300-410 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A network engineer is configuring 802.1X authentication on a Cisco IOS switch. The engineer wants to ensure that if the RADIUS server is unreachable, the switch will fall back to MAC authentication bypass (MAB) for devices that do not support 802.1X. The engineer also wants to enable critical authentication for a phone that must always have access. Which two commands are required to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authentication event server dead action authorize voice. The two required commands are 'mab' to enable MAC authentication bypass fallback and 'authentication event server dead action authorize voice' to enable critical authentication for voice devices. The other commands are either not sufficient alone or do not address the specific requirements of MAB fallback and critical authentication.

Answer

authentication event fail action authorize vlan 100

Answer

dot1x pae authenticator

Answer

aaa authentication dot1x default group radius

Question 2

A network security engineer is deploying 802.1X authentication on Cisco Catalyst switches. The engineer wants to ensure that if the RADIUS server becomes unavailable, endpoints can still access the network with limited privileges. The engineer plans to implement a fallback policy. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure the authentication event fail action authorize vlan <vlan-id> command on the switch.. To provide fallback access when the RADIUS server is unreachable, the switch must be configured to take a specific action when the server is marked dead. The 'authentication event server dead action authorize vlan' command authorizes the port into a VLAN when the server is dead. Additionally, the 'authentication event fail action authorize vlan' command handles authentication failures, which can occur when the server is unreachable and the switch times out. Together, they ensure limited access.

Answer

Configure the authentication critical recovery delay on the switch.

Answer

Configure the authentication host-mode multi-auth command on the switch.

Answer

Configure the dot1x pae authenticator command on the switch.

Question 3

A network engineer is deploying 802.1X on Cisco Catalyst switches. The requirement is to authenticate users via a RADIUS server and, if the RADIUS server is unreachable, to place the port in a restricted VLAN that allows limited access to remediation resources. Which set of commands on the switch interface correctly implements this fallback behavior?

Accepted Answer

interface GigabitEthernet0/1
 authentication host-mode multi-auth
 authentication order dot1x
 authentication port-control auto
 authentication critical recovery delay 5000
 authentication event server dead action authorize vlan 100. The correct configuration uses the 'authentication event server dead action authorize vlan 100' command to assign the port to a restricted VLAN when the RADIUS server is unreachable. This provides limited access for remediation. The 'authentication critical recovery delay' command is optional but helps manage reauthentication attempts. Other options either use incorrect syntax or trigger on the wrong event.

Answer

interface GigabitEthernet0/1
 authentication host-mode multi-auth
 authentication order dot1x
 authentication port-control auto
 authentication control-direction in
 authentication event server dead action reinitialize vlan 100

Answer

interface GigabitEthernet0/1
 authentication host-mode multi-auth
 authentication order dot1x
 authentication port-control auto
 authentication event fail action authorize vlan 100
 authentication event server dead action authorize vlan 100

Answer

interface GigabitEthernet0/1
 authentication host-mode multi-auth
 authentication order dot1x
 authentication port-control auto
 authentication violation restrict
 authentication fallback profile Remediation

Question 4

A network administrator is deploying 802.1X authentication on a Cisco Catalyst switch. The switch is configured as an authenticator, and the RADIUS server is reachable. However, when a PC attempts to authenticate, the switch port goes into the unauthorized state and the PC cannot access the network. The administrator notices that the switch is sending EAPOL-Start frames to the PC but receiving no response. Which action should the administrator take to resolve this issue?

Accepted Answer

Enable 802.1X on the PC's network interface card and configure it as a supplicant.. 802.1X requires three roles: supplicant (client), authenticator (switch), and authentication server (RADIUS). The PC must run supplicant software to respond to EAPOL frames. Without it, the switch cannot authenticate the port, leaving it unauthorized. Enabling the supplicant on the PC is the correct fix.

Answer

Change the switch port's host mode to multi-domain to support both voice and data devices.

Answer

Configure the switch port as a trunk port to allow multiple VLANs for authentication traffic.

Answer

Configure the RADIUS server to send EAPOL-Start frames to the PC.

Question 5

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router. The administrator wants to rate-limit ARP packets destined to the route processor to 1000 packets per second, while allowing all other traffic without policing. Which configuration correctly applies CoPP to achieve this?

Accepted Answer

policy-map COPP
 class ARP
  police 1000
 class class-default
control-plane
 service-policy input COPP. The correct configuration uses a policy map with a class for ARP that polices at 1000 pps and a class-default with no police action, applied under control-plane with 'service-policy input COPP'. This ensures only ARP is policed while other control plane traffic is not rate-limited, as required.

Answer

policy-map COPP
 class ARP
  police 1000
 class class-default
  police 8000
interface GigabitEthernet0/0
 service-policy input COPP

Answer

policy-map COPP
 class ARP
  police 1000
control-plane
 service-policy input COPP

Answer

policy-map COPP
 class ARP
  police 1000
 class class-default
  police 8000
control-plane
 service-policy input COPP

Question 6

A network administrator is configuring a Cisco IOS router to use SSH for remote management instead of Telnet. The administrator has already generated an RSA key pair and configured a username and password. Which additional command is required to enable SSH on the router?

Accepted Answer

crypto key generate rsa. To enable SSH on a Cisco IOS router, the RSA key pair must be generated using the 'crypto key generate rsa' command. This command creates the keys and enables the SSH server. Although the scenario states that keys are already generated, this is the command that enables SSH. The other commands configure SSH version or restrict VTY access, but they do not enable the SSH server.

Answer

line vty 0 4

Answer

ip ssh version 2

Answer

transport input ssh

Question 7

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN uses strong encryption and integrity. The engineer configures an ISAKMP policy with AES 256 encryption and SHA-256 hashing. However, the VPN fails to establish. Which two actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify that both peers have matching ISAKMP policies, including encryption, hash, authentication, and Diffie-Hellman group.. For an IPsec VPN to establish, both Phase 1 (ISAKMP) and Phase 2 (IPsec) parameters must match on both peers. The engineer should verify that ISAKMP policies and transform sets are identical on both routers, including encryption, hash, authentication, and DH group for Phase 1, and encryption and integrity algorithms for Phase 2.

Answer

Verify that the IPsec tunnel interface is configured with the correct IP address and is in the up/up state.

Answer

Confirm that the RSA keys or pre-shared keys are identical on both peers.

Answer

Ensure that the crypto ACLs are mirrored on both peers, with source and destination addresses reversed.

Question 8

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. The administrator has configured the crypto ACL as 'access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255'. Which additional configuration is necessary to complete the IPsec VPN setup?

Accepted Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101
interface Serial0/0/0
 crypto map MYMAP. The correct configuration creates a crypto map that references the ACL 101 for matching interesting traffic, sets the peer and transform set, and applies the crypto map to the interface. This ensures that only traffic from 10.1.1.0/24 to 10.2.2.0/24 is encrypted. Other traffic is not matched by the ACL and is sent unencrypted. The transform set and ISAKMP policy must be defined separately.

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101
interface Serial0/0/0
 crypto map MYMAP
crypto ipsec transform-set MYSET esp-aes esp-sha-hmac

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101
interface Serial0/0/0
 crypto map MYMAP
crypto isakmp key cisco123 address 203.0.113.2

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101
interface Serial0/0/0
 crypto map MYMAP
access-list 101 deny ip any any

Question 9

A network administrator is deploying 802.1X on Cisco Catalyst switches. The RADIUS server is reachable, but some supplicants are failing authentication. The administrator suspects that the switch is not correctly forwarding EAP messages. Which command should be used to verify the 802.1X authentication status and EAP exchange details on a per-interface basis?

Accepted Answer

show dot1x interface GigabitEthernet0/1 details. The 'show dot1x interface <interface> details' command is specifically designed to display detailed 802.1X operational status and EAP exchange information for a given interface. It shows the authentication method, EAP type, and any errors, making it ideal for troubleshooting supplicant authentication failures. The other commands provide either session-level information or statistics but lack the per-interface EAP details.

Answer

debug dot1x all

Answer

show authentication sessions interface GigabitEthernet0/1

Answer

show radius statistics

Question 10

A network engineer is configuring a Cisco IOS router for MPLS L3VPN. The router is a PE that connects to a customer CE via a VRF named CUST. The engineer wants to prevent any traffic from the CUST VRF from reaching the global routing table, and also wants to ensure that routes learned from the CE are not advertised to other VRFs. Which configuration is required?

Accepted Answer

Configure the VRF without a route target and enable BGP with the CE using the VRF address family, and ensure that no global BGP peering is configured.. VRF isolation is achieved by not configuring route targets, which prevents the import and export of routes between VRFs. Without route targets, the VRF cannot exchange routes with other VRFs, and no global BGP peering ensures that routes do not leak to the global table. This is a valid method to isolate a VRF when no inter-VRF communication is desired.

Answer

Configure a route-target export and import under the VRF address family, and enable BGP with the CE using the VRF address family.

Answer

Configure a route map to filter routes from the CE and apply it to the BGP neighbor, and configure a static route to Null0 for the global table.

Answer

Configure the VRF with a unique route distinguisher and enable the ip vrf forwarding command on the CE-facing interface.

Question 11

A network engineer is troubleshooting an 802.1X deployment on a Cisco Catalyst switch. Users are unable to authenticate, and the switch logs show 'RADIUS: No response from server'. The engineer verifies that the RADIUS server is reachable via ping. Which action should the engineer take next to resolve the issue?

Accepted Answer

Check the RADIUS server UDP ports 1812 and 1813 are open.. The error 'RADIUS: No response from server' indicates that the switch is not receiving any response from the RADIUS server, despite the server being reachable via ICMP. The most likely cause is that UDP ports 1812 (authentication) and 1813 (accounting) are blocked. The engineer should verify that these ports are open and that no firewall or ACL is filtering RADIUS traffic. Shared secret, NAS-IP-Address, and authentication method would not cause a complete lack of response.

Answer

Ensure the switch is configured with the correct NAS-IP-Address.

Answer

Verify the RADIUS shared secret on the switch and server.

Answer

Verify the 802.1X authentication method is set to open.

Question 12

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer wants to rate-limit ICMP echo requests destined to the router itself to 10 packets per second, while allowing other traffic. Which two statements are true regarding the implementation of CoPP for this requirement? (Choose two.)

Accepted Answer

The policy map should use the 'police' command with a rate of 10 packets per second (pps) to enforce the rate limit.. CoPP is implemented using MQC, where a class map identifies traffic and a policy map defines actions. The policy map is applied to the control plane using the 'service-policy' command in control-plane configuration mode. The 'police' command with a rate in pps enforces the rate limit. These two statements correctly describe the implementation steps for rate-limiting ICMP echo requests to the router.

Answer

CoPP can only be applied to the control plane globally; it cannot be applied per interface.

Answer

The class map must match traffic destined to the router's IP addresses using an ACL that permits ICMP echo requests to any router interface.

Answer

The 'control-plane' configuration mode allows the application of a service policy to police traffic destined to the route processor.

Question 13

A network engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router. The router has two interfaces: GigabitEthernet0/0 (WAN) and GigabitEthernet0/1 (LAN). The engineer wants to prevent spoofed packets from entering the WAN interface while allowing legitimate traffic. The routing table shows that the WAN subnet is reachable via GigabitEthernet0/0. Which uRPF mode should the engineer configure on GigabitEthernet0/0?

Accepted Answer

Strict mode. Strict mode uRPF verifies that the source IP of a packet is reachable via the same interface the packet arrived on. Since the WAN subnet is reachable via GigabitEthernet0/0, strict mode will drop packets with spoofed source addresses while allowing legitimate WAN traffic. This effectively mitigates IP spoofing on the WAN interface.

Answer

Feasible path uRPF

Answer

Disable uRPF and use IP Source Guard instead

Answer

Loose mode

Question 14

A network engineer is configuring a Cisco IOS router to authenticate login sessions against a TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to using the local username database for authentication. The router already has a local username configured. Which configuration should the engineer apply to the router's VTY lines?

Accepted Answer

line vty 0 4
 login authentication default
 aaa authentication login default group tacacs+ local. The correct configuration uses a named method list (default) that lists TACACS+ first and local second. Applying that method list to the VTY lines with 'login authentication default' ensures that the router attempts TACACS+ authentication and falls back to the local database if the server is unavailable. The other options either use the wrong fallback method or bypass AAA entirely.

Answer

line vty 0 4
 login authentication TACACS+
 aaa authentication login TACACS+ group tacacs+ enable

Answer

line vty 0 4
 login authentication default
 aaa authentication login default group tacacs+ none

Answer

line vty 0 4
 login local
 aaa authentication login default group tacacs+ local

Question 15

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using SHA-256 HMAC. The engineer wants to ensure that the key is not sent in clear text and that the authentication is applied only to OSPF packets on a specific interface. Which command set correctly implements this requirement?

Accepted Answer

key chain OSPF-KEYS
 key 1
  cryptographic-algorithm hmac-sha-256
  key-string MySecretKey
interface GigabitEthernet0/0
 ip ospf authentication key-chain OSPF-KEYS. The correct answer is the configuration that uses a key chain with HMAC-SHA-256 and applies it to the interface with 'ip ospf authentication key-chain'. This ensures the key is not sent in clear text and authentication is limited to the specified interface. Key chains provide secure key management, and HMAC-SHA-256 is a strong cryptographic algorithm. The other options either use insecure simple authentication, apply authentication too broadly, or use unsupported syntax.

Answer

interface GigabitEthernet0/0
 ip ospf authentication
 ip ospf authentication-key MySecretKey

Answer

router ospf 1
 area 0 authentication message-digest
 area 0 authentication key-chain OSPF-KEYS
key chain OSPF-KEYS
 key 1
  cryptographic-algorithm hmac-sha-256
  key-string MySecretKey

Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 sha-256 MySecretKey