300-410 Practice Exam 55 — 20 Questions

Question 1

A network engineer is configuring an IPv6 First Hop Security feature on a Cisco Catalyst switch to prevent rogue devices from sending Router Advertisement messages with a prefix that conflicts with the legitimate prefix. The engineer wants to ensure that only authorized routers can advertise prefixes, while still allowing hosts to perform SLAAC. Which feature should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IPv6 RA Guard. The requirement is to prevent rogue devices from sending Router Advertisement messages with conflicting prefixes while allowing legitimate routers and SLAAC. IPv6 RA Guard is designed specifically to filter RA and Redirect messages on untrusted ports, ensuring only authorized routers can advertise. The other features address different threats such as source spoofing, rogue DHCPv6 servers, or ND cache exhaustion.

Answer

IPv6 Source Guard

Answer

IPv6 DHCP Guard

Answer

IPv6 Destination Guard

Question 2

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against a flood of OSPF hello packets. The engineer wants to ensure that OSPF hellos are rate-limited to 1000 packets per second (pps) with a burst of 2000 packets, while allowing all other traffic without policing. The engineer applies the following configuration:

class-map match-any OSPF_HELLO
  match access-group name OSPF_HELLO_ACL
!
policy-map COPP_POLICY
  class OSPF_HELLO
    police 1000 2000 conform-action transmit exceed-action drop
  class class-default
    police 1000000 2000000 conform-action transmit exceed-action drop
!
control-plane
  service-policy input COPP_POLICY

After applying the policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the OSPF_HELLO_ACL matches OSPF hello packets by permitting IP protocol 89 and the correct multicast destination address, and adjust the ACL if necessary.. OSPF hellos are multicast to 224.0.0.5 with IP protocol 89. If the ACL used in the class-map does not match these specifics, hellos are classified into class-default and may be dropped when the class-default policer is exceeded, causing adjacencies to flap. The engineer must verify the ACL matches protocol 89 and the correct multicast destination, and adjust it so hellos are policed by the dedicated class with a higher rate.

Answer

Increase the police rate for the OSPF_HELLO class to 5000 pps to accommodate normal OSPF hello traffic.

Answer

Modify the class-default policer to transmit all traffic without policing by using police 1000000 2000000 conform-action transmit exceed-action transmit.

Answer

Apply the CoPP policy to the control plane using the service-policy output command instead of input.

Question 3

A network administrator is configuring a Cisco IOS XE router to support MPLS L3VPN. The administrator needs to enable MPLS forwarding on an interface that connects to the service provider core. Which command should be applied to the interface?

Accepted Answer

mpls ip. The 'mpls ip' command is the standard way to enable MPLS forwarding on an interface in Cisco IOS XE. It allows the interface to forward labeled packets, which is required for MPLS L3VPN. The other commands either set global parameters or use deprecated syntax, and do not directly enable MPLS forwarding on the interface.

Answer

tag-switching ip

Answer

mpls label protocol ldp

Answer

mpls ldp router-id loopback0

Question 4

A network engineer is configuring a Cisco IOS XE router to send syslog messages to a remote server for security auditing. The engineer wants to ensure that the syslog messages are protected from eavesdropping and tampering. The router already has a CA trustpoint configured. Which command should the engineer use to enable secure syslog?

Accepted Answer

logging host 10.10.10.10 transport tls port 6514. The requirement is to protect syslog messages from eavesdropping and tampering, which necessitates encryption and integrity protection. Syslog over TLS (often called secure syslog) uses Transport Layer Security to encrypt and authenticate messages. The command 'logging host 10.10.10.10 transport tls port 6514' enables TLS transport, leveraging the existing CA trustpoint for certificate-based authentication. Other transport methods like UDP or plain TCP do not provide encryption. Therefore, the correct configuration is to use the 'tls' transport option.

Answer

logging host 10.10.10.10 transport tcp port 6514

Answer

logging host 10.10.10.10 transport udp port 514

Answer

logging host 10.10.10.10 transport tcp port 514

Question 5

A network administrator is troubleshooting a DMVPN Phase 3 hub-and-spoke deployment where the hub uses mGRE and spokes use mGRE. Spoke-to-spoke traffic works, but the administrator notices that the spokes are installing host routes for other spokes in their routing tables. Which DMVPN Phase 3 feature is responsible for adding these specific host routes?

Accepted Answer

NHRP shortcut on the spokes. In DMVPN Phase 3, the hub uses NHRP redirect to inform a spoke that a better path exists, and the spokes use NHRP shortcut to resolve the destination and install a host route for the peer tunnel address. Those host routes are what let the spoke forward traffic directly to another spoke. Without NHRP shortcut on the spokes, the redirect messages would not result in usable direct paths.

Answer

ip nhrp registration no-unique on the spokes

Answer

ip nhrp map multicast dynamic on the hub

Answer

NHRP redirect on the hub

Question 6

A network engineer is configuring EIGRP for IPv6 on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 (2001:DB8:1::1/64) and GigabitEthernet0/1 (2001:DB8:2::1/64). The engineer wants to enable EIGRP for IPv6 on both interfaces and ensure that the router forms adjacencies. Which configuration is required?

Accepted Answer

Enable IPv6 unicast routing globally, create an EIGRP for IPv6 routing process, and enable EIGRP on each interface with the ipv6 eigrp command.. EIGRP for IPv6 requires IPv6 unicast routing to be enabled globally, creation of an EIGRP for IPv6 routing process, and explicit enabling of EIGRP on each interface using the ipv6 eigrp command. Unlike IPv4 EIGRP, there is no network command; interfaces must be enabled individually. This ensures the router can form adjacencies and exchange IPv6 routing information.

Answer

Enable IPv6 unicast routing globally, configure an EIGRP for IPv6 routing process, and use the network command under the routing process to advertise the interfaces.

Answer

Enable IPv6 unicast routing globally, configure EIGRP for IPv6 with the no shutdown command under the routing process, and assign IPv6 addresses to interfaces.

Answer

Enable IPv6 unicast routing globally, configure EIGRP for IPv6, and enable EIGRP on interfaces using the ipv6 router eigrp command under each interface.

Question 7

A network engineer is configuring MPLS Layer 3 VPN on a Cisco IOS XE router. The engineer wants to enable the router to distribute VPNv4 prefixes to its PE peers. Which command must be configured under the BGP routing process to enable the address family?

Accepted Answer

address-family vpnv4. To enable the distribution of VPNv4 prefixes in MPLS L3VPN, the engineer must configure the address-family vpnv4 command under the BGP routing process. This enters the VPNv4 address family configuration mode, where neighbors can be activated and other parameters set. The other address families do not handle VPNv4 prefixes: ipv4 vrf is for VRF-specific routing, ipv4 unicast is for global IPv4, and vpnv6 is for IPv6 VPNs.

Answer

address-family ipv4 vrf

Answer

address-family ipv4 unicast

Answer

address-family vpnv6

Question 8

A network engineer is deploying a GET VPN solution across an MPLS L3VPN service provider network. The design requires that all group members use identical encryption keys and that the key server remain the single point of rekey distribution. The engineer must choose the protocol the key server uses to push rekey messages to group members. Which protocol should be configured for this purpose?

Accepted Answer

Group Domain of Interpretation (GDOI). GET VPN uses the Group Domain of Interpretation so that a key server can distribute a shared Group Security Association and push rekey messages to all group members. Members register with the key server, obtain the same keys and policies, and then encrypt traffic directly with one another over the provider network without building point-to-point tunnels. This preserves the any-to-any model and keeps rekeying centralized on the key server.

Answer

IKEv2 with a hub-and-spoke profile on the key server

Answer

IPsec SA negotiation using ISAKMP aggressive mode

Answer

NHRP with a next-hop server mapping

Question 9

A network engineer is implementing MPLS Layer 3 VPN on a Cisco IOS XE router. The engineer wants to ensure that customer routes are advertised with the correct route distinguisher (RD) and route target (RT) extended communities. Which BGP address family must be configured to exchange VPNv4 routes between PE routers?

Accepted Answer

address-family vpnv4 unicast. MPLS Layer 3 VPN uses BGP VPNv4 address family to exchange customer routes between PE routers. The VPNv4 address family carries the RD and RT extended communities that identify the VPN and control import/export. It must be activated on the PE-PE BGP session. The VRF address family is used for PE-CE routing and for assigning RDs and RTs, but not for exchanging VPNv4 routes.

Answer

address-family ipv4 vrf CUSTOMER

Answer

address-family ipv4 multicast

Answer

address-family ipv4 unicast

Question 10

A network administrator is troubleshooting a site-to-site IPsec VPN between two Cisco IOS routers. IKEv1 Phase 1 completes and the peer is authenticated, but the administrator sees that no IPsec SA is installed and interesting traffic is dropped. The administrator confirms the transform sets, ACLs, and pre-shared keys match on both sides. Which configuration element should the administrator verify next on both routers?

Accepted Answer

The Phase 2 proposal parameters, including encryption, hash, and PFS group. When IKE Phase 1 succeeds but no IPsec SA appears, the failure is almost always in the Phase 2 exchange. Both peers must agree on identical IPsec proposal parameters: encryption, integrity or hash, and the PFS Diffie-Hellman group if enabled. A single mismatch in any of these causes the responder to reject quick mode, leaving Phase 1 up while interesting traffic is dropped.

Answer

The crypto map sequence numbers and the ACL referenced by each map

Answer

The IKEv1 Phase 1 lifetime values on each peer

Answer

The routing table entries for the remote protected subnet

Question 11

A network engineer is configuring Policy-Based Routing (PBR) on a Cisco IOS XE router. The engineer wants to forward traffic matching a specific ACL to a next-hop IP address, but only if the next-hop is reachable. Which command should be used in the route map to specify the next-hop and enable tracking?

Accepted Answer

set ip next-hop verify-availability 10.1.1.1 1 track 1. To conditionally forward traffic based on next-hop reachability in PBR, the set ip next-hop verify-availability command is used. It references a tracking object that monitors the next-hop. If the track is up, the next-hop is used; if down, the route map is skipped, and normal routing applies. This provides the required conditional forwarding.

Answer

set ip next-hop 10.1.1.1

Answer

set ip default next-hop 10.1.1.1

Answer

set ip next-hop recursive 10.1.1.1

Question 12

A network engineer is troubleshooting an MPLS Layer 3 VPN on Cisco IOS XE routers. A customer edge (CE) router is not receiving routes from the provider edge (PE) router. The engineer suspects a VRF configuration issue. Which two commands should the engineer use to verify the VRF routing table and the BGP VPNv4 address family? (Choose two.)

Accepted Answer

show bgp vpnv4 unicast all. To troubleshoot MPLS L3VPN route propagation, the engineer must check both the VRF routing table and the BGP VPNv4 table. The `show ip route vrf CUSTOMER` command reveals whether routes are installed in the VRF, while `show bgp vpnv4 unicast all` shows the VPNv4 routes exchanged between PEs. Together, they help isolate whether the issue is with VRF configuration, route targets, or BGP VPNv4 peering.

Answer

show vrf detail

Answer

show ip bgp summary

Answer

show mpls ldp neighbor

Question 13

A network engineer is deploying a GET VPN solution using Cisco IOS routers. The key server must be configured to rekey group members. Which protocol does GET VPN use to distribute encryption keys and policies to group members?

Accepted Answer

Group Domain of Interpretation (GDOI). GET VPN uses the Group Domain of Interpretation (GDOI) protocol to distribute encryption keys and policies from the key server to group members. GDOI enables scalable group key management, allowing the key server to send rekey messages to all members. IKEv2 is for point-to-point VPNs, and the other options are not used for GET VPN key distribution.

Answer

Group Key Management Protocol (GKMP)

Answer

Multicast Group Management Protocol (MGMP)

Answer

Internet Key Exchange version 2 (IKEv2)

Question 14

A network engineer is deploying BGP on a Cisco IOS XE router. The router must advertise the network 10.10.0.0/16 to an external peer, but the engineer notices that the prefix is not being advertised even though the network command is configured. The routing table shows that 10.10.0.0/16 is present as two separate /24 routes via OSPF. What is the most likely cause?

Accepted Answer

The network command requires an exact match in the routing table.. BGP network statements require an exact match in the routing table to originate a prefix. The routing table contains only the more specific /24 routes, so the /16 is not advertised. To resolve this, the engineer must create a matching route, such as a static route to Null0, or use the aggregate-address command with the summary-only option. The other options do not address the fundamental requirement of an exact match.

Answer

The BGP router ID is not reachable, preventing advertisement.

Answer

The BGP neighbor is configured with a send-community attribute that filters the prefix.

Answer

The OSPF routes are not being redistributed into BGP.

Question 15

A network administrator is configuring a Cisco IOS router to use AAA authorization for administrative commands. The administrator wants to ensure that users are authorized for specific commands based on their user role. The TACACS+ server is configured with command authorization sets. Which AAA authorization method should the administrator configure to enforce command authorization?

Accepted Answer

aaa authorization commands 15 default group tacacs+ local. To enforce command authorization, the router must be configured to send authorization requests for each command entered by the user. The 'aaa authorization commands' command, specifying the privilege level (e.g., 15) and the method list (e.g., default) with TACACS+ as the first method, enables this functionality. The TACACS+ server must be configured with command sets that define which commands are permitted or denied. Other authorization methods like exec, network, or auth-proxy serve different purposes and do not provide per-command authorization.

Answer

aaa authorization auth-proxy default group tacacs+ local

Answer

aaa authorization network default group tacacs+ local

Answer

aaa authorization exec default group tacacs+ local

Question 16

A network engineer is deploying a GET VPN solution across an MPLS VPN WAN. The group members must encrypt traffic between any pair of sites without establishing point-to-point tunnels, and the key server must distribute a common encryption policy to all members. The engineer has configured the key server with a rekey policy but group members are not receiving rekeys. Which action must be taken on the key server to enable successful rekey transmission?

Accepted Answer

Enable unicast rekey on the key server so that rekeys are sent directly to each group member.. GET VPN key servers typically send rekeys using multicast to the group address. In networks that do not support multicast or where multicast is not enabled on the transport, group members will not receive rekeys. Enabling unicast rekey on the key server forces rekeys to be sent directly to each registered group member's unicast address, ensuring they receive the updated policy. This is a standard configuration adjustment for non-multicast underlays.

Answer

Change the key server to use a different group identity (GDOI group ID) that matches the members.

Answer

Configure the group members with the rekey retransmit timer set to a lower value.

Answer

Configure the key server to use IKEv2 for rekey authentication instead of IKEv1.

Question 17

A network administrator is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The administrator wants to ensure that uRPF is applied in strict mode on an interface that connects to an ISP. Which command correctly enables strict uRPF on the interface?

Accepted Answer

ip verify unicast source reachable-via rx. Strict uRPF is enabled with the command 'ip verify unicast source reachable-via rx', which ensures the source address is reachable via the same interface the packet arrived on. This is the correct choice for an ISP-facing interface to prevent spoofed source addresses.

Answer

ip verify unicast source reachable-via tx

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via any

Question 18

A network engineer is configuring a Cisco IOS XE router as a DHCPv6 server for a dual-stack network. The router must provide IPv6 addresses and other configuration parameters to clients on VLAN 20. The engineer has configured a DHCPv6 pool named POOL1 with the address prefix 2001:DB8:20::/64 and the DNS server 2001:DB8::53. The clients are not receiving IPv6 addresses. Which additional configuration is required on the router's VLAN 20 interface to ensure DHCPv6 clients can obtain addresses?

Accepted Answer

ipv6 dhcp server POOL1. To make a Cisco IOS XE router act as a DHCPv6 server on an interface, you must bind the DHCPv6 pool to that interface using the ipv6 dhcp server command. The pool configuration alone defines the parameters, but the interface must be explicitly enabled to serve DHCPv6. Without this command, the router will not listen for or respond to DHCPv6 client requests on VLAN 20. Therefore, the correct answer is the interface-level command that activates the server function.

Answer

ipv6 address dhcp

Answer

ipv6 nd managed-config-flag

Answer

ipv6 nd other-config-flag

Question 19

A network engineer is implementing BGP on a Cisco IOS XE router. The router is peering with an ISP and receives a full BGP table. The engineer wants to influence inbound traffic from the ISP by making a specific prefix more preferred. The engineer has configured a route map that sets the MED to 50 for the prefix 203.0.113.0/24 and applies it outbound to the ISP. However, the ISP still prefers a different path. Which BGP attribute should the engineer manipulate to influence inbound traffic more effectively?

Accepted Answer

AS_PATH. To influence inbound traffic from an ISP, the most effective method is to manipulate the AS_PATH attribute by prepending additional AS numbers. This makes the path appear longer and less preferred. MED is often not honored by ISPs because it is an optional attribute and is only considered between autonomous systems that agree to use it. LOCAL_PREF and WEIGHT are used for outbound traffic and are not advertised externally. ORIGIN is not typically used for this purpose.

Answer

WEIGHT

Answer

ORIGIN

Answer

LOCAL_PREF

Question 20

A network engineer is configuring VRF-lite on a Cisco IOS router to segment traffic for two customers. The engineer creates VRF CUSTA and assigns interface GigabitEthernet0/1 to it. The engineer then configures a static route within VRF CUSTA to reach 10.10.10.0/24 via next-hop 192.168.1.1. However, the route does not appear in the VRF CUSTA routing table. Which command is missing?

Accepted Answer

The `ip route vrf CUSTA 10.10.10.0 255.255.255.0 192.168.1.1` command must be configured in global configuration mode.. In VRF-lite, static routes for a VRF must be configured with the `ip route vrf <vrf-name>` command in global configuration mode. Without the `vrf` keyword, the route is placed in the global routing table instead of the VRF. The correct syntax ensures the route is installed in the VRF's routing table.

Answer

The `ip route vrf CUSTA 10.10.10.0 255.255.255.0 GigabitEthernet0/1` command must be used to specify the outgoing interface.

Answer

The `ip route 10.10.10.0 255.255.255.0 192.168.1.1` command must be configured under the VRF configuration mode.

Answer

The `ip route vrf CUSTA 10.10.10.0 255.255.255.0 192.168.1.1 global` command must be used to leak the route into the global table.