CertArea
All Cisco exams

Free 300-410 practice test: 30 questions with answers

30 original questions for Implementing Cisco Enterprise Advanced Routing and Services (ENARSI), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

300-410 exam guide: topics, cost and format

All 30 300-410 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Layer 3 technologies (6 questions)

  1. Question 1

    Two OSPF routers on the same segment are both connected, and an engineer wants a specific router to become the designated router. Which setting most directly influences the DR election?

    1. AThe hostname length
    2. BThe MTU of a loopback interface
    3. CThe OSPF interface priority
    4. DThe interface description
    Show answer and explanation
    Correct answer: C

    OSPF elects the DR using the highest interface priority, with the router ID as a tiebreaker. Interface descriptions, hostnames, and loopback MTU do not affect the election.

  2. Question 2

    An OSPF neighbour relationship remains stuck in the EXSTART or EXCHANGE state. Which issue is the most likely cause?

    1. AA mismatched MTU on the two interfaces
    2. BThe loopback interface has a description
    3. CA matching hello interval
    4. DThe same router ID on both routers
    Show answer and explanation
    Correct answer: A

    A mismatched MTU commonly prevents database description exchange, which leaves neighbours stuck in EXSTART or EXCHANGE. Matching hello intervals and descriptions are not problems here, and duplicate router IDs produce a different symptom.

  3. Question 3

    Which OSPF area type blocks Type 5 external routes and uses a default route for external destinations?

    1. ATotally stubby area
    2. BNormal area with no restrictions
    3. CBackbone area 0 only
    4. DVirtual link
    Show answer and explanation
    Correct answer: A

    A totally stubby area blocks Type 3 and Type 5 LSAs and relies on a default route for all destinations outside the area. Area 0 is the backbone, a normal area carries all LSAs, and a virtual link connects areas.

  4. Question 4

    Which EIGRP feature allows traffic to be load-balanced over paths with different metrics?

    1. AUnequal-cost load balancing using the variance command
    2. BStub routing only
    3. CA static default route with no metric
    4. DPassive interfaces on every link
    Show answer and explanation
    Correct answer: A

    EIGRP uses the variance setting to include feasible successors with higher metrics in load balancing. Stub routing, static defaults, and passive interfaces do not balance traffic across unequal paths.

  5. Question 5

    An EIGRP router has a feasible successor for a route. What does a feasible successor allow?

    1. ARouting with no metric
    2. BAutomatic removal of the route from the table
    3. CImmediate failover to a backup path without a recomputation
    4. DA permanent loop in the network
    Show answer and explanation
    Correct answer: C

    A feasible successor is a backup path that meets the feasibility condition, so the router can switch to it immediately if the successor fails. It does not create loops, has a metric, and does not remove routes.

  6. Question 6

    Which BGP path attribute is preferred first when selecting the best path inside an autonomous system, and is set to influence outbound traffic?

    1. ARouter ID only
    2. BLocal preference
    3. CAS path length only
    4. DOrigin code only
    Show answer and explanation
    Correct answer: B

    Local preference is used within an AS to choose the preferred exit path, and it is evaluated before AS path length. Origin code and router ID are considered later in the decision process.

Infrastructure services (6 questions)

  1. Question 7

    A router must send system messages to a central logging server so that events can be reviewed later. Which protocol is used for this?

    1. ANTP only
    2. BTFTP only
    3. CDHCP
    4. DSyslog
    Show answer and explanation
    Correct answer: D

    Syslog forwards log messages from network devices to a central collector. DHCP assigns addresses, NTP synchronizes time, and TFTP transfers files.

  2. Question 8

    Which syslog severity level number represents an emergency condition, the most severe level?

    1. A0
    2. B5
    3. C7
    4. D3
    Show answer and explanation
    Correct answer: A

    Syslog severity 0 is emergency, the most severe level, and 7 is debugging. Levels 3 and 5 are error and notice, respectively.

  3. Question 9

    A router must translate many internal private addresses to a single public address for outbound access. Which feature is used?

    1. APAT (NAT overload)
    2. BDHCP relay
    3. CSyslog forwarding
    4. DStatic NAT for every host
    Show answer and explanation
    Correct answer: A

    PAT, also called NAT overload, maps many private addresses to one public address using port numbers. Static NAT maps one-to-one, DHCP relay forwards requests, and syslog forwards logs.

  4. Question 10

    A router must forward DHCP requests from a client subnet to a DHCP server on another subnet. Which command or feature is needed?

    1. Aip helper-address
    2. Bip nat inside
    3. Clogging host
    4. Dip domain-lookup
    Show answer and explanation
    Correct answer: A

    The ip helper-address command relays DHCP broadcast requests to a remote DHCP server as unicast. The NAT, domain lookup, and logging commands do not relay DHCP.

  5. Question 11

    Which flow monitoring technology exports summarized records of network traffic, such as source, destination, and byte counts, to a collector?

    1. ASNMP trap only
    2. BPort mirroring
    3. CNetFlow
    4. DSyslog only
    Show answer and explanation
    Correct answer: C

    NetFlow exports flow records that summarize traffic, which supports traffic analysis and capacity planning. SNMP traps report events, port mirroring copies traffic, and syslog carries messages.

  6. Question 12

    Which SNMP version provides authentication and encryption of messages, which earlier versions lack?

    1. ANo version provides encryption
    2. BSNMPv1
    3. CSNMPv2c
    4. DSNMPv3
    Show answer and explanation
    Correct answer: D

    SNMPv3 adds authentication and encryption through its security model. SNMPv1 and SNMPv2c send community strings in clear text, and the last option is incorrect.

Infrastructure security (6 questions)

  1. Question 13

    A switch port must accept only a limited number of MAC addresses and shut down if an unknown device connects. Which feature provides this?

    1. ASpanning tree root guard
    2. BPort security
    3. CSyslog
    4. DDHCP snooping only
    Show answer and explanation
    Correct answer: B

    Port security limits the number of MAC addresses on a port and can shut the port down on violation. DHCP snooping filters DHCP messages, root guard protects spanning tree, and syslog logs messages.

  2. Question 14

    Which switch feature blocks rogue DHCP servers by allowing DHCP server responses only on trusted ports?

    1. ADHCP snooping
    2. BNAT overload
    3. CHot Standby Router Protocol
    4. DUplink fast
    Show answer and explanation
    Correct answer: A

    DHCP snooping designates trusted and untrusted ports and drops DHCP server messages from untrusted ports. NAT, uplink fast, and HSRP do not filter DHCP servers.

  3. Question 15

    Dynamic ARP Inspection is used to prevent what type of attack?

    1. ABrute-force password guessing
    2. BDenial-of-service on a web server
    3. CCertificate expiry
    4. DARP spoofing
    Show answer and explanation
    Correct answer: D

    Dynamic ARP Inspection validates ARP packets against trusted bindings, which blocks ARP spoofing. Password guessing, web denial-of-service, and certificate expiry are different problems.

  4. Question 16

    Which AAA component authorizes a user to run specific commands on a network device after authentication?

    1. AAccounting only
    2. BAuthorization
    3. CAccessibility
    4. DAddressing
    Show answer and explanation
    Correct answer: B

    Authorization controls what an authenticated user can do, such as permitted commands. Accounting records activity, and accessibility and addressing are not AAA components.

  5. Question 17

    A network requires that each user authenticate before a switch port is enabled. Which standard provides this port-based access control?

    1. AIEEE 802.1Q only
    2. BIEEE 802.11 beacon
    3. CIEEE 802.1X
    4. DIEEE 802.3ad
    Show answer and explanation
    Correct answer: C

    802.1X provides port-based network access control with authentication before the port is fully enabled. 802.3ad is link aggregation, 802.1Q is VLAN tagging, and 802.11 is wireless.

  6. Question 18

    Which AAA protocol encrypts the entire packet payload for device administration, and is preferred for network device management?

    1. ANetFlow
    2. BRADIUS for all tasks
    3. CTACACS+
    4. DSyslog
    Show answer and explanation
    Correct answer: C

    TACACS+ encrypts the full payload and separates authentication, authorization, and accounting, which suits device administration. RADIUS encrypts only the password field and is more common for network access, while syslog and NetFlow are logging and flow export protocols.

VPN technologies (6 questions)

  1. Question 19

    Which tunnelling protocol encapsulates IP packets with a simple header and is often combined with IPsec to protect the traffic?

    1. ASNMP
    2. BDNS
    3. CGRE
    4. DHTTP
    Show answer and explanation
    Correct answer: C

    Generic Routing Encapsulation carries packets inside a tunnel and is commonly protected with IPsec. HTTP, SNMP, and DNS are application protocols rather than tunnelling encapsulation.

  2. Question 20

    In an IPsec site-to-site VPN, which phase negotiates the secure channel used to protect the IPsec SA parameters?

    1. AARP resolution
    2. BIKE Phase 1
    3. CIKE Phase 2 only
    4. DDHCP discovery
    Show answer and explanation
    Correct answer: B

    IKE Phase 1 establishes an authenticated secure channel between peers, which is then used to negotiate IPsec SAs in Phase 2. DHCP and ARP are not IPsec negotiation phases.

  3. Question 21

    Which VPN design dynamically creates spoke-to-spoke tunnels on demand, using NHRP to resolve addresses?

    1. AStatic NAT
    2. BA VLAN trunk
    3. CDMVPN
    4. DPort mirroring
    Show answer and explanation
    Correct answer: C

    Dynamic Multipoint VPN uses NHRP to resolve endpoints so spokes can build direct tunnels as needed. Static NAT, VLAN trunks, and port mirroring do not create on-demand VPN tunnels.

  4. Question 22

    Which IPsec protocol provides encryption and integrity for the payload of an IP packet?

    1. AESP
    2. BAH only
    3. CICMP
    4. DSNMP
    Show answer and explanation
    Correct answer: A

    Encapsulating Security Payload provides encryption and integrity for the payload. AH provides integrity without encryption, while ICMP and SNMP are not IPsec protocols.

  5. Question 23

    A remote user needs secure access to the corporate network through a web browser, without installing a client. Which VPN type is most suitable?

    1. ASerial line encapsulation
    2. BClientless SSL VPN
    3. CGRE without encryption
    4. DIPsec site-to-site only
    Show answer and explanation
    Correct answer: B

    A clientless SSL VPN gives browser-based access to selected resources without a client install. Site-to-site IPsec connects networks, unencrypted GRE does not protect traffic, and serial encapsulation is outdated.

  6. Question 24

    When configuring an IPsec tunnel, what must match on both peers for the tunnel to establish?

    1. AThe login banner
    2. BThe IKE policy and transform sets or proposals agreed by both peers
    3. CThe router's hostname
    4. DThe interface description
    Show answer and explanation
    Correct answer: B

    Peers must agree on IKE policies and IPsec transform sets, along with pre-shared keys or certificates. Hostnames, descriptions, and banners do not affect negotiation.

Troubleshooting (6 questions)

  1. Question 25

    A router has two routes to the same destination, one from OSPF and one from a static route. Which route is installed in the routing table, all else equal?

    1. AThe static route, because its administrative distance is lower than OSPF's
    2. BBoth routes are installed with equal preference by default, and traffic is shared
    3. CNeither route is installed, because the routing table rejects duplicate prefixes
    4. DThe OSPF route, because its distance of 110 is lower than the static route's distance
    Show answer and explanation
    Correct answer: A

    Static routes have an administrative distance of 1 and OSPF has 110, so the static route wins when both exist. The OSPF statement is reversed, duplicates are not rejected, and the router selects one best route for installation.

  2. Question 26

    A traceroute shows that packets reach a router and then stop. Which command helps determine whether the router has a route to the destination?

    1. Ashow ip route
    2. Bshow clock
    3. Cshow running-config banner
    4. Dshow version
    Show answer and explanation
    Correct answer: A

    The routing table shows whether a route to the destination exists and which interface or next hop is used. Banner, clock, and version output do not show routing information.

  3. Question 27

    An EIGRP neighbour relationship does not form between two routers. Which check is most useful first?

    1. AChecking the color of the console cable jacket used for out-of-band access
    2. BMatching autonomous system numbers and K values on the interfaces
    3. CCounting the number of lines in the MOTD banner text file
    4. DConfirming the router's hostname length stays under the 63-character limit
    Show answer and explanation
    Correct answer: B

    EIGRP neighbours must share the same autonomous system number and compatible K values, and the subnets must align. Hostnames, cables, and banners do not affect adjacency.

  4. Question 28

    An OSPF network shows routes with incorrect costs on one link. Which setting is most likely misconfigured?

    1. AThe SNMP read-only community string configured on the monitoring server
    2. BThe interface bandwidth or the OSPF cost on that interface
    3. CThe NTP server address used to synchronize the router's clock
    4. DThe login banner text displayed to users before authentication occurs
    Show answer and explanation
    Correct answer: B

    OSPF cost comes from interface bandwidth or an explicit cost setting, so an error there changes route selection. SNMP, NTP, and banners do not affect OSPF costs.

  5. Question 29

    A device intermittently loses connectivity, and the team needs to see whether an interface is flapping. Which command provides the interface error and status counters?

    1. Ashow banner motd
    2. Bshow history
    3. Cshow clock detail only
    4. Dshow interfaces
    Show answer and explanation
    Correct answer: D

    show interfaces displays status, error counters, and line protocol state, which helps identify flapping or errors. Banner, clock, and history output do not show interface health.

  6. Question 30

    A network team wants to see which routes are learned from a specific EIGRP neighbour. Which command helps?

    1. Ashow logging history
    2. Bshow users session detail
    3. Cshow crypto key list
    4. Dshow ip eigrp neighbors
    Show answer and explanation
    Correct answer: D

    show ip eigrp neighbors lists EIGRP adjacencies and their details. Crypto keys, logging output, and user sessions do not show routing neighbours.