300-410 Mock Exam 77 — 25 Questions

Question 1

A network administrator is implementing GET VPN on Cisco IOS routers. The key server is configured with a policy that includes the `rekey` command. Which statement accurately describes the behavior of the rekey mechanism in GET VPN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The key server sends rekey messages to group members to refresh the Group Domain of Interpretation (GDOI) keys.. GET VPN uses GDOI for group key management. The key server sends rekey messages to group members to update encryption keys and policies. This allows scalable key distribution without re-registration. The rekey command configures the key server's rekey behavior, including algorithms and lifetimes. It directly impacts data plane keys, ensuring secure and efficient key rollover.

Answer

The rekey mechanism only applies to the control plane and does not affect data plane encryption keys.

Answer

The rekey command is used to manually trigger a key rollover on the key server.

Answer

The rekey mechanism requires each group member to initiate a new registration with the key server.

Question 2

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The engineer wants to ensure that the authentication key is not sent in clear text and that the key can be changed without disrupting the adjacency. Which command should be used to configure the key on the interface?

Accepted Answer

ip ospf message-digest-key md5 . To configure an MD5 key for OSPFv2 authentication on an interface, the 'ip ospf message-digest-key' command is used. The key is hashed and not sent in clear text. By configuring multiple keys with different key IDs, you can change the key without disrupting the adjacency. The other options either configure plaintext authentication or enable authentication without setting the key.

Answer

area 0 authentication message-digest

Answer

ip ospf authentication message-digest

Answer

ip ospf authentication-key <key>

Question 3

A network administrator is configuring a Cisco IOS XE router to support IPv6. The administrator wants to enable IPv6 routing and assign an IPv6 address to an interface. Which command must be configured globally to enable IPv6 routing?

Accepted Answer

ipv6 unicast-routing. To enable IPv6 routing on a Cisco IOS XE router, the global command 'ipv6 unicast-routing' must be configured. This allows the router to forward IPv6 packets and run IPv6 routing protocols. Interface commands like 'ipv6 enable' or 'ipv6 address autoconfig' are used for address configuration but do not enable global routing. The command 'ip routing ipv6' is invalid.

Answer

ipv6 address autoconfig

Answer

ip routing ipv6

Answer

ipv6 enable

Question 4

A network engineer is implementing MPLS Traffic Engineering (TE) with RSVP-TE. The engineer must ensure that the TE tunnel can be established and that the headend router can signal the path. Which two statements about RSVP-TE operation are true? (Choose two.)

Accepted Answer

RSVP-TE uses the Resource Reservation Protocol to reserve bandwidth along the path of a TE tunnel.. RSVP-TE reserves bandwidth along the explicit path of a TE tunnel using PATH and RESV messages. All routers along the path must support and enable RSVP on relevant interfaces for signaling to succeed. RSVP-TE does not use LDP for label distribution; it handles labels itself. Path computation is done by CSPF on the headend, not automatically by RSVP. Reservations are unidirectional, but a separate return tunnel is not always required.

Answer

RSVP-TE automatically computes the shortest path for the tunnel without any explicit configuration.

Answer

RSVP-TE uses LDP to distribute labels for the TE tunnel.

Answer

RSVP-TE reservations are unidirectional, so a separate tunnel is needed for the return traffic.

Question 5

A network engineer is configuring a static route on a Cisco IOS router to reach the network 192.168.2.0/24 via the next-hop address 10.1.1.2. The engineer enters the command 'ip route 192.168.2.0 255.255.255.0 10.1.1.2'. However, the route does not appear in the routing table. What is the most likely reason?

Accepted Answer

The next-hop address 10.1.1.2 is not reachable.. A static route is only installed in the routing table if its next-hop address is reachable. The next-hop 10.1.1.2 must be reachable via a directly connected interface or another route. If it is not reachable, the static route remains in the configuration but is not active. The subnet mask is correct, and no special keywords are needed for basic installation. Thus, the most likely reason is that the next-hop is unreachable.

Answer

The static route requires the 'permanent' keyword to be installed.

Answer

The subnet mask is incorrect; it should be 255.255.255.0.

Answer

The router needs a default route to install any static route.

Question 6

A network technician is configuring a static route on a Cisco router. The technician wants to ensure that the static route is only used when the primary route is unavailable. Which type of static route should be configured?

Accepted Answer

Floating static route. A floating static route is designed to be a backup by assigning it a higher administrative distance than the primary route. When the primary route is present, the floating static route is not installed in the routing table. If the primary route fails, the floating static route becomes active. This behavior precisely matches the requirement of using the static route only when the primary route is unavailable.

Answer

Default static route

Answer

Summary static route

Answer

Recursive static route

Question 7

A network engineer is configuring MPLS Layer 3 VPN on a Cisco IOS XR router. The engineer needs to ensure that customer routes are properly propagated across the MPLS core. Which two of the following are required to establish the VPNv4 peering between PE routers? (Choose two.)

Accepted Answer

Enable BGP address-family vpnv4 unicast on the PE routers.. To establish VPNv4 peering between PE routers, you must enable the BGP VPNv4 address family and have either a full mesh of iBGP sessions or a route reflector. These two elements allow the exchange of VPNv4 routes with route distinguishers and route targets, which are essential for MPLS L3VPN. LDP and IGP are for transport but not for VPNv4 peering itself.

Answer

Configure OSPF as the IGP for the MPLS core.

Answer

Enable LDP for label distribution on the core interfaces.

Answer

Enable BGP address-family ipv4 unicast for customer routes.

Question 8

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only specific traffic from the local subnet to the remote subnet is encrypted, while other traffic is sent in clear text. Which IPsec component is used to define the interesting traffic?

Accepted Answer

Crypto ACL. The crypto ACL is the component that specifies the traffic to be encrypted by IPsec. It acts as a filter, and only packets permitted by the ACL are protected. The crypto map then references this ACL to apply the IPsec policy. Other components like transform set and ISAKMP policy handle encryption algorithms and key negotiation, not traffic selection.

Answer

ISAKMP policy

Answer

Transform set

Answer

Crypto map

Question 9

A network administrator is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The VPN tunnel is up, but traffic from the local subnet to the remote subnet is not passing. The administrator checks the crypto ACL and finds that it matches the traffic. Which of the following is the most likely cause of the problem?

Accepted Answer

There is no route for the remote subnet pointing to the tunnel interface or next-hop.. In an IPsec site-to-site VPN, the tunnel can be up due to traffic from other sources or because the peers established it, but for specific traffic to pass, the router must have a route to the remote subnet pointing to the tunnel or the next-hop. Without this route, packets are not sent through the tunnel and may be dropped or routed elsewhere. The crypto ACL matching is necessary but not sufficient; routing is equally important.

Answer

The crypto map is applied to the wrong interface.

Answer

The crypto ACL is configured with the wrong source and destination addresses.

Answer

The transform set is mismatched between peers.

Question 10

A network engineer is configuring policy-based routing (PBR) on a Cisco router. The router has two interfaces: GigabitEthernet0/0 (LAN) and GigabitEthernet0/1 (WAN). The engineer wants to route traffic from the 192.168.1.0/24 subnet to a next-hop of 10.1.1.2, and all other traffic should follow the default routing table. Which two steps are required to implement this? (Choose two.)

Accepted Answer

Apply the route map to the GigabitEthernet0/0 interface using the ip policy route-map command.. To implement PBR, you must define a route map that matches the traffic (using an ACL) and sets the next-hop. Then, you apply that route map to the ingress interface using the ip policy route-map command. The other options are incorrect: a default route would affect all traffic, PBR is not enabled globally, and applying an ACL directly to the interface would filter rather than route.

Answer

Configure a default route pointing to 10.1.1.2.

Answer

Create an ACL that permits traffic from 192.168.1.0/24 and apply it to the GigabitEthernet0/0 interface inbound.

Answer

Enable PBR globally using the ip policy route-map command in global configuration mode.

Question 11

A network administrator is troubleshooting a DMVPN Phase 3 network using OSPF as the routing protocol. Spoke routers are not learning routes from other spokes. Which two actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Configure the spoke routers with 'ip nhrp shortcut' on their tunnel interfaces.. In DMVPN Phase 3, spoke-to-spoke communication requires the hub to send NHRP redirect messages and the spokes to support NHRP shortcuts. The hub must have 'ip nhrp redirect' configured, and each spoke must have 'ip nhrp shortcut' configured. These commands enable the spokes to dynamically discover and establish direct tunnels to other spokes, bypassing the hub. Without them, spokes will not learn the specific routes to other spokes and will continue to route traffic through the hub, which is inefficient.

Answer

Configure the hub as a route reflector for BGP.

Answer

Disable split horizon on the hub's tunnel interface.

Answer

Change the OSPF network type to point-to-multipoint on all routers.

Question 12

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel interface is up, but the engineer cannot ping the remote tunnel endpoint. The physical interfaces are up, and there is a route to the remote physical address. Which command should be used to verify that the tunnel source and destination are correctly configured?

Accepted Answer

show interfaces tunnel 0. The 'show interfaces tunnel 0' command displays detailed information about the tunnel interface, including the configured source and destination addresses, and the tunnel status. It is the most direct way to verify that the tunnel endpoints are correctly configured. Other commands do not show the tunnel source and destination.

Answer

show ip route

Answer

show ip interface brief

Answer

show crypto session

Question 13

A network technician is configuring a Cisco IOS router to authenticate administrative users via TACACS+ using a centralized server. The requirement is that if the TACACS+ server is unreachable, the router should use the local username database for authentication. Which command sequence correctly configures this fallback behavior?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct command is aaa authentication login default group tacacs+ local. This configures the router to attempt authentication via TACACS+ first, and if the TACACS+ server is unreachable, it falls back to the local username database. The order of methods is critical: the first method is tried, and subsequent methods are used only if the previous method fails or is unreachable.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default local group tacacs+

Question 14

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router must dynamically learn spoke-to-spoke routes without requiring a full mesh of tunnels. Which technology should be implemented on the hub to allow spoke routers to resolve next-hop addresses directly?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. NHRP redirect on the hub and NHRP shortcut on the spokes are the defining features of DMVPN Phase 3. The hub uses redirect messages to inform spokes of a better path, and spokes use shortcut to create direct tunnels. This enables dynamic spoke-to-spoke communication without a full mesh, reducing latency and hub resource consumption.

Answer

Configure OSPF network type as point-to-multipoint on all routers.

Answer

Implement IPsec tunnel protection on the hub only.

Answer

Use BGP route reflectors to distribute spoke routes.

Question 15

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. The engineer also wants to use a pre-shared key for authentication. Which configuration element is required to define the interesting traffic?

Accepted Answer

access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The interesting traffic is defined by an extended ACL that matches the source and destination subnets. This ACL is then referenced in the crypto map using the 'match address' command. The ACL specifies which packets are encrypted and sent through the VPN tunnel, while all other traffic is sent unencrypted. The other options are part of the IPsec configuration but do not define the traffic to be encrypted.

Answer

crypto isakmp policy 10
 authentication pre-share

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101

Answer

crypto ipsec transform-set MYSET esp-aes esp-sha-hmac

Question 16

A network engineer is deploying an MPLS Layer 3 VPN for a customer. The customer requires that the provider edge (PE) routers support a unique route distinguisher (RD) per VRF and that the same customer routes be imported into multiple VRFs. Which configuration on the PE router accomplishes this requirement?

Accepted Answer

Configure a unique RD under each VRF and use route targets (RTs) to control import and export of routes between VRFs.. A unique route distinguisher per VRF ensures that overlapping customer prefixes remain distinct in the MP-BGP VPNv4 table. Route targets, which are BGP extended communities, define import and export policies so that the same customer routes can be imported into multiple VRFs. This combination is the standard method for shared services and overlapping VPNs.

Answer

Configure a unique RD per VRF and use OSPF areas to import routes into multiple VRFs.

Answer

Configure the same RD for all VRFs and rely on BGP extended communities for route distribution.

Answer

Configure a unique RD per VRF and use BGP confederations to import routes into multiple VRFs.

Question 17

A network administrator is deploying DMVPN Phase 3 with IKEv2. The hub router is configured with a dynamic multipoint VPN tunnel and is using NHRP. Spoke routers are configured to register with the hub. After configuration, the administrator notices that spoke-to-spoke traffic is still going through the hub instead of directly between spokes. Which configuration change is most likely to resolve this issue?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. DMVPN Phase 3 requires NHRP redirect on the hub and NHRP shortcut on the spokes to enable direct spoke-to-spoke communication. The hub uses NHRP redirect to inform a spoke that a more efficient path exists directly to another spoke. The spoke then uses NHRP shortcut to resolve the destination and establish a direct tunnel. Without these, traffic will continue to flow through the hub.

Answer

Configure the hub as a route reflector for BGP.

Answer

Enable split horizon on the hub's tunnel interface.

Answer

Change the tunnel mode from GRE multipoint to GRE point-to-point.

Question 18

A network administrator is troubleshooting an EIGRP adjacency that is stuck in the ACTIVE state. The adjacency is between two routers, R1 and R2, on a point-to-point link. The administrator notices that R1 is sending queries but not receiving replies. Which of the following is the most likely cause?

Accepted Answer

A stuck-in-active condition is caused by a router not receiving replies to its queries, often due to a unidirectional link or a neighbor that is unable to respond.. EIGRP routers enter the ACTIVE state when they lose a route and must query neighbors for an alternative path. If a neighbor does not respond to queries, the route can become stuck-in-active. This is often due to unidirectional link failures, high CPU on the neighbor, or packet filters that allow hellos but block other EIGRP packets. The symptom of queries being sent but no replies received points directly to a communication issue in one direction.

Answer

The autonomous system number is misconfigured on R1.

Answer

An access list is blocking EIGRP multicast packets on R2's interface.

Answer

The K values for EIGRP metric calculation are mismatched between R1 and R2.

Question 19

A network administrator is troubleshooting a DMVPN Phase 3 deployment using mGRE and IPsec. Spoke-to-spoke communication is not working directly; traffic is flowing through the hub. The administrator verifies that NHRP registrations are successful and that the hub has a route to all spokes. Which two actions are required to enable direct spoke-to-spoke communication? (Choose two.)

Accepted Answer

Configure 'ip nhrp shortcut' on the spoke tunnel interfaces.. DMVPN Phase 3 requires 'ip nhrp redirect' on the hub and 'ip nhrp shortcut' on the spokes to enable direct spoke-to-spoke tunnels. The hub uses redirect to inform the originating spoke of a better path, and the spoke uses shortcut to act on that information and establish a direct tunnel to the destination spoke. Without both, traffic continues to flow through the hub.

Answer

Configure 'ip nhrp network-id' on all tunnel interfaces.

Answer

Configure 'ip nhrp shortcut' on the hub tunnel interface.

Answer

Configure 'ip nhrp map' entries for all remote spokes on each spoke.

Question 20

A network engineer is configuring a branch router to obtain its WAN interface IPv4 address from an ISP using DHCP. The provider requires the router to send a specific client identifier. Which command must be applied under the interface configuration to meet this requirement?

Accepted Answer

ip dhcp client client-id ascii BRANCH-ROUTER. The ip dhcp client client-id ascii BRANCH-ROUTER command correctly sets the DHCP client identifier to the ASCII string BRANCH-ROUTER. This is necessary when an ISP requires a specific client identifier for address assignment or authentication. The other options either configure server-side settings or request the identifier from the server, which does not meet the requirement.

Answer

ip dhcp client hostname BRANCH-ROUTER

Answer

ip dhcp client request client-id

Answer

ip dhcp pool BRANCH-ROUTER