security Configuration Guide

Release 15M&T

"Getting Started with the Classic Firewall (Context-Based Access Control)" section

"How CBAC Works" subsection. This documentation explains the order of operations: "When a packet arrives at an interface with an ACL and an inspection rule

the ACL is processed first." This confirms that the stateless traffic-filter will drop the DNS response before the stateful inspect engine can process it.

3. Cisco IOS IPv6 Command Reference

permit (IPv6) command documentation. This reference details the valid keywords and syntax for IPv6 ACL entries

confirming that options C and D use invalid syntax. For example

the protocol must be specified

and any is not a protocol keyword.

The objective is to deny Telnet traffic specifically from R2's Loopback0 to R1's Loopback4, while permitting all other Telnet traffic. The access list is applied inbound on R1's Loopback4 interface. Therefore, the source address is R2's Loopback0 (1001:ABC:2011:7::1) and the destination address is R1's Loopback4 (400A:0:400C::1).

The correct access control entry (ACE) to block this specific traffic is deny tcp host 1001:ABC:2011:7::1 host 400A:0:400C::1 eq telnet. Although the fundamental issue in the exhibit is that the general permit rule (sequence 10) is processed before the specific deny rule, option C correctly identifies the required deny statement.

A. This is a permit statement. The requirement is to deny, not permit, this specific traffic flow.

B. This statement incorrectly reverses the source and destination addresses for a filter applied inbound on R1.

D. This is a permit statement and also incorrectly reverses the source and destination addresses.

1. Cisco IOS XE Security Configuration Guide

Release 17.x

"Implementing IPv6 Access Control Lists": This document states

"The router tests the packet against the conditions in the access list one by one. The first match determines whether the router accepts or rejects the packet." This confirms that a specific deny statement must be placed before a general permit statement to be effective. The syntax for an ACE is also detailed

confirming the structure used in the correct answer.

2. Cisco IOS IPv6 Configuration Guide

Release 15M&T

"IPv6 Access Control Lists": In the section "How to Configure IPv6 ACLs

" the guide provides the command syntax: deny protocol {source-ipv6-prefix/prefix-length | host source-ipv6-address | any} {destination-ipv6-prefix/prefix-length | host destination-ipv6-address | any}. This directly supports the format deny tcp host host as the correct way to specify the source and destination hosts for the traffic to be denied.

3. Cisco IOS Master Command List

"ipv6 traffic-filter": The documentation for this command explains its use for applying an access list to an interface for filtering inbound or outbound traffic. This confirms that for an in filter

the source address in the ACL corresponds to the packet's originator (R2) and the destination is the local interface (R1).

DHCP client requests, such as DHCPDISCOVER, are sent as Layer 2 broadcast frames. Routers, by design, do not forward broadcast traffic between their interfaces, which isolates broadcast domains. In the given topology, the Branch 2 hosts are in a different broadcast domain than the DHCP server. To resolve this, the router interface that acts as the default gateway for the clients (R2's GigabitEthernet 0/2) must be configured as a DHCP relay agent. The ip helper-address command achieves this by intercepting the DHCP broadcasts and forwarding them as unicast packets to the specified DHCP server's IP address (10.10.10.1).

B. The ip helper-address command is a Layer 3 routed interface command and is not configurable on a Layer 2 switchport.

C. The helper address must be configured on the router interface facing the clients (R2 Gi0/2), not on an interface on the DHCP server's router.

D. Configuring the helper address on the DHCP server's own interface (DHCP Gi0/0) is incorrect; it must be on the interface that receives the client broadcasts.

1. Cisco Systems

Inc.

"IP Addressing: DHCP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x"

Section: "Configuring the DHCP Relay Agent". The documentation states

"The ip helper-address command is configured on the interface that receives broadcasts from DHCP clients." This directly supports placing the command on R2's Gi0/2 interface.

2. Cisco Systems

Inc.

"Configuring the DHCP Relay Agent"

Document ID: 13722. This guide specifies

"To enable the DHCP relay agent on an interface

use the ip helper-address address interface configuration command. The address is the IP address of the DHCP server." This confirms the command's purpose and placement on the client-facing gateway interface.

3. Odom

W.

"CCNP Enterprise Advanced Routing ENARSI 300-410 Official Cert Guide" (Cisco Press

2020)

Chapter 20

"DHCP"

Section: "DHCP Relay". The text explains that the ip helper-address command must be configured on the Layer 3 interface on which the client's DHCP broadcast is received.

The error message %Error opening ftp://192.0.2.40/packages.conf (Not logged in) indicates that the router's FTP client attempted an anonymous login, which the FTP server rejected. To resolve this, the client must provide valid credentials.

Cisco IOS XE offers two primary methods for this:

1. Globally configure the default FTP credentials using the ip ftp username and ip ftp password commands. The router will automatically use these for subsequent FTP operations.

2. Specify the credentials directly within the destination URL on the copy command line, using the standard URL syntax: copy flash:packages.conf ftp://username:[email protected]/.

Both methods provide the necessary authentication to the FTP server.

B. Using SCP is a different file transfer protocol; it does not solve the authentication issue with the existing FTP server.

D. A locally configured user on the router is for device management and is not used for authenticating to a remote FTP server.

E. The interactive copy ... ftp: command, as shown in the exhibit, does not prompt for credentials and defaults to an anonymous login.

1. Cisco IOS XE Amsterdam 17.3.x (Catalyst 9300 Switches) IP Application Services Command Reference

ip ftp username and ip ftp password commands.

Reference: "To specify the username for the File Transfer Protocol (FTP) connection

use the ip ftp username command in global configuration mode." and "To specify the password for the File Transfer Protocol (FTP) connection

use the ip ftp password command in global configuration mode." This documentation confirms that these global commands set the default credentials for FTP client operations

supporting option A.

2. Cisco IOS XE Fuji 16.9.x (Catalyst 9300 Switches) Command Reference

Basic File Transfer Services Commands

copy command section.

Reference: The command syntax for the destination is specified as destination-file-url. The URL format is detailed as protocol:[//[user[:password]@]location]/directory/filename. This official syntax guide confirms that embedding the username and password directly in the FTP URL is a valid method

supporting option C.

The OSPF adjacency between R4 and R7 failed, indicating a parameter mismatch. The requirements are to fix the adjacency and ensure R7 is not elected as the Designated Router (DR).

1. DR Election: To prevent a router from participating in the DR/BDR election, its OSPF interface priority must be set to 0.

2. Adjacency Parameters: For an adjacency to form on a broadcast network, parameters such as Hello and Dead intervals must match between neighbors. R4 is using default values, which for a broadcast network are a Hello interval of 10 seconds and a Dead interval of 40 seconds.

Option C applies the ip ospf priority 0 command, satisfying the DR requirement. It also explicitly sets the hello and dead intervals to 10 and 40 seconds, respectively, ensuring they match R4's defaults and resolving the adjacency failure.

A: This configuration creates a hello interval mismatch (5 seconds on R7 vs. the default 10 seconds on R4), which prevents adjacency formation.

B: This changes the OSPF network type to point-to-point, which mismatches R4's default broadcast type on Ethernet, preventing the adjacency.

D: Setting the priority to 255 makes R7 the most likely candidate to become DR, which directly violates the requirement that it must not be elected.

1. Cisco Systems

"IP Routing: OSPF Configuration Guide

Cisco IOS XE Release 3S": In the "Configuring OSPF Interface Parameters" section

the documentation for the ip ospf priority command states

"A router with a router priority of 0 is ineligible to become the DR or backup designated router (BDR)."

2. Cisco Systems

"OSPF Design Guide": Under the section "OSPF Adjacency

" it is specified that for two routers to become adjacent

their "Hello and Dead Intervals" must match on a per-interface basis. The guide also confirms the default Hello interval for broadcast networks is 10 seconds.

3. Cisco Systems

"IP Routing: OSPF Configuration Guide

Cisco IOS XE Release 3S": The documentation for the ip ospf network command explains that the OSPF network type must be consistent between neighbors for an adjacency to form. A mismatch between broadcast (default on R4) and point-to-point (configured in option B) will cause failure.

The issue shown in the exhibit, where interface utilization data is inconsistent after a router reload, is a classic symptom of a non-persistent SNMP interface index (ifIndex). Network Management Systems (NMS) use the ifIndex value within the SNMP MIB to uniquely identify and poll interfaces for performance data. By default, a router may reassign these ifIndex values upon reboot. When this happens, the NMS sees the interface (e.g., GigabitEthernet0/0/0) with a new ifIndex and treats it as a completely new interface, causing a break in the historical data graph. Configuring ifIndex persistence on the router ensures that the mapping between an interface name and its ifIndex is saved and maintained across reboots, providing the NMS with a consistent identifier for polling.

A. Rediscovering interfaces is a reactive workaround, not a preventative solution. It does not link the historical data associated with the old index to the new one.

B. Saving the router configuration is standard practice but does not influence the dynamic assignment of ifIndex values, which occurs during the system boot process.

C. The NMS already uses OIDs that include the ifIndex. The problem is not the OID structure itself, but the dynamic value of the ifIndex component within it.

1. Cisco IOS XE Software Documentation

SNMP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x

"Configuring SNMP Support" section

"Interface Index Persistence" subsection.

"The Interface Index (IF) MIB Persistence feature provides persistent interface index (ifIndex) values in the IF-MIB

which means that the ifIndex values are maintained across router reboots... To enable the persistence of ifIndex values

use the snmp-server ifindex persist command in global configuration mode."

2. Cisco IOS Software Documentation

IP Application Services Configuration Guide

Cisco IOS Release 15M&T

"Configuring SNMP" chapter

"How to Configure SNMP Support" section.

Under the "Enabling Interface Index (ifIndex) MIB Persistence" topic

the guide states: "By default

the ifIndex persistence is disabled on the router. When the router reboots

the interfaces may be assigned to different ifIndex values... This behavior may cause the NMS to rediscover the interfaces on the router and to lose the historical data of the interfaces." It then specifies the snmp-server ifindex persist command as the solution.

In EIGRP a network that appears in the local routing table but is tagged “filtered” in show ip eigrp topology is being blocked by an outbound distribute-list (outgoing filter list).

Because R2’s outbound filter denies 130.130.130.0/24, the prefix never reaches R3 even though R2 knows the route. Configuring (or correcting) an outgoing filter list that explicitly permits the prefix on all interfaces removes the “filtered” state and allows the update to be advertised. Summarization and synchronization do not override distribute-list behavior, and incoming filters affect only what R2 learns, not what it sends.

A. Summarization only changes the prefix length; it cannot override a distribute-list that is already suppressing the route.

B. Incoming filters control routes learned by R2, not those it forwards to neighbors.

C. EIGRP synchronization is disabled by default and only blocks advertisements absent from an IGP, not routes denied by distribute-lists.

1. Cisco IOS 15M&T IP Routing: EIGRP Command Reference – “distribute-list” section

Note 2: “Routes denied by an outbound distribute-list appear as ‘filtered’ in the topology table.”

2. Lacoste & Edgeworth

“CCNP Enterprise Advanced Routing ENARSI 300-410 Official Cert Guide

” 1st ed.

2020

Chapter 10 “EIGRP Route Filtering

” pp. 351-353.

3. Cisco Press

“Troubleshooting IP Routing Protocols

” Allan et al.

2002

Chapter 4 EIGRP

p. 225: explanation of “filtered” state caused by outbound filters.

4. Cisco Networking Academy

“Routing Protocols and Concepts – EIGRP

” v7 curriculum

Section 8.3.2: outbound distribute-list operation and show-command output.

The provided configuration has two primary issues preventing the desired fallback behavior.

1. RADIUS Server Mismatch: The command aaa authentication login default group radius local instructs the router to use the list of globally defined RADIUS servers. This list is populated by the legacy radius-server host command. However, the configuration uses the modern radius server ISE block syntax, which defines a named server that must be placed into a server group (aaa group server radius ...) to be used. Therefore, the group radius method list is not associated with any configured server.

2. Missing Source Interface: The router does not have a specified source interface for RADIUS packets. It will use the IP address of the egress interface by default. If this IP does not match the network device IP configured on the ISE server (192.168.1.1), authentication will fail. This also impacts the router's ability to reliably detect when the server is unreachable and initiate the fallback mechanism.

Adding the legacy server configuration (Option C) and specifying the correct source interface (Option E) resolves both issues.

A. This command creates a server group but is incomplete. The aaa authentication login command must also be modified to reference this new group (as in Option B).

B. This command references a server group named ISE-GROUP that does not exist in the original configuration. It would only work if combined with Option A.

D. This creates a new authentication list named VTY but does not apply it. The VTY lines are still using the broken default list, so the issue remains unresolved.

1. Cisco IOS XE Security Configuration Guide

Release 17.x

"Configuring RADIUS" section. This guide details the two methods for configuring RADIUS servers. It clarifies that the group radius keyword in an aaa authentication command corresponds to servers configured globally with the radius-server host command

not those defined within a named radius server block unless they are part of a server group that is explicitly called.

2. Cisco IOS XE Security Command Reference

"aaa authentication login" command. The documentation for this command confirms that group radius is a keyword that specifies using the list of all globally configured RADIUS servers. This supports the reasoning that the existing configuration has a mismatch.

3. Cisco IOS XE IP Addresses and Services Command Reference

"ip radius source-interface" command. The entry for this command states its purpose is to "force RADIUS to use the IP address of a specific interface for all outgoing RADIUS packets." This is critical for ensuring the Network Access Device (NAD) is correctly identified by the RADIUS server

a common requirement for successful authentication.

This configuration correctly establishes EIGRP MD5 authentication. It first creates a key chain named EIGRP with key 1 and a password (key-string) of Cisco. It then applies this authentication to the correct interface, GigabitEthernet 2.10, which is a subinterface commonly used for VLAN routing in a router-on-a-stick topology when peering with a switch. The commands ip authentication mode eigrp 88 md5 and ip authentication key-chain eigrp 88 EIGRP correctly enable MD5 authentication for AS 88 and link it to the previously defined key chain named EIGRP. This configuration is syntactically and logically correct for the described scenario.

B: The ip authentication key-chain command references the key chain name "Cisco", but the key chain was created with the name "EIGRP".

C: This configuration is applied to the physical interface. In a router-to-switch peering, using a subinterface for a specific VLAN is the standard and more likely configuration.

D: The ip authentication key-chain command references the key chain name "Cisco", but the key chain was created with the name "EIGRP".

1. Cisco Systems

Inc.

IP Routing: EIGRP Configuration Guide

Cisco IOS XE Release 3S

"How to Configure EIGRP" section

"Configuring EIGRP MD5 Authentication" subsection. This document outlines the required steps: 1. Create a key chain. 2. Specify the key number and key string. 3. Configure the interface to use EIGRP authentication. The guide explicitly shows the ip authentication key-chain eigrp command

where must match the name configured with the key chain command. This validates the syntax in option A and invalidates options B and D.

2. Cisco Systems

Inc.

Cisco IOS IP Routing: EIGRP Command Reference

ip authentication key-chain eigrp command documentation. This reference specifies the command syntax as ip authentication key-chain eigrp . The argument is defined as the "Name of the key chain

" confirming it must match the name created in global configuration mode. This directly proves that referencing "Cisco" as the key chain name when it was defined as "EIGRP" is incorrect.

3. Cisco Systems

Inc.

Cisco IOS Interface and Hardware Component Configuration Guide

Release 15M&T

"Configuring a Subinterface on a LAN Interface" section. This guide details the use of subinterfaces for routing traffic from multiple VLANs over a single physical interface (router-on-a-stick). Given that R1 is peering with a switch (SW1)

this topology is the most probable design

making the application of EIGRP configuration on a subinterface (as in option A) more appropriate than on the physical interface (as in option C).