350-401 Exam Questions and Answers

FlexConnect

FlexConnect is correct because it separates the control plane (which remains with the WLC) from the data plane (which is switched locally at the AP). This allows client traffic to be forwarded directly to the wired network at each access point, avoiding unnecessary latency and controller bottlenecks, which is ideal for high-bandwidth, high-density indoor environments. Furthermore, FlexConnect supports IEEE 802.11r fast roaming and can perform client-based or AP-based neighbor discovery when connected to a WLC, ensuring seamless and fast handoffs as users move across the office. Its design balances centralized management with localized forwarding, offering both the operational consistency of a controller and the performance of distributed switching.

Type 1, Type 2, Type 3 (including default)

In a totally stubby area, the ABR suppresses Type 4 (ASBR-summary) and Type 5 (AS-external) LSAs, and also replaces all Type 3 inter-area summaries with a single default route. This leaves only Type 1 (router) and Type 2 (network) LSAs for intra-area topology, plus the injected Type 3 default LSA for any traffic leaving the area. Therefore, the allowed LSA set is exactly Type 1, Type 2, and the default Type 3.

Feasibility condition

The feasibility condition is EIGRP's loop-free guarantee: a neighbor advertises a reported distance (RD) that is strictly lower than the current feasible distance (FD) to a destination. This proves the neighbor's path does not pass back through the local router, so the path can safely be used as a feasible successor. If no such neighbor exists, DUAL goes active and queries neighbors, but the feasibility condition remains the core mechanism ensuring that any selected path is genuinely loop-free.

Low Latency Queuing (LLQ)

LLQ (Low Latency Queuing) combines a strict-priority queue with CBWFQ: the priority queue is serviced first on every scheduling cycle, before any CBWFQ class queues, so voice is dequeued with minimal and deterministic delay. The priority queue can be policed to a configured rate to prevent a flood of priority traffic from starving the non-priority classes, but within the committed rate voice effectively experiences 'express lane' treatment. This strict-priority scheduling is exactly what makes LLQ the standard QoS queueing strategy for real-time voice traffic in an enterprise.

vlan 100

vlan 100 is the global configuration command that creates a new VLAN with ID 100 and immediately enters VLAN configuration mode. This is the required first step when establishing a new VLAN, as it adds the VLAN to the switch's local VLAN database. From this mode, you can set optional parameters such as the VLAN name, MTU, or other interface-specific settings. Issuing this command makes the VLAN available for subsequent operations like assigning access ports or creating an SVI.

MTU mismatch between the routers

During the EXSTART/EXCHANGE phase, OSPF routers exchange database description (DBD) packets that can be as large as the interface MTU; if one router's MTU is lower, the larger DBD packet will be dropped or fragmented, and the neighbor will never leave EXSTART because it keeps waiting for a valid DBD sequence. The interface MTU mismatch is a classic cause of OSPF adjacencies stuck in EXSTART, as the router with the smaller MTU silently discards the oversized multicast packets. This can be diagnosed by checking the 'show ip ospf neighbor' state and by ensuring both ends have the same MTU or by enabling 'ip ospf mtu-ignore' as a workaround.

The L2Out is not configured to flood BUM traffic.

An L2Out connects the ACI fabric to an external Layer 2 network, but by default BUM (broadcast, unknown unicast, multicast) traffic is not automatically flooded through every L2Out. The 'flood on' setting under the L2Out must be explicitly enabled so that BUM frames received in the BD are also sent to the external network; without it, BUM traffic is dropped or handled only locally. Since this L2Out lacks that flood configuration, the L2 extension does not actually extend L2 flooding, which explains the connectivity problem.

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.

The VNI must be explicitly activated under BGP EVPN. Without the 'vni 10100 l2' configuration inside address-family l2vpn evpn, BGP has no awareness of this L2 VNI and will not originate or import the type-2 (MAC/IP) and type-3 (inclusive multicast) routes needed for remote VTEPs to learn MAC addresses. Adding that command, along with 'evpn' as the address family, is what makes the control plane advertise the VNI. This is the missing configuration causing the issue.

Enables Layer 2 extension across Layer 3 boundaries.

VXLAN tunnels Layer 2 over Layer 3.

Supports up to 16 million logical networks.

VNI provides 16M segments.

Spine switch

Spine switches form the fabric backbone.

APIC controller

APIC manages the ACI fabric.

Leaf switch

Leaf switches connect to endpoints.

The MAC address of the target VM is not being advertised in EVPN type-2 routes because the VM's MAC is learned on a different leaf switch than expected.

In EVPN, each leaf switch advertises locally learned MAC addresses via MP-BGP Type-2 routes. If the target VM's MAC is learned on a leaf different from the one the source leaf expects, or if that leaf has not advertised the route, the source leaf has no EVPN entry for that MAC. It floods the ARP request as BUM, but the reply is sent as unicast, and without a Type-2 route the source cannot properly deliver or cache the reply, leading to unidirectional communication failure.

Create trunk links with 802.1Q subinterfaces on each switch and assign each subinterface to the appropriate VRF.

Creating an 802.1Q trunk with subinterfaces lets each switch or router terminate multiple VLANs on a single physical link, and each subinterface can be explicitly bound to a tenant's VRF. This gives each tenant an isolated routing table; the switch will route packets received on a subinterface using only the routes in that subinterface's assigned VRF. The trunk carries tagged frames for all tenants, but the VRF association ensures that traffic from tenant A's VLAN never enters tenant B's routing path, even though they share the same physical ports and trunk. This is a standard VRF-lite design for inter-switch VRF connectivity.

Authentication is configured on one router but not on the other.

EIGRP authenticates each hello packet and every routing update using a configured key, typically MD5 or SHA-2. If one router has authentication enabled (e.g., 'ip authentication mode eigrp' and 'ip authentication key-chain eigrp') while the peer does not, the receiving router fails the authentication check and silently discards the hello, so no adjacency can ever form. Even a key mismatch or different key-chain name on both sides produces the same failure, making this a classic common cause of missing EIGRP neighbor relationships.

CoS 5, DSCP EF

CoS 5 combined with DSCP EF (Expedited Forwarding, DSCP 46) is the industry-standard marking for voice bearer traffic in a campus network. This dual marking ensures that voice frames are placed in the strict-priority queue at both Layer 2 and Layer 3, providing the low latency, low jitter, and minimal packet loss that real-time audio requires. The EF PHB (Per-Hop Behavior) is designed to guarantee a configured bandwidth and queue service, while CoS 5 aligns with the Cisco-recommended voice VLAN and switch port trust settings, making this the only correct answer.

Configure the port as a trunk port.

A trunk port tags frames with 802.1Q VLAN identifiers, allowing multiple VLANs to traverse one physical link to the router. Access ports carry only a single untagged VLAN, so they cannot satisfy the multi-VLAN requirement.

WPA2-PSK with AES

WPA2-PSK with AES-CCMP is the appropriate choice because it offers robust wireless encryption (AES in counter mode with CBC-MAC) and uses a pre-shared key for straightforward authentication. This configuration is widely supported, passes PCI DSS requirements for strong encryption, and fulfills the stated requirement of using AES-based security. It balances compatibility with strong protection.

The interface MTU does not match.

An MTU mismatch is the classic cause of an OSPF neighbor being stuck in EXSTART; during the Database Description exchange, each router advertises its outgoing interface MTU in the DBD packet header. If one router's interface has a lower MTU, it discards DBD packets that declare a larger MTU, so the neighboring router never receives a valid acknowledgment and remains in EXSTART. Because OSPF does not initialize the DBD exchange until both MTUs are verified equal, the adjacency stalls at the point where the Master/Slave election occurs, exactly matching the reported symptom.

vlan 100

The global configuration command 'vlan 100' creates VLAN 100 and enters VLAN configuration mode, allowing optional parameters such as a name or MTU to be applied. This is the standard and correct method to create a VLAN on modern Cisco IOS switches, as it directly adds the VLAN to the switch's VLAN database and running configuration. Without this command, other VLAN-related commands have no VLAN to act upon.

Enable IP traffic export (NetFlow) on the switch.

NetFlow (IP traffic export) samples and exports flow records containing source/destination IP addresses, Layer 4 ports, protocol numbers, and packet/byte counts to a NetFlow collector. By analyzing these exported records, the administrator can pinpoint exactly which flows are contributing to the saturated 'IP Input' process, such as specific hosts generating large volumes of routed traffic. This local, low-overhead mechanism is specifically designed for flow-level visibility and is the correct tool for this troubleshooting scenario.

Low Latency Queuing (LLQ)

Low Latency Queuing (LLQ) is correct because it integrates a strict priority queue (PQ) with CBWFQ. The LLQ scheduler always empties the priority class before servicing any other CBWFQ class, which guarantees that real-time packets like voice are dequeued first and experience minimal, jitter-free delay. To prevent the PQ from starving other classes, LLQ applies a policer to priority-class traffic, dropping or shaping excess packets while still meeting the latency objective for admitted real-time flows.

The next-hop IP address is not reachable.

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

Internet Group Management Protocol (IGMP)

IGMP is the end-system to router protocol that lets hosts on a directly connected subnet announce their interest in a specific multicast group, which is exactly what an IPTV receiver must do to request a channel. Routers send general queries and process membership reports to maintain an active group list on each interface. IGMPv3 further supports source-specific joins (S,G), enabling explicit control over which IPTV streams are received. Without IGMP, the first-hop router would have no way to know that a host wants multicast traffic.

IP SLA can be used with tracking objects to trigger route changes.

IP SLA operations can be tied to Cisco tracking objects using the 'track' command, where the tracked object state changes based on probe reachability or response-time thresholds. When the probe fails consecutive times, the tracking object transitions to 'down', which can trigger a floating static route, policy-based routing, or other route manipulation to redirect traffic. This creates a dynamic failover or convergence mechanism driven by synthetic traffic rather than solely by physical link state.

IP SLA can measure jitter between two devices.

IP SLA supports a UDP jitter operation that sends a series of synthetic UDP packets at a predetermined rate and interval between a source and destination running the IP SLA Responder. By embedding sequence numbers and timestamps in the packets, the operation calculates jitter (inter-packet delay variance), one-way delay, and packet loss. This provides a quantitative measure of network QoE, which is especially useful for VoIP and video traffic, and it does not rely on actual user data.

Broadcast storms

A broadcast storm floods every port with endlessly circulating frames, forcing the switch CPU to process enormous volumes of broadcast traffic and replicate frames across the broadcast domain. This software-path processing load, rather than normal hardware switching, is what drives control-plane CPU utilisation upward.

Frequent STP topology changes

Each STP topology change triggers recalculation, flushing MAC address tables and generating TCN BPDUs processed by the CPU. Frequent flapping or unstable links therefore cause repeated reconvergence, a well-known driver of high CPU on Catalyst switches.

ACL logging with 'log' keyword

ACL logging with the log keyword punts matching packets to the switch's CPU for syslog generation, so high traffic volumes hitting logged entries drive CPU utilisation up sharply. This is a recognised control-plane cause of elevated Catalyst switch CPU.

switchport port-security maximum 2 switchport port-security violation shutdown

This is the correct configuration. It sets the maximum number of secure MAC addresses to 2 and also specifies the violation action as 'shutdown'. When a third MAC address attempts to use the port, the switch places the interface in an err-disabled state, which completely disables the port and blocks all traffic, satisfying the requirement to disable the interface upon a violation.

authentication port-control auto

This command sets the port's authentication mode to auto, meaning the port will be unauthorized until the client successfully authenticates via 802.1X. It triggers the authentication process and is the required command to enable 802.1X on an interface. This is the correct answer because it directly controls the port's state based on authentication.

class-map match-all SSH match protocol ssh policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop class class-default police 8000 conform-action transmit exceed-action drop

This is the correct CoPP configuration: `class-map match-all SSH` with `match protocol ssh` classifies SSH control-plane traffic, and the policy map `COPP` applies a police rate of 1,000,000 bps with a burst of 2000 bytes, dropping exceeding traffic. The `class-default` then polices all other control-plane traffic at 8000 bps, ensuring that no unclassified protocol can flood the CPU. The syntax and parameters are correctly ordered (rate in bps, burst in bytes), providing comprehensive control-plane protection.

access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443

This is the correct configuration for transparent mode. The global access-list is the only ACL applied to a transparent ASA, and it evaluates all traffic crossing the Layer 2 bridge. The rule precisely matches the requirement: source is the inside subnet 192.168.1.0/24, destination is any, and service is TCP 443 (HTTPS), thus permitting only outbound HTTPS from the inside network while implicitly denying everything else. This adheres to least-privilege access control and is applied globally so that traffic from any interface, including the inside, is filtered consistently.

Disable Dynamic Trunking Protocol (DTP) on all access ports.

Prevents trunk negotiation.

Set the native VLAN to an unused VLAN ID on all trunk ports.

Mitigates double-tagging VLAN hopping.

It uses Security Group Tags (SGTs) to classify traffic.

SGTs are used for classification.

It provides data confidentiality using IEEE 802.1AE (MACsec) encryption.

MACsec provides link-layer encryption.

It uses Security Group Access Control Lists (SGACLs) to enforce policies.

SGACLs are enforced based on SGTs.

The switch is not assigned to a site

In DNA Center, CLI templates are created and then associated with a site, and devices that are not assigned to a site cannot be targeted by the provisioning workflow that applies those templates. Template configuration via the 'Provision' workflow only operates on devices that belong to a selected site in the network hierarchy. Thus the correct fix is to assign the switch to a site, after which the templates and compliance checks become applicable.

Run ssh-add on the control node to add the private key to the SSH agent

Running ssh-add on the control node is the correct solution because it loads the passphrase-protected private key into the running SSH agent, where its decrypted form is retained for the duration of the agent session. Once the key is in the agent, Ansible's SSH connections can use it transparently without prompting for the passphrase, since the agent responds to authentication requests. This directly addresses the root cause: the key must be pre-authenticated to the SSH agent before Ansible attempts to connect, and ssh-add is the standard way to do that in an automated, non-interactive workflow.

The IP address of the Catalyst Center appliance changed after the upgrade

If the Catalyst Center appliance's IP address is changed after an upgrade, the management network's routing and ARP entries are disrupted. Devices that are configured to send telemetry or accept management commands to/from the old IP address will no longer be reachable, because their ARP caches, DHCP reservations, or static routes still reference the previous address. Additionally, any access control lists on the devices that permit management traffic from the appliance's old IP will silently drop the new source address. This directly explains why all devices become unreachable after the upgrade, even though the appliance itself is up.

The device's SSH server is not fully initialized

This error from Netmiko/Paramiko means the SSHTransport object is not in an active state when invoke_shell() is called. On Cisco devices, this commonly occurs when the device is still booting and the SSH server has not fully initialized—for example, RSA keys are still being generated—so the server accepts TCP but aborts the SSH protocol handshake, leaving the client transport inactive.

Chef client

The Chef client is the enforcement agent that runs directly on each managed device, including network infrastructure such as IOS XE, NX-OS, or IOS XR when Cisco devices are integrated with Chef. It performs the convergence loop by querying the Chef server for the node's run list, evaluating the current state using Ohai, and then executing resources to bring the device to the desired configuration. This on-device agent is precisely the component that applies the automated configuration, making it the correct answer.

DNA Center uses a declarative model for network configuration.

DNA Center's intent-based declarative model lets engineers define the desired end state, and the controller computes and applies device configuration to reach it. This contrasts with imperative per-device CLI configuration, and is a defining characteristic of DNA Center automation.

DNA Center provides a single dashboard for network management.

DNA Center consolidates assurance, design, policy, and provisioning into one management interface, giving visibility across the entire campus fabric rather than per-device views. This single-pane-of-glass dashboard is a core automation and management characteristic of the platform.