300-410 Infrastructure Services Practice Test 13 — 15 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology. Spokes are behind NAT devices and have dynamically assigned public IP addresses. The engineer wants to ensure that spoke-to-spoke traffic can be established directly without traversing the hub. Which technology should be implemented on the hub to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NHRP redirect. In DMVPN Phase 3, the hub uses NHRP redirect to signal spokes about a better path to another spoke. The spoke then uses NHRP shortcut to establish a direct tunnel. The question asks what to implement on the hub, so NHRP redirect is correct. NHRP shortcut is on the spoke, IPsec tunnel protection is for encryption, and multicast replication is for routing protocol support.

Answer

IPsec tunnel protection

Answer

NHRP shortcut

Answer

Multicast replication

Question 2

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent. The router receives DHCP discover messages on interface GigabitEthernet0/1 and must forward them to a DHCP server at 10.1.1.100. Which command is required on the router?

Accepted Answer

ip helper-address 10.1.1.100. To configure a Cisco IOS router as a DHCP relay agent, the ip helper-address command must be applied to the interface where DHCP broadcasts are received. This command forwards the broadcasts as unicast packets to the specified DHCP server. It is the standard and required configuration for this functionality.

Answer

ip dhcp relay 10.1.1.100

Answer

ip forward-protocol udp 67

Answer

ip dhcp server 10.1.1.100

Question 3

A network administrator is configuring a Cisco IOS router to use NAT overload (PAT) for a small office. The inside network is 192.168.1.0/24, and the router's outside interface is GigabitEthernet0/0 with IP address 203.0.113.5. The administrator enters the following commands:

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/0
 ip address 203.0.113.5 255.255.255.0
 ip nat outside

However, hosts on the inside network cannot access the Internet. Which command is missing?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.1. The NAT configuration correctly translates inside addresses to the outside interface address using PAT. However, the router lacks a default route to reach the Internet. Without a default route pointing to the ISP's next-hop address, the router cannot forward packets beyond its directly connected networks, so inside hosts cannot access external destinations.

Answer

ip nat inside source list 1 pool overload

Answer

ip nat inside source static 192.168.1.0 203.0.113.5

Answer

ip nat pool overload 203.0.113.5 203.0.113.5 netmask 255.255.255.0

Question 4

A network administrator is implementing policy-based routing (PBR) on a Cisco IOS router. The goal is to route traffic from a specific subnet (192.168.1.0/24) through a next-hop of 10.1.1.2 instead of the default route. The administrator has created a route map named PBR-MAP and configured a match statement for the subnet. Which action must be configured in the route map to set the next-hop?

Accepted Answer

set ip next-hop 10.1.1.2. Policy-based routing uses route maps to match traffic and set actions. The 'set ip next-hop' command is the correct action to specify the next-hop IP address for matching packets. It overrides the routing table for those packets. The other options either set a default next-hop (used only when no route exists), discard traffic, or mark packets, none of which achieve the goal.

Answer

set interface Null0

Answer

set ip default next-hop 10.1.1.2

Answer

set ip precedence 5

Question 5

A network engineer is configuring DHCPv6 on a Cisco IOS-XE router. The router must provide IPv6 addresses and other configuration parameters to clients on the LAN. The engineer wants the router to assign addresses using stateless address autoconfiguration (SLAAC) but also provide DNS server information via DHCPv6. Which command set correctly configures the router's LAN interface to achieve this?

Accepted Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd other-config-flag
ipv6 dhcp server POOL. The other-config-flag in router advertisements signals hosts to use DHCPv6 for additional configuration parameters, while addresses are still autoconfigured via SLAAC. The ipv6 dhcp server command attaches the DHCPv6 pool to the interface. The managed-config-flag would force hosts to use DHCPv6 for addresses as well, which is not desired. Other commands like ra-interval or prefix do not control the DHCPv6 usage flags.

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 dhcp server POOL
ipv6 nd ra-interval 30

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd prefix 2001:DB8:1::/64
ipv6 dhcp server POOL

Answer

ipv6 address 2001:DB8:1::1/64
ipv6 nd managed-config-flag
ipv6 dhcp server POOL

Question 6

A network engineer is configuring a Cisco router to support Network Address Translation (NAT) for a small office. The engineer wants to translate internal private addresses to a single public address using Port Address Translation (PAT). Which command enables PAT by allowing the router to use the interface's IP address for translation?

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload. PAT is enabled by using the overload keyword with the ip nat inside source command. When translating to an interface address, the syntax includes the interface keyword and overload. The correct command references the access list defining inside traffic, specifies the outside interface, and includes overload. Other options either use a pool, perform static translation, or omit overload, so they do not achieve PAT using the interface address.

Answer

ip nat inside source list 1 interface GigabitEthernet0/0

Answer

ip nat inside source static 10.1.1.1 203.0.113.1

Answer

ip nat inside source list 1 pool PUBLIC_POOL overload

Question 7

A network engineer is configuring a Cisco IOS XE router to support MPLS Layer 3 VPNs. The engineer has enabled MPLS IP on the core interfaces and configured OSPF as the IGP. Which additional configuration is required on the PE routers to exchange VPNv4 routes with other PE routers?

Accepted Answer

Enable BGP with the `address-family vpnv4` configuration and activate neighbors.. MPLS Layer 3 VPNs rely on MP-BGP to distribute VPNv4 routes among PE routers. Enabling the VPNv4 address family and activating neighbors under that address family is mandatory for exchanging customer VPN routes with the associated route targets and labels. Without this BGP configuration, PE routers cannot learn each other's VPN routes, and the VPN will not operate.

Answer

Enable `mpls ip` on all PE-CE interfaces.

Answer

Configure `mpls ldp router-id Loopback0` to ensure LDP uses the loopback interface.

Answer

Configure a route reflector for the IGP to distribute routes between PE routers.

Question 8

A network engineer is configuring a Cisco IOS router for IPv6 First Hop Security. The requirement is to prevent rogue DHCPv6 servers from assigning addresses to clients on a VLAN. The engineer has already enabled IPv6 snooping on the VLAN. Which additional feature should be configured to meet this requirement?

Accepted Answer

IPv6 DHCPv6 Guard. DHCPv6 Guard is specifically designed to block DHCPv6 server messages on untrusted ports, ensuring that only authorized DHCPv6 servers can assign addresses. With IPv6 snooping already enabled, configuring DHCPv6 Guard on the VLAN provides the necessary protection against rogue servers. Other First Hop Security features address different threats and do not fulfill this requirement.

Answer

IPv6 ND Inspection

Answer

IPv6 Destination Guard

Answer

IPv6 Source Guard

Question 9

A network engineer is configuring a Cisco router to act as a DHCP server for a remote subnet. The router's interface connected to the remote subnet is configured with the `ip helper-address` command pointing to the DHCP server. However, clients on the remote subnet are not receiving IP addresses. The engineer verifies that the DHCP server is operational and has a valid pool for the remote subnet. What is the most likely cause of the problem?

Accepted Answer

The DHCP server does not have a route back to the remote subnet.. When using `ip helper-address` to forward DHCP requests to a server on a different subnet, the DHCP server must have a route back to the client subnet. The server uses this route to send DHCPOFFER and DHCPACK messages. Without it, the server cannot reach the clients, and they will not receive IP addresses. Ensuring the server has a route to the remote subnet resolves the issue.

Answer

The `ip helper-address` command is applied to the wrong interface.

Answer

The router's interface connected to the remote subnet is down.

Answer

The DHCP server is configured with a different subnet mask than the clients.

Question 10

A network engineer is configuring a Cisco IOS router to support MPLS Traffic Engineering (TE). The engineer has enabled MPLS TE globally and on the interfaces, and has configured a TE tunnel. However, the tunnel is not coming up. The engineer verifies that the IGP (OSPF) is advertising TE information. Which additional configuration is required to establish the TE tunnel?

Accepted Answer

Enable RSVP on the interfaces along the path.. For MPLS TE tunnels to be established, RSVP must be enabled on all interfaces that the tunnel traverses. RSVP handles the signaling and resource reservation. While the IGP advertises TE information, without RSVP the headend cannot signal the path. Therefore, enabling RSVP on the relevant interfaces is the required additional configuration.

Answer

Configure the tunnel mode to mpls traffic-eng on all routers.

Answer

Enable LDP on the TE tunnel interface.

Answer

Configure CSPF on all routers in the path.

Question 11

A network engineer is troubleshooting an MPLS L3VPN where customer routes are not being advertised between PE routers. The engineer verifies that the VRFs are configured correctly and that MPLS forwarding is operational. Which MP-BGP configuration is required to exchange VPNv4 routes between PE routers?

Accepted Answer

address-family vpnv4 unicast. To exchange VPNv4 routes between PE routers, MP-BGP must be configured with the address-family vpnv4 unicast. This address family carries the VPN-specific attributes, including route targets and the VPN label. Once activated, BGP can advertise and receive VPNv4 prefixes, allowing PEs to import routes into the correct VRFs. The other options are either for different address families or are supporting commands that do not by themselves enable VPNv4 route exchange.

Answer

neighbor x.x.x.x activate

Answer

address-family ipv4 unicast

Answer

neighbor x.x.x.x send-community extended

Question 12

A network administrator is configuring a Cisco IOS router to act as a DHCP server for a LAN segment. The administrator wants to exclude a range of IP addresses from being assigned to clients because those addresses are statically assigned to servers and printers. Which command should be used to accomplish this?

Accepted Answer

ip dhcp excluded-address 192.168.1.10 192.168.1.20. To prevent the DHCP server from assigning a specific range of addresses, the 'ip dhcp excluded-address' command must be used in global configuration mode. This command takes a start and end IP address (or a single IP) and ensures those addresses are not offered to clients. The other options either use incorrect syntax or place the command in the wrong configuration mode.

Answer

ip dhcp pool LAN
  network 192.168.1.0 255.255.255.0
  excluded-address 192.168.1.10 192.168.1.20

Answer

ip dhcp excluded-address 192.168.1.10 192.168.1.20 255.255.255.0

Answer

ip dhcp pool STATIC
  host 192.168.1.10 255.255.255.0

Question 13

A network engineer is troubleshooting an MPLS L3 VPN where OSPF is used as the PE-CE routing protocol. The customer reports that routes from one site are not being learned at another site. The engineer checks the PE routers and finds that the OSPF routes are present in the VRF routing table but not in the MP-BGP table. What is the most likely cause?

Accepted Answer

The OSPF routes are not being redistributed into BGP.. When OSPF routes are present in the VRF routing table but not in MP-BGP, the most likely cause is that redistribution from OSPF into BGP is not configured. MP-BGP only advertises routes that are explicitly redistributed or network statements are used. Without redistribution, the routes remain local to the VRF and are not propagated as VPNv4 routes. Other issues like route target or VRF configuration would manifest differently.

Answer

The route target configuration is incorrect.

Answer

The OSPF process is not configured with the correct VRF.

Answer

The BGP router ID is not unique.

Question 14

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 192.168.1.0/24 subnet to the 10.0.0.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which configuration element is used to define this traffic?

Accepted Answer

ACL. In Cisco IOS IPsec configuration, an extended ACL is used to identify the traffic that should be encrypted. The ACL specifies the source and destination addresses and ports. This ACL is then referenced in the crypto map, which applies the IPsec policies to matching traffic. Traffic that does not match the ACL is not encrypted and is routed normally. Therefore, the ACL is the configuration element that defines the traffic to be protected.

Answer

transform set

Answer

ISAKMP policy

Answer

crypto map

Question 15

A network administrator is deploying MPLS Layer 3 VPNs across a service provider backbone. The provider uses OSPF as the IGP and MP-BGP for VPNv4 route distribution. The administrator notices that VPNv4 routes are not being advertised between PE routers. Which configuration step is most likely missing on the PE routers?

Accepted Answer

Activating the VPNv4 address family under the BGP routing process and configuring the PE routers as neighbors. MPLS L3VPN relies on MP-BGP to distribute VPNv4 routes between PE routers. The VPNv4 address family must be activated under the BGP process, and PE routers must be configured as neighbors within that address family. Without this, VPNv4 NLRIs are not exchanged, and customer routes cannot be propagated across the provider backbone.

Answer

Configuring MPLS LDP on all interfaces between PE and P routers

Answer

Enabling OSPF on the PE-CE links with the correct area ID

Answer

Configuring route reflectors or full mesh iBGP peering between PE routers