300-410 practice questions 341–350

1. Question 341 · 578 in bank

   

   Refer to the exhibit. Routing protocols are mutually redistributed on R3 and R1. Users report intermittent connectivity to services hosted on the 10.1.1.0/24 prefix. Significant routing update changes are noticed on R3 when the show ip route profile command is run. How must the services be stabilized?

   • AThe routing loop must be fixed by reducing the admin distance of OSPF from 110 to 80 on R3
   • BThe routing loop must be fixed by reducing the admin distance of iBGP from 200 to 100 on R3
   • CThe issue with using BGP must be resolved by using another protocol and redistributing it into EIGRP on R3
   • DThe issue with using iBGP must be fixed by running eBGP between R3 and R4

   Show answer

   Answer: B

   Explanation

   B is correct After redistribution, R3 learns about network 10.1.1.0/24 via two paths:+ Internal BGP (IBGP): advertised from R4 with AD of 200 (and metric of 0)+ OSPF: advertised from R1 with AD of 110 (O E2) (and metric of 20)Therefore R3 will choose the path with the lower AD via OSPF But this is a looped path which is received from R3 -> R2 -> R1 -> R3. So when the advertised route from R4 is expired, the looped path is also expired soon and R3 willreinstall the main path from R4. This is the cause of intermittent connectivity.In order to solve this issue, we can lower the AD of iBGP to a value which is lower than 110 so that it is preferred over OSPF-advertised route.

   Source: Adapted from community discussion — AliMo123

   Next question

2. Question 342 · 578 in bank

   

   Refer to the exhibit. The ACL is placed on the inbound Gigabit 0/1 interface of the router. Host 192.168.10.10 cannot SSH to host 192.168.100.10 even though the flow is permitted. Which action resolves the issue without opening full access to this router?

   • ATemporarily move the permit ip any any line to the beginning of the ACL to see if the flow works
   • BTemporarily remove the ACL from the interface to see if the flow works.
   • CMove the SSH entry to the beginning of the ACL.
   • DRun the show access-list FILTER command to view if the SSH entry has any hit statistics associated with it.

   Show answer

   Answer: C

   Explanation

   Remember that ACLs are read by the router from top to bottom. If there is a hit in any of the first entries, it will go ahead and perform the permit or deny that is specified in the entry.

   Source: Adapted from community discussion — Coffee_bean_master

   Next question

3. Question 343 · 578 in bank

   

   Refer to the exhibit. A CoPP policy is implemented to allow specific control traffic, but the traffic is not matching as expected and is getting unexpected behavior of control traffic. Which action resolves the issue?

   • AUse match-any instruction in class-map.
   • BCreate a separate class map against each ACL.
   • CCreate a separate class map for ICMP traffic.
   • DUse default-class to match ICMP traffic.

   Show answer

   Answer: A

   Explanation

   Given answer is correct! -match-all in class-map statement means that all ACLs have to match (which is very unlikely). -match-any in class-map statement means that at least one ACL has to match. For this reason why no traffic was matching.

   Source: Adapted from community discussion — ellen_AA

   Next question

4. Question 344 · 578 in bank

   

   Refer to the exhibit. An engineer sets up a DMVPN connection to connect branch 1 and branch 2 to HQ. Branch 1 and branch 2 cannot communicate with each other. Which change must be made to resolve this issue?

   • AR1(config)#int eth1/1 - R1(config-if)#no ip split-horizon eigrp 100
   • BR2(config)#router eigrp 100 - R2(config-router)#tneighbor 172.16.1.3
   • CR3(config)#router eigrp 100 - R3(config-router)#neighbor 172.16.1.2
   • DR1(config)#int tunnel 1 - R1(config-if)#no ip split-horizon eigrp 100

   Show answer

   Answer: D

   Next question

5. Question 345 · 578 in bank

   Select 2

   The network administrator is tasked to configure R1 to authenticate telnet connections based on Cisco ISE using RADIUS. ISE has been configured with an IP address of 192.168.1.5 and with a network device pointing towards R1 (192.168.1.1) with a shared secret password of Cisco123. If ISE is down, the administrator should be able to connect using the local database with a username and password combination of admin/cisco123. The administrator has configured the following on R1: aaa new-model ! username admin password cisco123 ! radius server ISE1 address ipv4 192.168.1.5 key Cisco123 ! aaa group server tacacs+ RAD-SERV server name ISE1 ! aaa authentication login RAD-LOCAL group RAD-SERV ISE has gone down. The Network Administrator is not able to Telnet to R1 when ISE went down. Which two configuration changes will fix the issue? (Choose two.)

   • Aaaa authentication login RAD-SERV group RAD-LOCAL local
   • Baaa authentication login RAD-LOCAL group RAD-SERV local
   • Cline vty 0 4 login authentication RAD-LOCAL
   • Dline vty 0 4 login authentication default
   • Eline vty 0 4 login authentication RAD-SERV

   Show answer

   Answer: BC

   Explanation

   Given answers are correct; One more detail, we are asked to configure radius not tacas+. So, configure: - aaa group server radius RAD-SERV instead of: - aaa group server tacas+ RAD-SERV

   Source: Adapted from community discussion — ellen_AA

   Next question

6. Question 346 · 578 in bank

   Select 2

   The network administrator deployed the Binding Table Recovery feature. Which two devices recover the missing binding table entries? (Choose two.)

   • ADHCP client
   • Bdestination host
   • CDHCP relay agent
   • Dsource host
   • EDHCP server

   Show answer

   Answer: BE

   Explanation

   This mechanism enables the binding table to recover in the event of a device reboot. The recovery mechanism will block any data traffic sourced from an unknown source; that is, a source not already specified in the binding table and previously learned through ND or DHCPgleaning. Thisfeature recoversthe missing binding table entries when the resolution for a destination address fails in the destination guard. When a failure occurs, a binding table entry is recovered by querying the DHCP server or the destination host, depending on the configuration. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-16-12/ip6f-xe-16-12-book/ip6-snooping.pdf Page 2

   Source: Adapted from community discussion — DUBC89x

   References

   • Cisco documentation

   Next question

7. Question 347 · 578 in bank

   Select 2

   Which two components are needed for a service provider to utilize the L3VPN MPLS application? (Choose two.)

   • AThe P routers must be configured with RSVP.
   • BThe PE routers must be configured for MP-eBGP to connect to CEs.
   • CThe P routers must be configured for MP-iBGP toward the PE routers.
   • DThe PE routers must be configured for MP-iBGP with other PE routers.
   • EThe P and PE routers must be configured with LDP or RSVP.

   Show answer

   Answer: DE

   Next question

8. Question 348 · 578 in bank

   

   Refer to the exhibit. A network is configured for EIGRP equal-cost load balancing, but the traffic destined to the servers is not load balanced. Link metrics from router R2 to R3 and R4 are the same. Which delay value must be configured to resolve the issue?

   • A2200 on R4 E0/1
   • B200 on R3 E0/1
   • C120 on R3 E0/1
   • D120 on R4 E0/1

   Show answer

   Answer: C

   Explanation

   Delay shown at a R2 is a SUM of delays R2 (e0/0) and R3 (e0/1) via R2-R3 path and SUM of delays R2 (e0/0) and R4 (e0/1) via R2-R4 path Thus, it is 100 (tens of microseconds) + 100 (tens of microseconds) = 200 (tens of msec) = 2000 (microseconds) via upper path, and 100 + 120 (220 tens of msec = 2200) via lower path. For load balancing, we have to setup R3 e0/1 delay 120 (delay on an interface is setup in tens of microseconds) Finally, we will have 2200 msec summarized delay for 10.1.3.0 subnet on R2 Labbed it in GNS3.

   Source: Adapted from community discussion — elmorrre

   References

   • Cisco documentation

   Next question

9. Question 349 · 578 in bank

   

   Refer to the exhibit. An engineer notices a connectivity problem between routers R1 and R2. The frequency of this problem is high during peak business hours. Which action resolves the issue?

   • AIncrease the available bandwidth between R1 and R2.
   • BDecrease the EIGRP keepalive and hold down timers on R1 and R2.
   • CIncrease the MTU on the interfaces that connect R1 and R2.
   • DSet static EIGRP neighborship between R1 and R2.

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

10. Question 350 · 578 in bank

    

    Refer to the exhibit. A network administrator configured name resolution for IPv6 traffic to be allowed through an inbound access list. After the access list is applied to resolve the issue, name resolution still did not work. Which action does the network administrator take to resolve the name resolution problem?

    • AAdd permit udp any eq domain 53 any log in the access list
    • BRemove ipv6 inspect ipv6-firewall in from interface gi0/1
    • CAdd permit udp any eq domain any log in the access list
    • DInspect ipv6 inspect name ipv6-firewall udp 53 in global config

    Show answer

    Answer: C

    Explanation

    Please, see explanation here: https://networkengineering.stackexchange.com/questions/46248/configuring-acl-for-dns ACE - Client to server UDP case for DNS queries: permit udp any any eq domain Reply ACE for DNS replies with the A-record: permit udp any eq domain any Scenario is taken from: https://community.cisco.com/t5/ipv6/ipv6-acl-problem-with-dns/td-p/2271733

    Source: Adapted from community discussion — HungarianDish_111

    References

    • cisco.com documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 341. 578 questions available.