CiscoProfessional level300-410Page 3 of 3

300-410 exam dumps: questions 201 to 292 of 292

Page 3 of the free 300-410 question bank for the Implementing Cisco Enterprise Advanced Routing and Services exam. Questions 201 to 292 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 201 to 292

Free 300-410 practice questions

Questions 201 to 205 of 292

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

300-410 Question 201

Select 3

You are tasked with enhancing the security of a branch office's network. The branch router is experiencing unauthorized configuration changes and excessive login attempts. Which of the following measures can you implement on the router to mitigate these issues?

A
Enable role-based access control (RBAC) for user accounts.
B
Implement Control Plane Policing (CoPP) to limit management traffic.
C
Disable logging for failed login attempts to reduce router resource usage.
D
Configure login block-for to restrict repeated failed login attempts.
E
Enable SNMPv1 for monitoring and management.

Show answer and explanation

Correct answers: A, B, D

Explanation

To secure the branch router, you should implement measures that control access and protect the router from unauthorized changes or attacks. Enabling RBAC ensures users have only the access they need. CoPP protects the router's control plane from excessive or malicious management traffic. Configuring login block-for helps prevent brute force attacks. Avoiding outdated protocols like SNMPv1 and keeping logging enabled are also critical best practices for maintaining infrastructure security.

A. Correct.
Enabling RBAC allows you to define roles with specific privileges, reducing the risk of unauthorized configuration changes.
B. Correct.
Control Plane Policing (CoPP) protects the router's control plane by filtering and rate-limiting management traffic, mitigating DoS attacks and unauthorized access.
C. Incorrect.
Disabling logging for failed login attempts is not a security best practice, as it removes critical information needed for troubleshooting and auditing.
D. Correct.
The login block-for command helps mitigate brute force login attempts by temporarily blocking access after a certain number of failed login attempts.
E. Incorrect.
SNMPv1 is outdated and lacks encryption, making it unsuitable for secure monitoring and management.

300-410 Question 202

Select 2

A network engineer is tasked with securing an OSPF routing domain in a multi-area network. The engineer must ensure that OSPF neighbor relationships are protected against unauthorized devices joining the network and that routing information integrity is maintained. Which of the following configurations should the engineer implement?

A
Enable OSPF authentication using MD5 or SHA on all OSPF interfaces.
B
Configure OSPF passive interfaces on non-routing links.
C
Deploy route filtering to restrict specific prefixes from being advertised.
D
Use a prefix list to limit OSPF LSAs from entering specific areas.
E
Implement IPsec to secure all OSPF traffic.

Show answer and explanation

Correct answers: A, B

Explanation

To secure an OSPF routing domain, it is crucial to implement OSPF authentication to protect neighbor relationships and ensure integrity of routing information. Additionally, configuring OSPF passive interfaces restricts unnecessary OSPF communication on non-routing links, reducing exposure to potential attacks. These measures address the specific security challenges in OSPF without adding excessive complexity, such as deploying IPsec.

A. Correct.
Enabling OSPF authentication using MD5 or SHA ensures that OSPF neighbors must authenticate themselves before forming an adjacency, protecting the network from unauthorized devices.
B. Correct.
Configuring OSPF passive interfaces on non-routing links prevents OSPF hello packets from being sent on interfaces where neighbor relationships are not required, reducing the attack surface.
C. Incorrect.
Route filtering is used to control route propagation but does not directly secure OSPF neighbor relationships or routing information integrity.
D. Incorrect.
Using a prefix list to limit OSPF LSAs can help manage routing information but does not provide authentication or integrity protection for OSPF.
E. Incorrect.
While IPsec can secure OSPF traffic, it is not a standard approach to securing OSPF in most enterprise networks and can add unnecessary complexity.

300-410 Question 203

Select 2

An organization has deployed an OSPF-based routing environment. To improve infrastructure security, the network administrator decides to authenticate OSPF neighbor relationships. Which of the following configurations will ensure OSPF authentication is properly implemented?

A
Configure MD5 authentication on the OSPF interfaces with the same key on both ends.
B
Enable OSPFv3 encryption-only mode to secure all communication.
C
Use plaintext passwords for OSPF authentication.
D
Apply an authentication configuration under the OSPF process and ensure interfaces use the same key.
E
Use SHA-based authentication to replace MD5 in OSPFv2.

Show answer and explanation

Correct answers: A, D

Explanation

OSPF authentication is essential for securing routing exchanges and preventing unauthorized devices from forming OSPF adjacencies. MD5 authentication (for OSPFv2) or IPsec (for OSPFv3) are commonly used methods. Correctly configuring the authentication at the interface or process level with matching keys ensures secure OSPF neighbor relationships while avoiding potential misconfigurations or vulnerabilities.

A. Correct.
Correct: Configuring MD5 authentication ensures OSPF messages are authenticated using a shared key, preventing unauthorized routers from forming adjacencies. The key must match on both ends.
B. Incorrect.
Incorrect: OSPFv3 supports IPsec for authentication and encryption, but 'encryption-only' does not secure authentication. Authentication must be explicitly configured.
C. Incorrect.
Incorrect: Using plaintext passwords is insecure and not recommended. OSPF supports MD5 or IPsec for secure authentication.
D. Correct.
Correct: Applying authentication at the OSPF process level ensures all related OSPF interfaces must use the same authentication method and key.
E. Incorrect.
Incorrect: OSPFv2 does not support SHA-based authentication. MD5 remains the standard for OSPFv2 in most implementations.

300-410 Question 204

Select 4

A network administrator has configured AAA on a Cisco router to use a TACACS+ server for authentication. However, users are unable to log in to the router using their TACACS+ credentials, and the fallback to the local database is not working. Which of the following steps should the administrator take to troubleshoot the issue?

A
Verify that the TACACS+ server is reachable from the router using ping or traceroute.
B
Ensure the correct AAA login method list is applied to the lines used for user login.
C
Check the shared secret key configured on the router matches the one on the TACACS+ server.
D
Reconfigure the local username and password to bypass TACACS+ authentication.
E
Review the TACACS+ server logs for authentication request details and potential errors.

Show answer and explanation

Correct answers: A, B, C, E

Explanation

Troubleshooting TACACS+ authentication involves verifying that the server is reachable, ensuring the correct AAA method list is applied, and confirming the shared secret key matches between the router and the server. Additionally, reviewing TACACS+ server logs can provide insights into why authentication requests are failing. Reconfiguring the local username and password does not address the core AAA configuration issues.

A. Correct.
If the TACACS+ server cannot be reached, authentication requests will fail. Verifying connectivity using ping or traceroute is a critical step.
B. Correct.
The AAA method list determines how users are authenticated. If the wrong method list is applied, the router might not even use TACACS+ or fallback to the local database.
C. Correct.
A mismatched shared secret key between the router and the TACACS+ server will prevent successful authentication.
D. Incorrect.
Reconfiguring the local username and password does not resolve the issue with AAA or TACACS+ and is not a recommended troubleshooting step.
E. Correct.
TACACS+ server logs provide valuable information about the authentication process and can help identify configuration errors or request failures.

300-410 Question 205

Single answer

A network administrator is troubleshooting an authentication issue on a Cisco router configured with AAA using a TACACS+ server. Users report that they are unable to log in to the router. Upon verifying the configuration, the administrator notices the following partial configuration:

aaa new-model
aaa authentication login default group tacacs+ local
tacacs-server host 192.168.10.1 key secretkey

What is the most likely issue causing the authentication failure?

A
The TACACS+ server IP address is incorrect.
B
The local database fallback is not configured properly.
C
The shared secret key is mismatched between the router and the TACACS+ server.
D
The 'aaa new-model' command is missing in the configuration.

Show answer and explanation

Correct answer: C

Explanation

In this scenario, the most likely cause of the authentication failure is a shared secret key mismatch between the router and the TACACS+ server. The shared secret key is used to encrypt communication between the router and the TACACS+ server, and if the keys do not match, authentication attempts will fail. The configuration snippet provided shows that the 'aaa new-model' command is enabled, the TACACS+ server IP address is configured, and the local fallback is properly set up, leaving the key mismatch as the most probable issue.

A. Incorrect.
The TACACS+ server IP address appears correct as per the configuration. If it were incorrect, the router would not be able to reach the server, but the issue here points to authentication failure, not reachability.
B. Incorrect.
The configuration specifies a local database fallback with 'local', meaning if the TACACS+ server is unavailable, the router will use the local database. This fallback is properly configured.
C. Correct.
A shared secret key mismatch is a common cause of authentication failures with TACACS+. If the key configured on the router does not match the key on the TACACS+ server, authentication will fail.
D. Incorrect.
The 'aaa new-model' command is present in the configuration, so it is not the issue in this scenario.

Timed practice exam

Take a 300-410 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

300-410 practice questions 201 to 292 of 292

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.