300-410 Device Access Control Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show mpls ldp bindings 10.10.10.0 24

lib entry: 10.10.10.0/24, rev 2
        local binding:  label: 101
        remote binding: lsr: 10.1.1.2:0, label: 102
        remote binding: lsr: 10.1.2.2:0, label: 103

What does this output indicate?

Accepted Answer

The router has a local label of 101 for the prefix and has learned two remote labels from two different neighbors.. The output of 'show mpls ldp bindings 10.10.10.0 24' displays the Label Information Base (LIB) entry for prefix 10.10.10.0/24. The 'local binding: label: 101' indicates that this router has assigned label 101 to the prefix. The two 'remote binding' lines show that two different LDP neighbors (LSR IDs 10.1.1.2 and 10.1.2.2) have advertised labels 102 and 103 respectively for the same prefix. This is the normal operation of LDP, where a router learns multiple remote labels for the same FEC from different peers.

Answer

The router has only a local label of 101; the remote bindings are not used because they are from the same LSR.

Answer

The label 102 is the local label for the prefix 10.10.10.0/24.

Answer

The router has no label for the prefix because the lib entry is incomplete.

Question 2

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# debug nhrp

NHRP: Receive Resolution Request via Tunnel0 10.1.1.2, target 192.168.1.1
NHRP: Send Resolution Reply via Tunnel0 to 10.1.1.2, target 192.168.1.1

What does this output indicate?

Accepted Answer

The router is acting as a NHRP server and successfully resolves the NBMA address for the target.. The debug output shows the router receiving a Resolution Request and immediately sending a Resolution Reply, which is the behavior of a Next Hop Resolution Protocol (NHRP) server (or hub) that has a mapping for the target 192.168.1.1. The router successfully resolves the Non-Broadcast Multiple Access (NBMA) address (10.1.1.2) for the target, indicating it is acting as a server in a DMVPN or similar overlay network.

Answer

The router is a NHRP client and is requesting resolution for target 192.168.1.1.

Answer

The router is unable to resolve the target address because it does not have a mapping.

Answer

The NHRP process is failing due to a misconfigured authentication key.

Question 3

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show crypto isakmp sa detail

Codes: C - IKE configuration mode, D - Dead Peer Detection
       I - IKE Initiatior, R - IKE Responder

C-id  Local           Remote          I-VRF     Status Encr Hash Auth DH Lifetime Cap.
1001  10.1.1.1        10.1.1.2                  ACTIVE aes  sha  md5  2  86400 D

What does this output indicate?

Accepted Answer

An IKE Phase 1 SA is established with the remote peer using AES encryption and SHA hash.. The output from 'show crypto isakmp sa detail' displays an IKE Phase 1 (ISAKMP) security association with status 'ACTIVE', indicating successful Phase 1 negotiation. The 'Encr' column shows 'aes', 'Hash' shows 'sha', and 'Auth' shows 'md5', confirming AES encryption and SHA hash are used. This matches option A, which correctly identifies an established IKE Phase 1 SA with those parameters.

Answer

The IKE Phase 1 SA is in a failed state because the authentication method is MD5.

Answer

The IKE Phase 2 SA is established with the remote peer.

Answer

The router is the initiator of the IKE Phase 1 SA.

Question 4

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show policy-map control-plane input class class-default

Class-map: class-default (match-any)
    140225 packets, 12345678 bytes
    5 minute offered rate 1000 bps, drop rate 0 bps
    Match: any
    police:
        cir 1000000 bps, bc 31250 bytes
        conformed 140225 packets, 12345678 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

What does this output indicate?

Accepted Answer

The CoPP policy is policing traffic to 1 Mbps, and all traffic so far has been within the limit and transmitted.. The output shows that the class-default class in the CoPP policy has a police configuration with a CIR of 1,000,000 bps (1 Mbps). All 140,225 packets have been counted as conforming, with zero exceeded or violated packets, and the conform action is 'transmit'. This means all traffic has been within the policed rate and has been forwarded without drops.

Answer

The CoPP policy is dropping all traffic because the CIR is too low.

Answer

The CoPP policy is not matching any traffic because the class-default does not match any packets.

Answer

The CoPP policy is only policing traffic that exceeds the CIR, but all traffic is being transmitted.

Question 5

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show ip bgp vpnv4 vrf CUSTOMER-A 10.10.10.0/24

BGP routing table entry for 10.10.10.0/24, version 2
Paths: (1 available, best #1, table CUSTOMER-A)
  Not advertised to any peer
  Refresh Epoch 1
  Local
    10.1.1.2 from 10.1.1.2 (10.1.1.2)
      Origin IGP, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:100:100
      mpls labels in/out nolabel/101

What does this output indicate?

Accepted Answer

The route 10.10.10.0/24 is installed in VRF CUSTOMER-A with an MPLS label of 101 for forwarding.. The output shows that the route 10.10.10.0/24 is installed in VRF CUSTOMER-A (table CUSTOMER-A) with an MPLS label of 101 for outgoing forwarding, as indicated by 'mpls labels in/out nolabel/101'. The route is valid, internal, and best, meaning it is used for forwarding despite not being advertised to any peer. This confirms that the MPLS label is applied for forwarding within the VRF context.

Answer

The route 10.10.10.0/24 is not installed because it is not advertised to any peer.

Answer

The route 10.10.10.0/24 is learned from an external BGP peer.

Answer

The route 10.10.10.0/24 has no MPLS label and will be forwarded using IP lookup.

Question 6

What is the default dead interval on a Cisco IOS-XE router for OSPF on a broadcast network type?

Accepted Answer

40 seconds. On a broadcast network type, OSPF uses a default dead interval of 40 seconds, which is four times the default hello interval of 10 seconds. This relationship is defined in RFC 2328, ensuring that a neighbor is declared down only after missing four consecutive hello packets.

Answer

10 seconds

Answer

30 seconds

Answer

120 seconds

Question 7

Which EIGRP packet type is used to acknowledge receipt of a reliable packet?

Accepted Answer

Ack. D is correct because the EIGRP Ack (Acknowledgement) packet is a special packet used exclusively to confirm the reliable delivery of EIGRP packets such as Update, Query, and Reply. Ack packets are sent as unicast to the source router and contain no data, serving only as a delivery confirmation. This mechanism ensures that EIGRP's Reliable Transport Protocol (RTP) can guarantee ordered and guaranteed delivery of critical routing information.

Answer

Hello

Answer

Update

Answer

Reply

Question 8

What is the default administrative distance for OSPF routes in Cisco IOS?

Accepted Answer

110. OSPF has a default administrative distance (AD) of 110 in Cisco IOS. This value is used by the router to select the best route when multiple routing protocols provide a route to the same destination, with lower AD values being preferred. OSPF's AD of 110 is higher than that of static routes (1) and EIGRP (90/170), but lower than RIP (120) and IS-IS (115).

Answer

90

Answer

100

Answer

120

Question 9

Which statement accurately describes the default behavior of auto-summary in EIGRP on Cisco IOS-XE?

Accepted Answer

Auto-summary is disabled by default, and EIGRP advertises subnets without automatic summarization.. In Cisco IOS-XE, EIGRP auto-summary is disabled by default. This means that EIGRP advertises subnets without automatically summarizing them at classful boundaries, allowing for more granular route advertisement and preventing routing issues in discontiguous networks.

Answer

Auto-summary is enabled by default, causing EIGRP to summarize at classful boundaries.

Answer

Auto-summary is enabled by default but only for external routes.

Answer

Auto-summary is disabled by default unless the network is configured with a classful mask.

Question 10

What is the maximum hop count for a route in RIP?

Accepted Answer

15. RIP (Routing Information Protocol) uses a maximum hop count of 15 to prevent routing loops. A route with a hop count of 16 is considered unreachable (infinite metric). This limit is defined in RFC 1058 for RIPv1 and RFC 2453 for RIPv2, ensuring that the network diameter remains small and loop-free.

Answer

16

Answer

255

Answer

32

Question 11

Which OSPF LSA type is used to advertise external routes and is flooded throughout the entire OSPF domain?

Accepted Answer

Type 5 (AS-external LSA). Type 5 (AS-external LSA) is correct because it is originated by an ASBR to advertise external routes redistributed into OSPF from another routing domain. These LSAs are flooded throughout the entire OSPF domain, including all areas, and their flooding scope is AS-wide, as defined in RFC 2328.

Answer

Type 1 (Router LSA)

Answer

Type 3 (Summary LSA)

Answer

Type 4 (ASBR Summary LSA)

Question 12

In BGP, what is the default value of the keepalive timer?

Accepted Answer

60 seconds. In BGP, the default keepalive timer is 60 seconds, as specified in RFC 4271. This timer determines how often a BGP speaker sends Keepalive messages to its peer to maintain the session. The hold timer, which is three times the keepalive interval (default 180 seconds), triggers session teardown if no Keepalive or update is received within that period.

Answer

30 seconds

Answer

90 seconds

Answer

180 seconds

Question 13

Which statement correctly describes the behavior of OSPF network type 'point-to-multipoint' regarding neighbor discovery?

Accepted Answer

Neighbors are discovered via unicast hello packets and no DR/BDR is elected.. In OSPF point-to-multipoint network type, neighbors are manually configured or discovered via unicast hello packets because the network does not support broadcast or multicast flooding. No Designated Router (DR) or Backup Designated Router (BDR) is elected because the network is treated as a collection of point-to-point links, avoiding the need for a central adjacency point.

Answer

Neighbors are discovered via multicast hello packets and a DR/BDR is elected.

Answer

Neighbors are discovered via multicast hello packets but no DR/BDR is elected.

Answer

Neighbors are discovered via unicast hello packets and a DR/BDR is elected.

Question 14

What is the default OSPF metric for a route redistributed from another routing protocol into OSPF?

Accepted Answer

20. When a route is redistributed from another routing protocol into OSPF, the default metric is 20 for routes that are not BGP. This is defined in RFC 2328 and is the seed metric used when no explicit metric is configured with the redistribute command. The value 20 applies to most external routes (Type 2 by default), while BGP redistributed routes default to 1.

Answer

0

Answer

1

Answer

10

Question 15

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure hostname and domain name. First, a hostname and domain name must be set to generate the RSA key pair. Then the RSA key pair is generated with the crypto key generate rsa command. Next, local AAA authentication is enabled with aaa new-model and aaa authentication login default local. The VTY lines are then configured to use SSH transport and the local login authentication. Finally, the SSH version is set to 2 for enhanced security.