300-410 Mock Exam 81 — 25 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 hub router. Spoke routers are behind dynamic NAT and cannot receive inbound connections. The engineer needs to ensure that spoke-to-spoke traffic flows directly without traversing the hub. Which technology must be enabled on the hub to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to notify a spoke that a better path exists to another spoke. The spoke then uses NHRP shortcut to resolve the destination's public address and establish a direct tunnel. Without NHRP redirect on the hub, spokes continue to send traffic through the hub even if they are capable of direct communication.

Answer

IPsec transport mode

Answer

NHRP shortcut

Answer

Multipoint GRE with dynamic routing

Question 2

A network engineer is configuring a Cisco IOS router to authenticate management users via TACACS+ against an ISE server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to using the local username database for authentication. The TACACS+ server is already configured with the address 10.1.1.100 and a shared secret. Which additional configuration is required on the router to achieve this fallback?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration is to define an AAA authentication method list that includes both TACACS+ and local. The command 'aaa authentication login default group tacacs+ local' ensures that the router first attempts authentication via TACACS+; if the server is unreachable, it then checks the local username database. This provides the required fallback and maintains security by not allowing unauthenticated access.

Answer

aaa authentication login default group tacacs+ none

Answer

tacacs-server timeout 5

Answer

tacacs-server directed-request

Question 3

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. Phase 1 is up, but Phase 2 fails to establish. The engineer suspects a mismatch in the transform set. Which command should be used to verify the transform set configured for the crypto map on the local router?

Accepted Answer

show crypto map. To verify the transform set configured in a crypto map, the show crypto map command is used. It displays the crypto map entries, including the transform set name, peer, and ACL. This allows the engineer to confirm the local configuration and compare it with the remote peer to identify mismatches.

Answer

show crypto ipsec transform-set

Answer

show crypto isakmp sa

Answer

show crypto ipsec sa

Question 4

A network administrator is troubleshooting an OSPFv3 network. Router R1 is not forming an adjacency with Router R2 over a point-to-point link. The administrator verifies that the interfaces are up, IPv6 addresses are configured, and OSPFv3 is enabled on both interfaces. The output of 'show ipv6 ospf interface' on R1 shows that the interface is in the 'LOOPBACK' state. What is the most likely reason for this state?

Accepted Answer

There is a duplicate router ID on the network, and R1 has detected its own router ID in a hello packet from R2.. The LOOPBACK state on an OSPFv3 interface indicates that the router has received a hello packet containing its own router ID. This is a safeguard against duplicate router IDs. When two routers on the same link share the same router ID, they will not form an adjacency, and the interface will remain in LOOPBACK state. The administrator should check the router ID configuration on both routers and ensure they are unique.

Answer

The interface is configured as a passive interface under the OSPFv3 process.

Answer

The interface is configured as a loopback interface instead of a point-to-point interface.

Answer

The OSPFv3 process is not enabled on the interface, causing it to be placed in the LOOPBACK state.

Question 5

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which crypto ACL configuration achieves this?

Accepted Answer

access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The correct crypto ACL is a single permit statement for the specific source and destination subnets. Because ACLs have an implicit deny at the end, all other traffic is not matched and therefore not encrypted. This precisely meets the requirement to encrypt only the specified traffic.

Answer

access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 100 deny ip any any

Answer

access-list 100 permit ip any any

Answer

access-list 100 deny ip any any
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Question 6

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The engineer wants to rate-limit ARP packets destined to the route processor to 1000 packets per second, with a burst of 2000 packets. Which CoPP policy configuration accomplishes this?

Accepted Answer

class-map match-all ARP-CLASS
 match protocol arp
policy-map COPP-POLICY
 class ARP-CLASS
  police 1000 2000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP-POLICY. The correct configuration uses a class-map with 'match protocol arp', a policy-map with 'police 1000 2000', and applies the policy to the control plane with 'service-policy input COPP-POLICY'. This effectively rate-limits ARP packets destined to the route processor. The other options misapply the service policy to an interface, use an invalid access list for ARP, or apply it in the wrong direction.

Answer

class-map match-all ARP-CLASS
 match protocol arp
policy-map COPP-POLICY
 class ARP-CLASS
  police 1000 2000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input COPP-POLICY

Answer

class-map match-all ARP-CLASS
 match access-group 101
access-list 101 permit arp any any
policy-map COPP-POLICY
 class ARP-CLASS
  police 1000 2000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP-POLICY

Answer

class-map match-any ARP-CLASS
 match protocol arp
policy-map COPP-POLICY
 class ARP-CLASS
  police 1000 2000 conform-action transmit exceed-action drop
control-plane
 service-policy output COPP-POLICY

Question 7

A network administrator is configuring a site-to-site VPN on a Cisco IOS router using IPsec. The administrator wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent over the VPN tunnel. Which configuration component is used to define the interesting traffic?

Accepted Answer

access list. An access list is used to define interesting traffic for an IPsec VPN. It specifies the source and destination addresses and protocols that should be encrypted. The crypto map references this ACL to determine which packets to encrypt and send through the tunnel. The transform set and ISAKMP policy define security parameters but do not select traffic.

Answer

ISAKMP policy

Answer

transform set

Answer

crypto map

Question 8

A network engineer is configuring a Cisco IOS router for IPv6 First Hop Security. The requirement is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. The engineer has already enabled IPv6 snooping on the VLAN. Which additional feature should be configured to meet this requirement?

Accepted Answer

IPv6 DHCPv6 Guard. DHCPv6 Guard is specifically designed to block DHCPv6 server messages on untrusted ports, ensuring that only authorized DHCPv6 servers can assign addresses. With IPv6 snooping already enabled, configuring DHCPv6 Guard on the VLAN provides the necessary protection against rogue servers. Other First Hop Security features address different threats and do not fulfill this requirement.

Answer

IPv6 ND Inspection

Answer

IPv6 Destination Guard

Answer

IPv6 Source Guard

Question 9

A network engineer is troubleshooting an MPLS L3VPN where customer routes are not being advertised between PE routers. The engineer verifies that the VRFs are configured correctly and that MPLS forwarding is operational. Which MP-BGP configuration is required to exchange VPNv4 routes between PE routers?

Accepted Answer

address-family vpnv4 unicast. To exchange VPNv4 routes between PE routers, MP-BGP must be configured with the address-family vpnv4 unicast. This address family carries the VPN-specific attributes, including route targets and the VPN label. Once activated, BGP can advertise and receive VPNv4 prefixes, allowing PEs to import routes into the correct VRFs. The other options are either for different address families or are supporting commands that do not by themselves enable VPNv4 route exchange.

Answer

neighbor x.x.x.x activate

Answer

address-family ipv4 unicast

Answer

neighbor x.x.x.x send-community extended

Question 10

An engineer is configuring a GRE tunnel between two Cisco routers. The tunnel source is a physical interface, and the tunnel destination is the remote router's physical interface. After configuration, the tunnel interface is up, but no traffic passes through it. The engineer verifies that the physical interfaces are up and IP connectivity exists between the tunnel endpoints. What is the most likely cause?

Accepted Answer

There is no route to the remote network through the tunnel.. A GRE tunnel can be up, but without a route directing traffic into the tunnel, no data will traverse it. The tunnel interface's up state only indicates that the tunnel source and destination are reachable and the tunnel is operational. Routing is still required to forward traffic. Therefore, the absence of a route to the remote network via the tunnel is the most likely cause.

Answer

The tunnel destination is not reachable.

Answer

The tunnel keepalive is misconfigured.

Answer

The tunnel interface is missing an IP address.

Question 11

A network engineer is implementing MPLS Layer 3 VPN on a Cisco IOS-XE router. The engineer needs to configure the PE router to exchange VPNv4 routes with other PE routers. Which address family must be configured under the BGP routing process to enable VPNv4 route exchange?

Accepted Answer

address-family vpnv4. In MPLS Layer 3 VPN, PE routers exchange VPNv4 routes using the VPNv4 address family under BGP. This address family carries the route distinguisher and extended communities (like route targets) that identify the VPN membership. Configuring 'address-family vpnv4' is essential for the PE routers to exchange customer routes and maintain separate routing tables.

Answer

address-family ipv6 vpnv4

Answer

address-family ipv4 vrf

Answer

address-family ipv4 unicast

Question 12

A network security engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against denial-of-service attacks. The engineer wants to classify and police traffic destined to the route processor. Which two types of traffic should be considered for policing? (Choose two.)

Accepted Answer

Management traffic (e.g., SSH, SNMP). CoPP is used to protect the route processor from excessive traffic that could cause high CPU utilization. The most critical types of traffic to police are those destined to the control plane, such as routing protocol updates and management traffic (SSH, SNMP, etc.). These are essential for network operation but can be exploited in DoS attacks. Transit traffic, ARP, and IPsec data traffic are not primary control plane traffic and should be handled by other mechanisms.

Answer

ARP requests and replies

Answer

User data traffic transiting the router

Answer

IPsec encrypted traffic

Question 13

A network engineer is configuring a Cisco IOS router to authenticate management access using TACACS+. The TACACS+ server is reachable at 10.1.1.100. The engineer wants to ensure that if the TACACS+ server becomes unavailable, the router will fall back to using the local username database for authentication. Which command sequence correctly configures this fallback?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the default method list with TACACS+ first and local second. This ensures that if the TACACS+ server is unreachable, the router will use the local username database for authentication, maintaining management access. The other options either use the wrong fallback method, reverse the order, or disable authentication entirely.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ enable

Question 14

A network engineer is configuring DMVPN Phase 3 on a hub router. The hub has a public IP address and is reachable. Spokes are behind NAT devices and have dynamic public IP addresses. Which technology allows spokes to communicate directly without routing traffic through the hub?

Accepted Answer

NHRP shortcut. In DMVPN Phase 3, NHRP shortcut enables direct spoke-to-spoke tunnels. When a spoke sends traffic to another spoke via the hub, the hub sends an NHRP redirect, and the spoke then uses NHRP shortcut to establish a direct tunnel.

Answer

NHRP redirect

Answer

NHRP resolution

Answer

NHRP registration

Question 15

A network engineer is configuring OSPFv3 on a Cisco IOS XE router. The router has two interfaces: GigabitEthernet0/0 in Area 0 and GigabitEthernet0/1 in Area 1. The engineer wants to ensure that the router acts as an ABR and that inter-area routes are summarized. Which command must be configured under the OSPFv3 router configuration mode to enable ABR functionality?

Accepted Answer

No additional command is required; ABR is automatic.. ABR status in OSPFv3 is not enabled by a command; it is a role that a router assumes when it has interfaces in multiple areas. The engineer must ensure that the interfaces are assigned to different areas, which is already the case. Commands like area range are used for summarization but do not enable ABR. The router ID is necessary for OSPFv3 operation but not for ABR functionality. Therefore, no additional command is required to make the router an ABR.

Answer

area 1 range 2001:db8:1::/64

Answer

router-id 1.1.1.1

Answer

interface GigabitEthernet0/1

Question 16

A network engineer is configuring DHCPv6 on a Cisco IOS-XE router. The router must provide IPv6 addresses and other configuration parameters to clients on the LAN. The engineer wants the router to assign addresses using stateless address autoconfiguration (SLAAC) but also provide DNS server information via DHCPv6. Which command set correctly configures the router's LAN interface to achieve this?

Accepted Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd other-config-flag
ipv6 dhcp server POOL. The other-config-flag in router advertisements signals hosts to use DHCPv6 for additional configuration parameters, while addresses are still autoconfigured via SLAAC. The ipv6 dhcp server command attaches the DHCPv6 pool to the interface. The managed-config-flag would force hosts to use DHCPv6 for addresses as well, which is not desired. Other commands like ra-interval or prefix do not control the DHCPv6 usage flags.

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 dhcp server POOL
ipv6 nd ra-interval 30

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd prefix 2001:DB8:1::/64
ipv6 dhcp server POOL

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd managed-config-flag
ipv6 dhcp server POOL

Question 17

A network administrator is deploying IPv6 First Hop Security (FHS) on a Cisco Catalyst switch to mitigate rogue Router Advertisement (RA) attacks. The switch is running Cisco IOS Software and is configured with the command ipv6 nd raguard policy POLICY1. Which additional step is required to activate RA guard on an interface?

Accepted Answer

Apply the policy to the interface using ipv6 nd raguard attach-policy POLICY1.. RA guard requires two steps: creating a policy that defines the filtering rules, and attaching that policy to an interface. The attach-policy command activates the policy on the specified interface. Other options are either unrelated features or modify trust settings, but they do not activate the policy on an interface.

Answer

Configure the interface as trusted using ipv6 nd raguard trust.

Answer

Enable IPv6 unicast routing globally with ipv6 unicast-routing.

Answer

Enable DHCPv6 snooping globally with ipv6 dhcp snooping.

Question 18

A network administrator is configuring OSPF on a Cisco router. The router is connected to two different OSPF areas: Area 0 and Area 1. The administrator wants to summarize routes from Area 1 into Area 0. Which command should be used on the Area Border Router (ABR) to accomplish this?

Accepted Answer

area 1 range 10.1.0.0 255.255.0.0. Inter-area route summarization in OSPF is performed on ABRs using the 'area range' command. The area specified is the source area from which routes are summarized. In this case, routes from Area 1 are summarized before being advertised into Area 0. This reduces the number of LSAs and routing entries, improving scalability. The other commands either summarize external routes or apply to the wrong area, and thus do not meet the requirement.

Answer

summary-address 10.1.0.0 255.255.0.0

Answer

ip summary-address ospf 1 10.1.0.0 255.255.0.0

Answer

area 0 range 10.1.0.0 255.255.0.0

Question 19

A network technician is configuring SSH access on a Cisco IOS router. The technician wants to ensure that only SSH version 2 is allowed and that the RSA key pair is generated with a modulus of 2048 bits. Which commands are required?

Accepted Answer

crypto key generate rsa modulus 2048
ip ssh version 2. The correct answer generates a 2048-bit RSA key and sets SSH to version 2. This satisfies both the key size and protocol version requirements. The other options either use the wrong key size or configure SSH version 1, which is insecure. It is important to generate the key before enabling SSH, and version 2 should be enforced for security.

Answer

crypto key generate rsa general-keys modulus 2048
ip ssh version 1

Answer

ip ssh version 2
crypto key generate rsa modulus 4096

Answer

crypto key generate rsa modulus 1024
ip ssh version 2

Question 20

A network administrator is configuring DMVPN Phase 3 with a hub-and-spoke topology. The administrator wants to enable spoke-to-spoke communication directly without traversing the hub. Which command must be configured on the hub router to allow spoke-to-spoke tunnels?

Accepted Answer

ip nhrp redirect. The correct answer is 'ip nhrp redirect' on the hub. In DMVPN Phase 3, the hub uses NHRP redirect messages to inform spokes about a better direct path to other spokes. When a spoke receives a redirect, it can establish a direct tunnel to the destination spoke, reducing latency and hub load. This command is essential on the hub to enable this behavior. The spoke routers must also have 'ip nhrp shortcut' configured to act on the redirects.

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic