300-410 Infrastructure Security Practice Test 8 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to use IPsec VPN with IKEv2. The engineer wants to ensure that the router prefers a specific transform set that includes AES-256 encryption and SHA-256 hashing for integrity. Which command correctly defines the IKEv2 proposal with these parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

crypto ikev2 proposal PROPOSAL1
 encryption aes-cbc-256
 integrity sha256
 group 14. IKEv2 proposals define the encryption, integrity, and Diffie-Hellman group parameters. The correct command is crypto ikev2 proposal, followed by encryption aes-cbc-256, integrity sha256, and group 14. This proposal can then be referenced in an IKEv2 policy. The other options use incorrect commands or syntax for IKEv2.

Answer

crypto ikev2 policy POLICY1
 encryption aes-256
 hash sha256
 group 14

Answer

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14

Answer

crypto ikev2 profile PROFILE1
 encryption aes-cbc-256
 integrity sha256
 group 14

Question 2

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch is configured as an authenticator, and a RADIUS server is used for authentication. The administrator wants to ensure that if the RADIUS server becomes unreachable, endpoints are placed into a guest VLAN with limited access. Which command must be configured on the switch to enable this behavior?

Accepted Answer

authentication event server dead action authorize vlan 100. To place endpoints into a guest VLAN when the RADIUS server is unreachable, the switch must be configured with the 'authentication event server dead action authorize vlan' command under the interface. This triggers the fallback VLAN assignment upon detecting the server as dead.

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 100

Answer

authentication violation restrict

Question 3

A network administrator is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connects to the internet, and GigabitEthernet0/1 connects to the internal network. The administrator wants to ensure that packets arriving on GigabitEthernet0/0 are dropped if their source address is not reachable via that interface. However, the administrator also wants to allow asymmetric routing where return traffic may use a different path. Which uRPF mode should be configured on GigabitEthernet0/0?

Accepted Answer

ip verify unicast source reachable-via any. Loose uRPF, configured with ip verify unicast source reachable-via any, checks the routing table for the source address but does not require the source to be reachable via the incoming interface. This allows asymmetric routing while still providing spoofing mitigation. Strict uRPF (rx) would drop packets in asymmetric scenarios, and the other options are either invalid or equivalent to strict mode.

Answer

ip verify unicast source reachable-via rx

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via tx

Question 4

A network engineer is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers. The tunnel fails to establish, and the engineer sees the debug output: 'ISAKMP: Unable to find a valid preshared key'. The engineer verifies that the preshared key is identical on both peers. Which additional configuration is most likely causing the issue?

Accepted Answer

The crypto isakmp key command is configured with the wrong peer address.. The error 'Unable to find a valid preshared key' typically occurs when the router cannot match the preshared key to the peer's IP address. This is often due to the 'crypto isakmp key' command specifying an incorrect peer address, even if the key string itself is correct.

Answer

The crypto map is applied to the wrong interface.

Answer

The transform set is not configured with the correct encryption algorithm.

Answer

The ISAKMP policy priority numbers are different on the two peers.

Question 5

A network technician is configuring a Cisco IOS router to use SSH for remote management. The technician generates an RSA key pair with 2048 bits, configures a local username and password, and enables SSH version 2. However, when attempting to connect via SSH, the connection is refused. Which additional configuration is required on the VTY lines to allow SSH access?

Accepted Answer

transport input ssh. To enable SSH on a Cisco IOS router, you must generate an RSA key pair, configure a local username and password, enable SSH version 2, and apply 'transport input ssh' on the VTY lines. Without this transport command, the router may not accept SSH connections, resulting in a refused connection. The other options either enable insecure protocols or do not address the transport mechanism.

Answer

login local

Answer

transport input all

Answer

exec-timeout 0 0

Question 6

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The engineer has created a class-map to match malicious traffic and a policy-map to police it. Which two statements are true regarding the application and behavior of CoPP? (Choose two.)

Accepted Answer

CoPP uses a token bucket algorithm to enforce rate limits, where the first value is the committed information rate and the second is the burst size.. CoPP is applied to the control plane via the service-policy command under control-plane configuration mode, and it uses a token bucket algorithm with a committed information rate and burst size. The other statements are false: CoPP is not applied to interfaces, class-default does not require a police action, and the exceed-action determines the fate of excess traffic.

Answer

CoPP automatically drops all traffic that exceeds the configured rate, regardless of the exceed-action specified in the policy.

Answer

The class-default class in a CoPP policy-map must always have a police action configured to drop all unmatched traffic.

Answer

CoPP can be applied to a specific interface to police traffic entering that interface before it reaches the control plane.

Question 7

A network administrator is configuring a router to authenticate with a TACACS+ server for administrative access. The administrator enters the command `aaa authentication login default group tacacs+ local` on the router. Which statement describes the authentication behavior when the TACACS+ server is reachable but rejects the user's credentials?

Accepted Answer

The router will deny access and will not attempt local authentication.. With the command `aaa authentication login default group tacacs+ local`, the router first attempts authentication via the TACACS+ server group. If the server is reachable and returns a rejection (e.g., invalid credentials), the router treats that as a final denial and does not fall back to the local database. The local method is used only when the TACACS+ server is unreachable (timeout or error). This ensures that a deliberate rejection by the central server is honored, preventing bypass via local accounts.

Answer

The router will attempt local authentication first, then TACACS+ if local fails.

Answer

The router will send the credentials to both TACACS+ and local simultaneously and grant access if either succeeds.

Answer

The router will fall back to the local database and authenticate the user if the local credentials are valid.

Question 8

A network administrator is configuring IPsec VPN on a Cisco IOS router using IKEv2. The administrator wants to ensure that the IKEv2 proposal includes encryption and integrity algorithms that are considered secure. Which two algorithms should be included in the IKEv2 proposal? (Choose two.)

Accepted Answer

SHA-256 for integrity. For a secure IKEv2 proposal, encryption and integrity algorithms must be strong. AES-CBC-256 provides robust encryption, and SHA-256 offers secure integrity protection. These are both recommended in modern Cisco IOS configurations. 3DES and DES are weak encryption algorithms, and MD5 is an insecure integrity algorithm. Therefore, the correct choices are AES-CBC-256 and SHA-256.

Answer

3DES for encryption

Answer

MD5 for integrity

Answer

DES for encryption

Question 9

A network security engineer is configuring a Cisco IOS router to support Zone-Based Policy Firewall (ZPF). The engineer has created zones INSIDE and OUTSIDE, assigned interfaces to them, and now needs to allow HTTP traffic from INSIDE to OUTSIDE while inspecting return traffic. Which configuration step is required to achieve this?

Accepted Answer

Create a zone-pair from INSIDE to OUTSIDE, define a policy-map with inspect action for HTTP, and apply the policy-map to the zone-pair using `service-policy type inspect`.. Zone-Based Policy Firewall (ZPF) uses zone pairs to apply traffic policies between zones. To allow HTTP from INSIDE to OUTSIDE and inspect return traffic, you must create a zone-pair from INSIDE to OUTSIDE, define a policy-map with an inspect action for HTTP, and apply that policy-map to the zone-pair using `service-policy type inspect`. This creates a stateful inspection allowing return traffic. Applying policies directly to zones or interfaces is not correct for ZPF.

Answer

Create a policy-map with inspect action for HTTP, apply it to both INSIDE and OUTSIDE interfaces using `service-policy type inspect` in the inbound direction.

Answer

Create an ACL that permits HTTP from INSIDE to OUTSIDE, apply it to the INSIDE interface with `ip access-group` in the outbound direction, and enable `ip inspect` on the OUTSIDE interface.

Answer

Create a class-map that matches HTTP traffic, define a policy-map with inspect action, and apply the policy-map to the INSIDE zone using `service-policy type inspect`.

Question 10

A network engineer is configuring uRPF on a Cisco IOS router. The router has two interfaces: GigabitEthernet0/0 (WAN) and GigabitEthernet0/1 (LAN). The engineer wants to prevent spoofed packets from entering the WAN interface while allowing asymmetric routing. Which uRPF mode should be configured on GigabitEthernet0/0?

Accepted Answer

Loose mode. Loose mode uRPF allows asymmetric routing because it only checks that the source address is present in the routing table, regardless of the incoming interface. Strict mode would require the source to be reachable via the same interface, which would break asymmetric routing. Therefore, loose mode is correct.

Answer

Feasible path uRPF

Answer

VRF mode

Answer

Strict mode

Question 11

A network technician is configuring SSH access on a Cisco IOS router. The technician wants to ensure that only SSH version 2 is allowed and that the RSA key pair is generated with a modulus of 2048 bits. Which commands are required?

Accepted Answer

crypto key generate rsa modulus 2048
ip ssh version 2. The correct answer generates a 2048-bit RSA key and sets SSH to version 2. This satisfies both the key size and protocol version requirements. The other options either use the wrong key size or configure SSH version 1, which is insecure. It is important to generate the key before enabling SSH, and version 2 should be enforced for security.

Answer

crypto key generate rsa general-keys modulus 2048
ip ssh version 1

Answer

ip ssh version 2
crypto key generate rsa modulus 4096

Answer

crypto key generate rsa modulus 1024
ip ssh version 2

Question 12

A network engineer is configuring a Cisco IOS router to use IPsec VPN with IKEv2. The engineer wants to ensure that the router prefers a specific transform set that includes AES-256 encryption and SHA-256 hashing for integrity. Which command correctly defines the IKEv2 proposal with these parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Loose mode. Loose mode verifies that the source address exists in the routing table without requiring the packet to arrive on the same interface as the reverse route. This allows asymmetric traffic to pass while still dropping packets with completely unknown source addresses, providing useful anti-spoofing protection. Strict and feasible path modes would drop legitimate asymmetric traffic, and VRF-aware mode does not change the fundamental same-interface requirement.

Answer

Strict mode

Answer

VRF-aware strict mode

Answer

Feasible path mode

Question 13

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive control-plane traffic. After applying the CoPP policy, the administrator notices that OSPF adjacencies are flapping and that SNMP polling from the management station is failing. The administrator wants to correct the CoPP policy without disabling protection entirely. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Increase the rate limit or mark the OSPF and SNMP traffic as conforming in the class maps.. CoPP failures for specific protocols usually stem from either incorrect classification or insufficient rate limits. Verifying that class maps match OSPF and SNMP traffic ensures they are placed in the correct class, and increasing the rate limit or adjusting the conform action for those classes allows legitimate traffic to pass. Together these correct the symptoms while preserving control-plane protection.

Answer

Apply the CoPP policy to all interfaces instead of the control plane.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs instead.

Answer

Disable CEF switching on the router to reduce control-plane load.

Question 14

A network engineer is configuring a Cisco IOS router to use IPsec VPN with IKEv2. The engineer wants to ensure that the router prefers a specific transform set that includes AES-256 encryption and SHA-256 hashing for integrity. Which command correctly defines the IKEv2 proposal with these parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a class-map that matches all TCP and UDP traffic, define a policy-map with inspect for that class, and apply the policy-map to the zone-pair from LAN to WAN using the service-policy command.. To implement Zone-Based Policy Firewall, you must define class-maps to identify traffic, policy-maps to specify actions (such as inspect), and apply the policy-map to a zone-pair with the service-policy command. Inspecting traffic from LAN to WAN allows return traffic while denying unsolicited WAN-initiated traffic, as traffic not explicitly permitted between zones is dropped by default.

Answer

Apply an access-list to the WAN interface inbound to block all traffic and an access-list to the LAN interface inbound to permit all traffic.

Answer

Configure a zone-pair from WAN to LAN and apply a policy-map that inspects all traffic, then configure a zone-pair from LAN to WAN with a policy-map that drops all traffic.

Answer

Enable Cisco IOS Firewall with the ip inspect command on the LAN interface and apply an inbound access-list on the WAN interface to deny all traffic.

Question 15

A network engineer is configuring a Cisco IOS router to use IPsec VPN with IKEv2. The engineer wants to ensure that the router prefers a specific transform set that includes AES-256 encryption and SHA-256 hashing for integrity. Which command correctly defines the IKEv2 proposal with these parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aaa authentication login default group tacacs+ local. The method list order determines fallback behavior. Placing group tacacs+ before local ensures TACACS+ is tried first, and local is used only when the server is unreachable. If the server rejects credentials, the local method is not attempted, which satisfies both requirements. The other options either reverse the order, allow unauthenticated access, or use the enable password, none of which meet the stated goals.

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable