Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 541:

  The network administrator configured R1 for Control Plane Policing so that the inbound Telnet traffic is policed to 100 kbps. This policy must not apply to traffic coming in from 10.1.1.1/32 and 172.16.1.1/32. The administrator has configured this: The network administrator is not getting the desired results.

  

  Which set of configurations resolves this issue?

  A. no access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any

  B. control-plane no service-policy input PM-CoPP ! interface Ethernet 0/0 service-policy input PM-CoPP

  C. no access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any ! Interface E 0/0 service-policy input PM-CoPP

  D. control-plane no service-policy input PM-CoPP service-policy input PM-CoPP

  Correct Answer: A

  Packets that match a deny rule are excluded from that class and cascade to the next class (if one

  exists) for classification. Therefore if we don't want to CoPP traffic from 10.1.1.1/32 and 172.16.1.1/32, we must "deny" them in the ACL.

• Question 542:

  Refer to the exhibit.

  

  A network administrator successfully logs in to a switch using SSH from a (RADIUS server When the network administrator uses a console port to access the switch the RADIUS server returns shell:priv-lvl=15'' and the switch asks to enter the enable command \ the command is entered, it gets rejected. Which command set is used to troubleshoot and reserve this issue?

  A. line con 0 aaa authorization console privl5 ! line vty 0 4 authorization exec

  B. line con 0 aaa authorization console ! line vty 0 4 authorization exec

  C. line con 0 aaa authorization console authorization priv15 ! line vty 0 4 transport input ssh

  D. line con 0 aaa authorization console authorization exec ! line vty 0 4 transport input ssh

  Correct Answer: D

  Reference: https://flylib.com/books/en/1.233.1.74/1/

• Question 543:

  Refer to the exhibit.

  

  An engineer is troubleshooting a TACACS problem.

  Which action resolves the issue?

  A. Configure a matching TACACS server IP.

  B. Configure a matching preshared key.

  C. Generate authentication from a relative source interface.

  D. Apply a configured AAA profile to the VTY.

  Correct Answer: B

  Reference: https://community.cisco.com/t5/network-access-control/issues-with-tacacs-authentication/td-p/3412001

  The last line shows us the reason, which is "Invalid AUTHEN packet (check keys)" so the most likely cause of this problem is key mismatch.

• Question 544:

  Refer to the exhibit.

  

  An engineer configures the router 10.1.100.10 for EIGRP autosummarization so that R1 should receive the summary route of 10.0.0.0/8. However, R1 receives more specific /24 routes. Which action resolves this issue?

  A. Router R1 should configure ip summary address eigrp (AS number) 10.0.0.0 255.0.0.0 for the R1 Fast Ethernet 0/0 connected interface.

  B. Router R1 should configure ip route 10.0.0.0 255.0.0.0 null 0 for the routes that are received on R1.

  C. Router 10.1.100.10 should configure ip route 10.0.0.0 255.0.0.0 null 0 for the routes that are summarized toward R1.

  D. Router 10.1.100.10 should configure ip summary address eigrp (AS number) 10.0.0.0 255.0.0.0 for the R1 Fast Ethernet 0/0 connected interface.

  Correct Answer: D

• Question 545:

  What is a characteristic of Layer 3 MPLS VPNs?

  A. Traffic engineering capabilities provide QoS and SLAs.

  B. Traffic engineering supports multiple IGP instances.

  C. LSP signaling requires the use of unnumbered IP links for traffic engineering.

  D. Authentication is performed by using digital certificates or preshared keys.

  Correct Answer: A

  MPLS traffic engineering supports only a single IGP process/instance

  The MPLS traffic engineering feature does not support routing and signaling of LSPs over unnumbered IP links.

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-3s/mp-te-path-setup-xe-3s-book/mp-te-enhance-xe.html https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_diffserv/configuration/15-mt/mp-tediffserv-15-mt-book/mp-te-diffserv-aw.html

• Question 546:

  How does an MPLS Layer 3 VPN differentiate the IP address space used between each VPN?

  A. by RT

  B. by address family

  C. by RD

  D. by MP-BGP

  Correct Answer: C

• Question 547:

  R1 and R2 are configured as eBGP neighbors. R1 is in AS100 and R2 is in AS200. R2 is advertising these networks to R1:

  172.16.16.0/20 172.16.3.0/24 172.16.4.0/24 192.168.1.0/24 192.168.2.0/24 172.16.0.0/16

  The network administrator on R1 must improve convergence by blocking all subnets of 172.16.0.0/16 major network with a mask lower than 23 from coming in.

  Which set of configurations accomplishes the task on R1?

  A. ip prefix-list PL-1 deny 172.16.0.0/16 ge 23 ip prefix-list PL-1 permit 0.0.0.0/0 le 32 ! router bgp 100 neighbor 192.168.100.2 remote-as 200 neighbor 192.168.100.2 prefix-list PL-1 in

  B. ip prefix-list PL-1 deny 172.16.0.0/16 le 23 ip prefix-list PL-1 permit 0.0.0.0/0 le 32 ! router bgp 100 neighbor 192.168.100.2 remote-as 200 neighbor 192.168.100.2 prefix-list PL-1 in

  C. ip prefix-list PL-1 deny 172.16.0.0/16 ip prefix-list PL-1 permit 0.0.0.0/0 ! router bgp 100 neighbor 192.168.100.2 remote-as 200 neighbor 192.168.100.2 prefix-list PL-1 in

  D. access-list 1 deny 172.16.0.0 0.0.254.255 access-list 1 permit any ! router bgp 100 neighbor 192.168.100.2 remote-as 200 neighbor 192.168.100.2 distribute-list 1 in

  Correct Answer: A

• Question 548:

  Refer to the exhibit. An engineer has configured R1 as EIGRP stub router. After the configuration, router R3 failed to reach to R2 loopback address.

  

  Which action advertises R2 loopback back into the R3 routing table?

  A. Add a static route for R2 loopback address in R1 and redistribute it to advertise to R3.

  B. Use a leak map on R1 that matches the required prefix and apply it with the distribute list command toward R3.

  C. Use a leak map on R3 that matches the required prefix and apply it with the EIGRP stub feature.

  D. Add a static null route for R2 loopback address in R1 and redistribute it to advertise to R3.

  Correct Answer: B

  The EIGRP stub feature is useful to prevent unnecessary EIGRP queries and to filter some routes that you advertise. What if you want to configure your router as a stub router but still make an exception to some routes that it advertises? That is possible with the leak-map feature. This is how to configure leak-map in this question:

  R1(config)#ip access-list standard R2_L0 R1(config-std-nacl)#permit host 2.2.2.2 R1(config)#route-map R2_L0_LEAK R2(config-route-map)#match ip address R2_L0 R1(config)#router eigrp 1 R1(config-router)#eigrp stub leak-map R2_L0_LEAK

• Question 549:

  Refer to the exhibit. A network administrator sets up an OSPF routing protocol for a DMVPN network on the hub router.

  

  

  Which configuration command is required to establish a DMVPN tunnel with multiple spokes?

  A. ip ospf network point-to-point on the hub router

  B. ip ospf network point-to-multipoint on one spoke router

  C. ip ospf network point-to-multipoint on both spoke routers

  D. ip ospf network point-to-point on both spoke routers

  Correct Answer: C

• Question 550:

  Refer to the exhibit. The Internet traffic should always prefer Site-A ISP-1 if the link and BGP connection are up; otherwise, all Internet traffic should go to ISP-2. Redistribution is configured between BGP and OSPF routing protocols, and it is not working as expected.

  

  What action resolves the issue?

  A. Set OSPF Cost 200 at Site-A RTR1, and set OSPF Cost 100 at Site-B RTR2.

  B. Set metric-type 2 at Site-A RTR1, and set metric-type 1 at Site-B RTR2.

  C. Set metric-type 1 at Site-A RTR1, and set metric-type 2 at Site-B RTR2.

  D. Set OSPF Cost 100 at Site-A RTR1, and set OSPF Cost 200 at Site-B RTR2.

  Correct Answer: C

  OSPF type 1 route is always preferred over a type 2 route for the same destination so we can set metric-type 1 at Site-A RTR1 so that it is preferred over Site-B RTR2.

  Note:

  Routes are redistributed in OSPF as either type 1 (E1) routes or type 2 (E2) routes, with type 2 being the default.

  1.

  A type 1 route has a metric that is the sum of the internal OSPF cost and the external redistributed cost.

  2.

  A type 2 route has a metric equal only to the redistributed cost.

  3.

  If routes are redistributed into OSPF as type 2 then every router in the OSPF domain will see the same cost to reach the external networks.

  4.

  If routes are redistributed into OSPF as type 1, then the cost to reach the external networks could vary from router to router.