300-410 Practice Exam 57 — 20 Questions

Question 1

A network engineer is implementing a DMVPN Phase 3 network with NHRP and mGRE on the hub. The design requires that spoke-to-spoke traffic be able to bypass the hub after resolution, and that the hub not be required to advertise specific routes to the spokes. Which two configuration elements are required to achieve shortcut switching and default-route-only behavior on the spokes? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the hub to summarize or advertise a default route to the spokes, and configure the spokes to use the hub as their default gateway.. DMVPN Phase 3 combines a hub-advertised default route with NHRP redirect and shortcut switching. The spokes point their default route at the hub, so unknown destinations initially go through the hub. When the hub sees traffic that could take a better path, NHRP redirect tells the source spoke to resolve the destination, and NHRP shortcut installs a direct route. This yields small spoke routing tables plus optimized spoke-to-spoke paths.

Answer

Disable NHRP shortcut on the spokes so they always forward through the hub first.

Answer

Configure the spokes with a static NHRP map for every other spoke in the topology.

Answer

Configure the hub with a route map that tags the default route so spokes prefer the hub path over shortcuts.

Question 2

A network administrator is setting up a site-to-site VPN between two Cisco IOS routers and wants to use IKEv2 with certificate-based authentication. The administrator has already installed the identity certificate and the CA certificate on both routers. Which additional configuration is required on each router so that IKEv2 can validate the peer's certificate during the IKE_AUTH exchange?

Accepted Answer

Reference the PKI trustpoint in the IKEv2 profile using the pki trustpoint command so the router knows which CA to use for validation.. IKEv2 certificate authentication requires the router to select a trustpoint that identifies its own certificate and the CA chain used to validate the peer. The pki trustpoint command under the IKEv2 profile provides that binding. With the trustpoint referenced, the router can present its identity certificate and verify the peer's certificate during IKE_AUTH, completing authentication even though the certificates were already installed.

Answer

Configure a pre-shared key on both routers as a fallback in case certificate validation fails.

Answer

Configure the IKEv2 profile with the authentication local rsa-sig command only, without referencing a trustpoint.

Answer

Enable the crypto pki server on both routers so each can issue certificates to the other.

Question 3

A network engineer is configuring a Cisco IOS XE router to act as a Dynamic Host Configuration Protocol (DHCP) client on its WAN interface. The service provider requires the router to send a specific client identifier in its DHCP requests. Which command accomplishes this?

Accepted Answer

ip dhcp client client-id <string>. The ip dhcp client client-id command allows the router to send a custom client identifier in its DHCP requests, which the service provider can use for lease assignment. The other commands set different DHCP options, such as hostname, class identifier, or requested options, and do not fulfill the requirement for a specific client identifier.

Answer

ip dhcp client class-id <string>

Answer

ip dhcp client request <option>

Answer

ip dhcp client hostname <name>

Question 4

A network engineer is troubleshooting an OSPFv3 network. Router R1 is an ABR connected to Area 0 and Area 1. Area 1 is configured as a totally stubby area. R1 is not injecting a default route into Area 1, and routers in Area 1 cannot reach external destinations. Which command should the engineer verify on R1 to ensure that a default route is generated into Area 1?

Accepted Answer

`area 1 stub no-summary` under the OSPFv3 process.. In OSPFv3, a totally stubby area is configured on the ABR with the `area <area-id> stub no-summary` command. This command blocks type 3 summary LSAs and causes the ABR to inject a default route (inter-area-prefix LSA) into the area. Without it, routers in the area have no default route and cannot reach external networks. The engineer should verify that this command is present on R1.

Answer

`summary-address` under the OSPFv3 process.

Answer

`default-information originate` under the OSPFv3 process.

Answer

`area 1 nssa no-summary` under the OSPFv3 process.

Question 5

A network engineer is configuring a Cisco IOS XE router to authenticate administrative SSH users against a TACACS+ server. The engineer wants to ensure that if the TACACS+ server is unreachable, a locally configured fallback account can still be used to log in. The engineer also wants to ensure that the fallback account is not used when the TACACS+ server is reachable but rejects the credentials. Which AAA configuration should the engineer apply?

Accepted Answer

aaa authentication login default group tacacs+ local. The method list order determines fallback behavior. Placing group tacacs+ before local ensures TACACS+ is tried first, and local is used only when the server is unreachable. If the server rejects credentials, the local method is not attempted, which satisfies both requirements. The other options either reverse the order, allow unauthenticated access, or use the enable password, none of which meet the stated goals.

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Question 6

A network engineer is configuring policy-based routing (PBR) on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 (10.1.1.1/24) and GigabitEthernet0/1 (10.2.2.1/24). The engineer wants traffic from the 10.1.1.0/24 subnet destined to 192.168.1.0/24 to be forwarded out GigabitEthernet0/1 instead of following the routing table, which points to GigabitEthernet0/0. Which configuration sequence correctly implements this requirement?

Accepted Answer

Create a route map that matches the source subnet and sets the next-hop to 10.2.2.2, then apply it to interface GigabitEthernet0/0 with the ip policy route-map command.. Policy-based routing allows the engineer to override the destination-based routing table by matching source addresses and setting a next-hop. The route map must be applied inbound on the interface where traffic enters the router. The set next-hop must point to a device reachable via the desired egress interface. This ensures only the specified source subnet is policy-routed, while other traffic follows normal routing.

Answer

Create an access list that permits the source subnet, apply it to interface GigabitEthernet0/1 with the ip access-group command, and set the default gateway to 10.2.2.2.

Answer

Configure a static route for 192.168.1.0/24 pointing to 10.2.2.2 with a lower administrative distance, and redistribute it into the routing protocol.

Answer

Enable PBR globally with the ip policy route-map command in global configuration mode, and reference a route map that sets the interface to GigabitEthernet0/1.

Question 7

Which of the following protocols has the lowest default administrative distance on a Cisco router?

Accepted Answer

Connected. Connected routes have an AD of 0, which is the lowest. Static routes are 1, eBGP is 20, EIGRP internal is 90.

Answer

eBGP

Answer

OSPF

Answer

EIGRP internal

Question 8

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. The hub router (Hub1) has a public IP of 203.0.113.1 and is configured with `tunnel mode gre multipoint`. Spoke routers are behind NAT devices. Spoke1 cannot establish a direct spoke-to-spoke tunnel with Spoke2, although both can reach the hub. Which technology must be enabled on the hub to allow spoke-to-spoke direct tunnels in this scenario?

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to notify spokes of a better path to another spoke. When Spoke1 sends traffic to Spoke2 via the hub, the hub sends an NHRP redirect, and Spoke1 then initiates a direct tunnel using NHRP shortcut. This is critical when spokes are behind NAT, as the hub facilitates the initial resolution and redirect.

Answer

NHRP shortcut

Answer

Multicast routing

Answer

IPsec tunnel protection

Question 9

A network engineer is configuring a Cisco IOS XE router as a Dynamic Host Configuration Protocol (DHCP) server for a guest wireless subnet. The router must dynamically allocate addresses from the 192.168.50.0/24 pool, but the first 30 addresses must be reserved for static assignment to access points and controllers. Which command must be issued to prevent the DHCP server from offering those addresses?

Accepted Answer

ip dhcp excluded-address 192.168.50.1 192.168.50.30. The ip dhcp excluded-address command with a start and end address prevents the Cisco IOS XE DHCP server from offering that range from any pool. This correctly reserves the first 30 addresses for static assignment while allowing the rest of the /24 to be leased dynamically. Other commands either restrict the pool incorrectly, introduce invalid syntax, or create static bindings instead of exclusions.

Answer

ip dhcp pool GUEST
 network 192.168.50.0 255.255.255.224

Answer

ip dhcp excluded-address 192.168.50.1 192.168.50.30 255.255.255.0

Answer

ip dhcp pool GUEST
 address 192.168.50.1 192.168.50.30

Question 10

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The router has two interfaces: GigabitEthernet0/0 connecting to an ISP (untrusted) and GigabitEthernet0/1 connecting to the internal network. The engineer wants to ensure that uRPF is applied only to traffic entering from the ISP. Which configuration mode and command should be used?

Accepted Answer

Interface configuration mode on GigabitEthernet0/0, using 'ip verify unicast source reachable-via rx'.. Strict uRPF is configured on the ingress interface facing the untrusted network using the 'ip verify unicast source reachable-via rx' command. This ensures that the source IP address of incoming packets is reachable via the same interface, effectively dropping spoofed packets. Applying it to the ISP-facing interface (GigabitEthernet0/0) meets the requirement of filtering traffic entering from the ISP.

Answer

Global configuration mode, using 'ip verify unicast source reachable-via any'.

Answer

Interface configuration mode on GigabitEthernet0/1, using 'ip verify unicast source reachable-via rx'.

Answer

Interface configuration mode on GigabitEthernet0/0, using 'ip verify unicast source reachable-via any'.

Question 11

A network engineer is troubleshooting a DMVPN Phase 3 deployment on a Cisco IOS XE hub. Spokes use NHRP to register with the hub and have working mGRE tunnels to the hub. The design requires that spoke-to-spoke traffic be sent directly between spokes without transiting the hub's data path. The engineer observes that all spoke-to-spoke packets still traverse the hub even though spoke registration and routing are correct. Which configuration change on the hub is required to enable direct spoke-to-spoke forwarding?

Accepted Answer

Configure ip nhrp redirect on the hub so the hub can inform the source spoke that a better path exists, triggering an NHRP resolution for the destination spoke.. DMVPN Phase 3 achieves direct spoke-to-spoke forwarding by combining hub-side NHRP redirect with spoke-side NHRP shortcut. When a spoke sends traffic through the hub, the hub issues an NHRP redirect telling the source spoke a better path exists. The spoke then resolves the destination's NBMA address and installs a shortcut route, allowing direct forwarding. Without the hub redirect, spokes continue to hairpin traffic through the hub.

Answer

Configure ip nhrp shortcut on the hub so the hub can cache the destination spoke's NBMA mapping and forward directly.

Answer

Configure ip nhrp map multicast dynamic on the hub so the hub can dynamically learn the NBMA addresses of all registering spokes.

Answer

Configure no ip next-hop-self eigrp under the tunnel interface's routing process so the hub does not rewrite the next hop for EIGRP routes.

Question 12

A network engineer is configuring a Cisco IOS router as a DHCP relay agent. The router's interface GigabitEthernet0/0 is connected to a client subnet, and the DHCP server is located at 10.1.1.100. The engineer wants the router to forward DHCP requests from clients to the server and ensure that the server can assign addresses from the correct pool. Which command is required on the router?

Accepted Answer

`ip helper-address 10.1.1.100` on interface GigabitEthernet0/0. To configure a Cisco IOS router as a DHCP relay agent, the `ip helper-address` command must be applied on the interface facing the DHCP clients. This command forwards DHCP broadcast requests to the specified DHCP server, allowing the server to assign addresses from the correct pool based on the incoming interface's IP address. Without this command, DHCP requests would not reach the server, and clients would not obtain IP addresses.

Answer

`ip dhcp relay information option` globally

Answer

`ip forward-protocol udp 67` on interface GigabitEthernet0/0

Answer

`ip dhcp pool CLIENT` and `network 192.168.1.0 /24`

Question 13

A network engineer is configuring a GRE tunnel between two Cisco IOS-XE routers to transport multicast traffic. The engineer notices that multicast packets are not being forwarded through the tunnel. Which action should the engineer take to enable multicast over the GRE tunnel?

Accepted Answer

Enable IP multicast routing globally and configure PIM on the tunnel interface and the physical interface.. To transport multicast over a GRE tunnel, multicast routing must be enabled globally, and PIM must be configured on both the tunnel interface and the physical interface. This allows the router to forward multicast packets into the tunnel and out the physical interface. The other options either misconfigure PIM, use an unnecessary tunnel mode, or address an unrelated MTU issue.

Answer

Increase the tunnel MTU to accommodate multicast packets, as fragmentation prevents multicast forwarding.

Answer

Configure the tunnel mode to gre multipoint to support multicast.

Answer

Set the tunnel interface to ip pim sparse-dense-mode and enable ip multicast-routing on the physical interface only.

Question 14

A network administrator is troubleshooting a DMVPN Phase 3 network. Spokes register with the hub, and routing adjacencies are up. However, spoke-to-spoke traffic is not taking the optimal path; it still goes through the hub. The hub is configured with `ip nhrp redirect` and `ip nhrp map multicast dynamic`. The administrator verifies that the spokes have `ip nhrp shortcut` configured. What is the most likely cause?

Accepted Answer

The routing protocol is not advertising specific routes to the spokes.. In DMVPN Phase 3, the hub uses `ip nhrp redirect` to inform spokes of a better path, but spokes also need a specific route to the destination to trigger NHRP resolution. If the hub only advertises a default route or summary, spokes lack the specific route and continue forwarding through the hub. Advertising specific routes from the hub enables spokes to resolve next hops and build direct tunnels.

Answer

The spokes are not configured with `ip nhrp redirect`.

Answer

The hub is not configured with `ip nhrp summary-map`.

Answer

The spokes are not configured with `ip nhrp network-id`.

Question 15

An engineer configures OSPFv2 with a virtual link to connect a non-backbone area to area 0. The virtual link is not coming up, and routes from the non-backbone area are not being advertised into area 0. Which is the most likely explanation?

Accepted Answer

The transit area is a stub area.. In OSPF, virtual links cannot be configured through stub areas. If the transit area is a stub area, the virtual link will not function correctly, and routes from the non-backbone area will not be advertised into area 0. Even if the virtual link appears to be up (e.g., due to misconfiguration or software bug), route propagation is blocked because stub areas do not allow virtual links or type 5 LSAs. Therefore, the most likely explanation is that the transit area is a stub area.

Answer

The virtual link is configured only on one router.

Answer

The OSPF process is configured with 'no-virtual-link' command.

Answer

The router IDs are not reachable via the transit area.

Question 16

Which two OSPF network types default to a hello interval of 30 seconds and a dead interval of 120 seconds on Cisco IOS? (Choose two.)

Accepted Answer

Non-Broadcast (NBMA). On Cisco IOS, both the NBMA (Non-Broadcast Multi-Access) and point-to-multipoint OSPF network types default to a hello interval of 30 seconds and a dead interval of 120 seconds. Broadcast and point-to-point networks use 10 and 40 seconds, respectively. Therefore, both options C and D are correct.

Answer

Broadcast

Answer

Point-to-point

Question 17

A network engineer runs the following command on Router R1:

R1# show ip route vrf BLUE

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
C        10.1.2.0/24 is directly connected, GigabitEthernet0/1
O        10.2.0.0/16 [110/20] via 10.1.1.2, 00:00:15, GigabitEthernet0/0

Based on this output, what is the problem?

Accepted Answer

The output is normal; no problem is indicated.. The output shows a normal VRF routing table. It contains two directly connected routes (10.1.1.0/24 and 10.1.2.0/24) and one OSPF route (10.2.0.0/16) via next hop 10.1.1.2, which is reachable through GigabitEthernet0/0. The route age of 00:00:15 indicates the OSPF route was installed 15 seconds ago, but that alone is not evidence of a flap; a route can be recently installed after an adjacency forms or after a normal topology change. The absence of a default route is not inherently a problem. Therefore, no problem is indicated by this output.

Answer

The OSPF route 10.2.0.0/16 has a next hop of 10.1.1.2, which is unreachable.

Answer

The VRF BLUE has no default route, which is a problem.

Answer

The connected routes are not in the routing table.

Question 18

EIGRP network with routers R1, R2, R3. R1 has:
router eigrp 100
 network 10.0.0.0
R2 has:
router eigrp 100
 network 10.0.0.0
R3 has:
router eigrp 100
 network 10.0.0.0
R1 shows:
R1# show ip eigrp topology 10.1.1.0/24
EIGRP-IPv4 Topology Entry for 10.1.1.0/24
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 128256
  Routing Descriptor Blocks:
  10.2.1.2 (Serial0/0/0), from 10.2.1.2, Send flag is 0x0
      Composite metric is (128256/156160), Route is Internal
  10.3.1.3 (Serial0/0/1), from 10.3.1.3, Send flag is 0x0
      Composite metric is (156160/128256), Route is Internal
R1# show ip route 10.1.1.0
Routing entry for 10.1.1.0/24
  Known via "eigrp 100", distance 90, metric 128256
  Last update from 10.2.1.2 on Serial0/0/0
An engineer expected R1 to use the path via 10.3.1.3 because it appears in the topology table, but R1 is using the path via 10.2.1.2. What is the reason?

Accepted Answer

The path with higher FD is not feasible; EIGRP always selects the lowest FD.. The show ip route output confirms that R1 installed the route via 10.2.1.2 with metric 128256, the lowest feasible distance. The path via 10.3.1.3 has a higher local metric (156160) and is not the successor. EIGRP always selects the route with the lowest FD, so the higher-FD path is not used. Option A is correct.

Answer

An offset-list is applied to the lower FD path, increasing its metric.

Answer

The route is in active state, causing EIGRP to use a backup path.

Answer

R1 has a distribute-list blocking the lower FD path.

Question 19

A network engineer runs the following command to troubleshoot an EIGRP issue:

R1# show ip eigrp topology 10.1.1.0/24

IP-EIGRP (AS 100): Topology entry for 10.1.1.0/24
  State: Passive, Query origin flag: 1, 1 Successor(s), FD is 131072
  Routing Descriptor Blocks:
  10.1.2.2 (GigabitEthernet0/0), from 10.1.2.2, Send flag: 0x0
      Composite metric: (131072/130816), Route is Internal
      Vector metric:
        Minimum bandwidth is 10000 Kbit
        Total delay is 100 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
  10.1.3.3 (GigabitEthernet0/1), from 10.1.3.3, Send flag: 0x0
      Composite metric: (131328/131072), Route is Internal
      Vector metric:
        Minimum bandwidth is 10000 Kbit
        Total delay is 200 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 2

What does this output indicate?

Accepted Answer

Only one path is available; the second path is a backup that is not used.. The output shows two paths for 10.1.1.0/24. The first path has a composite metric of (131072/130816), making the feasible distance (FD) 131072. The second path has a composite metric of (131328/131072), where the reported distance (131072) equals the FD. For a path to be a feasible successor, the reported distance must be strictly less than the FD (RD < FD). Since the second path's reported distance equals the FD, it does not satisfy the feasibility condition and is not a feasible successor. Therefore, only the first path is a successor and is installed in the routing table. The second path remains in the topology table but is not a feasible successor and will not be used for forwarding or as a backup unless a topology change causes it to satisfy the feasibility condition. Thus, option A is the best answer, though the term 'backup' in option A is imprecise because the second path is not a feasible successor.

Answer

Both paths are feasible successors, but only the first is installed in the routing table.

Answer

Both paths are installed in the routing table for load balancing.

Answer

The route is in active state, indicating a query is in progress.

Question 20

Which TWO statements correctly describe the behavior of TTL propagation in MPLS networks? (Choose TWO.)

Accepted Answer

Disabling TTL propagation prevents traceroute from revealing the internal LSR hops.. In MPLS, TTL propagation can be disabled for security or to hide the core topology. When disabled, the IP TTL is copied to the MPLS label only at the ingress LSR, and at the egress LSR the MPLS TTL is copied back to the IP header. By default, TTL propagation is enabled. The command 'no mpls ip propagate-ttl' disables it. Option A is correct because disabling TTL propagation hides the core hops from traceroute. Option B is correct because the command to disable is indeed 'no mpls ip propagate-ttl'. Option C is false: the command is not 'no mpls ip ttl-propagate'. Option D is false: traceroute shows only the ingress and egress LSRs, not all hops. Option E is false: when disabled, the TTL is not decremented across the MPLS core.

Answer

The command 'no mpls ip ttl-propagate' is used to disable TTL propagation.

Answer

When TTL propagation is disabled, traceroute shows every LSR hop in the MPLS core.

Answer

When TTL propagation is disabled, the TTL value is decremented normally at each LSR hop.