300-410 Mock Exam 78 — 25 Questions

Question 1

A network engineer is configuring a Cisco router to support MPLS Layer 3 VPNs. The engineer needs to enable the router to exchange VPNv4 routes with a provider edge (PE) router. Which address family must be configured under the BGP routing process to support this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

address-family vpnv4 unicast. MPLS Layer 3 VPNs rely on BGP VPNv4 address family to exchange VPN routes between PE routers. The VPNv4 address family carries the route distinguisher and route target attributes that identify the VPN membership. Other address families serve different purposes, such as IPv4 unicast for global routing or IPv4 VRF for per-VRF routing, but not for PE-to-PE VPN route exchange.

Answer

address-family ipv4 unicast

Answer

address-family ipv6 unicast

Answer

address-family ipv4 vrf

Question 2

A network engineer is deploying MPLS Layer 3 VPNs. The engineer must ensure that the PE routers can forward VPN traffic correctly. The following configuration is applied on a PE router:

ip vrf CUSTOMER
 rd 65000:1
 route-target export 65000:1
 route-target import 65000:1
!
interface GigabitEthernet0/1
 ip vrf forwarding CUSTOMER
 ip address 192.168.1.1 255.255.255.0

After configuration, the engineer notices that the CE router cannot reach remote sites. The MPLS core is operational, and MP-BGP is configured. What is the most likely missing configuration?

Accepted Answer

The BGP process must be configured with address-family ipv4 vrf CUSTOMER and the necessary redistribution or network statements.. In MPLS L3 VPN, the PE router must have a BGP address-family ipv4 vrf for each VRF to exchange VPN routes with other PE routers. The VRF definition and interface assignment are necessary but not sufficient. Without the address-family configuration and route redistribution or network statements, the PE will not advertise the customer routes, and remote sites will be unreachable.

Answer

The route-target must be configured under the interface GigabitEthernet0/1.

Answer

The PE router must have a route distinguisher configured under the BGP process.

Answer

The PE router must have a loopback interface configured and used for BGP peering.

Question 3

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. Spokes are behind NAT devices and have dynamically assigned public IP addresses. The engineer wants to ensure that spoke-to-spoke traffic can be established directly without traversing the hub. Which technology should be implemented on the hub to achieve this?

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to signal spokes about a better path to another spoke. The spoke then uses NHRP shortcut to establish a direct tunnel. The question asks what to implement on the hub, so NHRP redirect is correct. NHRP shortcut is on the spoke, IPsec tunnel protection is for encryption, and multicast replication is for routing protocol support.

Answer

IPsec tunnel protection

Answer

NHRP shortcut

Answer

Multicast replication

Question 4

A network engineer is configuring DMVPN Phase 3 with IKEv2. The hub router is a Cisco IOS XE device, and the goal is to allow spoke-to-spoke traffic to bypass the hub after initial registration. Which command must be configured on the hub to enable NHRP redirects?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirects to inform spokes about a better path to reach another spoke. The 'ip nhrp redirect' command on the hub enables this behavior. Combined with 'ip nhrp shortcut' on the spokes, it allows dynamic direct tunnels. Without the redirect on the hub, spokes continue to route traffic through the hub even if a direct path exists.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 5

A network technician is configuring a Cisco router to act as a DHCP relay agent. The router's interface GigabitEthernet0/0 is connected to a subnet where clients need to obtain IP addresses from a DHCP server located on a different subnet. Which command is required on the router to enable DHCP relay?

Accepted Answer

ip helper-address. To configure a Cisco router as a DHCP relay agent, the 'ip helper-address' command must be applied to the interface receiving the DHCP broadcasts. This command specifies the IP address of the DHCP server. The router then forwards the DHCP requests as unicasts to that server. Other commands like 'ip forward-protocol' or 'ip dhcp pool' serve different purposes and are not used to enable relay.

Answer

ip dhcp pool

Answer

ip dhcp relay

Answer

ip forward-protocol udp

Question 6

A network technician is configuring a GRE tunnel between two routers. The tunnel source is a physical interface, and the tunnel destination is a loopback interface on the remote router. The technician notices that the tunnel interface is up, but line protocol is down. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable.. A GRE tunnel interface will be in up/down state if the tunnel source is operational but the destination is unreachable. The router brings up the tunnel interface because the source is up, but the line protocol remains down until a route to the destination is available. Ensuring reachability to the tunnel destination resolves the issue.

Answer

The tunnel mode is set to GRE multipoint.

Answer

The tunnel source interface is shutdown.

Answer

The tunnel keepalive is misconfigured.

Question 7

A network technician is configuring a Cisco router to forward traffic to a remote network. The technician enters the command 'ip route 172.16.0.0 255.255.0.0 10.0.0.1'. However, the router does not install the route in its routing table. What is the most likely reason?

Accepted Answer

The next-hop address 10.0.0.1 is not reachable.. A static route is only installed in the routing table if its next-hop address is reachable. If the next-hop 10.0.0.1 is not reachable (e.g., no route to it, or interface down), the route will not be installed. The default administrative distance is low, the mask is correct, and the 'permanent' keyword is not required for installation. Therefore, the most likely cause is an unreachable next-hop.

Answer

The administrative distance of the static route is too high.

Answer

The subnet mask is incorrect.

Answer

The static route is missing the 'permanent' keyword.

Question 8

A network engineer is configuring a Cisco router to support MPLS Layer 3 VPNs. The engineer needs to enable the router to exchange VPNv4 routes with a provider edge (PE) router. Which address family must be configured under the BGP routing process to support this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload. PAT is enabled by using the overload keyword with the ip nat inside source command. When translating to an interface address, the syntax includes the interface keyword and overload. The correct command references the access list defining inside traffic, specifies the outside interface, and includes overload. Other options either use a pool, perform static translation, or omit overload, so they do not achieve PAT using the interface address.

Answer

ip nat inside source list 1 interface GigabitEthernet0/0

Answer

ip nat inside source static 10.1.1.1 203.0.113.1

Answer

ip nat inside source list 1 pool PUBLIC_POOL overload

Question 9

A network administrator is troubleshooting an OSPFv3 network. Routers R1 and R2 are in the same area and on the same broadcast segment, but they are not forming an adjacency. The administrator verifies that the interfaces are up and IPv6 addresses are configured correctly. Which command should be used to check if OSPFv3 is enabled on the interfaces?

Accepted Answer

show ipv6 ospf interface. To verify OSPFv3 interface configuration, the 'show ipv6 ospf interface' command is used. It shows whether OSPFv3 is enabled on the interface, the area, network type, and other parameters. This is the most direct way to confirm OSPFv3 is active on the interfaces.

Answer

show ipv6 protocols

Answer

show ipv6 ospf neighbor

Answer

show ipv6 ospf database

Question 10

A network engineer is troubleshooting an MPLS L3VPN where customer routes are not being advertised from one PE to another. The engineer verifies that the VRFs are configured correctly, the IGP is converged, and the PE routers have established an MP-BGP session. Which command should the engineer use to verify that the VPNv4 prefixes are being exchanged correctly?

Accepted Answer

show ip bgp vpnv4 all. To verify that VPNv4 prefixes are being exchanged between PE routers, the engineer should use show ip bgp vpnv4 all. This command displays the VPNv4 BGP table, showing all VPNv4 routes, their next-hops, labels, and route targets. It is the most direct way to confirm that MP-BGP is propagating customer VPN routes correctly.

Answer

show mpls forwarding-table

Answer

show ip route vrf <vrf-name>

Answer

show ip bgp summary

Question 11

A network administrator is troubleshooting an EIGRP network where a router is not receiving all expected routes from a neighbor. The neighbor relationship is established, and the topology table shows only a subset of routes. Which EIGRP feature could be filtering the routes?

Accepted Answer

EIGRP route filtering using distribute-list. EIGRP distribute-lists can filter routes either inbound or outbound. An inbound distribute-list applied on the local router can prevent specific routes from entering the topology table, even though the neighbor adjacency is up. This is a common cause of missing routes when the neighbor relationship is healthy. The distribute-list can use ACLs, prefix-lists, or route-maps to match and filter routes.

Answer

EIGRP variance

Answer

EIGRP authentication mismatch

Answer

EIGRP stub routing

Question 12

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that uRPF is applied in a way that allows asymmetric routing. Which uRPF mode should be configured?

Accepted Answer

Loose mode. Loose mode uRPF verifies that the source IP address is present in the routing table, but does not require the packet to arrive on the same interface as the route to the source. This allows asymmetric routing while still providing anti-spoofing protection. Strict mode would drop packets in asymmetric environments. VLAN mode and feasible path mode are not standard uRPF modes that allow asymmetric routing.

Answer

VLAN mode

Answer

Feasible path mode

Answer

Strict mode

Question 13

A network administrator is deploying DMVPN Phase 3 with IKEv2 between a hub and two spokes. The hub is configured with a dynamic multipoint VPN tunnel and uses NHRP. Spoke1 can reach Spoke2 via the hub, but direct spoke-to-spoke communication fails. The administrator verifies that NHRP registrations are successful and that the hub has routes to both spokes. Which action is most likely to enable direct spoke-to-spoke communication?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. In DMVPN Phase 3, direct spoke-to-spoke tunnels are established through NHRP. The hub must be configured with 'ip nhrp redirect' to send redirect messages to spokes, and each spoke must have 'ip nhrp shortcut' to intercept traffic and initiate NHRP resolution for the destination spoke. Without these, spokes will continue to forward traffic through the hub even though NHRP registrations succeed.

Answer

Configure the hub as a route reflector for BGP.

Answer

Disable split horizon on the hub's tunnel interface.

Answer

Configure the spokes to use the hub as the next-hop for all routes.

Question 14

A network engineer is configuring an MPLS L3VPN. The PE router is running OSPF with the CE router in VRF CUSTOMER. The engineer notices that routes from the customer are being redistributed into the provider's global OSPF process, causing instability. Which configuration change on the PE router will prevent this redistribution while still allowing customer routes to be advertised across the MPLS core?

Accepted Answer

Remove the redistribution of the VRF OSPF into the global OSPF process.. The root cause is the redistribution of the VRF OSPF into the provider's global OSPF. Removing that redistribution prevents customer routes from entering the provider's IGP, while MP-BGP can still carry the customer routes across the MPLS core as VPNv4 prefixes. This maintains customer connectivity without affecting the provider's routing stability.

Answer

Configure a distribute-list to filter the customer routes from being redistributed.

Answer

Configure the OSPF process with the capability vrf-lite command.

Answer

Change the OSPF domain-id to a unique value.

Question 15

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The customer requires that traffic for the 10.1.1.0/24 subnet be encrypted, but all other traffic must be sent unencrypted. The engineer applies a crypto map to the outside interface. Which additional configuration is required to meet this requirement?

Accepted Answer

Configure an extended ACL that permits IP traffic from 10.1.1.0/24 to the remote subnet and apply it to the crypto map as the match address.. The match address in a crypto map must reference an extended ACL that permits the traffic to be encrypted. Only traffic permitted by this ACL will be protected; all other traffic is sent unencrypted. Therefore, an extended ACL permitting the desired subnet is required.

Answer

Configure a standard ACL that permits the 10.1.1.0/24 subnet and apply it to the crypto map as the match address.

Answer

Configure a route map that matches the 10.1.1.0/24 subnet and apply it to the crypto map as the match address.

Answer

Configure an extended ACL that denies IP traffic from 10.1.1.0/24 to the remote subnet and apply it as the match address.

Question 16

A network engineer is deploying DMVPN Phase 3 with IPsec protection. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Which two statements are true regarding the configuration that must be applied to the spoke routers to enable direct spoke-to-spoke communication? (Choose two.)

Accepted Answer

The spoke must have a route to the destination spoke's tunnel network via the tunnel interface.. For DMVPN Phase 3 spoke-to-spoke communication, each spoke must have NHRP shortcut enabled to process redirect messages, and it must have a route to the destination spoke's tunnel network via the tunnel interface, typically learned through a routing protocol. These two elements allow the spoke to initiate a direct tunnel when needed.

Answer

The spoke must have NHRP redirect configured on its tunnel interface.

Answer

The spoke must have the ip nhrp map multicast dynamic command configured.

Answer

The spoke must use a different IPsec profile than the hub to avoid SA conflicts.

Question 17

A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The engineer runs `show crypto ipsec sa` and notices that the encaps/decaps counters are incrementing, but the inbound and outbound packets are being dropped. The ACL used for the VPN is `permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255`. What is the most likely cause of the dropped packets?

Accepted Answer

There is a routing issue or reverse path forwarding (RPF) check failure for the decapsulated packets.. When IPsec encaps/decaps counters increment but packets are dropped, the router is encrypting and decrypting successfully. The drop likely occurs after decryption due to a routing or RPF check failure. The decrypted packet's source address must be reachable via the interface it arrived on; if not, Unicast RPF drops it. This is a common troubleshooting scenario in IPsec VPNs.

Answer

The IPsec SA is using the wrong transform set.

Answer

The crypto map is applied to the wrong interface.

Answer

The ACL is too restrictive and does not match the actual traffic.

Question 18

A network engineer is configuring OSPF on a router with three interfaces: GigabitEthernet0/0 (10.1.1.1/24), GigabitEthernet0/1 (10.2.2.1/24), and Loopback0 (192.168.1.1/24). The engineer wants to ensure that the router ID is 192.168.1.1 and that it remains stable even if the Loopback0 interface flaps. Which command should be applied?

Accepted Answer

router ospf 1
 router-id 192.168.1.1. The router-id command under the OSPF process explicitly sets the OSPF router ID and ensures it remains stable regardless of interface state. Dynamic selection could change if the loopback flaps, leading to OSPF adjacency resets. The other options either enable OSPF on an interface or advertise a network, which do not control the router ID.

Answer

interface GigabitEthernet0/0
 ip ospf priority 1

Answer

interface Loopback0
 ip ospf 1 area 0

Answer

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

Question 19

A network engineer is deploying OSPFv3 in an IPv6 network. The engineer wants to enable OSPFv3 on a router and ensure that it can form adjacencies with neighbors. Which two commands are required on the router to enable OSPFv3 globally and on an interface? (Choose two.)

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3, you must start the OSPFv3 process with 'ipv6 router ospf 1' and then enable it on an interface with 'ipv6 ospf 1 area 0'. The other commands are either for OSPFv2, general IPv6 routing, or interface IPv6 enabling, which are not the specific OSPFv3 enabling commands.

Answer

ipv6 unicast-routing

Answer

router ospf 1

Answer

ipv6 enable

Question 20

A network engineer is configuring a Cisco router to support MPLS Layer 3 VPNs. The engineer needs to enable the router to exchange VPNv4 routes with a provider edge (PE) router. Which address family must be configured under the BGP routing process to support this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aaa authentication login default group radius local
radius server AD-SERVER
 address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
 key Cisco123. The correct configuration must use RADIUS with the standard authentication and accounting ports 1812 and 1813, and must not alter the username. The option that defines a RADIUS server group with the correct address, ports, and key, and applies it to the default login authentication list, satisfies all requirements. Other options either use the wrong protocol, legacy ports, or modify the username.

Answer

aaa authentication login default group tacacs+ local
tacacs server AD-SERVER
 address ipv4 10.1.1.50
 key Cisco123

Answer

aaa authentication login default group radius local
radius server AD-SERVER
 address ipv4 10.1.1.50 auth-port 1812 acct-port 1813
 key Cisco123
 username-case lower

Answer

aaa authentication login default group radius local
radius server AD-SERVER
 address ipv4 10.1.1.50 auth-port 1645 acct-port 1646
 key Cisco123