300-410 Infrastructure Services Practice Test 5 — 15 Questions

Question 1

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS routers. Spokes are unable to establish direct spoke-to-spoke tunnels even though the hub is reachable and NHRP registrations are successful. Which command should the engineer verify on the hub to ensure that spoke-to-spoke communication is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show run interface tunnel0. In DMVPN Phase 3, the hub must have the 'ip nhrp redirect' command configured on its tunnel interface to enable spoke-to-spoke tunnels. This command allows the hub to redirect spokes to a more optimal path. The engineer should verify the hub's tunnel interface configuration using 'show run interface tunnel0' to confirm this command is present. Other show commands do not display this configuration.

Answer

show dmvpn

Answer

show ip route nhrp

Answer

show ip nhrp

Question 2

A network engineer is implementing MPLS Layer 3 VPNs on a Cisco IOS XE router. The engineer needs to configure the PE router to support VRFs and MP-BGP. Which two configurations are required to enable the PE router to exchange VPNv4 routes with other PE routers? (Choose two.)

Accepted Answer

Configure a route distinguisher (RD) under each VRF to uniquely identify the VPN.. To enable a PE router to exchange VPNv4 routes, the router must run MP-BGP with the VPNv4 address family activated. Additionally, each VRF must have a unique route distinguisher to create unique VPNv4 prefixes. These two configurations are fundamental for MPLS L3VPN operation. Route reflectors, LDP, and route targets are important but not strictly required for the exchange of VPNv4 routes.

Answer

Configure a route target (RT) under each VRF to control import and export of routes.

Answer

Enable MPLS LDP on the core-facing interfaces of the PE router.

Answer

Configure BGP route reflectors to propagate VPNv4 routes between PE routers.

Question 3

A network administrator is deploying MPLS Layer 3 VPNs with Cisco IOS XE. The administrator must ensure that customer routes are propagated correctly between PE routers and that the VPNv4 prefix is uniquely identified. Which two BGP attributes are used to identify a VPNv4 prefix? (Choose two.)

Accepted Answer

Route Target (RT). A VPNv4 prefix is formed by combining an IPv4 prefix with a Route Distinguisher (RD), making it unique within the MPLS VPN backbone. The Route Target (RT) is a BGP extended community that controls which VRFs import and export the route. Both the RD and RT are BGP attributes carried in VPNv4 updates. The RD ensures uniqueness, while the RT ensures proper route distribution. Together, they are the two key attributes for identifying and propagating VPNv4 prefixes in MPLS Layer 3 VPNs.

Answer

Originator ID

Answer

Multi-Protocol Label Switching (MPLS) label

Answer

BGP community attribute

Question 4

A network administrator is deploying MPLS Layer 3 VPNs. The service provider uses OSPF as the PE-CE routing protocol. The customer requires that their OSPF routes be redistributed into MP-BGP on the PE routers, and that the OSPF domain ID be consistent across all sites. Which BGP extended community must be configured on the PE routers to ensure that OSPF routes are properly redistributed and loop prevention is maintained?

Accepted Answer

Domain ID. The Domain ID extended community is specifically designed for OSPF PE-CE scenarios in MPLS L3VPN. It carries the OSPF domain ID from one site to another, allowing the receiving PE to determine if the route originated from the same OSPF domain. If the domain IDs match, the route is redistributed into OSPF as an intra-area or inter-area route; if they differ, it is treated as an external route, preventing loops. This community is essential when OSPF is used as the PE-CE routing protocol.

Answer

Route Target

Answer

Route Origin

Answer

OSPF Router ID

Question 5

A network administrator is troubleshooting a DMVPN Phase 3 deployment using Cisco IOS routers. Spoke-to-spoke communication is failing, although spoke-to-hub and hub-to-spoke communication work fine. The administrator verifies that NHRP registration is successful and that the hub has the correct mappings. Which configuration issue on the spokes is most likely causing the spoke-to-spoke failure?

Accepted Answer

The spokes are not configured with the ip nhrp shortcut command on their tunnel interfaces.. In DMVPN Phase 3, spoke-to-spoke communication requires the spokes to have the ip nhrp shortcut command configured. This allows them to accept NHRP redirect messages from the hub and dynamically create shortcut routes to other spokes. Without it, traffic continues to flow through the hub, even though a direct path is possible.

Answer

The spokes are not configured with the ip nhrp map multicast dynamic command.

Answer

The spokes are not configured with the ip nhrp network-id command matching the hub.

Answer

The spokes are not configured with the ip nhrp redirect command on their tunnel interfaces.

Question 6

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS routers. Spokes are unable to establish direct spoke-to-spoke tunnels even though the hub is reachable and NHRP registrations are successful. Which command should the engineer verify on the hub to ensure that spoke-to-spoke communication is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the spokes to use NHRP shortcut.. In DMVPN Phase 2, spoke-to-spoke communication requires NHRP shortcut on the spokes. This allows a spoke to dynamically create a direct tunnel to another spoke after resolving its NBMA address via the hub. Without NHRP shortcut, spokes will forward traffic through the hub even if they have a route. Since registrations are successful, the missing piece is likely the shortcut configuration. NHRP redirect is for Phase 3 and is not applicable here.

Answer

Enable NHRP authentication on all spokes.

Answer

Configure the hub to use NHRP redirect.

Answer

Ensure that the spokes have a route to the remote spoke's private network via the hub.

Question 7

A network engineer is configuring a Cisco router to support MPLS Traffic Engineering (TE) tunnels. The engineer has enabled MPLS TE globally and on the interfaces, and has configured OSPF with TE extensions. The engineer wants to establish a TE tunnel from Router A to Router D. The path from A to D goes through Router B and Router C. The engineer configures an explicit path on Router A that lists the loopback addresses of B, C, and D. However, the tunnel fails to establish. Which of the following is the most likely reason for the failure?

Accepted Answer

The loopback interfaces of the intermediate routers are not enabled for MPLS TE.. MPLS TE requires that the loopback interfaces used in explicit paths be enabled for TE. This involves configuring `mpls traffic-eng` and `ip rsvp bandwidth` on the loopback interface. Without this, the loopback is not advertised as a TE node in OSPF TE extensions, and the explicit path cannot be resolved, causing the tunnel to fail. Ensuring TE is enabled on loopbacks of all nodes in the path resolves the issue.

Answer

The explicit path must be configured with the `next-address` command instead of listing the addresses directly.

Answer

The explicit path must use the physical interface IP addresses, not the loopback addresses.

Answer

The router does not have a route to the loopback addresses of the intermediate routers.

Question 8

A network administrator is configuring IPv6 routing with OSPFv3 on a Cisco router. The administrator wants to enable OSPFv3 on an interface and ensure that it participates in the OSPFv3 process with process ID 1. Which command is correct?

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 on an interface in Cisco IOS, the correct interface-level command is 'ipv6 ospf process-id area area-id'. This command activates OSPFv3 for IPv6 on that interface and associates it with the specified process and area. The global command 'ipv6 router ospf 1' must be configured first to create the process. The other options are either global commands or used for multi-address-family OSPFv3, not for pure IPv6 interface activation.

Answer

ipv6 router ospf 1

Answer

router ospfv3 1

Answer

ospfv3 1 area 0

Question 9

A network administrator is implementing MPLS Layer 3 VPNs with OSPF as the PE-CE routing protocol. The customer requires that OSPF routes from one site be redistributed into MP-BGP and then into OSPF at another site without being re-advertised back into MP-BGP. Which BGP extended community should be used to prevent routing loops?

Accepted Answer

Site of origin. The site of origin (SoO) extended community is used to prevent routing loops in MPLS L3 VPNs when routes are redistributed between OSPF and BGP. When a PE router redistributes a route from OSPF into MP-BGP, it can attach an SoO value. If that route is later redistributed back into OSPF at another PE, the SoO is checked, and if it matches the site's SoO, the route is not sent back, preventing a loop. Route target and route distinguisher serve different purposes.

Answer

Route distinguisher

Answer

Route origin

Answer

Route target

Question 10

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS routers. Spokes are unable to establish direct spoke-to-spoke tunnels even though the hub is reachable and NHRP registrations are successful. Which command should the engineer verify on the hub to ensure that spoke-to-spoke communication is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the inside and outside interfaces are correctly configured with 'ip nat inside' and 'ip nat outside'.. When 'show ip nat translations' shows no entries, the most common causes are misconfigured NAT inside/outside interfaces or an ACL that does not match the traffic. The 'ip nat inside' and 'ip nat outside' commands must be applied to the correct interfaces for NAT to process packets. The NAT ACL must permit the inside local addresses; if it doesn't, no translations occur. Checking these two items directly addresses why translations are not being created.

Answer

Check if the outside interface has an IP address assigned.

Answer

Verify that the default route is pointing to the outside interface.

Answer

Ensure that the 'ip nat inside source' command is configured with the correct pool or interface.

Question 11

A network administrator is implementing MPLS Layer 3 VPNs on a Cisco IOS XE router. The administrator wants to ensure that customer routes are advertised with the correct extended community attributes to control route selection and prevent routing loops. Which BGP extended community should be used to identify the originating VRF and prevent routes from being re-imported into the same VRF?

Accepted Answer

Site of Origin. In MPLS L3VPN, the Site of Origin (SoO) extended community is used to prevent routing loops when a site is multi-homed or when routes are redistributed back into the same VRF. The SoO is configured on the VRF and attached to routes exported from that site. If a route with a matching SoO is received, it is rejected, thus preventing the route from re-entering the same site. This is crucial for correct operation in complex VPN topologies.

Answer

Route Target

Answer

Route Origin

Answer

VPN Distinguisher

Question 12

A network engineer is configuring a Cisco IOS XE router to support a DMVPN Phase 3 hub with multiple spokes. The design requires that spoke-to-spoke traffic flows directly between spokes without traversing the hub after the initial route resolution. Which technology should be implemented on the hub to enable dynamic spoke-to-spoke tunnels while maintaining a single multipoint GRE interface?

Accepted Answer

Next Hop Resolution Protocol (NHRP) with shortcut switching enabled on the hub. NHRP with shortcut switching is the key enabler for DMVPN Phase 3 spoke-to-spoke direct tunnels. The hub serves as the NHRP server and initially forwards traffic, but spokes learn each other's NBMA addresses and build direct GRE tunnels. This reduces latency and hub load while maintaining a single multipoint GRE interface on the hub.

Answer

Dynamic Multipoint VPN with per-spoke VRF and route leaking

Answer

Multipoint GRE with IPsec tunnel protection and static crypto maps

Answer

DMVPN Phase 2 with spoke-to-spoke multicast replication

Question 13

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS routers. Spokes are unable to establish direct spoke-to-spoke tunnels even though the hub is reachable and NHRP registrations are successful. Which command should the engineer verify on the hub to ensure that spoke-to-spoke communication is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hello Interval. For an OSPFv3 adjacency to form, the Area ID and Hello Interval must match on both routers. The Area ID ensures both routers are in the same OSPF area, and the Hello Interval controls the frequency of Hello packets. If these parameters differ, the routers will not become neighbors. Other parameters like Router ID, Process ID, and MTU do not need to match; in fact, Router IDs must be unique, and Process IDs are locally significant.

Answer

Router ID

Answer

Process ID

Answer

Dead Interval

Question 14

A network administrator is configuring SNMPv3 on a Cisco IOS XE router to provide secure management access. The administrator wants to ensure that SNMPv3 authentication and encryption are used, and that the SNMP engine ID is unique. Which two configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Configure a unique SNMP engine ID using the 'snmp-server engineID local' command.. To use SNMPv3 with authentication and encryption, you must create an SNMP group that specifies 'priv' for encryption. Additionally, setting a unique SNMP engine ID is important for the security and uniqueness of the SNMPv3 implementation. While creating an SNMP user is also necessary, the two specific steps that address the stated requirements are the group with 'priv' and the unique engine ID.

Answer

Configure an SNMP view to define the OIDs that can be accessed.

Answer

Enable SNMPv3 by issuing the 'snmp-server enable traps' command.

Answer

Define an SNMP user with authentication and privacy passwords.

Question 15

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS routers. Spokes are unable to establish direct spoke-to-spoke tunnels even though the hub is reachable and NHRP registrations are successful. Which command should the engineer verify on the hub to ensure that spoke-to-spoke communication is enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The redistribute ospf command requires a metric to be specified, otherwise routes are not redistributed.. BGP requires a metric when redistributing routes from other protocols. If no default metric is set, the redistribution will fail. The command default-metric under the BGP router configuration or the metric keyword in the redistribute command must be used. Without it, OSPF routes will not be injected into BGP.

Answer

The OSPF routes are not present in the routing table because they are not in the OSPF database.

Answer

The OSPF process ID must match the BGP autonomous system number for redistribution to work.

Answer

The OSPF routes are not being redistributed because BGP requires the routes to be in the routing table and have a valid next hop.