300-410 Infrastructure Services — 30 Questions

Question 1

An engineer is configuring MPLS L3VPN on a Cisco IOS XE router. The customer edge (CE) router uses OSPF and the provider edge (PE) router must redistribute OSPF routes into MP-BGP. Which configuration is required on the PE to prevent routing loops and ensure proper route propagation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the OSPF domain ID under the VRF and configure the BGP extended community to carry it.. When redistributing OSPF into MP-BGP in an MPLS L3VPN, the OSPF domain ID must be configured and carried as a BGP extended community. This prevents routes from being redistributed back into the same OSPF domain, which would cause loops. The PE router uses this domain ID to filter routes during redistribution back into OSPF.

Answer

Configure a route distinguisher (RD) and route target (RT) under the VRF address family.

Answer

Enable OSPF sham link between PE routers to carry VPN traffic.

Answer

Configure BGP cost community to influence path selection.

Question 2

A network engineer is configuring a Cisco IOS router to provide first-hop redundancy for a group of hosts on VLAN 10. The design requires that the virtual IP address be the same as the real IP address of the active router, and that the standby router preempts immediately when it becomes available. Which First Hop Redundancy Protocol (FHRP) should be implemented to meet these requirements?

Accepted Answer

VRRP version 3. VRRP is the only FHRP that allows the virtual IP address to be identical to the physical IP address of the master router. This feature, known as the IP address owner, is useful when hosts are already configured with the real IP as their default gateway. VRRP also supports preemption, and with a preempt delay of zero, immediate takeover occurs. HSRP, GLBP, and IRDP cannot use the same IP as the active router.

Answer

IRDP

Answer

HSRP version 2

Answer

GLBP

Question 3

A network administrator is configuring IPv6 addressing on a Cisco router. The router must automatically generate a link-local address and use EUI-64 format for interface identifiers. Which command enables this behavior on an interface?

Accepted Answer

ipv6 enable. The ipv6 enable command enables IPv6 on an interface and automatically creates a link-local address using the EUI-64 format. This is the standard way to ensure a link-local address is present without configuring a global address. Other commands either configure global addresses or manually set link-local addresses, which is not required here.

Answer

ipv6 address eui-64

Answer

ipv6 address autoconfig

Answer

ipv6 address link-local

Question 4

A network administrator is deploying MPLS Layer 3 VPNs with OSPF as the PE-CE routing protocol. The customer requires that OSPF routes learned from one site be redistributed into BGP with the correct extended community to prevent routing loops and ensure proper propagation. Which BGP extended community must be attached to the redistributed routes?

Accepted Answer

OSPF domain ID. In MPLS L3VPN with OSPF as the PE-CE protocol, the OSPF domain ID extended community is used to prevent routing loops. When OSPF routes are redistributed into BGP, the PE attaches this community. If the same route is later received from another PE and redistributed back into OSPF, the domain ID match prevents re-advertisement. The route type community preserves the OSPF route type but is not for loop prevention.

Answer

OSPF route type

Answer

Route target

Answer

Site of origin

Question 5

A network engineer is troubleshooting a DMVPN Phase 2 deployment where spoke-to-spoke tunnels are not forming. The hub is configured correctly. Which two actions should be taken on the spokes to enable direct spoke-to-spoke communication? (Choose two.)

Accepted Answer

Configure NHRP shortcut on the spokes.. For DMVPN Phase 2 spoke-to-spoke tunnels, spokes must have NHRP shortcut enabled to dynamically build tunnels upon receiving redirects. Additionally, all routers in the DMVPN cloud must share the same NHRP network ID to communicate and resolve addresses. Without these, spoke-to-spoke tunnels will not form even if the hub is configured correctly.

Answer

Disable split horizon on the hub's tunnel interface.

Answer

Ensure the tunnel interface is configured with a /24 subnet mask.

Answer

Enable NHRP redirect on the spokes.

Question 6

A network administrator is implementing IPv6 First Hop Security on a Cisco Catalyst switch. The goal is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. Which feature should be enabled on the VLAN to achieve this?

Accepted Answer

IPv6 DHCP Guard on untrusted ports. IPv6 DHCP Guard is designed to block DHCPv6 server messages on untrusted ports. By enabling it on access ports and designating the legitimate server port as trusted, the switch prevents rogue DHCPv6 servers from sending Advertise and Reply messages. This effectively stops unauthorized address assignment. The other features address different security aspects.

Answer

IPv6 Destination Guard

Answer

IPv6 Source Guard

Answer

IPv6 DHCP Guard

Question 7

A network administrator is implementing a DMVPN Phase 3 hub-and-spoke topology using Cisco IOS routers. The hub router is configured with a multipoint GRE interface and NHRP. Spoke routers register with the hub, and the hub has a mapping for each spoke. However, when a spoke attempts to reach another spoke's LAN subnet, the traffic goes through the hub instead of directly between spokes. Which additional configuration is required on the hub to enable spoke-to-spoke direct communication?

Accepted Answer

Enable NHRP redirect on the hub's multipoint GRE interface using the ip nhrp redirect command.. In DMVPN Phase 3, spoke-to-spoke direct communication is achieved by combining NHRP redirect on the hub and NHRP shortcut on the spokes. The hub uses ip nhrp redirect to notify the source spoke that a better path exists to the destination. The source spoke then sends an NHRP resolution request for the destination spoke's NBMA address, and upon receiving a reply, it can build a direct tunnel. This reduces latency and hub load.

Answer

Configure the spokes with the ip nhrp shortcut command on their multipoint GRE interfaces.

Answer

Enable split horizon on the hub's multipoint GRE interface to allow spoke advertisements.

Answer

Configure the hub as a route reflector for the overlay routing protocol.

Question 8

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPNs. The router will act as a Provider Edge (PE) device. Which two tasks are required to enable MPLS VPN functionality on the PE router? (Choose two.)

Accepted Answer

Configure a VRF for each customer and assign customer-facing interfaces to the VRF.. To enable MPLS L3VPN on a PE router, you must enable MPLS forwarding on core-facing interfaces and configure VRFs for customer isolation. These two tasks are fundamental. Other tasks, such as enabling CEF or configuring BGP, are either prerequisites or optional depending on the design.

Answer

Enable Cisco Express Forwarding (CEF) globally with the ip cef command.

Answer

Configure BGP with the address-family ipv4 vrf command for each VRF.

Answer

Enable MPLS LDP on all interfaces, including customer-facing interfaces.

Question 9

A network engineer is configuring a Cisco IOS XE router to act as a DHCP relay. The router interface GigabitEthernet0/0 is connected to a subnet where DHCP clients reside, and the DHCP server is at 10.1.1.10. The engineer enters the command 'ip helper-address 10.1.1.10' on interface GigabitEthernet0/0. However, clients are not receiving IP addresses. Which additional configuration is required to allow DHCP relay to function?

Accepted Answer

Enable the DHCP relay agent using the 'service dhcp' global configuration command.. For DHCP relay to operate, the router must have the DHCP service enabled. The 'service dhcp' global command enables both DHCP server and relay agent functions. While it is enabled by default, it may have been disabled. The 'ip helper-address' command alone is insufficient if the service is off. Other options are either default behaviors or not required for relay functionality.

Answer

Configure 'ip forward-protocol udp bootps' globally.

Answer

Configure a static route to the DHCP server.

Answer

Apply an access list to permit UDP ports 67 and 68.

Question 10

A network engineer is implementing IPv6 First Hop Security on a Cisco switch to mitigate rogue router advertisements. Which two features should be enabled to prevent rogue RA messages from being processed by hosts? (Choose two.)

Accepted Answer

IPv6 RA Guard. To prevent rogue Router Advertisement messages from being processed by hosts, IPv6 RA Guard and IPv6 ND Inspection should be enabled. RA Guard filters RAs on untrusted ports, while ND Inspection validates ND messages and can drop unauthorized RAs. Together, they provide a robust defense against rogue RA attacks. Other First Hop Security features like DHCP Guard or Source Guard address different threats and do not directly block rogue RAs.

Answer

IPv6 Source Guard

Answer

IPv6 DHCP Guard

Answer

IPv6 Destination Guard

Question 11

A network engineer is configuring a Cisco router to authenticate OSPF neighbors using MD5. The engineer wants to ensure that only routers with the correct key can form adjacencies. Which command is required on the interface to enable OSPF MD5 authentication?

Accepted Answer

ip ospf authentication message-digest. To enable OSPF MD5 authentication on an interface, the command 'ip ospf authentication message-digest' must be configured. This activates authentication for OSPF packets on that interface. The MD5 key itself is configured with 'ip ospf message-digest-key'. The area-level command can enable authentication for all interfaces in an area, but the interface command is specifically required to enable it on a per-interface basis.

Answer

area 0 authentication message-digest

Answer

ip ospf message-digest-key 1 md5 cisco

Answer

ospf authentication message-digest

Question 12

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke network with OSPF as the routing protocol. The engineer wants to ensure that spoke-to-spoke communication can occur directly when needed, and that the hub can send redirects to spokes. Which two commands are required on the hub router to support this functionality? (Choose two.)

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to send redirect messages to spokes, enabling them to initiate direct tunnels. Additionally, ip nhrp map multicast dynamic is required to replicate multicast traffic (such as OSPF hellos) to all spokes, allowing the routing protocol to form adjacencies. These two commands are essential on the hub for Phase 3 functionality. The ip nhrp shortcut command is configured on spokes, not the hub, and the other options are either basic NHRP parameters or unrelated to Phase 3.

Answer

ip nhrp network-id 100

Answer

ip nhrp shortcut

Answer

ip nhrp registration no-unique

Question 13

A network engineer is troubleshooting a DHCP relay configuration on a Cisco IOS router. The router is not forwarding DHCP requests from clients on VLAN 10 to the DHCP server at 10.1.1.100. The interface VLAN 10 is up and has an IP address. Which two commands should the engineer verify are configured correctly on the router? (Choose two.)

Accepted Answer

ip helper-address 10.1.1.100 on interface VLAN 10. For DHCP relay to work, the client-facing interface must have the 'ip helper-address' command pointing to the DHCP server, and the global 'service dhcp' must be enabled. These two are essential. A DHCP pool is irrelevant for relay, and 'ip forward-protocol udp 67' is not needed because DHCP is forwarded by default. 'ip routing' is a general prerequisite but not specific to relay troubleshooting.

Answer

ip forward-protocol udp 67

Answer

ip dhcp pool VLAN10_POOL

Answer

ip routing

Question 14

A network engineer is configuring a DMVPN Phase 3 hub with dual ISPs for redundancy. The hub router has two WAN interfaces, both participating in the same mGRE tunnel interface. The engineer wants to ensure that spoke-to-spoke traffic can be dynamically redirected by the hub, and that the hub can advertise a single public IP address to all spokes. Which technology should be implemented on the hub to achieve this?

Accepted Answer

DMVPN Phase 3 with NHRP redirect and shortcut. DMVPN Phase 3 with NHRP redirect and shortcut is designed to allow the hub to redirect spoke-to-spoke traffic and enable direct tunnels, which is exactly what the scenario requires. It also supports dual ISPs on the hub, though the hub will advertise its own public IP per ISP, not a single IP. The other options do not provide the necessary redirection and shortcut features.

Answer

IPsec tunnel protection with dual hub redundancy

Answer

NHRP with multiple NHS entries and dynamic mapping

Answer

BGP with multipath and DMVPN Phase 2

Question 15

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and IPsec. The hub router is Cisco IOS XE. The engineer wants to ensure that spoke-to-spoke traffic flows directly without traversing the hub, even when the spokes are in different DMVPN networks. Which NHRP command must be configured on the hub to support this?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect to notify spokes of a better direct path. The spokes then use ip nhrp shortcut to install a shortcut route. Without redirect on the hub, spokes cannot learn about direct paths, and traffic continues to flow through the hub, defeating the purpose of Phase 3.

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 1

Answer

ip nhrp shortcut

Question 16

A network engineer is deploying DMVPN Phase 2 with OSPF as the routing protocol. The hub router is configured as a broadcast network, and spokes are configured as non-broadcast. OSPF adjacencies are not forming between spokes and the hub. Which configuration change is required on the spoke routers to allow OSPF neighbor formation?

Accepted Answer

Add neighbor statements on the spokes pointing to the hub's tunnel IP address.. In a DMVPN Phase 2 network with OSPF, if the hub is configured as a broadcast network and spokes as non-broadcast, the spokes will not send or listen for multicast OSPF hellos. To form adjacencies, each spoke must be configured with a neighbor statement pointing to the hub's tunnel IP address. This forces the spoke to send unicast hellos to the hub, which the hub can respond to, enabling OSPF neighbor formation.

Answer

Configure the spokes as point-to-multipoint network.

Answer

Configure the hub as a point-to-multipoint network.

Answer

Configure the hub with a neighbor statement for each spoke.

Question 17

A network engineer is configuring a Cisco IOS router to use TACACS+ for authorization of EXEC commands. The engineer wants to ensure that if the TACACS+ server is unavailable, the router will allow users to execute EXEC commands with privilege level 1. Which two commands are required to achieve this? (Choose two.)

Accepted Answer

username admin privilege 1 secret cisco. To allow EXEC commands with privilege level 1 when the TACACS+ server is unavailable, configure EXEC authorization to fall back to local using 'aaa authorization exec default group tacacs+ local'. Additionally, define a local user with privilege level 1 using 'username admin privilege 1 secret cisco'. This ensures that the fallback local authorization grants the intended privilege level.

Answer

aaa authorization exec default group tacacs+ if-authenticated

Answer

aaa authorization commands 1 default group tacacs+ local

Answer

aaa authorization exec default group tacacs+ none

Question 18

A network administrator is configuring DMVPN Phase 3 with IKEv2 on a hub router. The spoke routers must be able to dynamically establish direct spoke-to-spoke tunnels when needed. Which configuration on the hub is required to support this behavior?

Accepted Answer

Enable NHRP redirect and configure NHRP shortcut on the spokes.. DMVPN Phase 3 introduces NHRP redirect on the hub and NHRP shortcut on the spokes. When the hub receives a packet from one spoke destined to another spoke's network, it sends an NHRP redirect message to the source spoke. The source spoke then initiates an NHRP resolution for the destination spoke's NBMA address and installs a shortcut route, allowing direct tunnel establishment. Both commands are essential.

Answer

Configure the hub with a unique NHRP network ID and enable NHRP authentication.

Answer

Enable IPsec tunnel protection on the hub and configure IKEv2 with multiple proposals.

Answer

Configure the hub as a route reflector and enable BGP next-hop-self on all spokes.

Question 19

A company deploys MPLS Layer 3 VPNs with OSPF as the PE-CE routing protocol. The customer requires that routes learned from one site be redistributed into BGP with specific community attributes for traffic engineering. Which configuration step is necessary on the PE router to ensure that OSPF routes are redistributed with the correct BGP extended community for VPNv4?

Accepted Answer

Configure route-target export under the VRF address family.. The route-target export extended community is essential for MPLS L3VPN route distribution. It is configured under the VRF address family and is automatically attached to routes redistributed from OSPF into BGP. This allows remote PEs to import the routes into the correct VRF. The other options either do not achieve the goal or are not the standard configuration step.

Answer

Set the OSPF domain ID to match the BGP autonomous system number.

Answer

Enable OSPF as a BGP network statement under the global BGP configuration.

Answer

Configure a route-map to set the BGP extended community attribute to the route-target value.

Question 20

A network administrator is configuring a Cisco IOS router for MPLS L3VPN. The router is a PE device with a VRF named CUSTOMER. The administrator wants to ensure that routes from the CUSTOMER VRF are exported with the correct route target and that routes from other VRFs are not imported into CUSTOMER. Which configuration is required to accomplish this?

Accepted Answer

Under the VRF definition, configure 'route-target export 65000:100' and 'route-target import 65000:100'.. Route targets are essential for controlling import and export of routes between VRFs. The export route target is attached to routes when advertised, and the import route target determines which routes are accepted into the VRF. Configuring both export and import with the same value ensures proper route propagation and isolation. The other options either do not control route targets or use incorrect syntax.

Answer

Under the VRF definition, configure 'route-target both 65000:100'.

Answer

Under the BGP configuration, configure 'address-family ipv4 vrf CUSTOMER' and then 'redistribute connected'.

Answer

Under the VRF definition, configure 'rd 65000:100'.