300-410 Infrastructure Security Practice Test 7 — 15 Questions

Question 1

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch is configured as an authenticator, and the RADIUS server is reachable. However, some devices such as printers do not support 802.1X supplicant software. The administrator wants these devices to be automatically placed into a restricted VLAN with limited access. Which feature should be configured on the switch ports to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MAB (MAC Authentication Bypass). MAC Authentication Bypass (MAB) enables the switch to authenticate devices that do not support 802.1X by using their MAC addresses as credentials. The RADIUS server can then authorize and assign a VLAN, such as a restricted VLAN, based on the MAC address. This is the correct feature to support printers and similar devices while maintaining network access control.

Answer

Critical VLAN

Answer

802.1X supplicant mode

Answer

Web Auth

Question 2

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that uRPF is applied in a way that allows asymmetric routing. Which uRPF mode should be configured?

Accepted Answer

Loose mode. Loose mode uRPF verifies that the source IP address is present in the routing table, but does not require the packet to arrive on the same interface as the route to the source. This allows asymmetric routing while still providing anti-spoofing protection. Strict mode would drop packets in asymmetric environments. VLAN mode and feasible path mode are not standard uRPF modes that allow asymmetric routing.

Answer

VLAN mode

Answer

Feasible path mode

Answer

Strict mode

Question 3

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet is encrypted and sent over the VPN, while all other traffic is sent unencrypted. Which configuration element defines the traffic to be encrypted?

Accepted Answer

crypto ACL. The crypto ACL, an extended access list, is used to define interesting traffic that should be encrypted and sent through the IPsec tunnel. It specifies the source and destination subnets and protocols. The crypto map references this ACL to match packets that require IPsec protection. Therefore, the crypto ACL is the configuration element that defines the traffic to be encrypted.

Answer

ISAKMP policy

Answer

crypto map

Answer

transform set

Question 4

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH access using TACACS+ with a backup local user account. The TACACS+ server is reachable, but the engineer wants to ensure that if the TACACS+ server becomes unreachable, the router falls back to local authentication for users who are not defined on the TACACS+ server. Which AAA configuration accomplishes this?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the 'group tacacs+ local' method list, which attempts TACACS+ authentication first and then falls back to the local username database if the TACACS+ server is unreachable. This ensures that administrators can still log in with locally defined credentials during a TACACS+ outage, maintaining access without compromising security.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ if-needed

Answer

aaa authentication login default group tacacs+ enable

Question 5

A network engineer is troubleshooting a Cisco IOS router that is configured for AAA authorization. The engineer notices that users are not being authorized for certain commands even though the TACACS+ server is reachable and the user is authenticated. The configuration includes 'aaa authorization exec default group tacacs+ local' and 'aaa authorization commands 15 default group tacacs+ local'. Which issue is most likely causing the problem?

Accepted Answer

The TACACS+ server is not configured to return the correct AV pairs for command authorization.. Command authorization relies on the TACACS+ server to provide authorization attributes that define which commands the user is allowed to execute. If the server is reachable and the user is authenticated but commands are denied, the server is likely not configured to return the proper AV pairs for command authorization. The local fallback is not used because the server is responding, so the issue is with the server's authorization configuration.

Answer

The 'aaa new-model' command is not enabled.

Answer

The local database does not have the necessary privilege level configured for the user.

Answer

The 'aaa authorization commands 15' command requires the 'if-authenticated' keyword to work.

Question 6

A network engineer is deploying a new branch office router (Cisco IOS XE) and wants to protect the control plane from routing protocol floods. The router will run OSPF and EIGRP. The engineer must ensure that control plane packets are rate-limited and that the router logs when the rate is exceeded. Which of the following should be configured?

Accepted Answer

Control Plane Policing (CoPP) using a policy-map that classifies routing protocol traffic and applies police actions with exceeded-action logging.. Control Plane Policing (CoPP) is designed to protect the control plane by rate-limiting traffic destined to the router's CPU. By classifying OSPF and EIGRP packets and applying a policer with logging, the engineer can ensure that routing protocol floods are mitigated and that any excess is logged. Other options do not provide both rate-limiting and logging for control plane traffic.

Answer

Management Plane Protection (MPP) with an ACL that permits only SSH and SNMP.

Answer

Control Plane Protection (CPPr) with a port-filter policy that drops all non-management traffic.

Answer

uRPF strict mode on all interfaces facing the service provider.

Question 7

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The administrator wants to rate-limit ICMP echo requests destined to the router itself to 64 kbps, while allowing all other traffic to the control plane without restriction. Which configuration snippet correctly achieves this?

Accepted Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
!
control-plane
 service-policy input COPP. The correct configuration creates a class map matching ICMP traffic via an ACL, a policy map that polices that class to 64 kbps, and leaves the class-default without a policer. Applying the policy map to the control-plane in the input direction enforces the rate limit on ICMP traffic destined to the router while allowing all other control plane traffic unrestricted.

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
  police 8000
!
control-plane
 service-policy input COPP

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000
 class class-default
  police 8000000
!
control-plane
 service-policy input COPP

Answer

class-map match-any ICMP
 match access-group name ICMP_ACL
!
policy-map COPP
 class ICMP
  police 64000 conform-action transmit exceed-action drop
 class class-default
  police 64000
!
control-plane
 service-policy output COPP

Question 8

A network engineer is configuring a Cisco IOS router to authenticate management access using TACACS+. The TACACS+ server is reachable at 10.1.1.100. The engineer wants to ensure that if the TACACS+ server becomes unavailable, the router will fall back to using the local username database for authentication. Which command sequence correctly configures this fallback?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct configuration uses the default method list with TACACS+ first and local second. This ensures that if the TACACS+ server is unreachable, the router will use the local username database for authentication, maintaining management access. The other options either use the wrong fallback method, reverse the order, or disable authentication entirely.

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ enable

Question 9

A network engineer is configuring AAA authorization on a Cisco IOS router. The engineer wants to limit which commands a user can execute after logging in via SSH. The user should be allowed to run show commands but not configuration commands. Which AAA authorization method should be used?

Accepted Answer

aaa authorization commands 15 default group tacacs+. AAA authorization for commands allows the network access server to consult the AAA server for each command entered by the user. By specifying privilege level 15, the engineer can restrict commands for users at that privilege level. The TACACS+ server can then be configured with a command set that permits show commands and denies configuration commands, achieving the desired restriction.

Answer

aaa authentication login default group tacacs+

Answer

aaa authorization network default group tacacs+

Answer

aaa authorization exec default group tacacs+

Question 10

A network engineer is implementing Zone-Based Policy Firewall (ZPFW) on a Cisco IOS router. The router has three interfaces: inside, outside, and DMZ. The engineer wants to allow HTTP traffic from the inside zone to the DMZ zone, and block all other traffic from inside to DMZ. Which configuration is required?

Accepted Answer

Define a zone pair from inside to DMZ, apply a policy-map that inspects HTTP and drops all other traffic.. In ZPFW, traffic between zones is controlled by zone pairs. A zone pair from inside to DMZ with a policy-map that inspects HTTP and implicitly drops other traffic will allow only HTTP and block the rest. Other options either do not use ZPFW correctly or apply the policy in the wrong direction.

Answer

Configure a class-map that matches HTTP and apply it as an inspect action in the global policy.

Answer

Apply an ACL on the inside interface permitting HTTP to the DMZ and denying all other traffic.

Answer

Create a zone pair from DMZ to inside and apply a policy-map that permits HTTP return traffic.

Question 11

A network administrator is configuring a Cisco IOS router for site-to-site VPN using DMVPN Phase 3. The administrator wants to ensure that spoke-to-spoke traffic flows directly between spokes without traversing the hub, and that the hub is only used for initial registration and route resolution. Which technology must be enabled on the spokes to achieve direct spoke-to-spoke communication?

Accepted Answer

NHRP redirect on the hub and NHRP shortcut on the spokes. DMVPN Phase 3 enables direct spoke-to-spoke communication through NHRP redirect on the hub and NHRP shortcut on the spokes. The hub sends NHRP redirect messages to spokes when it detects traffic that could be sent directly, and the spokes use NHRP shortcut to resolve the destination and build a direct tunnel. This reduces latency and hub load.

Answer

IPsec tunnel protection on the hub only

Answer

NHRP redirect on the spokes and NHRP shortcut on the hub

Answer

OSPF broadcast network type on all spokes

Question 12

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to use a RADIUS server for authentication and authorization, but wants to use local authentication as a fallback if the RADIUS server is unreachable. Which command should be used to configure the fallback?

Accepted Answer

aaa authentication login default group radius local. The command 'aaa authentication login default group radius local' sets RADIUS as the primary authentication method and local as the fallback. If the RADIUS server is unreachable, the router will use the local username database, ensuring continued administrative access.

Answer

aaa authentication login default group radius enable

Answer

aaa authentication login default local group radius

Answer

aaa authentication login default group radius none

Question 13

A network administrator is troubleshooting an 802.1X deployment on a Cisco switch. Users report that they cannot authenticate and are placed into a guest VLAN. The administrator suspects that the switch is not receiving EAPOL packets from the supplicants. Which two actions should the administrator take to verify that EAPOL packets are being received and processed on the switch? (Choose two.)

Accepted Answer

Enable 'debug dot1x all' and observe the debug output for EAPOL packet reception.. The two correct actions are using 'show dot1x interface' and enabling 'debug dot1x all'. These commands provide direct visibility into EAPOL packet reception and processing on the switch. The other options either show session information that doesn't confirm EAPOL reception or focus on RADIUS or MAC address tables, which are not specific to verifying EAPOL packets from the supplicant.

Answer

Use the 'show authentication sessions interface' command to view the session status and method.

Answer

Check the 'show mac address-table interface' command to see if the supplicant's MAC address is learned.

Answer

Use the 'show radius statistics' command to verify RADIUS server reachability.

Question 14

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer has created a class map named 'CRITICAL' that matches BGP traffic and a policy map named 'COPP-POLICY' that applies a police rate of 1000000 bps with a conform-action transmit and exceed-action drop. After applying the policy map to the control plane, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue?

Accepted Answer

Increase the police rate in the policy map to accommodate the BGP traffic.. The BGP sessions are flapping because the CoPP policer is dropping legitimate BGP traffic due to a rate limit that is too low. Increasing the police rate allows the necessary BGP traffic to pass, stabilizing the sessions. The other options either disable policing, apply it incorrectly, or remove protection, none of which address the root cause.

Answer

Change the exceed-action to transmit and set a lower conform-action rate.

Answer

Remove the class map from the policy map and rely on default CoPP settings.

Answer

Apply the policy map to the data plane interfaces instead of the control plane.

Question 15

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS-XE router to protect the route processor from excessive traffic. The administrator creates a class-map to match all management traffic (SSH, SNMP, TACACS+) and a policy-map to police that traffic to 1 Mbps. After applying the service-policy to the control-plane, the administrator notices that some legitimate SNMP polling is being dropped. Which two actions can the administrator take to resolve this issue while maintaining protection against DoS attacks? (Choose two.)

Accepted Answer

Increase the police rate for the management class to accommodate the SNMP polling volume.. The legitimate SNMP polling is being dropped because the policer rate is too low for the combined management traffic. Increasing the overall rate or creating a separate class with a higher rate for SNMP will allow legitimate traffic while still policing excess. Both actions maintain protection against DoS by keeping policing in place.

Answer

Remove the police action and use a bandwidth guarantee instead.

Answer

Apply the service-policy to the data plane interfaces instead of the control plane.

Answer

Enable SNMPv3 authentication to reduce the volume of SNMP traffic.