Free 300-410 Exam Braindumps
Implementing Cisco Enterprise Advanced Routing and Services (ENARSI) Questions 153–160 (page: 21)

Updated On: 9-Jul-2026

Refer to the exhibit. A network administrator wants to block all traffic toward the Internet after business hours and on weekends. When the administrator applies an access list on interface Gi0/1, all traffic is blocked and there is no access to the Internet at any time.


Which action resolves the issue?

  1. Add the permit ip any any time-range no-conn statement after the deny udp any any time-range no- conn command in the access list.
  2. Add the permit ip any any statement after the deny icmp any any time-range no-conn command in the access list.
  3. Add the permit allowed time-range no-conn statement after the deny icmp any any time-range no-conncommand in the access list.
  4. Add the permit ip any any time-range no-conn statement after the deny icmp any any time-range no- conn command in the access list.

Answer(s): B



Refer to the exhibit. An IPv6 network was newly deployed in the environment and the help desk reports that R3 cannot SSH to the R2s Loopback interface.


Which action resolves the issue?

  1. Modify line 10 of the access list to permit instead of deny.
  2. Remove line 60 from the access list.
  3. Modify line 30 of the access list to permit instead of deny.
  4. Remove line 70 from the access list.

Answer(s): C



An engineer needs dynamic routing between two routers and is unable to establish OSPF adjacency. The output of the show ipospf neighbor command shows that the neighbor state is EXSTART/EXCHANGE.

Which action should be taken to resolve this issue?

  1. match the passwords
  2. match the hello timers
  3. match the MTUs
  4. match the network types

Answer(s): A



Refer to the exhibit.

A network administrator is trying to access a branch router using TACACS+ username and password credentials, but the administrator cannot log in to the router because the WAN connectivity is down. The branch router has following AAA configuration:

aaa new-model
aaa authorization commands 15 default group tacacs+
aaa accounting commands 1 default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
tacacs-server host 10.100.50.99
tacacs-server key Ci$co123

Which command will resolve this problem when WAN connectivity is down?

  1. aaa authentication login console group tacacs+ enable
  2. aaa authentication login default group tacacs+ local
  3. aaa authentication login default group tacacs+ enable
  4. aaa authentication login default group tacacs+ console

Answer(s): B



Refer to the exhibit. An engineer is troubleshooting failed access by contractors to the business application server via Telnet or HTTP during the weekend.


Which configuration resolves the issue?


  1. R1
    no access-list 101 permit tcp 10.3.3.0 0.0.0.255 host 10.1.1.3 eq telnet time-range Contractor

  2. R1
    time-range Contractor
    no periodic weekdays 8:00 to 16:30
    periodic daily 8:00 to 16:30

  3. R4
    time-range Contractor
    no periodic weekdays 17:00 to 23:59
    periodic daily 8:00 to 16:30

  4. R4
    no access-list 101 permit tcp 10.3.3.0 0.0.0.255 host 10.1.1.3 eq telnet time-range Contractor

Answer(s): B



What are two characteristics of IPv6 Source Guard? (Choose two.)

  1. requires the user to configure a static binding
  2. used in service provider deployments to protect DDoS attacks
  3. requires that validate prefix be enabled
  4. requires IPv6 snooping on Layer 2 access or trunk ports
  5. recovers missing binding table entries

Answer(s): C,D



DRAG DROP (Drag and Drop is not supported)
Drag and drop the IPv6 first hop security device roles from the left onto the corresponding descriptions on the right.

Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:


Reference:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_011011.pdf



The network administrator configured R1 for Control Plane Policing so that the inbound Telnet traffic is policed to 100 kbps. This policy must not apply to traffic coming in from 10.1.1.1/32 and 172.16.1.1/32. The administrator has configured this:

access-list 101 permit tcp host 10.1.1.1 any eq 23
access-list 101 permit tcp host 172.16.1.1 any eq 23
!
class-mapCoPP-TELNET
match access-group 101
!
policy-map PM-CoPP
classCoPP-TELNET
police 100000 conform transmit exceed drop
!
control-plane
service-policy input PM-CoPP

The network administrator is not getting the desired results.

Which set of configurations resolves this issue?


  1. no access-list 101
    access-list 101 deny tcp host 10.1.1.1 any eq 23
    access-list 101 deny tcp host 172.16.1.1 any eq 23
    access-list 101 permit ip any any

  2. control-plane
    no service-policy input PM-CoPP
    !
    interface Ethernet 0/0
    service-policy input PM-CoPP

  3. no access-list 101
    access-list 101 deny tcp host 10.1.1.1 any eq 23
    access-list 101 deny tcp host 172.16.1.1 any eq 23
    access-list 101 permit ip any any
    !
    Interface E 0/0
    service-policy input PM-CoPP

  4. control-plane
    no service-policy input PM-CoPP
    service-policy input PM-CoPP

Answer(s): A



Viewing page 21 of 81
Viewing questions 161 - 168 out of 640 questions


Post your Comments and Discuss Cisco 300-410 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!