Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 51:

  How does an MPLS Layer 3 VPN function?

  A. set of sites use multiprotocol BGP at the customer site for aggregation

  B. multiple customer sites interconnect through service provider network to create secure tunnels between customer edge devices

  C. set of sites interconnect privately over the Internet for security

  D. multiple customer sites interconnect through a service provider network using customer edge to provider edge connectivity

  Correct Answer: D

  A Multiprotocol Label Switching(MPLS) Layer 3 Virtual Private Network (VPN) consists of a set of sites that are interconnected by means of an MPLS provider core network. At each customer site, one or more customer edge (CE) routers attach to one or more provider edge (PE) routers.

  Reference: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-5/lxvpn/configuration/guide/b-l3vpn-cg-asr9000-65x/b-l3vpn-cg-asr9000-65x_chapter_010.pdf

• Question 52:

  An engineer configured Reverse Path Forwarding on an interface and noticed that the routes are dropped when a route lookup fails on that interface for a prefix that is available in the routing table Which interface configuration resolves the issue?

  A. ip verify unicast source reachable-via rx

  B. ip verify unicast source reachable-via any

  C. ip verify unicast source reachable-via allow-default

  D. ip verify unicast source reachable-via 12-src

  Correct Answer: B

  According to this question, uRPF is running in strict mode because packets are dropped even when that route exists in the routing table. Maybe packets are dropped because the receiving interface is different from the interface the local

  router uses to send packets to that destination.

  The ip verify unicast source reachable-via rx command enables Unicast RPF in strict mode.

  To enable loose mode, administrators can use the any option (ip verify unicast source reachable-via any). In loose mode, it doesn't matter if we use this interface to reach the source or not.

  

  The allow-default option allows the use of the default route in the source verification process.

• Question 53:

  What does the PE router convert the Ipv4 prefix to within an MPLS VPN?

  A. It is defined in RFC 3038 and 3039.

  B. It requires MPLS Traffic Engineering.

  C. It advertises labels per Forwarding Equivalence Class.

  D. It must use Resource Reservation Protocol.

  Correct Answer: B

• Question 54:

  Which configuration feature should be used to block rogue router advertisements instead of using the IPv6 Router Advertisement Guard feature?

  A. VACL blocking broadcast frames from nonauthorized hosts

  B. PVLANs with promiscuous ports associated to route advertisements and isolated ports for nodes

  C. PVLANs with community ports associated to route advertisements and isolated ports for nodes

  D. IPv4 ACL blocking route advertisements from nonauthorized hosts

  Correct Answer: B

  The IPv6 Router Advertisement Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement guard messages that arrive at the network device platform. Router Advertisements are used by devices to announce themselves on the link. The IPv6 Router Advertisement Guard feature analyzes these router advertisements and filters out router advertisements that are sent by unauthorized devices. Certain switch platforms can already implement some level of rogue RA filtering by the administrator configuring Access Control Lists (ACLs) that block RA ICMP messages that might be inbound on "user" ports.

• Question 55:

  When determining if a system is capable of support, what is the minimum time spacing required for a BFD control packet to receive once a control packet is arrived?

  A. Desired Min TX Interval

  B. Detect Mult

  C. Required Min RX Interval

  D. Required Min Echo RX Interval

  Correct Answer: C

• Question 56:

  Which two protocols work in the control plane of P routers across the MPLS cloud? (choose two)

  A. LSP

  B. RSVP

  C. ECMP

  D. LDP

  E. MPLS OAM

  Correct Answer: BD

• Question 57:

  How is VPN routing information distributed in an MPLS network?

  A. It is controlled through the use of RD.

  B. The top level of the customer data packet directs it to the correct CE device.

  C. It is established using VPN IPsec peers.

  D. It is controlled using of VPN target communities.

  Correct Answer: D

  The distribution of virtual private network (VPN) routing information is controlled through the use of VPN route target communities, implemented by Border Gateway Protocol (BGP) extended communities. Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/15-mt/mp-l3-vpns-15-mt-book/mp-cfg-layer3-vpn.html

• Question 58:

  Refer to the exhibit.

  

  Which two commands provide the administrator with the information needed to resolve the issue? (Choose two.)

  A. debug snmp packet

  B. debug snmp engine-id

  C. show snmp user

  D. debug snmpv3 engine-id

  E. show snmpv3 user

  Correct Answer: AC

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/command/snmp-xe-3se-3850-cr-book/snmp-xe-3se-3850-cr-book_chapter_0110.html

• Question 59:

  Refer to the exhibit BGP and EIGRP are mutually redistributed on R3, and EIGRP and OSPF are mutually redistributed on R1. Users report packet loss and interruption of service to applications hosted on the 10.1.1.0/24 prefix. An engineer tested the link from R3 to R4 with no packet loss present but has noticed frequent routing changes on R3 when running the debug ip route command. Which action stabilizes the service?

  

  A. Reduce frequent OSPF SPF calculations on R3 that cause a high CPU and packet loss on traffic traversing R3.

  B. Tag the 10.1.1.0/24 prefix and deny the prefix from being redistributed into OSPF on R1.

  C. Repeat the test from R4 using ICMP ping on the local 10.1.1.0/24 prefix, and fix any Layer 2 errors on the host or switch side of the subnet.

  D. Place an OSPF distribute-list outbound on R3 to block the 10.1.1.0/24 prefix from being advertised back to R3.

  Correct Answer: B

• Question 60:

  Refer to the exhibit.

  

  A network administrator is trying to access a branch router using TACACS+ usemame and password credentials, but the administrator cannot log in to the router because the WAN connectivity is down. The branch router has following AAA

  configuration:

  aaa new-model

  aaa authorization commands 15 default group tacacs+

  aaa accounting commands 1 default stop-only group tacacs+

  aaa accounting commands 15 default stop-only group tacacs+ tacacs-server host 10.100.50.99

  tacacs-server key Cisco123.

  Which command will resolve this problem when WAN connectivity is down?

  A. aaa authentication login default group tacacs+ local

  B. aaa authentication login console group tacacst enable

  C. aaa authentication login default group tacacs+ console

  D. aaa authentication login default group tacacst+ enable

  Correct Answer: A

  https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-accesscontrol-system-tacacs-/200606-aaa-authentication-login-default-local.html