300-410 Infrastructure Security — 15 Questions

Question 1

A network engineer wants to secure management access to a Cisco IOS router by allowing only SSH and denying Telnet. The engineer applies the following configuration:

line vty 0 4
 transport input ssh

However, after applying this, the engineer is unable to establish an SSH session to the router. Which additional configuration is required to enable SSH?

Accepted Answer

Configure a domain name and generate RSA keys using the crypto key generate rsa command.. To enable SSH on a Cisco IOS router, you must configure a hostname and domain name, then generate RSA keys using the 'crypto key generate rsa' command. The 'transport input ssh' command only restricts the VTY lines to accept SSH connections; it does not enable the SSH server. Without RSA keys, the SSH server cannot operate, and SSH sessions will fail. Therefore, generating RSA keys is the required additional step.

Answer

Configure an ACL to permit TCP port 22 inbound on the VTY lines using the access-class command.

Answer

Set the login method to use the local database with the 'login local' command under the VTY lines.

Answer

Enable the SSH server using the 'ip ssh server' command in global configuration mode.

Question 2

A network engineer is configuring a Cisco IOS router to authenticate management users against a TACACS+ server. The engineer wants to ensure that if the TACACS+ server is unreachable, the router will fall back to using the local username database. The engineer also wants to log all authentication attempts to the TACACS+ server. Which configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the 'group tacacs+ local' method list. This tells the router to attempt TACACS+ authentication first, and if the server is unreachable, it falls back to the local username database. This provides centralized authentication with a resilient fallback, ensuring management access is maintained during server outages while still logging attempts when the server is available.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default local group tacacs+

Question 3

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is to encrypt traffic between two sites using IKEv2. The administrator wants to ensure that the pre-shared key is not sent in clear text and that perfect forward secrecy (PFS) is used for the IPsec SA. Which combination of IKEv2 and IPsec parameters should be configured?

Accepted Answer

crypto ikev2 keyring with pre-shared-key, crypto ikev2 profile with authentication local pre-share, and crypto ipsec profile with set pfs group14. The correct configuration must use IKEv2 for secure pre-shared key exchange and include PFS in the IPsec profile. The keyring with pre-shared-key under IKEv2 ensures the key is not sent in clear text. The crypto ikev2 profile with authentication local pre-share enables pre-shared key authentication. The crypto ipsec profile with set pfs group14 enables perfect forward secrecy using DH group 14. This combination satisfies both requirements.

Answer

crypto isakmp policy with authentication pre-share, crypto ipsec transform-set with esp-aes esp-sha-hmac, and crypto map with set pfs group5

Answer

crypto ikev2 keyring with pre-shared-key, crypto ikev2 profile with authentication local pre-share, and crypto ipsec profile with set security-association lifetime seconds 3600

Answer

crypto ikev2 proposal with encryption aes-cbc-256, crypto ikev2 policy, and crypto ipsec profile with set security-association lifetime seconds 3600

Question 4

A network administrator is implementing uRPF on a Cisco IOS router to mitigate spoofed source IP addresses. The router has two interfaces: GigabitEthernet0/0 (connected to the Internet) and GigabitEthernet0/1 (connected to the internal network). The administrator wants to ensure that uRPF does not drop legitimate traffic when asymmetric routing exists. Which two uRPF modes should the administrator consider? (Choose two.)

Accepted Answer

Loose mode. Loose mode and feasible path uRPF both accommodate asymmetric routing by not requiring the source to be reachable via the receiving interface. Loose mode checks reachability via any interface, while feasible path uRPF uses the FIB to allow any feasible path. These modes prevent spoofing without dropping legitimate traffic when paths differ.

Answer

VRF-aware uRPF

Answer

Unicast RPF with allow-default

Answer

Strict mode

Question 5

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The administrator wants to ensure that if the RADIUS server becomes unavailable, the switch port is placed in a restricted VLAN that allows limited access to remediation resources. Which feature should be configured on the switch port?

Accepted Answer

Authentication guest-vlan. The guest VLAN feature is designed to provide limited network access when authentication cannot be completed, such as when the RADIUS server is unavailable or the client lacks 802.1X support. It places the port into a predetermined VLAN that can be configured with ACLs to restrict access to remediation servers. The critical VLAN, in contrast, is intended to provide full access during server outages, which is not the desired restricted access in this scenario.

Answer

Authentication critical

Answer

Authentication host-mode multi-auth

Answer

Authentication open

Question 6

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The administrator wants to limit ICMP echo requests destined to the router to 50 packets per second, with a burst of 100 packets, and drop excess traffic. Which configuration accomplishes this?

Accepted Answer

class-map match-all ICMP
 match access-group 101
!
policy-map COPP
 class ICMP
  police 50000 100000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP
access-list 101 permit icmp any any echo. The correct answer defines a class map for ICMP echo requests, a policy map with police rates in bits per second (50 kbps and 100 kbps burst), and applies it to the control plane using the 'control-plane' configuration mode. The other options either apply the policy to an interface, use incorrect units (packets per second instead of bits per second), or use an invalid configuration mode.

Answer

class-map match-all ICMP
 match access-group 101
!
policy-map COPP
 class ICMP
  police 50000 100000 conform-action transmit exceed-action drop
!
control-plane host
 service-policy input COPP
access-list 101 permit icmp any any echo

Answer

class-map match-all ICMP
 match access-group 101
!
policy-map COPP
 class ICMP
  police 50 100 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP
access-list 101 permit icmp any any echo

Answer

class-map match-all ICMP
 match access-group 101
!
policy-map COPP
 class ICMP
  police 50000 100000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 service-policy input COPP
access-list 101 permit icmp any any echo

Question 7

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted. Which configuration element defines this traffic?

Accepted Answer

access list. The traffic to be encrypted by an IPsec VPN is defined by an access list. This access list is referenced in the crypto map, which then applies the IPsec policies to matching traffic. The access list specifies the source and destination subnets, ensuring that only the desired traffic is encrypted. The transform set and crypto map are important but do not define the traffic itself.

Answer

transform set

Answer

crypto map

Answer

crypto ACL

Question 8

A network administrator is configuring SSH access on a Cisco IOS router. The administrator wants to ensure that only SSH version 2 is used and that the RSA key modulus is at least 2048 bits. Which set of commands accomplishes this?

Accepted Answer

ip ssh version 2
crypto key generate rsa modulus 2048. To enforce SSH version 2 and generate a 2048-bit RSA key, use 'ip ssh version 2' and 'crypto key generate rsa modulus 2048'. This ensures that SSH uses the more secure version 2 and that the key strength meets the minimum requirement. The other options either use an incorrect SSH version or an insufficient key size, or exceed the requirement unnecessarily.

Answer

ip ssh version 2
crypto key generate rsa modulus 1024

Answer

ip ssh version 1
crypto key generate rsa modulus 2048

Answer

ip ssh version 2
crypto key generate rsa general-keys modulus 4096

Question 9

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The administrator wants to rate-limit ICMP echo requests destined to the router itself. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Create an ACL that matches ICMP echo requests destined to the router's IP addresses.. To configure CoPP for ICMP echo requests, you must first classify the traffic using an ACL that matches ICMP echo requests destined to the router. Then, you create a class-map that references this ACL. The class-map is used in a policy-map to define the policing action. Finally, the policy-map is applied to the control plane. The two required actions are creating the ACL and configuring the class-map.

Answer

Apply the policy-map to the control plane interface using the service-policy command.

Answer

Enable NetFlow to monitor ICMP traffic and automatically rate-limit it.

Answer

Configure a route-map to match ICMP echo requests and set the next-hop to null0.

Question 10

A network security engineer is configuring a Zone-Based Firewall (ZBFW) on a Cisco IOS router. The router has two zones: INSIDE and OUTSIDE. The requirement is to allow HTTP traffic from INSIDE to OUTSIDE, allow return traffic, and block all other traffic from INSIDE to OUTSIDE. Which configuration is necessary to achieve this?

Accepted Answer

Create a class-map matching HTTP, a policy-map with inspect action for that class, and a class-default with drop action; apply the policy-map as a service-policy type inspect between INSIDE and OUTSIDE.. The correct configuration uses a class-map to match HTTP, a policy-map with inspect action to allow and track the traffic, and a class-default with drop to block all other traffic. The policy-map must be applied as a service-policy type inspect between the INSIDE and OUTSIDE zones to enforce the policy in the correct direction. The inspect action ensures that return traffic is allowed.

Answer

Create a class-map matching HTTP, a policy-map with inspect action for that class, and a class-default with inspect action; apply the policy-map as a service-policy type inspect between INSIDE and OUTSIDE.

Answer

Create a class-map matching HTTP, a policy-map with inspect action for that class, and a class-default with drop action; apply the policy-map as a service-policy type inspect between OUTSIDE and INSIDE.

Answer

Create a class-map matching HTTP, a policy-map with pass action for that class, and a class-default with drop action; apply the policy-map as a service-policy type inspect between INSIDE and OUTSIDE.

Question 11

A network engineer is configuring a Cisco IOS router to authenticate login users against a RADIUS server. The RADIUS server is reachable at 10.1.1.100, and the shared secret is 'Cisco123'. The engineer also wants to ensure that if the RADIUS server is unreachable, the router falls back to local authentication using the local username 'admin' with password 'AdminPass'. Which configuration sequence correctly achieves this?

Accepted Answer

aaa new-model
aaa authentication login default group radius local
radius server RAD1
 address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
 key Cisco123
username admin privilege 15 secret AdminPass
line vty 0 4
 login authentication default. The correct configuration enables AAA, defines a method list that tries RADIUS first then local, configures the RADIUS server with standard ports and the shared secret, creates a local user with a secure secret, and applies the method list to VTY lines. This ensures RADIUS authentication with local fallback, meeting the requirement.

Answer

aaa new-model
aaa authentication login default group radius local
radius server RAD1
 address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
 key Cisco123
username admin privilege 15 password AdminPass
line vty 0 4
 login authentication default

Answer

aaa new-model
aaa authentication login default group radius
radius server RAD1
 address ipv4 10.1.1.100 auth-port 1645 acct-port 1646
 key Cisco123
username admin privilege 15 secret AdminPass
line vty 0 4
 login authentication default

Answer

aaa new-model
aaa authentication login default group radius local
radius server RAD1
 address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
 key Cisco123
username admin privilege 15 secret AdminPass
line console 0
 login authentication default

Question 12

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 network to the 10.2.2.0/24 network is encrypted, while all other traffic is sent unencrypted. Which access list configuration should be used in the crypto ACL?

Accepted Answer

access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The correct crypto ACL permits IP traffic from the local subnet to the remote subnet, ensuring that only that traffic is encrypted. The implicit deny at the end of the ACL handles all other traffic, which remains unencrypted. The other options either block all traffic, include redundant deny statements, or permit too much traffic.

Answer

access-list 100 deny ip any any
access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Answer

access-list 100 permit ip 10.1.1.0 0.0.0.255 any

Answer

access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 100 deny ip any any

Question 13

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer wants to rate-limit ICMP echo requests destined to the router's management IP address to 10 Mbps, while allowing all other traffic to the control plane without restriction. The router uses a modular QoS CLI (MQC) configuration. Which set of commands correctly applies CoPP to achieve this?

Accepted Answer

class-map match-any ICMP_CLASS
 match access-group name ICMP_ACL
policy-map COPP_POLICY
 class ICMP_CLASS
  police 10000000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP_POLICY. CoPP is implemented by defining class-maps and policy-maps, then applying the policy-map to the control plane with the 'service-policy input' command under the 'control-plane' configuration. The policy-map must include a class for ICMP traffic with a police action, and typically a class-default for other traffic. The correct option shows this structure, although it also polices class-default, which is common practice to protect the control plane from all excess traffic.

Answer

policy-map COPP_POLICY
 class ICMP_CLASS
  police 10000000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input COPP_POLICY

Answer

policy-map COPP_POLICY
 class ICMP_CLASS
  police 10000000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy output COPP_POLICY

Answer

policy-map COPP_POLICY
 class ICMP_CLASS
  police 10000000 conform-action transmit exceed-action drop
control-plane
 service-policy output COPP_POLICY

Question 14

A network administrator is configuring a Cisco IOS router to log all denied IP traffic on its outside interface to a syslog server at 192.168.1.50. The administrator wants to ensure that only denied packets are logged, and that the log messages include the source and destination IP addresses and port numbers. Which configuration accomplishes this?

Accepted Answer

ip access-list extended OUTSIDE-IN
 deny ip any any log-input
 permit ip any any
interface GigabitEthernet0/0
 ip access-group OUTSIDE-IN in
logging host 192.168.1.50. The correct configuration uses an extended ACL with a deny statement that includes the 'log-input' keyword, which logs denied packets with source/destination IP and port numbers, and applies it inbound on the outside interface. The syslog host is configured. This ensures only denied traffic is logged with the required details.

Answer

ip access-list extended OUTSIDE-IN
 permit ip any any log
 deny ip any any
interface GigabitEthernet0/0
 ip access-group OUTSIDE-IN in
logging host 192.168.1.50

Answer

ip access-list extended OUTSIDE-IN
 deny ip any any log-input
 permit ip any any
interface GigabitEthernet0/0
 ip access-group OUTSIDE-IN out
logging host 192.168.1.50

Answer

ip access-list extended OUTSIDE-IN
 deny ip any any log
 permit ip any any
interface GigabitEthernet0/0
 ip access-group OUTSIDE-IN in
logging host 192.168.1.50

Question 15

A network engineer is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers. The tunnel is up, but traffic from the local subnet to the remote subnet is not being encrypted and is instead sent in clear text. The engineer verifies that the crypto map is applied to the correct interface and that the ACL matches the traffic. What is the most likely cause?

Accepted Answer

The crypto map is applied to the wrong interface or in the wrong direction.. The most likely cause is that the crypto map is not correctly applied to the interface that handles the traffic. For policy-based VPNs, the crypto map must be applied to the outbound interface that faces the remote peer, and it must be applied in the correct direction. If it is missing or applied to the wrong interface, the router will not encrypt traffic matching the ACL, even though the tunnel might be up for other traffic or due to a separate SA. Verifying the crypto map application is essential.

Answer

The route to the remote subnet points to the tunnel interface instead of the physical interface.

Answer

The crypto ACL is not mirrored correctly on the remote peer.

Answer

The transform set is misconfigured.