300-410 Practice Exam 53 — 20 Questions

Question 1

A network engineer is configuring a Cisco IOS XE router to connect to an ISP via BGP. The engineer wants to influence inbound traffic from the ISP by prepending the router's AS number multiple times to the BGP updates sent to the ISP. Which BGP attribute should the engineer modify to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AS path. AS path prepending is the technique of adding multiple instances of the local AS number to the AS path attribute in BGP updates sent to external peers. This makes the route less attractive because a longer AS path is less preferred. It is a standard method to influence inbound traffic from an ISP. Local preference and weight affect outbound traffic, while MED is an alternative but less forceful method for inbound influence.

Answer

Weight

Answer

Multi-exit discriminator (MED)

Answer

Local preference

Question 2

A network engineer is configuring a Cisco IOS XE router to connect to an ISP via BGP. The engineer wants to influence inbound traffic from the ISP by prepending the router's AS number multiple times to the BGP updates sent to the ISP. Which BGP attribute should the engineer modify to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the same IPsec SPI and key on the neighboring router under its OSPFv3 process.. OSPFv3 authentication uses IPsec to secure protocol packets. The configuration requires an SPI and a key to be manually set under the OSPFv3 process on both routers. When the peer lacks the matching SPI and key, authentication fails, and the adjacency cannot progress beyond EXSTART. Configuring the identical IPsec parameters on the neighbor resolves the issue.

Answer

Configure a key chain with the same key ID and key string on both routers.

Answer

Enable OSPFv3 authentication globally with the `ipv6 ospf authentication` command on all interfaces.

Answer

Change the authentication algorithm to MD5 to match the neighbor's configuration.

Question 3

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to authenticate administrative users against a TACACS+ server and ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. The administrator has configured the TACACS+ server and local user accounts. Which additional configuration is required to achieve this?

Accepted Answer

Configure 'aaa authentication login default group tacacs+ local'.. The correct command is 'aaa authentication login default group tacacs+ local', which specifies TACACS+ as the primary authentication method and local as the fallback. This ensures that if the TACACS+ server is unreachable, the router will use the local user database. Other options either reverse the order or use different methods that do not meet the fallback requirement.

Answer

Configure 'aaa authentication login default local group tacacs+'.

Answer

Configure 'aaa authentication login default group tacacs+ enable'.

Answer

Configure 'aaa authorization exec default group tacacs+ local'.

Question 4

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers that uses IKEv2. Phase 1 is up, but Phase 2 fails. The administrator reviews the configuration and notices that the transform set on one router includes esp-aes 256 esp-sha256-hmac, while the other router has esp-aes 256 esp-sha512-hmac. The administrator wants to ensure the Phase 2 SA is established. Which action should the administrator take?

Accepted Answer

Configure a matching transform set on both routers with the same encryption and integrity algorithms.. IPsec Phase 2 requires both peers to agree on a transform set that defines the encryption and integrity algorithms. The mismatch between esp-sha256-hmac and esp-sha512-hmac means the peers cannot agree on the integrity algorithm, so the IPsec SA fails to establish. The administrator must configure a matching transform set on both routers, ensuring the encryption and integrity algorithms are identical, to allow Phase 2 to complete.

Answer

Change the IKEv2 proposal to use a different DH group.

Answer

Restart the IKEv2 process on both routers to clear the Phase 1 SA and force renegotiation.

Answer

Enable perfect forward secrecy on both routers by configuring the same DH group in the IPsec profile.

Question 5

A network engineer is deploying an MPLS L3VPN using BGP as the PE-CE routing protocol. The customer requires that the PE router accept only routes with a specific BGP community and set a local preference of 200 for those routes. Which configuration on the PE router accomplishes this requirement?

Accepted Answer

Configure a route-map that matches the community and sets local preference, then apply it as an inbound route-map under the BGP neighbor configuration for the CE.. Inbound route-maps on the PE-CE BGP session are the correct tool to match BGP communities and modify attributes such as local preference. They allow granular control over which routes are accepted and how they are treated within the VRF. Outbound route-maps affect advertisements, distribute-lists cannot set attributes, and the network command does not provide community-based filtering.

Answer

Configure a route-map that matches the community and sets local preference, then apply it as an outbound route-map under the BGP neighbor configuration for the CE.

Answer

Configure a distribute-list with an extended ACL that matches the community and sets local preference under the BGP process.

Answer

Use the BGP network command with a backdoor route to inject the routes with the desired local preference.

Question 6

A network engineer is configuring a Cisco IOS XE router to connect to an ISP via BGP. The engineer wants to influence inbound traffic from the ISP by prepending the router's AS number multiple times to the BGP updates sent to the ISP. Which BGP attribute should the engineer modify to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a class-map that matches all TCP and UDP traffic, define a policy-map with inspect for that class, and apply the policy-map to the zone-pair from LAN to WAN using the service-policy command.. To implement Zone-Based Policy Firewall, you must define class-maps to identify traffic, policy-maps to specify actions (such as inspect), and apply the policy-map to a zone-pair with the service-policy command. Inspecting traffic from LAN to WAN allows return traffic while denying unsolicited WAN-initiated traffic, as traffic not explicitly permitted between zones is dropped by default.

Answer

Apply an access-list to the WAN interface inbound to block all traffic and an access-list to the LAN interface inbound to permit all traffic.

Answer

Configure a zone-pair from WAN to LAN and apply a policy-map that inspects all traffic, then configure a zone-pair from LAN to WAN with a policy-map that drops all traffic.

Answer

Enable Cisco IOS Firewall with the ip inspect command on the LAN interface and apply an inbound access-list on the WAN interface to deny all traffic.

Question 7

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. The hub router must advertise a default route to all spokes, but the spokes should not use the hub as the next hop for spoke-to-spoke traffic; instead, they should dynamically discover a direct path to other spokes. Which NHRP configuration on the hub is required to support this behavior?

Accepted Answer

ip nhrp redirect. DMVPN Phase 3 requires the hub to be configured with ip nhrp redirect on its mGRE interface. This allows the hub to send NHRP redirect messages to spokes when it forwards traffic between them, prompting the source spoke to resolve the destination spoke's NBMA address and build a direct tunnel. The spokes must also be configured with ip nhrp shortcut to use the redirect information. This combination allows the hub to advertise a default route while still enabling dynamic spoke-to-spoke direct paths.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Question 8

A network engineer is deploying a GET VPN solution across a service provider MPLS network. The company requires that all group members use the same encryption keys and that any group member can decrypt traffic from any other group member. Which key distribution method should the engineer configure?

Accepted Answer

Configure GDOI with a key server that distributes the Group Encryption Key and Group Anti-Replay key.. GET VPN uses GDOI to distribute group keys from a key server to all group members. This allows any member to encrypt and decrypt traffic for any other member using the same Group Encryption Key and Group Anti-Replay key, without building point-to-point IPsec tunnels. IKEv2, DMVPN, and FlexVPN do not provide this group key distribution model.

Answer

Configure FlexVPN with IKEv2 and a single IPsec profile on the hub.

Answer

Configure DMVPN with NHRP and IPsec profiles on all routers.

Answer

Configure IKEv2 with a single pre-shared key on all group members.

Question 9

A network engineer is implementing MPLS Layer 3 VPN on a Cisco IOS-XE router. The engineer needs to configure the router to exchange VPNv4 routes with a route reflector. The router is already configured with BGP AS 65001 and has established an IBGP session with the route reflector. Which address family must be activated to support VPNv4 route exchange?

Accepted Answer

address-family vpnv4 unicast. MPLS L3VPN uses the VPNv4 address family to exchange labeled VPN routes between PE routers. The VPNv4 address family carries the route distinguisher and route target extended communities. Activating it under the BGP routing process on both the PE and route reflector is required. Without it, VPNv4 prefixes are not propagated.

Answer

address-family ipv6 unicast

Answer

address-family ipv4 vrf

Answer

address-family ipv4 unicast

Question 10

A network engineer is configuring a Cisco IOS XE router to connect to an ISP via BGP. The engineer wants to influence inbound traffic from the ISP by prepending the router's AS number multiple times to the BGP updates sent to the ISP. Which BGP attribute should the engineer modify to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip rsvp bandwidth 100000. To enable RSVP-TE signaling on an interface, the 'ip rsvp bandwidth' command must be configured. This command reserves bandwidth for RSVP-TE LSPs and allows the interface to participate in RSVP signaling. The bandwidth value is specified in kilobits per second, so 100 Mbps is 100,000 kbps. Without this command, the router cannot signal an LSP with the required bandwidth, even if MPLS TE is enabled globally and on the interface.

Answer

mpls traffic-eng tunnels

Answer

mpls traffic-eng bandwidth 100000

Answer

mpls rsvp-te bandwidth 100000

Question 11

A network engineer is configuring a Cisco IOS XE router to connect to an ISP via BGP. The engineer wants to influence inbound traffic from the ISP by prepending the router's AS number multiple times to the BGP updates sent to the ISP. Which BGP attribute should the engineer modify to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip helper-address 10.1.1.100. To enable DHCP relay on a Cisco IOS XE router, the engineer must configure the ip helper-address command on the interface facing the DHCP clients, specifying the DHCP server's IP address. This command causes the router to forward DHCP broadcast requests as unicast packets to the server. The other options are either invalid commands or serve different purposes, such as configuring a DHCP server or modifying forwarded protocols.

Answer

ip dhcp pool 10.1.1.100

Answer

ip forward-protocol udp 67

Answer

ip dhcp relay 10.1.1.100

Question 12

A network engineer is configuring Zone-Based Policy Firewall on a Cisco IOS XE router. The company requires that all traffic from the internal LAN zone to the untrusted Internet zone be inspected, but traffic from the Internet to the internal LAN must be blocked unless it is return traffic. The engineer has already defined zone pairs with 'zone-pair security IN-TO-OUT source LAN destination INTERNET' and applied an inspect policy-map. What must the engineer do to complete the configuration?

Accepted Answer

Assign the interfaces to the LAN and INTERNET zones using the 'zone-member security' command.. Zone-Based Policy Firewall operates by grouping interfaces into security zones and defining policies between zone pairs. The inspect policy-map applied to the LAN-to-INTERNET zone pair only functions when the involved interfaces are assigned to their respective zones with 'zone-member security'. Until interfaces are bound to zones, the zone-pair policy remains inactive, so no stateful inspection or implicit return traffic handling occurs.

Answer

Configure a class-map matching all traffic and apply it to the zone pair with the 'inspect' action.

Answer

Enable 'ip inspect' globally on the router to activate stateful inspection for all zones.

Answer

Apply the inspect policy-map directly to the inside interface using the 'service-policy type inspect' command.

Question 13

A service provider is deploying MPLS Traffic Engineering (TE) with RSVP-TE to guarantee bandwidth for critical traffic. The network uses OSPF as the IGP with TE extensions enabled. An engineer notices that a TE tunnel fails to establish because the path computation cannot find a path with sufficient bandwidth, even though the physical links have enough capacity. Which action should the engineer take to ensure that RSVP-TE can reserve bandwidth on the links?

Accepted Answer

Enable MPLS TE on the physical interfaces and configure the ip rsvp bandwidth command with the appropriate reservable bandwidth.. RSVP-TE requires that MPLS TE be enabled on the physical interface and that the interface be configured with the ip rsvp bandwidth command to specify the reservable bandwidth. Without this interface-level configuration, the TE tunnel cannot signal a reservation, and path computation fails due to lack of available bandwidth. OSPF TE extensions are already enabled, so the missing piece is the interface configuration.

Answer

Enable MPLS LDP on all interfaces to ensure label distribution for the TE tunnel.

Answer

Configure the mpls traffic-eng tunnels command under the OSPF process to advertise TE metrics.

Answer

Configure the ip rsvp bandwidth command under the OSPF process to allow RSVP to reserve bandwidth.

Question 14

A network engineer is deploying MPLS Layer 3 VPNs on a Cisco IOS XE PE router. The customer VRF CUST_A uses OSPF as the PE-CE routing protocol. The engineer must ensure that OSPF routes from the customer are redistributed into MP-BGP and that the OSPF domain ID is preserved across the MPLS backbone. Which configuration step is required on the PE router?

Accepted Answer

Configure route redistribution from OSPF into BGP under the VRF address family and set a domain ID under router ospf with the same value on all PE routers.. Preserving the OSPF domain ID requires redistributing OSPF into MP-BGP and configuring a consistent domain ID under the OSPF process on all PE routers. This ensures that routes carry the domain identifier, which prevents routing loops and maintains OSPF route integrity across the MPLS VPN. Other options either misapply features or do not address domain ID preservation.

Answer

Configure the OSPF process with the capability vrf-lite command and redistribute connected routes into BGP.

Answer

Configure a route target export and import under the VRF and enable OSPF as the provider core routing protocol.

Answer

Configure a sham link between PE routers and set the OSPF network type to point-to-point on the PE-CE link.

Question 15

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that packets are dropped if the source IP address is not reachable via the same interface they arrived on. The engineer configures 'ip verify unicast source reachable-via rx' on interface GigabitEthernet0/0. However, some legitimate traffic from a secondary path is being dropped. What is the most likely cause?

Accepted Answer

The router uses strict uRPF, which requires the source to be reachable via the same interface; asymmetric routing causes legitimate packets to be dropped.. The 'reachable-via rx' option enables strict uRPF, which drops packets if the source IP is not reachable via the ingress interface. In networks with asymmetric routing, legitimate traffic may arrive on an interface that is not the best path back to the source, causing drops. Switching to loose uRPF ('reachable-via any') would alleviate this but reduce spoofing protection. CEF is typically enabled by default, so it is not the issue.

Answer

The interface must be configured with 'ip verify unicast source reachable-via any' to allow asymmetric routing.

Answer

The uRPF feature requires CEF to be enabled, and CEF is not enabled on the router.

Answer

The router uses loose uRPF, which only checks if the source is reachable via any interface, so it should not drop legitimate traffic.

Question 16

A network engineer is configuring MPLS Traffic Engineering (TE) with RSVP-TE on a Cisco IOS XE router to provide bandwidth guarantees for delay-sensitive traffic. The engineer must ensure that the TE tunnel can signal the required bandwidth and that the path is computed based on available resources. Which two statements about the configuration are true? (Choose two.)

Accepted Answer

The tunnel mpls traffic-eng bandwidth command specifies the bandwidth to be reserved for the TE tunnel.. To configure MPLS TE with RSVP-TE, the tunnel interface must have the bandwidth reservation set with tunnel mpls traffic-eng bandwidth, and each physical interface along the path must have RSVP enabled with ip rsvp bandwidth. These two steps ensure that the tunnel can signal its bandwidth requirements and that network resources are reserved. Other statements misrepresent the requirements for transit routers, destination configuration, or path types.

Answer

The ip explicit-path command is used to define a dynamic path that can change based on network conditions.

Answer

The mpls traffic-eng tunnels command is only needed on the tunnel headend and not on transit routers.

Answer

The tunnel destination command is optional if the path is explicitly specified with a dynamic path option.

Question 17

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent through the tunnel, while all other traffic is sent unencrypted. The engineer creates an extended ACL named VPN_TRAFFIC and applies it to the crypto map. However, after testing, the engineer finds that traffic from 192.168.1.0/24 is not being encrypted. Which action should the engineer take to correct the issue?

Accepted Answer

Ensure the ACL permits traffic from 192.168.1.0/24 to the remote subnet, and that the crypto map references this ACL.. The crypto map uses an extended ACL to identify interesting traffic that should be encrypted. If the ACL does not permit traffic from 192.168.1.0/24 to the remote subnet, that traffic will not be encrypted. The engineer must ensure the ACL entries match the desired source and destination and that the crypto map references the correct ACL. This is a common misconfiguration when defining VPN traffic.

Answer

Apply the ACL to the outside interface with 'ip access-group VPN_TRAFFIC out'.

Answer

Enable 'crypto ipsec transform-set' with the correct encapsulation mode.

Answer

Configure a route map to match the traffic and apply it to the crypto map.

Question 18

A network engineer is configuring a Cisco IOS XE router for MPLS Layer 3 VPN. The router is a PE connected to a CE via GigabitEthernet0/0. The engineer wants to configure a VRF named CUSTOMER_A and assign the interface to it. The engineer enters the following commands: `vrf definition CUSTOMER_A`, `rd 65000:1`, `address-family ipv4`, `exit`, `exit`. Then, under interface GigabitEthernet0/0, the engineer enters `vrf forwarding CUSTOMER_A`. After entering the command, the engineer notices that the IP address on the interface is removed. What is the most likely reason?

Accepted Answer

The `vrf forwarding` command removes the IP address because the interface must be reconfigured with an IP address within the VRF.. Assigning an interface to a VRF with `vrf forwarding` removes the existing IP address. This is by design because the interface's IP address must be unique within the VRF. The engineer must reconfigure the IP address after the VRF assignment. The other options describe unrelated VRF configuration steps or incorrect requirements.

Answer

The VRF definition must include `address-family ipv4` before the interface can be assigned, and the missing address-family caused the IP removal.

Answer

The interface must be shut down before assigning it to a VRF, otherwise the IP address is cleared.

Answer

The VRF definition is missing the `route-target export` and `route-target import` commands.

Question 19

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers using IKEv2. Phase 1 is up, but Phase 2 fails to establish. The administrator runs 'show crypto ipsec sa' and sees no active SAs. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify that the IPsec transform set or profile matches on both peers.. Phase 2 failure with no active SAs typically indicates a mismatch in the IPsec transform set or profile. Since Phase 1 is up, IKEv2 parameters like the proposal and pre-shared key are correct. The crypto ACL defines interesting traffic but does not prevent SA establishment. Therefore, verifying the transform set or profile match is the correct action.

Answer

Verify that the IKEv2 proposal matches on both peers.

Answer

Ensure that the crypto ACL or IPsec profile matches the traffic to be encrypted.

Answer

Check that the IKEv2 keyring contains the correct pre-shared key.

Question 20

A network administrator is configuring a Cisco IOS XE router to act as a DHCP relay agent. The router is connected to a client subnet on GigabitEthernet0/0 and to a DHCP server at 192.168.1.100 on GigabitEthernet0/1. The administrator enters the command 'ip helper-address 192.168.1.100' on GigabitEthernet0/0. Which statement is true about the behavior of this configuration?

Accepted Answer

The router will forward DHCP requests from clients to the DHCP server, and the server will reply to the router, which then forwards the reply to the clients.. When a Cisco IOS XE router is configured with 'ip helper-address', it acts as a DHCP relay agent. It forwards DHCP discover messages from clients to the specified DHCP server, inserting its own interface IP address as the giaddr. The DHCP server uses the giaddr to select the correct address pool and sends the DHCP offer back to the relay agent. The relay agent then forwards the offer to the client. This allows DHCP to function across subnets without requiring a DHCP server on every subnet.

Answer

The router will forward DHCP requests from clients to the DHCP server, and the server will reply directly to the clients.

Answer

The router will forward DHCP requests from clients to the DHCP server, but the server will not be able to assign an address because the router does not have a route to the client subnet.

Answer

The router will drop DHCP requests because it is not configured as a DHCP server.