350-401 Mock Exam 102 — 25 Questions

Question 1

A network engineer is deploying Cisco SD-Access and needs to integrate a new fabric site with an existing traditional network. The requirement is to allow endpoints in the fabric to communicate with external networks while preserving their fabric-assigned IP addresses and providing policy enforcement. Which component is responsible for this integration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fabric border node. The fabric border node is the component that connects the SD-Access fabric to external networks. It handles route redistribution between the fabric and external routing domains, preserves endpoint IP addresses, and can enforce policy using SGTs. Edge, control plane, and intermediate nodes have different roles and do not provide external integration.

Answer

Fabric control plane node

Answer

Fabric edge node

Answer

Fabric intermediate node

Question 2

A network engineer is troubleshooting a Cisco Nexus 9000 leaf switch that is part of a VXLAN EVPN fabric. The engineer notices that the leaf is not learning remote MAC addresses, although the underlay is operational and BGP EVPN sessions are established. Which action should the engineer take to verify that the leaf is receiving EVPN Type 2 routes?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' on the leaf.. To verify that the leaf is receiving EVPN Type 2 routes, you must examine the BGP EVPN table. The command 'show bgp l2vpn evpn' displays all EVPN routes, including Type 2 MAC/IP advertisement routes. If these routes are missing, the leaf will not learn remote MAC addresses. Other commands like 'show nve peers' show VTEP peers but not MAC routes, and 'show vxlan interface' shows tunnel configuration, not routes.

Answer

Check the output of 'show vxlan interface' on the leaf.

Answer

Check the output of 'show ip route' on the leaf.

Answer

Check the output of 'show nve peers' on the leaf.

Question 3

A network engineer is configuring a Cisco IOS XE router to support Network Address Translation (NAT) for a small office. The router has an inside interface GigabitEthernet0/0/0 and an outside interface GigabitEthernet0/0/1. The engineer wants to translate all inside hosts to the outside interface IP address using PAT. Which configuration snippet correctly implements this?

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0/1 overload; interface GigabitEthernet0/0/0: ip nat inside; interface GigabitEthernet0/0/1: ip nat outside; access-list 1 permit 192.168.1.0 0.0.0.255. The correct PAT configuration for translating all inside hosts to the outside interface IP uses the ip nat inside source list command with the interface keyword and overload. The access list defines the inside subnet, and interfaces are marked inside and outside. Static NAT, NAT pools, and outside source NAT do not meet the specific requirement of translating all inside hosts to the outside interface IP.

Answer

ip nat inside source static 192.168.1.10 203.0.113.1; interfaces marked inside/outside; no access-list needed

Answer

ip nat inside source list 1 pool MYPOOL overload; ip nat pool MYPOOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0; interfaces marked inside/outside; access-list 1 permit 192.168.1.0 0.0.0.255

Answer

ip nat outside source list 1 interface GigabitEthernet0/0/0 overload; interfaces marked inside/outside; access-list 1 permit any

Question 4

A network architect at a large university is designing a new campus network that must support seamless roaming for thousands of wireless clients across multiple buildings. The design requires a centralized control plane with a distributed data plane to avoid traffic tromboning. Which Cisco architecture should the architect implement?

Accepted Answer

Cisco SD-Access with fabric-enabled switches and a fabric controller. Cisco SD-Access fabric provides a centralized control plane using LISP and a distributed data plane using VXLAN, which enables seamless roaming and avoids traffic tromboning by allowing edge nodes to forward traffic directly. This architecture is specifically designed for campus networks requiring mobility and scalability.

Answer

Cisco Digital Network Architecture (DNA) Center with traditional campus switching

Answer

Cisco Application Centric Infrastructure (ACI) with spine-leaf topology

Answer

Cisco Software-Defined WAN (SD-WAN) with vManage and vSmart controllers

Question 5

A network administrator is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a customer. The administrator wants to ensure that traffic from the customer's VRF can reach the internet through a global routing table. Which feature should be configured to allow communication between the VRF and the global routing table?

Accepted Answer

Route leaking. Route leaking allows routes to be exchanged between VRFs, including the global routing table. By configuring route leaking, you can import routes from the global table into the VRF and export routes from the VRF to the global table. This enables communication between the VRF and the global table, allowing traffic to reach the internet. Other features like NAT or MPLS L3VPN do not provide this local routing capability.

Answer

VXLAN EVPN

Answer

VRF-aware NAT

Answer

MPLS Layer 3 VPN

Question 6

A company is consolidating branch servers onto a single physical host running a hypervisor. The administrator needs each virtual machine to have its own virtual NIC with an independent MAC address and to be isolated at Layer 2 from other virtual machines unless explicitly connected to the same virtual switch. Which component provides this function?

Accepted Answer

The virtual switch inside the hypervisor. The virtual switch is the hypervisor component that gives each virtual machine a virtual NIC and forwards frames between them, enforcing isolation between port groups unless they are connected. The physical switch and trunk only carry traffic once it leaves the host, and the virtual machine monitor handles resource scheduling rather than Layer 2 forwarding.

Answer

The hypervisor's virtual machine monitor alone

Answer

The physical top-of-rack switch

Answer

A VLAN trunk configured on the physical NIC

Question 7

A network engineer at a large enterprise is deploying a new branch office. The branch has two Cisco Catalyst switches, SW1 and SW2, that must participate in the same Layer 2 domain. SW1 is configured as the VTP server with domain 'CORP' and version 2. SW2 is a new switch with a higher VTP revision number and the same domain and password, but it has an empty VLAN database. The engineer connects SW2 to SW1 via a trunk link. What will happen to the VLAN database on SW1?

Accepted Answer

SW1 will synchronize its VLAN database to SW2's database, potentially deleting VLANs.. VTP uses the configuration revision number to determine which switch has the most recent VLAN database. When SW2 with a higher revision number connects, SW1 accepts SW2's advertisement and replaces its own VLAN database, even though SW1 is the server. This can cause VLANs to be deleted, so it is critical to reset the revision number on new switches before connecting them to the production network.

Answer

SW1 will not synchronize because VTP version 2 requires the same configuration revision number.

Answer

SW1 will overwrite SW2's VLAN database because SW1 is the VTP server.

Answer

SW1 will reject SW2's advertisement because SW2 is not a VTP server.

Question 8

A network administrator is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric has two border nodes and four edge nodes. The administrator wants to ensure that traffic from a wired endpoint in VLAN 10 can reach a wireless endpoint in the same VLAN that is roaming between access points. Which component is responsible for mapping the endpoint's IP address to its location in the fabric?

Accepted Answer

The fabric control plane node maintains the mapping in its LISP map-server database.. In Cisco SD-Access, the control plane node hosts the LISP map-server and map-resolver, maintaining the database of endpoint-to-RLOC mappings. Edge nodes register endpoints and query the control plane to resolve destinations. This centralized mapping enables seamless mobility and policy enforcement across the fabric.

Answer

The fabric intermediate node acts as a LISP proxy ETR to provide the mapping.

Answer

The fabric edge node caches the mapping and shares it directly with other edge nodes via LISP pub-sub.

Answer

The fabric border node performs the mapping using the LISP map-server function.

Question 9

A network engineer is implementing Cisco SD-Access and needs to ensure that endpoints in a virtual network can communicate with a shared service that resides in a different virtual network. The shared service must be reachable from multiple virtual networks without duplicating the service. Which SD-Access component should be configured to provide this inter-VN communication?

Accepted Answer

Fusion router. The fusion router is specifically designed to enable inter-VN communication and shared services in Cisco SD-Access. It connects to the fabric border node and uses VRF leaking to allow endpoints in different virtual networks to reach common services. Fabric edge nodes, border nodes, and control plane nodes have different roles and do not provide this function. The fusion router ensures that shared services are not duplicated across VNs.

Answer

Control plane node

Answer

Fabric edge node

Answer

Fabric border node

Question 10

A network engineer is deploying a Cisco Nexus 9000 leaf switch in a VXLAN EVPN fabric. The underlay uses OSPF for loopback reachability, and the engineer must now enable the control plane that carries MAC and IP address reachability information for the overlay. Which technology must be enabled on the leaf switch to distribute this overlay reachability information?

Accepted Answer

MP-BGP with the Layer 2 EVPN address family. In a VXLAN EVPN fabric, the underlay (here OSPF) provides loopback-to-loopback reachability between VTEPs, while the overlay control plane is MP-BGP with the L2VPN EVPN address family. Enabling that address family allows the leaf to advertise MAC and IP address routes and VTEP membership through the spine route reflectors, replacing flood-and-learn with a scalable, standards-based control plane.

Answer

LISP with a Map-Server and Map-Resolver

Answer

OSPFv3 with the IPv6 unicast address family

Answer

PIM sparse mode with an Anycast-RP

Question 11

A network administrator is configuring a VXLAN EVPN fabric. The administrator wants to optimize the forwarding of broadcast, unknown unicast, and multicast (BUM) traffic by using a multicast group per VLAN. Which VXLAN feature should be configured on the VTEPs to achieve this?

Accepted Answer

Multicast underlay with PIM Sparse Mode. Using a multicast underlay with PIM Sparse Mode allows each VLAN to be mapped to a unique multicast group, so BUM traffic is replicated only to VTEPs that have joined that group. This optimizes bandwidth and reduces unnecessary flooding. Ingress replication and anycast VTEP do not provide per-VLAN multicast group mapping. EVPN IRB is for routing, not BUM optimization.

Answer

Ingress replication

Answer

EVPN Integrated Routing and Bridging (IRB)

Answer

Anycast VTEP

Question 12

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The underlay network is OSPF, and the overlay uses BGP EVPN. The engineer notices that VM traffic between two hosts on different VTEPs is not being encapsulated. Which action should be taken to ensure VXLAN traffic is properly encapsulated and forwarded?

Accepted Answer

Enable VXLAN feature and configure the NVE interface with a source interface and a VNI mapping to the VLAN.. VXLAN encapsulation requires the NVE interface to be configured with a source interface and VNI-to-VLAN mapping. Enabling the VXLAN features and configuring the NVE interface are essential steps. Without these, the switch will not encapsulate traffic, even if the underlay and overlay routing are correct.

Answer

Ensure that the underlay OSPF cost is equal on all links to allow ECMP for VXLAN traffic.

Answer

Configure a VRF for the overlay and redistribute the VRF routes into OSPF.

Answer

Configure a VXLAN tunnel interface with the source interface as the loopback0 and the destination as the remote VTEP's loopback0.

Question 13

A network engineer is implementing Cisco SD-Access for a campus network. The fabric uses LISP for control plane and VXLAN for data plane. The engineer needs to ensure that endpoints in the same VLAN but on different fabric edge nodes can communicate. Which Cisco SD-Access component is responsible for mapping endpoint EIDs to RLOCs?

Accepted Answer

Control plane node. In Cisco SD-Access, the control plane node provides LISP map-server and map-resolver services. It stores the EID-to-RLOC mappings for all endpoints registered by fabric edge nodes. When an edge node needs to send traffic to an endpoint on another edge node, it queries the control plane node to resolve the destination RLOC, enabling VXLAN encapsulation and forwarding. This centralizes mapping and supports mobility.

Answer

Fabric border node

Answer

Fabric edge node

Answer

Intermediate node

Question 14

A network engineer is configuring Cisco ACI to extend a Layer 2 bridge domain to an external Layer 2 network. The engineer must ensure that the ACI fabric can forward traffic between the bridge domain and the external network without routing. Which ACI construct should be configured to achieve this?

Accepted Answer

Layer 2 Outside (L2Out). To extend a Layer 2 bridge domain to an external Layer 2 network in Cisco ACI, the correct construct is a Layer 2 Outside (L2Out). L2Out maps the bridge domain to an external VLAN and allows Layer 2 traffic to traverse between the fabric and the external switch without routing. Other constructs like L3Out, Tenant, or VRF do not provide this Layer 2 extension capability. Therefore, L2Out is the correct choice.

Answer

Layer 3 Outside (L3Out)

Answer

Tenant

Answer

VRF

Question 15

A network engineer is learning about data models used in network automation. The engineer needs to choose a data modeling language that is human-readable, supports hierarchical data structures, and is used by NETCONF and RESTCONF to define the structure of configuration and state data. Which data modeling language should the engineer choose?

Accepted Answer

YANG. YANG is the data modeling language standardized by IETF for NETCONF and RESTCONF. It provides a hierarchical, human-readable way to model configuration and state data. JSON and XML are serialization formats used to encode data, but they do not define the data model. SNMP MIBs are for SNMP and not used by NETCONF/RESTCONF. Therefore, YANG is the correct choice for modeling data in modern network automation.

Answer

JSON

Answer

XML

Answer

SNMP MIB

Question 16

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch uplink between two buildings to protect Layer 2 traffic. The team wants to ensure that the link encrypts traffic and that the peer is authenticated before secure communication begins. Which configuration approach meets these requirements?

Accepted Answer

Enable MACsec with MKA using a pre-shared key or 802.1X-derived CAK, and set the switchport to macsec desired or must.. MACsec provides Layer 2 hop-by-hop encryption and integrity using 802.1AE, with the MACsec Key Agreement protocol handling key exchange and peer authentication. On Catalyst 9000, the supported design uses MKA with a connectivity association key from a pre-shared key or 802.1X, plus an interface mode of macsec desired or macsec must to enforce encrypted, authenticated links.

Answer

Enable IPsec transport mode on the switch uplink with a crypto map and IKEv2 pre-shared key.

Answer

Enable port security with sticky MAC addresses and storm control on the uplink to secure the connection.

Answer

Enable 802.1AE without MKA and manually configure static secure associations on both ends.

Question 17

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric uses LISP for control plane and VXLAN for data plane. Which component is responsible for mapping endpoint IP addresses to fabric edge nodes?

Accepted Answer

Control plane node. In Cisco SD-Access, the control plane node runs LISP Map-Server and Map-Resolver. It maintains the mapping of endpoint IP addresses to the RLOC of the fabric edge node where the endpoint is connected. When an edge node needs to forward traffic to an endpoint, it queries the control plane node to obtain the mapping, enabling VXLAN encapsulation. The border and intermediate nodes do not perform this mapping function.

Answer

Fabric edge node

Answer

Fabric intermediate node

Answer

Fabric border node

Question 18

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a remote subnet 10.10.10.0/24. The DHCP server is located at 172.16.1.100. The engineer issues the command 'ip helper-address 172.16.1.100' on interface GigabitEthernet0/0, which is the gateway for that subnet. However, clients on the subnet are not receiving IP addresses. What is the most likely cause?

Accepted Answer

The DHCP server is not reachable from the router because a route to 172.16.1.100 is missing.. The 'ip helper-address' command relays DHCP broadcasts to a specified server, but the router must have a route to that server. Without a route to 172.16.1.100, the relayed packets are dropped, and clients cannot obtain addresses. Ensuring IP reachability to the DHCP server is essential for successful relay operation.

Answer

The 'service dhcp' command is disabled globally on the router.

Answer

The 'ip helper-address' command must be configured on the interface facing the DHCP server, not the client-facing interface.

Answer

The DHCP server is configured to use a different subnet mask than the clients require.

Question 19

A network engineer is configuring IPsec VPN on a Cisco IOS router. The requirement is to encrypt traffic between two sites using IKEv2. The engineer wants to ensure that the IKEv2 proposal uses AES-256 for encryption, SHA-256 for integrity, and Diffie-Hellman group 14. Which command correctly defines the IKEv2 proposal with these parameters?

Accepted Answer

crypto ikev2 proposal PROP encryption aes-cbc-256 integrity sha256 group 14. The correct command to define an IKEv2 proposal with specific encryption, integrity, and DH group is under crypto ikev2 proposal, using the encryption, integrity, and group keywords. The policy command only references a proposal, and ISAKMP policy is for IKEv1. The keyring is for authentication, not proposal parameters.

Answer

crypto ikev2 keyring KEYRING peer SITE address 1.1.1.1 pre-shared-key local secret

Answer

crypto isakmp policy 10 encryption aes 256 hash sha256 group 14

Answer

crypto ikev2 policy POLICY proposal PROP encryption aes-256 integrity sha256 group 14

Question 20

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The requirement is to provide sub-second failover for IPv4 hosts and to load-balance traffic between the two switches for different VLANs. Which protocol should be used to meet these requirements?

Accepted Answer

Gateway Load Balancing Protocol (GLBP). GLBP is designed to provide both redundancy and load balancing. It elects an Active Virtual Gateway that assigns virtual MAC addresses to up to four Active Virtual Forwarders, allowing multiple switches to share the traffic load while providing sub-second failover. HSRP and VRRP can provide redundancy but require manual configuration for load balancing, and IRDP lacks the necessary features.

Answer

ICMP Router Discovery Protocol (IRDP)

Answer

Hot Standby Router Protocol (HSRP) version 1

Answer

Virtual Router Redundancy Protocol (VRRP) version 3