300-410 Practice Test 2 — 10 Questions

Question 1

Examine the following partial configuration:

username admin privilege 15 secret 5 $1$abcdefg$hashedvalue
username operator privilege 1 password cisco
!
line console 0
 login local
!
line vty 0 4
 login local
 transport input ssh

What is a potential security issue with this configuration?

Accepted Answer

The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.. The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Answer

The 'admin' user has privilege 15, which is too high for administrative access.

Answer

The console line is missing the 'transport input' command.

Answer

The VTY lines should use 'login' without 'local' to allow remote authentication.

Question 2

A network engineer runs the following command to verify IPv6 traffic filtering with logging:

R1# show logging | include FILTER
*Mar 1 00:04:56.789: %IPV6_ACL-6-ACCESSLOGDP: list FILTER denied tcp 2001:DB8:2::1(12345) -> 2001:DB8:3::1(80), 1 packet

What does this output indicate?

Accepted Answer

A TCP packet from 2001:DB8:2::1 to destination 2001:DB8:3::1 port 80 was denied by the access list.. The log message shows an IPv6 ACL (named FILTER) logging a denied TCP packet from source 2001:DB8:2::1 port 12345 to destination 2001:DB8:3::1 port 80. The keyword 'denied' in the log entry confirms the packet was blocked by the access list, making option A correct.

Answer

A TCP packet was permitted by the access list.

Answer

The access list is not applied to any interface.

Answer

The packet was dropped due to uRPF.

Question 3

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 4

Which DHCP message type is used by a client to renew its lease before it expires?

Accepted Answer

DHCPREQUEST. When a DHCP client wants to renew its existing lease before it expires, it sends a unicast DHCPREQUEST message directly to the DHCP server that originally granted the lease. This is part of the renewal process defined in RFC 2131, where the client transitions from the BOUND state to the RENEWING state and uses the server's IP address to request an extension of the lease time.

Answer

DHCPDISCOVER

Answer

DHCPACK

Answer

DHCPRELEASE

Question 5

A network engineer runs the following command to verify DHCPv4 server statistics on router R1:

R1# show ip dhcp server statistics

Output:
 Memory usage: 12345
 Address pools: 2
 Database agents: 0
 Automatic bindings: 150
 Manual bindings: 5
 Expired bindings: 10
 Malformed messages: 0

Message    Received
 BOOTREQUEST    0
 DHCPDISCOVER   200
 DHCPREQUEST    180
 DHCPDECLINE    2
 DHCPRELEASE    5
 DHCPINFORM     10

What does this output indicate?

Accepted Answer

The DHCP server has 150 active automatic bindings and 5 manual bindings.. The 'Automatic bindings: 150' and 'Manual bindings: 5' fields directly indicate the number of active leases assigned dynamically (via DHCP) and statically (via manual configuration), respectively. These represent the current active bindings on the DHCP server, with no other interpretation needed.

Answer

The DHCP server has received 200 DHCPREQUEST messages.

Answer

The DHCP server has 10 malformed messages, indicating a configuration issue.

Answer

The DHCP server has 2 database agents configured.

Question 6

A network engineer runs the following command to troubleshoot DHCPv6 address assignment on router R1:

R1# show ipv6 dhcp binding

Output:
 Client: FE80::21A:2BFF:FE3C:4D01
   DUID: 0003000121A2B3C4D5E6
   Username: unassigned
   VRF: default
   IA NA: IA ID 0x00040001, T1 302400, T2 483840
       Address: 2001:DB8:1::100
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)
   IA PD: IA ID 0x00040002, T1 302400, T2 483840
       Prefix: 2001:DB8:1::/48
           Preferred lifetime 604800, valid lifetime 2592000
           Expires at Mar 01 2025 12:00 PM (2592000 seconds)

What does this output indicate?

Accepted Answer

The DHCPv6 server has assigned both an IPv6 address and a prefix delegation to the client.. The output shows both an IA_NA (Identity Association for Non-temporary Address) with an IPv6 address (2001:DB8:1::100) and an IA_PD (Identity Association for Prefix Delegation) with a prefix (2001:DB8:1::/48). This confirms that the DHCPv6 server has assigned both a global unicast address and a delegated prefix to the client, making option B correct.

Answer

The DHCPv6 server has assigned only an IPv6 address to the client.

Answer

The DHCPv6 client is using stateless autoconfiguration (SLAAC) because no address is shown.

Answer

The DHCPv6 server has a pool with only one prefix available.

Question 7

A network engineer runs the following command to troubleshoot DHCPv6 relay on router R1:

R1# debug ipv6 dhcp relay

Output:
 IPv6 DHCP relay: Received SOLICIT message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding SOLICIT to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received ADVERTISE message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding ADVERTISE to client FE80::1 via GigabitEthernet0/0
 IPv6 DHCP relay: Received REQUEST message from FE80::1 on GigabitEthernet0/0
 IPv6 DHCP relay: Forwarding REQUEST to server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Received REPLY message from server 2001:DB8:2::1 via GigabitEthernet0/1
 IPv6 DHCP relay: Forwarding REPLY to client FE80::1 via GigabitEthernet0/0

What does this output indicate?

Accepted Answer

The DHCPv6 relay agent is successfully forwarding messages between the client and server.. The debug output shows a complete DHCPv6 four-message exchange (SOLICIT-ADVERTISE-REQUEST-REPLY) being relayed between the client (FE80::1) and the server (2001:DB8:2::1). Each message is received on one interface and forwarded out the other, confirming the relay agent is functioning correctly. Therefore, option B is correct.

Answer

The DHCPv6 relay agent is not functioning because messages are not being forwarded.

Answer

The DHCPv6 server is unreachable because no REPLY is received.

Answer

The DHCPv6 client is using a global unicast address as its link-local address.

Question 8

An engineer applies the following configuration to an interface:

interface GigabitEthernet0/5
 ipv6 dhcp guard attach-policy DHCP_GUARD
 ipv6 snooping database file nvram:ipv6-snoop.db

Which statement is true?

Accepted Answer

The DHCP guard policy is applied to the interface, and the snooping database is stored in NVRAM.. The 'ipv6 dhcp guard attach-policy DHCP_GUARD' command applies the DHCP Guard policy to the interface, and the 'ipv6 snooping database file nvram:ipv6-snoop.db' command configures the snooping database to be stored in NVRAM. These two commands operate independently; the DHCP Guard policy is enforced immediately upon attachment, regardless of the database's presence or population state.

Answer

The DHCP guard policy is applied only if the snooping database is present.

Answer

The interface will not forward any DHCP messages until the database is populated.

Answer

The snooping database is used to validate DHCP server messages.

Question 9

In IPv6 First Hop Security, what is the purpose of the 'device-role' command in a DHCP guard policy?

Accepted Answer

It specifies whether the interface is a server, client, or relay for DHCP filtering.. The 'device-role' command in a DHCP guard policy specifies the role of the interface as either a DHCP server, client, or relay. This allows the switch to filter DHCP messages based on the expected role, blocking unauthorized DHCP server messages on interfaces that should only have clients or relays. It is a key component of IPv6 First Hop Security to prevent rogue DHCPv6 servers.

Answer

It sets the trust level for ND inspection.

Answer

It defines the VLAN membership for the interface.

Answer

It enables IPv6 routing on the interface.

Question 10

A network engineer runs the following command to verify BFD with EIGRP:

R1# show ip eigrp 100 topology 10.2.2.0/24

EIGRP-IPv4 Topology Entry for AS(100)/ID(10.2.2.0/24)
  State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072
  Descriptor Blocks:
  10.1.1.2 (GigabitEthernet0/0), from 10.1.1.2, Send flag: 0x0
      Composite metric: (131072/130816), Route is Internal
      Vector metric:
        Minimum bandwidth is 100000 Kbit
        Total delay is 100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
        Originating router is 2.2.2.2
      BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

EIGRP is using BFD with state UP, providing sub-second convergence.. The output shows that BFD is enabled for the EIGRP neighbor and the BFD state is UP, indicating fast failure detection is active for this route.

Answer

EIGRP has no BFD session for this neighbor.

Answer

BFD is down, so EIGRP relies on its own hello/dead timers.

Answer

EIGRP is using BFD in passive mode only.