300-410 practice questions 281–290

1. Question 281 · 578 in bank

   

   Refer to the exhibit. An engineer must filter EIGRP updates that are received to block all 10.10.10.0/24 prefixes. The engineer tests the distribute list and finds one associated prefix. Which action resolves the issue?

   • AThere is a permit in the ACL that allows this prefix into EIGRP. The ACL should be modified to deny 10.10.10.0 255.255.255.0.
   • BThere is a permit in the ACL that allows this prefix into EIGRP. The ACL should be modified to deny 10.10.10.0 0.0.0.255.
   • CThere is a permit in the route map that allows this prefix. A deny 20 statement is required with a match condition to match a new ACL that denies all prefixes.
   • DThere is a permit in the route map that allows this prefix. A deny 20 statement is required with no match condition to block the prefix.

   Show answer

   Answer: B

   Explanation

   If they aim to filter 10.10.10.0/24, then I would expect to see something like this: ip access-list standard EIGRP-FILTER permit 10.10.10.0 0.0.0.255 route-map EIGRP deny 10 match ip address EIGRP-FILTER route-map EIGRP permit 20

   Source: Adapted from community discussion — HungarianDish_111

   Next question

2. Question 282 · 578 in bank

   A network engineer must configure a DMVPN network so that a spoke establishes a direct path to another spoke if the two must send traffic to each other. A spoke must send traffic directly to the hub if required. Which configuration meets this requirement?

   • AAt the hub router: interface tunnel10 ip nhrp nhs dynamic multipoint ip nhrp nhs shortcut tunnel mode gre multicast On the spokes router: interface tunnel10 ip nhrp nhs multicast dynamic ip nhrp nhs redirect tunnel mode gre multicast
   • BAt the hub router: interface tunnel10 ip nhrp map dynamic multipoint ip nhrp redirect tunnel mode gre multicast On the spokes router: interface tunnel10 ip nhrp map multicast dynamic ip nhrp shortcut tunnel mode gre multicast
   • CAt the hub router: interface tunnel10 ip nhrp nhs multicast dynamic ip nhrp nhs shortcut tunnel mode gre multipoint On the spokes router: interface tunnel10 ip nhrp nhs multicast dynamic ip nhrp nhs redirect tunnel mode gre multipoint
   • DAt the hub router: interface tunnel10 ip nhrp map multicast dynamic ip nhrp redirect tunnel mode gre multipoint On the spokes router: interface tunnel10 ip nhrp map multicast dynamic ip nhrp shortcut tunnel mode gre multipoint

   Show answer

   Answer: D

   Explanation

   Main 2 points to look at in the differences. -Spoke-to-spoke communication = ip nhrp redirect (hub) ip nhrp shortcut (spokes) -tunnel mode gre multipoint

   Source: Adapted from community discussion — darkspawn117

   Next question

3. Question 283 · 578 in bank

   The network administrator configured R1 to authenticate Telnet connections based on Cisco ISE using TACACS+. ISE has been configured with an IP address of 192.168.1.5 and with a network device pointing toward R1 (192.168.1.1) with a shared secret password of Cisco123. The administrator has configured this on R1: aaa new-model ! tacacs server ISE1 address ipv4 192.168.1.5 key Cisco123 ! aaa group server tacacs+ TAC-SERV server name ISE1 ! aaa authentication login telnet group TAC-SERV The network administrator cannot authenticate to R1 based on ISE. Which configuration fixes the issue?

   • Aline vty 0 4 login authentication TAC-SERV
   • Btacacs-server host 192.168.1.5 key Cisco123
   • Cip tacacs-server host 192.168.1.5 key Cisco123
   • Dline vty 0 4 login authentication telnet

   Show answer

   Answer: D

   Explanation

   aaa new-model ! tacacs server ISE1 address ipv4 192.168.1.5 key Cisco123 ! aaa group server tacacs+ TAC-SERV server name ISE1 ! aaa authentication login telnet group TAC-SERV ! R5(config)#line vty 0 4 R5(config-line)#login authentication TAC-SERV AAA: Warning authentication list "TAC-SERV" is not defined for LOGIN. R5(config-line)#login authentication telnet R5(config-line)#end R5#

   Source: Adapted from community discussion — Zizu007

   Next question

4. Question 284 · 578 in bank

   The network administrator must configure R1 to authenticate Telnet connections based on Cisco ISE using RADIUS. ISE has been configured with an IP address of 192.168.1.5 and with a network device pointing toward R1 (192.168.1.1) with a shared secret password of Cisco123. The administrator has configured this on R1: aaa new-model ! radius server ISE1 address ipv4 192.168.1.5 key Cisco123 ! aaa group server tacacs+ RAD-SERV server name ISE1 ! aaa authentication login default group RAD-SERV The network administrator cannot authenticate to access R1 based on ISE. Which set of configurations fixes the issue?

   • Aline vty 0 4 login authentication RAD-SERV
   • Baaa group server tacacs+ ISE1 server name RAD-SERV
   • Caaa group server radius RAD-SERV server name ISE1
   • Dline vty 0 4 login authentication default

   Show answer

   Answer: C

   Explanation

   Correct answer is C: Router is using default method: #aaa authentication login default group RAD-SERV that calls a group RAD-SERV (which is a tacas+ in this scenario), but the question asks about a radius server config, not tacacs+. So we need to configure a radius group named RAD-SERV.

   Source: Adapted from community discussion — ellen_AA

   Next question

5. Question 285 · 578 in bank

   

   Refer to the exhibit. The network administrator configured redistribution on an ASBR to reach to all WAN networks but failed. Which action resolves the issue?

   • AThe route map EIGRP->OSPF must have the 10.0.106.0/24 entry to exist in one of the three prefix lists to pass
   • BEIGRP must redistribute the 10.0.106.0/24 route instead of using the network statement
   • CThe OSPF process must have a metric when redistributing prefixes from EIGRP
   • DThe route map must have the keyword prefix-list to evaluate the prefix list entries

   Show answer

   Answer: D

   Explanation

   D is ok. It's written for ex : match ip adress WAN_PREFIXES and should be : match ip adress prefix-list WAN_PREFIXES Same for LOCAL_PREFIXES & VPN_PREFIXES

   Source: Adapted from community discussion — Stivostine

   Next question

6. Question 286 · 578 in bank

   Which IPv6 first-hop security feature helps to minimize denial of service attacks?

   • AIPv6 Router Advertisement Guard
   • BIPv6 Destination Guard
   • CDHCPv6 Guard
   • DIPv6 MAC address filtering

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

7. Question 287 · 578 in bank

   

   Refer to the exhibit. A network engineer is troubleshooting a failed link between R2 and R3. No traffic loss is reported from router R5 to HQ. Which command fixes the separated backbone?

   • AR3(config-router)#area 21 virtual-link 192.168.125.5
   • BR2(config-router)#area 21 virtual-link 192.168.125.5
   • CR3(config-router)#no area 21 stub
   • DR2(config-router)#no area 21 stub

   Show answer

   Answer: C

   Explanation

   https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/47866-ospfdb7.html The area through which you configure the virtual link, known as a transit area , must have full routing information. The transit area cannot be a stub area.

   Source: Adapted from community discussion — HungarianDish_111

   References

   • Cisco documentation

   Next question

8. Question 288 · 578 in bank

   A CoPP policy is applied for receiving SSH traffic from the WAN interface on a Cisco ISR4321 router. However, the SSH response from the router is abnormal and stuck during the high link utilization. The problem is identified as SSH traffic does not match in the ACL. Which action resolves the issue?

   • AApply CoPP on the control plane interface.
   • BApply CoPP on the WAN interface inbound direction.
   • CRate-limit SSH traffic to ensure dedicated bandwidth.
   • DIncrease the IP precedence value of SSH traffic to 6.

   Show answer

   Answer: A

   Explanation

   I read the quesiton as the CoPP Policy has been applied to the WAN interface, if that's the case then it's A... Stupid quesiton

   Source: Adapted from community discussion — Commando1664

   References

   • cisco.com documentation

   Next question

9. Question 289 · 578 in bank

   

   Refer to the exhibit. The network administrator must configure Cape Town to reach Dubai via Tokyo based on the speeds provided by the service provider. It was noticed that Cape Town is reaching Dubai directly and failed to meet the requirement. Which configuration fixes the issue?

   • ACapeTown - router eigrp 100 variance 2
   • BCapeTown - interface E 0/0 bandwidth 5000 interface E 0/1 bandwidth 10000
   • CCapeTown - interface E 0/0 bandwidth 5000 interface E 0/1 bandwidth 10000 Dubai - interface E 0/0 bandwidth 50000 interface E 0/1 bandwidth 5000 Tokyo - interface E 0/0 bandwidth 50000 interface E 0/1 bandwidth 10000
   • DDubai - router eigrp 100 variance 2

   Show answer

   Answer: C

   Explanation

   I mean we can still do balancing by setting bandwidths, but only if feasability condition is met. Notice the words: " based on the speeds provided by the service provider". We need to modify the bandwidth to meet the speeds provided by the ISP

   Source: Adapted from community discussion — bk989

   References

   • cisco.com documentation

   Next question

10. Question 290 · 578 in bank

    DRAG DROP - Drag and drop the ICMPv6 neighbor discovery messages from the left onto the correct packet types on the right.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    correct! Type 133 - Router Solicitation Type 134 - Router Advertisement Type 135 - Neighbor Solicitation Type 136 - Neighbor Advertisement Type 137 - Redirect Message

    Source: Adapted from community discussion — Zizu007

    References

    • Cisco documentation

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 281. 578 questions available.