300-410 practice questions 61–70

1. Question 61 · 578 in bank

   Refer to the exhibit.

   

   A network administrator is trying to access a branch router using TACACS+ username and password credentials, but the administrator cannot log in to the router because the WAN connectivity is down. The branch router has following AAA configuration: aaa new-model aaa authorization commands 15 default group tacacs+ aaa accounting commands 1 default stop-only group tacacs+ aaa accounting commands 15 default stop-only group tacacs+ tacacs-server host 10.100.50.99 tacacs-server key Ci$co123 Which command will resolve this problem when WAN connectivity is down?

   • Aaaa authentication login console group tacacs+ enable
   • Baaa authentication login default group tacacs+ local
   • Caaa authentication login default group tacacs+ enable
   • Daaa authentication login default group tacacs+ console

   Show answer

   Answer: B

   Explanation

   aaa new-model aaa authorization commands 15 default group tacacs+ aaa accounting commands 1 default stop-only group tacacs+ aaa accounting commands 15 default stop-only group tacacs+ tacacs-server host 10.100.50.99 tacacs-server key Ci$co123 Both B and C would work (we do not see the rest of the config, we do not know whether users or enable secrets are configured)

   Source: Adapted from community discussion — bogd

   Next question

2. Question 62 · 578 in bank

   Refer to the exhibit.

   

   An engineer is troubleshooting failed access by contractors to the business application server via Telnet or HTTP during the weekend. Which configuration resolves the issue?

   • AR1 no access-list 101 permit tcp 10.3.3.0 0.0.0.255 host 10.1.1.3 eq telnet time-range Contractor
   • BR1 time-range Contractor no periodic weekdays 8:00 to 16:30 periodic daily 8:00 to 16:30
   • CR4 time-range Contractor no periodic weekdays 17:00 to 23:59 periodic daily 8:00 to 16:30
   • DR4 no access-list 101 permit tcp 10.3.3.0 0.0.0.255 host 10.1.1.3 eq telnet time-range Contractor

   Show answer

   Answer: B

   Explanation

   Contractors need to connect during weekend but time-range is configured for weekdays. Answer B is correct because you have to delete old time-range statement for weekdays, and configure new for all days (daily). C is not correct because bad time-range (17:00 to 23:59).

   Source: Adapted from community discussion — daloslav

   References

   • Cisco documentation

   Next question

3. Question 63 · 578 in bank

   Select 2

   What are two characteristics of IPv6 Source Guard? (Choose two.)

   • Arequires the user to configure a static binding
   • Bused in service provider deployments to protect DDoS attacks
   • Crequires that validate prefix be enabled
   • Drequires IPv6 snooping on Layer 2 access or trunk ports
   • Erecovers missing binding table entries

   Show answer

   Answer: AD

   Explanation

   This is how I see it: For source guard to operate, binding table entries need to exists. So, A or D are required. A) static binding -> yes, or use ipv6 snooping #security-level glean to populate the binding table B) to protect against DDOS -> yes, but not just for service providers (it's rather prefix guard) C) can be configured with validate address or validate prefix (not explicitly needed) D) snooping on L2 access or trunk -> yes, or create static bindings E) not source guard itself, but the snooping feature glean recovers missing binding table entries

   Source: Adapted from community discussion — HungarianDish_111

   Next question

4. Question 64 · 578 in bank

   DRAG DROP - Drag and drop the IPv6 first hop security device roles from the left onto the corresponding descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_011011.pdf

   Source: Adapted from community discussion — t1s

   

   Next question

5. Question 65 · 578 in bank

   Refer to the exhibit. What is the result of applying this configuration?

   

   • AThe router can form BGP neighborships with any other device.
   • BThe router cannot form BGP neighborships with any other device.
   • CThe router cannot form BGP neighborships with any device that is matched by the access list named ג€BGPג€.
   • DThe router can form BGP neighborships with any device that is matched by the access list named ג€BGPג€.

   Show answer

   Answer: C

   Explanation

   with this (below) ACL both incoming (179) and outgoing (179) are blocked. BGP cannot be established. R7#show ip access-lists Extended IP access list ACL_BGP 10 permit tcp any any eq bgp (45 matches) 20 permit tcp any eq bgp any (3 matches) R7#sh policy-map control-plane Control Plane Service-policy input: CoPP_IN Class-map: CL_BGP (match-all) 76 packets, 4826 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group name ACL_BGP drop Class-map: class-default (match-any) 237 packets, 55172 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: any R7#

   Source: Adapted from community discussion — Zizu007

   References

   • cisco.com documentation

   Next question

6. Question 66 · 578 in bank

   The network administrator configured R1 for Control Plane Policing so that the inbound Telnet traffic is policed to 100 kbps. This policy must not apply to traffic coming in from 10.1.1.1/32 and 172.16.1.1/32. The administrator has configured this: access-list 101 permit tcp host 10.1.1.1 any eq 23 access-list 101 permit tcp host 172.16.1.1 any eq 23 ! class-map CoPP-TELNET match access-group 101 ! policy-map PM-CoPP class CoPP-TELNET police 100000 conform transmit exceed drop ! control-plane service-policy input PM-CoPP The network administrator is not getting the desired results. Which set of configurations resolves this issue?

   • Ano access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any
   • Bcontrol-plane no service-policy input PM-CoPP ! interface Ethernet 0/0 service-policy input PM-CoPP
   • Cno access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any ! Interface E 0/0 service-policy input PM-CoPP
   • Dcontrol-plane no service-policy input PM-CoPP service-policy input PM-CoPP

   Show answer

   Answer: A

   Explanation

   A is the correct answer. reference : https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/control_plane_policing_copp.pdf Page 8. This example shows how to allow full access for Telnet to the switch from a host in a specific subnet and police the rest of the subnet: Router(config)# access-list 121 deny tcp host 10.86.183.3 any eq telnet Router(config)# access-list 121 permit tcp 10.86.183.0 0.0.0.255 any eq telnet

   Source: Adapted from community discussion — WAKIDI

   References

   • Cisco documentation

   Next question

7. Question 67 · 578 in bank

   

   Refer to the exhibit. A network administrator successfully logs in to a switch using SSH from a RADIUS server. When the network administrator uses a console port to access the switch, the RADIUS server returns shell:priv-lvl=15" and the switch asks to enter the enable command. When the command is entered, it gets rejected. Which command set is used to troubleshoot and resolve this issue?

   • Aline con 0 aaa authorization console privl5 ! line vty 0 4 authorization exec
   • Bline con 0 aaa authorization console ! line vty 0 4 authorization exec
   • Cline con 0 aaa authorization console authorization priv15 ! line vty 0 4 transport input ssh
   • Dline con 0 aaa authorization console authorization exec ! line vty 0 4 transport input ssh

   Show answer

   Answer: D

   Explanation

   Almost sure it is D, but the command is a bit broken, D: "line con 0 aaa authorization console authorization exec ! line vty 0 4 transport input ssh " It needs to be: 1. globally enable authorization on console: aaa authorization console 2. move to line console 0: line con 0 3. Set the group to be used for authorization (note default is missing in the answer): authorization exec default 4. Go to line vty 0 4 (will set the same twice on next step): line vty 0 4 5. setting transport again to ssh: transport input ssh Note that "console authentication == DISABLED by default": more info https://flylib.com/books/en/1.233.1.74/1/ So concluding, answer is bad quality, but D seems best of them.

   Source: Adapted from community discussion — Pietjeplukgeluk

   Next question

8. Question 68 · 578 in bank

   

   Refer to the exhibit. An engineer is troubleshooting a TACACS problem. Which action resolves the issue?

   • AConfigure a matching TACACS server IP.
   • BConfigure a matching preshared key.
   • CGenerate authentication from a relative source interface.
   • DApply a configured AAA profile to the VTY.

   Show answer

   Answer: B

   References

   • cisco.com documentation

   Next question

9. Question 69 · 578 in bank

   The network administrator configured CoPP so that all HTTP and HTTPS traffic from the administrator device located at 172.16 1.99 toward the router CPU is limited to 500 kbps. Any traffic that exceeds this limit must be dropped. access-list 100 permit ip host 172.16.1.99 any ! class-map CM-ADMIN match access-group 100 ! policy-map PM-COPP class CM-ADMIN police 500000 conform-action transmit ! interface E0/0 service-policy input PM-COPP CoPP failed to capture the desired traffic and the CPU load is getting higher. Which two configurations resolve the issue? (Choose two.)

   • Ainterface E0/0 no service-policy input PM-COPP ! control-plane service-policy input PM-COPP
   • Bpolicy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit ! control-plane service-policy input PM-COPP
   • Cno access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80
   • Dno access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80 access-list 100 permit tcp host 172.16.1.99 any eq 443
   • Epolicy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit

   Show answer

   Answer: A

   Explanation

   I would say A an D as well. but should not we add an exceed-action drop at the and as well? it says that any exceeding traffic should be dropped....

   Source: Adapted from community discussion — rogabor81

   Next question

10. Question 70 · 578 in bank

    

    Refer to the exhibit. While monitoring VTY access to a router, an engineer notices that the router does not have any filter and anyone can access the router with username and password even though an ACL is configured. Which command resolves this issue?

    • Aaccess-class INTERNET in
    • Bip access-group INTERNET in
    • Cipv6 traffic-filter INTERNET in
    • Dipv6 access-class INTERNET in

    Show answer

    Answer: D

    Explanation

    Answer is D: IPv6 access-class vs IPv6 traffic-filter The difference depends on whether you want to filter IPv6 traffic sent *to* the router or *through* the router. The 'ipv6 traffic-filter' command is used to filter IPv6 traffic flowing through an interface: Command reference (with example): http://www.cisco.com/en/US/docs/ios/ipv6/command/reference/ipv6_09.html#wp2297000 The 'ipv6 access-class' command is used to filter IPv6 traffic destined to the router (i.e. management traffic). Command reference (with example): http://www.cisco.com/en/US/docs/ios/ipv6/command/reference/ipv6_05.html#wp2274594

    Source: Adapted from community discussion — TECH3K3

    References

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-410 practice, question 61. 578 questions available.