Objective 400.025% of exam

Infrastructure Services

300-410 Practice Questions

Infrastructure Services covers Cisco IOS/IOS-XE features that provide secure connectivity and network services: DMVPN Phase 3, IPv6 First Hop Security, and AAA with TACACS+. Questions present a configuration goal or symptom and ask for the exact command, feature behavior, or verification output needed to meet it.

Full Practice Test →All Objectives

What this objective tests

300-410 Infrastructure Services — Key Topics

Be able to select and apply the exact IOS commands that enable DMVPN Phase 3 spoke-to-spoke forwarding, IPv6 First Hop Security filtering, and TACACS+ AAA with fallback. The single most important thing is knowing which command goes on the hub versus the spoke.

DMVPN Phase 3 hub commands: ip nhrp redirect and ip nhrp shortcut for spoke-to-spoke tunnels
IPv6 First Hop Security features including DHCPv6 Guard, RA Guard, and IPv6 snooping
TACACS+ authentication, authorization, and accounting configuration with fallback behavior
Verification and troubleshooting of NHRP mappings, DHCPv6 Guard policy, and AAA server reachability

Common exam traps

Where candidates lose marks on Infrastructure Services

⚠Assuming ip nhrp redirect alone enables spoke-to-spoke tunnels; the spoke also needs ip nhrp shortcut and a route to the destination spoke.
⚠Confusing DHCPv6 Guard with RA Guard; DHCPv6 Guard filters DHCPv6 server and client messages, not router advertisements.
⚠Forgetting that TACACS+ fallback requires configuring the aaa authentication command with a local or none fallback method after the server group.

300-410 Infrastructure Services — Practice Questions

30 questions from this objective · 25% of your 300-410 exam

Question 2hardmultiple choice

Infrastructure Services

300-410 Infrastructure Services — Key Topics

Where candidates lose marks on Infrastructure Services

300-410 Infrastructure Services — Practice Questions

An engineer is configuring MPLS L3VPN on a Cisco IOS XE router. The customer edge (CE) router uses OSPF and the provider edge (PE) router must redistribute OSPF routes into MP-BGP. Which configuration is required on the PE to prevent routing loops and ensure proper route propagation?

A network administrator is configuring IPv6 addressing on a Cisco router. The router must automatically generate a link-local address and use EUI-64 format for interface identifiers. Which command enables this behavior on an interface?

A network engineer is troubleshooting a DMVPN Phase 2 deployment where spoke-to-spoke tunnels are not forming. The hub is configured correctly. Which two actions should be taken on the spokes to enable direct spoke-to-spoke communication? (Choose two.)

A network administrator is implementing IPv6 First Hop Security on a Cisco Catalyst switch. The goal is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. Which feature should be enabled on the VLAN to achieve this?

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPNs. The router will act as a Provider Edge (PE) device. Which two tasks are required to enable MPLS VPN functionality on the PE router? (Choose two.)

A network engineer is implementing IPv6 First Hop Security on a Cisco switch to mitigate rogue router advertisements. Which two features should be enabled to prevent rogue RA messages from being processed by hosts? (Choose two.)

A network engineer is configuring a Cisco router to authenticate OSPF neighbors using MD5. The engineer wants to ensure that only routers with the correct key can form adjacencies. Which command is required on the interface to enable OSPF MD5 authentication?

A network administrator is configuring DMVPN Phase 3 with IKEv2 on a hub router. The spoke routers must be able to dynamically establish direct spoke-to-spoke tunnels when needed. Which configuration on the hub is required to support this behavior?

A network administrator is configuring a Cisco IOS router to act as a DHCP server for a remote subnet. The router is not directly connected to that subnet. Which command is necessary to configure the router to assign IP addresses from a pool to clients on that remote subnet?

All 300-410 Objectives

Infrastructure Services

300-410 Infrastructure Services — Key Topics

Where candidates lose marks on Infrastructure Services

300-410 Infrastructure Services — Practice Questions

An engineer is configuring MPLS L3VPN on a Cisco IOS XE router. The customer edge (CE) router uses OSPF and the provider edge (PE) router must redistribute OSPF routes into MP-BGP. Which configuration is required on the PE to prevent routing loops and ensure proper route propagation?

A network administrator is configuring IPv6 addressing on a Cisco router. The router must automatically generate a link-local address and use EUI-64 format for interface identifiers. Which command enables this behavior on an interface?

A network engineer is troubleshooting a DMVPN Phase 2 deployment where spoke-to-spoke tunnels are not forming. The hub is configured correctly. Which two actions should be taken on the spokes to enable direct spoke-to-spoke communication? (Choose two.)

A network administrator is implementing IPv6 First Hop Security on a Cisco Catalyst switch. The goal is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. Which feature should be enabled on the VLAN to achieve this?

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPNs. The router will act as a Provider Edge (PE) device. Which two tasks are required to enable MPLS VPN functionality on the PE router? (Choose two.)

A network engineer is implementing IPv6 First Hop Security on a Cisco switch to mitigate rogue router advertisements. Which two features should be enabled to prevent rogue RA messages from being processed by hosts? (Choose two.)

A network engineer is configuring a Cisco router to authenticate OSPF neighbors using MD5. The engineer wants to ensure that only routers with the correct key can form adjacencies. Which command is required on the interface to enable OSPF MD5 authentication?

A network administrator is configuring DMVPN Phase 3 with IKEv2 on a hub router. The spoke routers must be able to dynamically establish direct spoke-to-spoke tunnels when needed. Which configuration on the hub is required to support this behavior?

A network administrator is configuring a Cisco IOS router to act as a DHCP server for a remote subnet. The router is not directly connected to that subnet. Which command is necessary to configure the router to assign IP addresses from a pool to clients on that remote subnet?

All 300-410 Objectives