Medium 300-410 practice questions

An engineer configures AAA on a router with the following: 'aaa new-model', 'aaa authentication login default group tacacs+', and a TACACS+ server that is fully reachable. After saving, remote SSH logins work correctly using TACACS+ credentials, but the engineer notices that when logging in through the physical console port, the router still prompts for and accepts credentials against the TACACS+ server rather than allowing local-only access. The console line has no 'login authentication' command applied. Why is the console being authenticated against TACACS+?

A network engineer configures AAA on a router with the command 'aaa authentication login VTY-ACCESS group tacacs+ none' and applies it to the VTY lines. During a security audit, the auditor notes that when the TACACS+ servers were temporarily unreachable during maintenance, administrators were able to log in without providing any credentials. The engineer intended for local authentication to serve as the backup. Which change correctly resolves the security concern while preserving login access during a TACACS+ outage?

A network engineer configures a router to authenticate administrative logins against a RADIUS server. Users can log in successfully with their RADIUS credentials, but every user lands at privilege level 1 and cannot enter privileged EXEC mode even though the RADIUS server is configured to return a cisco-av-pair of 'shell:priv-lvl=15'. The relevant configuration includes 'aaa authentication login default group radius local' and 'line vty 0 4 / login authentication default'. Which configuration change will allow the returned privilege level to be applied automatically at login?

A network engineer configures AAA on a router with the commands 'aaa authentication login default group tacacs+' and points to a single TACACS+ server. During a maintenance window the TACACS+ server becomes unreachable, and all administrators are now locked out of the device even though local usernames exist. What change will allow login using the local database when the TACACS+ server is down, without weakening security while the server is reachable?

A network engineer configures a router to authenticate administrative logins against a TACACS+ server reachable only through the management VRF via Loopback0. Local logins work as a fallback, but every attempt to authenticate to the TACACS+ server times out. Debugging shows the packets are being sourced from the outbound physical interface IP, which is not permitted on the ACL protecting the TACACS+ server. Which configuration will resolve the authentication failures?

A network engineer configures BFD on a Layer 3 point-to-point link between R1 and R2 to speed up EIGRP convergence. The interface commands 'bfd interval 300 min_rx 300 multiplier 3' are applied on both routers, and the interface is up. However, when the link fails on an intermediate transport device, EIGRP still waits for its hold timer to expire before removing the neighbor. Running 'show bfd neighbors' on R1 shows no BFD sessions established. Which action will most likely enable BFD-triggered fast failover for EIGRP?

An engineer configures a route map on R1 to tag routes learned from a customer eBGP peer with community 65000:100 so an upstream provider can filter them. After applying the policy, the neighbor R2 (the upstream) reports that none of the received prefixes carry the community. The relevant configuration on R1 is: route-map SET-COMM permit 10 match ip address prefix-list CUST-NETS set community 65000:100 ! router bgp 65000 neighbor 10.1.1.2 remote-as 65001 neighbor 10.1.1.2 route-map SET-COMM out The prefixes are being advertised to R2 correctly, but without the community value. What is the most likely cause?

A network engineer redistributes BGP-learned routes into OSPF on an ASBR using the command 'redistribute bgp 65001 subnets'. Users report that when there are two ASBRs advertising the same external prefixes with different internal path costs to reach them, traffic does not always take the path with the lowest total cost to the ASBR. The engineer confirms both ASBRs are advertising the routes. What is the MOST likely reason the internal cost to the ASBR is being ignored in path selection?

A network engineer uses Cisco Catalyst Center Assurance to investigate user complaints in a warehouse. The wireless Client Health dashboard shows several clients with a poor health score, and the client 360 view flags them during the 'Onboarding' phase with the RF metric indicating a high noise floor of -78 dBm on the 2.4 GHz band. AP and WLC device health scores are all green, and RADIUS authentication times are normal. Which conclusion is best supported by this Assurance data?

A network engineer is troubleshooting an intermittent connectivity issue on a busy WAN router. Traffic from a single host (10.1.1.50) to a remote server needs to be examined, but running 'debug ip packet detail' floods the console and spikes CPU because of the high traffic volume. The engineer wants to limit the debug output to only packets to/from that one host without impacting other traffic. Which action correctly restricts the debug output?

After deploying a new CoPP policy on an enterprise core router, network operations reports that OSPF adjacencies on several interfaces repeatedly drop and re-establish, while SSH and SNMP management continue to work normally. The relevant policy configuration is: class-map match-any CP-ROUTING matching access-list 120, which permits 'ip ospf any any'; a policy-map CP-POLICY with class CP-ROUTING configured with 'police 8000 conform-action transmit exceed-action drop'; and 'control-plane service-policy input CP-POLICY'. The router runs OSPF over broadcast segments with many neighbors. Which action MOST likely resolves the adjacency instability?

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, users report that transit traffic passing through the router is unaffected, but a newly added deny-all class at the end of the policy-map (applied to catch unclassified traffic to the router itself) is dropping legitimate SSH sessions to the device from a management subnet. The management subnet was intentionally omitted from the permit ACLs. Which characteristic of CoPP explains why only the router-destined SSH traffic is impacted and not the transit traffic?

A network engineer configures CoPP on an edge router to rate-limit management traffic. The NMS uses SNMPv2c to poll the router. After deployment, the NMS reports intermittent timeouts and gaps in interface statistics graphs. The engineer runs 'show policy-map control-plane' and sees the SNMP class matching only a small number of packets while a large and increasing conform/exceed drop count appears under the 'class-default' policer, which is configured with a low 8 kbps rate. Which action most likely resolves the SNMP polling problem?

A network monitoring server performs SNMP GETBULK walks against a core router every 5 minutes. Recently, the NMS reports intermittent timeouts and partial MIB tables, but pings and SSH to the router remain stable. On the router, 'show policy-map control-plane' shows the SNMP class with a growing number of dropped packets under 'exceed', while the 'conform' counter also increases. The class matches ACL traffic to UDP 161. What is the MOST likely cause of the intermittent SNMP failures?

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, administrators report intermittent SSH session timeouts to the router, while ping and OSPF adjacencies remain stable. The relevant configuration is: class-map match-all COPP-MGMT match access-group name SSH-ACL ! policy-map COPP-POLICY class COPP-MGMT police 8000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY The SSH-ACL correctly matches TCP port 22 to the router loopback. The command 'show policy-map control-plane' shows a steadily increasing number of exceeded (dropped) packets in class COPP-MGMT. What is the most likely cause?

A network engineer configures CoPP on a core router to rate-limit management traffic. After applying the policy, administrators report they can no longer reach the router via HTTPS for the web GUI, but SSH still works fine. The relevant configuration is shown below: ip access-list extended MGMT-TRAFFIC permit tcp any any eq 22 permit tcp any any eq 80 class-map match-all MGMT match access-group name MGMT-TRAFFIC policy-map COPP-POLICY class MGMT police 8000 conform-action transmit exceed-action transmit class class-default police 8000 conform-action transmit exceed-action drop control-plane service-policy input COPP-POLICY What is the most likely cause of the HTTPS connectivity failure?

A network engineer configures CoPP on a core router to protect the control plane. After applying the policy, routine management traffic works, but scheduled firmware pushes to the router via TFTP now fail intermittently, and 'show policy-map control-plane' shows a rising drop counter in class-default. The engineer's policy has explicit classes for SSH, SNMP, and OSPF with generous rates, plus a class-default with 'police rate 8000 pps conform-action transmit exceed-action drop'. Which action best resolves the TFTP failures without weakening protection for other traffic?

A branch router's WAN-facing interface is configured with 'ip address dhcp' to obtain an address from the ISP. After a reload, the interface remains up/up but never obtains an IP address. Debugging with 'debug dhcp detail' shows the router sending DHCPDISCOVER messages repeatedly but never receiving a DHCPOFFER. The ISP confirms their DHCP server is operational and that other customers on the same segment obtain leases normally. A packet capture on the router's interface shows the outbound DISCOVER packets but no inbound traffic from the server at all. What is the MOST likely cause?

IP phones in VLAN 20 obtain IP addresses from the IOS DHCP server but fail to download their configuration and firmware from the TFTP server at 10.10.50.5. Data PCs in the same subnet get addresses and reach the network normally. The phone DHCP pool is configured with default-router and dns-server statements only. Which action will allow the phones to locate the TFTP server?

A branch router is configured as an IOS DHCP server for VLAN 20 using the network 192.168.20.0/24. Users report that only the first few devices each morning receive addresses, then new clients fail to get an IP. The 'show ip dhcp pool' output shows 'Leased addresses : 250' and 'Total addresses : 253'. The administrator confirms the DHCP scope is correct and the relay is not involved (clients are on the same segment). What is the MOST likely cause of the address shortage?

You are deploying a single-hub DMVPN. All spokes have formed their GRE tunnels but none of the spokes can register with the hub, and 'show ip nhrp' on the hub shows no dynamic mappings. The tunnel interfaces are up/up and ping to the hub's tunnel address fails. On a spoke you run 'debug nhrp' and see the message 'NHRP: Receive Registration Reply' is never generated, while the hub logs 'NHRP: Rejecting authentication error'. What is the most likely cause?

A network engineer has configured a single-hub DMVPN with two spokes. Spoke-to-spoke tunnels form correctly, but the engineer notices that after a spoke reboots, its dynamic NHRP mapping remains on the hub for far longer than expected, causing the hub to attempt forwarding traffic to an unreachable spoke before purging the entry. On the hub tunnel interface, the current configuration includes 'ip nhrp holdtime 7200'. Which action best resolves the delayed purging of stale spoke registrations?

You configured a single-hub DMVPN Phase 1 network. All spokes register successfully with the hub (show ip nhrp shows valid entries on the hub, and spokes list the hub NHS as 'up'). However, EIGRP over the tunnel fails to form neighbor adjacencies between the hub and any spoke. Static neighbor definitions are not used. Which hub tunnel configuration omission best explains the failure?

A network engineer is configuring a single-hub DMVPN. The hub tunnel interface is up, but a newly added spoke shows no NHRP registration on the hub (show ip nhrp lists no entries for the spoke). The spoke's tunnel interface is up/up and the underlying physical path to the hub NBMA address is reachable via ping. On the spoke, the relevant configuration is: interface Tunnel0 ip address 10.0.0.2 255.255.255.0 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 The hub uses 'ip nhrp map multicast dynamic' and 'ip nhrp network-id 100'. What is the most likely cause the spoke fails to register with the hub?

You manage a single-hub DMVPN deployment with EIGRP running over the mGRE tunnels. Spokes register successfully with the hub, and spoke-to-hub and hub-to-spoke traffic works fine. However, you want spoke-to-spoke traffic to be forwarded directly between spokes instead of always transiting the hub, while keeping the hub's routing table summarized. Traffic between two spokes currently always passes through the hub. Which combination of NHRP configuration commands enables the desired direct spoke-to-spoke forwarding in this Phase 3 design?