300-410 practice questions 121–130

1. Question 121 · 578 in bank

   

   Refer to the exhibit. An engineer must block access to the console ports for all corporate remote Cisco devices based on the recent corporate security policy but the security team still can connect through the console port. Which configuration on the console port resolves the issue?

   • Alogin and password
   • Bexec 0 0
   • Ctransport input telnet
   • Dno exec

   Show answer

   Answer: D

   Explanation

   When you want to allow an outgoing connection only for a line (no incoming) use the no exec command. When a user tries to Telnet to a line with the no exec command configured, the user will get no response when pressing the Return key at the login screen. https://community.cisco.com/t5/routing/no-exec/td-p/3715737

   Source: Adapted from community discussion — bk989

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

2. Question 122 · 578 in bank

   

   Refer to the exhibit. A network administrator is troubleshooting IPv6 address assignment for a DHCP client that is not getting an IPv6 address from the server. Which configuration retrieves the client IPv6 address from the DHCP server?

   • Aipv6 address autoconfig command on the interface
   • Bipv6 dhcp server automatic command on DHCP server
   • Cipv6 dhcp relay-agent command on the interface
   • Dservice dhcp command on DHCP server

   Show answer

   Answer: A

   Explanation

   The closest solution seems to be "ipv6 address autoconfig", however this configuration is not going to achieve ipv6 address assignment by the DHCPv6 server. https://www.routerfreak.com/the-idiosyncrasies-of-ipv6-on-cisco-devices/ https://networklessons.com/ipv6/cisco-dhcpv6-server-configuration

   Source: Adapted from community discussion — HungarianDish_111

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 123 · 578 in bank

   

   Refer to the exhibit. A junior engineer configured SNMP to network devices. Malicious users have uploaded different configurations to the network devices using SNMP and TFTP servers. Which configuration prevents changes from unauthorized NMS and TFTP servers?

   • Aaccess-list 20 permit 10.221.10.11 access-list 20 deny any log ! snmp-server group NETVIEW v3 priv read NETVIEW access 20 snmp-server group NETADMIN v3 priv read NETVIEW write NETADMIN access 20 snmp-server community Cisc0Us3r RO 20 snmp-server community Cisc0wrus3r RW 20 snmp-server tftp-server-list 20
   • Baccess-list 20 permit 10.221.10.11 access-list 20 deny any log ! snmp-server group NETVIEW v3 priv read NETVIEW access 20 snmp-server group NETADMIN v3 priv read NETVIEW write NETADMIN access 20 snmp-server community Cisc0wrus3r RO 20 snmp-server community Cisc0Us3r RW 20 snmp-server tftp-server-list 20
   • Caccess-list 20 permit 10.221.10.11 access-list 20 deny any log
   • Daccess-list 20 permit 10.221.10.11

   Show answer

   Answer: A

   Explanation

   access-list 20 permit 10.221.10.11 --> Permitting only from NMS. access-list 20 deny any log --> Similar to implicit deny by logging is enabled. snmp-server group NETVIEW v3 priv read NETVIEW access 20 --> We filter based on the access-list snmp-server group NETADMIN v3 priv read NETVIEW write NETADMIN access 20 --> We filter based on the access-list snmp-server community Cisc0Us3r RO 20 --> Same level of permission but we filter based on the access-list snmp-server community Cisc0wrus3r RW 20 --> Same level of permission but we filter based on the access-list snmp-server tftp-server-list 20 --> Limit TFTP servers used via SNMP only over access-list 20

   Source: Adapted from community discussion — MasterMatt

   Next question

4. Question 124 · 578 in bank

   An engineer creates a Cisco DNA Center cluster with three nodes, but all the services are running on one host node. Which action resolves this issue?

   • ARestore the link on the switch interface that is connected to a cluster link on the Cisco DNA Center.
   • BClick system updates, and upgrade to the latest version of Cisco DNA Center.
   • CEnable service distribution from the Systems 360 page.
   • DClick the master host node with all the services and select services to be moved to other hosts.

   Show answer

   Answer: C

   Explanation

   C. Click and then choose System Settings. The System 360 tab is displayed by default. 2. In the Hosts area, click Enable Service Distributio

   Source: Adapted from community discussion — Bruffas

   References

   • Cisco documentation

   Next question

5. Question 125 · 578 in bank

   

   Refer to the exhibit. The AP status from Cisco DNA Center Assurance Dashboard shows some physical connectivity issues from access switch interface G1/0/14. Which command generates the diagnostic data to resolve the physical connectivity issues?

   • Acheck cable-diagnostics tdr interface GigabitEthernet1/0/14
   • Bverify cable-diagnostics tdr interface GigabitEthernet1/0/14
   • Cshow cable-diagnostics tdr interface GigabitEthernet1/0/14
   • Dtest cable-diagnostics tdr interface GigabitEthernet1/0/14

   Show answer

   Answer: D

   Explanation

   I feel like this is poorly written. Test cable-diagnostics, generates the information, but show cable-diagnostics actually show the output of the test. Can someone clarify what the answer should be?

   Source: Adapted from community discussion — jthompaf

   Next question

6. Question 126 · 578 in bank

   

   Refer to the exhibit. An engineer configured NetFlow on R1, but the NMS server cannot see the flow from R1. Which configuration resolves the issue?

   • Ainterface Ethernet0/1 flow-destination 10.221.10.11
   • Binterface Ethernet0/0 flow-destination 10.221.10.11
   • Cflow exporter FlowAnalyzer1 destination 10.221.10.11
   • Dflow monitor Flowmonitor1 destination 10.221.10.11

   Show answer

   Answer: C

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 127 · 578 in bank

   

   Refer to the exhibit. An engineer cannot copy the IOS.bin file from the FTP server to the switch. Which action resolves the issue?

   • AAllow file permissions to download the file from the FTP server.
   • BAdd the IOS.bin file, which does not exist on FTP server.
   • CMake memory space on the switch flash or USB drive to download the file.
   • DUse the copy flash:/ ftp://cisco@10.0.0.2/IOS.bin command.

   Show answer

   Answer: B

   Explanation

   This is a long thread, but it points out that missing permission is indicated by the error message: "Permission denied" "No such file or directory" means the file and/or directory is not found in the specified directory of the TFTP server. "Permission denied" means read access to the file and/or directory is not enabled. https://community.cisco.com/t5/switching/error-opening-tftp-permission-denied/td-p/3302909/page/3

   Source: Adapted from community discussion — HungarianDish_111

   References

   • cisco.com documentation
   • cisco.com documentation
   • cisco.com documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 128 · 578 in bank

   

   Refer to the exhibit. After reloading the router, an administrator discovered that the interface utilization graphs displayed inconsistencies with their previous history in the NMS. Which action prevents this issue from occurring after another router reload in the future?

   • AConfigure SNMP interface index persistence on the router.
   • BSave the router configuration to startup-config before reloading the router.
   • CRediscover all the router interfaces through SNMP after the router is reloaded.
   • DConfigure SNMP to use static OIDs referring to individual router interfaces.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

9. Question 129 · 578 in bank

   

   Refer to the exhibit. In an attempt to increase the network security, the administrator applied the Gi3-in ACL to the Gi3 interface. After the ACL was applied, clients in the network connected to Gi3 lost their ability to obtain IP settings from DHCP. Which two configuration commands must be added to the Gi3-in ACL to reinstate the DHCP service for the clients? (Choose two.)

   • A74 permit udp 192.168.30.0 0.0.0.255 eq bootpc host 192.168.255.3 eq bootps
   • B71 permit udp host 0.0.0.0 eq bootps host 255.255.255.255 eq bootpc
   • C73 permit udp host 0.0.0.0 eq bootpc host 192.168.255.3 eq bootps
   • D72 permit udp host 192.168.255.3 eq bootps 192.168.30.0 0.0.0.255 eq bootpc
   • E75 permit udp host 0.0.0.0 eq bootpc host 255.255.255.255 eq bootps

   Show answer

   Answer: A

   Explanation

   For first time DHCP client, the discover and request messages would all be from 0.0.0.0 to 255.255.255.255. So E is needed. https://wiki.wireshark.org/uploads/__moin_import__/attachments/DHCP/dhcp-ws.png For renewing with DHCP request, the source is the current assigned IP and the destination is server itself. So A is needed. Other packets like inform is from the assigned IP to the 255.255.255.255. The existing ACL entry allows for it already. I will go with AE.

   Source: Adapted from community discussion — Huntkey

   References

   • cisco.com documentation

   Next question

10. Question 130 · 578 in bank

    

    Refer to the exhibit. Router R2 should be learning the route for 10.123.187.0/24 via EIGRP. Which action resolves the issue without introducing more issues?

    • ARedistribute the route in EIGRP with metric, delay, and reliability.
    • BUse distribute-list to modify the route as an internal EIGRP route.
    • CUse distribute-list to filter the external routes in OSPF.
    • DRemove route redistribution in R2 for this route in OSPF.

    Show answer

    Answer: D

    Explanation

    My assumption: the route 10.123.187.0/24 could be a static route which is redistributed into eigrp, and so it gets the AD 170 as eigrp external route. The the route goes to R2 where all eigrp routes are redistributed into ospf as E2 external ospf routes. At this point, the route 10.123.187.0/24 has an AD 110 in ospf and an AD 170 in eigrp on R2, thus ospf wins, and R2 learns the route from ospf. We would need to stop the EIGRP route (10.123.187.0/24) from getting redistributed into OSPF using a route-map, which means solution "D".

    Source: Adapted from community discussion — HungarianDish_111

    References

    • cisco.com documentation
    • cisco.com documentation
    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 121. 578 questions available.