300-410 Multiple Select — 60 Questions

Question 1

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure 'event cli pattern "write memory" sync no' under the applet.. The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'. The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.

Answer

Define the applet using the 'event manager policy' command instead of 'event manager applet'.

Answer

Add an 'event syslog pattern "WRITE"' to detect the write memory operation.

Answer

Include an 'action cli command "enable"' before the copy command to ensure privileged access.

Question 2

Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)

Accepted Answer

A time-range can include both absolute and periodic statements simultaneously.. The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.

Answer

The time-range is applied to the entire ACL, not individual ACEs.

Answer

If the router's clock is not set, the time-range will be considered active at all times.

Answer

The time-range feature can only be used with extended named ACLs, not standard ACLs.

Question 3

Which TWO statements correctly describe the behavior of the 'default-information originate' command in the context of route redistribution? (Choose TWO.)

Accepted Answer

In OSPF, the 'default-information originate' command always injects a default route into the OSPF domain, even if no default route exists in the routing table, provided the 'always' keyword is used.. The 'default-information originate' command in OSPF and EIGRP has specific behaviors. In OSPF, it always originates a default route regardless of the routing table, unless the 'always' keyword is omitted and there is no default route in the routing table. In EIGRP, it requires a default route in the routing table to inject the default, unless the 'always' keyword is used. The command does not automatically redistribute all routes; it only injects a default route.

Answer

In EIGRP, the 'redistribute static' command automatically injects a default route if a static default route is configured.

Answer

In OSPF, the 'default-information originate always' command will inject a default route even if OSPF is not configured on any interface.

Answer

In both OSPF and EIGRP, the 'default-information originate' command automatically redistributes all connected routes into the routing protocol.

Question 4

Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)

Accepted Answer

It validates Neighbor Solicitation and Neighbor Advertisement messages against the IPv6 snooping binding table.. IPv6 ND Inspection validates Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages against the IPv6 snooping binding table. This table is built by gleaning information from DHCPv6 messages or by using the IPv6 Neighbor Discovery protocol itself, ensuring that only legitimate ND messages from trusted sources are forwarded, preventing attacks like Neighbor Cache exhaustion or address spoofing.

Answer

It prevents rogue DHCPv6 servers from assigning malicious addresses.

Answer

It uses a prefix list to determine which source addresses are allowed.

Answer

It is enabled globally and cannot be applied on a per-interface basis.

Question 5

Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)

Accepted Answer

PAT allows multiple inside hosts to share a single public IP address by using unique source port numbers.. PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.

Answer

The 'ip nat inside source static' command automatically enables PAT when multiple inside hosts are configured.

Answer

The 'ip nat pool' command is required for all PAT configurations.

Question 6

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Accepted Answer

IPv6 ACLs are applied to interfaces using the ipv6 traffic-filter command.. The `ipv6 traffic-filter` command is the Cisco IOS command used to apply an IPv6 ACL to an interface for filtering inbound or outbound traffic. This is the direct IPv6 equivalent of the `ip access-group` command used for IPv4 ACLs, and it is the only valid method for applying IPv6 ACLs to filter traffic on a Cisco router interface.

Answer

IPv6 ACLs use wildcard masks similar to IPv4 ACLs.

Answer

IPv6 ACLs automatically permit ICMPv6 neighbor discovery traffic by default.

Answer

IPv6 ACLs support the remark keyword for documentation.

Question 7

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show snmp. The `show snmp` command displays the overall SNMP agent configuration, including contact, location, community strings, and SNMP version. The `show snmp host` command lists the configured SNMP notification receivers (trap or inform destinations) and verifies that the router is correctly configured to send SNMP messages to the management station. Together, these two commands confirm both the agent's operational state and its connectivity to remote hosts.

Answer

show snmp group

Answer

show snmp user

Answer

debug snmp packets

Question 8

Which TWO statements about EEM environment variables and their scoping are true? (Choose TWO.)

Accepted Answer

Environment variables defined using the 'event manager environment' global configuration command are available to all EEM applets on the device.. The correct answers are A and E. Option A is correct because EEM environment variables set with the 'event manager environment' global configuration command are global and available to all applets on the device. Option E is correct because the '$_syslog_msg' variable is only populated when the applet is triggered by a syslog event; it is not available for other event types. Option B is incorrect because variables set with 'action set' within an applet are local to that applet and are not automatically shared with other applets. Option C is incorrect because the '$_cli_msg' variable, when used with 'event cli', does not contain the full command line including parameters; it only contains the command keyword. Option D is incorrect because there is no standard EEM variable '$_event_pub_sec'; the correct variable for event publish security information is '$_event_pub_sec_name' or similar, but not as described.

Answer

Variables set within an applet using the 'action set' command are automatically available to other applets running on the same device.

Answer

The '$_cli_msg' variable, when used with 'event cli', contains the full command line that triggered the event, including any parameters.

Answer

The '$_event_pub_sec' variable provides the priority and severity of the event that triggered the applet.

Question 9

Which TWO statements about the 'distance' command in Cisco IOS routing protocols are true? (Choose TWO.)

Accepted Answer

Under EIGRP, the 'distance eigrp

' command sets different ADs for internal and external routes.. The distance command can be used to modify the administrative distance for routes learned via a routing protocol. It can be applied globally or with an access-list or prefix-list to match specific routes. The command does not affect the AD of routes from other protocols. The distance value must be between 1 and 255. The command can be used under EIGRP, OSPF, RIP, and BGP, but the syntax varies slightly.

Answer

The 'distance' command can be used to change the AD of connected routes.

Answer

The 'distance' command requires a route-map to match specific prefixes in all routing protocols.

Answer

The 'distance' command can be used to set an AD of 0 for a specific route.

Question 10

An engineer must enable BFD for an OSPF single-hop session between two directly connected routers. Which TWO configuration changes are required on each router? (Choose TWO.)

Accepted Answer

Configure the bfd interval command under the interface.. To enable BFD for OSPF, you must first enable BFD on the interface (bfd interval) and then enable BFD support under the OSPF routing process or interface (ip ospf bfd). The bfd neighbor command is for static BFD sessions, not OSPF. The router ospf command alone does not enable BFD. The bfd all-interfaces command enables BFD on all OSPF interfaces but still requires interface-level BFD configuration.

Answer

Configure the bfd neighbor command under global configuration.

Answer

Configure the router ospf command and then use the bfd all-interfaces command.

Answer

Configure the bfd slow-timers command under the interface.

Question 11

Which THREE statements about IPv6 unicast RPF (uRPF) are true? (Choose THREE.)

Accepted Answer

IPv6 uRPF uses the Forwarding Information Base (FIB) to verify source address reachability.. IPv6 unicast RPF (uRPF) leverages the Forwarding Information Base (FIB) to verify that the source address of an incoming packet is reachable via the interface on which the packet was received. The FIB contains the best routes from the routing table, and uRPF performs a reverse path lookup against it to ensure the source address is topologically correct. This prevents spoofed traffic from entering the network.

Answer

IPv6 uRPF checks the destination address of incoming packets.

Answer

IPv6 uRPF is used to filter multicast traffic.

Question 12

Which TWO commands can be used to verify the operational status of a manually configured IPv6 tunnel on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show interfaces tunnel 0. The 'show interfaces tunnel 0' command displays the operational status, line protocol state, and encapsulation details of the tunnel interface, which directly verifies whether the manually configured IPv6 tunnel is up/up. The 'show ipv6 interface tunnel 0' command shows IPv6-specific information such as the IPv6 address, link-local address, and whether IPv6 is enabled on the tunnel interface, confirming that IPv6 traffic can be processed. Both commands provide essential operational verification for a manually configured IPv6 tunnel, such as a 6in4 or GRE tunnel carrying IPv6.

Answer

show ipv6 route

Answer

show ipv6 tunnel 0

Answer

show running-config interface tunnel 0

Question 13

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Accepted Answer

'show crypto session' displays the IKEv2 SA status and the IPsec SA status.. The 'show crypto session' command provides a concise summary of both IKEv2 SA (phase 1) and IPsec SA (phase 2) status, including the state (UP-ACTIVE) and peer IP. This makes it a quick troubleshooting tool for verifying that both security associations are established without needing separate commands for each phase.

Answer

'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

Answer

The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.

Answer

'show crypto map' displays the current packet count for each IPsec SA.

Question 14

Which TWO actions will prevent IPv6 traffic with a spoofed source address from being forwarded in a network where BGP is used for routing? (Choose TWO.)

Accepted Answer

Apply uRPF loose mode on the customer-facing interface.. URPF (Unicast Reverse Path Forwarding) loose mode checks the source address of incoming IPv6 traffic against the routing table to ensure a route exists back to that source, without requiring the exact interface. This prevents spoofed source addresses from being forwarded when no route exists for the claimed source. Option B is correct because an inbound IPv6 ACL on the edge interface can explicitly deny traffic from reserved prefixes (e.g., RFC 6890) or internal prefixes that should never appear as source addresses from outside, effectively blocking spoofed traffic at the ingress point.

Answer

Use the 'ipv6 verify unicast source reachable-via any allow-default' command to allow traffic with default route.

Answer

Apply an outbound IPv6 ACL on the BGP neighbor interface to filter spoofed source addresses.

Answer

Disable BGP prefix filtering to allow all prefixes, then rely on uRPF only.

Question 15

Which TWO statements correctly describe the behavior of Policy-Based Routing (PBR) when using the 'set ip next-hop' and 'set ip default next-hop' commands? (Choose TWO.)

Accepted Answer

The 'set ip next-hop' command overrides the routing table only when the next-hop address is reachable; if unreachable, the packet is dropped unless a default route exists.. PBR uses route maps to override the routing table. The 'set ip next-hop' command is applied only if the packet matches the match criteria; if the next hop is unreachable, the packet is dropped (unless a default route exists). The 'set ip default next-hop' command is used only when the routing table has no explicit route for the destination. The 'set ip next-hop verify-availability' option tracks reachability using CEF. The 'set interface' command does not require a next-hop IP but can be used for directly connected networks.

Answer

The 'set ip default next-hop' command is used to forward packets that match the route-map permit statement, regardless of whether a route exists in the routing table.

Answer

The 'set ip next-hop verify-availability' feature uses ICMP echo requests to verify next-hop reachability before applying PBR.

Answer

If a route map with 'set ip next-hop' is applied inbound on an interface, PBR processes only the first packet of a flow; subsequent packets use the routing table.

Question 16

Which TWO statements about IPv6 unicast RPF (uRPF) behavior in Cisco IOS-XE are correct? (Choose TWO.)

Accepted Answer

Strict mode uRPF drops packets if the source address is not reachable via the incoming interface.. IPv6 unicast RPF strict mode verifies that the source address of an incoming packet is reachable via the exact interface on which the packet arrived, according to the FIB. If the source address is not reachable through that interface, the packet is dropped. This prevents spoofed traffic from entering the network from an unexpected path.

Answer

The default uRPF mode on Cisco IOS-XE is strict mode.

Answer

IPv6 uRPF can be applied globally using the 'ipv6 unicast-rpf' command.

Answer

uRPF checks both source and destination addresses in the IPv6 header.

Question 17

Which TWO configuration steps are required to implement static NAT on a Cisco IOS router? (Choose TWO.)

Accepted Answer

Configure ip nat inside source static

in global configuration mode.. The 'ip nat inside source static' command in global configuration mode defines the static one-to-one mapping between an inside local (private) IP address and an inside global (public) IP address. This is the fundamental configuration step for static NAT, as it creates the permanent translation entry in the NAT table without requiring dynamic address pools or access lists.

Answer

Apply the ip nat outside command on the interface facing the internal network.

Answer

Configure an access list to match the inside local addresses for translation.

Answer

Enable the ip nat service command globally to activate NAT.

Question 18

Which TWO statements about the default administrative distances for different route sources are correct? (Choose TWO.)

Accepted Answer

The default administrative distance for a connected interface is 0.. Cisco IOS assigns default AD values to various route sources. Connected interfaces have an AD of 0, static routes have 1, EIGRP summary routes have 5, internal BGP has 200, and external EIGRP has 170. OSPF has 110, and RIP has 120. Knowing these defaults is critical for troubleshooting route selection.

Answer

The default administrative distance for internal BGP (iBGP) is 20.

Answer

The default administrative distance for RIP is 100.

Answer

The default administrative distance for OSPF is 90.

Question 19

Which TWO commands would a network engineer use to verify that syslog messages are being sent to a remote syslog server? (Choose TWO.)

Accepted Answer

show logging. The 'show logging' command displays the current logging configuration, including the syslog server address and whether logging is enabled. The 'debug logging' command is not valid; the correct command to see real-time syslog messages is 'terminal monitor' after enabling logging. 'show run | include logging' shows the running config lines for logging. 'ping' tests reachability but not syslog functionality. 'show ip route' checks routing but not logging.

Answer

debug logging

Answer

ping <syslog-server-ip>

Answer

show ip route

Question 20

Which THREE statements about MPLS label operations (push, swap, pop) are true? (Choose THREE.)

Accepted Answer

The ingress LSR performs a label push operation.. In MPLS, the ingress LSR pushes a label, transit LSRs swap labels, and the penultimate hop router (PHP) pops the label. The egress LSR does not perform label operations if PHP is used. Label operations are based on the label forwarding table, not the routing table directly.

Answer

The egress LSR always performs a label pop operation.

Answer

Label operations are determined by the IP routing table.