Objective 300.020% of exam

Infrastructure Security

300-410 Practice Questions

Infrastructure Security covers device access control and control-plane protection on Cisco IOS/IOS-XE routers and switches. Expect scenario items on AAA with TACACS+ and RADIUS, fallback and authorization behavior, OSPF and EIGRP neighbor authentication, and Control Plane Policing, plus IPv6 first-hop security and uRPF features.

Full Practice Test →All Objectives

What this objective tests

300-410 Infrastructure Security — Key Topics

Configure and verify AAA with TACACS+ or RADIUS and local fallback, OSPF/EIGRP neighbor authentication, and CoPP policies on Cisco IOS. The critical skill is reading show command output to confirm which authentication method or policy actually applied to the traffic.

AAA authentication, authorization, and accounting using TACACS+ and RADIUS with local fallback
OSPFv2 and OSPFv3 neighbor authentication using MD5 or SHA key chains
Control Plane Policing and control-plane protection for router CPU-bound traffic
IPv6 first-hop security and uRPF anti-spoofing features on Cisco IOS

Common exam traps

Where candidates lose marks on Infrastructure Security

⚠Assuming 'aaa authentication login default group tacacs+ local' falls back to local when the TACACS+ server is reachable but rejects the user; fallback only occurs on server unavailability.
⚠Configuring OSPF MD5 authentication on an interface without matching authentication on the neighbor, or forgetting that authentication must be enabled in the OSPF area or interface.
⚠Building CoPP policy-maps with wrong match criteria or applying them to the wrong control-plane interface, so policing never affects the intended traffic.

300-410 Infrastructure Security — Practice Questions

30 questions from this objective · 20% of your 300-410 exam

Question 2easymultiple choice

Review the full routing breakdown →

A network engineer wants to secure management access to a Cisco IOS router by allowing only SSH and denying Telnet. The engineer applies the following configuration:

line vty 0 4

transport input ssh

However, after applying this, the engineer is unable to establish an SSH session to the router. Which additional configuration is required to enable SSH?

Question 3mediummultiple choice

Infrastructure Security

300-410 Infrastructure Security — Key Topics

Where candidates lose marks on Infrastructure Security

300-410 Infrastructure Security — Practice Questions

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted. Which configuration element defines this traffic?

A network administrator is configuring SSH access on a Cisco IOS router. The administrator wants to ensure that only SSH version 2 is used and that the RSA key modulus is at least 2048 bits. Which set of commands accomplishes this?

A network administrator is configuring a Cisco IOS router to use SSH for remote management instead of Telnet. The administrator has already generated an RSA key pair and configured a username and password. Which additional command is required to enable SSH on the router?

All 300-410 Objectives

Infrastructure Security

300-410 Infrastructure Security — Key Topics

Where candidates lose marks on Infrastructure Security

300-410 Infrastructure Security — Practice Questions

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted. Which configuration element defines this traffic?

A network administrator is configuring SSH access on a Cisco IOS router. The administrator wants to ensure that only SSH version 2 is used and that the RSA key modulus is at least 2048 bits. Which set of commands accomplishes this?

A network administrator is configuring a Cisco IOS router to use SSH for remote management instead of Telnet. The administrator has already generated an RSA key pair and configured a username and password. Which additional command is required to enable SSH on the router?

All 300-410 Objectives