300-410 Infrastructure Security Practice Test 4 — 15 Questions

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses IKEv2 with certificate-based authentication and that the tunnel is established only when there is interesting traffic. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto ikev2 profile IKEV2-PROF
 match identity remote address 203.0.113.1
 authentication remote rsa-sig
 authentication local rsa-sig
crypto ipsec profile IPSEC-PROF
 set ikev2-profile IKEV2-PROF
interface Tunnel0
 tunnel protection ipsec profile IPSEC-PROF. The correct answer configures IKEv2 with RSA signature authentication in an IKEv2 profile, then applies an IPsec profile to a tunnel interface. This ensures certificate-based authentication and on-demand tunnel establishment when traffic is routed through the tunnel. The other options either use IKEv1, pre-shared keys, or omit essential IKEv2 components like proposals and policies, making them incorrect.

Answer

crypto ikev2 proposal PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy POL
 proposal PROP
crypto ikev2 keyring KEYRING
 peer PEER
  address 203.0.113.1
  pre-shared-key local MyKey
  pre-shared-key remote MyKey
crypto ikev2 profile IKEV2-PROF
 match identity remote address 203.0.113.1
 identity local address 198.51.100.1
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING

Answer

crypto ikev2 profile IKEV2-PROF
 match identity remote address 203.0.113.1
 authentication remote rsa-sig
 authentication local rsa-sig
crypto ipsec transform-set TS esp-aes esp-sha-hmac
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set TS
 set ikev2-profile IKEV2-PROF
 match address 100
interface GigabitEthernet0/0
 crypto map CMAP

Answer

crypto isakmp policy 10
 authentication rsa-sig
crypto ipsec transform-set TS esp-aes esp-sha-hmac
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set TS
 match address 100
interface GigabitEthernet0/0
 crypto map CMAP

Question 2

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The engineer wants to rate-limit ARP and ICMP traffic destined to the control plane. Which two statements are true about CoPP configuration and behavior? (Choose two.)

Accepted Answer

CoPP uses a policy map that is applied globally with the 'service-policy' command under 'control-plane' configuration mode.. The two true statements are that CoPP uses a policy map applied under control-plane configuration, and that the 'police' command can set rate limits and actions. CoPP is essential for protecting the control plane from excessive traffic. The other statements are false because CoPP can match Layer 2 protocols like ARP, it only affects control plane traffic, and it supports protocol keywords in class maps.

Answer

CoPP requires the use of an ACL to match traffic; class maps cannot use protocol keywords like 'arp' or 'icmp'.

Answer

CoPP policies are applied to the data plane and affect all transit traffic, not just traffic destined to the control plane.

Answer

CoPP can only classify traffic based on Layer 3 and Layer 4 headers, not Layer 2 headers like ARP.

Question 3

A network engineer is configuring an IPsec site-to-site VPN on a Cisco IOS XE router. The engineer wants to ensure that only traffic from the 10.10.10.0/24 subnet is encrypted and sent through the tunnel, while all other traffic is sent unencrypted. The engineer has configured the crypto ACL as permit ip 10.10.10.0 0.0.0.255 192.168.20.0 0.0.0.255. However, the engineer notices that traffic from 10.10.10.0/24 to other destinations is also being encrypted. What is the most likely cause?

Accepted Answer

A default route or more specific route is directing the traffic into the tunnel interface, causing it to be encrypted.. The crypto ACL defines which traffic should be encrypted, but routing determines where packets are sent. If a default route or a route for the destination points to the tunnel interface, traffic not matching the ACL can be routed into the tunnel and encrypted. The most likely cause is that routing is directing traffic into the tunnel, not the ACL itself. Checking the routing table and ensuring that only intended traffic is routed to the tunnel is necessary.

Answer

The transform set is misconfigured, causing all traffic to be encrypted.

Answer

The crypto ACL is matching more traffic than intended due to an implicit deny or incorrect wildcard mask.

Answer

The crypto map is applied to the wrong interface.

Question 4

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against excessive ARP traffic. The administrator wants to rate-limit ARP packets destined to the control plane to 1000 packets per second, with a burst of 2000 packets, and drop excess traffic. Which configuration snippet correctly achieves this?

Accepted Answer

policy-map COPP-ARP
 class ARP-CLASS
  police rate 1000 pps burst 2000 packets
   drop
!. Control Plane Policing uses the Modular QoS CLI to rate-limit traffic destined to the control plane. The correct configuration requires a class-map to match ARP traffic, a policy-map that applies a police action with the desired rate and burst, and the drop action to discard excess packets. The policy-map is then applied to the control plane with the service-policy input command.

Answer

class-map match-all ARP-CLASS
 match access-group name ARP-ACL
!
policy-map COPP-ARP
 class ARP-CLASS
  police rate 1000 pps burst 2000 packets
   transmit
!

Answer

class-map match-any ARP-CLASS
 match protocol arp
!
policy-map COPP-ARP
 class ARP-CLASS
  police cir 1000
   drop
!
control-plane
 service-policy input COPP-ARP

Answer

policy-map COPP-ARP
 class ARP-CLASS
  police 1000 2000 conform-action transmit exceed-action drop
!

Question 5

A network engineer must secure a Cisco IOS XE router's management plane so that only SSH version 2 is accepted, and idle SSH sessions are terminated after 5 minutes. The engineer enters 'ip ssh version 2' and 'ip ssh time-out 300'. After committing the configuration, the engineer notices that SSH version 1 clients can still connect. What is the most likely cause?

Accepted Answer

The SSH server must be restarted with 'no ip ssh server' followed by 'ip ssh server' for the version change to take effect.. The global command 'ip ssh version 2' restricts the SSH server to version 2, but on some IOS XE releases the change requires restarting the SSH server. Disabling and re-enabling the server forces the new version to be applied. VTY transport commands and key generation do not control the SSH protocol version, so they are not valid remedies.

Answer

The 'ip ssh version 2' command is not supported on IOS XE and must be replaced with 'transport input sshv2' under the VTY lines.

Answer

The RSA key pair was generated before SSH version 2 was configured, so the router still advertises SSH version 1.

Answer

The VTY lines are configured with 'transport input all', which overrides the global SSH version setting.

Question 6

A network administrator is configuring AAA authorization on a Cisco IOS XE router. The administrator wants to ensure that after successful authentication, users are authorized for specific commands based on their user privilege level, and that authorization is performed using TACACS+ with fallback to local authorization if the TACACS+ server is unreachable. Which configuration achieves this?

Accepted Answer

aaa authorization exec default group tacacs+ local. The command aaa authorization exec default group tacacs+ local configures EXEC authorization to first use TACACS+, then fall back to the local database if TACACS+ is unavailable. This ensures that users are authorized based on their privilege level as defined on the TACACS+ server, with local authorization as a backup.

Answer

aaa authorization exec default group tacacs+ if-authenticated

Answer

aaa authorization commands 15 default group tacacs+ local

Answer

aaa authorization exec default group tacacs+ none

Question 7

A network engineer is configuring a Cisco IOS XE router to authenticate OSPFv3 neighbors using IPsec Authentication Header (AH) with SHA-256 HMAC. The engineer has applied the following configuration to the router:

crypto keyring OSPFv3_KEYRING
  pre-shared-key address 2001:DB8::2 key MySecretKey
!
interface GigabitEthernet0/0
  ipv6 ospf 1 area 0
  ipv6 ospf authentication ipsec spi 500 sha256 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF

However, OSPFv3 neighbor adjacency fails to form. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the same pre-shared key on the neighboring router and apply the identical IPsec SPI and SHA-256 key to its interface.. OSPFv3 IPsec authentication requires symmetric configuration on both routers. The local router has the correct interface command with SPI and SHA-256 key, but the neighbor router must have the same pre-shared key in its crypto keyring and the identical SPI and key on its interface. Without this symmetry, the authentication header check fails, and the adjacency does not form. Ensuring both routers have matching parameters resolves the issue.

Answer

Change the OSPFv3 authentication from IPsec AH to IPsec ESP with null encryption to allow the neighbor relationship.

Answer

Enable OSPFv3 authentication globally under the router ospfv3 process using the area authentication command.

Answer

Replace the pre-shared key with a digital certificate and configure IKEv2 to negotiate the IPsec security association for OSPFv3.

Question 8

A network engineer is configuring a Cisco IOS router for zone-based firewall (ZBFW) to inspect traffic between a LAN zone and a WAN zone. The engineer wants to ensure that return traffic for sessions initiated from the LAN is allowed without explicitly configuring an ACL for return traffic. Which zone-based firewall configuration is required to achieve this?

Accepted Answer

Apply an inspect policy on the LAN-to-WAN traffic and no policy on the WAN-to-LAN traffic; the inspect action automatically allows return traffic.. Zone-based firewall uses stateful inspection to automatically allow return traffic for sessions initiated in the opposite direction. Applying an inspect policy on the LAN-to-WAN traffic creates a session, and the router permits return traffic without needing a policy on the WAN-to-LAN direction. This eliminates the need for explicit ACLs for return traffic, which is the desired outcome.

Answer

Apply an inspect policy on the LAN-to-WAN traffic and a drop policy on the WAN-to-LAN traffic.

Answer

Apply an inspect policy on the LAN-to-WAN traffic and a pass policy on the WAN-to-LAN traffic.

Answer

Apply a pass policy on the LAN-to-WAN traffic and an inspect policy on the WAN-to-LAN traffic.

Question 9

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch is configured as an authenticator, and a RADIUS server is used for authentication. The administrator wants to ensure that if the RADIUS server becomes unreachable, the switch will place the port in a state that requires manual intervention to restore access. Which command should be configured on the switch to achieve this?

Accepted Answer

authentication event server dead action authorize. When the RADIUS server is unreachable, the 'authentication event server dead action authorize' command without a VLAN argument causes the switch to keep the port unauthorized. This state persists until an administrator manually intervenes, satisfying the requirement. Commands that assign a VLAN or reinitialize the port would grant access automatically, which is not desired.

Answer

authentication event server dead action reinitialize vlan 1

Answer

authentication event fail action authorize vlan 1

Answer

authentication event server dead action authorize vlan 1

Question 10

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that the VPN tunnel uses strong encryption and integrity algorithms, and that perfect forward secrecy (PFS) is enabled. Which two configuration commands are required to meet these requirements? (Choose two.)

Accepted Answer

crypto ipsec transform-set MYSET esp-aes 256 esp-sha256-hmac. To meet the requirements, you need to define the IPsec transform-set with strong algorithms (ESP-AES 256 and ESP-SHA256-HMAC) and configure an IPsec profile that references the transform-set and enables PFS with a strong Diffie-Hellman group (group14). These two commands together ensure both strong encryption/integrity and PFS for the IPsec tunnel.

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 set pfs group14

Answer

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14

Answer

crypto isakmp key SECRETKEY address 203.0.113.2

Question 11

A network security engineer is deploying a Cisco IOS XE router at a branch office. The security policy requires that the router's management plane be protected by an ACL that restricts SSH access to the 10.10.10.0/24 management subnet, but the engineer notices that the existing ACL is not blocking SSH from other subnets. The engineer verifies that the ACL is applied to the VTY lines with 'access-class 10 in'. Which additional configuration is required to ensure that the ACL is applied to all incoming SSH sessions?

Accepted Answer

Configure 'access-class 10 in' under the 'line vty 0 4' and 'line vty 5 15' sections.. The ACL must be applied to all VTY lines because Cisco IOS XE routers have two VTY line ranges: 0-4 and 5-15. If only the first range is configured, SSH sessions using lines 5-15 bypass the ACL, allowing unauthorized access. Applying the access-class to both ranges ensures that all incoming SSH connections are filtered by the ACL, satisfying the management plane protection requirement.

Answer

Configure 'ip access-list standard 10' and add 'permit 10.10.10.0 0.0.0.255 any'.

Answer

Configure 'ip access-group 10 in' on the management interface.

Answer

Configure 'transport input ssh' under the VTY lines to restrict access to SSH only.

Question 12

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect against denial-of-service attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's control plane to 100 packets per second, while allowing all other traffic. The engineer creates a class-map and policy-map, then applies the policy to the control plane. Which two statements are true about this configuration? (Choose two.)

Accepted Answer

The policy-map must be applied to the control plane using the 'service-policy input' command under 'control-plane' configuration mode.. CoPP policies are applied under 'control-plane' with 'service-policy input'. The class-map must identify the target traffic, typically via an ACL matching ICMP echo requests (type 8 code 0). The police command rate-limits that traffic. The policy does not automatically apply to interfaces, and a class-default is optional. Thus, the true statements are about the application point and the ACL match.

Answer

The policy-map must be configured with a 'class class-default' that has no police action to allow all other traffic.

Answer

The 'police' command in the policy-map must specify a conform action of 'transmit' and an exceed action of 'drop' to rate-limit traffic.

Answer

The CoPP policy will automatically be applied to all interfaces in the inbound direction.

Question 13

A network administrator is configuring AAA authorization on a Cisco IOS router to restrict which commands a TACACS+ authenticated user can execute. The administrator wants to ensure that users in the 'helpdesk' group can only run show commands, while users in the 'admin' group can run all commands. The administrator has configured the TACACS+ server with the appropriate command sets and applied the following configuration on the router:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

tacacs server TAC1
 address ipv4 10.1.1.100
 key MyKey

line vty 0 4
 login authentication default
 authorization exec default
 authorization commands 15 default

However, when a helpdesk user logs in, they can execute all commands, including configuration commands. Which action should the administrator take to enforce the command restrictions?

Accepted Answer

Ensure that the TACACS+ server is configured to return the correct command set for the helpdesk group and that the router is configured to use TACACS+ for command authorization.. Command authorization on Cisco IOS routers relies on the TACACS+ server to return the appropriate command set for the user's privilege level. The router configuration appears correct for level 15 authorization, but if the server does not enforce restrictions or the router falls back to local (which permits all), helpdesk users can run all commands. The administrator must verify the TACACS+ server's per-command authorization configuration and ensure the router successfully uses TACACS+ for command authorization.

Answer

Change the authorization commands level from 15 to 1 for the helpdesk users on the router.

Answer

Remove the local keyword from the aaa authorization commands 15 default command to prevent fallback to local authorization.

Answer

Configure aaa authorization commands 1 default group tacacs+ local to authorize privilege level 1 commands for helpdesk users.

Question 14

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that uRPF operates in strict mode and that the router logs dropped packets. Which two configuration commands are required to achieve this? (Choose two.)

Accepted Answer

ip verify unicast source reachable-via rx acl-number. Strict mode uRPF is enabled with the 'ip verify unicast source reachable-via rx' command. To log dropped packets, an ACL must be referenced at the end of the command. The ACL is used to select which dropped packets to log, and it must permit the traffic to be logged. The combination of these two commands achieves strict mode uRPF with logging.

Answer

ip verify unicast source reachable-via rx logging

Answer

ip verify unicast source reachable-via any

Answer

ip verify unicast source reachable-via rx allow-default

Question 15

A network engineer is configuring a Cisco IOS XE router to authenticate management users via TACACS+ against an ISE server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, a local fallback user can still log in with privilege level 15. The engineer has configured the following:

aaa new-model
tacacs server ISE1
 address ipv4 10.1.1.100
 key MyKey
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
username backup privilege 15 secret BackupPass

Which two additional configurations are required to ensure the local fallback user can log in and have full command authorization when the TACACS+ server is unavailable? (Choose two.)

Accepted Answer

Configure aaa authorization commands 15 default group tacacs+ local to include local fallback for command authorization.. To ensure the local fallback user can log in and have full command authorization when TACACS+ is unavailable, the router must have local fallback configured for both exec and command authorization. The given configuration already includes local for both exec and commands 15 authorization. However, the command authorization must be applied to the VTY lines to be effective; otherwise, no command authorization occurs, and the user can run all commands, which might be acceptable. But the question likely expects that the engineer must apply the authorization commands to the VTY lines and ensure the local user is configured. The two correct options are C and D, as they explicitly include local fallback for exec and commands, which are necessary for the fallback user to obtain privilege 15 and have commands authorized locally.

Answer

Configure aaa authentication login default group tacacs+ local-case to ensure case-sensitive local authentication.

Answer

Configure the local user with privilege 15 and ensure that aaa authorization commands 15 default group tacacs+ local is applied to the VTY lines.

Answer

Configure aaa authorization console to allow authorization for console access.