300-410 Device Access Control Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP
    class-map: MANAGEMENT (match-all)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps
      police:
          cir 8000 bps, bc 1500 bytes
        conformed 100 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Based on this output, which statement is correct?

Accepted Answer

All management traffic has been transmitted without any drops.. Option A is correct because the output shows that all 100 packets matched by the MANAGEMENT class-map were conformed (100 packets, 10000 bytes) and the action for conformed traffic is 'transmit', with zero exceeded packets. This indicates that the policing rate of 8000 bps (CIR) was sufficient for the offered traffic, and no packets were dropped. The 'exceeded 0 packets' field confirms no drops occurred.

Answer

Management traffic is being dropped because the police rate is too low.

Answer

The CoPP policy is not applied because the control plane is not specified.

Answer

The class-map MANAGEMENT is not matching any traffic.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip vrf CUSTOMER
  Name                             Default RD           Interfaces
  CUSTOMER                         65001:100             Gi0/0.100
                                                        Gi0/1.100

Based on this output, which statement is correct?

Accepted Answer

The VRF CUSTOMER is configured with two subinterfaces.. The output of 'show ip vrf CUSTOMER' displays the VRF name, its default route distinguisher (RD) of 65001:100, and the interfaces assigned to it. The interfaces listed are Gi0/0.100 and Gi0/1.100, which are both subinterfaces (indicated by the .100 suffix). Therefore, the VRF CUSTOMER is correctly configured with two subinterfaces.

Answer

The VRF CUSTOMER has no route distinguisher configured.

Answer

The VRF CUSTOMER is not active because no routes are shown.

Answer

The VRF CUSTOMER is using OSPF as the routing protocol.

Question 3

A network engineer runs the following command on Router R1:

R1# show ip sla statistics
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Type of operation: icmp-echo
        Latest RTT: 20 milliseconds
        Latest operation start time: 12:00:00 UTC Mon Mar 1 2021
        Latest operation return code: OK
        Number of successes: 100
        Number of failures: 0

Based on this output, which statement is correct?

Accepted Answer

The IP SLA probe is successfully reaching the target with no failures.. The output shows 100 successes and 0 failures for the ICMP echo operation, with a latest return code of OK, confirming that the IP SLA probe is successfully reaching the target without any failures. The 'Number of successes: 100' and 'Number of failures: 0' directly indicate a 100% success rate for the probe.

Answer

The IP SLA probe has failed 100 times.

Answer

The IP SLA probe is using UDP jitter.

Answer

The IP SLA probe is not configured because the operation ID is 1.

Question 4

Examine the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group MY_ACL in
!
access-list 100 permit tcp any host 192.168.1.1 eq 22
access-list 100 deny ip any any
!
line vty 0 4
 transport input ssh
 login local
!
username admin privilege 15 secret cisco

What is the effect of this configuration?

Accepted Answer

Only SSH connections to the router are permitted; all other IP traffic is denied inbound on this interface.. The ACL 100 is applied inbound on GigabitEthernet0/1 via the 'ip access-group MY_ACL in' command. It explicitly permits TCP traffic to host 192.168.1.1 on port 22 (SSH) and then denies all other IP traffic. Since the router's own IP address is 192.168.1.1, this allows only SSH management access from any source, while blocking all other inbound traffic to the router or through the interface.

Answer

The ACL permits SSH and HTTP traffic to the router; all other traffic is denied.

Answer

The ACL is applied outbound, so it filters traffic leaving the interface; SSH is permitted outbound.

Answer

The ACL has no effect because it is missing a 'permit ip any any' statement.

Question 5

Consider the following partial configuration on a Cisco router:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface Serial0/0/0
 ip access-group BLOCK_TELNET out
!
line vty 0 4
 transport input telnet
 password cisco
 login

What is the effect of this configuration?

Accepted Answer

Telnet traffic from the router to remote devices via Serial0/0/0 is blocked; Telnet to the router itself is still allowed.. The ACL BLOCK_TELNET is applied outbound on Serial0/0/0, so it filters traffic leaving that interface. Telnet traffic (TCP port 23) sourced from the router itself (e.g., a user initiating a Telnet session from the router's CLI) is subject to this outbound ACL and is denied. However, Telnet traffic destined to the router (i.e., incoming management sessions to the VTY lines) is not affected because the ACL is not applied inbound on any interface, and the VTY lines have their own authentication and transport input settings.

Answer

All Telnet traffic to and from the router is blocked.

Answer

The ACL has no effect because it is applied outbound and Telnet is a TCP protocol.

Answer

The configuration is invalid because the ACL name contains an underscore.

Question 6

Examine the following partial configuration:

username admin privilege 15 secret 5 $1$abcdefg$hashedvalue
username operator privilege 1 password cisco
!
line console 0
 login local
!
line vty 0 4
 login local
 transport input ssh

What is a potential security issue with this configuration?

Accepted Answer

The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.. Option A is correct because the 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.

Answer

The 'admin' user has privilege 15, which is too high for administrative access.

Answer

The console line is missing the 'transport input' command.

Answer

The VTY lines should use 'login' without 'local' to allow remote authentication.

Question 7

Given the following partial configuration on a router:

ip access-list standard FILTER_SNMP
 permit 192.168.1.0 0.0.0.255
 deny any
!
snmp-server community public RO FILTER_SNMP
snmp-server location DataCenter
snmp-server contact admin@example.com

What is the effect of this configuration?

Accepted Answer

Only SNMP requests from the 192.168.1.0/24 network are allowed with the community string 'public'.. The configuration applies the standard ACL 'FILTER_SNMP' to the SNMP community string 'public' with read-only (RO) access. The ACL permits only the 192.168.1.0/24 network, so SNMP requests (e.g., GET, GETNEXT) from that subnet are allowed, while all other sources are denied. This is the intended effect of using an ACL to restrict SNMP access by source IP.

Answer

SNMP requests from any source are allowed because the ACL is not applied correctly.

Answer

The community string 'public' allows read-write access.

Answer

The ACL is applied outbound, so SNMP responses are filtered.

Question 8

Examine the following partial configuration:

ip access-list extended MGMT_ACCESS
 permit tcp 10.0.0.0 0.255.255.255 any eq 22
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any
!
line vty 0 4
 access-class MGMT_ACCESS in
 transport input ssh
 login local

What is the effect of the 'access-class' command?

Accepted Answer

Only SSH and HTTPS connections from the 10.0.0.0/8 network are allowed to the VTY lines.. The `access-class` command applied to VTY lines with the `in` keyword filters inbound Telnet/SSH sessions to the router. The ACL `MGMT_ACCESS` permits TCP ports 22 (SSH) and 443 (HTTPS) from source network 10.0.0.0/8, and denies all other traffic. This restricts management access to only SSH and HTTPS connections originating from the 10.0.0.0/8 network.

Answer

The ACL filters traffic leaving the VTY lines, allowing SSH and HTTPS from any source.

Answer

All traffic from the 10.0.0.0/8 network is permitted to the router.

Answer

The configuration is missing 'permit ip any any' to allow other management protocols.

Question 9

Consider the following partial configuration:

ip access-list extended SECURE_ACCESS
 permit icmp any any echo
 permit icmp any any echo-reply
 permit tcp any host 192.168.1.1 eq 22
 permit tcp any host 192.168.1.1 eq 443
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group SECURE_ACCESS in
!
interface GigabitEthernet0/1
 ip access-group SECURE_ACCESS out

What is a potential issue with this ACL placement?

Accepted Answer

The ACL may block traffic that needs to pass between the two interfaces because it is applied in both directions.. The ACL SECURE_ACCESS is applied inbound on GigabitEthernet0/0 and outbound on GigabitEthernet0/1. This means traffic entering G0/0 is filtered by the ACL, and traffic exiting G0/1 is also filtered by the same ACL. Since the ACL denies all IP traffic by default (via the 'deny ip any any' at the end), any packet that must traverse from G0/0 to G0/1 will be checked twice: once inbound on G0/0 and again outbound on G0/1. If the packet matches a permit statement on the inbound check, it may still be denied on the outbound check if the source/destination or protocol does not match the permit entries from the perspective of the outbound interface. In this configuration, the ACL permits only ICMP echo/echo-reply and TCP to 192.168.1.1 on ports 22 and 443; all other traffic is denied. Therefore, legitimate traffic between the two interfaces that does not match these specific permits will be blocked, potentially disrupting connectivity.

Answer

The ACL is missing a 'permit ip any any' statement, so all traffic is denied.

Answer

The ACL should be applied only inbound on both interfaces.

Answer

The ACL permits ICMP echo and echo-reply, which could allow ping floods.

Question 10

What is the default OSPF dead interval on a broadcast multi-access network (e.g., Ethernet) when the hello interval is 10 seconds?

Accepted Answer

40 seconds. On broadcast multi-access networks like Ethernet, OSPF defaults to a hello interval of 10 seconds. The dead interval is calculated as 4 times the hello interval, resulting in a default dead interval of 40 seconds. This ensures that a router has multiple missed hello opportunities before being declared dead, providing stability against transient network issues.

Answer

30 seconds

Answer

20 seconds

Answer

10 seconds

Question 11

In EIGRP, which metric component is disabled by default and must be explicitly enabled using the 'metric weights' command?

Accepted Answer

Reliability and load. In EIGRP, the composite metric is calculated by default using bandwidth and delay. Reliability and load are included in the metric formula but are disabled by default (their K-values are set to 0). To enable them, you must use the 'metric weights' command to adjust the K-values (e.g., K2 for load and K3 for reliability).

Answer

Bandwidth and delay

Answer

MTU

Answer

Hop count

Question 12

Which of the following is true regarding the use of the 'transport input' command on a VTY line?

Accepted Answer

The 'transport input ssh' command allows only SSH connections, blocking Telnet.. Option B is correct because the 'transport input ssh' command explicitly restricts the VTY line to accept only SSH connections, blocking Telnet and other protocols. This is a common security best practice to ensure encrypted remote administration.

Answer

If 'transport input' is not configured, the VTY line defaults to allowing both Telnet and SSH.

Answer

The 'transport input none' command allows all protocols.

Answer

The 'transport input' command applies to both inbound and outbound VTY connections.

Question 13

Which TWO commands would a network engineer use to verify the status of local authentication and authorization for device access control on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show aaa local user lockout. Option A is correct because 'show aaa local user lockout' displays whether local users have been locked out due to failed authentication attempts, which is directly relevant to verifying local authentication and authorization status. Option B is correct because 'show running-config | include aaa authentication login' shows the configured AAA authentication method lists for login, allowing verification of local authentication policies.

Answer

show aaa servers

Answer

debug aaa authentication

Answer

show ip local policy

Question 14

Which TWO statements about configuring login enhancements for device access control on a Cisco IOS router are true? (Choose TWO.)

Accepted Answer

The 'login block-for' command specifies the duration (in seconds) that login access is blocked after a threshold of failed attempts is exceeded.. Option A is correct because the 'login block-for' command specifies the duration in seconds that login access is blocked after a threshold of failed attempts is exceeded. This command is part of the login enhancements feature that provides brute-force attack mitigation by enforcing a quiet period when the number of failed login attempts reaches a configured value within a specified watch period.

Answer

The 'login on-failure log' command must be configured for the 'login block-for' command to function.

Answer

The 'login quiet-mode access-class' command is used to allow only specific IP addresses during the quiet period.

Answer

The 'login block-for' command can be applied per-line to override global settings.

Question 15

Which TWO configuration steps are required to enable TACACS+ authentication for device access control on a Cisco IOS router, assuming the TACACS+ server is already reachable? (Choose TWO.)

Accepted Answer

Configure the TACACS+ server with the 'tacacs server' command and specify the server IP and key.. Option A is correct because the 'tacacs server' command is required to define the TACACS+ server's IP address and the shared secret key, which is necessary for the router to communicate securely with the server. Option B is correct because 'aaa authentication login default group tacacs+' creates an authentication method list that tells the router to use TACACS+ as the primary method for login authentication, which is essential for device access control.

Answer

Configure 'aaa authorization exec default group tacacs+' to authorize user commands after authentication.

Answer

Use 'radius-server host' to define the authentication server.

Answer

Enable 'aaa new-model' to activate AAA services.