Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 461:

  A newly installed spoke router is configured for DMVPN with the ip mtu 1400 command. Which configuration allows the spoke to use fragmentation with the maximum negotiated TCP MTU over GRE?

  A. ip tcp adjust-mss 1360 crypto ipsec fragmentation after-encryption

  B. ip tcp adjust-mss 1360 crypto ipsec fragmentation mtu-discovery

  C. ip tcp payload-mtu 1360 crypto ipsec fragmentation mtu-discovery

  D. ip tcp payload-mtu 1360 crypto ipsec fragmentation after-encryption

  Correct Answer: A

  There is no "ip tcp payload-mtu" command so the correct answer should be "ip tcp adjust-mss".

  Note: The "ip tcp adjust-mss 1360" command will signal the source and destination device during the three-way handshake to use the TCP MSS size of 1360 bytes so that if they create the full size packet there will still not be any drop/

  fragmentation on the router.

  We tested with Cisco IOSv15.4 but could not find the "crypto ipsec fragmentation mtu-discovery" command.

• Question 462:

  Which two components are required for MPLS Layer 3 VPN configuration? (Choose two)

  A. Use MP-BGP for customer routes.

  B. Use LDP for customer routes.

  C. Use a unique RD per customer VRF.

  D. Use pseudowire for Layer 2 routes

  E. Use OSPF between PE and CE

  Correct Answer: AC

• Question 463:

  Which method provides failure detection in BFD?

  A. short duration, high overhead

  B. short duration, low overhead

  C. long duration, high overhead

  D. long duration, low overhead

  Correct Answer: B

• Question 464:

  A network administrator added a new spoke site with dynamic IP on the DMVPN network. Which configuration command passes traffic on the DMVPN tunnel from the spoke router?

  A. ip nhrp registration dynamic

  B. ip nhrp registration ignore

  C. ip nhrp registration no-registration

  D. ip nhrp registration no-unique

  Correct Answer: D

  "ip nhrp registration no-unique": allow the client to not set the unique flag in the NHRP packets. This is useful when a station has a dynamic IP address that could change over time.

• Question 465:

  A customer requested a GRE tunnel through the provider network between two customer sites using loopback to hide internal networks. Which configuration on R2 establishes the tunnel with R1?

  A. R2(config)#interface Tunnel1 R2(config-if)#ip address 172.20.1.2 255.255.255.0 R2(config-if)#ip mtu 1500 R2(config-if}#ip tcp adjust-mss 1360 R2(config-if)#tunnel source 192.168.20.1 R2(config-if)#tunnel destination 10.10.1.1

  B. R2(config)#interface Tunnel1 R2(config-if)#ip address 172.20.1.2 255.255.255.0 R2(config-if)#ip mtu 1400 R2(config-if)#ip tcp adjust-mss 1360 R2(config-if)#tunnel source 192.168.20.1 R2(config-if)#tunnel destination 192.168.10.1

  C. R2(config)#interface Tunnel1 R2(config-if)#ip address 172.20.1.2 255.255.255.0 R2(config-if)#ip mtu 1400 R2(config-if)#ip tcp adjust-mss 1360 R2(config-if)#tunnel source 10.10.2.2 R2(config-if)#tunnel destination 10.10.1.1

  D. R2(config)#interface Tunnel1 R2(config-if)#ip address 172.20.1.2 255.255.255.0 R2(config-if)#ip mtu 1500 R2(config-if)#ip tcp adjust-mss 1360 R2(config-if)#tunnel source 10.10.2.2 R2(config-if)#tunnel destination 10.10.1.1

  Correct Answer: C

• Question 466:

  An engineer failed to run diagnostic commands on devices using Cisco DNA center, which action in Cisco DNA center resolves the issue?

  A. Enable Secure Shell.

  B. Enable Command Runner.

  C. Enable APIs

  D. Enable CDP.

  Correct Answer: B

• Question 467:

  Which two components are required for MPLS Layer 3 VPN configuration? (Choose two)

  A. Use pseudowire for Layer 2 routes

  B. Use MP-BGP for customer routes

  C. Use OSPF between PE and CE

  D. Use a unique RD per customer VRF

  E. Use LDP for customer routes

  Correct Answer: BD

• Question 468:

  Refer to the exhibit.

  

  R1#show ip route 1.0.0.0/32 is subnetted, 1 subnets C 1.1.1.1/32 is directly connected, Loopback0 2.0.0.0/32 is subnetted, 1 subnets O 2.2.2.2/32 [110/2] via 10.10.10.2, 00:09:30, GigabitEthernet0/0/0 10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks C 10.10.10.0/30 is directly connected, GigabitEthernet0/0/0 L 10.10.10.1/32 is directly connected, GigabitEthernet0/0/0 C 10.10.20.0/30 is directly connected, GigabitEthernet0/0/1 L 10.10.20.1/32 is directly connected, GigabitEthernet0/0/1 D 10.20.10.0/30 [90/3072] via 10.10.10.2, 00:09:30, GigabitEthernet0/0/0 O 10.30.10.0/30 [90/3328] via 10.10.10.2, 00:05:48, GigabitEthernet0/0/0 S 10.40.10.0/30 [1/0] via 10.10.20.2

  Routers R1, R2, R3, and R4 use EIGRP. However, traffic always prefers R1 to R5 backup links in non failure scenarios. Which configuration resolves the issue?

  A. R1(config)#no ip route 10.40.10.0 255.255.255.252 10.10.20.2 R1(config)#ip route 10.40.10.0 255.255.255.252 10.10.20.2 115

  B. R1(config)#int gigabitEthernet 0/0/0 R1 (config-if)#bandwidth 10000000

  C. R1(config-if)#int gigabitEthernet 0/0/0 R1(config-if)#bandwidth 10000

  D. R1(config)#no ip route 10.40.10.0 255.255.255.252 10.10.20.2 R1(config)#ip route 0.0.0.0 0.0.0.0 10.10.10.2

  Correct Answer: A

• Question 469:

  Refer to the exhibit. An engineer is trying to add an encrypted user password that should not be visible in the router configuration. Which two configuration commands resolve the issue? (Choose two)

  

  A. service password-encryption

  B. username Admin password 5 Cisco@123

  C. no service password-encryption

  D. username Admin password Cisco@123

  E. password encryption aes

  F. username Admin secret Cisco@123

  Correct Answer: AF

  We can use the "service password-encryption" to encrypt all current and future passwords. Or we can use the "secret" keyword to encrypt the password with MD5 (although MD5 is not secured nowadays).

  Note: The command "service password-encryption" enables the AES password encryption feature (type 6) but we have to converts existing plain or weakly encrypted passwords to type-6 encrypted passwords with the "encryption re-encrypt

  obfuscated" command.

  You can enable the AES password encryption feature without a primary key, but encryption starts only when a primary key is present in the system with the command key config-key password-encrypt super-secret-password.

  Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3400s/sw/93x/security/configuration/guide/Cisco-n3400-nx-ossecurity-configuration-guide-93x/m-configuring-password-encryption-922.pdf

• Question 470:

  An engineer configured a router with this configuration

  ip access-hst DENY TELNET 10 deny tcp any any eq 23 log-input The router console starts receiving log message : %SEC-6-IPACCESSLOGP: list DENY_TELNET denied tcp

  192.168.1.10(1022)(FastEthernet1/0 D508.89gb.003f) ->192.168.2.20(23), 1 packet Which action stops messages on the console while still denying Telnet?

  A. Configure a 20 permit ip any any command

  B. Remove log-Input keyword from the access list.

  C. Replace log-input keyword with the log keyword in the access list.

  D. Configure a 20 permit ip any any log-input command.

  Correct Answer: B