300-410 Multiple Select — 20 Questions

Question 1

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. Option A is correct because static NAT is created with the global configuration command ip nat inside source static

, which permanently maps one inside local address to one inside global address. Option B is correct because the router must know which interface is the internal side, and that is done by entering the interface configuration and issuing the ip nat inside command on the interface facing the internal network. Option C is wrong because ip nat outside must be applied to the external-facing interface, not the internal one. Option D is wrong because an access list is used for dynamic NAT or PAT with the pool/overload syntax, not for a static one-to-one mapping. Option E is wrong because there is no global ip nat service command required to activate NAT on Cisco IOS; NAT is enabled by the inside/outside interface designations and the translation statements themselves.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 2

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 defines three security levels. The noAuthNoPriv level uses a community-string-like mechanism without authentication or encryption, making it the least secure option. This is correct because it matches the RFC 3414 definition where no authentication and no privacy (encryption) are applied.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 3

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. Option A is correct because IPv6 ND Inspection builds a binding table (IPv6 address to MAC address mappings learned from DHCPv6 snooping or ND messages) and validates Neighbor Solicitation and Neighbor Advertisement messages against that table, dropping messages whose source link-layer address does not match the binding. Option B is correct because ND Inspection supports per-interface configuration, including the ability to rate-limit ND packets (using the ipv6 nd inspection limit rate command) to mitigate ND flooding and DoS attacks. Option C is not correct because blocking rogue DHCPv6 servers is the function of DHCPv6 Guard, not ND Inspection. Option D is not correct because ND Inspection relies on the IPv6 snooping binding table rather than a prefix list to validate addresses. Option E is not correct because ND Inspection is configured on a per-interface basis (with a global policy applied to interfaces), not globally only.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 4

A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. The hub router is configured with a multipoint GRE tunnel and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels. Which two statements describe the correct operation of DMVPN Phase 3 that could explain the issue? (Choose two.)

Accepted Answer

The hub must be configured with the ip nhrp redirect command to support Phase 3.. In DMVPN Phase 3, the hub must be configured with ip nhrp redirect, and spokes must be configured with ip nhrp shortcut. The redirect command allows the hub to notify spokes of a better path, while the shortcut command enables spokes to act on those notifications and establish direct tunnels. Without these, spoke-to-spoke traffic will continue to traverse the hub, even if other NHRP settings are correct.

Answer

Spokes must be configured with the ip nhrp network-id command matching the hub.

Answer

The hub must be configured with the ip nhrp map multicast dynamic command.

Answer

The hub must be configured with the ip nhrp authentication command.

Question 5

A network engineer is configuring a DMVPN Phase 3 network with mGRE and NHRP. The hub router must be able to dynamically learn spoke routes and advertise them to other spokes. Which two statements are true regarding the configuration of the hub to support spoke-to-spoke communication in DMVPN Phase 3? (Choose two.)

Accepted Answer

The hub must have a route to all spoke networks, either through a routing protocol or summary route.. In DMVPN Phase 3, the hub must be configured with 'ip nhrp redirect' to inform spokes of a better direct path, and it must have a route to all spoke networks to provide initial connectivity and forwarding. The spokes require 'ip nhrp shortcut' to act on redirects. The other options are either not specific to Phase 3 or are configured on spokes.

Answer

The hub must have 'ip nhrp shortcut' configured on its tunnel interface.

Answer

The hub must have 'ip nhrp network-id' configured with the same value as the spokes.

Answer

The hub must have 'ip nhrp map multicast dynamic' configured to support multicast traffic.

Question 6

A network engineer is implementing GET VPN using GDOI on Cisco IOS routers. The key server must distribute the group policy, and the group members must register and receive rekey messages. The engineer needs to verify which components are required for the group members to successfully join the group and decrypt traffic. (Choose two.)

Accepted Answer

Group members must be configured with the group identity and a matching GDOI group configuration referencing the key server.. GET VPN GDOI group members must be configured with the correct group identity and key server reference, and they must successfully register to receive the KEK and TEK from the key server. These two elements are fundamental: the local group configuration identifies which key server to contact, and successful registration provides the keys needed to decrypt the group's encrypted traffic. Authentication uses IKEv1 rather than IKEv2 with a CA, and the encryption ACL comes from the downloaded policy.

Answer

Group members must have a static VRF configured to isolate the GET VPN traffic from the global routing table.

Answer

Group members must be configured with the same ACL as the key server to define interesting traffic for the encryption policy.

Answer

Group members must have IKEv2 configured with a certificate authority to authenticate to the key server.

Question 7

Which TWO statements correctly describe the behavior of OSPFv3 when troubleshooting neighbor adjacency issues on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

OSPFv3 neighbor adjacencies are formed using the link-local IPv6 address of the neighbor.. Option A is correct because OSPFv3 forms neighbor adjacencies over IPv6 link-local addresses, which are used as the source and next-hop for Hello packets on the link. Option D is correct because the 'show ipv6 ospf neighbor' command output includes the neighbor's link-local address, which is essential when troubleshooting adjacency issues. Option B is incorrect because the OSPFv3 router ID is a 32-bit value, not 128-bit, and is typically derived from an IPv4 address or manually configured. Option C is incorrect because OSPFv3 is enabled on an interface with the 'ipv6 ospf area ' command, while 'ipv6 router ospf' enters the OSPFv3 process configuration mode. Option E is incorrect because OSPFv3 network type is configured per interface, not globally under the OSPFv3 process.

Answer

The OSPFv3 router ID is a 128-bit value derived from the highest loopback IPv6 address.

Answer

The 'ipv6 router ospf' command is used to enable OSPFv3 on an interface.

Answer

OSPFv3 uses the network type configured under the OSPFv3 process globally, not per interface.

Question 8

Which TWO statements about the syslog message format and its fields are correct? (Choose TWO.)

Accepted Answer

The facility code in a syslog message identifies the type of process that generated the message, such as local7 (value 23).. The only correct statement is A. The facility code identifies the type of process that generated the message (local7 is facility 23). B is incorrect because severity 0 is Emergency, not Debugging. C is incorrect because Cisco IOS does not add sequence numbers by default; this requires the service sequence-numbers command. D is incorrect because the default Cisco syslog timestamp is not DD/MM/YYYY; the default format is typically *HH:MM:SS or MMM DD YYYY HH:MM:SS when timestamps are enabled. E is incorrect because the hostname field uses the device's configured hostname, not the IP address.

Answer

The severity level in a syslog message ranges from 0 (debugging) to 7 (emergency).

Answer

By default, Cisco IOS includes a sequence number in every syslog message when logging is enabled.

Answer

The timestamp in a syslog message from a Cisco device is formatted as DD/MM/YYYY HH:MM:SS by default.

Answer

The hostname field in a syslog message is derived from the IP address of the interface that sends the message.

Question 9

Which TWO statements about MPLS label imposition, disposition, and swapping are true? (Choose TWO.)

Accepted Answer

Penultimate Hop Popping (PHP) reduces the processing load on the egress LSR by having the penultimate LSR pop the label.. Option A is correct because Penultimate Hop Popping (PHP) lets the penultimate LSR pop the MPLS label before forwarding the packet to the egress LSR, so the egress LSR receives a plain IP packet and avoids an extra label lookup, reducing its processing load. Option B is correct because a core/intermediate LSR performs the label swap operation, replacing the incoming label value with the outgoing label value from its LFIB (LIB) entry before forwarding the frame. Option C is wrong because label imposition (push) is performed by the ingress LSR (ingress edge LER), not the egress LSR, which performs disposition (pop) or receives an already-popped packet. Option D is wrong because PHP is a normal behavior between adjacent LSRs and does not require the egress LSR to be non-adjacent to the penultimate LSR. Option E is wrong because PHP is enabled by default on Cisco IOS routers (the implicit null label is advertised), not disabled by default requiring explicit configuration.

Answer

The egress LSR performs label imposition (push) before forwarding the IP packet to the destination.

Answer

PHP is enabled only when the egress LSR is not directly connected to the penultimate LSR.

Answer

By default, PHP is disabled on Cisco IOS routers and must be explicitly configured.

Question 10

Which TWO statements about SNMPv3 configuration on Cisco IOS XE are true? (Choose TWO.)

Accepted Answer

The 'snmp-server user' command can specify an authentication and privacy password for a user.. Option B is correct because the 'snmp-server user' command on Cisco IOS XE allows you to configure a user with authentication (auth) and privacy (priv) passwords, e.g., 'snmp-server user user1 group1 v3 auth sha authpass priv aes 128 privpass', which sets both the authentication and encryption credentials. Option D is correct because when configuring SNMPv3 traps or informs with 'snmp-server host', you must specify the username (and optionally the security level) so the device knows which SNMPv3 user credentials to use when sending notifications, e.g., 'snmp-server host 192.0.2.1 traps version 3 priv user1'. Option A is incorrect because 'snmp-server group' creates an SNMPv3 group and associates it with a security model and access level, but it does not assign a username; users are assigned to groups via the 'snmp-server user' command. Option C is incorrect because the SNMP engine ID is automatically generated by default, but it can be manually configured using the 'snmp-server engineID local' command. Option E is incorrect because SNMPv3 supports three security levels: noAuthNoPriv, authNoPriv, and authPriv, not only authPriv.

Answer

The 'snmp-server group' command creates a group and assigns a username to it.

Answer

The engine ID is automatically generated and cannot be manually configured.

Answer

SNMPv3 supports only the authPriv security level.

Question 11

Which TWO configuration steps are required to implement Control Plane Policing (CoPP) on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

Create a policy map that defines a police action for the classified traffic.. A policy map is required to define the police action (e.g., 'police rate 10000 conform-action transmit exceed-action drop') that enforces rate limiting on the classified traffic. Without a policy map specifying the policing parameters, CoPP cannot apply any QoS action to the control plane traffic. Option C is correct because a class map is necessary to classify the specific traffic types (e.g., SSH, BGP, ICMP) that should be subjected to policing, using match statements based on access lists or protocol headers.

Answer

Apply the policy map to a physical interface using the 'service-policy input' command.

Answer

Configure a 'shape average' command in the policy map to limit traffic rate.

Answer

Apply the policy map to the control plane using the 'service-policy input' command under the interface configuration mode.

Question 12

Which TWO configuration steps are required to enable IPv6 RA Guard on a Cisco switch interface? (Choose TWO.)

Accepted Answer

Create an RA Guard policy using the 'ipv6 nd raguard policy POLICY_NAME' command.. Option A is correct because RA Guard on Cisco switches requires first defining a policy in global configuration mode with the 'ipv6 nd raguard policy POLICY_NAME' command, which creates the policy container where device-role and other parameters are set. Option B is correct because the policy must then be bound to the specific Layer 2 switch interface using the interface-level command 'ipv6 nd raguard attach-policy POLICY_NAME' for the filtering to take effect. Option C is not required because RA Guard is a Layer 2 security feature that filters ICMPv6 Router Advertisement messages at the switch port and does not depend on the switch having IPv6 unicast routing enabled. Option D is incorrect because there is no direct interface command 'ipv6 nd raguard' that enables the feature without an associated policy. Option E is incorrect because DHCPv6 Guard is a separate feature that filters DHCPv6 server/client messages and is not a prerequisite for RA Guard.

Answer

Enable IPv6 routing globally with 'ipv6 unicast-routing'.

Answer

Configure 'ipv6 nd raguard' directly on the interface without a policy.

Answer

Enable DHCPv6 Guard on the same interface to complement RA Guard.

Question 13

Which TWO actions will prevent a BGP route from being installed in the routing table (RIB) while still being present in the BGP table? (Choose TWO.)

Accepted Answer

The route is suppressed due to an aggregate-address command.. A route is present in the BGP table but not installed in the RIB when it is suppressed by an aggregate-address command (option A), when the BGP next hop is unreachable (option B), or when it is dampened due to BGP flap dampening (option E). Dampened routes remain in the BGP table but are marked damped and are not installed. Option C is incorrect because local preference influences best-path selection but does not by itself prevent RIB installation. Option D is incorrect because soft-reconfiguration inbound stores received updates but does not affect RIB installation.

Answer

The route is received with a higher local preference than the best path.

Answer

The neighbor is configured with 'soft-reconfiguration inbound'.

Question 14

Which THREE symptoms indicate that an IPv4 access control list may be misconfigured or not applied correctly? (Choose THREE.)

Accepted Answer

Traffic that should be permitted is being blocked.. A primary symptom of a misconfigured or incorrectly applied ACL is that it blocks traffic that should be permitted. This typically occurs when the ACL's sequence of permit and deny statements does not match the intended policy, or when the ACL is applied in the wrong direction (inbound vs. outbound) on an interface. The router processes ACL entries sequentially, so a deny statement placed before a permit statement for the same traffic will cause legitimate packets to be dropped.

Answer

The interface is flapping up and down.

Answer

Routing protocol neighbors are dropping.

Question 15

Which TWO configuration steps are required to enable SNMPv3 with authentication and encryption on a Cisco router? (Choose TWO.)

Accepted Answer

snmp-server group GROUP v3 priv. The `snmp-server group GROUP v3 priv` command creates an SNMPv3 group that enforces the `priv` security level, which requires both authentication and encryption for all users in that group. This is the foundational step to enable SNMPv3 with auth and encryption, as the group defines the minimum security model (noAuthNoPriv, authNoPriv, or authPriv) that users must meet. Without this group configuration, users cannot be assigned the necessary privileges for encrypted communication.

Answer

snmp-server community PUBLIC ro

Answer

snmp-server host 10.1.1.1 version 3 priv USER

Answer

snmp-server enable traps

Question 16

A network administrator is troubleshooting an 802.1X deployment on a Cisco switch. Users report that they cannot authenticate and are placed into a guest VLAN. The administrator suspects that the switch is not receiving EAPOL packets from the supplicants. Which two actions should the administrator take to verify that EAPOL packets are being received and processed on the switch? (Choose two.)

Accepted Answer

Enable 'debug dot1x all' and observe the debug output for EAPOL packet reception.. The two correct actions are using 'show dot1x interface' and enabling 'debug dot1x all'. These commands provide direct visibility into EAPOL packet reception and processing on the switch. The other options either show session information that doesn't confirm EAPOL reception or focus on RADIUS or MAC address tables, which are not specific to verifying EAPOL packets from the supplicant.

Answer

Use the 'show authentication sessions interface' command to view the session status and method.

Answer

Check the 'show mac address-table interface' command to see if the supplicant's MAC address is learned.

Answer

Use the 'show radius statistics' command to verify RADIUS server reachability.

Question 17

Which TWO statements about route summarization in BGP are true? (Choose TWO.)

Accepted Answer

The 'aggregate-address' command creates a summary route in the BGP table.. Option A is correct because the Cisco IOS 'aggregate-address ' command under the BGP router configuration creates an aggregate (summary) entry in the BGP table, provided at least one more-specific route from the same AS exists in the BGP table. Option B is correct because adding the 'summary-only' keyword to 'aggregate-address' advertises only the aggregate and suppresses the more-specific component routes to all neighbors, which is the standard way to prevent the specifics from being advertised. Option C is wrong because the 'network' command injects an exact prefix into BGP (it does not perform summarization or create an aggregate). Option D is wrong because suppression of more-specifics is achieved with the 'summary-only' keyword (or with 'suppress-map' for selective suppression), not by a route-map requirement. Option E is wrong because route summarization via 'aggregate-address' can be configured on any BGP speaker, not only on route reflectors.

Answer

The 'network' command is used to create a summary route in BGP.

Answer

BGP summarization requires a route-map to suppress more specific routes.

Answer

Route summarization in BGP can only be configured on route reflectors.

Question 18

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The engineer has created a class-map to match malicious traffic and a policy-map to police it. Which two statements are true regarding the application and behavior of CoPP? (Choose two.)

Accepted Answer

CoPP uses a token bucket algorithm to enforce rate limits, where the first value is the committed information rate and the second is the burst size.. CoPP is applied to the control plane via the service-policy command under control-plane configuration mode, and it uses a token bucket algorithm with a committed information rate and burst size. The other statements are false: CoPP is not applied to interfaces, class-default does not require a police action, and the exceed-action determines the fate of excess traffic.

Answer

CoPP automatically drops all traffic that exceeds the configured rate, regardless of the exceed-action specified in the policy.

Answer

The class-default class in a CoPP policy-map must always have a police action configured to drop all unmatched traffic.

Answer

CoPP can be applied to a specific interface to police traffic entering that interface before it reaches the control plane.

Question 19

Which TWO configuration steps are required to implement Policy-Based Routing (PBR) on a Cisco router? (Choose TWO.)

Accepted Answer

Create a route-map with match and set commands.. Option A is correct because PBR is defined inside a route-map, where 'match' statements identify the traffic (typically via an ACL or prefix-list) and 'set' statements define the forwarding action such as 'set ip next-hop' or 'set interface'. Option B is correct because the route-map must be attached to the ingress interface with the interface-level command 'ip policy route-map <name>' for PBR to take effect on transit traffic. Option C is not required as a separate step because the ACL is referenced within the route-map's match statement rather than configured as an independent mandatory configuration element. Option D is not required because Cisco Express Forwarding is enabled by default on modern Cisco IOS platforms and is not a PBR-specific configuration step. Option E is incorrect for this scenario because 'ip local policy route-map' applies PBR to router-generated (locally sourced) traffic, not to traffic being routed through an interface.

Answer

Configure an access-list to match the traffic.

Answer

Enable CEF globally.

Answer

Use the 'ip local policy route-map' command.

Question 20

A network administrator is deploying MPLS Layer 3 VPNs on Cisco IOS routers. The administrator must ensure that customer routes are exchanged between PE routers without requiring customer involvement. Which two protocols or features are required to accomplish this? (Choose two.)

Accepted Answer

Route targets configured under VRFs. MPLS Layer 3 VPNs rely on MP-BGP with the VPNv4 address family to exchange customer routes between PE routers. Route targets, implemented as extended BGP communities, are used to control import and export of these routes into VRFs. Together, they enable the PE routers to maintain separate routing tables and forward customer traffic correctly across the shared MPLS core.

Answer

OSPF as the PE-CE routing protocol

Answer

RSVP-TE for traffic engineering

Answer

LDP for label distribution