300-410 Practice Exam 54 — 20 Questions

Question 1

A network administrator is building a FlexVPN hub-and-spoke deployment using IKEv2 on a Cisco IOS router. The hub must accept connections from many spokes that use dynamically assigned public addresses, and the administrator wants the hub to authorize each spoke and assign it an address from a pool after authentication. Which IKEv2 configuration element on the hub provides the address assignment to authenticated spokes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IKEv2 authorization policy that references a local or DHCP address pool. FlexVPN uses IKEv2 profiles and authorization policies to control what authenticated peers receive. The authorization policy references an address pool, either local or external via DHCP, and the hub assigns each spoke an address for its virtual access interface after authentication succeeds. This is the mechanism that provides dynamic addressing to spokes in a hub-and-spoke FlexVPN deployment.

Answer

A transform set with the esp-aes esp-sha256-hmac algorithms applied to the virtual template

Answer

An NHRP map entry for each spoke pointing to the hub's tunnel address

Answer

A crypto map with the set peer dynamic command on the hub

Question 2

A network engineer is troubleshooting a DMVPN Phase 3 network using EIGRP as the routing protocol. Spoke routers are unable to establish direct spoke-to-spoke tunnels. The engineer verifies that NHRP registration is successful and that the hub has routes to all spokes. Which action is most likely to resolve the issue?

Accepted Answer

Verify that the hub is configured with ip nhrp redirect and the spokes with ip nhrp shortcut.. In DMVPN Phase 3, spoke-to-spoke tunnels require ip nhrp redirect on the hub and ip nhrp shortcut on the spokes. These commands allow the hub to redirect traffic and the spokes to create shortcut routes. Without them, spokes will continue to route through the hub, even if NHRP registration is successful.

Answer

Ensure that the tunnel interfaces on all routers are configured with the same tunnel key.

Answer

Change the EIGRP network type on the tunnel interfaces to point-to-multipoint.

Answer

Configure EIGRP stub routing on the spoke routers.

Question 3

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. Spoke routers are unable to establish direct spoke-to-spoke tunnels. The hub router is configured with 'ip nhrp redirect', and spokes are configured with 'ip nhrp shortcut'. The engineer notices that spoke routers are not receiving NHRP redirect messages from the hub. Which action should be taken to resolve this issue?

Accepted Answer

Ensure that the hub router has a route to the spoke networks and that NHRP resolution is working.. In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to inform spokes of a better path to a destination. For the hub to send redirects, it must have a route to the destination network and be able to resolve the destination's NBMA address via NHRP. If the hub lacks a route or NHRP resolution fails, no redirects are sent, and spokes cannot establish direct tunnels. Verifying hub routing and NHRP operation is essential for troubleshooting this issue.

Answer

Configure 'ip nhrp map multicast dynamic' on the spoke routers.

Answer

Enable 'ip nhrp shortcut' on the hub router.

Answer

Change the tunnel mode from GRE multipoint to GRE point-to-point.

Question 4

A network engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS XE router to mitigate spoofed source IP addresses. The router has two interfaces: GigabitEthernet0/0 (WAN, connected to ISP) and GigabitEthernet0/1 (LAN, connected to internal network). The engineer wants to apply strict uRPF on the WAN interface to drop packets with spoofed source addresses, but the internal network uses asymmetric routing, with some return traffic going out a different interface. The engineer applies the following configuration:

interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.0
 ip verify unicast source reachable-via rx

After applying this, the engineer notices that some legitimate traffic from the internal network is being dropped. Which action should the engineer take to resolve the issue while maintaining spoofing protection?

Accepted Answer

Configure uRPF with an access list to allow specific internal subnets that are subject to asymmetric routing, while keeping strict mode for other traffic.. Strict uRPF drops packets if the source address is not reachable via the incoming interface. Asymmetric routing causes legitimate return traffic to arrive on an interface different from the one used to reach the source, triggering drops. Cisco IOS XE allows an access list with strict uRPF to exempt specific source addresses from the check. By permitting the internal subnets that use asymmetric routing in the ACL, the engineer maintains strict uRPF for all other traffic, preserving spoofing protection while allowing legitimate flows.

Answer

Enable uRPF in loose mode with an access list that denies known spoofed prefixes, and apply it to the WAN interface.

Answer

Disable uRPF on the WAN interface and instead implement IP Source Guard on the LAN interfaces to prevent spoofing.

Answer

Change the uRPF mode to loose mode by using the ip verify unicast source reachable-via any command on the WAN interface.

Question 5

A network administrator is troubleshooting a site-to-site IPsec VPN between two Cisco IOS routers using IKEv1. Phase 1 completes successfully, but Phase 2 fails with the message 'QM_IDLE' and no IPSec SA is established. The administrator verifies that the transform sets on both peers contain matching encryption and hash algorithms. Which configuration mismatch is the most likely cause of the Phase 2 failure?

Accepted Answer

The crypto ACLs on the two peers do not mirror each other for the interesting traffic.. In IKEv1, Phase 2 quick mode negotiates the IPSec SA using proxy identities derived from the crypto ACLs. These ACLs must be mirror images between peers so that the source and destination selectors align. If they do not mirror each other, quick mode fails and no IPSec SA is created, even though Phase 1 is established and transform sets match.

Answer

The ISAKMP policy priority numbers are different on the two peers.

Answer

The IKEv1 aggressive mode is enabled on one peer but not the other.

Answer

The pre-shared keys on the two peers do not match.

Question 6

A network engineer is configuring a Cisco IOS router as a DHCP server for a subnet. The router must exclude the address 10.10.10.1 from being assigned to clients. Which command correctly accomplishes this?

Accepted Answer

ip dhcp excluded-address 10.10.10.1. The correct way to exclude a single IP address from a Cisco IOS DHCP server is to use the global command 'ip dhcp excluded-address' followed by the specific address. This prevents the DHCP server from assigning that address to any client. The command must be entered in global configuration mode, not within the DHCP pool.

Answer

ip dhcp excluded-address 10.10.10.1 10.10.10.1

Answer

ip dhcp excluded-address 10.10.10.0 10.10.10.255

Answer

ip dhcp pool POOL; excluded-address 10.10.10.1

Question 7

A network engineer is deploying DMVPN Phase 3 with NHRP and wants spoke-to-spoke traffic to be built directly between spokes without traversing the hub after initial resolution. On the hub router, the engineer issues the command 'ip nhrp redirect' on the tunnel interface and 'ip nhrp shortcut' on each spoke tunnel interface. After configuration, spokes can reach the hub but spoke-to-spoke traffic still hairpins through the hub. Which additional configuration is required on the spoke routers for the shortcut path to be installed?

Accepted Answer

Ensure the routing protocol on the spokes has a route to the destination spoke's tunnel network, typically via a summary or default from the hub, so traffic triggers NHRP resolution.. DMVPN Phase 3 shortcut switching requires the spoke to have a route covering the remote spoke prefix so that forwarded traffic triggers an NHRP resolution. The hub uses 'ip nhrp redirect' to notify spokes of a better path, and the spoke uses 'ip nhrp shortcut' to act on that notification. Without a route toward the destination spoke network, the spoke never originates the resolution and the shortcut never installs.

Answer

Enable 'ip nhrp map multicast dynamic' on the spoke tunnel interfaces.

Answer

Enable 'ip nhrp network-id' with the same value on all spoke tunnel interfaces.

Answer

Configure the tunnel interface with 'ip nhrp nhs <hub-NBMA>' so the spoke registers to the hub.

Question 8

A network engineer is implementing policy-based routing (PBR) on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 (LAN) and GigabitEthernet0/1 (WAN). A route-map named PBR-MAP is applied to GigabitEthernet0/0 with the command `ip policy route-map PBR-MAP`. The route-map contains a match statement for access-list 101, which permits traffic from 10.1.1.0/24 to any destination. The set statement is `set ip next-hop 192.168.2.1`. However, traffic from 10.1.1.0/24 is still being routed according to the routing table instead of being forwarded to 192.168.2.1. Which action should the engineer take to ensure PBR is applied?

Accepted Answer

Verify that the access-list 101 is correctly configured and matches the traffic, and that the route-map is applied to the correct interface in the inbound direction.. Policy-based routing requires the route-map to be applied to the inbound interface where traffic enters the router. The match conditions, such as an ACL, must correctly identify the traffic to be policy-routed. If the ACL is incorrect or the policy is not applied inbound, PBR will not override the routing table. Verifying these elements ensures that the policy is triggered and the set action is applied.

Answer

Enable PBR globally with the command `ip policy route-map PBR-MAP` in global configuration mode.

Answer

Configure a default route pointing to 192.168.2.1 to force all traffic through that next-hop.

Answer

Apply the route-map to the outbound direction on GigabitEthernet0/1 instead of inbound on GigabitEthernet0/0.

Question 9

A network engineer is configuring EIGRP on a Cisco IOS XE router. The router is connected to two different autonomous systems: AS 100 and AS 200. The engineer wants to redistribute routes from AS 100 into AS 200. Which two statements are true regarding EIGRP redistribution? (Choose two.)

Accepted Answer

A seed metric must be specified using the `default-metric` command or in the redistribute statement.. To redistribute routes from EIGRP AS 100 into EIGRP AS 200, you must configure the `redistribute eigrp 100` command under the EIGRP AS 200 process. Additionally, a seed metric must be provided, either within the redistribute command or via the `default-metric` command, because EIGRP requires specific metric parameters. Without these, redistribution will not occur.

Answer

The `redistribute eigrp 100` command must be configured under router eigrp 100.

Answer

Redistribution between different EIGRP autonomous systems requires the `redistribute connected` command.

Answer

The `default-metric` command is optional and only needed for OSPF redistribution.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list PERMIT-ONLY
IPv6 access list PERMIT-ONLY
    permit ipv6 2001:DB8:3::/48 any sequence 10

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else. An IPv6 access list, like its IPv4 counterpart, has an implicit deny all at the end. The single permit entry for source 2001:DB8:3::/48 allows only traffic from that prefix; all other IPv6 traffic is denied by the implicit deny ipv6 any any rule.

Answer

It permits all IPv6 traffic

Answer

It denies all IPv6 traffic from 2001:DB8:3::/48

Answer

It permits all IPv6 traffic except from 2001:DB8:3::/48

Question 11

A network engineer is configuring object tracking to influence a static default route on a Cisco IOS router. The engineer wants the default route to be removed from the routing table if the tracked object (a reachability test to 192.0.2.1) goes down. The engineer enters the following configuration:

track 1 ip route 192.0.2.1 255.255.255.255 reachability
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1

After the link to 203.0.113.1 fails, the default route remains in the routing table. What is the most likely reason?

Accepted Answer

The tracked object uses a reachability test to 192.0.2.1, which may still be reachable via an alternate path, so the object remains up.. Object tracking removes a static route only when the tracked object transitions to a down state. The reachability test to 192.0.2.1 may succeed via an alternate path even after the primary link fails, keeping the object up. The track keyword placement, administrative distance, and delay parameters do not explain the persistent route in this scenario.

Answer

The static route must be configured with a administrative distance lower than the default to be removed by tracking.

Answer

The 'track 1 ip route' command requires a delay before the object goes down, so the route removal is delayed indefinitely.

Answer

The 'track' keyword on the static route must reference the track object by number, but the syntax requires 'track 1' to be placed before the route.

Question 12

A network administrator is configuring AAA on a Cisco IOS router to authenticate administrative SSH users against a TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, a locally configured user account can still be used for authentication. Which configuration should the administrator apply?

Accepted Answer

aaa authentication login default group tacacs+ local. The 'aaa authentication login default group tacacs+ local' command creates a method list that tries TACACS+ first and then the local username database. This ensures that if the TACACS+ server is unreachable, administrators can still log in using locally configured credentials. The order of methods is critical: TACACS+ must be primary to maintain centralized authentication, with local as a backup for resiliency.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ enable

Question 13

A network engineer is configuring Policy-Based Routing (PBR) on a Cisco IOS-XE router. The engineer wants to route traffic from the 10.1.1.0/24 subnet that is destined for any TCP port 80 to next-hop 192.168.2.1, but only for packets arriving on GigabitEthernet0/1. Other traffic should follow the normal routing table. Which configuration sequence correctly accomplishes this?

Accepted Answer

Create an extended ACL that permits tcp 10.1.1.0 0.0.0.255 any eq 80, reference it in a route-map match statement, set the next-hop to 192.168.2.1, and apply the route-map to interface GigabitEthernet0/1 with the ip policy route-map command.. The correct configuration uses an extended ACL to match both source subnet and destination TCP port 80, references it in a route-map, sets the next-hop, and applies the route-map inbound on the specified interface. This ensures only HTTP traffic from 10.1.1.0/24 arriving on GigabitEthernet0/1 is policy-routed, while other traffic follows normal routing.

Answer

Create a route-map with a match statement for IP address 10.1.1.0/24 and a set statement for interface GigabitEthernet0/2, then apply it globally with the ip local policy route-map command.

Answer

Create a standard ACL that permits 10.1.1.0 0.0.0.255, reference it in a route-map match statement, set the next-hop to 192.168.2.1, and apply the route-map to interface GigabitEthernet0/1 with the ip policy route-map command.

Answer

Create a route-map with a match statement for IP address 10.1.1.0/24 and a set statement for next-hop 192.168.2.1, then apply it to interface GigabitEthernet0/1 using the ip policy route-map command.

Question 14

A network engineer is troubleshooting a BGP routing issue on a Cisco IOS XE router. The router is configured with a route map that sets the local preference for routes learned from a specific neighbor. However, the engineer notices that the local preference is not being applied to routes received from that neighbor. Which BGP configuration command is most likely missing?

Accepted Answer

neighbor 10.1.1.1 route-map LOCAL-PREF in. To set local preference on routes learned from a specific BGP neighbor, a route map must be created that sets the local preference and then applied to that neighbor in the inbound direction. The correct command is neighbor route-map in. Without this, the route map is not applied, and local preference remains at the default value.

Answer

bgp default local-preference 200

Answer

neighbor 10.1.1.1 send-community

Answer

neighbor 10.1.1.1 soft-reconfiguration inbound

Question 15

A network engineer is troubleshooting a Cisco IOS XE router that is configured with a route map for policy-based routing (PBR). The route map is applied to the ingress interface with `ip policy route-map PBR`. The engineer wants to verify that the PBR is matching traffic and setting the next-hop correctly. Which command provides the most detailed information about PBR matches and actions?

Accepted Answer

debug ip policy. For detailed PBR troubleshooting, `debug ip policy` is the most informative command. It logs each packet's match against route map sequences and shows the set actions applied, such as next-hop or interface. While `show route-map` provides configuration and some counters, it lacks the per-packet detail. `show ip policy` only confirms attachment. Thus, the debug command is the correct choice for verifying matches and next-hop settings.

Answer

show route-map PBR

Answer

show ip policy

Answer

show ip route

Question 16

A network engineer is configuring a Cisco IOS XE router for MPLS L3VPN. The router is a PE device with a VRF named CUSTOMER. The engineer wants to redistribute routes from the VRF into MP-BGP so they can be advertised to a remote PE. The engineer has configured the VRF and assigned interfaces. Which command sequence correctly redistributes the connected routes from the VRF into BGP?

Accepted Answer

router bgp 65000
 address-family ipv4 vrf CUSTOMER
  redistribute connected. To advertise VRF routes via MP-BGP, you must redistribute them within the VRF address family under the BGP routing process. The address-family ipv4 vrf CUSTOMER context allows you to redistribute connected, static, or IGP routes from that VRF into BGP. These routes are then converted into VPNv4 prefixes with the appropriate route distinguisher and route target. Redistributing in the global BGP instance or in the VPNv4 address family does not work because those contexts do not have access to the VRF routing table.

Answer

router bgp 65000
 redistribute connected

Answer

router bgp 65000
 address-family ipv4 vrf CUSTOMER
  network 10.0.0.0 mask 255.255.255.0

Answer

router bgp 65000
 address-family vpnv4 unicast
  redistribute connected

Question 17

A service provider is deploying MPLS Traffic Engineering (TE) with RSVP-TE to ensure bandwidth guarantees for critical traffic. The network engineer has configured an MPLS TE tunnel on a Cisco IOS XE router. The tunnel must be able to signal an explicit path that includes a specific link with a reserved bandwidth of 50 Mbps. Which RSVP-TE object is used to carry the explicit route information in the Path message?

Accepted Answer

EXPLICIT_ROUTE object. In RSVP-TE, the EXPLICIT_ROUTE object (ERO) is used to specify the explicit path for a TE tunnel. It is included in the Path message and contains the list of hops that the tunnel must traverse. The SESSION object identifies the session, the RSVP_HOP object provides previous hop information, and the LABEL_REQUEST object requests label bindings. Only the EXPLICIT_ROUTE object carries the explicit route information needed to signal a path that includes a specific link.

Answer

LABEL_REQUEST object

Answer

RSVP_HOP object

Answer

SESSION object

Question 18

A network engineer is configuring route redistribution between EIGRP and OSPF on a Cisco IOS-XE router. The engineer wants to prevent routing loops and ensure that only specific EIGRP routes are redistributed into OSPF. Which combination of tools should the engineer use?

Accepted Answer

Use a route map with a prefix list to match specific routes, and set a tag on redistributed routes to prevent them from being redistributed back into EIGRP.. To control redistribution and prevent loops, a route map with a prefix list filters which EIGRP routes enter OSPF, while route tagging marks those routes so EIGRP can deny them if they are redistributed back. This combination is the most precise and scalable method. The other options either do not filter properly, break connectivity, or rely on mechanisms that do not prevent loops during mutual redistribution.

Answer

Configure OSPF as a stub area to prevent external routes from being injected, and redistribute only connected routes into EIGRP.

Answer

Use a distribute-list on the OSPF process to filter routes, and rely on OSPF's built-in loop prevention mechanisms.

Answer

Set the administrative distance of EIGRP to a lower value than OSPF, and use passive interfaces to control updates.

Question 19

A network engineer is configuring a GRE tunnel between two Cisco IOS XE routers, R1 and R2, to transport IPv6 traffic over an IPv4 network. The tunnel source is R1's GigabitEthernet0/0 interface (IPv4 address 10.1.1.1) and the tunnel destination is R2's GigabitEthernet0/0 interface (IPv4 address 10.2.2.2). The engineer configures the tunnel interface with IPv6 address 2001:DB8:1::1/64 and enables OSPFv3 on the tunnel interface. However, OSPFv3 adjacencies are not forming. What is the most likely cause?

Accepted Answer

The tunnel source and destination must be reachable via IPv4, and the tunnel interface must be up.. GRE tunnels require that the source and destination addresses are reachable via the transport network (IPv4 in this case). If the IPv4 network cannot route between the tunnel endpoints, the tunnel interface will be down, and no IPv6 traffic, including OSPFv3 hellos, will pass. The tunnel interface must be up and have the correct IPv6 address and OSPFv3 configuration.

Answer

The tunnel interface must be configured with the `tunnel mode gre ipv6` command.

Answer

OSPFv3 requires the tunnel interface to be in the same area as the physical interfaces.

Answer

The tunnel interface must have an IPv4 address configured for OSPFv3 to work.

Question 20

A network engineer is configuring a Cisco IOS XE router to act as an IPv6 DHCP server for a LAN segment. The router must provide IPv6 addresses and other configuration parameters to hosts. Which two tasks must the engineer perform to enable stateful DHCPv6 operation on the router? (Choose two.)

Accepted Answer

Configure an IPv6 DHCP pool with the address prefix and other parameters.. To enable stateful DHCPv6 on a Cisco IOS XE router, you must create a DHCPv6 pool that defines the address prefix and options, and then enable the DHCPv6 server on the interface with the ipv6 dhcp server command referencing that pool. These two steps allow the router to assign addresses and parameters to clients. The other options are either unrelated or would not contribute to server functionality.

Answer

Enable IPv6 unicast routing globally with the ipv6 unicast-routing command.

Answer

Configure a DHCPv6 relay destination on the interface pointing to itself.

Answer

Configure a static IPv6 address on the interface using the eui-64 keyword.