Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 21:

  Refer to the exhibits.

  

  When DMVPN is configured, which configuration allows spoke-to-spoke communication using loopback as tunnel source?

  A. Configure crypto isakmp key cisco address 0.0.0.0 on the hub.

  B. Configure crypto isakmp key Cisco address 200.1.0.0 255.255.0.0 on the hub.

  C. Configure crypto isakmp key cisco address 200.1.0.0 255.255.0.0 on the spokes.

  D. Configure crypto isakmp key cisco address 0.0.0.0 on the spokes.

  Correct Answer: D

  https://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd802b8f3c.html

• Question 22:

  Refer to the exhibit.

  

  The administrator can see the traps for the failed login attempts, but cannot see the traps of successful login attempts. What command is needed to resolve the issue?

  A. Configure logging history 2

  B. Configure logging history 3

  C. Configure logging history 4

  D. Configure logging history 5

  Correct Answer: D

  By default, the maximum severity sent as a syslog trap is warning. That is why you see syslog traps for login failures. Since a login success is severity 5 (notifications), those syslog messages will not be converted to traps. To fix this, configure:

  

  Note:

  The syntax of login block is:

  login block-for seconds attempts tries within seconds

• Question 23:

  An engineer must configure a Cisco router to initiate secure connections from the router to other devices in the network but kept failing.

  Which two actions resolve the issue? (Choose two.)

  A. Configure transport input ssh command on the console.

  B. Configure a domain name.

  C. Configure a crypto key to be generated.

  D. Configure a source port for the SSH connection to initiate.

  E. Configure a TACACS+ server and enable it.

  Correct Answer: BC

  Follow these guidelines when configuring the switch as an SSH server or SSH client:

  +

  An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.

  +

  If the SSH server is running on a stack master and the stack master fails, the new stack master uses the RSA key pair generated by the previous stack master + If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key pair has not been generated. Reconfigure thehostname and domain, and then enter the crypto key generate rsa command.

  +

  When generating the RSA key pair, the message No host name specified might appear. If it does, you must configure a hostname by using the hostname globalconfiguration command. + When generating the RSA key pair, the message No domain specified might appear. If it does, you must configure an IP domain name by using the ip domain-nameglobal configuration command. + When configuring the local authentication and authorization authentication method, make sure that AAA is disabled on the console.

• Question 24:

  An engineer is troubleshooting on the console session of a router and turns on multiple debug commands. The console screen is filled with scrolling debug messages that none of the commands can be verified if entered correctly or display any output.

  Which action allows the engineer to see entered console commands while still continuing the analysis of the debug messages?

  A. Configure the term no mon command globally.

  B. Configure the logging synchronous level all command.

  C. Configure the logging synchronous command.

  D. Configure the no logging console debugging command globally.

  Correct Answer: C

  Let's see how the "logging synchronous" command affect the typing command:

  Without this command, a message may pop up and you may not know what you typed if that message is too long. When trying to erase (backspace) your command, you realize you are erasing the message instead.

  

  With this command enabled, when a message pops up you will be put to a new line with your typing command which is very

  

• Question 25:

  Refer to the exhibit. BGP is flapping after the Copp policy is applied. What are the two solutions to fix the issue? (Choose two)

  

  A. Configure BGP in the COPP-CRITICAL-7600 ACL

  B. Configure a higher value for CIR under the default class to allow more packets during peak traffic

  C. Configure a higher value for CIR under the class COPP-CRITICAL-7600

  D. Configure a three-color policer instead of two-color policer under class COPP-CRITICAL-7600

  E. Configure IP CEF to CoPP policy and BGP to work

  Correct Answer: AB

  The policy-map COPP-7600 only rate-limit HTTP and HTTPS traffic (based on the ACL conditions) so any BGP packets will be processed in the class "class-default", which drops exceeded BGP packets. Therefore we have two ways to solve this problem:

  +

  Add BGP to the ACL with the statement "permit tcp any any eq bgp"

  +

  Configure higher value for CIR in default class as 2Mbps is too low for web traffic (http and https)

• Question 26:

  Which configuration enabled the VRF that is labeled "Inet" on FastEthernet0/0?

  A. R1(config)# ip vrf Inet R1(config-vrf)#interface FastEthernet0/0 R1(config-if)#ip vrf forwarding Inet

  B. R1(config)#router ospf 1 vrf Inet R1(config-router)#ip vrf forwarding FastEthernet0/0

  C. R1(config)#ip vrf Inet FastEthernet0/0

  D. R1(config)# ip vrf Inet R1(config-vrf)#ip vrf FastEthernet0/0

  Correct Answer: A

• Question 27:

  What is the minimum time gap required by the local system before putting a BFD control packet on the wire?

  A. Detect Mult

  B. Required Min Echo RX Interval

  C. Desired Min TX Interval

  D. Required Min RX Interval

  Correct Answer: C

  Desired Min TX Interval: This is the minimum interval, in microseconds, that the local system would like to use when transmitting BFD Control packets, less any jitterapplied. The value zero is reserved. Required Min Echo RX Interval: This is the minimum interval, in microseconds, between received BFD Echo packets that this system is capable of supporting, less anyjitter applied by the sender. If this value is zero, the transmitting system does not support the receipt of BFD Echo packets.

• Question 28:

  Refer to the exhibit.

  

  Router DHCP is configured to lease IPv4 and IPv6 addresses to clients on ALS1 and ALS2. Clients on ALS2 receive IPv4 and IPv6 addresses. Clients on ALS1 receive IPv4 addresses. Which configuration on DSW1 allows clients on ALS1 to receive IPv6 addresses?

  

  A. DSW1(dhcp-config)# default-router 2002:A04:A01::A04:A01

  B. DSW1(config)# ipv6 dhcp relay destination 2002:404:404::404:404 GigabitEthernet 1/2

  C. DSW1(config)#ipv6 route 2002:404:404::404:404/128 FastEthernet 1/0

  D. DSW1(config-if)# ipv6 helper address 2002:404:404::404:404

  Correct Answer: B

• Question 29:

  Refer to the exhibit. Bangkok is using ECMP to reach to the 192.168.5.0/24 network. The administrator must configure Bangkok in such a way that Telnet traffic from 192.168.3.0/24 and 192.168.4.0/24 networks uses the HongKong router as the preferred router. Which set of configurations accomplishes this task?

  

  A. access-list 101 permit ip 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255 access-list 101 permit ip 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255 ! route-map PBR1 permit 10 match ip address 101 set ip next-hop 172.18.1.2 interface Ethernet0/3 ip policy route-map PBR1

  B. access-list 101 permit tcp 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255 eq 23 access-list 101 permit tcp 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255 eq 23 route-map PBR1 permit 10 match ip address 101 set ip next-hop 172.18.1.2 interface Ethernet0/1 ip policy route-map PBR1

  C. access-list 101 permit tcp 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255 eq 23 access-list 101 permit tcp 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255 eq 23 route-map PBR1 permit 10 match ip address 101 set ip next-hop 172.18.1.2 interface Ethernet0/3 ip policy route-map PBR1

  D. access-list 101 permit ip 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255 access-list 101 permit ip 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255 route-map PBR1 permit 10 match ip address 101 set ip next-hop 172.18.1.2 interface Ethernet0/1 ip policy route-map PBR1

  Correct Answer: C

  We need to use Policy Based Routing (PBR) here on Bangkok router to match the traffic from 192.168.3.0/24 and 192.168.4.0/24 and "set ip next-hop" to HongKong router(172.18.1.2 in this case). Note: Please notice that we have to apply the PBR on incoming interface e0/3 to receive traffic from 192.168.3.0/24 and 192.168.4.0/24.

• Question 30:

  Refer to the exhibit. Which action resolves the authentication problem?

  

  A. Configure the user name on the TACACS+ server

  B. Configure the UDP port 1812 to be allowed on the TACACS+ server

  C. Confiqure the TCP port 49 to be reachable by the router

  D. Configure the same password between the TACACS+ server and router.

  Correct Answer: D

  From the last line of the output, we notice that the result was "Invalid AUTHEN packet". Therefore something went wrong with the username or password.