300-410 practice questions 531–540

1. Question 531 · 578 in bank

   SIMULATION - Guidelines - This is a lab item in which tasks will be performed on virtual devices. • Refer to the Tasks tab to view the tasks for this lab item. • Refer to the Topology tab to access the device console(s) and perform the tasks. • Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. • All necessary preconfigurations have been applied. • Do not change the enable password or hostname for any device. • Save your configurations to NVRAM before moving to the next item. • Click Next at the bottom of the screen to submit this lab and move to the next question. • When Next is clicked, the lab closes and cannot be reopened. Topology -

   

   Tasks - Configure IPSec security policy on tunnel interfaces to ensure data confidentiality and integrity where mGRE tunnels are up and running between HUB and SPOKE routers. 1. Configure the ISAKMP policy parameters with the following attributes: • AES256 • SHA256 • Group2 • lifetime 86400 2. Ensure that GRE IP Header should be encrypted inside the IPSec packet. Verify IPSec security association and ISAKMP encrypted key. Use ISAKMP key "abc123". 3. Configure a flexible ISAKMP Policy on the HUB to add peers that have the dynamic IP addresses where SPOKES must add HUB IP static entry using an encrypted key. Use a single command to configure it. Use IPSec phase-2 transform-set name as T-SET and IPSec Profile name as ’IPSEC-PROFILE’.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   i had this lab in the exam, the only differences were: 1. configure MD5 instead of SHA256. 2. the name of ipsec profile was different in the exam (be aware of the details of names in the exam, they are not always the same). on all Routers: (config)#crypto isakmp policy 10 (config-isakmp)#encryption aes256 (config-isakmp)#hash md5 (config-isakmp)#authentication pre-share (config-isakmp)#group 2 (config-isakmp)#lifetime 86400 (config)#crypto isakmp key abc123 address 0.0.0.0 (config)#crypto ipsec transform-set T-SET esp-aes256 esp-md5-hmac (config)#crypto ipsec profile IPSEC-PROFILE (config-ipsec-profile)#set transform-set T-SET (config)#int tunnel 0 (config-if)#tunnel source (phisical interface or phisical ip) (config-if)#tunnel protection ipsec profile IPSEC-PROFILE there´s no need for this command "tunnel mode gre multipoint" cop r st

   Source: Adapted from community discussion — [Removed]

   

   Next question

2. Question 532 · 578 in bank

   Which feature drops packets if the source address is not found in the snooping table?

   • AIPv6 Destination Guard
   • BIPv6 Source Guard
   • CBinding Table Recovery
   • DIPv6 Prefix Guard

   Show answer

   Answer: B

   Next question

3. Question 533 · 578 in bank

   Refer to the exhibit.

   

   An engineer configured BGP between routers R1 and R3. The BGP peers cannot establish neighbor adjacency to be able to exchange routes. Which configuration resolves this issue?

   • AR1 router bgp 6501 address-family ipv6 neighbor AB01:2011:7:100::3 activate
   • BR3 router bgp 6502 address-family ipv6 neighbor AB01:2011:7:100::1 activate
   • CR1 router bgp 6501 neighbor AB01:2011:7:100::3 ebgp-multihop 255
   • DR3 router bgp 6502 neighbor AB01:2011:7:100::1 ebgp-multihop 255

   Show answer

   Answer: B

   Explanation

   B is the correct answer. As it states in the debug "Connection refused by remote host". Extra step needed on the remote router (R3) which is to activate the neighbor in address-family ipv6 unicast and run the "neighbor activate" command.

   Source: Adapted from community discussion — networkWiz

   Next question

4. Question 534 · 578 in bank

   

   Refer to the exhibit. R1 is multihomed to ISP1 and ISP2. uRPF strict mode has been configured on both interfaces uplinked to the ISPs. Traffic destined to the Internet over ISP1 returns to R1 via ISP2 and is immediately dropped. Which configuration changes address this issue and allow return traffic from the other ISP?

   • AR1(config)#interface fastethernet 0/1 R1(config-if)# ip verify unicast source reachable-via any
   • BR1(config)#interface fastethernet 0/1 R1(config-if)# ip verify unicast source reachable-via any allow-default
   • CR1(config)#interface fastethernet 0/0 R1(config-if)# no ip verify unicast source reachable-via any allow-default
   • DR1(config)#interface fastethernet 0/0 R1 (config-if)# ip verify unicast source reachable-via rx

   Show answer

   Answer: B

   Explanation

   allow-default is configured when the return of traffic is over on default route, I supose that ISP1 and ISP2 delivery both default route to client, not Full Route. So, B is correct.

   Source: Adapted from community discussion — tubirubs

   Next question

5. Question 535 · 578 in bank

   What is the purpose of the DHCPv6 Guard?

   • AIt messages between a DHCPv6 server and a DHCPv6 client (or relay agent).
   • BIt allows DHCPv6 reply and advertisements from (rogue) DHCPv6 servers.
   • CIt shows that clients of a DHCPv6 server are affected.
   • DIt blocks DHCPv6 messages from relay agents to a DHCPv6 server.

   Show answer

   Answer: D

   Explanation

   Answer is A This module describes the Dynamic Host Configuration Protocol version 6 (DHCPv6) Guard feature. This feature blocks DHCPreply and advertisement messages that originate from unauthorized DHCPservers and relay agents that forward DHCP packets from servers to clients. Client messages or messages sent by relay agentsfrom clientsto servers are not blocked. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/ip6-dhcpv6-guard.pdf#:~:text=Feature%20Name%20The%20DHCP%E2%80%94DHCPv6%20Guard%20feature%20blocks,from%20clients%20to%20servers%20are%20not%20blocked.

   Source: Adapted from community discussion — bk989

   References

   • Cisco documentation

   Next question

6. Question 536 · 578 in bank

   

   Refer to the exhibit. Customer B has decided not to receive any routes from R1 that originated outside the AS 100. Which AS path access list must the engineer choose to meet this requirement?

   

   • Aip as-path access-list 1 permit ^10[0-9]*$
   • Bip as-path access-list 1 permit ^100$
   • Cip as-path access-list 1 permit _100$
   • Dip as-path access-list 1 permit _100_

   Show answer

   Answer: B

   Explanation

   Correct answer is B since AS100 is the neighboring AS of R6 so it will be always the 1st in the AS path, and we don't want to see any other AS behind AS100, so it has to be ^100$

   Source: Adapted from community discussion — vitalizator

   Next question

7. Question 537 · 578 in bank

   

   Refer to the exhibit. An engineer is troubleshooting an issue using the debug ip packet command and notices that no time stamps are shown on R4 to establish the event time. Which configuration resolves this issue by showing time stamps regardless of the time zone in R4 logs?

   • Aservice timestamps log datetime localtime msec
   • Bservice timestamps debug datetime localtime msec
   • Cservice timestamps log datetime msec show-timezone
   • Dservice timestamps debug datetime msec show-timezone

   Show answer

   Answer: B

   Explanation

   The following example enables time stamps on logging messages, showing the current time and date relative to the local time zone, with the time zone name included: service timestamps log datetime localtime show-timezone

   Source: Adapted from community discussion — krobo

   Next question

8. Question 538 · 578 in bank

   How do devices operate in MPLS L3VPN topology?

   • AP routers provide connectivity between PE devices with MPLS switching.
   • BP and associated PE routers with IGP populate the VRF table in different VPNs.
   • CCE routers connect to the provider network and perform LSP functionality.
   • DP routers support PE to PE VPN tunnel without LSP functionality.

   Show answer

   Answer: A

   Next question

9. Question 539 · 578 in bank

   Refer to the exhibit.

   

   Which action resolves the adjacency issue?

   • AConfigure the same autonomous system numbers.
   • BMatch the hello interval timers.
   • CMatch the authentication keys.
   • DConfigure the same EIGRP process IDs.

   Show answer

   Answer: A

   Explanation

   Mismatched AS Numbers When you enter the debug eigrp packets hello command, it reveals that the router does not receive the Hello packets. https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/118974-technote-eigrp-00.html#anc36

   Source: Adapted from community discussion — wts

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

10. Question 540 · 578 in bank

    

    Refer to the exhibit. The engineer is reviewing the logs on the DENVER router and notices that this error message repeats constantly: *Jun 12 13:42:03.399: %TCP-6-BADAUTH: No MD5 digest from 10.40.1.1(27174) to 10.40.1.2(179) tableid - 0 Which action resolves the issue?

    • AConfigure OSPF link authentication on the router with IP address 10.40.1.1.
    • BConfigure NTP authentication on the router with IP address 10.40.1.1.
    • CConfigure BGP authentication on the router with IP address 10.40.1.2.
    • DConfigure BGP authentication on the router with IP address 10.40.1.1.

    Show answer

    Answer: D

    Explanation

    D is corerct but it must be done on both routers, however since we have only one option to choose D is correct anyway https://community.cisco.com/t5/switching/tcp-6-badauth-no-md5-digest/td-p/1627116

    Source: Adapted from community discussion — [Removed]

    References

    • Cisco documentation
    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 531. 578 questions available.