Cisco CCNP Enterprise 300-410 Questions & Answers

• Question 711:

  An engineer sets up a DMVPN connection to connect branch 1 and branch 2 to HQ branch 1 and branch 2 cannot communicate with each other. Which change must be made to resolve this issue?

  

  A. R1(config)#int eth1/1 R1(config-if)#no ip split-horizon eigrp 100

  B. R2(config)#router eigrp 100 R2(config-router)#tneighbor 172.16.1.3

  C. R3(config)#router eigrp 100 R3(config-router)#neighbor 172.16.1.2

  D. R1(config)#int tunnel 1 R1(config-if)#no ip split-horizon eigrp 100

  Correct Answer: D

• Question 712:

  Which Ipv6 first-hop security feature helps to minimize denial of service attacks?

  A. IPv6 Router Advertisement Guard

  B. IPv6 Destination Guard

  C. DHCPv6 Guard

  D. IPv6 MAC address filtering

  Correct Answer: B

  The Destination Guard feature helps in minimizing denial-of-service (DoS) attacks. It performs address resolutions only for those addresses that are active on the link,and requires the FHS binding table to be populated with the help of the IPv6 snooping feature.The feature enables the filtering of IPv6 traffic based on the destinationaddress, and blocks the NDP resolution for destination addresses that are not found in the binding table. By default, the policy drops traffic coming for an unknowndestination.

• Question 713:

  Refer to Exhibit.

  

  A network administrator has successfully configured DMVPN topology between a hub and two spoke routers. Which two configuration commands should establish direct communications between spoke 1 and spoke 2 without going through the hub? (Choose two).

  A. At the hub router, configure the ip nhrp shortcut command.

  B. At the spoke routers, configure the ip nhrp spoke-tunnel command.

  C. At the hub router, configure ip nhrp redirect the command

  D. At the spoke routers, configure the ip nhrp shortcut command.

  E. At the hub router, configure tne Ip nhrp spoke-tunnel command

  Correct Answer: CD

  To configure Spoke to Spoke communication we can configure DMVPN Phase II or Phase III. But in Phase II, the first few packets would go through Hub. In order tototally ignore the hub, we have to use DMVPN Phase III: DMVPN Phase III is same as Phase 2 but removes some restrictions and complexities of Phase 2. Also allows greater variety of DMVPN network designs we use:

  +

  ip nhrp redirect in hub: tells the initiator spoke to look for a better path to the destination spoke than through the Hub. Upon receiving the NHRP redirect message thespokes communicate with each other over the hub and they have their NHRP replies for the NHRP Resolution Requests that they sent out.

  +

  ip nhrp shortcut in spokes: overwrite the CEF table on the spoke. It basically overrides the next-hop value for a remote spoke network from the default initial hubtunnel IP address to the NHRP resolved remote spoke tunnel IP address)

• Question 714:

  Refer to the exhibit.

  

  Traffic from the branch network should route through HQ_R1 unless the path is unavailable. An engineer tests this functionality by shutting down interface on the BRANCH router toward HQ_R1 router but 192.168.20.0/24 is no longer reachable from the branch router. Which set of configurations resolves the issue?

  A. HQ_R1(config)# ip sla responder HQ_R1(config)# ip sla responder icmp-echo 172.16.35.2

  B. BRANCH(config)# ip sla 1 BRANCH(config-ip-sla)# icmp-echo 172.16.35.1

  C. HQ_R2(config)# ip sla responder HQ_R2(config)# ip sla responder icmp-echo 172.16.35.5

  D. BRANCH(config)# ip sla 1 BRANCH(config-ip-sla)#icmp-echo 172.16.35.2

  Correct Answer: D

  In the configuration above, the engineer has made a mistake as he was tracking 172.16.35.6 (the backup path) instead of tracking the main path (172.16.35.2). Therefore,when he shut down the main path, the track 1 was still up so traffic still went through the main path -> it failed. To fix this issue, we just need to correct the tracking interface of the main path.

• Question 715:

  Refer to Exhibit.

  

  Which two configurations allow clients to get dynamic ip addresses assigned?

  A. Configure access-list 100 permit udp any any eq 61 as the first line

  B. Configure access-list 100 permit udp any any eq 86 as the first line

  C. Configure access-list 100 permit udp any any eq 68 as the first line

  D. Configure access-list 100 permit udp any any eq 69 as the first line

  E. Configure access-list 100 permit udp any any eq 67 as the first line

  Correct Answer: CE

  A DHCP server that receives a DHCPDISCOVER message may respond with a DHCPOFFER message on UDP port 68 (BootP client).

  ...

  In the event that the DHCP server is not on the local subnet, the DHCP server will send the DHCPOFFER, as a unicast packet, on UDP port 67, back to the DHCP/BootPRelay Agent from which the DHCPDISCOVER came.

• Question 716:

  Refer to the exhibits. All the serial links between R1, R2, and R3 have the same bandwidth. Users on the 192.168.1.0/24 network report slow response times while they access resources on network 192.168.3.0/24. When a traceroute is run on the path, it shows that the packet is getting forwarded via R2 to R3 although the link between R1 and R3 is still up.

  What must the network administrator do to fix the slowness?

  

  A. Add a static route on R1 using the next hop of R3.

  B. Remove the static route on R1.

  C. Change the Administrative Distance of EIGRP to 5.

  D. Redistribute the R1 static route to EIGRP.

  Correct Answer: B

• Question 717:

  Clients on ALS2 receive IPv4 and IPv6 addresses but clients on ALS1 receive only IPv4 addresses and not IPv6 addresses. Which action on DSW1 allows clients on ALS1 to receive IPv6 addresses?

  

  A. Configure DSW1(dhcp-config)#default-router 2002:A04:A01::A04:A01

  B. Configure DSW1(config-if)#ipv6 dhcp relay destination 2002:404:404::404:404 GigabitEthernet1/2

  C. Configure DSW1(config)#ipv6 route 2002:404:404::404:404/128 FastEthernet1/0

  D. Configure DSW1(config-if)#ipv6 helper address 2002:404:404::404:404

  Correct Answer: B

  DSW1(config)#int f0/0 DSW1(config-if)#ipv6 dhcp relay destination 2002:404:404::404:404 GigabitEthernet1/2 https://www.cbtnuggets.com/blog/technology/networking/how-to-use-the-ipv6-dhcp-relay

• Question 718:

  A network administrator is tasked to permit http and https traffic only toward the internet from the User1 laptop to adhere to company's security policy. The administrator can still ping to www.cisco.com Which interface should the access list 101 be applied to resolve this issue?

  

  A. Interface G0/48 in the incoming direction

  B. Interface G0/0 in the outgoing direction.

  C. Interface S1/0 in the outgoing direction.

  D. Interface G0/0 in the incoming direction.

  Correct Answer: D

• Question 719:

  Refer to the exhibit.

  

  A network administrator is using the DNA Assurance Dashboard panel to troubleshoot an OSPF adjacency that failed between Edge_NYC Interface GigabitEthernet1/3 with Neighbor Edge_SNJ. The administrator observes that the neighborship is stuck in exstart state.

  How does the administrator fix this issue?

  A. Configure to match the OSPF interface network types on both routers.

  B. Configure to match the OSPF interface speed and duplex settings on both routers.

  C. Configure to match the OSPF interface MTU settings on both routers.

  D. Configure to match the OSPF interface unique IP address and subnet mask on both routers.

  Correct Answer: C

  https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13684-12.html

  After two OSPF neighboring routers establish bi-directional communication and complete DR/BDR election (on multi-access networks), the routers transition to the exstart state. In this state, the neighboring routers establish a master/slave relationship and determine the initial database descriptor (DBD) sequence number to use while exchanging DBD packets. Neighbors Stuck in Exstart/Exchange State The problem occurs most frequently when attempting to run OSPF between a Cisco router and another vendor's router. The problem occurs when the maximum transmission unit (MTU) settings for neighboring router interfaces don't match. If the router with the higher MTU sends a packet larger that the MTU set on the neighboring router, the neighboring router ignores the packet.

• Question 720:

  What are two functions of LDP? (Choose two.)

  A. It advertises labels per Forwarding Equivalence Class.

  B. It uses Forwarding Equivalence Class.

  C. It is defined in RFC 3038 and 3039.

  D. It requires MPLS Traffic Engineering.

  E. It must use Resource Reservation Protocol.

  Correct Answer: AB

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/mpls/configuration/guide/mpls_cg/mp_mpls_overview.pdf