300-410 practice questions 331–340

1. Question 331 · 578 in bank

   

   Refer to the exhibit. An IP SLA is configured to use the backup default route when the primary is down, but it is not working as desired. Which command fixes the issue?

   • AR1(config)# ip route 0.0.0.0 0.0.0.0 2.2.2.2 10 track 1
   • BR1(config}# ip route 0.0.0.0 0.0.0.0 2.2.2.2
   • CR1(config)# ip sla track 1
   • DR1(config)# ip route 0.0.0.0 0.0.0.0 1.1.1.1 track 1

   Show answer

   Answer: D

   Next question

2. Question 332 · 578 in bank

   

   Refer to the exhibit. The route to 192.168.200.0 is flapping between R1 and R2. Which set of configuration changes resolves the flapping route?

   • AR2(config)#router ospf 100 - R2(config-router)#no redistribute eigrp 100 R2(config-router)#redistribute eigrp 100 metric 1 subnets
   • BR1(config)#no router rip - R1(config)#ip route 192.168.200.0 255.255.255.0 10.40.0.2
   • CR2(config)#router eigrp 100 - R2(config-router)#no redistribute ospf 100 R2(config-router)#redistribute rip
   • DR1(config)#router ospf 100 - R1(config-router)#redistribute rip metric 1 metric-type 1 subnets

   Show answer

   Answer: D

   Explanation

   D is right. R1 just redistribute RIP in EIGRP. R2 learn 192.168.200.0 route from EIGRP and R2 redistribute EIGRP in OSPF, then R2 advertive 192.168.200.0 to R1. R1 learns 192.168.200.0 from R2 via OSPF. OSPF has AD 90 and RIP 120, so OSPF route become better than RIP route, but, for a route redistribution there is a rule that says the route must be in routing table and the source of redistribution must be the source of this route in route table, in this case, the RIP. When R1 learn this route in OSPF, the OSPF route replace the RIP route in route table, so the rule is broken and the redistribution stop working, then R1 stops redistribuing 192.168.200.0 to EIGRP and R2 stop reciving this route and R2 stops redistribute this route in OSPF so R1 won't recive this route from OSPF anymore, then OSPF route is removed from LSDB and RIB so RIP route go to the route table and the redistribution to EIGRP starts again and the problem starts over and over If you redistribute RIP in OSPF in R1, R2 is gonna have this route as the best route from OSPF, so it does not matter if R2 learns it from EIGRP or NOT, because OSPF has AD 90 and External EIGRP 170.

   Source: Adapted from community discussion — Malasxd

   Next question

3. Question 333 · 578 in bank

   

   Refer to the exhibit. Which action installs route 192.168.2.2/32 in the routing table?

   • ARedistribute connected networks into BGP on the local router.
   • BConfigure NAT on the local router to translate private IP addresses.
   • CConfigure the next-hop-self attribute for the peering on the local router.
   • DConfigure the next-hop-self attribute for the peering on the peer router.

   Show answer

   Answer: D

   Explanation

   if we did command "show ip route 192.168.2.2/32" It will show the next hop address as (inaccessible) which means the router has no way to the next hop of the advertised route. So we do next-hop-self on advertising router to reach the destination. BGP advertisement doesn't overwrite the next hop.

   Source: Adapted from community discussion — bk989

   Next question

4. Question 334 · 578 in bank

   

   Refer to the exhibit. An engineer is trying to log in to R1 via R3 loopback address. Which action resolves the issue?

   • AAdd transport input SCP.
   • BRemove the IPv6 traffic filter from R1, which is blocking the SSH.
   • CRemove the IPv6 traffic filter from R1, which is blocking the Telnet.
   • DAdd transport input none.

   Show answer

   Answer: C

   Explanation

   We don't see that in the configuration. But through process of elimination, we can see that A & D are wrong because "transport input ssh telnet" already allows remote access. So we are just left with two answers. From the image we can see the user is using "telnet" to remote access, so we must choose C. Although we cannot see an ACL, we can see all configuration looks correct and the connection is failing. So the answer is "C"

   Source: Adapted from community discussion — rob899

   Next question

5. Question 335 · 578 in bank

   

   Refer to the exhibit. Which action restores the routes from neighbors while still filtering 1.1.1.0/24?

   • AAdd a second line in the access list to permit any.
   • BModify the route map to permit the access list instead of deny it.
   • CModify the access list to deny instead of permit it.
   • DAdd a second sequence in the route map permit 20.

   Show answer

   Answer: D

   Explanation

   wrong. "Which action restores the routes from neighbors while still filtering 1.1.1.0/24?" Wuestion wants to filter out 1.1.1.0/24 and allow other routes. We add sequence 20 to route map, with no match, to allow everything.

   Source: Adapted from community discussion — bk989

   Next question

6. Question 336 · 578 in bank

   Select 2

   

   Refer to the exhibit. An administrator must upload the packages.conf file to an FTP server. However, the FTP server rejected anonymous service and required users to authenticate. What are the two ways to resolve the issue? (Choose two.)

   • AUse the copy flash:packages.conf scp: command instead, and enter the FTP server credentials when prompted.
   • BUse the copy flash:packages.conf ftp: command instead, and enter the FTP server credentials when prompted.
   • CEnter the FTP server credentials directly in the FTP URL using the ftp://username:password@192.0.2.40/ syntax.
   • DCreate a user on the router matching the username and password on the FTP server and log in before attempting the copy.
   • EUse ip ftp username and ip ftp password configuration commands to specify valid FTP server credentials.

   Show answer

   Answer: CE

   Explanation

   ip ftp username username Example: Router(config)# ip ftp username user1 ip ftp password password Example: Router(config)# ip ftp password guessme Router# copy slot0:1:your-ios ftp://myuser:mypass@172.23.1.129/dirt/sysadmin/your-ios

   Source: Adapted from community discussion — pitcholo

   References

   • Cisco documentation

   Next question

7. Question 337 · 578 in bank

   An engineer configured VRF-Lite on a router for VRF blue and VRF red. OSPF must be enabled on each VRF to peer to a directly connected router in each VRF. Which configuration forms OSPF neighbors over the network 10.10.10.0/28 for VRF blue and 192.168.0.0/30 for VRF red?

   • Arouter ospf 1 vrf blue network 10.10.10.0 0.0.0.252 area 0 router ospf 2 vrf red network 192.168.0.0 0.0.0.240 area 0
   • Brouter ospf 1 vrf blue network 10.10.10.0 0.0.0.15 area 0 router ospf 2 vrf red network 192.168.0.0 0.0.0.3 area 0
   • Crouter ospf 1 vrf blue network 10.10.10.0 0.0.0.240 area 0 router ospf 2 vrf red network 192.168.0.0 0.0.0.252 area 0
   • Drouter ospf 1 vrf blue network 10.10.10.0 0.0.0.3 area 0 router ospf 2 vrf red network 192 168.0.0 0.0.0.15 are 0

   Show answer

   Answer: B

   Explanation

   Both B & C are correct however using wild card mask is more desirable than using the subnet mask. Quote : In my network implementations, I use the network statements in three different ways: If I have to assign a specific interface into an area, I would always use network x.y.z.w 0.0.0.0 area n; If the area address ranges are nicely assigned (which also helps immensely when you have to start summarizing), you can use a single network statement to cover the whole area. If, for example, area 3 has address range 10.1.16.0/20, use network 10.1.16.0 0.0.15.255 area 3; If the router has all interfaces in a single area, I would almost always use network 0.0.0.0 255.255.255.255 area area-id (unless there is an extremely good reason that some interfaces should not be seen by the OSPF process). Correct answer is B .

   Source: Adapted from community discussion — pitcholo

   Next question

8. Question 338 · 578 in bank

   The network administrator must implement IPv6 in the network to allow only devices that not only have registered IP addresses but are also connecting from assigned locations. Which security feature must be implemented?

   • AIPv6 Snooping
   • BIPv6 Destination Guard
   • CIPv6 Router Advertisement Guard
   • DIPv6 Prefix Guard

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

9. Question 339 · 578 in bank

   

   Refer to the exhibit. An administrator can log in to the device using Telnet, but the attempts to log in to the same device using SSH with the same credentials fail. Which action resolves this issue?

   • AConfigure the VTY lines with login local.
   • BConfigure transport input all on the VTY lines to allow SSH.
   • CConfigure SSH service on the router.
   • DConfigure to use the Telnet user database for SSH as well.

   Show answer

   Answer: A

   Explanation

   I needed to see this in my CML lab. Actually, both solutions worked fine: A) adding "login local" to the vty configuration and Zizu007's solution using AAA. The main thing was to instruct the router to use the local user database this or that way. For this, a local user was created, e.g. username admin password cisco As a solution with AAA is not listed, I choose answer "A".

   Source: Adapted from community discussion — HungarianDish_111

   Next question

10. Question 340 · 578 in bank

    

    Refer to the exhibit. Which action limits access to R2 from 192.168.12.1?

    • AModify sequence 20 to permit tcp host 192.168.12.1 eq 22 any to access-list 100.
    • BSwap sequence 10 with sequence 20 in access-list 100.
    • CSwap sequence 20 with sequence 10 in access-list 100.
    • DModify sequence 10 to deny tcp any eq 22 any to access-list 100.

    Show answer

    Answer: B

    Explanation

    IMHO, B or C seem to be both OK. They would like to police SSH traffic only from source 192.168.12.1. So, they need to match the traffic with an access-list: 10 permit tcp host 192.168.12.1 any eq 22 -> Police (rate-limit) this traffic 20 deny tcp any any eq 22 -> Allow this traffic unconstrained Then they use it in the class-map SSH: class-map SSH match access-group 100 policy-map CoPP class SSH This CoPP constrains traffic from 192.168.12.1 (matched by "permit"), but allows hosts with any other source address without constraint (excluded by "deny"). They have to "deny" SSH traffic from any other source addresses in the ACL so that they are excluded from "class-map SSH". They will be matched and allowed unconstrained by the “class-default” which is implemented implicitly at the end of the policy-map.

    Source: Adapted from community discussion — HungarianDish_111

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 331. 578 questions available.