Cisco 300-410 Online Practice Questions and Exam Preparation

Cisco 300-410 Online Questions & Answers

• Question 711:

  Which command is the proper command for allowing RIP routing updates to be received on an interface while not allowing them to be sent out of the same interface?

  A. Router(config)# passive-interface e0/0
  B. Router(config-if)# passive-interface
  C. Router(config-if)# interface passive
  D. Router(config-router)# passive-interface e0/0
  E. Router(config-router)# interface passive e0/0
  D. Router(config-router)# passive-interface e0/0

  ---

  The correct answer is as follows:

  Router(config-router)# passive-interface e0/0

  The effect of the passive-interface command is dependent on the routing protocol running on the interface. For EIGRP, the router will not only stop sending routing updates, but also hellos, which means that it will not form a neighbor relationship with another EIGRP router on that interface. This is also the case with OSPF and IS-IS. With RIP, however, the router will continue to send hellos even as it stops sending routing updates, and it will still receive routing updates.

  The passive-interface command issued at the router configuration mode will prevent routing updates from being sent out on a specific interface while still allowing the interface to receive updates. This command can be used in any situation where you want the router to receive routing updates on a particular interface but not send any updates. This is helpful for security purposes, for preventing routing loops, or to control routing update traffic.

  The other options either use improper syntax or are executed at an incorrect prompt.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify loop prevention mechanisms

  References:

  Cisco > Home > Support > Technology Support > IP > IP Routing > Design > Design Technotes > How Does the Passive Interface Feature Work in EIGRP? Cisco > Cisco IOS IP Routing: Protocol-Independent Command Reference > passive-interface

• Question 712:

  The network administrator configured CoPP so that all HTTP and HTTPS traffic from the administrator device located at 172.16 1.99 toward the router CPU is limited to 500 kbps. Any traffic that exceeds this limit must be dropped.

  access-list 100 permit ip host 172.16.1.99 any ! class-map CM-ADMIN match access-group 100 ! policy-map PM-COPP class CM-ADMIN police 500000 conform-action transmit ! interface E0/0 service-policy input PM-COPP

  CoPP failed to capture the desired traffic and the CPU load is getting higher.

  Which two configurations resolve the issue? (Choose two.)

  A. interface E0/0 no service-policy input PM-COPP ! control-plane service-policy input PM-COPP
  B. policy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit ! control-plane service-policy input PM-COPP
  C. no access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80
  D. no access-list 100 access-list 100 permit tcp host 172.16.1.99 any eq 80 access-list 100 permit tcp host 172.16.1.99 any eq 443
  E. policy-map PM-COPP class CM-ADMIN no police 500000 conform-action transmit police 500 conform-action transmit
  A. interface E0/0 no service-policy input PM-COPP ! control-plane service-policy input PM-COPP

• Question 713:

  The following commands were executed on the perimeter router. The Fa1/0 interface in the router is the external interface.

  

  What will be the effect of these commands?

  A. all traffic will be blocked incoming
  B. traffic sourced from private IP addresses will be blocked incoming
  C. traffic destined for private IP addresses will be allowed incoming
  D. no traffic will be blocked incoming
  A. all traffic will be blocked incoming

  ---

  All traffic will be blocked incoming. While it appears on the surface that this list was designed to block incoming traffic sourced from private IP addresses, it is lacking a single permit statement. Due to the implied deny all at the end of the list, no traffic will be allowed incoming.

  Blocking incoming traffic from private IP addresses is a way to prevent IP spoofing, since there should be no reason for traffic from private IP addresses to be incoming from the Internet. However, you need to include a permit statement at the end to allow all other traffic types.

  Traffic destined for private IP addresses is not all that will be blocked by this command set. In fact, no traffic would be allowed. If there were a permit ip any any at the end of the list, then incoming traffic destined for private IP addresses would be allowed. This is probably not a great idea either, but if it a permit IP any were added at the end of the command set in the scenario, it would allow incoming traffic destined for private IP addresses.

  Objective:

  Infrastructure Security

  Sub-Objective:

  Configure and verify router security features

  References:

  Cisco > Cisco IOS Security Command Commands A to C > access-list Cisco > Cisco IOS Security Command Commands D to L > ip-group Prevent IP spoofing with the Cisco IOS

• Question 714:

  Refer to the exhibit.

  

  2. R2 and R5 receive traffic from R1 in AS 65101.

  The traffic from spoke to hub is dropping. The operations team observes:

  1. R2-R3 link is down due to the fiber cut.

  3. R3 and R6 receive traffic from R4 in AS 65201.

  Which configuration resolves the issue?

  A. R5(config)#router bgp 65101 R5(config-router)#neighbor 10.10.10.6 remote-as 65201 R5(config-router)#neighbor 10.10.10.6 update-source Loopback0 R5(config-router)#neighbor 10.10.10.6 ebgp-multihop 3
  B. R5(config)#router bgp 65101 R5(config-router)#no neighbor 10.0.0.18 update-source Loopback0
  C. R6(config)#router bgp 65101 R6(config-router)#no neighbor 10.0.0.17 update-source Loopback0
  D. R6(config)#router bgp 65201 R6(config-router)#neighbor 10.10.10.5 remote-as 65101 R6(config-router)#neighbor 10.10.10.5 update-source Loopback0 R6(config-router)#neighbor 10.10.10.5 ebgp-multihop 3
  B. R5(config)#router bgp 65101 R5(config-router)#no neighbor 10.0.0.18 update-source Loopback0

  ---

  The error message "BGP: 10.0.0.18 passive open failed - 10.0.0.17 is not update-source Loopback0's address (10.10.10.5)" indicates that there was a problem with establishing a BGP session between two routers with IP addresses 10.0.0.18 and 10.0.0.17.

  The message specifically states that the passive open attempt from the device with IP address 10.0.0.18 has failed because the device with IP address 10.0.0.17 is not using the correct source IP address when sending updates. Instead of using the IP address of the Loopback0 interface, which is 10.10.10.5, it is using a different IP address.

  In this case, it appears that the device with IP address 10.0.0.17 is using a different source IP address than the one expected by the device with IP address 10.0.0.18. Specifically, the device with IP address 10.0.0.17 should be configured to use the IP address of its Loopback0 interface (10.10.10.5 in this case) as the source address for BGP updates when communicating with the device at IP address 10.0.0.18.

• Question 715:

  Refer to the exhibit.

  

  An engineer wanted to set a tag of 30 to route 10 1.80.65/32 but it failed How is the issue fixed?

  A. Modify route-map ospf-to-eigrp permit 30 and match prefix-list ccnp2.
  B. Modify route-map ospf-to-eigrp permit 10 and match prefix-list ccnp2.
  C. Modify prefix-list ccnp3 to add 10.1.64.0/20 le 24
  D. Modify prefix-list ccnp3 to add 10.1.64.0/20 ge 32
  B. Modify route-map ospf-to-eigrp permit 10 and match prefix-list ccnp2.

• Question 716:

  Which of the following IPv6/IPv4 interoperability techniques routes both IP versions simultaneously?

  A. NAT-PT
  B. Dual stack
  C. 6 to4 tunnels
  D. Teredo
  B. Dual stack

  ---

  When the routers in the network are capable of routing both IPv6 and IPv4 traffic, it is referred to as dual stack. The dual stack routers simply recognize the version a frame is using and react accordingly to each frame.

  Network Address Translation- Port Translation (NAT-PT) is a service that runs on a router or server that converts IPv4 traffic to IPv6, and vice versa. This eliminates the need for the routers or clients to be dual stack- capable. When only one router exists between the IPv4 and the IPv6 networks, this will be the only option, since all other methods listed require a dual stack capable device on each end of the tunnel. The IPv6 to IPv4 mapping can be obtained by the host from a DNS server, or the mapping can

  be statically defined on the NAT device.

  6to4 tunnels can be created between dual stack routers or between a dual stack router and a dual stack client. In either case, each tunnel endpoint will have both an IPv6 and an IPv4 address. When traffic needs to cross an area where IPv6 is not supported, the tunnel can be used to transport the IPv6 packet within an IPv4 frame. When the frame reaches the end of the tunnel, the IPv4 header is removed and the IPv6 frame is further routed based on its IPv6 address.

  Teredo is an alternate tunneling mechanism that encapsulates the IPv6 frame in an IPv4 UDP packet. It has the added benefit of traversing a NAT device that is converting private IP addresses to public IP addresses. 6to4 tunnels cannot traverse NAT devices by converting private IP addresses to public IP addresses.

  Objective:

  Network Principles

  Sub-Objective:

  Recognize proposed changes to the network

  References:

  Cisco > Home > Products and Services > Cisco IOS and NX-OS Software > Cisco IOS Technologies > IPV6 > Product Literature > White Papers > Federal Agencies and the Transition to IPv6 Cisco > Cisco IOS IPv6 Configuration Guide, Release 15.2MT

• Question 717:

  Refer to the exhibit.

  

  The network administrator has configured the Customer Edge router (AS 64511) to send only summarized routes toward ISP-1 (AS 100) and ISP-2 (AS 200).

  

  After this configuration, ISP-1 and ISP-2 continue to receive the specific routes and the summary route.

  Which configuration resolves the issue?

  A. router bgp 64511 aggregate-address 172.16.20.0 255.255.252.0 summary-only
  B. router bgp 64511 neighbor 192.168.100.1 summary-only neighbor 192.168.200.2 summary-only
  C. interface E 0/0 ip bgp suppress-map BLOCK_SPECIFIC ! interface E 0/1 ip bgp suppress-map BLOCK_SPECIFIC ! ip prefix-list PL_BLOCK_SPECIFIC permit 172.16.20.0/22 ge 24 ! route-map BLOCK_SPECIFIC permit 10 match ip address prefix-list PL_BLOCK_SPECIFIC
  D. ip prefix-list PL_BLOCK_SPECIFIC deny 172.16.20.0/22 ge 22 ip prefix-list PL BLOCK SPECIFIC permit 172.16.20.0/22 ! route-map BLOCK_SPECIFIC permit 10 match ip address prefix-list PL_BLOCK_SPECIFIC ! router bgp 64511 aggregate-address 172.16.20.0 255 255.252.0 suppress-map BLOCKSPECIFIC
  A. router bgp 64511 aggregate-address 172.16.20.0 255.255.252.0 summary-only

  ---

  When the aggregate-address command is used within BGP routing, the aggregated address is advertised, along with the more specific routes. The exception to this rule is through the use of the summary-only command. The "summary-only" keyword suppresses the more specific routes and announces only the summarized route.

• Question 718:

  Which command shows a list of neighboring routers, their priorities, and their current state?

  A. show ip ospf
  B. show ip protocol
  C. show ip ospf database
  D. show ip ospf neighbor [detail]
  D. show ip ospf neighbor [detail]

  ---

  The show ip ospf neighbor [detail] command will display the OSPF information that is known about OSPF neighbors and the OSPF operating state with them.

  The commands below can be used to monitor and verify OSPF operation:

  show ip ospf - shows the number of times the SPF algorithm has run and the default LSU interval. show ip protocol - displays information about timers, filters, metric, etc. for the entire router. show ip ospf database - shows the router ID, the OSPF process ID, and the contents of the topological database.

  These commands do not show details about OSPF neighbors.

  Objective:

  Layer 3 Technologies

  Sub-Objective:

  Configure and verify OSPF neighbor relationship and authentication

  References:

  Cisco > Cisco IOS IP Routing Protocols Command Reference > IP Routing Protocol-Independent Commands:

  S through T > show ip ospf neighbor

• Question 719:

  DRAG DROP

  Drag and drop the MPLS VPN concepts from the left onto the correct descriptions on the right.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  + propagates VPN reachability information: multiprotocol BGP

  + distributes labels for traffic engineering: Resource Reservation Protocol

  + uniquely identifies a customer prefix: route distinguisher

  + controls the import/export of customer prefixes: route target

  Reference: https://www.rogerperkin.co.uk/featured/route-distinguisher-vs-route-target/

• Question 720:

  A company is looking to implement VPN between their Head Quarter and over 100+ Branch Offices. They are looking for a solution that:

  1. Reduces deployment complexity

  2. Simplifies branch communications

  3. Offers branch to branch connectivity.

  4. Is cost effective

  5. Offers strong encryption

  Select the best option from the below options that you would recommend to implement.

  A. MPLS
  B. IPSEC
  C. DMVPN
  D. GRE
  C. DMVPN