300-410 Practice Exam 56 — 20 Questions

Question 1

A network engineer is configuring a Cisco IOS router to run OSPFv3 for IPv6. The router must form an adjacency with a neighbor on a broadcast network. Which command is required to enable OSPFv3 on an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 on an interface for IPv6, the command `ipv6 ospf 1 area 0` is used in interface configuration mode. This activates OSPFv3 on the interface and associates it with the specified area. The global command `ipv6 router ospf 1` is also needed to configure the router ID and other parameters, but the interface-level command is essential for adjacency formation.

Answer

ospfv3 1 ipv6 area 0

Answer

ipv6 ospf area 0

Answer

ipv6 router ospf 1

Question 2

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent through the tunnel, while other traffic is sent unencrypted. Which configuration element is required to define the interesting traffic?

Accepted Answer

access-list. In Cisco IOS IPsec configuration, an access list (ACL) is used to define interesting traffic that should be encrypted and sent through the VPN tunnel. The ACL specifies the source and destination subnets. The crypto map then references this ACL to apply IPsec to matching traffic. Other components like transform set and ISAKMP policy handle encryption algorithms and key exchange, but not traffic selection.

Answer

transform set

Answer

crypto map

Answer

ISAKMP policy

Question 3

A network engineer is configuring a Cisco IOS XE router to mitigate spoofed source addresses on a WAN-facing interface using Unicast Reverse Path Forwarding. The WAN provider uses asymmetric routing, where return traffic from the provider occasionally arrives on a different interface than the one used for outbound traffic. The engineer wants to avoid dropping legitimate packets while still providing anti-spoofing protection. Which uRPF mode should the engineer configure on the WAN interface?

Accepted Answer

Loose mode. Loose mode verifies that the source address exists in the routing table without requiring the packet to arrive on the same interface as the reverse route. This allows asymmetric traffic to pass while still dropping packets with completely unknown source addresses, providing useful anti-spoofing protection. Strict and feasible path modes would drop legitimate asymmetric traffic, and VRF-aware mode does not change the fundamental same-interface requirement.

Answer

Strict mode

Answer

VRF-aware strict mode

Answer

Feasible path mode

Question 4

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive control-plane traffic. After applying the CoPP policy, the administrator notices that OSPF adjacencies are flapping and that SNMP polling from the management station is failing. The administrator wants to correct the CoPP policy without disabling protection entirely. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Increase the rate limit or mark the OSPF and SNMP traffic as conforming in the class maps.. CoPP failures for specific protocols usually stem from either incorrect classification or insufficient rate limits. Verifying that class maps match OSPF and SNMP traffic ensures they are placed in the correct class, and increasing the rate limit or adjusting the conform action for those classes allows legitimate traffic to pass. Together these correct the symptoms while preserving control-plane protection.

Answer

Apply the CoPP policy to all interfaces instead of the control plane.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs instead.

Answer

Disable CEF switching on the router to reduce control-plane load.

Question 5

A network engineer is troubleshooting a flapping OSPFv2 adjacency between two Cisco IOS-XE routers on a broadcast segment. The log shows repeated %OSPF-5-ADJCHG messages with reason 'Dead timer expired'. The engineer confirms that both routers are in Area 0, have identical hello/dead intervals, and are not configured with authentication. Which action most likely resolves the issue?

Accepted Answer

Check for a Layer 2 loop or unidirectional link on the segment, because hellos are being lost in one direction and the dead timer expires.. The repeated 'Dead timer expired' indicates that the router stopped receiving hellos from its neighbor within the dead interval. Since authentication, area, and timers are correct, the issue is at Layer 2—likely a unidirectional link or loop causing hello loss. Checking Layer 2 and interface counters is the correct troubleshooting step. Other options address issues that would produce different symptoms, such as Init or 2-Way states, not a dead timer expiration.

Answer

Verify that the OSPF network type matches on both interfaces; a mismatch between broadcast and point-to-point prevents hellos from being processed correctly.

Answer

Confirm that the OSPF priority is set to 0 on both interfaces, because a priority of 0 prevents the router from sending hellos on broadcast networks.

Answer

Ensure that both routers have the same OSPF router ID, as duplicate router IDs cause the adjacency to continuously reset.

Question 6

A network engineer is deploying GET VPN across an MPLS L3VPN service provider network. The key server is reachable by all group members, and the engineer wants to avoid rekeying storms when many group members reboot simultaneously after a power outage. Which mechanism should the engineer configure on the key server to spread rekey retransmissions over a period of time?

Accepted Answer

Configure the key server with a rekey retransmit interval and a retransmit limit, and enable the rekey acknowledgment feature so members request unicast retransmissions.. The key server in GET VPN distributes the group key via multicast and then uses reliable rekey retransmission with acknowledgment to unicast the rekey to members that did not receive it. Configuring a retransmit interval and retransmit limit spreads those unicast retransmissions over time, so a large number of members rebooting simultaneously do not overload the key server. This preserves key synchronization across the group without disabling the reliability mechanism that guarantees delivery.

Answer

Configure the key server with a rekey retransmit interval and disable the rekey acknowledgment, forcing members to pull rekeys at randomized intervals.

Answer

Configure the group members with a longer registration timeout so they wait longer before contacting the key server after reboot.

Answer

Configure the key server to use a shorter rekey lifetime so that keys expire quickly and members are forced to re-register frequently.

Question 7

A network engineer is configuring a Cisco IOS XE router to act as a DHCP relay agent. The router receives DHCP discover messages on interface GigabitEthernet0/1 and must forward them to a DHCP server at 10.1.1.100. The engineer configures the command 'ip helper-address 10.1.1.100' on GigabitEthernet0/1. However, the DHCP server is not receiving the requests. Which additional configuration is required to ensure that DHCP relay works correctly?

Accepted Answer

Ensure that the interface facing the DHCP server has an IP address and that routing is configured to reach 10.1.1.100.. The DHCP relay agent uses the 'ip helper-address' command to forward broadcast DHCP requests to a unicast address. However, the router must have a valid route to that unicast address. If the interface toward the DHCP server is not configured with an IP address or is down, or if there is no route to the server, the relayed packets cannot be sent. Therefore, ensuring IP connectivity to the DHCP server is essential. The other options are either default behaviors or optional features not required for basic relay operation.

Answer

Configure 'ip forward-protocol udp 67' globally.

Answer

Configure 'ip dhcp relay information option' globally.

Answer

Enable 'service dhcp' globally on the router.

Question 8

A network engineer is troubleshooting a Cisco IOS XE router running OSPFv2. The router is an ABR between Area 0 and Area 1. Area 1 is configured as a Not-So-Stubby Area (NSSA). The engineer notices that a Type-7 LSA originated by an ASBR in Area 1 is not being translated into a Type-5 LSA by the ABR. Which condition would prevent the ABR from performing Type-7 to Type-5 translation?

Accepted Answer

The Type-7 LSA has the P-bit (Propagate bit) cleared, indicating that the LSA should not be translated by the ABR.. Type-7 to Type-5 translation in an NSSA depends on the P-bit in the Type-7 LSA. If the P-bit is cleared, the ABR will not translate the LSA into a Type-5 LSA, preventing the external route from being propagated into the backbone area. This bit is set by the originating ASBR and can be cleared in specific scenarios.

Answer

The ABR has a static route to the NSSA ASBR's loopback interface but no OSPF adjacency with the ASBR.

Answer

The ABR is not configured with the `area 1 nssa translate type7 always` command and there is another ABR with a higher router ID in the NSSA.

Answer

The forwarding address in the Type-7 LSA is set to 0.0.0.0 and the ABR has no route to the ASBR's router ID.

Question 9

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that uRPF is applied correctly and does not drop legitimate traffic. Which uRPF mode should the engineer use to allow asymmetric routing while still providing some protection?

Accepted Answer

Loose mode. uRPF has two primary modes: strict and loose. Strict mode requires the source IP to be reachable via the same interface the packet arrived on, which breaks asymmetric routing. Loose mode only requires the source IP to be present in the routing table via any interface, allowing asymmetric routing while still dropping packets with spoofed sources not in the routing table. Therefore, loose mode is the appropriate choice to allow asymmetric routing while providing spoofing protection.

Answer

VRF mode

Answer

Feasible path mode

Answer

Strict mode

Question 10

A network engineer is troubleshooting a Cisco IOS XE router that is configured for IPv6 First Hop Security on a user VLAN. Hosts report intermittent connectivity, and the engineer suspects that IPv6 Router Advertisement (RA) messages from an unauthorized device are being accepted. Which feature should be enabled to ensure that only RAs from the legitimate router are processed by hosts?

Accepted Answer

IPv6 RA Guard. RA Guard is the IPv6 First Hop Security feature that filters Router Advertisement and Redirect messages on a per-port basis. When configured to block RAs on host-facing ports, it ensures hosts only accept RAs from the authorized router, mitigating rogue RA attacks. The other features address different threats such as rogue DHCPv6 servers or spoofed source addresses.

Answer

IPv6 Source Guard

Answer

IPv6 Destination Guard

Answer

IPv6 DHCPv6 Guard

Question 11

A network engineer is configuring a Cisco IOS router to run OSPFv3 for IPv6. The router must form an adjacency with a neighbor on a broadcast network. Which command is required to enable OSPFv3 on an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

router lisp. On Cisco IOS XE, LISP is enabled by entering the router lisp global configuration command. This mode allows you to configure the router as an ITR, ETR, or both, and to define EID-to-RLOC mappings and map-resolvers. The other commands are either invalid in this context or belong to different platforms, so they would not enable LISP functionality.

Answer

lisp itr enable

Answer

feature lisp

Answer

ipv4 lisp

Question 12

A network engineer is deploying a site-to-site VPN between two Cisco IOS routers. The security policy requires that the peer identities be authenticated with certificates issued by an internal CA, and that the two peers negotiate a fresh keying channel for each new IKEv2 SA without relying on aggressive-mode pre-shared keys. Which IKEv2 configuration element must be present on both routers to satisfy the certificate-based authentication requirement?

Accepted Answer

crypto ikev2 profile with authentication remote rsa-sig and authentication local rsa-sig. Certificate-based IKEv2 authentication requires the IKEv2 profile to reference a PKI trustpoint and to specify rsa-sig for both local and remote authentication. The trustpoint supplies the CA chain and the router's own identity certificate, and rsa-sig makes the router present and verify X.509 signatures during the IKE_AUTH exchange. Pre-shared-key constructs, whether IKEv1 policies or IKEv2 keyrings, cannot meet a policy that mandates CA-issued certificates.

Answer

crypto isakmp policy with authentication pre-share and a matching keyring

Answer

crypto pki server with grant auto and a registered local RSA keypair

Answer

crypto ikev2 keyring with a peer entry containing an RSA public key

Question 13

A network engineer is deploying GET VPN with Cisco IOS routers to provide any-to-any encrypted communication over a private MPLS WAN. The design requires that a router joining the group automatically receives the current group security policy from the group controller without any manual pre-shared key configuration on the member. Which protocol should the engineer configure to dynamically distribute the group encryption keys from the key server to the group members?

Accepted Answer

GDOI. GET VPN relies on GDOI for group key management. The key server (group controller/key server) distributes the group security policy and encryption keys to registered group members via rekey messages, enabling scalable any-to-any encryption over a private WAN without point-to-point tunnels. GDOI is the protocol that dynamically distributes the group encryption keys, satisfying the requirement for automatic key delivery without manual pre-shared key configuration on each member.

Answer

IKEv2

Answer

ISAKMP

Answer

NHRP

Question 14

A network engineer is configuring MPLS Traffic Engineering (TE) with RSVP-TE on a Cisco IOS XE router. The engineer wants to establish a TE tunnel from Router A to Router D. The path must be explicitly defined to go through Router B and then Router C. The engineer has configured the tunnel interface with the destination and an explicit path. However, the tunnel is not coming up. Which command is required to enable RSVP-TE on the core interfaces of Router A, B, C, and D?

Accepted Answer

ip rsvp bandwidth. For RSVP-TE to signal a TE tunnel, RSVP must be enabled on every interface along the path. This is done with the ip rsvp bandwidth command, which also allocates bandwidth for reservations. While global MPLS TE commands and tunnel interface configuration are necessary, they do not activate RSVP on the physical links. The tunnel will remain down if RSVP is not enabled on the core interfaces. Therefore, the correct answer is the interface-level command that enables RSVP and sets the reservable bandwidth.

Answer

mpls ldp router-id Loopback0 force

Answer

mpls traffic-eng tunnels

Answer

mpls traffic-eng tunnel-te 1

Question 15

What is the default administrative distance for a route learned via the Intermediate System-to-Intermediate System (IS-IS) protocol?

Accepted Answer

115. IS-IS routes have a default administrative distance of 115.

Answer

110

Answer

120

Answer

90

Question 16

A network engineer is configuring a Cisco IOS router to run OSPFv3 for IPv6. The router must form an adjacency with a neighbor on a broadcast network. Which command is required to enable OSPFv3 on an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

mpls ip. To enable MPLS forwarding on a Cisco IOS XE router interface, the mpls ip command must be configured. This command instructs the interface to process MPLS labels and forward labeled packets. On a PE router, the core-facing interface must have mpls ip enabled to send and receive MPLS traffic for VPNs. While other MPLS-related commands configure label distribution or router IDs, they do not enable the actual forwarding of MPLS packets on the interface.

Answer

mpls label protocol ldp

Answer

mpls ldp router-id Loopback0

Answer

mpls ldp discovery transport-address interface

Question 17

A network engineer is deploying a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP, and wants spokes to reach other spokes directly without routing through the hub for every packet. The engineer must configure the hub so that it advertises a default route to the spokes while still allowing spoke-to-spoke shortcut tunnels. (Choose two.)

Accepted Answer

Enable NHRP redirect on the hub so it can inform spokes of a better path to the destination.. DMVPN Phase 3 achieves spoke-to-spoke shortcuts through two cooperating NHRP features. The hub enables NHRP redirect so it can tell a spoke that a better path exists, and each spoke enables NHRP shortcut so it can resolve the destination and install a temporary direct route. Together these allow direct tunnels while the hub still advertises a summarizable default route to all spokes.

Answer

Disable split horizon on the hub's mGRE interface to allow spoke routes to be re-advertised.

Answer

Configure the hub with a default route pointing to the provider and redistribute it into the routing protocol with a metric that spokes accept.

Answer

Configure the spokes with a static route for every remote spoke subnet pointing at the hub.

Question 18

A network administrator is configuring a Cisco IOS router to provide first-hop redundancy for a group of hosts on VLAN 10. The design requires that the virtual IP address be 10.1.10.1 and that the router with the highest priority become the active gateway. The administrator has configured the interface with 'standby 10 ip 10.1.10.1' and 'standby 10 priority 150'. Which additional command is required to ensure that the router preempts and becomes the active gateway if it reboots?

Accepted Answer

standby 10 preempt. In HSRP, preemption must be explicitly enabled with the 'standby preempt' command. Without it, a router with a higher priority that comes online after the active router is already elected will not become active. The priority alone does not trigger preemption. Therefore, to ensure the router becomes active after a reboot, the preempt command is necessary.

Answer

standby 10 authentication md5 key-string cisco

Answer

standby 10 timers 1 3

Answer

standby 10 track 1 decrement 20

Question 19

A network engineer is configuring a Cisco IOS router to run OSPFv3 for IPv6. The router must form an adjacency with a neighbor on a broadcast network. Which command is required to enable OSPFv3 on an interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NHRP redirect and NHRP shortcut. DMVPN Phase 3 uses NHRP redirect on the hub and NHRP shortcut on the spokes to enable direct spoke-to-spoke tunnels. Redirect informs spokes of a better path, and shortcut allows them to establish direct tunnels. Both are required to achieve the desired traffic flow without traversing the hub.

Answer

NHRP shortcut only

Answer

NHRP redirect only

Answer

Multicast NHRP mapping

Question 20

A network engineer is troubleshooting a Cisco IOS FlexVPN IKEv2 hub that terminates many spokes using a single IKEv2 profile. A new spoke fails to complete IKEv2 authentication even though the same pre-shared key is configured on both peers. The hub logs show the failure occurs during IKE_AUTH. The spoke is not sending a certificate and there is no local AAA authentication configured on the hub for IKEv2. Which configuration change on the hub is most likely to resolve the authentication failure?

Accepted Answer

Add the spoke's identity to the IKEv2 keyring as a peer entry with the matching pre-shared key. Cisco IOS IKEv2 pre-shared key authentication relies on the IKEv2 keyring to look up the key associated with the peer's identity. The IKEv2 profile references the keyring, but the key itself must exist in a peer or subnet entry that matches the spoke. Because no AAA authentication is configured, the keyring is the only source of the key, so adding the spoke identity with the matching key fixes the IKE_AUTH failure.

Answer

Configure a local AAA authorization list on the IKEv2 profile to authorize the spoke's group policy

Answer

Bind the IKEv2 profile to a virtual template interface used for the spoke's virtual access interface

Answer

Enable RSA signature authentication on the IKEv2 profile so the hub can validate the spoke without a keyring