300-410 Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against denial-of-service attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's control plane. The engineer configures a class-map to match ICMP echo requests and a policy-map to police this traffic. Which two additional steps are required to complete the CoPP configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define an ACL to match ICMP echo requests and reference it in the class-map.. To complete CoPP, the engineer must define a class-map that matches the traffic (using an ACL for ICMP echo requests) and then apply the policy-map to the control plane with 'service-policy input' under the 'control-plane' configuration. These two steps ensure that the policing policy is correctly targeted and activated for control plane traffic.

Answer

Configure 'control-plane host' to enable CoPP for host traffic.

Answer

Configure 'platform qos' to enable CoPP globally.

Answer

Apply the policy-map to the ingress interface using 'service-policy input POLICY-MAP'.

Question 2

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to use TACACS+ for authentication and authorization, and local fallback for authentication if the TACACS+ server is unreachable. The administrator also wants to ensure that user privilege levels are enforced based on the TACACS+ server response. Which two commands are required to achieve these goals? (Choose two.)

Accepted Answer

aaa authentication login default group tacacs+ local. To configure AAA with TACACS+ authentication and local fallback, the authentication method list must specify group tacacs+ followed by local. For authorization and privilege level enforcement, the exec authorization method list must include TACACS+ and local fallback. These two commands together provide the required functionality.

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa accounting exec default start-stop group tacacs+

Answer

aaa authorization commands 15 default group tacacs+ local

Question 3

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against denial-of-service attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's control plane. The engineer configures a class-map to match ICMP echo requests and a policy-map to police this traffic. Which two additional steps are required to complete the CoPP configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the class-map uses the 'match-any' or 'match-all' keyword appropriately and includes the 'match protocol arp' and 'match protocol icmp' statements.. To activate CoPP, the engineer must attach the policy-map to the control plane using 'service-policy input' under control-plane configuration mode, and ensure the class-maps correctly match the targeted protocols (ARP and ICMP). These two steps are necessary: the class-map defines what to police, and the service-policy application enforces the police actions on control plane traffic.

Answer

Enable 'ip cef distributed' to allow CoPP to process traffic in hardware.

Answer

Configure a service-policy on each physical interface to rate-limit ARP and ICMP traffic.

Answer

Configure an ACL to permit only trusted sources and apply it to the control plane with the 'access-class' command.

Question 4

A network administrator is configuring a Cisco IOS router to authenticate SSH users against an external TACACS+ server. The TACACS+ server is reachable at 10.10.10.5, and the shared secret is 'Cisco123'. The administrator wants to ensure that if the TACACS+ server is unreachable, a local user account 'backup' with privilege level 15 is used for authentication. Which configuration sequence correctly achieves this?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123. The correct configuration must enable AAA, set the default login authentication to use TACACS+ first and then the local database, create a local user with privilege 15, and define the TACACS+ server with the correct IP and key. The fallback to local is essential for when the TACACS+ server is unreachable, and using 'secret' is best practice for storing the local password securely.

Answer

aaa new-model
aaa authentication login default group tacacs+
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ local
username backup privilege 15 password Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ enable
username backup privilege 15 secret Cisco123
tacacs server TAC1
 address ipv4 10.10.10.5
 key Cisco123

Question 5

A network engineer configures a Cisco IOS router with the following commands:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group BLOCK_TELNET in

After applying the configuration, the engineer notices that Telnet traffic from the local router to a remote device is still successful. What is the cause of this issue?

Accepted Answer

The access list is applied in the inbound direction, which only filters traffic entering the interface, not traffic originated by the router.. Access lists applied to an interface with the ip access-group command filter only traffic that passes through that interface in the specified direction. They do not filter traffic originated by the router itself. To control Telnet access to or from the router, an access-class must be applied under the VTY lines. Since the ACL is applied inbound on an interface, it does not affect locally generated Telnet packets, so the Telnet session succeeds.

Answer

The implicit deny at the end of the access list is blocking the Telnet traffic, but the 'permit ip any any' statement overrides it.

Answer

The access list must be applied with the 'ip access-group BLOCK_TELNET out' command on the same interface to filter locally generated traffic.

Answer

The 'deny tcp any any eq 23' statement is incorrect because Telnet uses TCP port 22, not port 23.

Question 6

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. The administrator has configured the crypto ACL as follows: 'access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255'. However, after applying the crypto map, the administrator notices that all traffic, including traffic to other destinations, is being dropped. What is the most likely cause?

Accepted Answer

The ACL 101 is also applied as an interface ACL in the outbound direction, and its implicit deny is dropping all other traffic.. The most likely cause is that the crypto ACL is also applied as an interface ACL, and its implicit deny is dropping all traffic that does not match the permit statement. Crypto ACLs are not meant to filter traffic; they only identify interesting traffic for encryption. If the same ACL is used for interface filtering, it will drop non-matching traffic.

Answer

The crypto map is applied to the wrong interface or in the wrong direction.

Answer

The crypto ACL is missing a deny statement for other traffic, causing all non-matching traffic to be dropped by the implicit deny at the end of the ACL.

Answer

The IPsec transform set is misconfigured, causing all traffic to be dropped.

Question 7

A network administrator is configuring AAA on a Cisco IOS router using TACACS+. The requirement is that if the TACACS+ server is unreachable, the router should allow administrative access using the local username and password configured on the router. Which configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. To configure AAA authentication with TACACS+ and a fallback to the local username database, you use the 'aaa authentication login default group tacacs+ local' command. The 'local' keyword specifies that the router should use its local username and password configuration if the TACACS+ server does not respond. This provides a secure fallback method, ensuring administrative access is not lost during server outages.

Answer

aaa authentication login default group tacacs+ enable

Answer

aaa authentication login default group tacacs+ if-needed

Answer

aaa authentication login default group tacacs+ none

Question 8

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The administrator wants to rate-limit ARP traffic destined to the route processor. Which configuration correctly applies a CoPP policy to ARP traffic?

Accepted Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY. Control Plane Policing (CoPP) is configured by defining class-maps to match traffic, policy-maps to define actions, and then attaching the policy to the control plane using the 'control-plane' global configuration mode with 'service-policy input'. The class-map must match ARP traffic using 'match protocol arp'. This setup rate-limits ARP packets destined to the route processor, protecting it from DoS attacks.

Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
interface Control-Plane
 service-policy input COPP_POLICY

Answer

class-map match-all ARP_CLASS
 match protocol arp
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
control-plane host
 service-policy input COPP_POLICY

Answer

class-map match-all ARP_CLASS
 match access-group name ARP_ACL
!
policy-map COPP_POLICY
 class ARP_CLASS
  police 8000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 service-policy input COPP_POLICY

Question 9

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using MD5. The engineer enters the following commands:

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 C1sco123

After applying the configuration, the OSPF neighbor relationship fails to form. Which action must the engineer take to resolve the issue?

Accepted Answer

Configure the same MD5 key and key ID on the neighboring router's interface.. OSPF MD5 authentication requires that both neighbors have the same key ID and key string configured on their interfaces. The local router is correctly configured for MD5, but the neighbor lacks the matching key, causing authentication to fail. Configuring the identical key on the neighbor's interface will allow the adjacency to form.

Answer

Configure the ip ospf authentication-key command with the same password.

Answer

Change the key ID to 0 on both routers to match the default key.

Answer

Enable OSPF authentication globally using the area authentication command.

Question 10

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins against an external TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. Which configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct command is 'aaa authentication login default group tacacs+ local'. It configures the default method list to try TACACS+ first and then the local database if the server is unreachable. This ensures administrative SSH logins are authenticated externally when possible, but local fallback maintains access during server outages. The order of methods is critical: listing 'local' first would bypass the TACACS+ server.

Answer

aaa authentication login default group radius local

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Question 11

A network engineer is configuring a Cisco IOS router to authenticate management users via TACACS+ using the server at 10.1.1.100 with the shared key 'Cisco123'. The engineer wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to local authentication using the local username 'admin' with password 'AdminPass'. Which configuration correctly achieves this?

Accepted Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass. The correct configuration enables AAA, defines the TACACS+ server, and configures the default authentication and authorization method lists to try TACACS+ first and then local. The VTY lines must reference the correct method list, and a local username must exist for fallback. The other options either omit fallback, reverse the order, or reference an invalid method list.

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+
aaa authorization exec default group tacacs+
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default local group tacacs+
aaa authorization exec default local group tacacs+
line vty 0 4
 login authentication default
username admin privilege 15 secret AdminPass

Answer

aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
line vty 0 4
 login authentication TAC1
username admin privilege 15 secret AdminPass

Question 12

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against denial-of-service attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's control plane. The engineer configures a class-map to match ICMP echo requests and a policy-map to police this traffic. Which two additional steps are required to complete the CoPP configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
control-plane
 service-policy input CoPP. CoPP is implemented by defining a class-map to match traffic, a policy-map to police it, and then applying the policy-map to the control plane with 'service-policy input' under the 'control-plane' configuration mode. The correct snippet uses an ACL to match ICMP echo requests, polices them at 100 pps, and applies the policy to the control plane. This protects the route processor from excessive ICMP traffic while allowing other traffic.

Answer

class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input CoPP

Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy output CoPP

Answer

access-list 101 permit icmp any any echo
class-map match-any ICMP
 match access-group 101
policy-map CoPP
 class ICMP
  police 100 conform-action transmit exceed-action drop
control-plane
 service-policy output CoPP

Question 13

A network administrator is configuring a Cisco IOS router to authenticate login users against a TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, the router falls back to the local username database for authentication. Which configuration should be applied?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration must specify TACACS+ as the primary authentication method and local as the fallback. The order of methods in the AAA authentication list determines the sequence: the router tries each method in turn until one succeeds or all fail. Placing 'group tacacs+' before 'local' ensures TACACS+ is attempted first, and if unreachable, local authentication is used.

Answer

aaa authentication login default group tacacs+

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group radius local

Question 14

A network engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 (WAN) and GigabitEthernet0/1 (LAN). The engineer wants to apply strict mode uRPF on the WAN interface and loose mode uRPF on the LAN interface. Which two commands are required to accomplish this? (Choose two.)

Accepted Answer

interface GigabitEthernet0/0, then ip verify unicast source reachable-via rx. The correct commands are to enable strict mode uRPF on the WAN interface with ip verify unicast source reachable-via rx, and loose mode uRPF on the LAN interface with ip verify unicast source reachable-via any. These configurations match the requirement of strict on WAN and loose on LAN, providing effective anti-spoofing while accommodating asymmetric routing on the LAN.

Answer

interface GigabitEthernet0/0, then ip verify unicast source reachable-via any

Answer

interface GigabitEthernet0/1, then ip verify unicast source reachable-via rx

Answer

ip verify unicast source reachable-via rx allow-default

Question 15

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. The engineer also wants to use a pre-shared key for authentication. Which configuration element is required to define the interesting traffic?

Accepted Answer

access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. The interesting traffic is defined by an extended ACL that matches the source and destination subnets. This ACL is then referenced in the crypto map using the 'match address' command. The ACL specifies which packets are encrypted and sent through the VPN tunnel, while all other traffic is sent unencrypted. The other options are part of the IPsec configuration but do not define the traffic to be encrypted.

Answer

crypto isakmp policy 10
 authentication pre-share

Answer

crypto map MYMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set MYSET
 match address 101

Answer

crypto ipsec transform-set MYSET esp-aes esp-sha-hmac