Configure and verify Cisco IOS tools like SNMPv3, NetFlow, SPAN/RSPAN, and IP SLA probes to monitor live traffic. The critical skill is reading syslog severity levels and IP SLA tracking output correctly.
Start practicing
Network Assurance — choose a session length
Free · No account required
Domain overview
Network Assurance is 10% of ENCOR 350-401 and covers the tools Cisco expects you to use to verify a live network rather than configure it. Expect questions on syslog severity levels, SNMPv2c versus SNMPv3, NetFlow and Flexible NetFlow exports, SPAN and RSPAN sessions, IP SLA probes, and DNA Center assurance and device health dashboards.
Exam objectives
Configuring syslog logging levels, hosts, and interpreting severity 0-7 messages
Comparing SNMPv2c community strings with SNMPv3 authPriv users and views
Building Flexible NetFlow records, exporters, and monitors for traffic analysis
Configuring local SPAN, RSPAN, and ERSPAN source/destination sessions on switches
Confusing syslog severity numbers: lower numbers are more severe, so level 0 is emergencies and level 7 is debugging.
Assuming SNMPv3 encryption is mandatory; authNoPriv provides authentication but no privacy, unlike authPriv.
Forgetting that a SPAN destination port stops normal switching and cannot source traffic while monitoring.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?
2A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?
3A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?
4A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?
5Which TWO statements are true about IP SLA? (Choose two.)
6Which THREE are common causes of high CPU utilization on a Cisco Catalyst switch? (Choose three.)
7Refer to the exhibit. An engineer notices that interface resets have occurred. What is the most likely cause of the interface resets?
8Refer to the exhibit. Which OSPF route type is the default route?
9A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?
10A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?
11Which TWO STP features are used to improve convergence time after a topology change?
12Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?
13A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?
14Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?
15A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?
16Drag and drop the steps for the DHCP DORA process in the correct order.
17A network engineer has configured a Cisco IOS IP SLA operation with an ICMP echo probe to monitor reachability of a remote branch router. The engineer wants to automatically remove a static route from the routing table when the probe fails. Which feature should be configured to achieve this?
18A network engineer is using Cisco DNA Center Assurance to monitor the health of a wireless network. The engineer notices that a particular access point is reporting a high number of client disconnects. Which feature in DNA Center Assurance would best help identify the root cause of these disconnects?
19A network engineer is troubleshooting a connectivity problem between two hosts on the same VLAN. The engineer suspects a duplex mismatch on the switch port. Which command should be used to verify the duplex settings on a Cisco Catalyst switch interface?
20A network administrator is configuring a Cisco IOS XE device to send syslog messages to a remote server. The administrator wants to ensure that only messages with severity level 4 and higher (i.e., more severe) are sent. Which command should be used?
21A network engineer needs to verify the performance of a WAN link between two Cisco routers. The engineer configures an IP SLA operation on Router A that sends ICMP echo requests to Router B every 60 seconds and stores the results. After a week, the engineer checks the results and finds that the operation has been running successfully, but no history data is available. What is the most likely reason for the lack of history data?
22A network engineer is troubleshooting a Connectivity issue between two data center switches. The engineer suspects a physical layer problem and wants to verify the cable and interface status. Which command should be used to check the status of all interfaces, including the link state and speed?
23A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator wants to identify the root cause of poor wireless client experience. Which two actions can be taken within Cisco DNA Center Assurance to troubleshoot this issue? (Choose two.)
24A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular access point is reporting a high number of client association failures. Which Cisco DNA Center Assurance feature should be used to correlate these failures with client device types and identify the root cause?
25A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor performance. The administrator wants to see detailed information about the client's connectivity, including the path taken through the network and any issues encountered. Which Cisco DNA Center Assurance feature should the administrator use?
26A network engineer is configuring an IP SLA operation to monitor the reachability of a critical server at 10.1.1.1. The engineer wants to generate a syslog message and trigger a track object if the response time exceeds 100 ms. Which IP SLA operation type should be used?
27A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a specific client device is experiencing poor performance. Which feature in DNA Center Assurance provides a detailed timeline of events, including onboarding, authentication, and application usage for a specific client?
28A network engineer is troubleshooting a Cisco SD-WAN deployment where some branches experience intermittent packet loss. The engineer suspects that the issue is related to the control plane connections between vEdge routers and the vSmart controller. Which command should be used on a vEdge router to verify the status of the control connections?
29A network engineer is configuring a Cisco IOS router to export NetFlow data to a collector. The engineer wants to ensure that only ingress traffic on GigabitEthernet0/0 is monitored and that the NetFlow cache is optimized for high traffic volumes. Which configuration step is required to enable NetFlow on the interface?
30A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor voice quality. Which Cisco DNA Center Assurance feature should be used to analyze the issue and determine the root cause?
31A network administrator is examining the output of the show interfaces command on a switch and notices a high number of CRC errors on a Gigabit Ethernet port. What is the most likely cause of these errors?
32A network engineer has configured a Cisco IOS IP SLA operation using ICMP echo to monitor reachability to a remote branch router. The engineer wants to correlate the results with syslog messages and SNMP traps to detect when the branch becomes unreachable. Which IP SLA configuration step is required to generate these notifications?
33A network administrator is troubleshooting a Cisco Catalyst switch and suspects a Layer 2 loop. The administrator wants to verify the Spanning Tree Protocol (STP) topology and identify the root bridge. Which command should be used?
34A network administrator is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to a SaaS application. The administrator suspects that the issue is related to the application-aware routing policy not correctly identifying the application. Which component of Cisco SD-WAN is responsible for identifying applications in the data plane?
35A network engineer is configuring a Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch to capture traffic from a specific VLAN. Which configuration command is required to monitor all traffic on VLAN 10 and send it to a destination port?
36A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that the health score for a particular building has dropped significantly. Which feature of Cisco DNA Center Assurance should the administrator use to identify the root cause of the issue by analyzing network events and device performance metrics over time?
37A network engineer is analyzing traffic flows on a Cisco Nexus switch and needs to collect NetFlow data. The engineer wants to export flow records to an external collector at 192.168.100.50 on port 2055. Which configuration step is required to enable NetFlow export?
38A network engineer is analyzing the output of 'show ip sla statistics' on a Cisco IOS router. The engineer notices that the SLA operation is returning 'Timeout' for several probes. Which two statements are true about the potential causes of this issue? (Choose two.)
39A network administrator is troubleshooting a connectivity issue between two switches connected via a trunk link. The trunk is configured with 802.1Q encapsulation. The administrator suspects that the native VLAN is mismatched. Which command displays the native VLAN configuration on a Cisco Catalyst switch?
40A network engineer is analyzing the output of the show processes cpu sorted command on a Cisco Catalyst 9300 switch and notices that the CPU utilization is consistently high. Which two methods can help identify the cause of high CPU utilization? (Choose two.)
41A network engineer is troubleshooting a connectivity issue and wants to verify the path that packets take from a Cisco IOS XE router to a remote destination. Which command provides a hop-by-hop listing of the path, including latency information for each hop?
42A network engineer is using Cisco DNA Center Assurance to monitor and troubleshoot a network. The engineer wants to use the Assurance features to proactively detect issues and receive recommendations. Which two statements are true about Cisco DNA Center Assurance capabilities? (Choose two.)
43A network administrator is analyzing NetFlow data on a Cisco IOS router to identify top talkers. The administrator notices that a large amount of traffic is being exported but the NetFlow cache is filling up quickly. Which action should the administrator take to reduce the cache size while maintaining visibility into the most significant flows?
44A network administrator is analyzing syslog messages from a Cisco Catalyst switch and notices the message %SW_MATM-4-MACFLAP_NOTIF: Host 0000.1111.2222 in vlan 10 is flapping between port Gi1/0/1 and port Gi1/0/2. What is the most likely cause of this message?
45A network engineer is analyzing traffic flows using Cisco IOS NetFlow on a router. The engineer notices that the NetFlow cache is filling up rapidly, causing older entries to be exported prematurely before they can be properly aggregated. Which NetFlow configuration parameter should the engineer adjust to control the maximum number of entries in the cache?
46A network administrator is troubleshooting a network issue using Cisco DNA Center Assurance. The administrator wants to identify which network devices are experiencing the highest number of errors, such as CRC errors and interface flaps. Which Assurance dashboard should the administrator use?
47A network engineer is deploying Cisco DNA Center Assurance and wants to ensure that the system can accurately monitor and troubleshoot network issues. Which two statements about Cisco DNA Center Assurance are true? (Choose two.)
48A network engineer is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The engineer wants to view detailed hop-by-hop performance metrics for the path between the user's endpoint and the voice gateway over the last 24 hours. Which Assurance feature should the engineer use?
49A network administrator needs to validate that the path taken by packets from a branch router to a remote server matches the expected primary path. The administrator wants to collect per-hop latency and packet loss statistics along that path. Which tool should be used?
50A network engineer is deploying Cisco DNA Center Assurance to monitor a campus fabric. The engineer needs to verify that the fabric underlay and overlay health scores are being calculated correctly. Which data source does Cisco DNA Center Assurance primarily use to compute the fabric health score?
51A network engineer is configuring a Cisco Catalyst switch to send flow data to a NetFlow collector for traffic analysis. The engineer wants to ensure that only ingress traffic on a specific interface is exported. Which command is required to enable NetFlow on that interface?
52A network engineer is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The engineer notices that the client's health score is low due to onboarding failures. Which component of Cisco DNA Center Assurance should be examined first to identify the root cause?
53A network administrator is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The client is associated to a wireless controller but cannot reach the default gateway. The administrator notices that the client's onboarding status shows 'DHCP failed'. Which Assurance feature should the administrator use to trace the client's path and identify where DHCP packets are being dropped?
54A network engineer is troubleshooting why a newly added Cisco Catalyst 9300 switch is not appearing in Cisco DNA Center's topology view, even though it is reachable via SSH from the management network. The switch has been configured with the correct SNMP community string. Which protocol must be enabled on the switch for Cisco DNA Center to discover and monitor it?
55A network engineer is troubleshooting intermittent packet loss on a WAN circuit connecting a branch office to headquarters. The engineer suspects the provider is not honoring the committed rate. Which tool should be used to measure one-way delay, jitter, and packet loss between the two sites and generate threshold-based alerts?
56A network administrator is implementing NetFlow on a Cisco IOS XE router to monitor traffic. Which two statements about NetFlow are true? (Choose two.)
57A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)
58A network administrator is using Cisco DNA Center Assurance to monitor the health of wireless clients. The administrator notices that some clients are experiencing poor performance, but the Assurance dashboard shows them as 'Good'. Which action should the administrator take to troubleshoot the issue?
59A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when the number of clients on a specific wireless controller exceeds a threshold. Which feature in Cisco DNA Center Assurance should be used to configure this?
60A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when a switch's health score drops below a threshold. Which Assurance feature should be configured to generate these alerts?
61A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator notices that a particular client device shows a health score of 'Poor' but the switch port statistics indicate no errors or drops. Which Cisco DNA Center Assurance feature should the administrator use to identify the root cause of the poor health score?
62A network administrator is using Cisco DNA Center to monitor the health of network devices. The administrator wants to see a summary of the overall network health and any issues that need attention. Which Cisco DNA Center feature provides this information?
63A network engineer is using Cisco DNA Center Assurance to monitor a network with Cisco SD-Access fabric. The engineer notices that the fabric health score is consistently low, but individual device health scores are high. Which component of the fabric should the engineer investigate first?
64A network engineer is using Cisco DNA Center's Assurance to troubleshoot a performance issue reported by users on a specific floor. The engineer wants to analyze the path that traffic takes from a client to a server in the data center, including details of each hop such as device, interface, and any ACLs applied. Which Cisco DNA Center Assurance feature provides this information?
65A network engineer has configured an IP SLA operation on a Cisco router to monitor the reachability of a remote server. The engineer wants to ensure that the operation sends ICMP echo requests every 30 seconds and that the router tracks the operation's state to influence a static route. Which command is required to associate the IP SLA operation with the static route?
66A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing intermittent connectivity drops. The administrator wants to view the historical trend of the client's connectivity and identify the root cause. Which Cisco DNA Center Assurance feature should the administrator use?
67A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator wants to receive alerts when the onboarding time for wireless clients exceeds a defined threshold. Which Cisco DNA Center Assurance feature should be configured to accomplish this?
68A network administrator is analyzing the output of 'show ip sla statistics' on a Cisco router. Which two statements correctly describe the information provided by this command? (Choose two.)
69A network engineer is deploying Cisco SD-Access and needs to ensure that fabric edge nodes can register with the fabric control plane node. Which protocol is used for this registration and for endpoint location mapping?
70A network administrator is analyzing traffic flows using Cisco DNA Center Assurance. The administrator wants to see which applications are consuming the most bandwidth on a specific interface of a Catalyst 9500 switch. Which feature should be enabled on the switch to provide this level of granularity?
71A network engineer is troubleshooting a routing loop between two OSPF areas. To verify the path that packets are taking, the engineer decides to use the Cisco IOS Embedded Event Manager (EEM) to generate a syslog message when the OSPF neighbor state changes. Which EEM applet configuration is required to trigger on the OSPF neighbor state change?
72A network engineer is deploying Cisco DNA Center Assurance to monitor a campus network. The engineer wants to leverage machine learning to baseline normal behavior and detect anomalies without manually defining thresholds. Which capability should be enabled?
73A network engineer is troubleshooting why a Cisco Catalyst 9300 switch is not exporting flow data to a NetFlow collector. The engineer verified that the flow record and exporter are correctly configured and that the collector is reachable. Which additional configuration is required on the switch to enable Flexible NetFlow?
74A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device is experiencing frequent disconnects. Which Assurance feature should be used to view a chronological list of events related to that specific client, including association, authentication, and roaming events?
75A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device shows a poor health score. Which Cisco DNA Center Assurance feature should the administrator use to determine the root cause of the poor health score?
76A network administrator is using Cisco DNA Center to monitor a campus network. The administrator wants to receive an alert when a switch's CPU utilization exceeds 80% for more than 5 minutes. Which feature should be configured?
77A network administrator is troubleshooting a network performance issue and suspects a duplex mismatch on a switch port. Which command should be used to verify the duplex settings on a Cisco switch interface?
78A network administrator is using the Cisco DNA Center Assurance application to troubleshoot a user's slow wireless experience. The administrator notices that the client's onboarding time is high and wants to see a detailed timeline of the client's onboarding process, including association, authentication, and DHCP phases. Which Cisco DNA Center Assurance feature provides this information?
79A network engineer is using NetFlow to monitor traffic on a Cisco router. The engineer wants to export NetFlow data to a collector for analysis. Which two commands are required to configure NetFlow export on the router? (Choose two.)
80A network engineer is deploying IP SLA to monitor network performance. The engineer needs to configure an IP SLA operation that measures jitter and packet loss between two Cisco routers. Which two statements are true about configuring IP SLA for this purpose? (Choose two.)
81A network engineer is using Cisco DNA Center Assurance to troubleshoot a wireless client that frequently disconnects. The engineer wants to identify the root cause by examining relevant assurance data. Which two types of information are available in the Client 360 view to help diagnose the issue? (Choose two.)
82A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing intermittent packet drops. The engineer suspects a hardware forwarding issue and needs to verify the status of the switch's forwarding ASIC and its associated resources. Which command should the engineer use to display the current ASIC and forwarding resource utilization?
83A network administrator is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The administrator wants to identify whether the issue is related to the network or the application. Which two Assurance features should be used to gather relevant data? (Choose two.)
84A network engineer is analyzing traffic patterns using Cisco IOS IP Service Level Agreements (IP SLA). The engineer wants to measure the round-trip time (RTT) for HTTP traffic to a web server at 10.1.1.1. Which IP SLA operation type should be configured?
85A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to the data center. The engineer suspects that the issue is related to the Bidirectional Forwarding Detection (BFD) configuration on the WAN Edge routers. Which Cisco SD-WAN component is responsible for establishing BFD sessions between WAN Edge routers?
86A network technician is troubleshooting a switch that is experiencing high CPU utilization. The technician runs the command 'show processes cpu sorted' and notices that the process 'ARP Input' is consuming a large percentage of CPU. Which action should the technician take to mitigate this issue?
87A network engineer is analyzing network traffic using Cisco IOS Embedded Packet Capture (EPC) on a Cisco ISR router. The engineer wants to capture only TCP packets with a source port of 80 and a destination IP address of 10.1.1.1. Which EPC configuration is required to achieve this?
Deep-dive questions
The most-searched questions in this domain — detailed explanations, worked examples, full answer breakdowns.
Configure and verify Cisco IOS tools like SNMPv3, NetFlow, SPAN/RSPAN, and IP SLA probes to monitor live traffic. The critical skill is reading syslog severity levels and IP SLA tracking output correctly.
The Courseiva 350-401 question bank contains 87 questions in the Network Assurance domain, covering the 10% of the exam attributed to this domain in the official Cisco blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Network Assurance domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included