How should I use these Device Access Control practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Device Access Control questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Device Access Control domain.

300-410 · topic practice

Device Access Control practice questions

Practise Cisco CCNP ENARSI 300-410 Device Access Control practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Device Access Control

Practice 10 questions Browse domain →

What the exam tests

What to know about Device Access Control

Device Access Control questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Device Access Control exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Device Access Control questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting a site-to-site VPN between two Cisco routers. The tunnel is up, but traffic is not passing. On R1, the engineer issues the command 'show crypto map' and sees that the crypto map is applied to the outbound interface. What is the most likely cause of the traffic failure?

Trap 1: The access-list in the crypto map does not permit the traffic.

Incorrect because the tunnel is up, indicating the IKE and IPsec negotiations succeeded; the issue is the crypto map application direction.

Trap 2: The ISAKMP policy is misconfigured.

Incorrect because the tunnel is up, so ISAKMP negotiation succeeded.

Trap 3: The transform set is incorrect.

Incorrect because the tunnel is up, meaning the transform set was accepted during negotiation.

Study all Device Access Control common traps →

A
The crypto map is applied to the wrong interface.
Correct because crypto maps should be applied to the inbound direction of the interface to match traffic for encryption.
B
The access-list in the crypto map does not permit the traffic.
Why wrong: Incorrect because the tunnel is up, indicating the IKE and IPsec negotiations succeeded; the issue is the crypto map application direction.
C
The ISAKMP policy is misconfigured.
Why wrong: Incorrect because the tunnel is up, so ISAKMP negotiation succeeded.
D
The transform set is incorrect.
Why wrong: Incorrect because the tunnel is up, meaning the transform set was accepted during negotiation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Study the full AAA explanation →

A network administrator is configuring AAA for device access on a Cisco router. After configuring the RADIUS server and AAA authentication login default group radius local, the engineer tests Telnet access and receives 'Access denied' even with correct credentials. The RADIUS server is reachable. What is the most likely cause?

Trap 1: The RADIUS server shared key is incorrect.

Incorrect because the RADIUS server is reachable, and the issue is specific to AAA application on VTY lines.

Trap 2: The enable password is not set.

Incorrect because AAA login authentication does not require an enable password; the issue is with the method list application.

Trap 3: The 'aaa new-model' command is missing.

Incorrect because if 'aaa new-model' were missing, the AAA commands would not be accepted; the configuration exists but is not applied.

Study all Device Access Control common traps →

A
The VTY lines are not configured with 'login authentication default'.
Correct because the AAA login method list must be explicitly applied to the VTY lines using the 'login authentication' command.
B
The RADIUS server shared key is incorrect.
Why wrong: Incorrect because the RADIUS server is reachable, and the issue is specific to AAA application on VTY lines.
C
The enable password is not set.
Why wrong: Incorrect because AAA login authentication does not require an enable password; the issue is with the method list application.
D
The 'aaa new-model' command is missing.
Why wrong: Incorrect because if 'aaa new-model' were missing, the AAA commands would not be accepted; the configuration exists but is not applied.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full routing breakdown →

An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?

Trap 1: The VTY lines are not configured with 'transport input ssh'.

Incorrect because even without 'transport input ssh', SSH would still attempt to connect; the refusal indicates the SSH server is not running.

Trap 2: The RSA key modulus is too small.

Incorrect because a modulus of 2048 is sufficient and supported.

Trap 3: The IP address on GigabitEthernet0/0 is not in the same subnet as…

Incorrect because the scenario does not mention connectivity issues; the refusal is at the application layer.

Study all Device Access Control common traps →

A
The hostname and domain name are not configured.
Correct because SSH uses the hostname and domain name to generate the RSA key pair; without them, the SSH server may not function.
B
The VTY lines are not configured with 'transport input ssh'.
Why wrong: Incorrect because even without 'transport input ssh', SSH would still attempt to connect; the refusal indicates the SSH server is not running.
C
The RSA key modulus is too small.
Why wrong: Incorrect because a modulus of 2048 is sufficient and supported.
D
The IP address on GigabitEthernet0/0 is not in the same subnet as the client.
Why wrong: Incorrect because the scenario does not mention connectivity issues; the refusal is at the application layer.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a Cisco router that is not responding to SNMP polls from a management station. The router has 'snmp-server community public RO' configured. The management station can ping the router. What is the most likely cause?

Trap 1: The SNMP version is not configured.

Incorrect because the 'snmp-server community' command enables SNMPv1/v2c by default.

Trap 2: The router's SNMP agent is disabled.

Incorrect because the 'snmp-server community' command enables the SNMP agent.

Trap 3: The management station is using the wrong SNMP port.

Incorrect because SNMP uses UDP port 161 by default, and the scenario does not indicate a port change.

Study all Device Access Control common traps →

A
The SNMP community string is not associated with an ACL that permits the management station.
Correct because without an ACL, the default behavior is to deny all SNMP access; the community must be bound to an ACL that permits the management station.
B
The SNMP version is not configured.
Why wrong: Incorrect because the 'snmp-server community' command enables SNMPv1/v2c by default.
C
The router's SNMP agent is disabled.
Why wrong: Incorrect because the 'snmp-server community' command enables the SNMP agent.
D
The management station is using the wrong SNMP port.
Why wrong: Incorrect because SNMP uses UDP port 161 by default, and the scenario does not indicate a port change.

Full breakdown with real-world context →

Question 5hardmultiple choice

Study the full AAA explanation →

An engineer configures a Cisco router with 'aaa authentication login default local' and 'aaa authorization exec default local'. The engineer then attempts to log in via the console and is prompted for a username and password. The username 'admin' with password 'cisco' is configured locally. The login fails. What is the most likely cause?

Trap 1: The username 'admin' is not in the local database.

Incorrect because the username is configured; the failure is due to the method list not being applied.

Trap 2: The password 'cisco' is incorrect.

Incorrect because the scenario states the password is configured correctly.

Trap 3: The 'aaa new-model' command is missing.

Incorrect because if 'aaa new-model' were missing, the AAA commands would not be accepted; the configuration exists.

Study all Device Access Control common traps →

A
The console line is not configured with 'login authentication default'.
Correct because the default AAA login method list must be applied to the console line using the 'login authentication' command.
B
The username 'admin' is not in the local database.
Why wrong: Incorrect because the username is configured; the failure is due to the method list not being applied.
C
The password 'cisco' is incorrect.
Why wrong: Incorrect because the scenario states the password is configured correctly.
D
The 'aaa new-model' command is missing.
Why wrong: Incorrect because if 'aaa new-model' were missing, the AAA commands would not be accepted; the configuration exists.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full AAA explanation →

A network engineer is troubleshooting a Cisco router that is configured for RADIUS authentication. The engineer issues 'debug radius authentication' and sees that the RADIUS server is not responding. The router can ping the RADIUS server. What is the most likely cause?

Trap 1: The RADIUS server shared key is incorrect.

Incorrect because if the shared key were incorrect, the server would respond with a reject, not a timeout.

Trap 2: The router's IP address is not in the RADIUS server's client list.

Incorrect because the server would still respond with a reject if the client is not authorized.

Trap 3: The RADIUS server is down.

Incorrect because the router can ping the server, indicating it is reachable.

Study all Device Access Control common traps →

A
UDP port 1812 is blocked between the router and the RADIUS server.
Correct because RADIUS authentication uses UDP port 1812; if blocked, the server will not receive or respond to requests.
B
The RADIUS server shared key is incorrect.
Why wrong: Incorrect because if the shared key were incorrect, the server would respond with a reject, not a timeout.
C
The router's IP address is not in the RADIUS server's client list.
Why wrong: Incorrect because the server would still respond with a reject if the client is not authorized.
D
The RADIUS server is down.
Why wrong: Incorrect because the router can ping the server, indicating it is reachable.

Full breakdown with real-world context →

Question 7hardmultiple choice

Review the full routing breakdown →

An engineer configures a Cisco router with 'ip http server' and 'ip http authentication local' for web-based management. The engineer creates a local username 'admin' with privilege level 15. However, when accessing the router via HTTP, the engineer is prompted for credentials but access is denied. What is the most likely cause?

Trap 1: The username 'admin' does not have a password.

Incorrect because the scenario states the username is created with privilege level 15, implying a password is set.

Trap 2: The HTTP server is using a different port.

Incorrect because the default port 80 is used unless changed; the issue is access control.

Trap 3: The 'ip http secure-server' is required for HTTP access.

Incorrect because 'ip http server' enables standard HTTP; HTTPS requires 'ip http secure-server' but is not mandatory for HTTP.

Study all Device Access Control common traps →

A
The HTTP server is not configured with an access-class that permits the client.
Correct because 'ip http access-class' is required to permit specific IP addresses; without it, HTTP access is denied by default.
B
The username 'admin' does not have a password.
Why wrong: Incorrect because the scenario states the username is created with privilege level 15, implying a password is set.
C
The HTTP server is using a different port.
Why wrong: Incorrect because the default port 80 is used unless changed; the issue is access control.
D
The 'ip http secure-server' is required for HTTP access.
Why wrong: Incorrect because 'ip http server' enables standard HTTP; HTTPS requires 'ip http secure-server' but is not mandatory for HTTP.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full AAA explanation →

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Trap 1: The TACACS+ server shared key is incorrect.

Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.

Trap 2: The username 'admin' does not exist on the TACACS+ server.

Incorrect because the test command would still receive a response from the server indicating authentication failure.

Trap 3: The TACACS+ server is not configured for the router's IP address.

Incorrect because the server would still respond with a reject if the client is not authorized.

Study all Device Access Control common traps →

A
TCP port 49 is blocked between the router and the TACACS+ server.
Correct because TACACS+ uses TCP port 49; if blocked, the router cannot establish a connection to the server.
B
The TACACS+ server shared key is incorrect.
Why wrong: Incorrect because if the shared key were incorrect, the server would respond with a reject, not a failure due to timeout.
C
The username 'admin' does not exist on the TACACS+ server.
Why wrong: Incorrect because the test command would still receive a response from the server indicating authentication failure.
D
The TACACS+ server is not configured for the router's IP address.
Why wrong: Incorrect because the server would still respond with a reject if the client is not authorized.

Full breakdown with real-world context →

Question 9hardmultiple choice

Study the full AAA explanation →

An engineer configures a Cisco router with 'aaa authentication login default group radius local' and 'aaa authentication enable default group radius enable'. The engineer then attempts to enter enable mode and is prompted for a password. The RADIUS server is reachable, but the enable password is not accepted. What is the most likely cause?

Trap 1: The RADIUS server is not configured to provide the enable password.

Incorrect because the RADIUS server can provide enable access via the service type; but the issue is the local fallback.

Trap 2: The 'aaa authentication enable default' command is missing the…

Incorrect because the command uses 'enable' as a fallback, not 'local'.

Trap 3: The router's enable secret is set to a different password.

Incorrect because the enable secret is used for local enable authentication; if set, it would work as a fallback.

Study all Device Access Control common traps →

A
The local enable password is not configured.
Correct because the enable authentication method list includes 'enable' as a fallback; if no local enable password is set, the fallback fails.
B
The RADIUS server is not configured to provide the enable password.
Why wrong: Incorrect because the RADIUS server can provide enable access via the service type; but the issue is the local fallback.
C
The 'aaa authentication enable default' command is missing the 'local' keyword.
Why wrong: Incorrect because the command uses 'enable' as a fallback, not 'local'.
D
The router's enable secret is set to a different password.
Why wrong: Incorrect because the enable secret is used for local enable authentication; if set, it would work as a fallback.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors

EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.1.2 Gi0/0 13 00:12:34 1 200 0 45 1 10.2.2.2 Gi0/1 12 00:11:20 2 200 0 67 2 10.3.3.2 Gi0/2 10 00:10:15 1 200 0 89

Based on this output, which statement is correct?

Trap 1: The neighbor on Gi0/2 is experiencing packet loss because its hold…

A hold timer of 10 seconds is still within the default hold time of 15 seconds and does not indicate packet loss.

Trap 2: The neighbor on Gi0/0 has a high SRTT, indicating congestion.

The SRTT for Gi0/0 is 1 ms, which is very low and indicates no congestion.

Trap 3: The neighbor on Gi0/1 has a sequence number of 67, which is higher…

Sequence numbers are incremental and do not indicate routing loops; they track update order.

Study all Device Access Control common traps →

A
All EIGRP neighbors are fully operational with no issues.
The output shows stable adjacencies with low SRTT, RTO, and Q count of 0, indicating normal operation.
B
The neighbor on Gi0/2 is experiencing packet loss because its hold timer is 10 seconds.
Why wrong: A hold timer of 10 seconds is still within the default hold time of 15 seconds and does not indicate packet loss.
C
The neighbor on Gi0/0 has a high SRTT, indicating congestion.
Why wrong: The SRTT for Gi0/0 is 1 ms, which is very low and indicates no congestion.
D
The neighbor on Gi0/1 has a sequence number of 67, which is higher than others, indicating a routing loop.
Why wrong: Sequence numbers are incremental and do not indicate routing loops; they track update order.

Full breakdown with real-world context →

Question 11mediummultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2     1     FULL/DR        00:00:35    10.1.1.2        GigabitEthernet0/0
192.168.2.2     1     2WAY/DROTHER   00:00:32    10.2.2.2        GigabitEthernet0/1
192.168.3.2     1     FULL/BDR       00:00:38    10.3.3.2        GigabitEthernet0/2

Based on this output, what is a potential issue?

Trap 1: The neighbor on Gi0/0 is the DR, which is causing high CPU usage.

Being the DR is normal and does not necessarily indicate high CPU usage.

Trap 2: The neighbor on Gi0/2 is the BDR, which is a problem because it…

BDR is a normal role in OSPF multi-access networks.

Trap 3: All neighbors are in FULL state, indicating no issues.

The neighbor on Gi0/1 is in 2WAY, not FULL, so there is an issue.

Study all Device Access Control common traps →

A
The neighbor on Gi0/1 is not forming a full adjacency because it is in 2WAY state.
In OSPF, the 2WAY state indicates that the router has received a Hello from the neighbor but has not yet exchanged database descriptors; a FULL state is required for complete adjacency.
B
The neighbor on Gi0/0 is the DR, which is causing high CPU usage.
Why wrong: Being the DR is normal and does not necessarily indicate high CPU usage.
C
The neighbor on Gi0/2 is the BDR, which is a problem because it should be the DR.
Why wrong: BDR is a normal role in OSPF multi-access networks.
D
All neighbors are in FULL state, indicating no issues.
Why wrong: The neighbor on Gi0/1 is in 2WAY, not FULL, so there is an issue.

Full breakdown with real-world context →

Question 12mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast summary

BGP router identifier 192.168.1.1, local AS number 65001 BGP table version is 10, main routing table version 10

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          65002    1200    1200       10    0    0 01:00:00        5
10.2.2.2        4          65003    0       0          0    0    0 never    Active

Based on this output, what is the problem with the neighbor 10.2.2.2?

Trap 1: The neighbor is in Idle state because of a hold timer expiry.

The state is Active, not Idle; Idle would indicate a different issue.

Trap 2: The neighbor has received 5 prefixes, indicating a successful…

The neighbor has 0 prefixes received (PfxRcd is not shown but implied by 0 MsgRcvd).

Trap 3: The BGP table version is 10, meaning there is a routing loop.

The table version is a sequence number and does not indicate loops.

Study all Device Access Control common traps →

A
The neighbor is not reachable or is not configured to accept BGP connections.
The Active state indicates that the router is attempting to establish a TCP connection but is not receiving a response, likely due to unreachability or misconfiguration.
B
The neighbor is in Idle state because of a hold timer expiry.
Why wrong: The state is Active, not Idle; Idle would indicate a different issue.
C
The neighbor has received 5 prefixes, indicating a successful session.
Why wrong: The neighbor has 0 prefixes received (PfxRcd is not shown but implied by 0 MsgRcvd).
D
The BGP table version is 10, meaning there is a routing loop.
Why wrong: The table version is a sequence number and does not indicate loops.

Full breakdown with real-world context →

Question 13mediummultiple choice

Review the full routing breakdown →

A network engineer runs the following command on Router R1:

R1# show route-map TEST

route-map TEST, permit, sequence 10 Match clauses:

ip address (access-lists): 100

Set clauses: metric 50 Policy routing matches: 0 packets, 0 bytes route-map TEST, deny, sequence 20 Match clauses:

ip address (access-lists): 101

Set clauses: Policy routing matches: 0 packets, 0 bytes

Based on this output, which statement is correct?

Trap 1: The route-map is misconfigured because sequence 20 does not have a…

A deny sequence does not require a set clause; it simply denies matching traffic.

Trap 2: The route-map will set the metric to 50 for all packets.

Only packets matching ACL 100 will have the metric set; others will be denied or not matched.

Trap 3: The route-map is applied globally and is affecting all routing…

Route-maps must be explicitly applied to an interface or routing process to take effect.

Study all Device Access Control common traps →

A
The route-map is applied to an interface but no traffic has matched it yet.
The 'Policy routing matches: 0 packets' indicates that the route-map is configured but has not yet been used to route any packets.
B
The route-map is misconfigured because sequence 20 does not have a set clause.
Why wrong: A deny sequence does not require a set clause; it simply denies matching traffic.
C
The route-map will set the metric to 50 for all packets.
Why wrong: Only packets matching ACL 100 will have the metric set; others will be denied or not matched.
D
The route-map is applied globally and is affecting all routing decisions.
Why wrong: Route-maps must be explicitly applied to an interface or routing process to take effect.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full MPLS explanation →

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 192.168.2.2:0, Local LDP Ident: 192.168.1.1:0 TCP connection: 10.1.1.2.646 - 10.1.1.1.646 State: Oper; Msgs sent/rcvd: 100/100; Downstream Up time: 00:45:00 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.1.1.2 Addresses bound to peer LDP Ident:

10.1.1.2     192.168.2.2

Based on this output, what is the state of the LDP session?

Trap 1: The LDP session is in a down state due to a TCP reset.

The state is 'Oper', not down.

Trap 2: The LDP session is in initialization state because no labels have…

The session is operational, so labels have been exchanged.

Trap 3: The LDP session is using UDP instead of TCP.

LDP uses TCP for session establishment, as shown by the TCP connection.

Study all Device Access Control common traps →

A
The LDP session is operational and exchanging label information.
The 'State: Oper' indicates the session is operational, and the message counts confirm label exchange.
B
The LDP session is in a down state due to a TCP reset.
Why wrong: The state is 'Oper', not down.
C
The LDP session is in initialization state because no labels have been exchanged.
Why wrong: The session is operational, so labels have been exchanged.
D
The LDP session is using UDP instead of TCP.
Why wrong: LDP uses TCP for session establishment, as shown by the TCP connection.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command on Router R1:

R1# show dmvpn
Interface: Tunnel0, IPv4 NHRP Details

Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb

----- ----------------- --------------- ----- -------- ----- 1 10.0.0.2 10.1.1.2 UP 00:10:00 D 2 10.0.0.3 10.1.1.3 UP 00:05:00 D

Based on this output, what is the role of Router R1 in the DMVPN network?

Trap 1: Router R1 is a spoke router with two hub connections.

The type is Hub, not Spoke.

Trap 2: Router R1 is a spoke router with two other spoke connections.

The type is Hub, and spokes connect to hubs.

Trap 3: Router R1 is not participating in DMVPN because the tunnel is down.

The tunnel is up, as indicated by the UP state of peers.

Study all Device Access Control common traps →

A
Router R1 is the hub router with two active spoke connections.
The 'Type:Hub' and two UP peers indicate it is a hub.
B
Router R1 is a spoke router with two hub connections.
Why wrong: The type is Hub, not Spoke.
C
Router R1 is a spoke router with two other spoke connections.
Why wrong: The type is Hub, and spokes connect to hubs.
D
Router R1 is not participating in DMVPN because the tunnel is down.
Why wrong: The tunnel is up, as indicated by the UP state of peers.

Full breakdown with real-world context →

Question 16mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP class-map: MANAGEMENT (match-all) 100 packets, 10000 bytes 5 minute offered rate 0 bps police: cir 8000 bps, bc 1500 bytes conformed 100 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps

Based on this output, which statement is correct?

Trap 1: Management traffic is being dropped because the police rate is too…

No packets were exceeded, so no drops occurred.

Trap 2: The CoPP policy is not applied because the control plane is not…

The output shows it is applied to the control plane.

Trap 3: The class-map MANAGEMENT is not matching any traffic.

It matched 100 packets.

Study all Device Access Control common traps →

A
All management traffic has been transmitted without any drops.
The 'conformed' count shows 100 packets transmitted, and 'exceeded' is 0, meaning no drops.
B
Management traffic is being dropped because the police rate is too low.
Why wrong: No packets were exceeded, so no drops occurred.
C
The CoPP policy is not applied because the control plane is not specified.
Why wrong: The output shows it is applied to the control plane.
D
The class-map MANAGEMENT is not matching any traffic.
Why wrong: It matched 100 packets.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full VRF explanation →

A network engineer runs the following command on Router R1:

R1# show ip vrf CUSTOMER

Name Default RD Interfaces CUSTOMER 65001:100 Gi0/0.100 Gi0/1.100

Based on this output, which statement is correct?

Trap 1: The VRF CUSTOMER has no route distinguisher configured.

The RD is shown as 65001:100.

Trap 2: The VRF CUSTOMER is not active because no routes are shown.

The VRF is active, as indicated by the interfaces.

Trap 3: The VRF CUSTOMER is using OSPF as the routing protocol.

The output does not show routing protocol information.

Study all Device Access Control common traps →

A
The VRF CUSTOMER is configured with two subinterfaces.
The output lists two interfaces under the VRF.
B
The VRF CUSTOMER has no route distinguisher configured.
Why wrong: The RD is shown as 65001:100.
C
The VRF CUSTOMER is not active because no routes are shown.
Why wrong: The VRF is active, as indicated by the interfaces.
D
The VRF CUSTOMER is using OSPF as the routing protocol.
Why wrong: The output does not show routing protocol information.

Full breakdown with real-world context →

Question 18mediummultiple choice

Review the full routing breakdown →

A network engineer runs the following command on Router R1:

R1# show ip sla statistics

IPSLAs Latest Operation Statistics

IPSLA operation id: 1 Type of operation: icmp-echo Latest RTT: 20 milliseconds Latest operation start time: 12:00:00 UTC Mon Mar 1 2021 Latest operation return code: OK Number of successes: 100 Number of failures: 0

Based on this output, which statement is correct?

Trap 1: The IP SLA probe has failed 100 times.

The number of failures is 0.

Trap 2: The IP SLA probe is using UDP jitter.

The type is icmp-echo, not UDP jitter.

Trap 3: The IP SLA probe is not configured because the operation ID is 1.

The operation ID 1 is valid and shows statistics.

Study all Device Access Control common traps →

A
The IP SLA probe is successfully reaching the target with no failures.
The return code is OK, and there are 100 successes with 0 failures.
B
The IP SLA probe has failed 100 times.
Why wrong: The number of failures is 0.
C
The IP SLA probe is using UDP jitter.
Why wrong: The type is icmp-echo, not UDP jitter.
D
The IP SLA probe is not configured because the operation ID is 1.
Why wrong: The operation ID 1 is valid and shows statistics.

Full breakdown with real-world context →

Question 19mediummultiple choice

Review the full routing breakdown →

Examine the following partial configuration on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group MY_ACL in

access-list 100 permit tcp any host 192.168.1.1 eq 22
access-list 
100 deny ip any any

line vty 0 4

transport input ssh login local !

username admin privilege 15 secret cisco

What is the effect of this configuration?

Trap 1: The ACL permits SSH and HTTP traffic to the router; all other…

The ACL only permits TCP port 22 (SSH), not HTTP (port 80).

Trap 2: The ACL is applied outbound, so it filters traffic leaving the…

The 'ip access-group MY_ACL in' applies the ACL inbound, not outbound.

Trap 3: The ACL has no effect because it is missing a 'permit ip any any'…

The ACL explicitly denies all other traffic with 'deny ip any any', which is effective. No further permit is needed for the intended restriction.

Study all Device Access Control common traps →

A
Only SSH connections to the router are permitted; all other IP traffic is denied inbound on this interface.
The ACL permits TCP port 22 (SSH) and denies all other IP traffic, applied inbound. This restricts management access to SSH only.
B
The ACL permits SSH and HTTP traffic to the router; all other traffic is denied.
Why wrong: The ACL only permits TCP port 22 (SSH), not HTTP (port 80).
C
The ACL is applied outbound, so it filters traffic leaving the interface; SSH is permitted outbound.
Why wrong: The 'ip access-group MY_ACL in' applies the ACL inbound, not outbound.
D
The ACL has no effect because it is missing a 'permit ip any any' statement.
Why wrong: The ACL explicitly denies all other traffic with 'deny ip any any', which is effective. No further permit is needed for the intended restriction.

Full breakdown with real-world context →

Question 20mediummultiple choice

Review the full routing breakdown →

Consider the following partial configuration on a Cisco router:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any

interface Serial0/0/0
 ip access-group BLOCK_TELNET out

line vty 0 4

transport input telnet password cisco login

What is the effect of this configuration?

Trap 1: All Telnet traffic to and from the router is blocked.

The ACL is outbound only, so inbound Telnet to the router is not filtered.

Trap 2: The ACL has no effect because it is applied outbound and Telnet is…

Outbound ACLs can filter TCP traffic; the direction matters, not the protocol type.

Trap 3: The configuration is invalid because the ACL name contains an…

Underscores are allowed in ACL names.

Study all Device Access Control common traps →

A
Telnet traffic from the router to remote devices via Serial0/0/0 is blocked; Telnet to the router itself is still allowed.
The outbound ACL blocks Telnet leaving the interface, but does not filter traffic destined to the router. VTY lines still accept Telnet.
B
All Telnet traffic to and from the router is blocked.
Why wrong: The ACL is outbound only, so inbound Telnet to the router is not filtered.
C
The ACL has no effect because it is applied outbound and Telnet is a TCP protocol.
Why wrong: Outbound ACLs can filter TCP traffic; the direction matters, not the protocol type.
D
The configuration is invalid because the ACL name contains an underscore.
Why wrong: Underscores are allowed in ACL names.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Device Access Control sessions

Start a Device Access Control only practice session

Every question in these sessions is drawn from the Device Access Control domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Device Access Control questions →Mixed 300-410 session

Frequently asked questions

What does the 300-410 exam test about Device Access Control?: Device Access Control questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Device Access Control questions in a focused session?: Yes — the session launcher on this page draws every question from the Device Access Control domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 300-410 topics?: Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.

Device Access Control only

10 questions 20 questions 30 questions 50 questions

Mixed 300-410 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 300-410 questions Device Access Control domain overview 300-410 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Device Access Control practice questions

What to know about Device Access Control

Common Device Access Control exam traps

Device Access Control questions

An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?

A network engineer is troubleshooting a Cisco router that is not responding to SNMP polls from a management station. The router has 'snmp-server community public RO' configured. The management station can ping the router. What is the most likely cause?

A network engineer is troubleshooting a Cisco router that is configured for RADIUS authentication. The engineer issues 'debug radius authentication' and sees that the RADIUS server is not responding. The router can ping the RADIUS server. What is the most likely cause?

A network engineer is troubleshooting a Cisco router that is configured for TACACS+ authentication. The engineer issues 'test aaa group tacacs+ admin cisco123 new-code' and receives 'FAILED'. The router can ping the TACACS+ server. What is the most likely cause?

Track your progress over time

Start a Device Access Control only practice session

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid