300-410 Practice Exam 52 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        MM_ACTIVE      1       0     ACTIVE
10.1.1.3        10.1.1.1        MM_ACTIVE      2       0     ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete for both peers.. The show crypto isakmp sa command shows IKE phase 1 security associations. The state MM_ACTIVE indicates that IKE phase 1 is complete and active. The output shows two active SAs with the local router (10.1.1.1) and two remote peers (10.1.1.2 and 10.1.1.3).

Answer

IKE phase 2 is complete for both peers.

Answer

The IPsec tunnels are established.

Answer

The peers are not responding.

Question 2

An engineer enables uRPF (strict mode) on an interface facing the Internet. Legitimate traffic from a customer network is being dropped. The customer network uses asymmetric routing where return traffic takes a different path. Which is the most likely explanation?

Accepted Answer

The uRPF strict mode requires that the source IP's best path is out the same interface; asymmetric routing violates this.. Strict uRPF checks that the source IP of incoming packets has a route in the FIB pointing back to the same interface. With asymmetric routing, the return path may use a different interface, causing the check to fail and the packet to be dropped.

Answer

The uRPF loose mode should be used instead, as it only requires a route to the source IP in the FIB.

Answer

The customer network is using private IP addresses that are not routable.

Answer

The uRPF allow-default option is missing, which is required for default routes.

Question 3

Which TWO statements are true regarding the use of VRF-Lite in a Cisco Enterprise network? (Choose TWO.)

Accepted Answer

VRF-Lite enables multiple virtual routing tables on a single router, providing traffic separation without MPLS.. VRF-Lite allows multiple routing tables on a single router, enabling traffic separation without MPLS. It relies on static routes or dynamic routing protocols like OSPF, EIGRP, or BGP within each VRF. The incorrect options: MPLS is not required for VRF-Lite; VRF-Lite does not support MPLS VPNv4 route exchange (that requires MPLS); and VRF-Lite does not inherently provide encryption.

Answer

VRF-Lite requires MPLS to exchange VPNv4 routes between routers.

Answer

VRF-Lite can automatically encrypt traffic between VRFs using IPsec.

Answer

VRF-Lite can only be used with static routing.

Question 4

What is the default administrative distance for a route installed by Policy-Based Routing (PBR) using the 'set ip next-hop' command?

Accepted Answer

The administrative distance of the routing protocol that learned the route.. Policy-Based Routing does not install routes into the routing table with its own administrative distance. When PBR uses 'set ip next-hop', the router must resolve the next-hop address via the routing table; the resulting forwarding entry inherits the administrative distance of whatever routing protocol or static route provided that next-hop resolution. PBR itself has no independent AD value.

Answer

0

Answer

1

Answer

120

Question 5

A network security engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect against denial-of-service attacks. The engineer wants to ensure that CoPP policies are applied correctly and that the router's control plane is protected. Which two statements about CoPP configuration are true? (Choose two.)

Accepted Answer

CoPP can be configured to rate-limit specific types of traffic, such as OSPF and SSH, to protect the route processor.. CoPP uses the MQC framework to classify and police control plane traffic, allowing rate limiting of specific protocols like OSPF and SSH to protect the route processor. The policy is applied to the control plane, not globally or to the data plane. Unmatched traffic is not dropped by default; a class-default can be configured to manage it. Therefore, the true statements are that CoPP uses MQC with class maps and policy maps, and that it can rate-limit specific traffic types.

Answer

CoPP policies are applied globally to all interfaces using the service-policy command in global configuration mode.

Answer

CoPP policies are applied to the data plane to filter transit traffic.

Answer

CoPP requires that all control plane traffic be explicitly permitted in a class map, otherwise it is dropped by default.

Question 6

Drag and drop the steps for MPLS LDP label discovery and distribution into the correct order, from first to last.

Accepted Answer

Establish TCP connection on port 646. LDP label discovery and distribution begins with sending Hello messages to multicast 224.0.0.2 (UDP). Once a Hello is received, a LDP adjacency is formed directly, then a TCP connection on port 646 is established between the peers. After TCP is up, label mapping messages are exchanged. Finally, the learned labels populate the Label Information Base (LIB). The correct order is: B (Hello), C (adjacency), A (TCP connection), D (label mapping), E (LIB). Note that adjacency is formed before the TCP connection because LDP uses a two-phase discovery process.

Question 7

A network engineer runs the following command to verify OSPF database on a DMVPN hub:

R1# show ip ospf database router 2.2.2.2

OSPF Router with ID (1.1.1.1) (Process ID 1)

Router Link States (Area 0)

LS age: 100
  Options: (No TOS-capability, DC)
  LS Type: Router Links
  Link State ID: 2.2.2.2
  Advertising Router: 2.2.2.2
  LS Seq Number: 80000001
  Checksum: 0x1234
  Length: 48
  Number of Links: 1

Link connected to: a Transit Network
     (Link ID) Designated Router address: 10.0.0.1
     (Link Data) Router Interface address: 10.0.0.2
      Number of MTID metrics: 0
       TOS 0 Metrics: 10

What does this output indicate?

Accepted Answer

The router 2.2.2.2 is connected to the DR at 10.0.0.1 over the DMVPN tunnel with cost 10.. The output shows a Router LSA (Type 1) for router 2.2.2.2 with one link: a transit network whose Designated Router is 10.0.0.1 and whose local interface address is 10.0.0.2, with a TOS 0 metric (cost) of 10. This indicates 2.2.2.2 is attached to a multi-access transit network (the DMVPN tunnel) via 10.0.0.2, with the DR at 10.0.0.1, and the link cost is 10.

Answer

The router 2.2.2.2 is advertising a stub network via Tunnel0.

Answer

The router 2.2.2.2 is the DR for the DMVPN network.

Answer

The OSPF database is empty; no LSAs have been received.

Question 8

A network engineer is configuring a Cisco IOS XE router to act as a DHCPv6 relay agent. The router is connected to a LAN segment with DHCPv6 clients and must forward DHCPv6 messages to a DHCPv6 server at 2001:DB8::100. The engineer has configured the interface with ipv6 address 2001:DB8:1::1/64 and ipv6 enable. Which command is required to enable DHCPv6 relay on the interface?

Accepted Answer

ipv6 dhcp relay destination 2001:DB8::100. To configure a Cisco IOS XE router as a DHCPv6 relay agent, you must use the ipv6 dhcp relay destination command on the interface facing the clients. This command specifies the DHCPv6 server address to which client messages are forwarded. It is the direct analog to the IPv4 ip helper-address command, but with IPv6-specific syntax. Without it, the router will not relay DHCPv6 messages, and clients will not receive addresses from the remote server. The other options either configure the router as a server or set RA flags, neither of which enables relay.

Answer

ipv6 dhcp server 2001:DB8::100

Answer

ipv6 helper-address 2001:DB8::100

Answer

ipv6 nd managed-config-flag

Question 9

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connecting to the internet (untrusted) and GigabitEthernet0/1 connecting to the internal network (trusted). The engineer wants to enable strict uRPF on the untrusted interface. Which command should be applied to GigabitEthernet0/0?

Accepted Answer

ip verify unicast source reachable-via rx. Strict uRPF is enabled with the command ip verify unicast source reachable-via rx on the interface. It ensures that the source IP address of incoming packets is reachable via the same interface, effectively dropping packets with spoofed source addresses that would not be routed back out that interface.

Answer

ip verify unicast source reachable-via any

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via rx allow-default

Question 10

A network engineer is configuring an MPLS L3VPN on a Cisco IOS XE PE router. The customer edge (CE) router uses eBGP to peer with the PE router. The engineer wants to ensure that the CE can advertise its routes to the PE and that the PE can propagate them to other PE routers via MP-BGP. The engineer has configured the VRF, the PE-CE eBGP session, and MP-BGP on the PE. However, the routes from the CE are not appearing in the MP-BGP table. Which configuration step is most likely missing on the PE router?

Accepted Answer

The VRF must be enabled for IPv4 unicast address family under the BGP router configuration.. In MPLS L3VPN, the PE router must configure a separate BGP address family for each VRF to exchange routes with CE routers. The 'address-family ipv4 vrf CUSTOMER' command under 'router bgp' activates the VRF context, and the eBGP neighbor must be activated within that address family. Without this, routes from the CE are not imported into BGP and thus not propagated via MP-BGP to other PEs.

Answer

The PE router must be configured with 'neighbor remote-as ' under the global BGP configuration.

Answer

The PE router must be configured with 'router bgp <AS>' and 'address-family vpnv4 unicast' to enable MP-BGP.

Answer

The PE router must have 'ip vrf forwarding CUSTOMER' applied to the interface facing the CE.

Question 11

A network engineer is configuring a Cisco IOS XE router to support First Hop Redundancy Protocol (FHRP) for a group of hosts on VLAN 10. The design requires that the virtual IP address and virtual MAC address remain the same even if the active router changes. The engineer decides to use Virtual Router Redundancy Protocol (VRRP) version 2. Which statement about VRRPv2 is true?

Accepted Answer

VRRPv2 uses a virtual MAC address of 0000.0c07.acXX, where XX is the group ID in hexadecimal.. VRRPv2 uses the virtual MAC address 0000.0c07.acXX, where XX is the VRRP group ID in hexadecimal. This ensures a consistent virtual MAC for hosts, regardless of which physical router is master. The other statements are incorrect: VRRPv2 does not support IPv6 (that requires VRRPv3), it uses multicast 224.0.0.18 (not 224.0.0.2), and preemption can be disabled on any router, not just the master.

Answer

VRRPv2 allows preemption to be disabled only on the master router.

Answer

VRRPv2 supports IPv6 natively without any additional configuration.

Answer

VRRPv2 uses multicast address 224.0.0.2 for hello packets.

Question 12

A network engineer is troubleshooting a dual-stack Cisco IOS XE router that runs OSPFv3 for IPv6 and OSPFv2 for IPv4. IPv4 adjacencies form and routes are exchanged, but no OSPFv3 adjacencies form and no IPv6 routes appear. The engineer verifies that the interfaces have IPv6 addresses and that `ipv6 unicast-routing` is enabled. Which configuration step is most likely missing?

Accepted Answer

Enable OSPFv3 on the interfaces by adding them to an OSPFv3 process with the `ipv6 ospf 1 area 0` interface command.. OSPFv3 requires explicit interface activation; creating the process and enabling global IPv6 routing are not enough. The `ipv6 ospf area ` interface command enables OSPFv3 on that link and triggers hello packets. Without it, no OSPFv3 neighbor relationships form, even though IPv6 addressing and forwarding are correctly configured. This is a common oversight when migrating from OSPFv2, where network statements under the process can enable interfaces indirectly.

Answer

Configure an IPv6 address on the OSPFv3 process using the `ipv6 address` command under `router ospfv3`.

Answer

Configure an OSPFv3 router ID with the `router-id` command under the OSPFv3 process.

Answer

Enable IPv6 unicast routing globally with the `ipv6 unicast-routing` command.

Question 13

A network engineer is configuring a Cisco IOS XE router as a Dynamic Multipoint VPN (DMVPN) Phase 3 hub. The hub must support spoke-to-spoke direct tunnels while allowing the hub to remain in the data path for initial spoke-to-spoke communication. The engineer has configured the tunnel interface with 'ip nhrp redirect' on the hub. Which additional command must be configured on the spoke routers to enable them to dynamically create direct tunnels to other spokes?

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 3, the hub uses ip nhrp redirect to inform a spoke that a better path exists. The spoke must have ip nhrp shortcut configured to act on that redirect, install a shortcut route, and initiate a direct tunnel to the destination spoke. This combination allows dynamic spoke-to-spoke tunnels while the hub remains involved only for initial resolution.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp holdtime 300

Answer

ip nhrp network-id 100

Question 14

A network engineer is deploying DMVPN Phase 3 with EIGRP as the routing protocol over a hub-and-spoke topology. The hub router is configured with `ip nhrp redirect` on its tunnel interface, and each spoke has `ip nhrp shortcut`. A spoke needs to send traffic to a remote subnet behind another spoke. Which mechanism allows the spoke to install a direct route to the remote spoke's tunnel IP without traversing the hub for every packet?

Accepted Answer

NHRP resolution request triggered by the hub's redirect message, followed by installation of a shortcut entry in the NHRP cache and a /32 route in the RIB.. In DMVPN Phase 3, the hub uses NHRP redirect to tell a spoke that a better path exists. The spoke then sends an NHRP resolution request for the destination, receives the remote spoke's NBMA address, installs a shortcut entry, and creates a /32 route. This enables direct spoke-to-spoke forwarding without hairpinning through the hub for every packet.

Answer

The hub advertises a host route for each spoke's tunnel IP, and the spoke uses that route with the hub as next hop until the NHRP cache is populated by regular traffic.

Answer

The hub sends an ICMP redirect to the spoke, which then uses the hub's next-hop IP as the gateway for the remote subnet.

Answer

The spoke performs a recursive lookup on the hub's public IP and automatically derives the remote spoke's tunnel IP from the hub's NHRP database.

Question 15

A network administrator is deploying FlexVPN between a Cisco IOS headend and several remote spokes. The design requires that each spoke be assigned a unique virtual IP address from a pool on the headend, and that the headend pushes a specific DNS server address to each spoke during IKEv2 negotiation. Which configuration element on the headend provides the DNS server address to the spokes?

Accepted Answer

An IKEv2 authorization policy that specifies the DNS server and is referenced by the IKEv2 profile.. FlexVPN uses IKEv2 configuration attributes to deliver parameters such as virtual IP addresses, DNS servers, and split-tunnel information to spokes. The headend's IKEv2 authorization policy defines these attributes, and the IKEv2 profile references the authorization policy so the values are returned during IKE_AUTH. The local IP pool supplies addresses, but the DNS server specifically comes from the authorization policy, making it the correct element for the stated requirement.

Answer

A crypto pki trustpoint that includes the DNS server in the certificate subject alternative name field.

Answer

A local IP pool configured with the ip local pool command and referenced under the virtual-template interface.

Answer

A dynamic routing protocol such as OSPF configured on the virtual-template interface to advertise the DNS server.

Question 16

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to allow traffic from a multihomed customer that uses asymmetric routing. Which uRPF mode should the engineer configure?

Accepted Answer

Loose mode. Loose mode uRPF verifies that the source IP address is reachable via any interface in the routing table, making it suitable for asymmetric routing scenarios. Strict mode would drop legitimate packets because it requires the source to be reachable via the receiving interface. Loose mode still provides anti-spoofing benefits by ensuring the source prefix exists in the routing table.

Answer

Strict mode

Answer

VRF mode

Answer

Feasible path mode

Question 17

A network engineer is configuring a Cisco IOS XE router to support IPv6. The engineer wants to enable IPv6 routing and assign an IPv6 address to an interface. Which command must be configured globally to enable IPv6 routing?

Accepted Answer

ipv6 unicast-routing. To enable IPv6 routing globally on a Cisco IOS XE router, the engineer must configure the ipv6 unicast-routing command in global configuration mode. This command allows the router to forward IPv6 packets and participate in IPv6 routing protocols. The other options are either interface-level commands or invalid syntax. Without this command, the router will not route IPv6 traffic, even if interfaces are configured with IPv6 addresses.

Answer

ipv6 routing

Answer

ipv6 address autoconfig

Answer

ipv6 enable

Question 18

A network engineer is configuring a Cisco IOS XE router for DMVPN Phase 3. The hub router is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 100`. The spoke routers are configured with `ip nhrp map` and `ip nhrp nhs`. The engineer wants to enable spoke-to-spoke communication without traffic traversing the hub after the initial resolution. Which additional command is required on the hub to support Phase 3 shortcut switching?

Accepted Answer

`ip nhrp redirect` on the hub tunnel interface.. DMVPN Phase 3 enables spoke-to-spoke communication with hub assistance. The hub uses `ip nhrp redirect` to send redirect messages to spokes when it detects that traffic between spokes could take a direct path. Spokes then use `ip nhrp shortcut` to create a direct tunnel. The hub must have `ip nhrp redirect` configured; otherwise, spokes never receive the redirect and continue to send traffic through the hub.

Answer

`ip nhrp shortcut` on the hub tunnel interface.

Answer

`ip nhrp network-id 100` on the spoke tunnel interfaces.

Answer

`ip nhrp map multicast dynamic` on the spoke tunnel interfaces.

Question 19

A network engineer is configuring BGP on a Cisco IOS XE router. The router has two eBGP peers: ISP-A and ISP-B. The engineer wants to influence outbound traffic so that the router prefers ISP-A for all destinations unless ISP-A fails. Which BGP attribute should the engineer manipulate, and how?

Accepted Answer

Set a higher local preference for routes learned from ISP-A using a route map with `set local-preference 200`.. Local preference is the correct attribute to influence outbound traffic in BGP. It is exchanged within an autonomous system via IBGP and is evaluated before MED and AS path. By assigning a higher local preference to routes from ISP-A, the router will consistently prefer ISP-A for outbound traffic as long as those routes are available. This provides a deterministic outbound path selection that can be applied network-wide.

Answer

Prepend the AS path for routes learned from ISP-A using a route map with `set as-path prepend`.

Answer

Set a higher weight for routes learned from ISP-A using the `neighbor weight` command.

Answer

Set a lower multi-exit discriminator (MED) for routes learned from ISP-A using a route map with `set metric 50`.

Question 20

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS-XE routers. The hub router is configured with `ip nhrp redirect` and spoke routers with `ip nhrp shortcut`. A spoke router is unable to establish a direct spoke-to-spoke tunnel for a specific destination. Which action should the engineer take to resolve this?

Accepted Answer

Ensure that the spoke routers have a route to the destination network via the hub.. DMVPN Phase 3 relies on NHRP redirects from the hub to trigger spoke-to-spoke shortcuts. For the spoke to send initial traffic to the hub and receive a redirect, it must have a route to the destination via the hub. This route is typically learned through the routing protocol running over the DMVPN. Without it, the spoke cannot initiate the shortcut process.

Answer

Disable `ip split-horizon` on the hub's tunnel interface.

Answer

Configure `ip nhrp map multicast dynamic` on the hub.

Answer

Configure `ip nhrp nhs` on the spoke to point to the hub.