300-410 Practice Test 45 — 15 Questions

Question 1

What is the default authentication type for NHRP in a DMVPN configuration?

Accepted Answer

No authentication. By default, NHRP does not use any authentication. Authentication can be configured using the 'ip nhrp authentication' command, but it is disabled by default.

Answer

Plaintext password

Answer

MD5 hash

Answer

IPsec

Question 2

A network engineer runs the following command on switch SW5:

SW5# show monitor session 7
Session 7
---------
Type : Local Session
Source Ports :
    Both : Gi0/11
Destination Ports : Gi0/12
    Encapsulation : Replicate
    Ingress : Disabled

Based on this output, which statement is correct?

Accepted Answer

The SPAN session will replicate the original VLAN tag on the mirrored traffic sent to Gi0/12.. This is a local SPAN session with source port Gi0/11 and destination port Gi0/12. The encapsulation is set to 'Replicate', which means the mirrored traffic retains its original VLAN tag. This is typical when the destination port is a trunk port and the analyzer expects tagged traffic.

Answer

The SPAN session will strip the VLAN tag from the mirrored traffic.

Answer

The SPAN session is using RSPAN because the encapsulation is set to Replicate.

Answer

The SPAN session is misconfigured because encapsulation Replicate is not supported.

Question 3

A network engineer is troubleshooting suboptimal routing in a DMVPN Phase 2 deployment. Hub router R1 has the following configuration: route-map SET-NEXT-HOP permit 10 match ip address prefix-list SPOKE-NET set ip next-hop 10.0.0.1. Spoke R2 shows: 'show ip route 192.168.1.0' points to the hub (R1) instead of directly to another spoke (R3). R2's NHRP shows 'show dmvpn' with no spoke-to-spoke tunnels established. What is the root cause?

Accepted Answer

The route-map SET-NEXT-HOP incorrectly sets the next-hop to the hub, preventing NHRP from establishing direct spoke-to-spoke tunnels.. In DMVPN Phase 2, spoke-to-spoke tunnels require that the next-hop in the routing table not be changed to the hub. The route-map SET-NEXT-HOP on R1 is setting the next-hop to the hub's tunnel IP (10.0.0.1) for routes matching SPOKE-NET. This causes spokes to see the hub as the next-hop for other spoke networks, preventing NHRP from triggering a spoke-to-spoke tunnel. The correct behavior is to not set the next-hop (or set it to itself) so that spokes use the original next-hop (the other spoke's tunnel IP) and NHRP can resolve it.

Answer

The prefix-list SPOKE-NET does not include the network 192.168.1.0.

Answer

The NHRP authentication is mismatched between R2 and R3.

Answer

The tunnel interface on R2 is not configured with ip nhrp redirect.

Question 4

A network engineer runs the following command to troubleshoot IPsec with route-maps:

R1# show crypto ipsec transform-set
Transform set combined: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Transport, }

Transform set ESP-AES: { esp-aes 256 esp-sha-hmac }
   will negotiate = { Tunnel, }

What does this output indicate?

Accepted Answer

There are two transform sets configured, one using transport mode and one using tunnel mode.. The output shows two IPsec transform sets: 'combined' and 'ESP-AES'. The 'combined' set uses transport mode, while 'ESP-AES' uses tunnel mode. This indicates that different transform sets are configured for different purposes.

Answer

The transform set 'combined' is not valid.

Answer

IPsec is not configured because no transform set is active.

Answer

The transform set 'ESP-AES' is used for route-map filtering.

Question 5

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKE, M - IKEv2, P - IPsec

C-id  Local           Remote          I-VRF      Status Encr Hash Auth DH Lifetime Cap.
1     10.1.1.1        10.1.1.2                  ACTIVE aes  sha  md5  2  86400
2     10.1.1.1        10.1.1.3                  ACTIVE aes  sha  md5  2  86400

Based on this output, what is the problem?

Accepted Answer

The IKE policy uses weak authentication (MD5) and DH group 2.. The output shows IKE phase 1 SAs with encryption aes, hash sha, authentication md5, and DH group 2. The problem is that MD5 is used for authentication, which is considered weak and insecure. Modern DMVPN deployments should use stronger algorithms like SHA-256. Additionally, DH group 2 is weak.

Answer

The IKE SAs are not active.

Answer

The IPsec SAs are missing.

Answer

The lifetime is too short.

Question 6

A network engineer is troubleshooting a redistribution loop between OSPF and EIGRP. Router R7 is redistributing EIGRP routes into OSPF, and also redistributing OSPF routes into EIGRP. The engineer notices that some OSPF routes are appearing in the EIGRP topology table with a higher metric than expected, causing suboptimal routing. What is the most likely cause?

Accepted Answer

Routes are being re-redistributed due to missing route tags; a route-map with 'set tag' should be used to prevent loops.. Redistribution loops can cause routes to be re-injected with different metrics. The most common fix is to use route-maps with tags to prevent re-redistribution. Without proper tagging, routes can loop between the two protocols.

Answer

The OSPF process has a 'default-information originate' command that is injecting a default route into EIGRP.

Answer

The EIGRP process has a 'variance' command that is causing unequal-cost load balancing.

Answer

The route-map applied to redistribution is missing a 'match tag' statement to filter out redistributed routes.

Question 7

An engineer configures IPsec site-to-site VPN with a route map that defines interesting traffic using an extended access list. The VPN tunnel is established, but traffic from the local LAN to the remote LAN is not encrypted. The engineer verifies that the access list matches the traffic correctly. Which is the most likely explanation?

Accepted Answer

The route map must be applied to the crypto map using the 'match ip address' command, but route maps are not supported for crypto maps.. In IPsec, the crypto map applies to the interface, and the access list defines interesting traffic. However, if the route map is applied to the crypto map, it is not used for interesting traffic; route maps are not supported for defining interesting traffic in crypto maps. The correct method is to use an access list directly in the crypto map. The edge case is that the engineer mistakenly used a route map instead of an access list.

Answer

The crypto map is applied to the wrong interface; it should be applied to the LAN interface.

Answer

The IPsec transform set is missing the ESP protocol.

Answer

The route map uses a prefix-list instead of an access list.

Question 8

Which TWO statements about OSPFv3 (OSPF for IPv6) are true when comparing it to OSPFv2? (Choose TWO.)

Accepted Answer

OSPFv3 uses link-local IPv6 addresses for neighbor discovery.. OSPFv3 runs on a per-link basis (not per-subnet) and uses link-local addresses for neighbor discovery. OSPFv3 still uses areas and LSAs, and authentication is handled by IPsec, not OSPF itself. OSPFv3 does not use the 'network' command; it uses 'ipv6 ospf' under the interface.

Answer

OSPFv3 uses the same LSA types as OSPFv2.

Answer

OSPFv3 supports authentication using MD5 or SHA within the OSPF packet.

Answer

OSPFv3 uses the 'network' command to enable OSPF on interfaces.

Question 9

Which TWO configuration steps are required to successfully redistribute OSPF routes into EIGRP on a Cisco router? (Choose TWO.)

Accepted Answer

Enter EIGRP router configuration mode using the 'router eigrp <as-number>' command.. To redistribute OSPF into EIGRP, you must enter EIGRP configuration mode and use the redistribute command. Additionally, you must set a seed metric for EIGRP because EIGRP does not have a default metric for redistributed routes. Option A is correct because you need to enter EIGRP router configuration. Option D is correct because you must set a metric (e.g., bandwidth, delay) for the redistributed routes. Option B is incorrect because you do not need to explicitly match routes in OSPF; you can redistribute all OSPF routes. Option C is incorrect because the redistribute command is under EIGRP, not OSPF. Option E is incorrect because the default-information originate command is for OSPF to inject a default route, not for redistribution.

Answer

Configure a route-map under OSPF to match OSPF routes for redistribution.

Answer

Use the 'redistribute eigrp <as-number>' command under OSPF router configuration mode.

Answer

Issue the 'default-information originate' command under OSPF to advertise redistributed routes.

Question 10

Consider this OSPFv3 configuration on router R2:

ipv6 router ospf 10
 router-id 2.2.2.2
 area 0 authentication ipsec spi 256 md5 1234567890abcdef1234567890abcdef

interface GigabitEthernet0/0
 ipv6 address 2001:db8:1::1/64
 ipv6 ospf 10 area 0

What is the effect of this configuration?

Accepted Answer

OSPFv3 will use IPsec MD5 authentication for all packets in area 0, including on GigabitEthernet0/0.. The area authentication command under OSPFv3 enables IPsec authentication for the entire area. The interface is enabled for OSPFv3 in area 0, so it will use the area authentication. However, OSPFv3 authentication uses IPsec AH or ESP; the configuration shown is valid.

Answer

Authentication is applied only to the GigabitEthernet0/0 interface, not the entire area.

Answer

The configuration is invalid because OSPFv3 does not support IPsec authentication.

Answer

The router-id is missing, so OSPFv3 will not start.

Question 11

An engineer configures a route map to filter OSPF routes using a distribute-list in OSPF process 1. The distribute-list references a prefix-list that permits only the 10.0.0.0/8 network. After applying the distribute-list in, the engineer notices that the OSPF neighbor state remains stuck in EXSTART/EXCHANGE. Which is the most likely explanation?

Accepted Answer

There is an MTU mismatch between the OSPF neighbors, preventing the exchange of Database Description packets.. OSPF distribute-list in only filters routes in the routing table, not LSAs. It does not affect the exchange of LSAs during adjacency formation. The adjacency stall is unrelated to the distribute-list; the issue is likely an MTU mismatch between the interfaces.

Answer

The distribute-list is applied incorrectly; it should be applied out instead of in.

Answer

The distribute-list filters LSAs during the exchange, causing the neighbor to be stuck.

Answer

The prefix-list is misconfigured; it should permit 10.0.0.0/8 with a ge 24 operator.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit ip 10.0.0.0 0.255.255.255 any (500 matches)
    20 deny ip any any (100 matches)

Based on this output, which statement is correct?

Accepted Answer

Traffic not from 10.0.0.0/8 is denied.. The ACL 150 has a permit entry for source 10.0.0.0/8 (wildcard 0.255.255.255) followed by a deny any any. Traffic matching the permit (from 10.0.0.0/8) is allowed, while all other traffic is denied by the implicit deny or the explicit deny entry. Thus, traffic not from the 10.0.0.0/8 network is denied, making option B correct.

Answer

Traffic from 10.0.0.0/8 is denied.

Answer

All traffic is permitted.

Answer

The ACL has no effect.

Question 13

Which statement about the default behavior of 'auto-summary' in EIGRP for DMVPN tunnel interfaces in IOS-XE is correct?

Accepted Answer

Auto-summary is disabled by default, preventing classful summarization.. In modern IOS-XE versions (15.x and later), auto-summary is disabled by default for EIGRP. This is a change from older IOS versions where it was enabled by default. Disabling auto-summary is essential in DMVPN to prevent incorrect summarization at classful boundaries.

Answer

Auto-summary is enabled by default and summarizes routes at classful boundaries.

Answer

Auto-summary is enabled by default but only for tunnel interfaces.

Answer

Auto-summary is disabled by default but can be enabled only for DMVPN.

Question 14

A network engineer runs the following command on Router R2:

R2# show ip route 192.168.10.0
Routing entry for 192.168.10.0/24
  Known via "ospf 1", distance 110, metric 20
  Redistributing via ospf 1
  Last update from 10.0.0.1 on GigabitEthernet0/1, 00:00:10 ago
  Routing Descriptor Blocks:
  * 10.0.0.1, from 10.0.0.1, 00:00:10 ago, via GigabitEthernet0/1
      Route metric is 20, traffic share count is 1

Based on this output, what is the most likely origin of this route?

Accepted Answer

The route is an OSPF external route, likely redistributed.. The metric of 20 is the default metric for OSPF external routes of type E2 (external type 2). The administrative distance of 110 is the default for OSPF routes. This combination indicates the route was redistributed into OSPF from another protocol.

Answer

The route is an OSPF intra-area route.

Answer

The route is an OSPF inter-area route.

Answer

The route is an OSPF NSSA external route.

Question 15

A network engineer runs the following command to troubleshoot OSPF route filtering:

R1# show ip ospf database router 2.2.2.2

OSPF Router with ID (1.1.1.1) (Process ID 1)

Router Link States (Area 0)

LS age: 300
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 2.2.2.2
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000004
  Checksum: 0x1234
  Length: 48
  Number of Links: 2

Link connected to: a Stub Network
     (Link ID) Network/subnet number: 10.1.1.0
     (Link Data) Network Mask: 255.255.255.0
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

Link connected to: a Transit Network
     (Link ID) Designated Router address: 10.1.1.2
     (Link Data) Router Interface address: 10.1.1.1
      Number of TOS metrics: 0
       TOS 0 Metrics: 10

What does this output indicate?

Accepted Answer

Router 2.2.2.2 is advertising two links, one of which is a stub network 10.1.1.0/24.. The output shows the OSPF router LSA from router 2.2.2.2. It lists two links: one stub network (10.1.1.0/24) and one transit network (via DR 10.1.1.2). This is normal OSPF operation.

Answer

Router 2.2.2.2 is filtering routes from area 0.

Answer

Router 2.2.2.2 is a DR for the transit network.

Answer

Router 2.2.2.2 has a mismatched area ID.