300-410 Practice Test 23 — 15 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 spoke router. The spoke must establish a direct tunnel to another spoke when traffic requires it. The hub is already configured with 'ip nhrp redirect'. Which additional command must be configured on the spoke to enable it to request and receive shortcut replies from the hub?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to notify spokes of a better path. The spoke must be configured with 'ip nhrp shortcut' to send NHRP resolution requests and install shortcut routes. This combination allows direct spoke-to-spoke tunnels, reducing latency and hub load. Other commands like 'ip nhrp map multicast dynamic' are hub-side multicast features and do not enable shortcut switching.

Answer

ip nhrp redirect

Answer

ip nhrp network-id 100

Answer

ip nhrp map multicast dynamic

Question 2

An engineer is troubleshooting why the NMS is receiving duplicate SNMP traps from router R9 for the same event. The router has two 'snmp-server host' commands pointing to the same NMS IP address but with different community strings: 'public' and 'private'. The NMS is configured to process traps from both communities. What is the most likely cause?

Accepted Answer

The router sends one trap per 'snmp-server host' command, resulting in duplicate traps for the same event.. Each 'snmp-server host' command creates a separate trap destination entry in the router's SNMP configuration. When a trap-generating event occurs, the router sends a trap to each configured destination. Since both commands point to the same NMS IP address but with different community strings ('public' and 'private'), the router sends two identical traps (one with each community string) for the same event, causing the NMS to receive duplicates.

Answer

The NMS is configured to listen on two different ports, causing duplicate reception.

Answer

The router has an SNMP trap filter that is misconfigured, causing the same trap to be sent twice.

Answer

The engineer enabled both 'snmp-server enable traps' and 'snmp-server enable informs', causing duplicate notifications.

Question 3

A network uses PBR to route traffic from a specific VLAN (10.10.10.0/24) through a firewall (next-hop 192.168.1.1). After a firewall replacement, traffic from this VLAN is being dropped. Router R1 shows: 'show route-map' shows the route-map is applied, 'show ip policy' shows the policy on the VLAN interface, but 'debug ip packet' shows packets being sent to 192.168.1.1 and no response. Router R2 (firewall) shows: 'show ip route 10.10.10.0' returns a route via 192.168.2.1, but the firewall is configured to drop traffic from 10.10.10.0/24. What is the root cause?

Accepted Answer

The firewall is configured to drop traffic from the source subnet 10.10.10.0/24. Update the firewall policy to allow this traffic.. The firewall (R2) is explicitly configured to drop traffic from 10.10.10.0/24, as stated in the scenario. Even though PBR on R1 correctly forwards traffic to 192.168.1.1, the firewall drops it based on its policy. The root cause is the firewall's drop rule, which must be updated to allow the traffic.

Answer

The next-hop 192.168.1.1 is not reachable from R1 due to a routing issue.

Answer

The route-map on R1 is missing a 'set ip next-hop verify-availability' command, causing it to forward traffic to an unreachable next-hop.

Answer

The VLAN interface on R1 has an ACL that is blocking traffic from 10.10.10.0/24.

Question 4

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The engineer has created a class-map to match malicious traffic and a policy-map to police it. Which two statements are true regarding the application and behavior of CoPP? (Choose two.)

Accepted Answer

CoPP uses a token bucket algorithm to enforce rate limits, where the first value is the committed information rate and the second is the burst size.. CoPP is applied to the control plane via the service-policy command under control-plane configuration mode, and it uses a token bucket algorithm with a committed information rate and burst size. The other statements are false: CoPP is not applied to interfaces, class-default does not require a police action, and the exceed-action determines the fate of excess traffic.

Answer

CoPP automatically drops all traffic that exceeds the configured rate, regardless of the exceed-action specified in the policy.

Answer

The class-default class in a CoPP policy-map must always have a police action configured to drop all unmatched traffic.

Answer

CoPP can be applied to a specific interface to police traffic entering that interface before it reaches the control plane.

Question 5

What is the default OSPF dead interval on an Ethernet broadcast network?

Accepted Answer

40 seconds. On an Ethernet broadcast network, OSPF defaults to a hello interval of 10 seconds and a dead interval of 40 seconds (four times the hello interval). This is defined in RFC 2328 and is the standard for broadcast multiaccess networks like Ethernet. Option C is correct because the dead interval is explicitly 40 seconds in this scenario.

Answer

10 seconds

Answer

30 seconds

Answer

120 seconds

Question 6

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# debug ip policy
Policy routing debugging is on
R1#
*Mar  1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy match
*Mar  1 00:15:30.789: IP: s=10.0.0.1 (FastEthernet0/0), d=20.0.0.1, len 100, policy rejected
*Mar  1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy match
*Mar  1 00:15:30.789: IP: s=10.0.0.2 (FastEthernet0/0), d=20.0.0.2, len 100, policy routed
*Mar  1 00:15:30.789: IP: FastEthernet0/0 to GigabitEthernet0/1 192.168.1.1

What does this output indicate?

Accepted Answer

The route-map has multiple sequences or ACL entries; one source is permitted, the other is denied or fails next-hop check.. The debug output shows two different source IPs (10.0.0.1 and 10.0.0.2) hitting the same PBR policy. For 10.0.0.1, the policy matches but is then rejected, meaning the route-map sequence matched but the set action (e.g., set ip next-hop) failed or the sequence was denied. For 10.0.0.2, the policy matches and is successfully routed to next-hop 192.168.1.1. This indicates the route-map has multiple sequences or ACL entries: one source is permitted and routed, the other is denied or fails a next-hop reachability check. The correct answer captures this multi-sequence behavior.

Answer

Both packets should have been rejected due to a misconfiguration.

Answer

The next-hop 192.168.1.1 is unreachable for the first packet.

Answer

The ACL is blocking all traffic from 10.0.0.1.

Question 7

A network engineer is configuring DMVPN Phase 3 on a hub router. The hub must forward traffic directly between spokes without traversing the hub. Which command is required on the hub to enable this behavior?

Accepted Answer

ip nhrp redirect. For DMVPN Phase 3, the hub must be configured with ip nhrp redirect to inform spokes about superior paths. When a spoke sends traffic to the hub for a destination reachable via another spoke, the hub responds with an NHRP redirect, prompting the originating spoke to initiate a direct tunnel. The spoke must have ip nhrp shortcut to act on the redirect. Together, these commands enable dynamic direct spoke-to-spoke tunnels.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 8

A network security engineer is configuring a Cisco IOS router to support Zone-Based Policy Firewall (ZPF). The engineer has created zones INSIDE and OUTSIDE, assigned interfaces to them, and now needs to allow HTTP traffic from INSIDE to OUTSIDE while inspecting return traffic. Which configuration step is required to achieve this?

Accepted Answer

Create a zone-pair from INSIDE to OUTSIDE, define a policy-map with inspect action for HTTP, and apply the policy-map to the zone-pair using `service-policy type inspect`.. Zone-Based Policy Firewall (ZPF) uses zone pairs to apply traffic policies between zones. To allow HTTP from INSIDE to OUTSIDE and inspect return traffic, you must create a zone-pair from INSIDE to OUTSIDE, define a policy-map with an inspect action for HTTP, and apply that policy-map to the zone-pair using `service-policy type inspect`. This creates a stateful inspection allowing return traffic. Applying policies directly to zones or interfaces is not correct for ZPF.

Answer

Create a policy-map with inspect action for HTTP, apply it to both INSIDE and OUTSIDE interfaces using `service-policy type inspect` in the inbound direction.

Answer

Create an ACL that permits HTTP from INSIDE to OUTSIDE, apply it to the INSIDE interface with `ip access-group` in the outbound direction, and enable `ip inspect` on the OUTSIDE interface.

Answer

Create a class-map that matches HTTP traffic, define a policy-map with inspect action, and apply the policy-map to the INSIDE zone using `service-policy type inspect`.

Question 9

Which of the following statements about BFD echo mode is true?

Accepted Answer

Echo mode allows the local router to detect failures without requiring the remote router to send BFD control packets.. In BFD echo mode, the local router sends echo packets that the remote router simply loops back (typically by forwarding to the same interface) without processing them as BFD control packets. This lets the local system detect forwarding-path failures on its own, without requiring the remote router to run BFD control-packet logic or maintain BFD state. The remote device only needs to forward the echo packets, which reduces its BFD processing burden.

Answer

Echo mode increases the load on the remote router because it must process echo packets.

Answer

Echo mode is disabled by default and must be explicitly enabled.

Answer

Echo mode uses the same timer values as the BFD control packets.

Question 10

A network administrator is configuring a Cisco IOS router to authenticate users via TACACS+ using a TACACS+ server at 10.1.1.50. The administrator wants to ensure that if the TACACS+ server is unreachable, the router will fall back to using the local username database. Which command set achieves this?

Accepted Answer

aaa authentication login default group tacacs+ local. The aaa authentication login default group tacacs+ local command sets TACACS+ as the primary authentication method and local as the fallback. This ensures that if the TACACS+ server is unreachable, the router will use its local username database, maintaining administrative access without compromising security.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default local group tacacs+

Question 11

A network engineer runs the following command on Router R1:

R1# show ip ospf virtual-links

Virtual Link OSPF_VL0 to router 10.1.1.3 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/0, Cost of using 10
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:08
  Adjacency State FULL

Based on this output, what can be concluded?

Accepted Answer

The virtual link is functioning correctly and the adjacency is full.. The output shows 'Virtual Link OSPF_VL0 to router 10.1.1.3 is up' and 'Adjacency State FULL', which means the virtual link has successfully formed an OSPF adjacency across the transit area. The transit area is explicitly listed as area 1, not area 0, and the cost is 10, confirming the link is operational and correctly configured.

Answer

The virtual link is using area 0 as the transit area.

Answer

Router R1 is not receiving hello packets on the virtual link.

Answer

The virtual link has a cost of 1.

Question 12

A network administrator is deploying IPv6 First Hop Security features on a Cisco Catalyst switch. The goal is to prevent rogue DHCPv6 servers from assigning addresses to clients. The administrator configures DHCPv6 Guard on the switch. Which additional configuration is necessary to ensure that DHCPv6 Guard operates correctly?

Accepted Answer

Enable IPv6 snooping globally.. DHCPv6 Guard requires IPv6 snooping to be enabled because it uses the snooping binding table to validate DHCPv6 server messages. Without IPv6 snooping, DHCPv6 Guard cannot inspect or filter DHCPv6 packets. The other options either do not address the requirement or are unrelated features. Thus, enabling IPv6 snooping globally is the necessary additional configuration.

Answer

Apply an IPv6 access list to block DHCPv6 server traffic.

Answer

Enable RA Guard on all switch ports.

Answer

Configure a DHCPv6 relay agent on the switch.

Question 13

A network administrator is deploying a DMVPN Phase 2 network with EIGRP as the routing protocol. The hub router is configured with a multipoint GRE interface and NHRP. Spokes are configured with tunnel interfaces and are registering with the hub. However, the administrator notices that spoke routers are not forming EIGRP neighbor adjacencies with the hub. Which command is most likely missing on the hub's mGRE interface?

Accepted Answer

ip nhrp map multicast dynamic. For EIGRP to form adjacencies over a DMVPN, the hub must be able to forward multicast hellos to all spokes. The command ip nhrp map multicast dynamic enables the hub to replicate multicast packets to all registered spokes. Without it, spokes do not receive EIGRP hellos, and neighbor relationships fail. This is a common oversight in DMVPN configurations. The other commands are either for Phase 3 or basic NHRP settings that are already working.

Answer

ip nhrp redirect

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 14

A network administrator is configuring a Cisco IOS router as a DHCP server. The router has two interfaces: GigabitEthernet0/0 with IP 192.168.1.1/24 and GigabitEthernet0/1 with IP 10.0.0.1/24. The administrator wants the router to assign addresses from the 192.168.1.0/24 subnet to clients on GigabitEthernet0/0. Which command must be configured in the DHCP pool to ensure that the router only assigns addresses from the correct subnet?

Accepted Answer

network 192.168.1.0 255.255.255.0. The network command is essential in a DHCP pool to define the subnet and mask from which addresses are assigned. It ensures that the router only offers addresses from the 192.168.1.0/24 range. The other options either set client parameters, exclude irrelevant addresses, or create a pool without defining its subnet.

Answer

ip dhcp pool 192.168.1.0

Answer

default-router 192.168.1.1

Answer

ip dhcp excluded-address 10.0.0.1 10.0.0.254

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 network where spoke-to-spoke communication is not working. The hub is configured with ip nhrp redirect, and spokes are configured with ip nhrp shortcut. The routing protocol is OSPF, and the hub is configured with ip nhrp map multicast dynamic. The engineer notices that when a spoke pings another spoke's LAN IP, the first few pings fail, but subsequent pings succeed. However, the engineer wants to eliminate the initial packet loss. Which of the following is the most likely cause of the initial packet loss?

Accepted Answer

The initial packet loss is expected because the spoke must first send an NHRP resolution request and receive a reply before building the direct tunnel.. The initial packet loss in DMVPN Phase 3 spoke-to-spoke communication is a normal occurrence. When a spoke first attempts to reach another spoke, it does not have a direct tunnel. It sends packets to the hub, which forwards them and simultaneously sends an NHRP redirect to the source spoke. The source spoke then initiates NHRP resolution to learn the destination spoke's NBMA address. Until the resolution completes and the direct tunnel is built, packets may be dropped or delayed. This is inherent to the on-demand nature of Phase 3. The other options suggest configuration errors that would prevent direct tunnels from working at all, but the scenario indicates they eventually work.

Answer

The hub is not configured with no ip next-hop-self for OSPF, causing the spokes to use the hub as the next hop and delaying direct tunnel establishment.

Answer

The hub is not configured with ip nhrp redirect, so the first packets are dropped while NHRP resolution occurs.

Answer

The spokes are not configured with ip nhrp shortcut, so they cannot build direct tunnels.