300-410 practice questions 391–400

1. Question 391 · 578 in bank

   

   Refer to the exhibit. Two routers are connected back to back via Gigabit Ethernet 0/0 interfaces. Which configuration provides VRF-Lite connectivity for two separate VRFs using the prefixes 10.1.1.0/24 for one VRF and 10.2.2.0/24 for the other VRF?

   • Aip vrf 1 rd 65001:1 ip vrf 2 rd 65001:2 ! int GigabitEthernet0/0 no shut ! int GigabitEthernet0/0.1 encapsulation dot1Q 1 ip vrf forwarding ip address 10.1.1.1 255.255.255.0 ! int GigabitEthernet0/0.2 encapsulation dot1Q 2 ip vrf forwarding ip address 10.2.2.1 255.255.255.0
   • Bip vrf 1 rd 65001:1 ip vrf 2 rd 65001:1 ! int GigabitEthernet0/0 no shut ! int GigabitEthernet0/0.1 encapsulation dot1Q 1 ip vrf forwarding 1 ip address 10.1.1.1 255.255.255.0 ! int GigabitEthernet0/0.2 encapsulation dot1Q 2 ip vrf forwarding 2 ip address 10.2.2.1 255.255.255.0
   • Cip vrf 1 ip vrf 2 int GigabitEthernet0/0 no shut ! int GigabitEthernet0/0.1 encapsulation dot1Q 1 ip vrf forwarding 1 ip address 10.1.1.1 255.255.255.0 ! int GigabitEthernet0/0.2 encapsulation dot1Q 2 ip vrf forwarding 2 ip address 10.2.2.1 255.255.255.0
   • Dip vrf 1 ip vrf 2 ! int GigabitEthernet0/0 no shut ! int GigabitEthernet0/0.1 encapsulation dot1Q 1 ip address 10.1.1.1 255.255.255.0 ip vrf forwarding 1 ! int GigabitEthernet0/0.2 encapsulation dot1Q 2 ip address 10.2.2.1 255.255.255.0 ip vrf forwarding 2

   Show answer

   Answer: C

   Explanation

   Just wanted to say that the option A is literally impossible as the router not going to you set "ip vrf forwarding" under an interface without defining the vrf itself. So it's IMPOSIBBLE to see such an output. Try and you'll see.

   Source: Adapted from community discussion — Brand

   Next question

2. Question 392 · 578 in bank

   

   Refer to the exhibit. The network administrator configures the Chicago router to mutually redistribute the LA and New York routes with EIGRP routes to be summarized as a single route in OSPF: router eigrp 100 redistribute ospf 1 metric 10 10 10 10 10 router ospf 1 redistribute eigrp 100 subnets area 0 range 192.168.4.0 255. 255.252.0 After the configuration, the LA router receives all the specific New York routes except the summary route. Which set of configurations resolve the issue on the Chicago router?

   • Ainterface E 0/0 ip summary-address eigrp 100 192.168.4.0 255.255.252.0
   • Brouter ospf 1 summary-address 192.168.4.0 255.255.252.0
   • Cinterface E 0/0 summary-address 192.168.4.0 255.255.252.0
   • Drouter ospf 1 area 0 range 192.168.0.0 255.255.0.0

   Show answer

   Answer: B

   Explanation

   Remember that ABRs benefit from the command "area range This command means that from this Area, advertise this range. But Chicago Router is an ASBR, which requires the command "summary-address " to summarize routes into the OSPF domain.

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 393 · 578 in bank

   

   Refer to the exhibit. The company implemented uRPF to address an antispoofing attack. A network engineer received a call from the IT security department that the regional data center is under an IP spoofing attack. Which configuration must be implemented on R1 to resolve this issue?

   • Ainterface ethernet0/0 ip verify unicast reverse-path
   • Binterface ethernet0/1 ip verify unicast reverse-path
   • Cinterface ethernet0/0 ip unicast RPF check reachable-via any allow-default allow-self-ping
   • Dinterface ethernet0/1 ip unicast RPF check reachable-via any allow-default allow-self-ping

   Show answer

   Answer: B

   Explanation

   "IP unicast RPF check is enabled" indicates that Unicast Reverse Path Forwarding (uRPF) is globally enabled on the device. This feature helps prevent source address spoofing by verifying that the source IP address of a packet received on an interface exists in the routing table and has a route back to the source. "Input features: uRPF" specifically indicates that uRPF is being applied as an input feature on that interface. This means that the uRPF check is actively being applied to packets received on that interface to verify their source addresses. In summary, while both statements relate to Unicast Reverse Path Forwarding, "IP unicast RPF check is enabled" is a global setting, and "input features: uRPF" specifies that uRPF is applied as an input feature on a specific interface. Hence we are not sure if e0/1 has uRPF enabled in this scenario.

   Source: Adapted from community discussion — bk989

   References

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

4. Question 394 · 578 in bank

   Select 2

   

   Refer to the exhibit. An engineer configured NetFlow but cannot receive the flows from R1. Which two configurations resolve the issue? (Choose two.)

   • AR3(config)#ip access-list extended DDOS R3(config-ext-nacl)#5 permit udp any host 10.66.66.66 eq 1090
   • BR4(config)#flow exporter FlowExporter1 R4(config-flow-exporter)#destination 10.66.66.66
   • CR3(config)#flow exporter FlowExporter1 R3(config-flow-exporter)#destination 10.66.66.66
   • DR1(config)#flow exporter FlowExporter1 R1(config-flow-exporter)#destination 10.66.60.66
   • ER4(config)#ip access-list extended DDOS R4(config-ext-naci)#5 permit udp any host 10.66.66.66 eq 1090

   Show answer

   Answer: AE

   Explanation

   The given answer is correct, because the port of othe destionation from the router is dropped because of the access list on R3 and R4, so u have to modify the ACL to permit that port.

   Source: Adapted from community discussion — Almylle

   Next question

5. Question 395 · 578 in bank

   

   Refer to the exhibit. R1 cannot authenticate via TACACS. Which configuration resolves the issue?

   • Aaaa group server tacacs+ DC1_TACACS server name DC_TACACS
   • Btacacs server DC1_TACACS address ipv4 10.66.66.66 key D@t@c3nter1TACACS
   • Ctacacs server DC1_TACACS address ipv4 10.60.66.66 key D@t@c3nter1TACACS
   • Daaa group server tacacs+ DC_TACACS server name DC_TACACS

   Show answer

   Answer: B

   Next question

6. Question 396 · 578 in bank

   

   Refer to the exhibit. R1 is connected with R2 via GigabitEthernet0/0, and R2 cannot ping R1. What action will fix the issue?

   • AFix route dampening configured on the router.
   • BReplace the SFP module because it is not supported.
   • CFix IP Event Dampening configured on the interface.
   • DCorrect the IP SLA probe that failed.

   Show answer

   Answer: C

   Explanation

   For those like me who don't what is IP Event Dampening : The IP Event Dampening feature introduces a configurable exponential decay mechanism to suppress the effects of excessive interface flapping events on routing protocols and routing tables in the network. This feature allows the network operator to configure a router to automatically identify and selectively dampen a local interface that is flapping. Dampening an interface removes the interface from the network until the interface stops flapping and becomes stable. Configuring the IP Event Dampening feature improves convergence times and stability throughout the network by isolating failures so that disturbances are not propagated. This, in turn, reduces the utilization of system processing resources by other devices in the network and improves overall network stability. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/xe-16-11/iri-xe-16-11-book/iri-pi-event-damp.html

   Source: Adapted from community discussion — Mjestic

   References

   • Cisco documentation

   Next question

7. Question 397 · 578 in bank

   

   Refer to the exhibit. R1 cannot receive the R2 interfaces with individual prefixes. What must be reconfigured to advertise R2 interfaces to R1?

   • AEIGRP process on R2 with the command stub summary receive-only
   • BEIGRP process on R2 with the command stub summary connected
   • CEIGRP process on R2 by removing the stub command keyword summary
   • Dinterface FastEthernet0/1 on R2 with an EIGRP summary for all three loopback prefixes

   Show answer

   Answer: B

   Explanation

   In this scenario both C and B are correct answers, however we already have a stub config in place so I think it's best not to delete the stub and just add the connected keyword as it will advertise the loopbacks .

   Source: Adapted from community discussion — potato_inet0

   Next question

8. Question 398 · 578 in bank

   

   Refer to the exhibit. The Customer Edge router wants to use AS 100 as the preferred ISP for all external routes and SP2 as a backup. Customer-Edge - route-map SETAS set as-path prepend 111 ! router bgp 64555 neighbor 192.168.1.1 remote-as 100 neighbor 192.168.2.2 remote-as 200 neighbor 192.168.2.2 route-map SETAS in After this configuration, all the backup routes have disappeared from the BGP table on the Customer Edge router. Which set of configurations resolves the issue on the Customer Edge router?

   • Aroute-map SETAS set as-path prepend 200 ! router bgp 64555 neighbor 192.168.1.1 remote-as 100 neighbor 192.168.2.2 remote-as 200 neighbor 192.168.2.2 route-map SETAS in
   • Broute-map SETAS set as-path prepend 111 ! router bgp 64555 neighbor 192.168.1.1 remote-as 100 neighbor 192.168.2.2 remote-as 200 neighbor 192.168.2.2 route-map SETAS out
   • Croute-map SETAS set as-path prepend 200 ! router bgp 64555 neighbor 192.168.1.1 remote-as 100 neighbor 192.168.2.2 remote-as 200 neighbor 192.168.2.2 route-map SETAS out
   • Droute-map SETAS set as-path prepend 111 ! router bgp 64555 neighbor 192.168.2.2 remote-as 100 neighbor 192.168.1.1 remote-as 200 neighbor 192.168.1.1 route-map SETAS in

   Show answer

   Answer: A

   Explanation

   Inbound is correct for sure. Only answer "A" uses correct neighbor + direction. neighbor 192.168.2.2 route-map AS in Probably this explains, why they want to prepend AS 200 (remote AS number): https://blog.ipspace.net/2009/03/as-path-prepending-technical-details.html Inbound AS-Path Prepending ... to add an extra copy of the REMOTE AS number to inbound updates received from (neighbor)

   Source: Adapted from community discussion — HungarianDish_111

   Next question

9. Question 399 · 578 in bank

   

   Refer to the exhibit. An engineer applied an IPv6 traffic filter on R1. The interface flapped between R1 and R2 and clearing the BGP session did not restore the BGP session and failed. Which action must the engineer take to restore the BGP session from R2 to R1?

   • AICMPv6 must be permitted by the IPv6 traffic filter.
   • BSwap the source and destination IP addresses in the IPv6 traffic filter.
   • CEnable the BGP session, which went down when the session was cleared.
   • DApply the IPv6 traffic filter in the outbound direction on the interface.

   Show answer

   Answer: A

   Explanation

   Solution "A" makes sure that neighbor advertisement packets are not discarded. (Usually only required after adding "deny ipv6 any any"). https://alexandremspmoraes.wordpress.com/2012/02/17/how-ios-ipv6-acls-handle-icmpv6-neighbor-discovery-messages/

   Source: Adapted from community discussion — HungarianDish_111

   Next question

10. Question 400 · 578 in bank

    DRAG DROP - Drag and drop the IPv6 First-Hop Security features from the left onto the definitions on the right.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    IPV6 DHCPV6 Guard -> Block reply and advertisement messages from unauthorized DHCP servers and relay agents. IPV6 Binding Table -> Create IPV6 neighbors connected to the device from information sources such as NDP snooping. IPv6 Source Guard -> Filter inbound traffic on Layer 2 switch ports that are not in the IPV6 binding table. IPv6 RA Guard -> Block a malicious host and permit the router from a legitimate route. IPV6 ND Inspection -> Create a binding table that is based on NS and NA messages.

    Source: Adapted from community discussion — seal2

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 391. 578 questions available.