300-410 Infrastructure Services Practice Test 7 — 15 Questions

Question 1

A network engineer is configuring MPLS L3VPN on a Cisco IOS XE PE router. The PE router uses MP-BGP to exchange VPNv4 routes with a remote PE. The engineer must ensure that the PE router accepts only VPNv4 routes that carry the correct route target for VRF CUSTOMER. Which two statements about route target configuration are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route target is configured under the VRF definition using the 'route-target export' command to tag routes when they are exported from the VRF into MP-BGP.. Route targets are BGP extended communities used to control import and export of VPNv4 routes between VRFs. On the local PE, the export route target is attached to routes redistributed from the VRF into MP-BGP. On the remote PE, the import route target is compared against the attached route target to decide whether to install the route into the corresponding VRF. Both the export and import route targets are configured under the VRF definition, and they must match on the respective PEs for proper route propagation. The route distinguisher is separate and only ensures uniqueness of the prefix in the BGP table.

Answer

The route target must be the same as the route distinguisher for the VRF to function correctly.

Answer

The route target is configured only on the remote PE router, not on the local PE router.

Answer

The route target is configured under the BGP neighbor using the 'route-target import' command to filter incoming VPNv4 routes.

Question 2

A network engineer is deploying MPLS L3VPN with BGP as the PE-CE routing protocol. The customer edge router (AS 65001) peers with the provider edge router (AS 100). The provider requires that the customer's BGP autonomous system number be hidden from the rest of the MPLS core while still allowing the customer to use their own AS. Which BGP feature should be configured on the PE router?

Accepted Answer

Configure the neighbor with the remote-as 65001 and apply the as-override command under the VRF address family on the PE router.. The as-override command on the PE router rewrites the customer's AS number in the AS_PATH to the provider's AS number, preventing the customer's AS from being visible in the core. This allows the customer to use their own AS without the provider needing to support it. The other options either do not hide the AS or are applied on the wrong router.

Answer

Configure the neighbor with the remote-as 65001 and apply the allowas-in command under the VRF address family.

Answer

Configure the neighbor with the remote-as 65001 and apply the as-override command on the customer edge router.

Answer

Configure the neighbor with the remote-as 65001 and apply the as-override command under the VRF address family.

Question 3

A network engineer is deploying a Cisco IOS XE router as a PE for an MPLS L3VPN customer using eBGP as the PE-CE routing protocol. The customer's CE advertises the 172.16.10.0/24 prefix with BGP AS 65001, and the PE is in the provider AS 65000. The engineer wants the customer prefix to enter the VPNv4 table with a route distinguisher of 65000:100 and be advertised to remote PEs, but the prefix is missing from the remote PE's VRF CUSTOMER routing table while it appears locally in the VRF. Which configuration element on the local PE is most likely missing?

Accepted Answer

The address-family ipv4 vrf CUSTOMER block lacks a redistribute bgp or network statement that injects the CE-learned prefix into MP-BGP for VPNv4 export to remote PEs.. For a PE-CE eBGP deployment to propagate customer prefixes into MP-BGP, the PE must copy VRF-local routes into the BGP table within the correct VRF address family. A route learned via eBGP on the VRF interface is not automatically exported as a VPNv4 route; redistribution or a network statement inside address-family ipv4 vrf is required so the RD and route targets are attached and the prefix is advertised to remote PEs.

Answer

The address-family ipv4 vrf CUSTOMER block lacks the neighbor <CE-IP> remote-as 65001 statement, so no eBGP session forms with the CE.

Answer

The VRF definition lacks the rd 65000:100 value, so the local VRF route cannot be tagged and exported into the MP-BGP VPNv4 table.

Answer

The global BGP process lacks the bgp default ipv4-unicast command, so MP-BGP cannot carry the customer prefix inside VPNv4.

Question 4

A network engineer is configuring a Cisco IOS XE router to support MPLS L3VPN. The router is a PE device with a VRF named CUSTOMER. The engineer needs to verify that the VRF is correctly associated with the correct route distinguisher and route targets. Which command displays the VRF configuration, including the route distinguisher and route targets?

Accepted Answer

show vrf detail. The 'show vrf detail' command is used to display the configuration of VRFs, including the route distinguisher and route targets. In Cisco IOS XE, VRFs can be defined using either the legacy 'ip vrf' command or the newer 'vrf definition' command. The 'show vrf detail' command works with 'vrf definition' and shows the RD and RTs. The 'show ip vrf detail' command is older and may not display all information for 'vrf definition' VRFs. Therefore, 'show vrf detail' is the correct choice for verifying the MPLS L3VPN parameters.

Answer

show ip route vrf CUSTOMER

Answer

show bgp vpnv4 unicast all summary

Answer

show ip vrf detail

Question 5

A network engineer is configuring a Cisco IOS XE router as a PE in an MPLS L3VPN environment. The engineer needs to verify that the VRF named BLUE is correctly configured and operational. Which two commands would provide the necessary information? (Choose two.)

Accepted Answer

show ip route vrf BLUE. The 'show vrf ipv4 unicast' command provides VRF configuration details including interfaces and route targets, while 'show ip route vrf BLUE' displays the actual routing table for the VRF. Together, they verify that the VRF is configured and operational. The other commands focus on core MPLS or BGP summary information, not VRF-specific details.

Answer

show mpls ldp neighbor

Answer

show bgp vpnv4 unicast all summary

Answer

show ip protocols vrf BLUE

Question 6

A network engineer is deploying a Cisco IOS XE router as the active device in a first-hop redundancy group for hosts on VLAN 20. The design requires that the virtual IP be 10.20.20.1, the virtual MAC be 0000.0c07.ac14, and the group use HSRP version 1 for compatibility with existing devices. The engineer issues the commands under interface Vlan20 and the group comes up active, but hosts cannot reach the default gateway. Which configuration issue is most likely causing the failure?

Accepted Answer

The standby ip command was entered with the wrong address, so the virtual IP does not match the 10.20.20.1 default gateway configured on hosts.. When HSRP is active but hosts cannot reach the gateway, the most common cause is that the virtual IP does not match the default gateway configured on the hosts. The virtual MAC being correct only confirms the group number and version; it does not guarantee the virtual IP is right. Verifying the standby ip value against host gateway settings resolves the mismatch.

Answer

The standby group number is configured as 20, which produces the virtual MAC 0000.0c07.ac14 only when the group is numbered 20 in HSRPv1.

Answer

The engineer forgot to configure standby preempt, so the router never becomes the active device and cannot forward host traffic.

Answer

The engineer configured standby version 2, which changes the virtual MAC format and breaks compatibility with HSRPv1 peers and host ARP caches.

Question 7

A network engineer is configuring a Cisco IOS XE router as a PE in an MPLS L3VPN environment. The engineer needs to assign a route distinguisher (RD) to a VRF named RED. The RD must be unique and use the format ASN:nn. Which command correctly assigns the RD?

Accepted Answer

rd 65000:100. The correct command to assign a route distinguisher in ASN:nn format is 'rd 65000:100' under VRF configuration mode. The other options use incorrect syntax or invalid keywords, and would not successfully assign the RD. The RD is crucial for unique identification of VPNv4 routes in MPLS L3VPN.

Answer

route-distinguisher 65000:100

Answer

rd 65000 100

Answer

rd 65000.100

Question 8

A network engineer is configuring a Cisco IOS XE router as a Dynamic Host Configuration Protocol (DHCP) client. The router's GigabitEthernet0/0 interface must obtain its IP address from a DHCP server. After applying the configuration, the interface remains in an 'up/up' state but has no IP address. Which command should be used to verify whether the router received a DHCP offer?

Accepted Answer

show ip dhcp client statistics. The 'show ip dhcp client statistics' command provides counters for DHCP messages sent and received, including offers. When an interface is configured as a DHCP client and fails to obtain an address, this command quickly reveals whether the router received any DHCP offers. If offers are zero, the issue likely lies with the server or Layer 2 connectivity; if offers were received but no lease, the problem may be in the request/acknowledgment phase.

Answer

debug ip dhcp client events

Answer

show ip interface GigabitEthernet0/0

Answer

show dhcp client binding

Question 9

A network engineer is configuring a Cisco IOS XE router to act as a DHCP server for the 192.168.50.0/24 subnet on interface GigabitEthernet0/1. The design requires that the DHCP pool exclude the addresses used by static devices (192.168.50.1 through 192.168.50.20) and that clients receive the DNS server 192.168.50.5 and the domain name corp.example.com. The engineer has already created the pool and configured the network statement and default router. Which two additional commands must be issued to meet these requirements? (Choose two.)

Accepted Answer

dns-server 192.168.50.5 under the DHCP pool configuration. Excluding statically assigned addresses requires the global ip dhcp excluded-address command, and delivering the DNS resolver to clients requires the dns-server command inside the DHCP pool. Together these satisfy the two design requirements. The exclusion command is global, not pool-level, and the DNS option is pool-level, which is a common source of configuration errors.

Answer

domain-name corp.example.com under the DHCP pool configuration

Answer

ip dhcp excluded-address 192.168.50.1 192.168.50.20 under the ip dhcp pool configuration

Answer

lease 0 8 under the DHCP pool configuration

Question 10

A network engineer is implementing a DMVPN Phase 3 hub-and-spoke topology using Cisco IOS XE routers. The hub router is configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'. The engineer notices that spoke-to-spoke traffic is still traversing the hub instead of building direct tunnels. Which of the following is the most likely cause?

Accepted Answer

The spoke routers have not been configured with 'ip nhrp redirect' on their tunnel interfaces.. For DMVPN Phase 3 spoke-to-spoke direct tunnels, the hub must have 'ip nhrp redirect' and each spoke must have both 'ip nhrp shortcut' and 'ip nhrp redirect'. The redirect on the spoke allows it to accept and act on NHRP redirect messages from the hub. Without it, the spoke ignores redirects and continues sending traffic through the hub. The shortcut command alone is insufficient.

Answer

The hub router is missing the 'ip nhrp map multicast dynamic' command on its tunnel interface.

Answer

The hub router is not configured with 'ip nhrp shortcut' on its tunnel interface.

Answer

The spoke routers are not configured with 'ip nhrp nhs' pointing to the hub's tunnel IP address.

Question 11

A service provider is running MPLS Traffic Engineering with RSVP-TE on Cisco IOS XE routers. An engineer has configured an explicit-path tunnel from PE1 to PE2 that must follow a specific set of core routers. The tunnel interface is up, RSVP reservations appear on the path, but the tunnel does not carry traffic because the headend reports that the path is not usable. The engineer verifies that the explicit path lists the correct router IDs in order. Which condition on the headend most likely prevents the tunnel from becoming operational?

Accepted Answer

The headend's CSPF computation fails because the TE topology database lacks the required IGP TE extensions, such as mpls traffic-eng router-id and the mpls traffic-eng area configuration, on one or more core routers.. For an RSVP-TE tunnel with an explicit path to become operational, the headend must compute a valid path using the IGP TE topology database. That database is built only when routers advertise TE information via mpls traffic-eng router-id and have mpls traffic-eng enabled under the IGP. If a core router along the explicit path does not advertise TE extensions, CSPF cannot validate the path and the tunnel remains non-operational despite correct hop ordering.

Answer

The tunnel interface lacks the ip unnumbered Loopback0 command, so the tunnel has no usable source address for the RSVP session.

Answer

The explicit-path ip explicit-path command was created with the enable command missing, so the listed hops are not actually enabled for CSPF computation.

Answer

The tunnel destination is configured as the loopback of PE2 but the explicit path references the physical interface addresses of the core routers.

Question 12

A network engineer is deploying a Cisco IOS XE router as a Dynamic Multipoint VPN (DMVPN) Phase 3 hub in a dual-cloud design. The design requires that each spoke be able to reach other spokes through the hub while still allowing direct spoke-to-spoke tunnels to form on demand. The engineer has configured the hub with 'ip nhrp redirect' and each spoke with 'ip nhrp shortcut'. After testing, the engineer notices that spoke-to-spoke traffic is not taking the direct path; all inter-spoke traffic still traverses the hub. Which additional command must be configured on the hub to enable NHRP to resolve the shortcut path?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be able to redirect spokes to a more optimal path. The hub uses 'ip nhrp redirect' to inform a spoke that a better path exists to the destination. The spoke, with 'ip nhrp shortcut', then sends an NHRP resolution request to the destination spoke and builds a direct tunnel. Without the hub redirect, spokes continue to forward traffic through the hub.

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 100

Question 13

A network engineer is configuring a Cisco IOS XE router to act as a DHCP relay agent. The DHCP server is on a different subnet, and the router must forward DHCP requests from clients on the 10.1.1.0/24 subnet to the server at 192.168.1.100. The engineer has already configured the interface with an IP address and enabled it. Which two additional commands are required on the router to complete the DHCP relay configuration? (Choose two.)

Accepted Answer

service dhcp. To configure a Cisco IOS XE router as a DHCP relay agent, you must enable the DHCP service globally with 'service dhcp' (if not already enabled) and configure 'ip helper-address' on the client-facing interface pointing to the DHCP server. The helper address forwards broadcast DHCP requests to the specified server. Other commands like Option 82 or UDP forwarding are optional or already default.

Answer

ip forward-protocol udp 67

Answer

ip dhcp pool RELAY

Answer

ip dhcp relay information option

Question 14

A network engineer is deploying a Cisco IOS XE router as a Dynamic Host Configuration Protocol (DHCP) snooping-enabled access switch for a VLAN. The design requires that DHCP server messages from the legitimate DHCP server be permitted while all other DHCP server messages be dropped. Which command must be applied on the access switch?

Accepted Answer

ip dhcp snooping and ip dhcp snooping vlan 10, then ip dhcp snooping trust on the uplink. DHCP snooping requires global enablement, per-VLAN activation, and explicit trust on the port facing the legitimate DHCP server. Without trusting that uplink, all DHCP server messages are dropped because access ports are untrusted by default. This configuration allows the authorized server while preventing rogue DHCP servers on user-facing ports.

Answer

ip dhcp snooping vlan 10

Answer

ip dhcp snooping

Answer

ip dhcp snooping trust

Question 15

A network engineer is configuring a Cisco IOS XE router to provide DHCP service for a guest wireless subnet. The router must assign IP addresses from the 192.168.100.0/24 pool, but the first 10 addresses and the last address in the range must be excluded from dynamic assignment. Additionally, the router must send the DNS server address 8.8.8.8 and the domain name 'guest.local' to clients. The engineer has already created the DHCP pool and entered the network statement. Which set of commands must be applied to the DHCP pool to meet these requirements?

Accepted Answer

In global config: ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254; then in pool: dns-server 8.8.8.8 and domain-name guest.local. DHCP excluded addresses are configured globally with 'ip dhcp excluded-address', while DHCP pool options such as DNS server and domain name are configured within the 'ip dhcp pool' configuration mode. The correct answer places the exclusions globally and the DNS and domain settings inside the pool. This ensures the router does not assign the reserved addresses and provides the required parameters to clients.

Answer

In global config: ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254; then in pool: dns-server 8.8.8.8 and domain-name guest.local and default-router 192.168.100.1

Answer

ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254; then in pool: dns-server 8.8.8.8 and domain-name guest.local

Answer

In pool: ip dhcp excluded-address 192.168.100.1 192.168.100.10 and ip dhcp excluded-address 192.168.100.254; then in global: dns-server 8.8.8.8 and domain-name guest.local