300-410 Mock Exam 76 — 25 Questions

Question 1

A network engineer is configuring a Cisco router as a Dynamic Host Configuration Protocol (DHCP) server for a remote subnet. The router's interface that connects to the remote subnet is GigabitEthernet0/1 with IP address 10.10.10.1/24. The engineer wants the router to assign addresses from the 10.10.10.0/24 pool to clients on that subnet. Which command must be issued in DHCP pool configuration mode to specify the default gateway that clients will receive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

default-router 10.10.10.1. In Cisco IOS DHCP server configuration, the default-router command within the DHCP pool defines the default gateway address provided to clients. Since the router's interface on the remote subnet is 10.10.10.1, that address is the correct gateway. The other commands either apply to the router's own gateway or are invalid, so they would not fulfill the requirement.

Answer

ip default-gateway 10.10.10.1

Answer

default-gateway 10.10.10.1

Answer

gateway 10.10.10.1

Question 2

A network engineer is configuring a Cisco IOS router to support MPLS L3VPN. The router will act as a PE router and needs to assign a unique identifier to each customer VRF to allow overlapping address spaces. Which MPLS L3VPN component provides this function?

Accepted Answer

Route Distinguisher. The Route Distinguisher (RD) is the MPLS L3VPN component that provides a unique identifier for each customer VRF, allowing overlapping IPv4 address spaces. By prepending the RD to customer prefixes, MP-BGP creates VPNv4 routes that are globally unique. This enables the service provider to carry multiple customers' routes without conflict. The RD is configured under the VRF definition and is essential for MPLS L3VPN operation.

Answer

Route Target

Answer

VPN Label

Answer

BGP Extended Community

Question 3

A network engineer is configuring a Cisco router as a Dynamic Host Configuration Protocol (DHCP) server for a remote subnet. The router's interface that connects to the remote subnet is GigabitEthernet0/1 with IP address 10.10.10.1/24. The engineer wants the router to assign addresses from the 10.10.10.0/24 pool to clients on that subnet. Which command must be issued in DHCP pool configuration mode to specify the default gateway that clients will receive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to notify the originating spoke that a better path exists directly to the destination spoke. The spoke then sends an NHRP resolution request for the destination spoke's NBMA address and, upon receiving a reply, establishes a direct tunnel. This optimizes traffic flow and reduces hub load. NHRP shortcut on the spoke caches the direct path, but the hub's redirect is the trigger.

Answer

Multipoint GRE (mGRE)

Answer

IPsec tunnel protection

Answer

Next Hop Resolution Protocol (NHRP) shortcut

Question 4

A network engineer is configuring a Cisco IOS router to authenticate login users against an external TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. Which command set correctly configures this behavior on the router?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration must specify TACACS+ as the primary authentication method and local as the fallback. The command 'aaa authentication login default group tacacs+ local' does exactly that: it attempts TACACS+ first, and if the server is unreachable, it uses the local username database. The other options either use the wrong fallback method, reverse the order, or disable authentication.

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Question 5

A network engineer is configuring MPLS Layer 3 VPN on a Cisco IOS XE router. The engineer needs to enable the provider edge (PE) router to exchange VPNv4 routes with another PE router. Which address family must be configured under the BGP routing process to achieve this?

Accepted Answer

address-family vpnv4 unicast. To exchange VPNv4 routes between PE routers in an MPLS L3VPN environment, the BGP process must be configured with the address-family vpnv4 unicast command. This enables the PE routers to exchange VPNv4 prefixes along with MPLS labels and route targets. The other address families do not support VPNv4 route exchange.

Answer

address-family ipv4 vrf

Answer

address-family ipv6 unicast

Answer

address-family ipv4 unicast

Question 6

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. Phase 1 is up, but Phase 2 fails to establish. The engineer suspects a mismatch in the IPsec proposal. Which command would show the configured IPsec transform set and the algorithms being used?

Accepted Answer

show crypto ipsec transform-set. When Phase 2 fails, the most likely cause is a mismatch in the IPsec transform set. The show crypto ipsec transform-set command reveals the configured algorithms for each transform set, enabling comparison between peers. While other commands show SA status or map references, only this command directly displays the transform set details needed to identify the mismatch.

Answer

show crypto map

Answer

show crypto isakmp sa

Answer

show crypto ipsec sa

Question 7

A network engineer is configuring a DMVPN Phase 3 hub router. The hub must dynamically discover spoke-to-spoke tunnels while still using the hub for initial registration. Which technology allows the hub to redirect spoke traffic directly to another spoke?

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform a source spoke that a more optimal direct path exists to the destination spoke. The hub inspects incoming packets and, upon determining that the destination is reachable via another spoke, sends an NHRP redirect message. The source spoke then initiates NHRP resolution for the destination and establishes a direct spoke-to-spoke tunnel, achieving Phase 3 shortcuts.

Answer

NHRP shortcut

Answer

NHRP registration

Answer

NHRP resolution

Question 8

A network engineer is troubleshooting a DHCP relay configuration on a Cisco IOS router. The router is configured with the ip helper-address 10.1.1.1 command on interface GigabitEthernet0/0, but clients on the 192.168.1.0/24 subnet are not receiving IP addresses from the DHCP server at 10.1.1.1. The engineer verifies that the DHCP server is operational and has a pool for 192.168.1.0/24. What is the most likely cause?

Accepted Answer

The DHCP server does not have a route back to the 192.168.1.0/24 subnet.. The most likely cause is that the DHCP server does not have a route back to the 192.168.1.0/24 subnet. Without a return route, the server cannot send DHCPOFFER messages to the relay agent, so clients never receive an address. The other options are either incorrect syntax or not applicable because the relay agent is typically enabled by default and the helper address is on the correct interface.

Answer

The DHCP relay agent is not enabled globally with the service dhcp command.

Answer

The ip helper-address command must be configured with the subnet mask of the DHCP server.

Answer

The ip helper-address command is configured on the wrong interface.

Question 9

A network engineer is configuring a VRF-aware IPsec VPN. The engineer needs to ensure that the IPsec tunnel traffic is forwarded within the correct VRF on the router. Which command must be configured under the crypto map to bind the IPsec tunnel to a specific VRF?

Accepted Answer

set vrf VPN-CORP. To bind an IPsec tunnel to a VRF in a VRF-aware IPsec configuration, the set vrf command is used under the crypto map entry. This ensures that the tunnel's traffic is forwarded using the specified VRF's routing table, allowing overlapping address spaces and segmentation.

Answer

set ip vrf VPN-CORP

Answer

ip vrf forwarding VPN-CORP

Answer

vrf forwarding VPN-CORP

Question 10

A network engineer is troubleshooting a DMVPN Phase 3 hub-and-spoke topology. Spoke routers are Cisco IOS devices running EIGRP as the routing protocol. The engineer wants to ensure that spoke-to-spoke traffic does not go through the hub after the initial path setup, and that spoke routers can dynamically form direct tunnels. Which NHRP command must be configured on the hub to enable this behavior?

Accepted Answer

ip nhrp redirect. For DMVPN Phase 3, the hub must be configured with 'ip nhrp redirect' to send redirect messages to spokes, allowing them to establish direct tunnels. Spokes must have 'ip nhrp shortcut' to act on those redirects. Without the hub redirect, spokes would continue sending traffic through the hub even after initial NHRP resolution.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 11

A network administrator is configuring a Cisco IOS router to authenticate SSH users against an external TACACS+ server. The TACACS+ server is reachable at 10.10.10.5, and the shared secret is 'Cisco123'. The administrator wants to ensure that if the TACACS+ server is unreachable, a local user account 'backup' with privilege level 15 is used for authentication. Which configuration sequence correctly achieves this?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123. The correct configuration must enable AAA, set the default login authentication to use TACACS+ first and then the local database, create a local user with privilege 15, and define the TACACS+ server with the correct IP and key. The fallback to local is essential for when the TACACS+ server is unreachable, and using 'secret' is best practice for storing the local password securely.

Answer

aaa new-model
aaa authentication login default group tacacs+
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ local
username backup privilege 15 password Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ enable
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Question 12

A network engineer is configuring OSPF on a Cisco router. The router has three interfaces in Area 0, and the engineer wants to ensure that the router does not become a Designated Router (DR) on any of these interfaces. Which command should be used on each interface?

Accepted Answer

ip ospf priority 0. OSPF DR/BDR election is influenced by interface priority. A priority of 0 makes a router ineligible to become DR or BDR. The other options either do not exist, change the network type unnecessarily, or increase the likelihood of becoming DR. Therefore, setting priority to 0 on each interface is the correct approach.

Answer

ip ospf priority 255

Answer

ip ospf network point-to-point

Answer

ip ospf dr-disable

Question 13

A network technician is configuring a Cisco router to act as a DHCP relay agent. The router's interface Gi0/0 is connected to the DHCP clients, and the DHCP server is reachable via interface Gi0/1. Which command must be configured on interface Gi0/0 to forward DHCP requests to the server at 192.168.1.10?

Accepted Answer

ip helper-address 192.168.1.10. To configure a Cisco router as a DHCP relay agent, the 'ip helper-address' command is applied on the interface receiving DHCP broadcasts. It forwards these broadcasts as unicasts to the specified DHCP server. This allows clients on one subnet to obtain IP addresses from a server on another subnet. Other commands like 'ip forward-protocol' are supplementary and do not specify the server.

Answer

ip forward-protocol udp 192.168.1.10

Answer

ip dhcp relay 192.168.1.10

Answer

ip dhcp-server 192.168.1.10

Question 14

A network engineer is configuring OSPF on a router that connects to a broadcast Ethernet segment. The router is connected to a switch that also connects to three other OSPF routers. The engineer wants to ensure that this router does not become the Designated Router (DR) or Backup Designated Router (BDR) on this segment, but still participates in OSPF. Which configuration should the engineer apply on the router's interface?

Accepted Answer

ip ospf priority 0. The OSPF priority value is used in the DR/BDR election on broadcast and non-broadcast multi-access segments. A priority of 0 makes the router ineligible to become DR or BDR, while still allowing it to form adjacencies and exchange routing information. This is the correct way to keep a router as a DROTHER on a segment where it should not take on a primary role.

Answer

ip ospf database-filter all out

Answer

ip ospf priority 255

Answer

ip ospf network point-to-point

Question 15

A network administrator is configuring a GRE tunnel between two Cisco routers to transport IPv6 traffic over an IPv4-only core. The administrator enters the following configuration on Router A:

interface Tunnel0
 ipv6 address 2001:DB8:100::1/64
 tunnel source 10.1.1.1
 tunnel destination 10.2.2.2
 tunnel mode gre ipv6

However, the tunnel interface remains down. What is the most likely cause?

Accepted Answer

The physical interface providing the tunnel source address is not operational or there is no route to the tunnel destination.. A GRE tunnel interface will only come up if the tunnel source is operational and there is a route to the tunnel destination. In this scenario, the tunnel source is 10.1.1.1, which must be assigned to an up interface, and the router must have a route to 10.2.2.2. Without these conditions, the tunnel remains down regardless of the tunnel mode or IPv6 configuration.

Answer

The tunnel source and destination must be IPv6 addresses, not IPv4.

Answer

The tunnel mode should be gre ipv6, but it is incorrectly set to gre ipv4.

Answer

The tunnel interface requires an IPv4 address in addition to the IPv6 address to become operational.

Question 16

A network engineer is configuring a site-to-site DMVPN Phase 3 hub router. The hub uses a single mGRE tunnel interface with the IP address 10.0.0.1/24. Spoke routers are configured with NHS 10.0.0.1 and are in the same subnet. The engineer wants spoke-to-spoke traffic to bypass the hub after the initial resolution. Which command must be configured on the hub to enable Phase 3 shortcut switching?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send redirect messages to spokes when it forwards traffic to another spoke. The spokes must have ip nhrp shortcut to act on those redirects. Together, they allow spoke-to-spoke direct tunnels after initial hub-based resolution. The hub's role is to redirect, so ip nhrp redirect is the correct command on the hub.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 100

Answer

ip nhrp map multicast dynamic

Question 17

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The administrator wants to rate-limit ARP traffic destined to the route processor. Which configuration correctly applies a CoPP policy to ARP traffic?

Accepted Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY. Control Plane Policing (CoPP) is configured by defining class-maps to match traffic, policy-maps to define actions, and then attaching the policy to the control plane using the 'control-plane' global configuration mode with 'service-policy input'. The class-map must match ARP traffic using 'match protocol arp'. This setup rate-limits ARP packets destined to the route processor, protecting it from DoS attacks.

Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
interface Control-Plane
 service-policy input COPP_POLICY

Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
control-plane host
 service-policy input COPP_POLICY

Answer

class-map match-all ARP_CLASS
 match access-group name ARP_ACL
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 service-policy input COPP_POLICY

Question 18

An engineer configures a Cisco IOS router with two static routes to the 10.10.0.0/16 network: one via 192.168.1.1 with administrative distance 1, and another via 192.168.2.1 with administrative distance 200. The route via 192.168.1.1 is installed in the routing table. Later, the interface to 192.168.1.1 goes down. Which statement describes the router's behavior?

Accepted Answer

The router immediately installs the route via 192.168.2.1 in the routing table.. The primary static route via 192.168.1.1 with administrative distance 1 is preferred. When its interface goes down, the route is removed. The floating static route via 192.168.2.1, with administrative distance 200, becomes the best available path and is installed. This provides redundancy without dynamic routing protocols.

Answer

The router removes both static routes and sends an ICMP redirect to the source.

Answer

The router keeps the route via 192.168.1.1 in the routing table but marks it as unreachable.

Answer

The router load-balances traffic between the two next hops because both are configured.

Question 19

A network engineer is implementing MPLS Layer 3 VPNs. The engineer wants to ensure that customer routes are propagated across the MPLS core. Which protocol is typically used within the provider core to distribute VPNv4 routes?

Accepted Answer

BGP. In MPLS Layer 3 VPNs, Multiprotocol BGP (MP-BGP) is used to distribute VPNv4 routes between provider edge routers. MP-BGP carries the VPNv4 address family, which includes the route distinguisher and route target extended communities, along with MPLS labels. This allows the provider core to forward customer traffic based on labels.

Answer

OSPF

Answer

LDP

Answer

EIGRP

Question 20

A network engineer is configuring a Cisco IOS router to authenticate SSH users against a TACACS+ server. The engineer wants to ensure that if the TACACS+ server is unreachable, the router will fall back to using the local username and password configured on the router. Which command set correctly configures this fallback behavior?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct command is 'aaa authentication login default group tacacs+ local'. The order of methods in the AAA authentication list is significant: the router tries each method in sequence until one succeeds. Placing 'group tacacs+' first ensures TACACS+ is preferred, and 'local' second ensures fallback to the local user database if the server is unreachable or rejects the credentials.

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none