300-410 Mock Exam 75 — 25 Questions

Question 1

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router interface GigabitEthernet0/0 is connected to a subnet with DHCP clients, and the DHCP server is located at 192.168.100.10. Which command must be applied to the interface to forward DHCP requests to the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip helper-address 192.168.100.10. The 'ip helper-address' command on the client-facing interface is required to relay DHCP requests to a remote server. It forwards UDP broadcasts (including DHCP) to the specified IP address. Other commands either modify relay behavior or are for server configuration. This command is the fundamental step for DHCP relay.

Answer

ip dhcp relay information option

Answer

ip dhcp pool RELAY_POOL

Answer

ip forward-protocol udp 67

Question 2

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS-XE router to protect the route processor from excessive traffic. The administrator creates a class-map to match all management traffic (SSH, SNMP, TACACS+) and a policy-map to police that traffic to 1 Mbps. After applying the service-policy to the control-plane, the administrator notices that some legitimate SNMP polling is being dropped. Which two actions can the administrator take to resolve this issue while maintaining protection against DoS attacks? (Choose two.)

Accepted Answer

Increase the police rate for the management class to accommodate the SNMP polling volume.. The legitimate SNMP polling is being dropped because the policer rate is too low for the combined management traffic. Increasing the overall rate or creating a separate class with a higher rate for SNMP will allow legitimate traffic while still policing excess. Both actions maintain protection against DoS by keeping policing in place.

Answer

Remove the police action and use a bandwidth guarantee instead.

Answer

Apply the service-policy to the data plane interfaces instead of the control plane.

Answer

Enable SNMPv3 authentication to reduce the volume of SNMP traffic.

Question 3

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router interface GigabitEthernet0/0 is connected to a subnet with DHCP clients, and the DHCP server is located at 192.168.100.10. Which command must be applied to the interface to forward DHCP requests to the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

service dhcp. The DHCP service on a Cisco IOS router must be enabled globally with the 'service dhcp' command. Although it is enabled by default, it can be disabled, preventing the router from responding to DHCP requests. Configuring a pool alone is insufficient. The correct command activates the service, allowing the router to lease addresses from the configured pool.

Answer

ip helper-address 10.1.1.1

Answer

ip dhcp pool BRANCH_POOL

Answer

ip dhcp relay information option

Question 4

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel source is GigabitEthernet0/0 on Router A with IP 192.168.1.1, and the tunnel destination is 192.168.2.1 on Router B. After configuration, the tunnel interface is up, but no traffic passes through. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable via the underlay network.. A GRE tunnel requires the tunnel destination to be reachable via the underlay network. If the destination is not reachable, the tunnel interface may appear up, but encapsulated packets cannot be delivered, resulting in no traffic flow. Other options are either incorrect or would cause different symptoms. Ensuring underlay reachability and proper routing is essential for GRE tunnel operation.

Answer

The tunnel source and destination are in different subnets.

Answer

The tunnel mode is set to GRE/IPv4, which is not supported.

Answer

The tunnel interface is missing an IP address.

Question 5

A network administrator is troubleshooting an OSPFv3 network. Routers R1 and R2 are directly connected on a point-to-point link. R1 is configured with OSPFv3 area 0, and R2 is configured with OSPFv3 area 1. The administrator notices that no OSPFv3 adjacency forms between them. What is the most likely cause?

Accepted Answer

The OSPFv3 area numbers do not match on the link.. For OSPFv3 to form an adjacency, both routers on a common link must be configured in the same OSPF area. In this scenario, R1 is in area 0 and R2 is in area 1, which violates this requirement. The hello packets will be ignored, and no adjacency will form. Other potential issues like duplicate router IDs or interface configuration are not indicated by the symptoms.

Answer

The OSPFv3 router IDs are not unique.

Answer

The OSPFv3 process is not enabled on the interfaces.

Answer

The OSPFv3 network type is mismatched.

Question 6

A network administrator is deploying a GET VPN using Cisco IOS routers. The key server is configured with a cooperative key server (COOP) for redundancy. The administrator notices that some group members are not registering with the primary key server. Which protocol and port must be allowed through the firewall for the group members to register with the key server?

Accepted Answer

GDOI on UDP port 848. GET VPN group members use GDOI on UDP port 848 to register with the key server. This port must be permitted through firewalls to allow registration and key retrieval.

Answer

ISAKMP on UDP port 500

Answer

IPsec ESP on IP protocol 50

Answer

NAT-T on UDP port 4500

Question 7

A network administrator is troubleshooting an OSPFv3 network. Router R1 is configured with the following:

ipv6 unicast-routing
interface GigabitEthernet0/0
 ipv6 address 2001:DB8:1::1/64
 ipv6 ospf 1 area 0
 ipv6 ospf network point-to-point
!
router ospf 1
 router-id 1.1.1.1
!

R1 is not forming an adjacency with R2, which is configured with:

interface GigabitEthernet0/0
 ipv6 address 2001:DB8:1::2/64
 ipv6 ospf 1 area 0
 ipv6 ospf network broadcast
!
router ospf 1
 router-id 2.2.2.2

What is the most likely reason for the adjacency failure?

Accepted Answer

The network type mismatch (point-to-point vs. broadcast) prevents the routers from forming an adjacency.. OSPF network types must be consistent on both ends of a link for an adjacency to form. R1 is configured with ipv6 ospf network point-to-point, while R2 uses broadcast. This mismatch leads to differing hello packet handling and prevents the adjacency. To resolve, configure both interfaces with the same network type, either point-to-point or broadcast.

Answer

The router-id must be the same on both routers for an adjacency to form.

Answer

OSPFv3 requires the use of link-local addresses for adjacency formation, and they are not configured.

Answer

OSPFv3 requires the router-id to be configured under the interface, not under the router ospf process.

Question 8

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router interface GigabitEthernet0/0 is connected to a subnet with DHCP clients, and the DHCP server is located at 192.168.100.10. Which command must be applied to the interface to forward DHCP requests to the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip dhcp pool LAN, network 10.10.10.0 255.255.255.0, default-router 10.10.10.1, dns-server 8.8.8.8. The correct configuration must include a DHCP pool with the network statement, default-router set to the router's interface IP (10.10.10.1), and dns-server for DNS. The other options either omit DNS, use an incorrect gateway, or add unnecessary parameters. The router's interface address is the appropriate default gateway for clients on that subnet.

Answer

ip dhcp excluded-address 10.10.10.1 10.10.10.10, ip dhcp pool LAN, network 10.10.10.0 255.255.255.0, default-router 10.10.10.254

Answer

ip dhcp pool LAN, network 10.10.10.0 255.255.255.0, default-router 10.10.10.1, dns-server 8.8.8.8, lease 0 0 10

Answer

ip dhcp pool LAN, network 10.10.10.0 255.255.255.0, default-router 10.10.10.1, dns-server 8.8.8.8, domain-name example.com

Question 9

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router interface GigabitEthernet0/0 is connected to a subnet with DHCP clients, and the DHCP server is located at 192.168.100.10. Which command must be applied to the interface to forward DHCP requests to the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto pki authenticate name. To validate certificates issued by an external CA, the router must first obtain the CA's own certificate. The crypto pki authenticate command performs this by retrieving the CA certificate and installing it as a trusted certificate. This step is a prerequisite for any PKI operations that rely on that CA, such as verifying client certificates during VPN authentication.

Answer

crypto pki import name certificate

Answer

crypto pki enroll name

Answer

crypto pki trustpoint name

Question 10

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN) on a service provider MPLS network. The administrator must ensure that the group members can communicate securely while maintaining any-to-any connectivity and minimizing tunnel overhead. Which two statements about GET VPN are true? (Choose two.)

Accepted Answer

GET VPN requires a key server to distribute encryption keys and policies to group members.. GET VPN uses a group security association managed by a key server, allowing any-to-any secure communication without per-peer tunnels. The key server distributes policies and keys via GDOI. This design preserves the original IP header for routing and supports both unicast and multicast, making it ideal for MPLS networks.

Answer

GET VPN encapsulates packets in a new IP header, adding significant overhead.

Answer

GET VPN uses IKEv2 to establish point-to-point tunnels between all group members.

Answer

GET VPN provides encryption only for unicast traffic, not multicast.

Question 11

A network engineer is implementing Zone-Based Policy Firewall (ZPFW) on a Cisco IOS router. The router has three interfaces: inside, outside, and DMZ. The engineer wants to allow HTTP traffic from the inside zone to the DMZ zone, and block all other traffic from inside to DMZ. Which configuration is required?

Accepted Answer

Define a zone pair from inside to DMZ, apply a policy-map that inspects HTTP and drops all other traffic.. In ZPFW, traffic between zones is controlled by zone pairs. A zone pair from inside to DMZ with a policy-map that inspects HTTP and implicitly drops other traffic will allow only HTTP and block the rest. Other options either do not use ZPFW correctly or apply the policy in the wrong direction.

Answer

Configure a class-map that matches HTTP and apply it as an inspect action in the global policy.

Answer

Apply an ACL on the inside interface permitting HTTP to the DMZ and denying all other traffic.

Answer

Create a zone pair from DMZ to inside and apply a policy-map that permits HTTP return traffic.

Question 12

A company has a Cisco IOS XE router configured with IP SLA and Object Tracking to monitor the reachability of a primary ISP. The router should fail over to a backup ISP when the primary path becomes unreachable. The engineer wants to ensure that the failover occurs quickly and that the primary path is restored when it becomes available again. Which configuration element is required to achieve this behavior?

Accepted Answer

An IP SLA operation with a track object that is referenced by a static route to the primary ISP. IP SLA with object tracking allows the router to monitor the primary ISP's reachability. The track object is referenced in the static route to the primary ISP, so when the SLA fails, the route is removed and the backup route (which could be a floating static or a default route) takes over. When the SLA recovers, the primary route is reinstated. This provides the required fast failover and automatic restoration.

Answer

A floating static route with a higher administrative distance to the backup ISP

Answer

A route map that matches the primary ISP's next-hop and sets the local preference

Answer

A static route with a lower administrative distance pointing to the backup ISP

Question 13

A network engineer is configuring OSPF on a router with three interfaces: Gi0/0 (10.1.1.1/24), Gi0/1 (10.2.2.1/24), and Gi0/2 (10.3.3.1/24). The engineer wants to prevent OSPF from forming adjacencies on Gi0/2 while still advertising the 10.3.3.0/24 network into OSPF. Which configuration accomplishes this?

Accepted Answer

Configure the Gi0/2 interface as passive with the passive-interface Gi0/2 command under router ospf.. The passive-interface command is designed to stop OSPF from sending and processing hello packets on an interface, which prevents neighbor adjacencies. However, the network prefix associated with that interface is still advertised as a stub network into OSPF, allowing other routers to reach it. This exactly matches the requirement to suppress adjacencies while still advertising the subnet.

Answer

Configure the Gi0/2 interface with the ip ospf database-filter all out command.

Answer

Configure the Gi0/2 interface with the ip ospf network point-to-point command.

Answer

Configure a distribute-list on Gi0/2 to filter OSPF hellos.

Question 14

A network engineer is troubleshooting a Cisco IOS router that is configured for AAA authorization. The engineer notices that users are not being authorized for certain commands even though the TACACS+ server is reachable and the user is authenticated. The configuration includes 'aaa authorization exec default group tacacs+ local' and 'aaa authorization commands 15 default group tacacs+ local'. Which issue is most likely causing the problem?

Accepted Answer

The TACACS+ server is not configured to return the correct AV pairs for command authorization.. Command authorization relies on the TACACS+ server to provide authorization attributes that define which commands the user is allowed to execute. If the server is reachable and the user is authenticated but commands are denied, the server is likely not configured to return the proper AV pairs for command authorization. The local fallback is not used because the server is responding, so the issue is with the server's authorization configuration.

Answer

The 'aaa new-model' command is not enabled.

Answer

The local database does not have the necessary privilege level configured for the user.

Answer

The 'aaa authorization commands 15' command requires the 'if-authenticated' keyword to work.

Question 15

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which type of ACL should be used in the crypto map to match this traffic?

Accepted Answer

An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and denies all other traffic.. The crypto ACL must permit the specific traffic that should be encrypted and implicitly deny all other traffic. An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and denies all other traffic achieves this. Standard ACLs cannot match destination addresses, and denying the desired traffic or permitting all traffic would be incorrect.

Answer

A standard ACL that permits the 10.1.1.0/24 subnet.

Answer

A named ACL that permits all IP traffic.

Answer

An extended ACL that denies IP traffic from 10.1.1.0/24 to 10.2.2.0/24 and permits all other traffic.

Question 16

A company is deploying IPv6 and wants to use stateful DHCPv6 to assign addresses to clients. The network administrator configures the router with the 'ipv6 dhcp pool' command and sets the 'address prefix' and 'dns-server' options. However, clients are not receiving IPv6 addresses. Which additional configuration is required on the client-facing interface to enable stateful DHCPv6?

Accepted Answer

ipv6 nd managed-config-flag. For stateful DHCPv6, the router must set the Managed Address Configuration flag in Router Advertisements. This is done with 'ipv6 nd managed-config-flag' on the client-facing interface. It tells clients to obtain addresses via DHCPv6. The other-config-flag only indicates other parameters are available via DHCPv6, and the DHCP server command alone does not force clients to use DHCPv6 for addresses.

Answer

ipv6 address autoconfig

Answer

ipv6 nd other-config-flag

Answer

ipv6 dhcp server DHCP_POOL

Question 17

A network administrator is configuring a point-to-point GRE tunnel between two Cisco routers. The administrator wants to verify that the tunnel is operational and that the correct encapsulation is being used. Which command should be used to display the tunnel interface status, including the encapsulation and tunnel source/destination?

Accepted Answer

show interfaces tunnel 0. The show interfaces tunnel 0 command provides comprehensive details about the tunnel interface, including its operational status, encapsulation type (GRE), and the configured tunnel source and destination. This allows the administrator to verify that the tunnel is up and correctly configured. The other commands do not provide the necessary tunnel-specific information.

Answer

show ip interface brief

Answer

show crypto ipsec sa

Answer

show ip route

Question 18

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router interface GigabitEthernet0/0 is connected to a subnet with DHCP clients, and the DHCP server is located at 192.168.100.10. Which command must be applied to the interface to forward DHCP requests to the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 on a specific interface for IPv6, the interface configuration command ipv6 ospf 1 area 0 is used. This command assigns the interface to OSPFv3 process 1 and area 0, allowing it to form adjacencies. Global configuration commands only create the OSPFv3 process; interface activation is required for adjacency formation.

Answer

router ospfv3 1

Answer

ospfv3 1 ipv6 area 0

Answer

ipv6 router ospf 1

Question 19

A network engineer is implementing policy-based routing (PBR) on a Cisco router. The goal is to forward traffic from a specific subnet to a next-hop IP address that is not directly connected, but reachable via a recursive lookup. The engineer configures a route-map with 'set ip next-hop recursive <IP>'. However, traffic is not being forwarded as expected. Which of the following is the most likely reason?

Accepted Answer

The next-hop IP address is not resolvable via a route in the RIB.. For 'set ip next-hop recursive' to work, the specified next-hop address must be resolvable via a route in the routing table. If no such route exists, the recursive lookup fails, and the PBR policy is skipped. The router then uses the normal routing table. Therefore, the absence of a route to the next-hop is the most likely cause of the failure.

Answer

The 'set ip next-hop recursive' command is not supported in PBR.

Answer

The next-hop IP address is reachable via the default route only.

Answer

The route-map is not applied to the correct interface.

Question 20

A network administrator is implementing policy-based routing (PBR) on a Cisco IOS router. The goal is to route traffic from a specific subnet (192.168.1.0/24) through a next-hop of 10.1.1.2 instead of the default route. The administrator has created a route map named PBR-MAP and configured a match statement for the subnet. Which action must be configured in the route map to set the next-hop?

Accepted Answer

set ip next-hop 10.1.1.2. Policy-based routing uses route maps to match traffic and set actions. The 'set ip next-hop' command is the correct action to specify the next-hop IP address for matching packets. It overrides the routing table for those packets. The other options either set a default next-hop (used only when no route exists), discard traffic, or mark packets, none of which achieve the goal.

Answer

set interface Null0

Answer

set ip default next-hop 10.1.1.2

Answer

set ip precedence 5