300-410 Infrastructure Security Practice Test 9 — 15 Questions

Question 1

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connecting to the internet (untrusted) and GigabitEthernet0/1 connecting to the internal network (trusted). The engineer wants to enable strict uRPF on the untrusted interface. Which command should be applied to GigabitEthernet0/0?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip verify unicast source reachable-via rx. Strict uRPF is enabled with the command ip verify unicast source reachable-via rx on the interface. It ensures that the source IP address of incoming packets is reachable via the same interface, effectively dropping packets with spoofed source addresses that would not be routed back out that interface.

Answer

ip verify unicast source reachable-via any

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via rx allow-default

Question 2

A network engineer is configuring object tracking to influence a static default route on a Cisco IOS router. The engineer wants the default route to be removed from the routing table if the tracked object (a reachability test to 192.0.2.1) goes down. The engineer enters the following configuration:

track 1 ip route 192.0.2.1 255.255.255.255 reachability
ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1

After the link to 203.0.113.1 fails, the default route remains in the routing table. What is the most likely reason?

Accepted Answer

The tracked object uses a reachability test to 192.0.2.1, which may still be reachable via an alternate path, so the object remains up.. Object tracking removes a static route only when the tracked object transitions to a down state. The reachability test to 192.0.2.1 may succeed via an alternate path even after the primary link fails, keeping the object up. The track keyword placement, administrative distance, and delay parameters do not explain the persistent route in this scenario.

Answer

The static route must be configured with a administrative distance lower than the default to be removed by tracking.

Answer

The 'track 1 ip route' command requires a delay before the object goes down, so the route removal is delayed indefinitely.

Answer

The 'track' keyword on the static route must reference the track object by number, but the syntax requires 'track 1' to be placed before the route.

Question 3

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against a flood of OSPF hello packets. The engineer wants to ensure that OSPF hellos are rate-limited to 1000 packets per second (pps) with a burst of 2000 packets, while allowing all other traffic without policing. The engineer applies the following configuration:

class-map match-any OSPF_HELLO
  match access-group name OSPF_HELLO_ACL
!
policy-map COPP_POLICY
  class OSPF_HELLO
    police 1000 2000 conform-action transmit exceed-action drop
  class class-default
    police 1000000 2000000 conform-action transmit exceed-action drop
!
control-plane
  service-policy input COPP_POLICY

After applying the policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the OSPF_HELLO_ACL matches OSPF hello packets by permitting IP protocol 89 and the correct multicast destination address, and adjust the ACL if necessary.. OSPF hellos are multicast to 224.0.0.5 with IP protocol 89. If the ACL used in the class-map does not match these specifics, hellos are classified into class-default and may be dropped when the class-default policer is exceeded, causing adjacencies to flap. The engineer must verify the ACL matches protocol 89 and the correct multicast destination, and adjust it so hellos are policed by the dedicated class with a higher rate.

Answer

Increase the police rate for the OSPF_HELLO class to 5000 pps to accommodate normal OSPF hello traffic.

Answer

Modify the class-default policer to transmit all traffic without policing by using police 1000000 2000000 conform-action transmit exceed-action transmit.

Answer

Apply the CoPP policy to the control plane using the service-policy output command instead of input.

Question 4

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent through the tunnel, while other traffic is sent unencrypted. Which configuration element is required to define the interesting traffic?

Accepted Answer

access-list. In Cisco IOS IPsec configuration, an access list (ACL) is used to define interesting traffic that should be encrypted and sent through the VPN tunnel. The ACL specifies the source and destination subnets. The crypto map then references this ACL to apply IPsec to matching traffic. Other components like transform set and ISAKMP policy handle encryption algorithms and key exchange, but not traffic selection.

Answer

transform set

Answer

crypto map

Answer

ISAKMP policy

Question 5

A network engineer is configuring an IPv6 First Hop Security feature on a Cisco Catalyst switch to prevent rogue devices from sending Router Advertisement messages with a prefix that conflicts with the legitimate prefix. The engineer wants to ensure that only authorized routers can advertise prefixes, while still allowing hosts to perform SLAAC. Which feature should be implemented?

Accepted Answer

IPv6 RA Guard. The requirement is to prevent rogue devices from sending Router Advertisement messages with conflicting prefixes while allowing legitimate routers and SLAAC. IPv6 RA Guard is designed specifically to filter RA and Redirect messages on untrusted ports, ensuring only authorized routers can advertise. The other features address different threats such as source spoofing, rogue DHCPv6 servers, or ND cache exhaustion.

Answer

IPv6 Source Guard

Answer

IPv6 DHCP Guard

Answer

IPv6 Destination Guard

Question 6

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent through the tunnel, while all other traffic is sent unencrypted. The engineer creates an extended ACL named VPN_TRAFFIC and applies it to the crypto map. However, after testing, the engineer finds that traffic from 192.168.1.0/24 is not being encrypted. Which action should the engineer take to correct the issue?

Accepted Answer

Ensure the ACL permits traffic from 192.168.1.0/24 to the remote subnet, and that the crypto map references this ACL.. The crypto map uses an extended ACL to identify interesting traffic that should be encrypted. If the ACL does not permit traffic from 192.168.1.0/24 to the remote subnet, that traffic will not be encrypted. The engineer must ensure the ACL entries match the desired source and destination and that the crypto map references the correct ACL. This is a common misconfiguration when defining VPN traffic.

Answer

Apply the ACL to the outside interface with 'ip access-group VPN_TRAFFIC out'.

Answer

Enable 'crypto ipsec transform-set' with the correct encapsulation mode.

Answer

Configure a route map to match the traffic and apply it to the crypto map.

Question 7

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connecting to the internet (untrusted) and GigabitEthernet0/1 connecting to the internal network (trusted). The engineer wants to enable strict uRPF on the untrusted interface. Which command should be applied to GigabitEthernet0/0?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router uses strict uRPF, which requires the source to be reachable via the same interface; asymmetric routing causes legitimate packets to be dropped.. The 'reachable-via rx' option enables strict uRPF, which drops packets if the source IP is not reachable via the ingress interface. In networks with asymmetric routing, legitimate traffic may arrive on an interface that is not the best path back to the source, causing drops. Switching to loose uRPF ('reachable-via any') would alleviate this but reduce spoofing protection. CEF is typically enabled by default, so it is not the issue.

Answer

The interface must be configured with 'ip verify unicast source reachable-via any' to allow asymmetric routing.

Answer

The uRPF feature requires CEF to be enabled, and CEF is not enabled on the router.

Answer

The router uses loose uRPF, which only checks if the source is reachable via any interface, so it should not drop legitimate traffic.

Question 8

A network engineer is implementing Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS XE router to mitigate spoofed source IP addresses. The router has two interfaces: GigabitEthernet0/0 (WAN, connected to ISP) and GigabitEthernet0/1 (LAN, connected to internal network). The engineer wants to apply strict uRPF on the WAN interface to drop packets with spoofed source addresses, but the internal network uses asymmetric routing, with some return traffic going out a different interface. The engineer applies the following configuration:

interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.0
 ip verify unicast source reachable-via rx

After applying this, the engineer notices that some legitimate traffic from the internal network is being dropped. Which action should the engineer take to resolve the issue while maintaining spoofing protection?

Accepted Answer

Configure uRPF with an access list to allow specific internal subnets that are subject to asymmetric routing, while keeping strict mode for other traffic.. Strict uRPF drops packets if the source address is not reachable via the incoming interface. Asymmetric routing causes legitimate return traffic to arrive on an interface different from the one used to reach the source, triggering drops. Cisco IOS XE allows an access list with strict uRPF to exempt specific source addresses from the check. By permitting the internal subnets that use asymmetric routing in the ACL, the engineer maintains strict uRPF for all other traffic, preserving spoofing protection while allowing legitimate flows.

Answer

Enable uRPF in loose mode with an access list that denies known spoofed prefixes, and apply it to the WAN interface.

Answer

Disable uRPF on the WAN interface and instead implement IP Source Guard on the LAN interfaces to prevent spoofing.

Answer

Change the uRPF mode to loose mode by using the ip verify unicast source reachable-via any command on the WAN interface.

Question 9

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to authenticate administrative users against a TACACS+ server and ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. The administrator has configured the TACACS+ server and local user accounts. Which additional configuration is required to achieve this?

Accepted Answer

Configure 'aaa authentication login default group tacacs+ local'.. The correct command is 'aaa authentication login default group tacacs+ local', which specifies TACACS+ as the primary authentication method and local as the fallback. This ensures that if the TACACS+ server is unreachable, the router will use the local user database. Other options either reverse the order or use different methods that do not meet the fallback requirement.

Answer

Configure 'aaa authentication login default local group tacacs+'.

Answer

Configure 'aaa authentication login default group tacacs+ enable'.

Answer

Configure 'aaa authorization exec default group tacacs+ local'.

Question 10

A network engineer is configuring a Cisco IOS XE router to send syslog messages to a remote server for security auditing. The engineer wants to ensure that the syslog messages are protected from eavesdropping and tampering. The router already has a CA trustpoint configured. Which command should the engineer use to enable secure syslog?

Accepted Answer

logging host 10.10.10.10 transport tls port 6514. The requirement is to protect syslog messages from eavesdropping and tampering, which necessitates encryption and integrity protection. Syslog over TLS (often called secure syslog) uses Transport Layer Security to encrypt and authenticate messages. The command 'logging host 10.10.10.10 transport tls port 6514' enables TLS transport, leveraging the existing CA trustpoint for certificate-based authentication. Other transport methods like UDP or plain TCP do not provide encryption. Therefore, the correct configuration is to use the 'tls' transport option.

Answer

logging host 10.10.10.10 transport tcp port 6514

Answer

logging host 10.10.10.10 transport udp port 514

Answer

logging host 10.10.10.10 transport tcp port 514

Question 11

A network administrator is configuring a Cisco IOS router to use AAA authorization for administrative commands. The administrator wants to ensure that users are authorized for specific commands based on their user role. The TACACS+ server is configured with command authorization sets. Which AAA authorization method should the administrator configure to enforce command authorization?

Accepted Answer

aaa authorization commands 15 default group tacacs+ local. To enforce command authorization, the router must be configured to send authorization requests for each command entered by the user. The 'aaa authorization commands' command, specifying the privilege level (e.g., 15) and the method list (e.g., default) with TACACS+ as the first method, enables this functionality. The TACACS+ server must be configured with command sets that define which commands are permitted or denied. Other authorization methods like exec, network, or auth-proxy serve different purposes and do not provide per-command authorization.

Answer

aaa authorization auth-proxy default group tacacs+ local

Answer

aaa authorization network default group tacacs+ local

Answer

aaa authorization exec default group tacacs+ local

Question 12

A network administrator is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The administrator wants to ensure that uRPF is applied in strict mode on an interface that connects to an ISP. Which command correctly enables strict uRPF on the interface?

Accepted Answer

ip verify unicast source reachable-via rx. Strict uRPF is enabled with the command 'ip verify unicast source reachable-via rx', which ensures the source address is reachable via the same interface the packet arrived on. This is the correct choice for an ISP-facing interface to prevent spoofed source addresses.

Answer

ip verify unicast source reachable-via tx

Answer

ip verify unicast reverse-path

Answer

ip verify unicast source reachable-via any

Question 13

A network security engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect against denial-of-service attacks. The engineer wants to ensure that CoPP policies are applied correctly and that the router's control plane is protected. Which two statements about CoPP configuration are true? (Choose two.)

Accepted Answer

CoPP can be configured to rate-limit specific types of traffic, such as OSPF and SSH, to protect the route processor.. CoPP uses the MQC framework to classify and police control plane traffic, allowing rate limiting of specific protocols like OSPF and SSH to protect the route processor. The policy is applied to the control plane, not globally or to the data plane. Unmatched traffic is not dropped by default; a class-default can be configured to manage it. Therefore, the true statements are that CoPP uses MQC with class maps and policy maps, and that it can rate-limit specific traffic types.

Answer

CoPP policies are applied globally to all interfaces using the service-policy command in global configuration mode.

Answer

CoPP policies are applied to the data plane to filter transit traffic.

Answer

CoPP requires that all control plane traffic be explicitly permitted in a class map, otherwise it is dropped by default.

Question 14

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate IP spoofing. The router has two interfaces: GigabitEthernet0/0 connecting to the internet (untrusted) and GigabitEthernet0/1 connecting to the internal network (trusted). The engineer wants to enable strict uRPF on the untrusted interface. Which command should be applied to GigabitEthernet0/0?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Loose mode. uRPF has two primary modes: strict and loose. Strict mode requires the source IP to be reachable via the same interface the packet arrived on, which breaks asymmetric routing. Loose mode only requires the source IP to be present in the routing table via any interface, allowing asymmetric routing while still dropping packets with spoofed sources not in the routing table. Therefore, loose mode is the appropriate choice to allow asymmetric routing while providing spoofing protection.

Answer

VRF mode

Answer

Feasible path mode

Answer

Strict mode

Question 15

A network engineer is configuring a Cisco IOS XE router to authenticate OSPFv3 neighbors. The engineer applies the following configuration under the OSPFv3 process: `area 0 authentication ipsec spi 256 sha1 0123456789ABCDEF0123456789ABCDEF01234567`. The engineer then verifies the neighbor relationship and sees that it remains in EXSTART state. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the same IPsec SPI and key on the neighboring router under its OSPFv3 process.. OSPFv3 authentication uses IPsec to secure protocol packets. The configuration requires an SPI and a key to be manually set under the OSPFv3 process on both routers. When the peer lacks the matching SPI and key, authentication fails, and the adjacency cannot progress beyond EXSTART. Configuring the identical IPsec parameters on the neighbor resolves the issue.

Answer

Configure a key chain with the same key ID and key string on both routers.

Answer

Enable OSPFv3 authentication globally with the `ipv6 ospf authentication` command on all interfaces.

Answer

Change the authentication algorithm to MD5 to match the neighbor's configuration.