300-410 practice questions 361–370

1. Question 361 · 578 in bank

   

   Refer to the exhibit. An administrator is troubleshooting a time synchronization problem for the router's time to another Cisco IOS XE-based device that has recently undergone security hardening. Which action resolves the issue?

   • ANTP service is disabled and must be enabled on 10.1.255.40.
   • BEnsure that the CPE router has a valid route to 10.1.255.40 for NTP and rectify if not reachable.
   • CAllow NTP in the ingress ACL on 10.1.255.40 by permitting UDP destined to port 123.
   • DAllow NTP in the ingress ACL on 10.1.255.40 by permitting TCP destined to port 123.

   Show answer

   Answer: A

   Explanation

   Sorry, i was wrong, also labbed it and Zizu007 is right. When filtered by access list: Jan 30 10:22:13.908: ICMP: dst (181.16.2.6) administratively prohibited unreachable rcv from 181.16.2.5 When NTP is turned off on master: *Jan 30 10:13:20.287: ICMP: dst (181.16.2.6) port unreachable rcv from 181.16.2.5 So in this case NTP needs to be enabled.

   Source: Adapted from community discussion — Patrick1234

   Next question

2. Question 362 · 578 in bank

   

   Refer to the exhibit. The traffic from spoke to hub is dropping. The operations team observes: • R2-R3 link is down due to the fiber cut. • R2 and R5 receive traffic from R1 in AS 65101. • R3 and R6 receive traffic from R4 in AS 65201. Which configuration resolves the issue?

   • AR5(config)#router bgp 65101 - R5(config-router)#neighbor 10.10.10.6 remote-as 65201 R5(config-router)#neighbor 10.10.10.6 update-source Loopback0 R5(config-router)#neighbor 10.10.10.6 ebgp-multihop 3
   • BR5(config)#router bgp 65101 - R5(config-router)#no neighbor 10.0.0.18 update-source Loopback0
   • CR6(config)#router bgp 65101 - R6(config-router)#no neighbor 10.0.0.17 update-source Loopback0
   • DR6(config)#router bgp 65201 - R6(config-router)#neighbor 10.10.10.5 remote-as 65101 R6(config-router)#neighbor 10.10.10.5 update-source Loopback0 R6(config-router)#neighbor 10.10.10.5 ebgp-multihop 3

   Show answer

   Answer: B

   Explanation

   The error message "BGP: 10.0.0.18 passive open failed - 10.0.0.17 is not update-source Loopback0's address (10.10.10.5)" indicates that there was a problem with establishing a BGP session between two routers with IP addresses 10.0.0.18 and 10.0.0.17. The message specifically states that the passive open attempt from the device with IP address 10.0.0.18 has failed because the device with IP address 10.0.0.17 is not using the correct source IP address when sending updates. Instead of using the IP address of the Loopback0 interface, which is 10.10.10.5, it is using a different IP address. In this case, it appears that the device with IP address 10.0.0.17 is using a different source IP address than the one expected by the device with IP address 10.0.0.18. Specifically, the device with IP address 10.0.0.17 should be configured to use the IP address of its Loopback0 interface (10.10.10.5 in this case) as the source address for BGP updates when communicating with the device at IP address 10.0.0.18.

   Source: Adapted from community discussion — Titini

   Next question

3. Question 363 · 578 in bank

   An engineer is configuring a network and needs packets to be forwarded to an interface for any destination address that is not in the routing table. What should be configured to accomplish this task?

   • Aset ip next-hop
   • Bset ip default next-hop
   • Cset ip next-hop recursive
   • Dset ip next-hop verify-availability

   Show answer

   Answer: B

   Explanation

   - The "set ip default next-hop" command verifies the existence of the destination IP address in the routing table: * If the destination IP address exists in the RT, the command does not policy route the packet, but forwards the packet based on the routing table. * If the destination IP address does not exist in the RT, the command policy routes the packet by sending it to the specified next hop. - The "set ip next-hop" command verifies the existence of the destination IP address in the routing table: * If the next hop exists in the routing table, then the command policy routes the packet to the next hop. * If the next hop does not exist in the routing table, the command uses the routing table to forward the packet.

   Source: Adapted from community discussion — ellen_AA

   References

   • Cisco documentation

   Next question

4. Question 364 · 578 in bank

   What is a function of an end device configured with DHCPv6 guard?

   • AIf it is configured as a client, messages are switched regardless of the assigned role.
   • BIf it is configured as a client, only DHCP requests are permitted.
   • CIf it is configured as a relay agent, only prefix assignments are permitted.
   • DIf it is configured as a server, only prefix assignments are permitted.

   Show answer

   Answer: A

   Explanation

   Q#427 - DUBC89x DHCPv6 Guard Overview The DHCPv6 Guard feature blocks reply and advertisement messages that come from unauthorized DHCP servers and relay agents. Packets are classified into one of the three DHCP type messages. All client messages are always switched regardless of device role. DHCP server messages are only processed further if the device role is set to server. Further processing of server messages includes DHCP server advertisements(for source validation and server preference) and DHCP server replies (for permitted prefixes). If the device is configured as a DHCP server, all the messages need to be switched, regardless of the device role configuration. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/ip6-dhcpv6-guard.pdf

   Source: Adapted from community discussion — HungarianDish_111

   References

   • Cisco documentation

   Next question

5. Question 365 · 578 in bank

   The network administrator configured CoPP so that all SNMP traffic from Cisco Prime located at 192.168.1.11 toward the router CPU is limited to 1000 kbps. Any traffic that exceeds this limit must be dropped. access-list 100 permit udp any any eq 161 ! class-map CM-SNMP match access-group 100 ! policy-map PM-COPP class CM-SNMP police 1000 conform-action transmit ! control-plane service-policy input PM-COPP The network administrator is not getting the desired result for the SNMP traffic and SNMP traffic is getting dropped frequently. Which set of configurations resolves the issue?

   • Ano access-list 100 access-list 100 permit tcp host 192.168.1.11 any eq 161
   • Bno access-list 100 access-list 100 permit udp host 192.168.1.11 any eq 161 ! policy-map PM-COPP class CM-SNMP no police 1000 conform-action transmit police 1000000 conform-action transmit ! control-plane no service-policy input PM-COPP ! interface E 0/0 service-policy input PM-COPP ! interface E 0/1 service-policy input PM-COPP
   • Cno access-list 100 access-list 100 permit udp host 192.168.1.11 any eq 161 ! policy-map PM-COPP class CM-SNMP no police 1000 conform-action transmit police 1000000 conform-action transmit
   • Dpolicy-map PM-COPP class CM-SNMP no police 1000 conform-action transmit police 1000000 conform-action transmit

   Show answer

   Answer: C

   Explanation

   Agree on "C", because it is more specific than "D". ("D" could work, too.) 1000 kbps = 1 000 000 bits per second => bps is used in CoPP, so this value needs to be changed. The ACL syntax for matching the interesting traffic: access-list 100 permit udp host any eq 161 (or eq snmp) Example: https://community.cisco.com/t5/routing/acl-help/td-p/2788816/page/2

   Source: Adapted from community discussion — HungarianDish_111

   References

   • cisco.com documentation

   Next question

6. Question 366 · 578 in bank

   Which protocol must be secured with MD-5 authentication across the MPLS cloud to prevent hackers from introducing bogus routers?

   • ARSVP
   • BALSO
   • CLDP
   • DMP-BGP

   Show answer

   Answer: C

   Explanation

   The Label Distribution Protocol (LDP) can also be secured with MD-5 authentication across the MPLS cloud. This prevents hackers from introducing bogus routers, which would participate in the LDP. https://www.cisco.com/c/en/us/td/docs/net_mgmt/vpn_solutions_center/2-0/mpls/provisioning/guide/PGmpls1.html

   Source: Adapted from community discussion — DUBC89x

   References

   • Cisco documentation

   Next question

7. Question 367 · 578 in bank

   

   Refer to the exhibit R3 cannot authenticate via TACACS. Which configuration resolves the issue?

   • Atacacs server SITE6_TACACS key C!sc0TACACS
   • Btacacs server SITE6_TACACS key C!scoTACACS
   • Ctacacs server SITE6_TACACS address ipv4 10.60.66.66 key C!scoTACACS
   • Dtacacs server SITE6_TACACS address ipv4 10.66.66.66 key CiscoTACACS

   Show answer

   Answer: B

   Explanation

   R3 is already pointing to the right server IP address, (10.66.66.66) therefore, we don't need to specify it again. The actual config on R3 has a "0" (ZERO) instead of the letter "O" along with an exclamation mark "!." If you look at the tacacs servers key, it is "C!iscoTACACS." Therefore, you only have to select the right key that matches the server. Which is in this case, answer "B"

   Source: Adapted from community discussion — Coffee_bean_master

   Next question

8. Question 368 · 578 in bank

   A customer is running an mGRE DMVPN tunnel over WAN infrastructure between hub and spoke sites. The existing configuration allows NHRP to add spoke routers automatically to the multicast NHRP mappings. The customer is migrating the network from IPv4 to the IPv6 addressing scheme for those spokes' routers that support IPv6 and can run DMVPN tunnel over the IPv6 network. Which configuration must be applied to support IPv4 and IPv6 DMVPN tunnels on spoke routers?

   • Atunnel mode ipv6ip 6to4
   • Btunnel mode ipv6ip auto-tunnel
   • Ctunnel mode ipv6ip 6rd
   • Dtunnel mode ipv6ip isatap

   Show answer

   Answer: B

   Explanation

   It's B with the command tunnel mode ipv6ip 6to4 basically you incapsulate IPv6 packets into ipv4 packet for traversing an IPv4 network. The question here is the opposite I think they are asking to us that they are migrating in IPv6 and so we need to incapsulate IPv4 packets into IPv6 packets in some cases. So the command that allow us to do so is tunnel mode ipv6ip auto-tunnel, this command allows you to use ipv4 addresses that will be compatible with ipv6

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

9. Question 369 · 578 in bank

   

   Refer to the exhibit. Which action ensures that 10.10.10.0/24 reaches 10.10.20.0/24 through the direct link between R1 and R2?

   • AConfigure R1 and R2 LAN links as nonpassive.
   • BConfigure R1 and R2 links under area 1.
   • CConfigure OSPF link cost to 1 between R1 and R2.
   • DConfigure OSPF path cost to 3 between R1 and R2.

   Show answer

   Answer: B

   Explanation

   Both given routes are in area1, direct link is in area0. By default ospf prefers intra-area routes 'O' over inter-area routes 'O IA'. Bringing the direct link to the same area as both routes will make it preferable.

   Source: Adapted from community discussion — ellen_AA

   Next question

10. Question 370 · 578 in bank

    The summary route is not shown in the Router_B routing table after this below configuration on Router_A: interface ethernet 0 description location ID:S4318T3E77F02 ip address 192.168.3.1 255.255.255.0 ip summary-address eigrp 1 172.16.80.0 255.255.240.0 Which Router_A configuration resolves the issue by advertising the summary route to Router_B?

    • Ainterface loopback 0 ip address 172.18.81.1 255.255.255.0 interface Ethernet 0 ip address 192.168.3.1 255.255.255.0 ip summary-address eigrp 1 172.16.80.0 255.255.240.0
    • Binterface loopback 0 ip address 172.16.79.1 255.255.255.0 interface Ethernet 0 ip address 192.168.3.1 255.255.255.0 ip summary-address eigrp 1 172.16.80.0 255.255.240.0
    • Cinterface loopback 0 ip address 172.16.81.1 255.255.255.0 interface Ethernet 0 ip address 192.168.3.1 255.255.255.0 ip summary-address eigrp 1 172.16.80.0 255.255.240.0
    • Dinterface loopback 0 ip address 172.16.96.1 255.255.255.0 interface Ethernet 0 ip address 192.168.3.1 255.255.255.0 ip summary-address eigrp 1 172.16.80.0 255.255.240.0

    Show answer

    Answer: C

    Explanation

    Summary addresses won't show in the routing table unless there's a componant route in the summary address range Another way of asking this question would be "which of the following loopback ip addresses are contained in the 172.16.80.0 255.255.240.0 summary address" A - 172.18.81.1 - is not in the summary as it has to be 172.16.80.0 - 172.16.95.255 B - 172.16.79.1 - is just under the summary D - 172.16.96.1 - is just over the summary Only C is in that range, which triggers the summary address to go into the routing table

    Source: Adapted from community discussion — targetA

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 361. 578 questions available.