300-410 practice questions 41–50

1. Question 41 · 578 in bank

   Select 2

   In which two ways does the IPv6 First-Hop Security Binding Table operate? (Choose two.)

   • Aby IPv6 HSRP to make sure neighbors are authenticated before being used as gateways
   • Bby various IPv6 guard features to validate the data link layer address
   • Cby the recovery mechanism to recover the binding table in the event of a device reboot
   • Dby IPv6 routing protocols to securely build neighborships without the need of authentication
   • Eby storing hashed keys for IPsec tunnels for the built-in IPsec features

   Show answer

   Answer: BC

   Explanation

   Ref: IPv6 First-Hop Security Binding Table – Cisco “… Overview of the IPv6 First-Hop Security Binding Table … This database, or binding table, is used by various IPv6 guard features to validate the link-layer address (LLA), the IPv4 or IPv6 address, and the prefix binding of the neighbors to prevent spoofing and redirect attacks. … IPv6 First-Hop Security Binding Table Recovery Mechanism The IPv6 first-hop security binding table recovery mechanism enables the binding table to recover in the event of a device reboot. …” A. by IPv6 HSRP to make sure neighbors are authenticated before being used as gateways Wrong answer. B. by various IPv6 guard features to validate the data link layer address Correct answer. C. by the recovery mechanism to recover the binding table in the event of a device reboot Correct answer. D. by IPv6 routing protocols to securely build neighborships without the need of authentication Wrong answer. E. by storing hashed keys for IPsec tunnels for the built-in IPsec features Wrong answer.

   Source: Adapted from community discussion — [Removed]

   References

   • Cisco documentation

   Next question

2. Question 42 · 578 in bank

   

   Refer to the exhibit. The engineer configured and connected Router2 to Router1. The link came up but could not establish a Telnet connection to Router1 IPv6 address of 2001:DB8::1. Which configuration allows Router2 to establish a Telnet connection to Router1?

   • Aipv6 unicast-routing
   • Bpermit ICMPv6 on access list INGRESS for Router2 to obtain IPv6 address
   • Cpermit ip any any on access list EGRESS2 on Router1
   • DIPv6 address on GigabitEthernet0/0

   Show answer

   Answer: D

   Explanation

   Correct answer is B because when R1 will send nd ra to R2 for its autoconfig, its access-list INGRESS will drop it. LAB for test : R2#show ipv6 access-list IPv6 access list INGRESS permit ipv6 2001:DB8::/64 any (1 match) sequence 10 deny ipv6 2001:DB8::/32 any sequence 20 permit icmp any any (5 matches) sequence 30 R2#telnet 2001:db8::1 Trying 2001:DB8::1 ... Open R1>

   Source: Adapted from community discussion — MP_iBGP

   Next question

3. Question 43 · 578 in bank

   An engineer configured Reverse Path Forwarding on an interface and noticed that the routes are dropped when a route lookup fails on that interface for a prefix that is available in the routing table. Which interface configuration resolves the issue?

   • Aip verify unicast source reachable-via l2-src
   • Bip verify unicast source reachable-via allow-default
   • Cip verify unicast source reachable-via any
   • Dip verify unicast source reachable-via rx

   Show answer

   Answer: C

   Explanation

   Ref: Security - Configuring Network Security [Support] - Cisco Systems “… Configuring the Unicast RPF Check Mode There are two Unicast RPF check modes: • Strict check mode, which verifies that the source IP address exists in the FIB table and verifies that the source IP address is reachable through the input port. • Exist-only check mode, which only verifies that the source IP address exists in the FIB table. … When configuring the Unicast RPF check mode, note the following information: • Use the rx keyword to enable strict check mode. • Use the any keyword to enable exist-only check mode. • Use the allow-default keyword to allow use of the default route for RPF verification. …” The route lookup failed, but the prefix is in the routing table. RPF Exist-only check mode is the way to go. A. ip verify unicast source reachable-via l2-src Wrong answer. B. ip verify unicast source reachable-via allow-default Wrong answer. C. ip verify unicast source reachable-via any Correct answer. D. ip verify unicast source reachable-via rx Wrong answer.

   Source: Adapted from community discussion — [Removed]

   Next question

4. Question 44 · 578 in bank

   Which attribute eliminates LFAs that belong to protected paths in situations where links in a network are connected through a common fiber?

   • Ashared risk link group-disjoint
   • Blinecard-disjoint
   • Clowest-repair-path-metric
   • Dinterface-disjoint

   Show answer

   Answer: A

   Explanation

   LFA Tie-Breaking Rules • Shared Risk Link Group (SRLG)-disjoint—Eliminates LFAs that belong to any of the protected path SRLGs.SRLGsrefer to situations where linksin a network share a common fiber (or a common physical attribute). If one link fails, other links in the group may also fail. Therefore, links in a group share risks. ref: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_eigrp/configuration/xe-3s/asr1000/ire-xe-3s-asr1000.pdf

   Source: Adapted from community discussion — networkWiz

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 45 · 578 in bank

   

   Refer to the exhibit. When monitoring an IPv6 access list, an engineer notices that the ACL does not have any hits and is causing unnecessary traffic through the interface Which command must be configured to resolve the issue?

   • Aip access-group INTERNET in
   • Bipv6 traffic-filter INTERNET in
   • Cipv6 access-class INTERNET in
   • Daccess-class INTERNET in

   Show answer

   Answer: B

   Explanation

   B is correct "In order to assign an IPv6 ACL to an interface, use this command in interface configuration mode: ipv6 traffic-filter access-list-name {in | out}"

   Source: Adapted from community discussion — AliMo123

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

6. Question 46 · 578 in bank

   Which configuration feature should be used to block rogue router advertisements instead of using the IPv6 Router Advertisement Guard feature?

   • AVACL blocking broadcast frames from nonauthorized hosts
   • BPVLANs with promiscuous ports associated to route advertisements and isolated ports for nodes
   • CPVLANs with community ports associated to route advertisements and isolated ports for nodes
   • DIPv4 ACL blocking route advertisements from nonauthorized hosts

   Show answer

   Answer: B

   Explanation

   The answer is not D, as this is regarding IPv6. The answer would be B. You would configure the switch with PVLANs, configure the switchport where you would expect to see RAs as a promiscuous port, and configure the client ports as isolated ports. With this configuration if any rogue RAs came in on an isolated port it would not be able to offer SLAAC addresses to any other client on the other isolated ports.

   Source: Adapted from community discussion — Dirkd0344

   Next question

7. Question 47 · 578 in bank

   

   Refer to the exhibit. Which action resolves the failed authentication attempt to the router?

   • AConfigure aaa authorization console global command
   • BConfigure aaa authorization console command on line vty 0 4
   • CConfigure aaa authorization login command on line console 0
   • DConfigure aaa authorization login command on line vty 0 4

   Show answer

   Answer: A

   Explanation

   Reference: https://community.cisco.com/t5/network-access-control/console-authorization-issue/td-p/2492619

   Source: Adapted from community discussion — toto2

   References

   • cisco.com documentation

   Next question

8. Question 48 · 578 in bank

   

   Refer to the exhibit. A network administrator logs into the router using TACACS+ username and password credentials, but the administrator cannot run any privileged commands. Which action resolves the issue?

   • AConfigure the username from a local database
   • BConfigure TACACS+ synchronization with the Active Directory admin group
   • CConfigure an authorized IP address for this user to access this router
   • DConfigure full access for the username from TACACS+ server

   Show answer

   Answer: D

   Explanation

   Ref: TACACS+ Configuration Guide, Cisco IOS Release 15S “C H A P T E R 1 Configuring TACACS … How to Configure TACACS … Specifying TACACS Authorization AAA authorization enables you to set parameters that restrict a user’s access to the network. Authorization via TACACS+ may be applied to commands, network connections, and EXEC sessions. …” A. Configure the username from a local database Wrong answer. B. Configure TACACS+ synchronization with the Active Directory admin group Wrong answer. C. Configure an authorized IP address for this user to access this router Wrong answer. D. Configure full access for the username from TACACS+ server Correct answer.

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 49 · 578 in bank

   

   Refer to the exhibit. AAA server 10.1.1.1 is configured with the default authentication and accounting settings, but the switch cannot communicate with the server. Which action resolves this issue?

   • ACorrect the timeout value.
   • BMatch the authentication port.
   • CCorrect the shared secret.
   • DMatch the accounting port.

   Show answer

   Answer: B

   Explanation

   The port values of 1812 for authentication and 1813 for accounting are RADIUS standard ports defined by the Internet Engineering Task Force (IETF) in RFCs 2865 and 2866. However, by default, many access servers use ports 1645 for authentication requests and 1646 for accounting requests.

   Source: Adapted from community discussion — Hack4

   Next question

10. Question 50 · 578 in bank

    

    Refer to the exhibit. R1 is being monitored using SNMP and monitoring devices are getting only partial information. What action should be taken to resolve this issue?

    • AModify the CoPP policy to increase the configured exceeded limit for SNMP.
    • BModify the access list to include snmptrap.
    • CModify the CoPP policy to increase the configured CIR limit for SNMP.
    • DModify the access list to add a second line to allow udp any any eq snmp.

    Show answer

    Answer: B

    Explanation

    B is the correct snmptrap uses port 161 snmp uses port 162 ip access-list extended ABC-ACL permit udp X.X.0.0 0.0.255.255 eq snmp host SERVER_IP !!source port is 161 permit udp X.X.0.0 0.0.255.255 host SERVER_IP eq snmptrap !!dest port is 162 https://community.cisco.com/t5/routing/acl-to-allow-snmp-traffic/td-p/1577251

    Source: Adapted from community discussion — ytsionis

    References

    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 41. 578 questions available.