Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.
Start Scenario PracticeAn engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)
Explanation: The 'event cli' with 'sync no' is needed to avoid blocking the CLI. The 'action cli command' must use the 'copy running-config tftp:' command. The 'event manager applet' is correct, not 'event manager policy'. The 'event syslog' with pattern 'WRITE' is not precise enough. The 'action cli command' should not use 'enable' as a separate action because the applet runs in the same privilege level as the triggering user.
Which TWO statements about the 'time-range' feature in IPv4 ACLs are correct? (Choose TWO.)
Explanation: The 'time-range' feature in Cisco IOS allows both absolute (specific start/end dates) and periodic (recurring days/times) statements to be combined within a single time-range definition. This enables flexible scheduling, such as allowing traffic only during business hours on weekdays while also specifying an absolute end date for the policy.
Which TWO statements correctly describe the behavior of the 'default-information originate' command in the context of route redistribution? (Choose TWO.)
Explanation: The 'default-information originate' command in OSPF and EIGRP has specific behaviors. In OSPF, it always originates a default route regardless of the routing table, unless the 'always' keyword is omitted and there is no default route in the routing table. In EIGRP, it requires a default route in the routing table to inject the default, unless the 'always' keyword is used. The command does not automatically redistribute all routes; it only injects a default route.
Which TWO statements about IPv6 Neighbor Discovery (ND) Inspection are true? (Choose TWO.)
Explanation: IPv6 ND Inspection validates Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages against the IPv6 snooping binding table. This table is built by gleaning information from DHCPv6 messages or by using the IPv6 Neighbor Discovery protocol itself, ensuring that only legitimate ND messages from trusted sources are forwarded, preventing attacks like Neighbor Cache exhaustion or address spoofing.
Which THREE statements about NAT and PAT behavior in Cisco IOS are true? (Choose THREE.)
Explanation: PAT (Port Address Translation) extends NAT by using unique source port numbers to multiplex multiple inside hosts over a single public IP address. This allows many internal devices to share one external IP, with the router tracking each session by the combination of inside global IP and port.
+15 more scenario questions available
Practice all Select Two (Multi-Select) QuestionsMulti-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination. These appear throughout the 300-410 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 300-410. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 300-410 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Select Two (Multi-Select) Questions session with instant scoring and detailed explanations.
Start Scenario Practice →