300-410 Practice Test 22 — 15 Questions

Question 1

A network engineer is configuring AAA on a Cisco IOS router. The engineer wants to authenticate administrative users against a TACACS+ server and ensure that if the server is unreachable, a local username and password can be used as a fallback. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aaa authentication login default group tacacs+ local. The correct command is aaa authentication login default group tacacs+ local. This method list attempts TACACS+ authentication first and, if the server is unreachable, falls back to the local username database. The order ensures TACACS+ is primary and local is used only when necessary.

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Question 2

Which statement correctly describes the default 'match' direction in a Flexible NetFlow flow record?

Accepted Answer

The default match direction is 'input' (ingress).. In a Flexible NetFlow flow record, the default match direction is 'input' (ingress). This means that by default, the flow record matches on fields in the ingress direction. If you need to match on egress fields, you must explicitly configure the 'match direction output' command.

Answer

The default match direction is 'output' (egress).

Answer

The default match direction is 'both' (input and output).

Answer

There is no default direction; it must always be specified.

Question 3

A network administrator is configuring a Cisco IOS router to authenticate login users against an external TACACS+ server. The administrator wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. The TACACS+ server has been configured with the IP address 10.1.1.100 and the shared secret key 'cisco123'. Which set of commands correctly implements this requirement?

Accepted Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key cisco123
aaa authentication login default group tacacs+ local
line vty 0 4
 login authentication default. The correct configuration enables AAA, defines the TACACS+ server with the proper address and key, and sets the default authentication method list to use TACACS+ with local fallback. Applying this method list to the VTY lines ensures remote login attempts use the intended sequence. The 'local' keyword is essential for fallback when the server is unreachable.

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key cisco123
aaa authentication login default group tacacs+
line vty 0 4
 login authentication default

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key cisco123
aaa authentication login default group tacacs+ enable
line vty 0 4
 login authentication default

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key cisco123
aaa authentication login default group tacacs+ local
line vty 0 4
 login authentication TAC1

Question 4

A network engineer is implementing CoPP on a Cisco router to protect the control plane from DoS attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's management IP address. Which CoPP policy component is responsible for defining the traffic classification?

Accepted Answer

Class map. The correct answer is the class map, which defines the traffic classification by matching specific packet characteristics. In CoPP, class maps are used to identify traffic of interest, such as ICMP echo requests. The policy map then applies actions like policing to those classes. The service policy attaches the policy map to the control plane, and ACLs can be used within class maps for matching but are not the classification component themselves.

Answer

Access control list (ACL)

Answer

Policy map

Answer

Service policy

Question 5

A network engineer runs the following command on Router R1:

R1# show ip route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

O    10.2.2.0/24 [110/20] via 192.168.12.2, 00:12:34, GigabitEthernet0/0
O IA 10.3.3.0/24 [110/30] via 192.168.13.3, 00:10:21, GigabitEthernet0/1

Based on this output, what can be determined?

Accepted Answer

Both routes have the same administrative distance.. Both routes are OSPF routes and have an OSPF administrative distance of 110, as shown in the brackets. Option D is correct. Option A is incorrect because 10.2.2.0/24 is an intra-area route (O), not external. Option C is incorrect because the output shows 'Gateway of last resort is not set', so no default route is configured.

Answer

The route to 10.2.2.0/24 is an external OSPF route.

Answer

The route to 10.3.3.0/24 is learned from a different area.

Answer

Router R1 has a default route configured.

Question 6

A network administrator is troubleshooting an 802.1X deployment on a Cisco switch. Users report that they cannot authenticate and are placed into a guest VLAN. The administrator suspects that the switch is not receiving EAPOL packets from the supplicants. Which two actions should the administrator take to verify that EAPOL packets are being received and processed on the switch? (Choose two.)

Accepted Answer

Enable 'debug dot1x all' and observe the debug output for EAPOL packet reception.. The two correct actions are using 'show dot1x interface' and enabling 'debug dot1x all'. These commands provide direct visibility into EAPOL packet reception and processing on the switch. The other options either show session information that doesn't confirm EAPOL reception or focus on RADIUS or MAC address tables, which are not specific to verifying EAPOL packets from the supplicant.

Answer

Use the 'show authentication sessions interface' command to view the session status and method.

Answer

Check the 'show mac address-table interface' command to see if the supplicant's MAC address is learned.

Answer

Use the 'show radius statistics' command to verify RADIUS server reachability.

Question 7

A network engineer is deploying a new branch office router (Cisco IOS XE) and wants to protect the control plane from routing protocol floods. The router will run OSPF and EIGRP. The engineer must ensure that control plane packets are rate-limited and that the router logs when the rate is exceeded. Which of the following should be configured?

Accepted Answer

Control Plane Policing (CoPP) using a policy-map that classifies routing protocol traffic and applies police actions with exceeded-action logging.. Control Plane Policing (CoPP) is designed to protect the control plane by rate-limiting traffic destined to the router's CPU. By classifying OSPF and EIGRP packets and applying a policer with logging, the engineer can ensure that routing protocol floods are mitigated and that any excess is logged. Other options do not provide both rate-limiting and logging for control plane traffic.

Answer

Management Plane Protection (MPP) with an ACL that permits only SSH and SNMP.

Answer

Control Plane Protection (CPPr) with a port-filter policy that drops all non-management traffic.

Answer

uRPF strict mode on all interfaces facing the service provider.

Question 8

An engineer configures SNMPv2c with a read-only community string 'public' on a router. The NMS can poll interface statistics, but when trying to poll OSPF neighbor states, the NMS receives no response. Which is the most likely explanation?

Accepted Answer

The OSPF MIB is not supported or not loaded on the router.. The most likely explanation is that the OSPF MIB is not supported or not loaded on the router. SNMPv2c with a read-only community string 'public' can poll standard interface MIB objects (like ifEntry) because those are part of the base IF-MIB, which is always loaded. However, OSPF neighbor states are defined in the OSPF-MIB (RFC 1850/4750), which is an enterprise-specific MIB that must be explicitly supported and loaded in the router's SNMP agent. If the OSPF MIB is not present, the agent will not respond to GET requests for OSPF-related OIDs, even though the community string has read-only access.

Answer

The community string 'public' is not allowed to access the OSPF MIB due to a missing 'snmp-server view' command.

Answer

OSPF neighbor states are only available via SNMPv3 due to security restrictions.

Answer

The NMS must use the OSPF process ID in the OID to poll neighbor states.

Question 9

A network engineer runs the following command to troubleshoot BFD with BGP:

R1# show bgp ipv4 unicast 10.3.3.0/24

BGP routing table entry for 10.3.3.0/24, version 2
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (2.2.2.2)
      Origin IGP, metric 0, localpref 100, valid, external, best
      rx pathid: 0, tx pathid: 0x0
      BFD enabled, BFD state: UP

What does this output indicate?

Accepted Answer

BGP is using BFD with state UP, enabling sub-second failure detection for this prefix.. The output shows that BFD is enabled for the BGP session and the BFD state is UP, indicating fast failure detection for the BGP neighbor.

Answer

BFD is disabled for this BGP neighbor.

Answer

BFD state is DOWN, so BGP uses its own timers.

Answer

BGP is using BFD only for IPv6 prefixes.

Question 10

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to use a RADIUS server for authentication and authorization, but wants to use local authentication as a fallback if the RADIUS server is unreachable. Which command should be used to configure the fallback?

Accepted Answer

aaa authentication login default group radius local. The command 'aaa authentication login default group radius local' sets RADIUS as the primary authentication method and local as the fallback. If the RADIUS server is unreachable, the router will use the local username database, ensuring continued administrative access.

Answer

aaa authentication login default group radius enable

Answer

aaa authentication login default local group radius

Answer

aaa authentication login default group radius none

Question 11

Which TWO statements about route summarization in BGP are true? (Choose TWO.)

Accepted Answer

The 'aggregate-address' command creates a summary route in the BGP table.. Option A is correct because the Cisco IOS 'aggregate-address ' command under the BGP router configuration creates an aggregate (summary) entry in the BGP table, provided at least one more-specific route from the same AS exists in the BGP table. Option B is correct because adding the 'summary-only' keyword to 'aggregate-address' advertises only the aggregate and suppresses the more-specific component routes to all neighbors, which is the standard way to prevent the specifics from being advertised. Option C is wrong because the 'network' command injects an exact prefix into BGP (it does not perform summarization or create an aggregate). Option D is wrong because suppression of more-specifics is achieved with the 'summary-only' keyword (or with 'suppress-map' for selective suppression), not by a route-map requirement. Option E is wrong because route summarization via 'aggregate-address' can be configured on any BGP speaker, not only on route reflectors.

Answer

The 'network' command is used to create a summary route in BGP.

Answer

BGP summarization requires a route-map to suppress more specific routes.

Answer

Route summarization in BGP can only be configured on route reflectors.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip bgp neighbors 10.2.2.2 advertised-routes
BGP table version is 10, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 10.1.1.0/24      0.0.0.0                  0         32768 i
*> 10.2.2.0/24      0.0.0.0                  0         32768 i

Total number of prefixes 2

Based on this output, what is the problem?

Accepted Answer

The routes are correctly advertised with next hop 0.0.0.0, which is normal for locally originated routes.. The output shows two locally originated BGP routes (weight 32768, origin IGP) with next hop 0.0.0.0, which is the standard representation for networks that the local router itself originated into BGP via the network command. The 'advertised-routes' keyword confirms these prefixes are being sent to neighbor 10.2.2.2, so there is no advertisement problem at all. Next hop 0.0.0.0 in the local BGP table simply means 'this router is the origin of the route.'

Answer

The routes are not being advertised to eBGP peers because the next hop is 0.0.0.0, which is invalid for eBGP.

Answer

The routes are being advertised to iBGP peers only, as indicated by the next hop 0.0.0.0.

Answer

The routes are redistributed from an IGP into BGP, and the next hop is correctly set to 0.0.0.0.

Question 13

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer has created a class map named 'CRITICAL' that matches BGP traffic and a policy map named 'COPP-POLICY' that applies a police rate of 1000000 bps with a conform-action transmit and exceed-action drop. After applying the policy map to the control plane, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue?

Accepted Answer

Increase the police rate in the policy map to accommodate the BGP traffic.. The BGP sessions are flapping because the CoPP policer is dropping legitimate BGP traffic due to a rate limit that is too low. Increasing the police rate allows the necessary BGP traffic to pass, stabilizing the sessions. The other options either disable policing, apply it incorrectly, or remove protection, none of which address the root cause.

Answer

Change the exceed-action to transmit and set a lower conform-action rate.

Answer

Remove the class map from the policy map and rely on default CoPP settings.

Answer

Apply the policy map to the data plane interfaces instead of the control plane.

Question 14

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch is configured as an authenticator, and a RADIUS server is used for authentication. The administrator wants to ensure that if the RADIUS server becomes unreachable, endpoints are placed into a guest VLAN with limited access. Which command must be configured on the switch to enable this behavior?

Accepted Answer

authentication event server dead action authorize vlan 100. To place endpoints into a guest VLAN when the RADIUS server is unreachable, the switch must be configured with the 'authentication event server dead action authorize vlan' command under the interface. This triggers the fallback VLAN assignment upon detecting the server as dead.

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 100

Answer

authentication violation restrict

Question 15

A network administrator is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connects to the internet, and GigabitEthernet0/1 connects to the internal network. The administrator wants to ensure that packets arriving on GigabitEthernet0/0 are dropped if their source address is not reachable via that interface. However, the administrator also wants to allow asymmetric routing where return traffic may use a different path. Which uRPF mode should be configured on GigabitEthernet0/0?

Accepted Answer

ip verify unicast source reachable-via any. Loose uRPF, configured with ip verify unicast source reachable-via any, checks the routing table for the source address but does not require the source to be reachable via the incoming interface. This allows asymmetric routing while still providing spoofing mitigation. Strict uRPF (rx) would drop packets in asymmetric scenarios, and the other options are either invalid or equivalent to strict mode.

Answer

ip verify unicast source reachable-via rx

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via tx