350-401 Cheat Sheet

Key concepts

• ✓Cisco SD-WAN segmentation using VPNs and VRF-aware routing for guest, employee, and IoT traffic
• ✓SD-Access underlay requirements: IP reachability, MTU, and routing protocol consistency
• ✓OSPF LSA types in totally stubby areas (Type 1, Type 2, Type 3 only)
• ✓QoS low-latency queuing (LLQ) for strict priority of voice traffic on outbound interfaces

Watch out for

• ⚠Assuming a totally stubby area still allows Type 4 or Type 5 LSAs; it blocks them and uses a default route instead.
• ⚠Confusing SD-WAN VPN segmentation with traditional VRF-lite; SD-WAN uses VPN IDs and BFD across overlays.
• ⚠Believing SD-Access underlay requires a specific routing protocol like IS-IS, when any IP-routed underlay works.

Key concepts

• ✓Distinguishing Type 1 and Type 2 hypervisors and their Cisco deployment use cases
• ✓Configuring VRFs to isolate routing and forwarding tables on IOS XE devices
• ✓Describing VXLAN encapsulation, VTEP operation, and Layer 2 over Layer 3 extension
• ✓Using Cisco IOS XE guestshell and virtual routing to host services on one device

Watch out for

• ⚠Treating VRF as a security feature; it separates routing tables but does not encrypt or firewall traffic by itself.
• ⚠Confusing VXLAN VNI mapping with VLAN ID mapping, assuming the two identifiers must always match.
• ⚠Assuming guestshell runs a full independent OS image rather than a Linux container inside IOS XE.

Key concepts

• ✓Configuring 802.1Q trunk and access ports, native VLAN, and VTP modes on IOS switches
• ✓Comparing RSTP, MST, and PVST+ port roles, states, and root bridge election
• ✓Tuning OSPF neighbor adjacencies, network types, cost, and passive interfaces
• ✓Implementing HSRP, VRRP, or GLBP and verifying with show standby brief

Watch out for

• ⚠Mixing up HSRP active/standby versus VRRP master/backup terminology, and forgetting HSRP's default priority of 100
• ⚠Assuming DTP negotiates trunks on all platforms; some Catalyst switches default to dynamic auto or access
• ⚠Configuring OSPF passive interfaces on links that must form adjacencies, silently blocking hello packets

Key concepts

• ✓Configuring syslog logging levels, hosts, and interpreting severity 0-7 messages
• ✓Comparing SNMPv2c community strings with SNMPv3 authPriv users and views
• ✓Building Flexible NetFlow records, exporters, and monitors for traffic analysis
• ✓Configuring local SPAN, RSPAN, and ERSPAN source/destination sessions on switches

Watch out for

• ⚠Confusing syslog severity numbers: lower numbers are more severe, so level 0 is emergencies and level 7 is debugging.
• ⚠Assuming SNMPv3 encryption is mandatory; authNoPriv provides authentication but no privacy, unlike authPriv.
• ⚠Forgetting that a SPAN destination port stops normal switching and cannot source traffic while monitoring.

Key concepts

• ✓Configuring AAA with TACACS+ or RADIUS, including authentication, authorization, and accounting method lists
• ✓Implementing Layer 2 protections: port security, DHCP snooping, Dynamic ARP Inspection, and 802.1X with MAB
• ✓Building and ordering standard, extended, and named ACLs, plus Control Plane Policing for management traffic
• ✓Configuring IPsec site-to-site VPNs and MACsec link encryption, including verifying SA and key status

Watch out for

• ⚠Forgetting that ACL entries are processed top-down with an implicit deny, so a permit placed after a broader deny never matches
• ⚠Mixing up DHCP snooping trust on uplinks versus access ports, which breaks client addressing or leaves snooping ineffective
• ⚠Assuming 802.1X alone handles non-supplicant devices, instead of enabling MAB as a fallback on the same port

Key concepts

• ✓Ansible agentless playbooks over SSH versus Puppet, Chef, and SaltStack agent-based models
• ✓NETCONF and RESTCONF APIs using YANG models on Cisco IOS XE devices
• ✓Data serialization formats JSON, XML, and YAML and their syntax rules
• ✓Python scripting with Cisco SDKs, NETCONF libraries, and REST API calls

Watch out for

• ⚠Assuming Ansible needs an agent on managed devices; it is agentless and relies on SSH or API transport.
• ⚠Confusing NETCONF, which uses SSH and XML, with RESTCONF, which uses HTTP methods and JSON or XML.
• ⚠Treating YANG as a data format rather than a modeling language that defines the structure exposed by NETCONF and RESTCONF.