300-540 Exam Dumps and Practice Questions

To run EVPN over Segment Routing MPLS (SR-MPLS), the IGP (here OSPF) must be enabled for segment routing so it can:

Advertise Segment IDs (SIDs) for prefixes and links

Carry SR extensions in OSPF LSAs

On Cisco devices, this is done under the OSPF process with:

router ospf 100

router-id 192.168.1.1

segment-routing mpls

Without the segment-routing mpls command, Spine_A will not participate correctly in the SR-enabled OSPF domain, and SR-related adjacencies/LSAs will not form as expected, resulting in failure to integrate into the intended SR-MPLS core.

The other options are not OSPF SR-enabling commands:

A otv join-interface OTV, unrelated to OSPF or SR-MPLS.

B address-family ipv4 BGP address family, not OSPF.

C connected-prefix-sid-map Global SR mapping for connected prefixes but does not itself enable SR for OSPF.

Therefore, the correct command is segment-routing mpls (D).

Router R2 is inside AS 100 and has three iBGP paths (via R3, R4, R5) toward AS 101. To perform iBGP multipath across these three equal-cost paths, BGP must:

Run the correct BGP process for AS 100

Allow installation of multiple iBGP paths in the routing table

This is done with:

router bgp 100

maximum-paths ibgp 3

router bgp 100 -- enters the BGP process for AS 100 (correct AS per diagram).

maximum-paths ibgp 3 -- tells BGP to keep up to 3 iBGP paths to the same destination, enabling CEF to load-share across them.

Other options:

ip load-sharing ibgp 3 -- not a valid command.

router bgp 101 -- wrong AS number.

ip load-sharing per-destination -- controls CEF hashing but does not enable BGP to install multiple iBGP paths by itself.

Destination-based Remote Triggered Black Hole (RTBH) routing is a DDoS mitigation technique where traffic to a victim's IP address is intentionally routed to a special next hop (usually Null0) so that the traffic is dropped as close to the source as possible. On the edge router (R1 in the figure), this is accomplished by installing /32 static routes for the victim endpoints, pointing to the null interface. When these routes are installed (often triggered via BGP in larger deployments), any traffic destined to those exact IP addresses is discarded.

In the topology:

Web server IP: 10.20.10.2

Mail server IP: 10.30.10.2

To perform destination-based RTBH at R1, we must configure static /32 routes to Null0 for each victim IP:

ip route 10.20.10.2 255.255.255.255 Null0

ip route 10.30.10.2 255.255.255.255 Null0

These correspond to:

Option C for the web server (10.20.10.2)

Option A for the mail server (10.30.10.2)

The other options are incorrect for RTBH:

B and D remove /24 routes via 10.10.10.2; they do not implement black-holing and would break normal routing rather than selectively drop attack traffic.

E black-holes 10.20.10.1, which is the default gateway on R2, not the victim server; that would impact overall connectivity instead of just dropping traffic to the attacked host.

From Cisco's EVPN VXLAN multihoming design requirements, port-active multihoming uses a single LAG (EtherChannel / Bundle-Ether) between the host/router and the pair of leaf switches. All physical interfaces participating in that bundle must be configured with:

bundle id <number> mode active

This command:

Associates the physical interfaces (g1/0 and g1/1) with Bundle-Ether1.

Uses LACP active mode, which is required for EVPN port-active multihoming.

Enables the host-facing port-channel required to support EVPN multihomed connectivity.

In the exhibit, R1 already has:

interface Bundle-Ether1

description 'Bundle to Leaf-1'

...

interface Bundle-Ether1.10

ip address 192.168.10.1 255.255.255.0

This confirms that the engineer intends to bundle g1/0 and g1/1 together into Bundle-Ether1, and the missing step is adding the interfaces into that bundle.

The correct configuration is:

interface g1/0

bundle id 1 mode active

interface g1/1

bundle id 1 mode active

Why the other options are incorrect

A . evpn ethernet-segment 1

This command is used on EVPN leaf switches (not R1) to define an ESI for multihoming. R1 is not an EVPN VTEP.

B . switchport mode trunk

R1 is a router, not a switch. L3 interfaces do not use switchport.

C . encapsulation dot1q 1

This applies only to subinterfaces, not physical interfaces, and is unrelated to building a LAG for port-active multihoming.

For a site-to-site IPsec VPN, each peer must point to the reachable IP address of the remote VPN endpoint---that is, the IP address on the WAN/Internet-facing interface of the remote router.

From the diagram:

R1 outside (toward Internet): 192.168.10.1

R2 outside (toward Internet): 192.168.20.2

Inside LANs:

Site 1: 10.1.0.0/24

Site 2: 10.2.0.0/24

The crypto map on R1 uses:

crypto map mymap 10 ipsec-isakmp

set transform-set myset

match address 101

set peer <REMOTE_PEER_IP>

The <REMOTE_PEER_IP> must be the IP address where R1 can actually reach the IPsec peer, which is R2's Internet-facing interface 192.168.20.2.

If the peer were configured with a LAN IP such as 10.2.0.1 (site 2's internal gateway), IKE packets would never reach the remote router because that address is not routable over the Internet.

Therefore, the correct command to bring up the VPN is:

set peer 192.168.20.2

Option A (10.1.0.1) -- local LAN IP (R1's side), not the remote endpoint.

Option C (192.168.10.1) -- R1's own WAN IP, not the remote peer.

Option D (10.2.0.1) -- remote LAN IP, not reachable directly over the Internet.