300-410 Mock Exam 82 — 25 Questions

Question 1

A network engineer is configuring a GRE over IPsec tunnel between two Cisco routers. The engineer wants to ensure that multicast traffic, such as OSPF hello packets, is encrypted and sent over the tunnel. Which statement about the configuration is true?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The crypto ACL must permit GRE (protocol 47) traffic.. In a GRE over IPsec configuration, GRE encapsulates the multicast traffic, and then IPsec encrypts the GRE packets. The crypto ACL must match the GRE protocol (IP protocol 47) between the tunnel source and destination. This allows multicast and broadcast traffic to be carried over the tunnel because GRE handles the multicast encapsulation, and IPsec provides encryption.

Answer

IPsec must be configured in transport mode to preserve the original IP header.

Answer

The tunnel interface must be configured with the tunnel mode gre multipoint command.

Answer

The crypto ACL must permit OSPF (protocol 89) traffic.

Question 2

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPNs. The router is a PE device that must exchange VPNv4 routes with other PE routers. The administrator has enabled MPLS LDP on the core-facing interfaces and configured BGP with the address-family vpnv4. Which additional configuration is required on the PE router to properly forward MPLS VPN traffic?

Accepted Answer

Configure a VRF on the PE router and assign the customer-facing interface to it.. MPLS L3 VPN requires the PE router to have VRFs configured for each customer, with customer interfaces assigned to those VRFs. This enables the PE to maintain separate routing tables, advertise routes via MP-BGP with route targets, and impose the correct label stack for VPN traffic. Without VRFs, the PE cannot differentiate customer traffic or forward it properly.

Answer

Configure BGP route reflectors to distribute VPNv4 routes.

Answer

Enable MPLS TE on all core interfaces to establish traffic-engineered tunnels.

Answer

Enable OSPF as the IGP and configure it to carry MPLS labels.

Question 3

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH access using TACACS+ with a backup local user account. The TACACS+ server is reachable, but the engineer wants to ensure that if the TACACS+ server becomes unreachable, the router falls back to local authentication for users who are not defined on the TACACS+ server. Which AAA configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the 'group tacacs+ local' method list, which attempts TACACS+ authentication first and then falls back to the local username database if the TACACS+ server is unreachable. This ensures that administrators can still log in with locally defined credentials during a TACACS+ outage, maintaining access without compromising security.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ if-needed

Answer

aaa authentication login default group tacacs+ enable

Question 4

A network engineer is configuring SSH access on a Cisco IOS router. The engineer wants to restrict SSH access to only the management subnet 192.168.1.0/24 and ensure that only SSH version 2 is used. Which set of commands accomplishes this?

Accepted Answer

ip ssh version 2
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
 transport input ssh
 access-class 10 in. The correct configuration must set SSH version 2, create an ACL for the management subnet, apply the ACL inbound on the VTY lines, and restrict transport input to SSH only. The other options either allow other protocols, use SSH version 1, or apply the ACL in the wrong direction.

Answer

ip ssh version 2
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
 transport input ssh
 access-class 10 out

Answer

ip ssh version 2
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
 transport input all
 access-class 10 in

Answer

ip ssh version 1
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
 transport input ssh
 access-class 10 in

Question 5

A network administrator is configuring a Cisco IOS router for site-to-site VPN using DMVPN Phase 3. The administrator wants to ensure that spoke-to-spoke traffic flows directly between spokes without traversing the hub, and that the hub is only used for initial registration and route resolution. Which technology must be enabled on the spokes to achieve direct spoke-to-spoke communication?

Accepted Answer

NHRP redirect on the hub and NHRP shortcut on the spokes. DMVPN Phase 3 enables direct spoke-to-spoke communication through NHRP redirect on the hub and NHRP shortcut on the spokes. The hub sends NHRP redirect messages to spokes when it detects traffic that could be sent directly, and the spokes use NHRP shortcut to resolve the destination and build a direct tunnel. This reduces latency and hub load.

Answer

IPsec tunnel protection on the hub only

Answer

NHRP redirect on the spokes and NHRP shortcut on the hub

Answer

OSPF broadcast network type on all spokes

Question 6

A network engineer is configuring a Cisco IOS router to authenticate management users via TACACS+ using the server at 10.1.1.100 with the shared key 'Cisco123'. The engineer wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to local authentication using the local username 'admin' with password 'AdminPass'. Which configuration correctly achieves this?

Accepted Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass. The correct configuration enables AAA, defines the TACACS+ server, and configures the default authentication and authorization method lists to try TACACS+ first and then local. The VTY lines must reference the correct method list, and a local username must exist for fallback. The other options either omit fallback, reverse the order, or reference an invalid method list.

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+
aaa authorization exec default group tacacs+
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default local group tacacs+
aaa authorization exec default local group tacacs+
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
line vty 0 4
 login authentication TAC1
username admin privilege 15 secret AdminPass

Question 7

A network engineer is configuring AAA authorization on a Cisco IOS router. The engineer wants to limit which commands a user can execute after logging in via SSH. The user should be allowed to run show commands but not configuration commands. Which AAA authorization method should be used?

Accepted Answer

aaa authorization commands 15 default group tacacs+. AAA authorization for commands allows the network access server to consult the AAA server for each command entered by the user. By specifying privilege level 15, the engineer can restrict commands for users at that privilege level. The TACACS+ server can then be configured with a command set that permits show commands and denies configuration commands, achieving the desired restriction.

Answer

aaa authentication login default group tacacs+

Answer

aaa authorization network default group tacacs+

Answer

aaa authorization exec default group tacacs+

Question 8

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The engineer wants to ensure that only traffic from the 10.1.1.0/24 network to the 10.2.2.0/24 network is encrypted. Which type of ACL must be used in the crypto map to define the interesting traffic?

Accepted Answer

An extended ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24.. In Cisco IPsec configuration, the crypto map references an extended ACL to identify interesting traffic. The ACL must permit IP traffic from the local subnet to the remote subnet. This ensures that only packets matching those criteria are encrypted and sent through the VPN tunnel. Standard ACLs or overly broad ACLs are incorrect.

Answer

A standard ACL that permits the 10.1.1.0/24 network.

Answer

An extended ACL that denies IP traffic from 10.1.1.0/24 to 10.2.2.0/24.

Answer

A named ACL that permits all IP traffic.

Question 9

A network administrator is troubleshooting an MPLS L3VPN where customer routes are not being propagated between PE routers. The PE routers are Cisco IOS-XE devices running MP-BGP. Which address family must be configured on the PE routers to exchange VPNv4 prefixes?

Accepted Answer

address-family vpnv4. In MPLS L3VPN, PE routers exchange customer routes using MP-BGP with the VPNv4 address family. This address family supports the route distinguisher and route target extended communities that identify the VPN membership. Configuring address-family vpnv4 under BGP and activating it with the neighbor command allows the PE routers to exchange these prefixes, enabling end-to-end connectivity for the customer VRFs.

Answer

address-family ipv4 multicast

Answer

address-family ipv4 vrf

Answer

address-family ipv4 unicast

Question 10

A network technician is configuring a Cisco IOS router to use SSH for remote management. The technician generates an RSA key pair with 2048 bits, configures a local username and password, and enables SSH version 2. However, when attempting to connect via SSH, the connection is refused. Which additional configuration is required on the VTY lines to allow SSH access?

Accepted Answer

transport input ssh. To enable SSH on a Cisco IOS router, you must generate an RSA key pair, configure a local username and password, enable SSH version 2, and apply 'transport input ssh' on the VTY lines. Without this transport command, the router may not accept SSH connections, resulting in a refused connection. The other options either enable insecure protocols or do not address the transport mechanism.

Answer

login local

Answer

transport input all

Answer

exec-timeout 0 0

Question 11

A network technician is configuring a static route on a Cisco router to reach a remote network. The technician wants the route to be used only if the primary path fails. Which type of static route should be configured?

Accepted Answer

Floating static route. A floating static route uses a higher administrative distance to remain inactive until the primary route is lost. This allows it to serve as a backup. Default, recursive, and directly connected static routes do not provide this conditional failover behavior. The floating static route is the correct choice for a backup path.

Answer

Directly connected static route

Answer

Recursive static route

Answer

Default static route

Question 12

A network technician is configuring a Cisco IOS router to authenticate EIGRP neighbors using MD5. The router is running EIGRP AS 10. Which command enables MD5 authentication for EIGRP on an interface?

Accepted Answer

ip authentication mode eigrp 10 md5. To enable MD5 authentication for EIGRP on an interface, you must use the ip authentication mode eigrp AS-number md5 command in interface configuration mode. This sets the authentication mode to MD5. You must also configure a key chain with keys and apply it using ip authentication key-chain eigrp AS-number key-chain-name. Both sides of the link must have matching key configurations.

Answer

authentication mode eigrp 10 md5

Answer

ip eigrp authentication md5

Answer

ip authentication key-chain eigrp 10 md5

Question 13

A network engineer is configuring OSPFv2 on a multiaccess segment. The engineer wants to ensure that the designated router (DR) election is deterministic and that a specific router becomes the DR. The router has the highest OSPF priority on the segment, but it is not becoming the DR. What could be the reason?

Accepted Answer

The router is not the first to be powered on, and a DR has already been elected.. OSPF DR election is non-preemptive. Once a DR is elected, it retains the role until it fails or the OSPF process restarts. Even if a router with a higher priority joins the segment later, it will not preempt the existing DR. Therefore, the most likely reason is that a DR was already elected before this router became active. To force a new election, the OSPF process must be restarted or the interfaces reset.

Answer

The router is configured with a higher OSPF priority but is not the DR because of a mismatch in OSPF network types.

Answer

The router's OSPF priority is set to 0.

Answer

The router's router ID is lower than another router's router ID.

Question 14

A network engineer is configuring OSPF on a router that connects to a service provider via a WAN link. The provider requires that the link be treated as a point-to-point connection without DR/BDR election, and the OSPF network type must be explicitly set to achieve this. Which command should be applied to the interface?

Accepted Answer

ip ospf network point-to-point. The requirement is to treat the WAN link as a point-to-point connection without DR/BDR election. The ip ospf network point-to-point command achieves this by setting the OSPF network type to point-to-point, which disables DR/BDR election and allows direct adjacency formation. This is the standard configuration for point-to-point WAN links in OSPF.

Answer

ip ospf network broadcast

Answer

ip ospf network point-to-multipoint

Answer

ip ospf network non-broadcast

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 network using OSPF. Spoke routers are unable to form OSPF adjacencies with each other directly, even though they can reach the hub. The engineer wants to enable direct spoke-to-spoke communication. Which configuration is required on the hub?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must have ip nhrp redirect to send redirect messages to spokes, enabling them to establish direct tunnels. Spokes require ip nhrp shortcut to act on those redirects. The other options are either configured on spokes or are basic NHRP settings not specific to enabling spoke-to-spoke communication.

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Question 16

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The VPN tunnel is up, but traffic is not passing through it. The engineer suspects a routing issue. Which command should be used to verify that the remote subnet is being routed through the tunnel interface?

Accepted Answer

show ip route. To verify that the remote subnet is routed through the tunnel, the engineer should inspect the routing table with 'show ip route'. This command reveals whether a route to the remote subnet exists and whether it points to the tunnel interface or the next-hop router. If the route is missing, traffic will not be encrypted and sent through the VPN.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

show crypto isakmp sa

Question 17

A network engineer is deploying a DMVPN Phase 3 hub-and-spoke topology. The hub router must dynamically learn spoke-to-spoke routes and allow direct spoke-to-spoke tunnels. Which technology should be implemented on the hub to achieve this?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes that a more optimal path exists directly to another spoke. Spokes then use NHRP shortcut to resolve the destination's NBMA address and establish a direct tunnel. This reduces hub transit and latency. The other options are valid DMVPN features but do not provide the dynamic spoke-to-spoke capability required.

Answer

Configure NHRP authentication and NHRP map entries on all routers.

Answer

Implement IPsec tunnel protection with IKEv2 and enable QoS pre-classify.

Answer

Use OSPF broadcast network type on all tunnel interfaces and enable split horizon.

Question 18

A network engineer is implementing policy-based routing (PBR) on a Cisco router. The goal is to forward traffic from a specific source subnet to a next-hop that is not the default gateway. The engineer configures a route map with a match statement for the source subnet and a set statement for the next-hop. However, the traffic is still following the default route. What is the most likely reason?

Accepted Answer

The ip policy route-map command is not configured on the ingress interface.. Policy-based routing requires the route map to be applied to the ingress interface with the ip policy route-map command. Without this command, the route map is not evaluated, and traffic is forwarded using the normal routing table, which explains why traffic follows the default route. Other issues, such as an incorrect next-hop or missing permit statement, would cause different symptoms, such as traffic being dropped or sent to the wrong next-hop, but not reverting to the default route.

Answer

The set statement is using an incorrect next-hop address.

Answer

The route map is missing a permit statement.

Answer

The route map is not applied to the correct interface.

Question 19

A network engineer is configuring a Cisco IOS router to support MPLS Traffic Engineering (TE). The engineer has enabled MPLS TE globally and on the interfaces, and has configured a TE tunnel. However, the tunnel is not coming up. The engineer verifies that the IGP (OSPF) is advertising TE information. Which additional configuration is required to establish the TE tunnel?

Accepted Answer

Enable RSVP on the interfaces along the path.. For MPLS TE tunnels to be established, RSVP must be enabled on all interfaces that the tunnel traverses. RSVP handles the signaling and resource reservation. While the IGP advertises TE information, without RSVP the headend cannot signal the path. Therefore, enabling RSVP on the relevant interfaces is the required additional configuration.

Answer

Configure the tunnel mode to mpls traffic-eng on all routers.

Answer

Enable LDP on the TE tunnel interface.

Answer

Configure CSPF on all routers in the path.

Question 20

A network administrator is implementing IPsec VPN between two Cisco routers. The administrator wants to ensure that only specific traffic, defined by an extended access list, is encrypted and sent through the tunnel, while all other traffic is sent unencrypted. Which IPsec configuration element is used to define this traffic?

Accepted Answer

crypto access list. In Cisco IOS IPsec configuration, the crypto access list (an extended ACL) specifies the traffic that should be encrypted and tunneled. The crypto map then references this access list to apply the IPsec policies. Other components like transform sets and ISAKMP policies handle protection and negotiation, not traffic selection.

Answer

transform set

Answer

ISAKMP policy

Answer

crypto map