Pass CCNP Enterprise 300-410 exam [Sep 09, 2022] Updated 395 Questions
Cisco 300-410 Actual Questions and 100% Cover Real Exam Questions
NEW QUESTION 170
Refer to the exhibit.
A client is concerned that passwords are visible when running this show archive log config all.
Which router configuration is needed to resolve this issue?
- A. MASS-RTR(config-archive-log-cfg)#hidekeys
- B. MASS-RTR(config-archive-log-cfg)#password encryption aes
- C. MASS-RTR(config)#service password-encryption
- D. MASS-RTR(config)#aaa authentication arap
Answer: A
Explanation:
NEW QUESTION 171
Refer to the exhibit.
An engineer must block access to the console ports for all corporate remote Cisco devices based on the recent corporate security policy but the security team stilt can connect through the console port. Which configuration on the console port resolves the issue?
- A. exec 0.0
- B. no exec
- C. login and password
- D. transport input telnet
Answer: B
Explanation:
"no exec" will disable access to a line. It is used if we want to allow only outgoing session (and disable incoming session) so this command will block all console port access.
There is no "exec 0 0" command. We can only find the "exec prompt" command in IOS Version
15.4(2)T4.
The most similar command is "exec-timeout 0 0" command, which is used to prevent Telnet/SSH sessions from timing out.
NEW QUESTION 172 
Refer to the exhibit. an engineer is trying to get 192.168.32.100 forwarded through 10.1.1.1, but it was forwarded through 10.1.1.2. What action forwards the packets through 10.1.1.1?
- A. Configure EIGRP to receive 192.168.32.0 route with lower admin distance.
- B. Configure EIGRP to receive 192.168.32.0 route with equal or longer prefix than /24.
- C. Configure EIGRP to receive 192.168.32.0 route with longer prefix than /19.
- D. Configure EIGRP to receive 192.168.32.0 route with lower metric.
Answer: B
NEW QUESTION 173
Exhibit:
Which action resolves the authentication problem?
- A. Configure the user name on the TACACS+ server
- B. Configure the TCP port 49 to be reachable by the router
- C. Configure the UDP port 1812 to be allowed on the TACACS+ server
- D. Configure the same password between the TACACS+ server and router.
Answer: D
Explanation:
Explanation
From the last line of the output, we notice that the result was "Invalid AUTHEN packet". Therefore something went wrong with the username or password.
NEW QUESTION 174
Refer to the exhibit.
After a security audit, the administrator implemented an ACL in the route reflector. The RR became unreachable from any router in the network. Which two actions resolve the issue? (Choose two.)
- A. Permit ICMPv6 neighbor discovery traffic in the ACL.
- B. Enable the ND proxy feature on the default gateway.
- C. Remove the ACL entry 80.
- D. Configure a link-local address on the Ethernet0/1 interface.
- E. Change the next hop of the default route to the link-local address of the default gateway.
Answer: A,C
NEW QUESTION 175
Refer to the exhibit.
Which subnet is redistributed from EIGRP to OSPF routing protocols?
- A. 10.1.2.0/24
- B. 10.1.4.0/26
- C. 10.2.2.0/24
- D. 10.2.3.0/26
Answer: C
NEW QUESTION 176 
Refer to the exhibit. In which circumstance does the BGP neighbor remain in the idle condition?
- A. if a prefix list is applied on the inbound direction
- B. if prefixes reach the maximum limit
- C. if prefixes are not received from the BGP peer
- D. if prefixes exceed the maximum limit
Answer: D
Explanation:
Section: Layer 3 Technologies
NEW QUESTION 177
An engineer configured SNMP notifications sent to the management server using authentication and encrypting data with DES. An error in the response PDU is received as "UNKNOWNUSERNAME. WRONGDIGEST". Which action resolves the issue?
- A. Configure correct authentication and privacy passwords using SNMPv3 authNoPriv.
- B. Configure the correct authentication password using SNMPv3 authPriv .
- C. Configure correct authentication and privacy passwords using SNMPv3 authPriv.
- D. Configure the correct authentication password using SNMPv3 authNoPriv.
Answer: B
Explanation:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/15-e/snmp-15-e-book.pdf There are three SNMP security levels (for SNMPv1, SNMPv2c, and SNMPv3):
+ noAuthNoPriv: Security level that does not provide authentication or encryption. + authNoPriv: Security level that provides authentication but does not provide encryption. + authPriv: Security level that provides both authentication and encryption.
For SNMPv3, "noAuthNoPriv" level uses a username match for authentication.
NEW QUESTION 178 
Refer to the exhibit. The Los Angeles and New York routers are receiving routes from Chicago but not from each other Which configuration fixes the issue?
- A. Interface Tunnel1
tunnel protection ipsec profile IPSec-PROFILE - B. Interface Tunnel1
no ip split-horizon eigrp 111 - C. Interface Tunnel1
tunnel mode Ipsec Ipv4 - D. Interface Tunnel1
Ip next-hop-self elgrp 111
Answer: B
Explanation:
Explanation
In this topology, Chicago router (Hub) will receive advertisements from Los Angeles (Spoke1) router on its tunnel interface. The problem here is that it also has a connection with New York (Spoke2) on that same tunnel interface. If we don't disable EIGRP split-horizon, then the Hub will not relay routes from Spoke1 to Spoke2 and the other way around. That is because it received those routes on interface Tunnel1 and therefore it cannot advertise back out that same interface (splithorizon rule). Therefore we must disable split-horizon on the Hub router to make sure the Spokes know about each other.
NEW QUESTION 179
Drag and drop the MPLS concepts from the left onto the descriptions on the right.
Answer:
Explanation:
NEW QUESTION 180
Refer to the exhibit.
The Math and Science departments connect through the corporate IT router but users in the Math department must not be able to reach the Science department and vice versa Which configuration accomplishes this task?
- A. vrf definition Science
address-family ipv4
!
interface E 0/2
vrf forwarding Science
ip address 192.168.1.1 255.255.255.0
no shut
!
interface E 0/3
vrf forwarding Science
ip address 192.168.2.1 - B. vrf definition Science
!
interface E 0/2
ip address 192.168.1.1 255.255.255.0
no shut
!
interface E 0/3
ip address 192.168.2.1 255.255.255.0
no shut - C. vrf definition Science
address-family ipv4
!
interface E 0/2
ip address 192.168.1.1 255.255.255.0
no shut
!
interface E 0/3
ip address 192.168.2.1 255.255.255.0
no shut - D. vrf definition Science
address-family ipv4
!
interface E 0/2
ip address 192.168.1.1 255.255.255.0
vrf forwarding Science
no shut
!
interface E 0/3
ip address 192.168.2.1 255.255.255.0
vrf forwarding Science
no shut
Answer: A
NEW QUESTION 181
Refer to the exhibit.
Drag and drop the credentials from the left onto the remote login information on the right to resolve a failed login attempt to vtys. Not all credentials are uf SLA by defining frequency and schedulingsed
Answer:
Explanation:
Explanation
vty 0:
+ cisco
+ 0csic
vty 1:
+ no username
+ no password
The command "aaa authentication login default none" means no authentication is required when access to the device via Console/VTY/AUX so if one interface does not specify another login authentication method (via the "login authentication ..." command), it will allow to access without requiring username or password. In this case VTY 1 does not specify another authentication login method so it will use the default method (which is "none" in this case).
NEW QUESTION 182
Refer to the exhibit.
An engineer configures a static route on a router, but when the engineer checks the route to the destination, a different next hop is chosen. What is the reason for this?
- A. The metric of the OSPF route is lower than the metric of the static route.
- B. The configured AD for the static route is higher than the AD of OSPF.
- C. Dynamic routing protocols always have priority over static routes.
- D. The syntax of the static route is not valid, so the route is not considered.
Answer: B
Explanation:
Explanation
The AD of static route is manually configured to 130 which is higher than the AD of OSPF router which is
110.
NEW QUESTION 183
Refer to the exhibit.
Drag and drop the credentials from the left onto the remote login information on the right to resolve a failed login attempt to vtys. Not all credentials are uf SLA by defining frequency and schedulingsed
Answer:
Explanation:
Explanation
vty 0:
+ cisco
+ 0csic
vty 1:
+ no username
+ no password
The command "aaa authentication login default none" means no authentication is required when access to the device via Console/VTY/AUX so if one interface does not specify another login authentication method (via the "login authentication ..." command), it will allow to access without requiring username or password. In this case VTY 1 does not specify another authentication login method so it will use the default method (which is "none" in this case).
NEW QUESTION 184
Drag and drop the OSPF adjacency states from the left onto the correct descriptions on the right.
Answer:
Explanation:
Explanation
DownThis is the first OSPF neighbor state. It means that no information (hellos) has been received from this neighbor, but hello packets can still be sent to the neighbor in this state.
During the fully adjacent neighbor state, if a router doesn't receive hello packet from a neighbor within the Router Dead Interval time (RouterDeadInterval = 4*HelloInterval by default) or if the manually configured neighbor is being removed from the configuration, then the neighbor state changes from Full to Down.
AttemptThis state is only valid for manually configured neighbors in an NBMA environment. In Attempt state, the router sends unicast hello packets every poll interval to the neighbor, from which hellos have not been received within the dead interval.
InitThis state specifies that the router has received a hello packet from its neighbor, but the receiving router's ID was not included in the hello packet. When a router receives a hello packet from a neighbor, it should list the sender's router ID in its hello packet as an acknowledgment that it received a valid hello packet.
2-WayThis state designates that bi-directional communication has been established between two routers.
Bi-directional means that each router has seen the other's hello packet. This state is attained when the router receiving the hello packet sees its own Router ID within the received hello packet's neighbor field. At this state, a router decides whether to become adjacent with this neighbor. On broadcast media and non-broadcast multiaccess networks, a router becomes full only with the designated router (DR) and the backup designated router (BDR); it stays in the 2-way state with all other neighbors. On Point-to-point and Point-to-multipoint networks, a router becomes full with all connected routers.
At the end of this stage, the DR and BDR for broadcast and non-broadcast multiacess networks are elected.
For more information on the DR election process, refer to DR Election.
Note: Receiving a Database Descriptor (DBD) packet from a neighbor in the init state will also a cause a transition to 2-way state.
ExstartOnce the DR and BDR are elected, the actual process of exchanging link state information can start between the routers and their DR and BDR. (ie. Shared or NBMA networks).
In this state, the routers and their DR and BDR establish a master-slave relationship and choose the initial sequence number for adjacency formation. The router with the higher router ID becomes the master and starts the exchange, and as such, is the only router that can increment the sequence number. Note that one would logically conclude that the DR/BDR with the highest router ID will become the master during this process of master-slave relation. Remember that the DR/BDR election might be purely by virtue of a higher priority configured on the router instead of highest router ID. Thus, it is possible that a DR plays the role of slave. And also note that master/slave election is on a per-neighbor basis.
ExchangeIn the exchange state, OSPF routers exchange database descriptor (DBD) packets. Database descriptors contain link-state advertisement (LSA) headers only and describe the contents of the entire link-state database. Each DBD packet has a sequence number which can be incremented only by master which is explicitly acknowledged by slave. Routers also send link-state request packets and link-state update packets (which contain the entire LSA) in this state. The contents of the DBD received are compared to the information contained in the routers link-state database to check if new or more current link-state information is available with the neighbor.
LoadingIn this state, the actual exchange of link state information occurs. Based on the information provided by the DBDs, routers send link-state request packets. The neighbor then provides the requested link-state information in link-state update packets. During the adjacency, if a router receives an outdated or missing LSA, it requests that LSA by sending a link-state request packet. All link-state update packets are acknowledged.
FullIn this state, routers are fully adjacent with each other. All the router and network LSAs are exchanged and the routers' databases are fully synchronized.
Full is the normal state for an OSPF router. If a router is stuck in another state, it is an indication that there are problems in forming adjacencies. The only exception to this is the 2-way state, which is normal in a broadcast network. Routers achieve the FULL state with their DR and BDR in NBMA/broadcast media and FULL state with every neighbor in the remaining media such as point-to-point and point-to-multipoint.
Note: The DR and BDR that achieve FULL state with every router on the segment will display FULL/DROTHER when you enter the show ip ospf neighbor command on either a DR or BDR. This simply means that the neighbor is not a DR or BDR, but since the router on which the command was entered is either a DR or BDR, this shows the neighbor as FULL/DROTHER.
NEW QUESTION 185
Refer to the exhibit.
Which subnet is redistributed from EIGRP to OSPF routing protocols?
- A. 10.1.2.0/24
- B. 10.1.4.0/26
- C. 10.2.2.0/24
- D. 10.2.3.0/26
Answer: C
NEW QUESTION 186
Drag and Drop the IPv6 First-Hop Security features from the left onto the definitions on the right.
Answer:
Explanation:
NEW QUESTION 187
An engineer needs dynamic routing between two routers and is unable to establish OSPF adjacency. The output of the show ip ospf neighbor command shows that the neighbor state is EXSTART/EXCHANGE. Which action should be taken to resolve this issue?
- A. match the network types
- B. match the MTUs
- C. match the hello timers
- D. match the passwords
Answer: B
Explanation:
NEW QUESTION 188
Refer to the exhibit. Which action restores the routes from neighbors while still filtering 1.1.1.0/24?
- A. Add a second line in the access list to permit any.
- B. Modify the route map to permit the access list instead of deny it
- C. Modify the access list to deny insteac of permit it.
- D. Add a second sequence in the route map permit 20
Answer: B
NEW QUESTION 189
The network administrator configured R1 for Control Plane Policing so that the inbound Telnet traffic is policed to 100 kbps. This policy must not apply to traffic coming in from 10.1.1.1/32 and 172.16.1.1/32. The administrator has configured this:
The network administrator is not getting the desired results. Which set of configurations resolves this issue?
- A. control-plane
no service-policy input PM-CoPP
service-policy input PM-CoPP - B. control-plane
no service-policy input PM-CoPP
!
interface Ethernet 0/0
service-policy input PM-CoPP - C. no access-list 101
access-list 101 deny tcp host 10,1,1.1 any eq 23
access-list 101 deny tcp host 172,16.1.1 any eq 23
access-list 101 permit ip any any - D. no access-list 101
access-list 101 deny tcp host 10,1.1.1 any eq 23
access-list 101 deny tcp host 172.16.1.1 any eq 23
access-list 101 permit ip any any
!
interface E0/0
service-policy input PM-CoPP
Answer: C
Explanation:
Explanation
Packets that match a deny rule are excluded from that class and cascade to the next class (if one exists) for classification. Therefore if we don't want to CoPP traffic from 10.1.1.1/32 and
172.16.1.1/32, we must "deny" them in the ACL.
NEW QUESTION 190
Refer to the exhibit.
R5 should not receive any routes originated in the EIGRP domain. Which set of configuration changes removes the EIGRP routes from the R5 routing table to fix the issue?
- A. R2
route-map E20 deny 20
R4
route-map O2R deny 10
match tag 111
!
router rip
redistribute ospf 1 route-map O2R metric 1 - B. R4
route-map O2R deny 10
match tag 111
route-map O2R permit 20
!
router rip
redistribute ospf 1 route-map O2R metric 1 - C. R4
route-map O2R deny 10
match tag 111
!
router rip
redistribute ospf 1 route-map O2R metric 1 - D. R4
route-map O2R permit 10
match tag 111
route-map O2R deny 20
!
router rip
redistribute ospf 1 route-map O2R metric 1
Answer: B
NEW QUESTION 191
Refer to the exhibit.
A network is under a cyberattack. A network engineer connected to R1 by SSH and enabled the terminal monitor via SSH session to find the source and destination of the attack. The session was flooded with messages, which made it impossible for the engineer to troubleshoot the issue. Which command resolves this issue on R1?
- A. no terminal monitor
- B. #terminal no monitor
- C. (config)#no terminal monitor
- D. (config)#terminal no monitor
Answer: B
NEW QUESTION 192
Refer to the exhibit.
What does the imp-null tag represent in the MPLS VPN cloud?
- A. Exclude the EXP bit
- B. Pop the label
- C. Impose the label
- D. Include the EXP bit
Answer: B
Explanation:
Explanation
The imp-null (implicit null) tag instructs the upstream router to pop the tag entry off the tag stack before forwarding the packet.
Note: pop means remove the top MPLS label
NEW QUESTION 193
An engineer configured the wrong default gateway for the Cisco DNA center enterprise interface during the install.
Which command must the engineer run to correct the configuration?
- A. Sudo maglev reinstall
- B. Sudo magiev-config update
- C. Sudo maglev install config update
- D. Sudi update config install
Answer: B
NEW QUESTION 194
Refer to the exhibit.
An IP SLA is configured to use the backup default route when the primary is down, but it is not working as desired. Which command fixes the issue?
- A. R1(config)#ip sla track 1
- B. R1(config)# ip route 0.0.0.0.0.0.0.0.1.1.1.1 track 1
- C. R1(config)# ip route 0.0.0.0.0.0.0.0.2.2.2.2 10 track 1
- D. R1(config)# ip route 0.0.0.0.0.0.0.0.2.2.2.2
Answer: B
NEW QUESTION 195
......
Cisco 300-410 Real 2022 Braindumps Mock Exam Dumps: https://passking.actualtorrent.com/300-410-exam-guide-torrent.html