300-410 Mock Exam 80 — 25 Questions

Question 1

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPN. The administrator needs to enable the provider edge (PE) router to exchange VPNv4 routes with other PE routers. Which two configurations are required on the PE router to enable MP-BGP for VPNv4? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate the VPNv4 address family with 'address-family vpnv4' and activate the neighbor.. To enable MP-BGP for VPNv4 on a PE router, you must first configure a BGP session with the remote PE using 'router bgp' and 'neighbor' commands. Then, you must activate the VPNv4 address family with 'address-family vpnv4' and activate the neighbor. These two steps allow the exchange of VPNv4 routes. Other configurations like RD, RT, and LDP are important for MPLS VPN but not for enabling MP-BGP itself.

Answer

Enable MPLS LDP on the core-facing interfaces.

Answer

Configure a route target (RT) under the VRF definition.

Answer

Configure a route distinguisher (RD) under the VRF definition.

Question 2

A network engineer is configuring OSPFv3 on a dual-stack router. The router must form an adjacency with a neighbor over a link that supports both IPv4 and IPv6. The interface is configured with 'ipv6 ospf 1 area 0' and the router ID is manually set to 10.1.1.1. After applying the configuration, the engineer notices that the OSPFv3 adjacency remains in EXSTART state. What is the most likely cause?

Accepted Answer

The IPv6 MTU on the interface does not match the neighbor's interface MTU.. The EXSTART state in OSPFv3 indicates that the routers have exchanged Hello packets and are attempting to negotiate the master/slave relationship for database description exchange. A mismatch in interface MTU prevents the successful exchange of database description packets, leaving the adjacency stuck in EXSTART. Ensuring consistent MTU on both sides resolves the issue.

Answer

The router ID is not unique in the OSPFv3 domain.

Answer

The OSPFv3 process is not configured with an IPv6 address family.

Answer

The neighbor router is using a different OSPFv3 process ID.

Question 3

A network engineer is configuring uRPF on a Cisco IOS router. The router has two interfaces: GigabitEthernet0/0 (WAN) and GigabitEthernet0/1 (LAN). The engineer wants to prevent spoofed packets from entering the WAN interface while allowing asymmetric routing. Which uRPF mode should be configured on GigabitEthernet0/0?

Accepted Answer

Loose mode. Loose mode uRPF allows asymmetric routing because it only checks that the source address is present in the routing table, regardless of the incoming interface. Strict mode would require the source to be reachable via the same interface, which would break asymmetric routing. Therefore, loose mode is correct.

Answer

Feasible path uRPF

Answer

VRF mode

Answer

Strict mode

Question 4

A network engineer is configuring a Cisco IOS router to use IPsec VPN with IKEv2. The engineer wants to ensure that the router prefers a specific transform set that includes AES-256 encryption and SHA-256 hashing for integrity. Which command correctly defines the IKEv2 proposal with these parameters?

Accepted Answer

crypto ikev2 proposal PROPOSAL1
 encryption aes-cbc-256
 integrity sha256
 group 14. IKEv2 proposals define the encryption, integrity, and Diffie-Hellman group parameters. The correct command is crypto ikev2 proposal, followed by encryption aes-cbc-256, integrity sha256, and group 14. This proposal can then be referenced in an IKEv2 policy. The other options use incorrect commands or syntax for IKEv2.

Answer

crypto ikev2 policy POLICY1
 encryption aes-256
 hash sha256
 group 14

Answer

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14

Answer

crypto ikev2 profile PROFILE1
 encryption aes-cbc-256
 integrity sha256
 group 14

Question 5

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins against an external TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. Which configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct command is 'aaa authentication login default group tacacs+ local'. It configures the default method list to try TACACS+ first and then the local database if the server is unreachable. This ensures administrative SSH logins are authenticated externally when possible, but local fallback maintains access during server outages. The order of methods is critical: listing 'local' first would bypass the TACACS+ server.

Answer

aaa authentication login default group radius local

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Question 6

A network engineer is implementing DMVPN Phase 3 with IPsec tunnel protection. The hub router must be configured to support NHRP redirect. Which command is required on the hub's tunnel interface?

Accepted Answer

ip nhrp redirect. The ip nhrp redirect command on the hub's tunnel interface is required for DMVPN Phase 3. It allows the hub to inform spokes about a better path when traffic is received on the same interface, prompting the spoke to initiate a direct tunnel. Without this command, the hub cannot send redirect messages, and spoke-to-spoke tunnels will not form dynamically.

Answer

ip nhrp shortcut

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Question 7

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch is configured as an authenticator, and the RADIUS server is reachable. However, some devices such as printers do not support 802.1X supplicant software. The administrator wants these devices to be automatically placed into a restricted VLAN with limited access. Which feature should be configured on the switch ports to achieve this?

Accepted Answer

MAB (MAC Authentication Bypass). MAC Authentication Bypass (MAB) enables the switch to authenticate devices that do not support 802.1X by using their MAC addresses as credentials. The RADIUS server can then authorize and assign a VLAN, such as a restricted VLAN, based on the MAC address. This is the correct feature to support printers and similar devices while maintaining network access control.

Answer

Critical VLAN

Answer

802.1X supplicant mode

Answer

Web Auth

Question 8

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet 10.10.10.0/24. The engineer wants to ensure that the router provides the default gateway, DNS server, and domain name to DHCP clients. Which three commands must be configured in the DHCP pool? (Choose three.)

Accepted Answer

dns-server 8.8.8.8. The correct commands are default-router, dns-server, and domain-name. These respectively provide the default gateway, DNS server address, and domain name to DHCP clients. The network command defines the pool's subnet but does not supply those options, and the lease command sets lease duration, which is not requested.

Answer

lease 0 8

Answer

network 10.10.10.0 255.255.255.0

Question 9

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. The hub router is a Cisco IOS XE device running a recent release. The engineer notices that spoke-to-spoke traffic is still traversing the hub even though the spokes have established direct tunnels. Which technology must be enabled on the hub to allow spoke routers to dynamically discover a direct path to other spokes?

Accepted Answer

Enable NHRP redirect on the hub.. In DMVPN Phase 3, the hub uses NHRP redirect to notify a source spoke that a more optimal path exists to a destination spoke. The spoke must have NHRP shortcut enabled to act on the redirect and initiate direct tunnel creation. Together, they allow dynamic spoke-to-spoke tunnels without preconfiguration.

Answer

Enable OSPF point-to-multipoint on the hub.

Answer

Enable NHRP shortcut on the hub.

Answer

Enable IPsec tunnel protection on the hub.

Question 10

A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?

Accepted Answer

Adjust the tunnel interface MTU and TCP MSS clamping on the tunnel interface.. IPsec and GRE encapsulation add overhead, reducing the effective MTU. When large packets are sent, they may exceed the path MTU and get dropped if fragmentation is not allowed. Adjusting the tunnel interface MTU and configuring TCP MSS clamping ensures that TCP sessions negotiate a smaller MSS, preventing fragmentation and packet loss while keeping the VPN secure.

Answer

Enable path MTU discovery (PMTUD) on the tunnel and rely on ICMP unreachable messages.

Answer

Increase the IP MTU on the physical interface to accommodate larger packets.

Answer

Disable IPsec encryption on the tunnel to eliminate overhead.

Question 11

A network administrator is configuring IPsec VPN on a Cisco IOS router using IKEv2. The administrator wants to ensure that the IKEv2 proposal includes encryption and integrity algorithms that are considered secure. Which two algorithms should be included in the IKEv2 proposal? (Choose two.)

Accepted Answer

SHA-256 for integrity. For a secure IKEv2 proposal, encryption and integrity algorithms must be strong. AES-CBC-256 provides robust encryption, and SHA-256 offers secure integrity protection. These are both recommended in modern Cisco IOS configurations. 3DES and DES are weak encryption algorithms, and MD5 is an insecure integrity algorithm. Therefore, the correct choices are AES-CBC-256 and SHA-256.

Answer

3DES for encryption

Answer

MD5 for integrity

Answer

DES for encryption

Question 12

A network administrator is troubleshooting a DMVPN Phase 3 configuration on a Cisco IOS router. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels; all traffic between spokes is going through the hub. The administrator verifies that NHRP registration is successful and that the hub has a mapping for each spoke. Which configuration change on the hub is required to enable spoke-to-spoke direct communication?

Accepted Answer

Configure the tunnel interface with ip nhrp redirect.. In DMVPN Phase 3, spoke-to-spoke direct tunnels are facilitated by NHRP redirects from the hub and NHRP shortcuts on spokes. The hub must be configured with ip nhrp redirect to send redirect messages when it detects traffic between spokes that could be direct. This triggers the originating spoke to request the destination spoke's NBMA address and build a direct tunnel, offloading traffic from the hub.

Answer

Configure the tunnel interface with ip nhrp shortcut.

Answer

Configure the tunnel interface with ip nhrp map multicast dynamic.

Answer

Configure the tunnel interface with ip nhrp network-id 100.

Question 13

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel only comes up when there is interesting traffic matching an extended ACL. The ACL is defined as: access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The crypto map is applied to interface GigabitEthernet0/0. Which command is required to complete the configuration so that the router considers traffic matching the ACL as interesting?

Accepted Answer

match address 100. The match address command within the crypto map entry binds the extended ACL to the crypto map, designating the traffic that should be protected by IPsec. In this scenario, the ACL 100 defines the interesting traffic between the two subnets. Without this command, the router would not know which packets to encrypt and tunnel, and the VPN would not initiate as intended.

Answer

crypto map mymap 10 ipsec-isakmp

Answer

crypto isakmp policy 10

Answer

set peer 203.0.113.2

Question 14

A network engineer is configuring a Cisco router to act as a DHCPv6 server for a dual-stack network. The engineer wants to provide IPv6 addresses to clients and also supply them with DNS server addresses. Which DHCPv6 message type should the server use to send the DNS server information to the clients?

Accepted Answer

Reply. In DHCPv6, the server uses the Reply message to deliver configuration parameters, including DNS server addresses, to clients. Clients request this information via Information-request or as part of address assignment, and the server responds with a Reply. The other message types serve different purposes in the DHCPv6 protocol exchange.

Answer

Solicit

Answer

Advertise

Answer

Information-request

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 deployment on a Cisco IOS XE router. The hub router is configured with 'ip nhrp redirect' and the spoke routers with 'ip nhrp shortcut'. However, spoke-to-spoke traffic is still traversing the hub. Which action should the engineer take to enable direct spoke-to-spoke communication?

Accepted Answer

Ensure that the spoke routers have a route to the spoke networks via the tunnel interface and that NHRP resolution is working.. Spoke-to-spoke shortcuts in DMVPN Phase 3 require that spokes have a route to the destination network via the tunnel interface and that NHRP resolution succeeds. The hub uses NHRP redirect to tell the spoke that a better path exists, and the spoke uses NHRP shortcut to install a direct entry. Without these, traffic continues through the hub.

Answer

Configure 'ip nhrp network-id' with the same value on all routers.

Answer

Configure 'ip nhrp map multicast dynamic' on the hub.

Answer

Enable 'ip nhrp authentication' on all routers.

Question 16

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet to the 10.0.0.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which configuration element is used to define this traffic?

Accepted Answer

ACL. In Cisco IOS IPsec configuration, an extended ACL is used to identify the traffic that should be encrypted. The ACL specifies the source and destination addresses and ports. This ACL is then referenced in the crypto map, which applies the IPsec policies to matching traffic. Traffic that does not match the ACL is not encrypted and is routed normally. Therefore, the ACL is the configuration element that defines the traffic to be protected.

Answer

transform set

Answer

ISAKMP policy

Answer

crypto map

Question 17

A network engineer is configuring a Cisco IOS router to send syslog messages to a remote syslog server at 10.1.1.100. The router's loopback0 interface is 192.168.1.1. The engineer wants syslog messages to be sourced from the loopback0 interface. Which command must be configured?

Accepted Answer

logging source-interface loopback0. The logging source-interface command configures the router to use the specified interface's IP address as the source for syslog packets. Using loopback0 provides a stable, always-up source address, which simplifies syslog server configuration and ensures logs are consistently attributed to the router regardless of which physical interface sends the traffic.

Answer

logging host 10.1.1.100 transport udp port 514

Answer

logging origin-id ip

Answer

logging facility local6

Question 18

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP. Spokes are behind dynamic NAT and register with the hub using their public IP addresses. The engineer wants to ensure that spoke-to-spoke traffic can be established directly without traversing the hub. Which NHRP configuration is required on the hub to support this?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes that a more optimal path exists directly to another spoke. The hub sends an NHRP redirect message to the source spoke, which then triggers an NHRP resolution for the destination spoke's NBMA address. The spoke then establishes a direct tunnel. The hub must have ip nhrp redirect enabled, while spokes typically have ip nhrp shortcut to act on the redirect.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Question 19

A network engineer is troubleshooting an IPv4 Network Address Translation (NAT) configuration on a Cisco IOS router. The router is configured with NAT overload (PAT) using the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. Inside hosts cannot reach the Internet. The engineer verifies that interface GigabitEthernet0/0 is up and has an IP address, and that access list 1 permits the inside subnet. Which additional configuration is most likely missing?

Accepted Answer

The ip nat inside command on the LAN interface and ip nat outside on the WAN interface.. NAT requires interfaces to be marked as inside or outside. Without these designations, the router cannot determine which traffic to translate. The NAT statement and access list alone are insufficient. The other options are either unnecessary for PAT or not directly related to the NAT configuration issue.

Answer

The ip nat inside source static command to create a static translation.

Answer

The ip route  0.0.0.0 0.0.0.0 GigabitEthernet0/0 command to provide a default route.

Answer

The ip nat pool command to define a pool of public addresses.

Question 20

A router running Cisco IOS XE has a VRF-aware DMVPN phase 3 tunnel interface. The network administrator wants to ensure that spoke-to-spoke traffic is switched directly between spokes when a route to the destination is present in the NHRP database. Which configuration on the hub is required to enable this behavior?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, spoke-to-spoke traffic optimization relies on the hub sending NHRP redirect messages to the ingress spoke. The hub must be configured with ip nhrp redirect to generate these messages when it receives traffic destined for a network reachable via another spoke. The spoke then uses ip nhrp shortcut to install a direct route, but the hub-side command is ip nhrp redirect.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic