300-410 Device Access Control — 20 Questions

Question 1

A network engineer is troubleshooting a site-to-site VPN between two Cisco routers. The tunnel is up, but traffic is not passing. On R1, the engineer issues the command 'show crypto map' and sees that the crypto map is applied to the outbound interface. What is the most likely cause of the traffic failure?

Accepted Answer

The crypto map is applied to the wrong interface.. The crypto map must be applied to the interface through which VPN traffic exits. If it is applied to the wrong interface (e.g., a loopback or a LAN interface instead of the WAN-facing interface), the router will not encrypt outbound traffic or decrypt inbound traffic for the VPN, even though the tunnel (ISAKMP/IPsec SA) may be established. The show crypto map output confirming the map is on the outbound interface indicates a misapplication, as the correct interface is the one facing the remote peer.

Answer

The access-list in the crypto map does not permit the traffic.

Answer

The ISAKMP policy is misconfigured.

Answer

The transform set is incorrect.

Question 2

A network administrator is configuring AAA for device access on a Cisco router. After configuring the RADIUS server and AAA authentication login default group radius local, the engineer tests Telnet access and receives 'Access denied' even with correct credentials. The RADIUS server is reachable. What is the most likely cause?

Accepted Answer

The VTY lines are not configured with 'login authentication default'.. The 'login authentication default' command must be applied to the VTY lines to use the AAA authentication method set globally with 'aaa authentication login default group radius local'. Without this, the VTY lines default to using the local enable password for authentication, ignoring the AAA configuration. Since the RADIUS server is reachable and credentials are correct, the missing VTY line configuration is the most likely cause of the 'Access denied' error.

Answer

The RADIUS server shared key is incorrect.

Answer

The enable password is not set.

Answer

The 'aaa new-model' command is missing.

Question 3

An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?

Accepted Answer

The hostname and domain name are not configured.. SSH requires a fully qualified domain name (FQDN) to generate RSA keys. Without a configured hostname and domain name, the 'crypto key generate rsa' command may appear to succeed but actually generates default keys that are not bound to the router's identity, causing SSH to refuse connections. The 'ip domain-name' and 'hostname' commands are prerequisites for proper RSA key generation and SSH operation.

Answer

The VTY lines are not configured with 'transport input ssh'.

Answer

The RSA key modulus is too small.

Answer

The IP address on GigabitEthernet0/0 is not in the same subnet as the client.

Question 4

A network engineer is troubleshooting a Cisco router that is not responding to SNMP polls from a management station. The router has 'snmp-server community public RO' configured. The management station can ping the router. What is the most likely cause?

Accepted Answer

The SNMP community string is not associated with an ACL that permits the management station.. The 'snmp-server community public RO' command configures an SNMP community string but does not restrict access by default. If no access control list (ACL) is associated with the community string, the router will respond to SNMP polls from any source. However, if an ACL is implicitly or explicitly applied that does not permit the management station's IP address, the router will silently drop the SNMP requests. Since the management station can ping the router, Layer 3 connectivity is confirmed, isolating the issue to SNMP-specific access control.

Answer

The SNMP version is not configured.

Answer

The router's SNMP agent is disabled.

Answer

The management station is using the wrong SNMP port.

Question 5

An engineer configures a Cisco router with 'aaa authentication login default local' and 'aaa authorization exec default local'. The engineer then attempts to log in via the console and is prompted for a username and password. The username 'admin' with password 'cisco' is configured locally. The login fails. What is the most likely cause?

Accepted Answer

The console line is not configured with 'login authentication default'.. Option A is correct because, by default, the console line does not inherit the AAA authentication methods defined under 'aaa authentication login default local'. The 'login authentication default' command must be explicitly applied to the console line under line configuration to use the global AAA authentication method. Without it, the console line falls back to its default behavior, which does not use AAA, causing the login to fail despite the local user being configured.

Answer

The username 'admin' is not in the local database.

Answer

The password 'cisco' is incorrect.

Answer

The 'aaa new-model' command is missing.

Question 6

A network engineer is troubleshooting a Cisco router that is configured for RADIUS authentication. The engineer issues 'debug radius authentication' and sees that the RADIUS server is not responding. The router can ping the RADIUS server. What is the most likely cause?

Accepted Answer

UDP port 1812 is blocked between the router and the RADIUS server.. The RADIUS protocol uses UDP port 1812 for authentication. Since the router can ping the RADIUS server, network-layer connectivity exists, but the lack of response in the debug output indicates that the UDP packets are not reaching the server. A firewall or ACL blocking UDP 1812 between the router and the server is the most likely cause, as it prevents the RADIUS request from being received while ICMP (ping) traffic is permitted.

Answer

The RADIUS server shared key is incorrect.

Answer

The router's IP address is not in the RADIUS server's client list.

Answer

The RADIUS server is down.

Question 7

An engineer configures a Cisco router with 'ip http server' and 'ip http authentication local' for web-based management. The engineer creates a local username 'admin' with privilege level 15. However, when accessing the router via HTTP, the engineer is prompted for credentials but access is denied. What is the most likely cause?

Accepted Answer

The HTTP server is not configured with an access-class that permits the client.. The 'ip http authentication local' command requires the HTTP server to authenticate users against the local username database. However, even with valid credentials, the router's HTTP server may deny access if an access-class is applied to the HTTP server that does not permit the client's IP address. The access-class restricts which source IP addresses can connect to the HTTP server, and if the client is not in the permitted list, authentication will fail with a denial even if the username and password are correct.

Answer

The username 'admin' does not have a password.

Answer

The HTTP server is using a different port.

Answer

The 'ip http secure-server' is required for HTTP access.

Question 8

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Accepted Answer

TCP port 49 is blocked between the router and the TACACS+ server.. The 'test aaa group tacacs+ admin cisco123 new-code' command uses the 'new-code' flag, which forces the test to use the TACACS+ protocol (TCP port 49) rather than the older, less secure method. Since the router can ping the TACACS+ server, Layer 3 connectivity is fine, but a failed authentication with 'new-code' strongly indicates that TCP port 49 is blocked by a firewall or ACL between the router and the server. TACACS+ relies on TCP port 49 for all communication, so blocking this port causes immediate failure.

Answer

The TACACS+ server shared key is incorrect.

Answer

The username 'admin' does not exist on the TACACS+ server.

Answer

The TACACS+ server is not configured for the router's IP address.

Question 9

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

Accepted Answer

The local enable password is not configured.. The 'aaa authentication enable default group radius enable' command tells the router to first contact the RADIUS server for enable authentication, and if that fails, fall back to the 'enable' method (which uses the local enable password). Since the RADIUS server is reachable, the router will attempt RADIUS authentication first. If the RADIUS server does not return a successful authentication (e.g., because it is not configured to provide the enable password), the router falls back to the 'enable' method, which requires a locally configured enable password. If no local enable password is set (via 'enable password' or 'enable secret'), the fallback fails, and the user is denied access. Therefore, the most likely cause is that the local enable password is not configured.

Answer

The RADIUS server is not configured to provide the enable password.

Answer

The 'aaa authentication enable default' command is missing the 'local' keyword.

Answer

The router's enable secret is set to a different password.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0                  13   00:12:34  1      200  0  45
1   10.2.2.2                Gi0/1                  12   00:11:20  2      200  0  67
2   10.3.3.2                Gi0/2                  10   00:10:15  1      200  0  89

Based on this output, which statement is correct?

Accepted Answer

All EIGRP neighbors are fully operational with no issues.. The output shows all three EIGRP neighbors with hold timers above 0, low SRTT values (1-2 ms), RTO at 200 ms, and a Q count of 0, indicating no queued packets. These metrics confirm that the neighbors are fully operational and stable, with no packet loss, congestion, or routing issues.

Answer

The neighbor on Gi0/2 is experiencing packet loss because its hold timer is 10 seconds.

Answer

The neighbor on Gi0/0 has a high SRTT, indicating congestion.

Answer

The neighbor on Gi0/1 has a sequence number of 67, which is higher than others, indicating a routing loop.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2     1     FULL/DR        00:00:35    10.1.1.2        GigabitEthernet0/0
192.168.2.2     1     2WAY/DROTHER   00:00:32    10.2.2.2        GigabitEthernet0/1
192.168.3.2     1     FULL/BDR       00:00:38    10.3.3.2        GigabitEthernet0/2

Based on this output, what is a potential issue?

Accepted Answer

The neighbor on Gi0/1 is not forming a full adjacency because it is in 2WAY state.. The neighbor on Gi0/1 is in the 2WAY/DROTHER state, which is normal for non-DR/BDR routers on a multi-access network; however, the question implies a potential issue because the engineer might expect all neighbors to reach FULL state. In OSPF, the 2WAY state is a valid adjacency state for DROTHER routers, but if the network is a point-to-point link or the engineer expects full connectivity, this state indicates that the neighbor is not exchanging LSAs (Link State Advertisements) with this router, which could be a problem if the link is not a broadcast multi-access network. The 2WAY state is formed after the two-way communication is established, but it does not progress to FULL unless the router is the DR or BDR, so this is not necessarily an error, but it is the only state that is not FULL, making it the potential issue highlighted in the question.

Answer

The neighbor on Gi0/0 is the DR, which is causing high CPU usage.

Answer

The neighbor on Gi0/2 is the BDR, which is a problem because it should be the DR.

Answer

All neighbors are in FULL state, indicating no issues.

Question 12

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary
BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          65002    1200    1200       10    0    0 01:00:00        5
10.2.2.2        4          65003    0       0          0    0    0 never    Active

Based on this output, what is the problem with the neighbor 10.2.2.2?

Accepted Answer

The neighbor is not reachable or is not configured to accept BGP connections.. The 'Active' state in BGP indicates that the router is actively trying to establish a TCP connection to the neighbor but has not yet succeeded. This typically occurs because the neighbor is unreachable (no route to the destination IP), the neighbor is not configured to accept BGP connections (e.g., no BGP process or incorrect ACL), or a firewall is blocking TCP port 179. The output shows 0 messages sent/received and 'never' uptime, confirming no session has ever been established.

Answer

The neighbor is in Idle state because of a hold timer expiry.

Answer

The neighbor has received 5 prefixes, indicating a successful session.

Answer

The BGP table version is 10, meaning there is a routing loop.

Question 13

A network engineer runs the following command on Router R1:

R1# show route-map TEST
route-map TEST, permit, sequence 10
  Match clauses:
    ip address (access-lists): 100
  Set clauses:
    metric 50
  Policy routing matches: 0 packets, 0 bytes
route-map TEST, deny, sequence 20
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

Based on this output, which statement is correct?

Accepted Answer

The route-map is applied to an interface but no traffic has matched it yet.. The output shows 'Policy routing matches: 0 packets, 0 bytes' for both sequences, which indicates the route-map has been applied to an interface (for policy-based routing) but no traffic has matched any of the match clauses yet. This is the only conclusion that can be drawn from the provided data.

Answer

The route-map is misconfigured because sequence 20 does not have a set clause.

Answer

The route-map will set the metric to 50 for all packets.

Answer

The route-map is applied globally and is affecting all routing decisions.

Question 14

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.2.2:0, Local LDP Ident: 192.168.1.1:0
        TCP connection: 10.1.1.2.646 - 10.1.1.1.646
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:45:00
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.1.1.2
        Addresses bound to peer LDP Ident:
          10.1.1.2     192.168.2.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which indicates the LDP session is operational. The 'Downstream' label distribution mode and the fact that messages have been sent and received (100/100) confirm that the session is actively exchanging label information. This matches the correct answer that the LDP session is operational and exchanging label information.

Answer

The LDP session is in a down state due to a TCP reset.

Answer

The LDP session is in initialization state because no labels have been exchanged.

Answer

The LDP session is using UDP instead of TCP.

Question 15

A network engineer runs the following command on Router R1:

R1# show dmvpn
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- ----------------- --------------- ----- -------- -----
     1 10.0.0.2         10.1.1.2         UP    00:10:00  D
     2 10.0.0.3         10.1.1.3         UP    00:05:00  D

Based on this output, what is the role of Router R1 in the DMVPN network?

Accepted Answer

Router R1 is the hub router with two active spoke connections.. The output shows that Router R1 has a Tunnel0 interface configured as a DMVPN hub (Type:Hub) with two NHRP peers (10.1.1.2 and 10.1.1.3) in the UP state. The 'D' attribute in the Attrb column indicates these peers are directly connected spokes, confirming R1 is the hub router with two active spoke connections.

Answer

Router R1 is a spoke router with two hub connections.

Answer

Router R1 is a spoke router with two other spoke connections.

Answer

Router R1 is not participating in DMVPN because the tunnel is down.

Question 16

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP
    class-map: MANAGEMENT (match-all)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 100 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Based on this output, which statement is correct?

Accepted Answer

All management traffic has been transmitted without any drops.. Option A is correct because the output shows that all 100 packets matched by the MANAGEMENT class-map were conformed (100 packets, 10000 bytes) and the action for conformed traffic is 'transmit', with zero exceeded packets. This indicates that the policing rate of 8000 bps (CIR) was sufficient for the offered traffic, and no packets were dropped. The 'exceeded 0 packets' field confirms no drops occurred.

Answer

Management traffic is being dropped because the police rate is too low.

Answer

The CoPP policy is not applied because the control plane is not specified.

Answer

The class-map MANAGEMENT is not matching any traffic.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip vrf CUSTOMER
  Name                             Default RD           Interfaces
  CUSTOMER                         65001:100             Gi0/0.100
                                                        Gi0/1.100

Based on this output, which statement is correct?

Accepted Answer

The VRF CUSTOMER is configured with two subinterfaces.. The output of 'show ip vrf CUSTOMER' displays the VRF name, its default route distinguisher (RD) of 65001:100, and the interfaces assigned to it. The interfaces listed are Gi0/0.100 and Gi0/1.100, which are both subinterfaces (indicated by the .100 suffix). Therefore, the VRF CUSTOMER is correctly configured with two subinterfaces.

Answer

The VRF CUSTOMER has no route distinguisher configured.

Answer

The VRF CUSTOMER is not active because no routes are shown.

Answer

The VRF CUSTOMER is using OSPF as the routing protocol.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip sla statistics
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Type of operation: icmp-echo
        Latest RTT: 20 milliseconds
        Latest operation start time: 12:00:00 UTC Mon Mar 1 2021
        Latest operation return code: OK
        Number of successes: 100
        Number of failures: 0

Based on this output, which statement is correct?

Accepted Answer

The IP SLA probe is successfully reaching the target with no failures.. The output shows 100 successes and 0 failures for the ICMP echo operation, with a latest return code of OK, confirming that the IP SLA probe is successfully reaching the target without any failures. The 'Number of successes: 100' and 'Number of failures: 0' directly indicate a 100% success rate for the probe.

Answer

The IP SLA probe has failed 100 times.

Answer

The IP SLA probe is using UDP jitter.

Answer

The IP SLA probe is not configured because the operation ID is 1.

Question 19

Examine the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group MY_ACL in
!
access-list 100 permit tcp any host 192.168.1.1 eq 22
access-list 100 deny ip any any
!
line vty 0 4
 transport input ssh
 login local
!
username admin privilege 15 secret cisco

What is the effect of this configuration?

Accepted Answer

Only SSH connections to the router are permitted; all other IP traffic is denied inbound on this interface.. The ACL 100 is applied inbound on GigabitEthernet0/1 via the 'ip access-group MY_ACL in' command. It explicitly permits TCP traffic to host 192.168.1.1 on port 22 (SSH) and then denies all other IP traffic. Since the router's own IP address is 192.168.1.1, this allows only SSH management access from any source, while blocking all other inbound traffic to the router or through the interface.

Answer

The ACL permits SSH and HTTP traffic to the router; all other traffic is denied.

Answer

The ACL is applied outbound, so it filters traffic leaving the interface; SSH is permitted outbound.

Answer

The ACL has no effect because it is missing a 'permit ip any any' statement.

Question 20

Consider the following partial configuration on a Cisco router:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface Serial0/0/0
 ip access-group BLOCK_TELNET out
!
line vty 0 4
 transport input telnet
 password cisco
 login

What is the effect of this configuration?

Accepted Answer

Telnet traffic from the router to remote devices via Serial0/0/0 is blocked; Telnet to the router itself is still allowed.. The ACL BLOCK_TELNET is applied outbound on Serial0/0/0, so it filters traffic leaving that interface. Telnet traffic (TCP port 23) sourced from the router itself (e.g., a user initiating a Telnet session from the router's CLI) is subject to this outbound ACL and is denied. However, Telnet traffic destined to the router (i.e., incoming management sessions to the VTY lines) is not affected because the ACL is not applied inbound on any interface, and the VTY lines have their own authentication and transport input settings.

Answer

All Telnet traffic to and from the router is blocked.

Answer

The ACL has no effect because it is applied outbound and Telnet is a TCP protocol.

Answer

The configuration is invalid because the ACL name contains an underscore.