300-410 Mock Exam 79 — 25 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spoke routers are behind dynamic NAT and cannot be reached directly. The engineer wants spoke-to-spoke traffic to bypass the hub after initial resolution. Which NHRP command on the spoke routers enables this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 3, the hub uses ip nhrp redirect to inform a spoke that a better path exists directly to another spoke. The spoke must have ip nhrp shortcut enabled to act on that redirect and install a direct tunnel. Together, these commands allow spoke-to-spoke traffic to bypass the hub after the initial packet flow, reducing latency and hub load.

Answer

ip nhrp redirect

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Question 2

A network engineer is configuring a site-to-site DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly without traffic traversing the hub. Which command must be configured on the hub to enable spoke-to-spoke direct tunnels?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send NHRP redirect messages to spokes when it receives traffic destined for another spoke. The spokes must also have ip nhrp shortcut to act on those redirects and establish direct tunnels. The redirect on the hub is essential for signaling the availability of a better path.

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp shortcut

Question 3

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The administrator wants to rate-limit ICMP echo requests destined to the router itself to 64 kbps, while allowing all other traffic to the control plane without restriction. Which configuration snippet correctly achieves this?

Accepted Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
!
control-plane
 service-policy input COPP. The correct configuration creates a class map matching ICMP traffic via an ACL, a policy map that polices that class to 64 kbps, and leaves the class-default without a policer. Applying the policy map to the control-plane in the input direction enforces the rate limit on ICMP traffic destined to the router while allowing all other control plane traffic unrestricted.

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
  police 8000
!
control-plane
 service-policy input COPP

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
  police 8000000
!
control-plane
 service-policy input COPP

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000 conform-action transmit exceed-action drop
 class class-default
  police 64000
!
control-plane
 service-policy output COPP

Question 4

A network engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 (WAN) and GigabitEthernet0/1 (LAN). The engineer wants to apply strict mode uRPF on the WAN interface and loose mode uRPF on the LAN interface. Which two commands are required to accomplish this? (Choose two.)

Accepted Answer

interface GigabitEthernet0/0, then ip verify unicast source reachable-via rx. The correct commands are to enable strict mode uRPF on the WAN interface with ip verify unicast source reachable-via rx, and loose mode uRPF on the LAN interface with ip verify unicast source reachable-via any. These configurations match the requirement of strict on WAN and loose on LAN, providing effective anti-spoofing while accommodating asymmetric routing on the LAN.

Answer

interface GigabitEthernet0/0, then ip verify unicast source reachable-via any

Answer

interface GigabitEthernet0/1, then ip verify unicast source reachable-via rx

Answer

ip verify unicast source reachable-via rx allow-default

Question 5

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spoke routers are behind dynamic NAT and cannot be reached directly. The engineer wants spoke-to-spoke traffic to bypass the hub after initial resolution. Which NHRP command on the spoke routers enables this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NHRP redirect and shortcut switching. In DMVPN Phase 3, the hub uses NHRP redirect to notify a spoke that a more optimal path exists to the destination. The spoke then sends an NHRP resolution request for the destination spoke's NBMA address and, upon receiving a reply, builds a direct mGRE tunnel. This reduces latency and hub load by allowing direct spoke-to-spoke traffic.

Answer

NHRP holdtime and registration

Answer

NHRP server-only and client-only configuration

Answer

NHRP authentication and mapping

Question 6

A network administrator is troubleshooting a DMVPN Phase 3 network using OSPF. Spoke routers are not learning routes from other spokes despite having a full mesh of tunnels. The hub is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'. Which action is most likely to resolve the issue?

Accepted Answer

Verify that the spoke routers have a route to the other spokes' tunnel endpoints via the hub, and that NHRP resolution is working.. In DMVPN Phase 3, spoke-to-spoke communication relies on NHRP shortcut resolution. For this to work, spokes must have a route to the other spokes' NBMA addresses (typically via the hub) and NHRP must be able to resolve their IP addresses. If NHRP resolution fails or there is no route to the NBMA address, the shortcut tunnel is not built, and traffic continues via the hub. Thus, verifying NHRP resolution and routing is essential.

Answer

Ensure that the hub is configured with 'ip nhrp map multicast dynamic' and spokes with 'ip nhrp map multicast <hub>'.

Answer

Configure 'ip ospf network broadcast' on all tunnel interfaces.

Answer

Enable OSPF point-to-multipoint network type on all tunnel interfaces.

Question 7

A network technician is configuring a Cisco IOS router to act as a DHCP server for a subnet. The technician wants the router to exclude a range of addresses from being assigned to clients. Which command should be used to exclude the addresses?

Accepted Answer

ip dhcp excluded-address

. The correct command to exclude IP addresses from DHCP assignment is 'ip dhcp excluded-address' configured in global configuration mode. This command specifies a range of addresses that the DHCP server will not lease to clients. Other variations either do not exist or are configured in the wrong mode.

Answer

ip dhcp pool excluded-address

Answer

ip dhcp excluded-address

inside the interface configuration

Answer

ip dhcp exclude

Question 8

A network engineer is configuring a Cisco router to act as a DHCP server for a remote subnet. The router's interface connected to the remote subnet is configured with the `ip helper-address` command pointing to the DHCP server. However, clients on the remote subnet are not receiving IP addresses. The engineer verifies that the DHCP server is operational and has a valid pool for the remote subnet. What is the most likely cause of the problem?

Accepted Answer

The DHCP server does not have a route back to the remote subnet.. When using `ip helper-address` to forward DHCP requests to a server on a different subnet, the DHCP server must have a route back to the client subnet. The server uses this route to send DHCPOFFER and DHCPACK messages. Without it, the server cannot reach the clients, and they will not receive IP addresses. Ensuring the server has a route to the remote subnet resolves the issue.

Answer

The `ip helper-address` command is applied to the wrong interface.

Answer

The router's interface connected to the remote subnet is down.

Answer

The DHCP server is configured with a different subnet mask than the clients.

Question 9

A network engineer is configuring EIGRP on a Cisco router. The router has two interfaces: GigabitEthernet0/0 with IP address 10.1.1.1/24 and GigabitEthernet0/1 with IP address 10.2.2.1/24. The engineer wants to advertise both networks into EIGRP AS 100. Which configuration command is required to enable EIGRP on the interfaces?

Accepted Answer

network 10.1.1.0 0.0.0.255 and network 10.2.2.0 0.0.0.255. To enable EIGRP for IPv4 on interfaces, you use the network command under router eigrp with a wildcard mask. Each network statement specifies a range of addresses; the wildcard mask 0.0.0.255 matches a /24 subnet. Two statements are needed to cover both 10.1.1.0/24 and 10.2.2.0/24. The other options are either too broad, invalid syntax, or for IPv6.

Answer

network 10.0.0.0

Answer

ipv6 eigrp 100 on each interface

Answer

network 10.0.0.0 0.255.255.255

Question 10

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to use a pre-shared key for authentication. Which command is used to configure the pre-shared key on the router?

Accepted Answer

crypto isakmp key MYKEY address 192.168.1.1. Pre-shared key authentication in IKE is configured using the 'crypto isakmp key' command, which specifies the key and the peer address. This command is separate from the ISAKMP policy that defines the authentication method. Both peers must have the same pre-shared key for Phase 1 to succeed. The key is used during the IKE authentication exchange.

Answer

crypto ipsec key MYKEY

Answer

crypto isakmp policy 10 authentication pre-share

Answer

crypto map MYMAP 10 set peer 192.168.1.1

Question 11

A network engineer is configuring a static route on a Cisco IOS router to reach a remote network. The engineer wants the route to be used only if the primary path fails and to be removed from the routing table when the primary path is available. Which type of static route should be configured?

Accepted Answer

Floating static route. A floating static route is designed to be a backup by setting a higher administrative distance than the primary route. It remains inactive until the primary route is removed from the routing table, at which point it becomes active. This provides redundancy without manual intervention, exactly matching the scenario's requirement.

Answer

Default static route

Answer

Recursive static route

Answer

Directly connected static route

Question 12

A network administrator is troubleshooting an IPsec site-to-site VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The administrator suspects a routing issue. Which command should be used to verify that the crypto ACL matches the traffic being sent?

Accepted Answer

show access-lists. When an IPsec tunnel is up but traffic is not passing, a common cause is a mismatch between the crypto ACL and the actual traffic. The crypto ACL defines interesting traffic that should be encrypted. By using 'show access-lists', you can see if the ACL's permit entries are being hit by the traffic. If counters are not incrementing, the traffic is not matching the ACL, and you need to adjust it.

Answer

show crypto ipsec sa

Answer

show crypto isakmp sa

Answer

show crypto map

Question 13

A network administrator is configuring MPLS Layer 3 VPN on a Cisco IOS XE router. The router is a PE device connected to two CE routers in different VRFs. The administrator wants to prevent routes from one VRF from being leaked into another VRF. Which configuration step is essential to maintain VRF separation?

Accepted Answer

Configure route targets (RTs) for import and export on each VRF.. In MPLS Layer 3 VPN, VRF separation is achieved through the use of route targets (RTs). Each VRF is configured with import and export RTs. When a route is exported from a VRF, it is tagged with the export RT. The receiving PE imports the route into a VRF only if the route's RT matches the VRF's import RT. Therefore, to prevent leaking, each VRF must have unique RTs that are not shared with other VRFs.

Answer

Enable OSPF as the PE-CE routing protocol and use different process IDs.

Answer

Assign a unique route distinguisher (RD) to each VRF.

Answer

Configure BGP neighbor statements with different autonomous system numbers.

Question 14

A network engineer is configuring OSPFv3 on a router that connects to an IPv6 network. The router must form an adjacency with a neighbor on the same segment, but the engineer notices that the router is not sending any OSPFv3 Hello packets. The interface is up, and IPv6 unicast routing is enabled globally. Which of the following is the most likely cause?

Accepted Answer

The OSPFv3 process is not enabled on the interface.. For OSPFv3 to operate on an interface, the interface must be explicitly enabled for OSPFv3 using the 'ipv6 ospf' command under interface configuration. Simply enabling IPv6 unicast routing and configuring an OSPFv3 process is not sufficient. Without interface enablement, no Hello packets are sent, and no adjacency can form. This is a common oversight when transitioning from OSPFv2, where network statements are used.

Answer

The interface is configured as passive.

Answer

The OSPFv3 network type is set to point-to-multipoint.

Answer

The OSPFv3 router ID is not configured.

Question 15

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spoke routers are behind dynamic NAT and cannot be reached directly. The engineer wants spoke-to-spoke traffic to bypass the hub after initial resolution. Which NHRP command on the spoke routers enables this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes about a more optimal path to another spoke, and spokes use NHRP shortcut to install a direct route. The hub must have ip nhrp redirect configured on its tunnel interface. The other options are either spoke-side commands or general NHRP parameters that do not enable Phase 3 behavior.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 16

A network administrator is configuring EIGRP on a router and wants to ensure that only a specific subnet is advertised out of an interface. The router has the following configuration: 'router eigrp 100', 'network 10.0.0.0', 'passive-interface GigabitEthernet0/0'. The administrator wants to advertise 10.1.1.0/24 out of GigabitEthernet0/0 while preventing other subnets from being advertised. Which configuration achieves this?

Accepted Answer

Remove the passive-interface command and configure a distribute-list outbound on GigabitEthernet0/0 to permit only 10.1.1.0/24.. To advertise a specific subnet out of an interface while suppressing others, the interface must not be passive so that EIGRP can form adjacencies and send updates. Then, an outbound distribute-list can filter the advertised routes, permitting only the desired subnet. This approach gives granular control over which routes are sent out of the interface, meeting the administrator's requirement.

Answer

Keep the passive-interface command and configure a distribute-list outbound on GigabitEthernet0/0 to permit only 10.1.1.0/24.

Answer

Remove the passive-interface command and configure a distribute-list inbound on GigabitEthernet0/0 to permit only 10.1.1.0/24.

Answer

Remove the passive-interface command and configure 'network 10.1.1.0 0.0.0.255' under router EIGRP.

Question 17

A network administrator is deploying DMVPN Phase 3 with IKEv2 IPsec protection. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Spoke routers register with the hub and can communicate directly with each other. The administrator wants to ensure that spoke-to-spoke traffic is encrypted. Which statement about the IPsec configuration is true?

Accepted Answer

A single IPsec profile on the hub and spokes can protect both hub-to-spoke and spoke-to-spoke traffic.. In DMVPN Phase 3, the same IPsec profile applied to the multipoint GRE tunnel interface on all routers (hub and spokes) protects all traffic, including spoke-to-spoke. When a spoke initiates a direct tunnel to another spoke, the IPsec session is established using the same profile. This uniform configuration is a primary benefit of DMVPN, allowing scalable and secure any-to-any connectivity.

Answer

IPsec must be configured on the physical interfaces of the spokes.

Answer

IPsec encryption for spoke-to-spoke traffic requires a separate IPsec profile on each spoke.

Answer

Spoke-to-spoke traffic bypasses IPsec encryption because it does not traverse the hub.

Question 18

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins against an external TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, a locally configured fallback account can still be used. The TACACS+ server IP is 10.1.1.100 and the shared key is 'Cisco123'. Which configuration snippet correctly implements this requirement?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123. The correct configuration enables AAA, defines a TACACS+ server, and sets the default login authentication method list to 'group tacacs+ local'. This ensures that the router first attempts to authenticate against the TACACS+ server and, if that server is unreachable, falls back to the local user database. The other options either omit the fallback, use deprecated commands, or reverse the authentication order.

Answer

aaa new-model
aaa authentication login default group tacacs+
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs-server host 10.1.1.100 key Cisco123

Answer

aaa new-model
aaa authentication login default local group tacacs+
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123

Question 19

A network engineer is configuring a GRE tunnel between two Cisco routers. The tunnel source is a physical interface, and the tunnel destination is a loopback interface on the remote router. The engineer notices that the tunnel interface is up, but line protocol is down. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable.. A GRE tunnel interface will show up/up only if the tunnel source is valid and the tunnel destination is reachable. If the destination is unreachable, the interface remains up but the line protocol goes down. The fix is to ensure that the underlay network has a route to the tunnel destination, often by advertising the loopback interface into the routing protocol or configuring a static route.

Answer

The tunnel key is mismatched.

Answer

The tunnel mode is set to GRE multipoint.

Answer

The tunnel source and destination are reversed.

Question 20

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet is encrypted and sent over the VPN, while all other traffic is sent unencrypted. Which configuration element defines the traffic to be encrypted?

Accepted Answer

crypto ACL. The crypto ACL, an extended access list, is used to define interesting traffic that should be encrypted and sent through the IPsec tunnel. It specifies the source and destination subnets and protocols. The crypto map references this ACL to match packets that require IPsec protection. Therefore, the crypto ACL is the configuration element that defines the traffic to be encrypted.

Answer

ISAKMP policy

Answer

crypto map

Answer

transform set