300-410 Timed Practice Test 1 — 10 Questions

Question 1

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Accepted Answer

Initiate IKE_SA_INIT exchange. IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.

Question 2

Drag and drop the steps to troubleshoot an IPsec site-to-site VPN adjacency failure into the correct order, from first to last.

Accepted Answer

Ping peer IP to confirm reachability. Start by verifying basic IP connectivity between peers, then check that the crypto isakmp policy and IKE proposals match. Next, confirm tunnel interface configuration and ACLs, then inspect IKE and IPsec SA states. Finally, enable debugs to isolate the specific failure.

Question 3

Drag and drop the steps to verify and validate the operational state of an IPsec site-to-site VPN into the correct order, from first to last.

Accepted Answer

Check IKEv2 SA using show crypto ikev2 sa. Begin by checking the IKE Phase 1 SA to ensure the control plane is established, then verify the IPsec Phase 2 SA for data-plane encryption. Confirm the tunnel interface is up/up, examine the crypto map to ensure it is active, and finally test traffic flow with a ping or extended ping.

Question 4

Drag and drop the steps to configure a GRE tunnel for IPv6 over IPv4 into the correct order, from first to last.

Accepted Answer

Create tunnel interface with 'interface tunnel0'. The correct order follows the standard Cisco IOS-XE GRE tunnel configuration workflow: first create the tunnel interface, then assign an IPv6 address, set the tunnel source (physical interface or IP), set the tunnel destination (IPv4 address of the remote endpoint), and finally configure the tunnel mode as GRE IPv6.

Question 5

Drag and drop the steps to troubleshoot IPv6 over IPv4 tunnel adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Check tunnel interface status with 'show ipv6 interface brief'. The troubleshooting process follows a logical progression: first verify the tunnel interface is up/up, then check the IPv6 routing table for the destination prefix, inspect the tunnel source and destination IPs for correctness, verify IPv4 reachability to the tunnel destination, and finally examine ACLs or firewall rules that might block GRE protocol 47 traffic.

Question 6

Drag and drop the steps to verify and validate the operational state of an IPv6 tunneling technique into the correct order, from first to last.

Accepted Answer

Check tunnel interface status with 'show interfaces tunnel0'. Validation follows a systematic approach: start with checking the tunnel interface status and counters, then verify IPv6 connectivity across the tunnel using ping, examine routing protocol adjacency over the tunnel, validate end-to-end IPv6 reachability to remote networks, and finally confirm traffic flow with traceroute or debug commands.

Question 7

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Accepted Answer

Configure hostname and domain name. First, a hostname and domain name must be set to generate the RSA key pair. Then the RSA key pair is generated with the crypto key generate rsa command. Next, local AAA authentication is enabled with aaa new-model and aaa authentication login default local. The VTY lines are then configured to use SSH transport and the local login authentication. Finally, the SSH version is set to 2 for enhanced security.

Question 8

Drag and drop the steps to troubleshoot Device Access Control adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify physical connectivity with ping. Start by verifying physical connectivity with ping to isolate Layer 1/2 issues. Then check the access control configuration on the interface to ensure it is not blocking traffic. Next, examine the adjacency table to confirm neighbor relationships. After that, review logs for authentication or authorization errors. Finally, use debug commands to capture real-time access control events.

Question 9

Drag and drop the steps to verify and validate Device Access Control operational state into the correct order, from first to last.

Accepted Answer

Check AAA server reachability. First, check the AAA server reachability to ensure the backend is accessible. Then verify the active authentication method list applied globally. Next, confirm the authorization method list for exec or commands. After that, validate the accounting configuration to track access. Finally, test the actual access control by attempting a remote login.

Question 10

Drag and drop the steps to troubleshoot IPv4 ACL adjacency or connectivity failures into the correct order, from first to last.

Accepted Answer

Verify ACL application on interface and direction. Start by confirming the ACL is applied to the correct interface and direction; then check for implicit deny blocking traffic; verify sequence numbers and order; examine log entries for hits; finally, adjust ACL by inserting a permit statement before the deny.