300-410 Infrastructure Services Practice Test 12 — 15 Questions

Question 1

A network engineer configures a Cisco IOS router as a DHCP relay agent. The router interface connected to the DHCP clients is configured with 'ip helper-address 192.168.1.10'. Which type of traffic will be forwarded to the DHCP server at 192.168.1.10 by default?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

UDP broadcasts for DHCP, TFTP, DNS, NetBIOS, and several other services.. The 'ip helper-address' command forwards UDP broadcasts for a default set of services, including DHCP, TFTP, DNS, NetBIOS, and others. This allows clients to communicate with servers on different subnets. The command is not limited to DHCP, nor does it forward all broadcasts.

Answer

Only unicast packets destined to the DHCP server's IP address.

Answer

Only UDP broadcasts for DHCP (ports 67 and 68).

Answer

All IP broadcasts, including DHCP, TFTP, DNS, and NetBIOS.

Question 2

A network engineer is deploying DMVPN Phase 3 with IPsec protection. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Which two statements are true regarding the configuration that must be applied to the spoke routers to enable direct spoke-to-spoke communication? (Choose two.)

Accepted Answer

The spoke must have a route to the destination spoke's tunnel network via the tunnel interface.. For DMVPN Phase 3 spoke-to-spoke communication, each spoke must have NHRP shortcut enabled to process redirect messages, and it must have a route to the destination spoke's tunnel network via the tunnel interface, typically learned through a routing protocol. These two elements allow the spoke to initiate a direct tunnel when needed.

Answer

The spoke must have NHRP redirect configured on its tunnel interface.

Answer

The spoke must have the ip nhrp map multicast dynamic command configured.

Answer

The spoke must use a different IPsec profile than the hub to avoid SA conflicts.

Question 3

A network engineer is troubleshooting an MPLS L3VPN where customer routes are not being propagated between PE routers. The engineer verifies that the MP-BGP session between the PEs is established and that VRFs are configured correctly. Which of the following is the most likely cause for the missing routes?

Accepted Answer

The route targets are not properly configured for import/export.. In MPLS L3VPN, route targets are extended BGP communities that determine which VRFs import and export routes. For a route to be installed in a remote VRF, the export RT attached to the route by the originating PE must match an import RT configured on the receiving PE's VRF. If they do not match, the route is discarded. This is a frequent issue when VRFs are newly configured or when RTs are changed. Verifying RT configuration on both PEs is essential.

Answer

The MPLS LDP session between the PEs is down.

Answer

The PE routers are not configured with unique route distinguishers.

Answer

The BGP session is not configured with the correct address-family.

Question 4

A network engineer is troubleshooting a DMVPN Phase 3 network. Spoke-to-spoke tunnels are not being established directly; traffic between spokes is going through the hub. The hub is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'. Which additional configuration is required on the spokes to enable direct spoke-to-spoke communication?

Accepted Answer

Ensure that the spokes have a route to the destination spoke's tunnel network via the hub, and that they are not using a default route that prevents shortcut switching.. In DMVPN Phase 3, spoke-to-spoke shortcut tunnels require that the spoke has a specific route to the destination network pointing to the tunnel interface. If the spoke uses a default route, it will not perform NHRP resolution for the specific destination, and traffic will continue to flow through the hub. Therefore, ensuring that spokes have specific routes (not just a default) is essential for direct spoke-to-spoke communication.

Answer

Configure 'ip nhrp network-id' with the same value on all spokes and the hub.

Answer

Configure 'ip nhrp shortcut' on the hub tunnel interface.

Answer

Configure 'ip nhrp map multicast dynamic' on the hub tunnel interface.

Question 5

A network administrator is implementing IPsec VPN between two Cisco routers. The administrator wants to ensure that only specific traffic, defined by an extended access list, is encrypted and sent through the tunnel, while all other traffic is sent unencrypted. Which IPsec configuration element is used to define this traffic?

Accepted Answer

crypto access list. In Cisco IOS IPsec configuration, the crypto access list (an extended ACL) specifies the traffic that should be encrypted and tunneled. The crypto map then references this access list to apply the IPsec policies. Other components like transform sets and ISAKMP policies handle protection and negotiation, not traffic selection.

Answer

transform set

Answer

ISAKMP policy

Answer

crypto map

Question 6

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPNs. The router is a PE device that must exchange VPNv4 routes with other PE routers. The administrator has enabled MPLS LDP on the core-facing interfaces and configured BGP with the address-family vpnv4. Which additional configuration is required on the PE router to properly forward MPLS VPN traffic?

Accepted Answer

Configure a VRF on the PE router and assign the customer-facing interface to it.. MPLS L3 VPN requires the PE router to have VRFs configured for each customer, with customer interfaces assigned to those VRFs. This enables the PE to maintain separate routing tables, advertise routes via MP-BGP with route targets, and impose the correct label stack for VPN traffic. Without VRFs, the PE cannot differentiate customer traffic or forward it properly.

Answer

Configure BGP route reflectors to distribute VPNv4 routes.

Answer

Enable MPLS TE on all core interfaces to establish traffic-engineered tunnels.

Answer

Enable OSPF as the IGP and configure it to carry MPLS labels.

Question 7

A network administrator is configuring a Cisco IOS router to support MPLS Layer 3 VPN. The administrator needs to enable the provider edge (PE) router to exchange VPNv4 routes with other PE routers. Which two configurations are required on the PE router to enable MP-BGP for VPNv4? (Choose two.)

Accepted Answer

Activate the VPNv4 address family with 'address-family vpnv4' and activate the neighbor.. To enable MP-BGP for VPNv4 on a PE router, you must first configure a BGP session with the remote PE using 'router bgp' and 'neighbor' commands. Then, you must activate the VPNv4 address family with 'address-family vpnv4' and activate the neighbor. These two steps allow the exchange of VPNv4 routes. Other configurations like RD, RT, and LDP are important for MPLS VPN but not for enabling MP-BGP itself.

Answer

Enable MPLS LDP on the core-facing interfaces.

Answer

Configure a route target (RT) under the VRF definition.

Answer

Configure a route distinguisher (RD) under the VRF definition.

Question 8

A network technician is configuring a GRE tunnel between two routers. The tunnel source is a physical interface, and the tunnel destination is a loopback interface on the remote router. The technician notices that the tunnel interface is up, but line protocol is down. What is the most likely cause?

Accepted Answer

The tunnel destination is not reachable.. A GRE tunnel interface will be in up/down state if the tunnel source is operational but the destination is unreachable. The router brings up the tunnel interface because the source is up, but the line protocol remains down until a route to the destination is available. Ensuring reachability to the tunnel destination resolves the issue.

Answer

The tunnel mode is set to GRE multipoint.

Answer

The tunnel source interface is shutdown.

Answer

The tunnel keepalive is misconfigured.

Question 9

A network administrator is configuring a GRE tunnel between two Cisco IOS routers. The tunnel must support multicast traffic and be protected by IPsec. Which two statements about the configuration are true? (Choose two.)

Accepted Answer

The tunnel interface must be configured with a unique IP subnet that is not used elsewhere.. A GRE tunnel requires reachable source and destination addresses for the tunnel to become operational. Additionally, the tunnel interface needs a unique IP subnet to route traffic and run dynamic routing protocols. While IPsec can protect GRE traffic, it is not automatically encrypting multicast, and transport mode is not mandatory. GRE multipoint is an option for hub-and-spoke but not a requirement for multicast support.

Answer

The tunnel mode must be set to gre multipoint to support multicast.

Answer

IPsec transport mode is required to encrypt the GRE traffic.

Answer

Multicast traffic is automatically encrypted by IPsec without additional configuration.

Question 10

A network engineer is configuring a Cisco router to support MPLS Layer 3 VPNs. The engineer needs to enable the router to exchange VPNv4 routes with a provider edge (PE) router. Which address family must be configured under the BGP routing process to support this?

Accepted Answer

address-family vpnv4 unicast. MPLS Layer 3 VPNs rely on BGP VPNv4 address family to exchange VPN routes between PE routers. The VPNv4 address family carries the route distinguisher and route target attributes that identify the VPN membership. Other address families serve different purposes, such as IPv4 unicast for global routing or IPv4 VRF for per-VRF routing, but not for PE-to-PE VPN route exchange.

Answer

address-family ipv4 unicast

Answer

address-family ipv6 unicast

Answer

address-family ipv4 vrf

Question 11

A network engineer is configuring an MPLS L3VPN. The PE router is running OSPF with the CE router in VRF CUSTOMER. The engineer notices that routes from the customer are being redistributed into the provider's global OSPF process, causing instability. Which configuration change on the PE router will prevent this redistribution while still allowing customer routes to be advertised across the MPLS core?

Accepted Answer

Remove the redistribution of the VRF OSPF into the global OSPF process.. The root cause is the redistribution of the VRF OSPF into the provider's global OSPF. Removing that redistribution prevents customer routes from entering the provider's IGP, while MP-BGP can still carry the customer routes across the MPLS core as VPNv4 prefixes. This maintains customer connectivity without affecting the provider's routing stability.

Answer

Configure a distribute-list to filter the customer routes from being redistributed.

Answer

Configure the OSPF process with the capability vrf-lite command.

Answer

Change the OSPF domain-id to a unique value.

Question 12

A network technician is configuring a Cisco router to act as a DHCP relay agent. The router's interface GigabitEthernet0/0 is connected to a subnet where clients need to obtain IP addresses from a DHCP server located on a different subnet. Which command is required on the router to enable DHCP relay?

Accepted Answer

ip helper-address. To configure a Cisco router as a DHCP relay agent, the 'ip helper-address' command must be applied to the interface receiving the DHCP broadcasts. This command specifies the IP address of the DHCP server. The router then forwards the DHCP requests as unicasts to that server. Other commands like 'ip forward-protocol' or 'ip dhcp pool' serve different purposes and are not used to enable relay.

Answer

ip dhcp pool

Answer

ip dhcp relay

Answer

ip forward-protocol udp

Question 13

A network administrator is deploying MPLS Layer 3 VPNs on Cisco IOS routers. The administrator must ensure that customer routes are exchanged between PE routers without requiring customer involvement. Which two protocols or features are required to accomplish this? (Choose two.)

Accepted Answer

Route targets configured under VRFs. MPLS Layer 3 VPNs rely on MP-BGP with the VPNv4 address family to exchange customer routes between PE routers. Route targets, implemented as extended BGP communities, are used to control import and export of these routes into VRFs. Together, they enable the PE routers to maintain separate routing tables and forward customer traffic correctly across the shared MPLS core.

Answer

OSPF as the PE-CE routing protocol

Answer

RSVP-TE for traffic engineering

Answer

LDP for label distribution

Question 14

A network administrator is deploying DMVPN Phase 3 with IKEv2. The hub router is configured with a dynamic multipoint VPN tunnel and is using NHRP. Spoke routers are configured to register with the hub. After configuration, the administrator notices that spoke-to-spoke traffic is still going through the hub instead of directly between spokes. Which configuration change is most likely to resolve this issue?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. DMVPN Phase 3 requires NHRP redirect on the hub and NHRP shortcut on the spokes to enable direct spoke-to-spoke communication. The hub uses NHRP redirect to inform a spoke that a more efficient path exists directly to another spoke. The spoke then uses NHRP shortcut to resolve the destination and establish a direct tunnel. Without these, traffic will continue to flow through the hub.

Answer

Configure the hub as a route reflector for BGP.

Answer

Enable split horizon on the hub's tunnel interface.

Answer

Change the tunnel mode from GRE multipoint to GRE point-to-point.

Question 15

A network engineer is implementing CoPP (Control Plane Policing) on a Cisco IOS router to protect the route processor from excessive traffic. The engineer wants to limit ICMP echo requests destined to the router itself to 100 kbps. Which action must be taken to ensure that CoPP applies only to traffic destined to the control plane?

Accepted Answer

Apply the service policy to the control-plane interface.. CoPP is implemented by creating a traffic class that matches control-plane traffic, defining a policy map with a policer, and attaching the policy to the control-plane interface. This interface is a virtual interface that represents traffic destined to the route processor. Applying the policy elsewhere, such as physical interfaces, would not selectively target control-plane traffic and could impact transit traffic.

Answer

Apply the service policy to all physical interfaces.

Answer

Configure an ACL to match ICMP echo requests and apply it inbound on the WAN interface.

Answer

Enable IP source guard on all interfaces.