300-410 Infrastructure Services Practice Test 4 — 15 Questions

Question 1

A network engineer is troubleshooting a DMVPN Phase 3 deployment using Cisco IOS routers. Spoke-to-spoke communication is failing, but spoke-to-hub connectivity works. The hub router is configured with ip nhrp redirect, and the spokes are configured with ip nhrp shortcut. The engineer notices that the spokes are not receiving NHRP redirect messages from the hub. Which action should be taken to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the hub is configured with the ip nhrp network-id command matching the spokes.. In DMVPN Phase 3, NHRP redirect messages are sent by the hub to spokes to facilitate spoke-to-spoke tunnels. For NHRP to function correctly, the network ID must be consistent across all routers in the same DMVPN cloud. If the network ID differs, NHRP messages, including redirects, may be ignored. Ensuring the network ID matches on all devices resolves the issue.

Answer

Configure the ip nhrp map multicast dynamic command on the hub.

Answer

Enable the ip nhrp authentication command on the spokes.

Answer

Configure the ip nhrp holdtime command on the hub to a lower value.

Question 2

A network engineer is configuring a Cisco IOS XE router to support DMVPN Phase 3. The hub router must advertise a default route to all spokes while allowing spoke-to-spoke communication without traffic traversing the hub. Which NHRP configuration on the hub is required to achieve this?

Accepted Answer

ip nhrp redirect. DMVPN Phase 3 requires the hub to be configured with 'ip nhrp redirect' so that when the hub receives a packet from a spoke destined to another spoke's subnet, it sends an NHRP redirect message back to the originating spoke. The spoke then uses 'ip nhrp shortcut' to resolve the destination spoke's NBMA address and build a direct tunnel. This offloads traffic from the hub and enables direct spoke-to-spoke communication.

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp shortcut

Question 3

A network administrator is implementing IPv6 DHCPv6 Prefix Delegation (DHCPv6-PD) on a Cisco IOS XE router that acts as a requesting router (client) to obtain a prefix from an upstream DHCPv6 server. The router's WAN interface is GigabitEthernet0/0, and the LAN interface is GigabitEthernet0/1. The administrator configures `ipv6 dhcp client pd PREFIX` on GigabitEthernet0/0 and `ipv6 address PREFIX ::1:0:0:1/64` on GigabitEthernet0/1. However, the LAN interface does not receive an IPv6 address. What is the most likely cause?

Accepted Answer

The DHCPv6 client on GigabitEthernet0/0 has not yet obtained a prefix from the server, so the LAN interface cannot derive an address.. DHCPv6 Prefix Delegation requires the requesting router to obtain a prefix from the server before it can assign addresses on downstream interfaces. The LAN interface configuration uses the delegated prefix variable, which is populated only after a successful DHCPv6-PD exchange. If the client fails to receive a prefix, the LAN interface will not configure an address. Thus, the lack of a delegated prefix is the root cause.

Answer

The `ipv6 dhcp client pd` command must be configured on the LAN interface instead of the WAN interface.

Answer

The `ipv6 dhcp client pd` command requires the `rapid-commit` option to be enabled.

Answer

The LAN interface configuration must use the `ipv6 address` command with the delegated prefix and a subnet ID, but the prefix length should be /64 and the interface ID must be specified correctly.

Question 4

A network engineer is configuring a Cisco IOS router for MPLS Traffic Engineering (TE) to establish a TE tunnel to a remote router. The engineer has enabled MPLS TE globally and on the interfaces, configured OSPF with TE extensions, and set up the tunnel interface with the appropriate destination and bandwidth. However, the TE tunnel is not coming up. Which two actions should the engineer verify to troubleshoot the issue? (Choose two.)

Accepted Answer

Check that the MPLS TE tunnel is not configured with an affinity that excludes all available links.. MPLS TE tunnels require sufficient bandwidth on all links along the path and must not be excluded by affinity constraints. If the requested bandwidth is unavailable, the tunnel cannot be signaled. Similarly, if the affinity/mask excludes all links, no path can be found. Therefore, verifying bandwidth availability and affinity configuration are critical troubleshooting steps.

Answer

Ensure that the MPLS TE tunnel interface has an explicit path configured.

Answer

Confirm that the tunnel destination is reachable via the IGP with a /32 route.

Answer

Ensure that the tunnel interface is configured with a valid IP address.

Question 5

A network administrator is configuring a Cisco IOS router to support IPv6. The router needs to obtain an IPv6 address automatically from the local link and also learn a default route from a neighboring router. Which command should be used on the router's interface to enable IPv6 and allow it to automatically configure an address using the link-local prefix?

Accepted Answer

ipv6 address autoconfig. The ipv6 address autoconfig command enables stateless address autoconfiguration (SLAAC), which allows the router to automatically configure a global IPv6 address using a prefix from router advertisements and to install a default route. Other options either use DHCPv6, only enable link-local addressing, or require manual configuration.

Answer

ipv6 address eui-64 2001:db8:1::/64

Answer

ipv6 address dhcp

Answer

ipv6 enable

Question 6

A network administrator is deploying IPv6 and wants to implement First Hop Security to prevent rogue Router Advertisement (RA) messages. The administrator configures IPv6 RA Guard on a switch port connected to a host. After configuration, the administrator notices that legitimate RAs from the authorized router are being blocked. Which additional configuration is required to allow RAs from the authorized router while still blocking rogue RAs?

Accepted Answer

Configure the switch port as a router port using the `ipv6 nd raguard policy` and `device-role router` commands.. IPv6 RA Guard uses a policy-based approach where each port is assigned a role, either host or router. By default, ports are host ports and block all RAs. To allow legitimate RAs from an authorized router, the port connected to that router must be configured with a policy that sets the device role to router. This ensures that RAs are only accepted from that port while other ports continue to block RAs.

Answer

Configure an IPv6 access list to permit RAs from the authorized router and apply it to the RA Guard policy.

Answer

Disable RA Guard globally and rely on IPv6 DHCP snooping to block rogue RAs.

Answer

Create an RA Guard policy that allows RAs from the authorized router's IPv6 address and apply it to the switch port.

Question 7

A network administrator is configuring a Cisco IOS router to support IPv6. The router needs to automatically obtain its IPv6 address and default route from the local ISP router. Which command enables this?

Accepted Answer

ipv6 address autoconfig. SLAAC allows a router to automatically configure its IPv6 address and default route based on Router Advertisements. The ipv6 address autoconfig command enables this behavior. Other options either require manual configuration or use DHCPv6, which does not provide a default route by default.

Answer

ipv6 address dhcp

Answer

ipv6 enable

Answer

ipv6 address eui-64

Question 8

A network engineer is configuring a Cisco IOS router to support a site-to-site IPsec VPN with a remote peer that uses a dynamic public IP address. The engineer wants the router to act as the responder and accept connections from any peer, but only if the peer provides the correct pre-shared key. Which command must be applied to the crypto keyring to allow this?

Accepted Answer

crypto keyring KEYRING-NAME
  pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123. To allow a router to act as an IPsec responder for a peer with a dynamic IP address, the pre-shared key must be configured with a wildcard address (0.0.0.0 0.0.0.0) in the crypto keyring. This matches any peer IP, enabling the router to authenticate the peer based solely on the pre-shared key. Other options either restrict to specific hostnames, use invalid wildcard masks, or create conflicting entries.

Answer

crypto keyring KEYRING-NAME
  pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123
  pre-shared-key address 0.0.0.0 0.0.0.0 key cisco456

Answer

crypto keyring KEYRING-NAME
  pre-shared-key address 0.0.0.0 255.255.255.255 key cisco123

Answer

crypto keyring KEYRING-NAME
  pre-shared-key hostname remote-peer key cisco123

Question 9

A network engineer is troubleshooting an OSPFv3 network. The engineer notices that a router is not forming an adjacency with its neighbor. The engineer verifies that the interfaces are up and IPv6 addresses are configured correctly. Which of the following could prevent OSPFv3 adjacency formation?

Accepted Answer

The router IDs are not unique.. Duplicate router IDs in OSPFv3 will prevent adjacency formation because each router must have a unique identifier within the OSPF domain. When two routers have the same router ID, they will not establish a neighbor relationship. Other options like missing router ID or passive interfaces are either not applicable or less likely given the scenario details.

Answer

The OSPFv3 network type is set to point-to-point on one side and broadcast on the other.

Answer

The OSPFv3 process is not configured with a router ID.

Answer

The interfaces are configured as passive.

Question 10

A network engineer is configuring a DMVPN Phase 3 hub router. The spoke routers are behind NAT devices and have dynamic public IP addresses. The engineer wants the hub to dynamically learn the public IP address of each spoke and allow direct spoke-to-spoke communication. Which configuration on the hub is required to achieve this?

Accepted Answer

Configure NHRP NAT traversal on the hub and ensure the spokes use NHRP registration with their public IP address.. To allow a DMVPN hub to dynamically learn the public IP addresses of spokes behind NAT, NHRP NAT traversal must be enabled on the hub. This feature inspects NHRP registration requests and learns the public IP from the packet's source address. Spokes register with their private IP, and the hub maps it to the public IP. This is essential for Phase 3 DMVPN where spokes may have dynamic public IPs and need to establish direct tunnels.

Answer

Enable NHRP authentication and configure the hub as an NHRP server with a dynamic multicast mapping.

Answer

Configure the hub with a static NHRP mapping for each spoke's public IP address.

Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.

Question 11

A network administrator is configuring a Cisco IOS router to support IPv6 and wants to enable OSPFv3 on an interface. The administrator enters the command ipv6 ospf 1 area 0 under the interface configuration. However, OSPFv3 does not form an adjacency with a neighboring router. Which additional step is required to enable OSPFv3 on the interface?

Accepted Answer

Enable IPv6 unicast routing globally with the ipv6 unicast-routing command.. For OSPFv3 to form adjacencies, IPv6 unicast routing must be enabled globally with the ipv6 unicast-routing command. Without it, the router does not process IPv6 routing protocols, and OSPFv3 will not function even if configured on interfaces. Therefore, the missing step is to enable global IPv6 routing.

Answer

Enable OSPFv3 globally with the ipv6 router ospf 1 command.

Answer

Configure the interface as a passive interface under OSPFv3.

Answer

Configure an IPv6 address on the interface using the ipv6 address command.

Question 12

A network engineer is configuring DMVPN Phase 3 with OSPF as the routing protocol. The hub router is configured with 'ip nhrp redirect' and the spoke routers with 'ip nhrp shortcut'. After the configuration, spoke-to-spoke traffic still traverses the hub. Which configuration is required on the spoke routers to enable direct spoke-to-spoke communication?

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 3, the hub uses NHRP redirect to inform spokes that a better path exists, and spokes must be configured with NHRP shortcut to act on that information. The shortcut command allows the spoke to dynamically create a direct NHRP mapping and route traffic directly to the destination spoke, bypassing the hub. Without it, the spoke ignores redirects and keeps sending traffic to the hub.

Answer

ip nhrp network-id 1

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp map

Question 13

A network engineer is configuring a Cisco IOS router to use Policy-Based Routing (PBR) to forward traffic from a specific source subnet to a next-hop router that differs from the default path. The engineer creates a route map named PBR_MAP and applies it to the ingress interface. However, traffic from the subnet is still following the default route. What is the most likely cause?

Accepted Answer

The route map is applied to the wrong interface or in the wrong direction.. PBR must be applied to the ingress interface using the ip policy route-map command. If it is applied to the wrong interface or direction, the policy will not be evaluated for the intended traffic. Other issues like missing match/set statements are possible but less likely if the engineer followed basic configuration steps.

Answer

The ip policy route-map command was applied globally instead of on the interface.

Answer

The set ip next-hop command is missing from the route map.

Answer

The route map does not have a match statement for the source subnet, so it is not matching the traffic.

Question 14

A network engineer is troubleshooting a DMVPN Phase 3 deployment using Cisco IOS routers. Spoke-to-spoke communication is failing, but spoke-to-hub connectivity works. The hub router is configured with ip nhrp redirect, and the spokes are configured with ip nhrp shortcut. The engineer notices that the spokes are not receiving NHRP redirect messages from the hub. Which action should be taken to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The `ipv6 dhcp pool` must be associated with the interface using the `ipv6 dhcp server` command with the pool name.. For a Cisco IOS XE router to act as a DHCPv6 server, the DHCPv6 pool must be bound to the interface using the `ipv6 dhcp server` command followed by the pool name. Without this binding, the router does not know which pool to use for incoming requests, even if the pool is configured. Therefore, the missing configuration is the pool association on the interface.

Answer

Configure `ipv6 dhcp relay destination` on the interface.

Answer

Enable `ipv6 unicast-routing` globally on the router.

Answer

Configure `ipv6 nd managed-config-flag` on the client-facing interface.

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 deployment using Cisco IOS routers. Spoke-to-spoke communication is failing, but spoke-to-hub connectivity works. The hub router is configured with ip nhrp redirect, and the spokes are configured with ip nhrp shortcut. The engineer notices that the spokes are not receiving NHRP redirect messages from the hub. Which action should be taken to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the DHCP server is reachable via the router's routing table.. For DHCP relay to work, the router must have a route to the DHCP server. Without reachability, the router cannot forward the requests. Other options are either not required or less likely to cause the issue, making routing the primary check.

Answer

Verify that the ip forward-protocol udp 67 command is not blocking DHCP forwarding.

Answer

Verify that the DHCP server is configured with the correct default gateway.

Answer

Check if the interface GigabitEthernet0/1 is configured with the ip dhcp relay information option command.