300-410 practice questions 231–240

1. Question 231 · 578 in bank

   Select 2

   Unicast Reverse Path Forwarding (uRPF) has been configured on a service provider network to protect itself from spoofed based attacks. Which of the following are valid uRPF modes? (Choose two.)

   • AStrict mode
   • BOpen mode
   • CClosed mode
   • DBlock mode
   • ELoose mode

   Show answer

   Answer: AE

   Explanation

   The answer is true. unicast Revers Path Forwarding is a security feature against Source IP spoofing. Good explanation can be found here: https://networklessons.com/cisco/ccie-routing-switching/unicast-reverse-path-forwarding-urpf

   Source: Adapted from community discussion — sajjad_gayyem

   Next question

2. Question 232 · 578 in bank

   Select 2

   Which of the following are commonly used ports when implementing RADIUS based authentication and accounting? (Choose two.)

   • AUDP port 1644 for authentication
   • BUDP port 1812 for authentication
   • CTCP port 1812 for authentication
   • DUDP port 1813 for accounting
   • ETCP port 1813 for accounting
   • FUDP port 1644 for accounting

   Show answer

   Answer: BD

   References

   • cisco.com documentation

   Next question

3. Question 233 · 578 in bank

   Select 2

   Which of the following are valid restrictions when configuring Control Plane Policing (CoPP) on Cisco devices? (Choose two.)

   • AYou cannot use the “log” keyword with CoPP on the access list entries
   • BCEF must be disabled
   • CThe only match types supported with CoPP is ip precedence, ip dscp, and access-group
   • DOnly standard access-lists are supported.

   Show answer

   Answer: AC

   Explanation

   Answer is correct https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/copp.html •To avoid matching the filtering and policing that are configured in a subsequent class, configure policing in each class. CoPP does not apply the filtering in a class that does not contain a police command. A class without a police command matches no traffic. •The ACLs used for classification are QoS ACLs. QoS ACLs supported are IP standard, extended, and named (IPv6 ACLs are not supported in hardware). •These are the only match types supported: –ip precedence –ip dscp –access-group •CoPP does not support ACEs with the log keyword.

   Source: Adapted from community discussion — GReddy2323

   References

   • Cisco documentation

   Next question

4. Question 234 · 578 in bank

   Select 2

   Which of the following are used to validate the source of IPv6 traffic and are considered IPv6 layer 2 snooping features? (Choose two.)

   • ADHCPv6 Guard
   • BDHCPv6 Root Guard
   • CIPv6 Source Guard
   • DIPv6 Prefix Guard

   Show answer

   Answer: CD

   Explanation

   "IPv6 Source Guard and IPv6 Prefix Guard are Layer 2 snooping features that validate the source of IPv6 traffic." https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/15-e/ip6f-15-e-book/ip6f-15-e-book_chapter_0110.pdf

   Source: Adapted from community discussion — Horsefeathers

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

5. Question 235 · 578 in bank

   You want to implement AAA on router R1 for a more robust authentication and authorization system. What is typically the first global command used to do this?

   • Aaaa new-model
   • Baaa enable
   • Caaa server-group
   • Daaa authentication login

   Show answer

   Answer: A

   Next question

6. Question 236 · 578 in bank

   Select 2

   A time based access list has been configured on R1 to allow SSH access to the device only on weekdays. Which of the following are valid options when using the time range command? (Choose two.)

   • Arelative
   • Brecurring
   • Cabsolute
   • Dperiodic

   Show answer

   Answer: CD

   Explanation

   C and D correct router(config)#time-range teste router(config-time-range)#? Time range configuration commands: absolute absolute time and date default Set a command to its defaults exit Exit from time-range configuration mode no Negate a command or set its defaults periodic periodic time and date

   Source: Adapted from community discussion — Malasxd

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 237 · 578 in bank

   Select 3

   First-Hop Security (FHS) is a set of features to optimize IPv6 link operation, and help with scale in large L2 domains. Which of the following are valid First-Hop Security features supported by Cisco? (Choose three.)

   • AIPv6 RA Guard
   • BIPv6 Source Guard
   • CDHCPv6 Guard
   • DIPv6 Snooping
   • EDHCPv6 Snooping

   Show answer

   Answer: ACD

   Explanation

   "IPv6 FHS features enable a better IPv6 link security and management over the layer 2 links. These are the features supported: • IPv6 Snooping • IPv6 Router Advertisement Guard • IPv6 - Destination Guard • Binding Table Recovery • DHCPv6 Guard • IPv6 Source Guard • IPv6 Prefix Guard • Data Gleaning" However: "The configuration of IPv6 Snooping is a prerequisite for IPv6 Source Guard." - therefore skip B https://www.cisco.com/c/en/us/td/docs/routers/7600/ios/15S/configuration/guide/7600_15_0s_book/IPv6_Security.pdf

   Source: Adapted from community discussion — Horsefeathers

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 238 · 578 in bank

   What are the four stages of obtaining an IP address from a DHCP server that corresponds to the acronym DORA?

   • ADiscover, Offer, Release, Addressing
   • BDiscover, Obtain, Request, Acknowledge
   • CDetermine, Offer, Release, Acknowledge
   • DDiscover, Offer, Request, Acknowledge

   Show answer

   Answer: D

   Next question

9. Question 239 · 578 in bank

   SNMPv2 has been used throughout a network to manage all of the network devices. You have been asked to migrate to an SNMPv3 solution instead. What is the biggest advantage to migrating from SNMPv2 to SNMPv3?

   • AEnhanced security, including encryption of passwords
   • BEnhanced performance, supporting more messages per minute.
   • CEnhanced scaling, supporting thousands more devices per network segment than SNMPv2.
   • DUsing a push model instead of pull. SNMPv3 uses telemetry to push data to SNMP management stations in real time.

   Show answer

   Answer: A

   Next question

10. Question 240 · 578 in bank

    You are configuring Netflow on various network elements in order to gain visibility into the traffic types used. How many export destinations can this Network data be sent to?

    • AUp to 2
    • BUp to 4
    • CUp to 8
    • DThere is no limitation on the number of flow data export destinations.

    Show answer

    Answer: A

    Explanation

    • Using flow exporters, you can create an exporter for every type of traffic that you want to analyze so that you can send each type of traffic to a different NetFlow collector. Original NetFlow sends the data in a cache for all of the analyzed traffic to a maximum of two export destinations. • Flow exporters support up to ten exporters per flow monitor. Original NetFlow is limited to only two export destinations per cache https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-16-10/fnf-xe-16-10-book/fnf-v9-export.pdf

    Source: Adapted from community discussion — bk989

    References

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 231. 578 questions available.