350-401 Practice Test 11 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces
EIGRP-IPv4 Interfaces for AS(100)

Interface                   Peers    Xmit Queue   Mean   Pacing Time   Multicast    Pending
                           Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes
Gi0/0                         1       0/0       12       0/10        50           0
Gi0/1                         1       0/0       15       0/10        55           0

Based on this output, what can be concluded?

Accepted Answer

Interface Gi0/1 has higher latency than Gi0/0.. The 'Mean SRTT' (Smooth Round-Trip Time) column shows the average time in milliseconds for EIGRP packets to reach a neighbor and receive an acknowledgment. Gi0/1 has an SRTT of 15 ms, while Gi0/0 has an SRTT of 12 ms, indicating higher latency on Gi0/1. This directly correlates to the path's delay, which EIGRP uses in its composite metric calculation.

Answer

Both interfaces have pending routes to send.

Answer

The router is using EIGRP named mode.

Answer

There is a queue backlog on Gi0/0.

Question 2

Drag and drop the steps of EIGRP DUAL route computation into the correct order, from first to last.

Accepted Answer

Identify feasible successors using reported distance. EIGRP DUAL first identifies feasible successors via reported distance, then selects the best path as successor. If the successor fails, it checks feasible successors; if none exist, it goes active and queries neighbors. After replies, it computes a new successor.

Question 3

Drag and drop the steps of EIGRP route summarization configuration into the correct order, from first to last.

Accepted Answer

Enable EIGRP with router eigrp AS. EIGRP route summarization first requires enabling EIGRP, configuring the network statement, then entering interface configuration mode, applying the summary-address command, and finally verifying the summary route in the routing table.

Question 4

Which TWO statements about NETCONF and YANG are true?

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and state data. Option D is correct because YANG (RFC 7950) is a data modeling language specifically designed to define the structure of configuration and state data, as well as notifications and RPCs, for network devices. It provides a hierarchical, schema-based representation of data that can be serialized into XML or JSON, making it the standard for modeling NETCONF and RESTCONF datastores.

Answer

NETCONF sessions are stateless

Answer

YANG defines both the data model and the RPC operations for network devices

Answer

NETCONF uses TLS as the mandatory transport protocol

Question 5

Drag and drop the steps of EIGRP neighbor establishment into the correct order, from first to last.

Accepted Answer

Send Hello packets to discover neighbors. EIGRP neighbor formation begins with sending Hello packets, then exchanging full routing tables via Update packets, acknowledging with ACK packets, and finally entering the Established state where incremental updates are sent.

Question 6

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Desg FWD 4         128.1    P2p
Gi0/2            Desg FWD 4         128.2    P2p
Gi0/3            Desg FWD 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

This switch is the root bridge for VLAN 10.. The output explicitly states 'This bridge is the root' for VLAN 10, and the Root ID and Bridge ID are identical (same priority 32778 and address 0011.2233.4455), confirming SW1 is the root bridge for VLAN 10. All interfaces are in the Designated (Desg) role and Forwarding (FWD) state, which is expected for a root bridge because root bridges have no root ports.

Answer

Gi0/2 is a root port.

Answer

The spanning-tree mode is PVST+.

Answer

VLAN 10 has a forwarding delay of 30 seconds.

Question 7

Given the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

What is the effect of this configuration?

Accepted Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all untagged frames will be placed into VLAN 999.. Option A is correct because the configuration sets the interface as a trunk port, explicitly allows only VLANs 10, 20, and 30 to traverse it, and designates VLAN 999 as the native VLAN. On a trunk, the native VLAN is used for untagged frames (e.g., DTP, CDP, or any traffic sent without an 802.1Q header), so all untagged frames received or sent on this interface will be associated with VLAN 999.

Answer

The interface will forward traffic for all VLANs except 10, 20, and 30, and the native VLAN is 1.

Answer

The interface will operate as an access port in VLAN 999.

Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all frames will be tagged including the native VLAN.

Question 8

Drag and drop the steps of adding a new VLAN to a trunk link into the correct order, from first to last.

Accepted Answer

Create VLAN 100 in global configuration. First, create the VLAN globally on the switch. Then, verify the VLAN exists. Next, ensure the trunk allows that VLAN. After that, check the trunk's allowed VLAN list. Finally, test connectivity for hosts in the new VLAN.

Question 9

Drag and drop the steps of configuring a native VLAN mismatch detection into the correct order, from first to last.

Accepted Answer

Configure native VLAN 10 on trunk interface. First, configure the trunk interface with a specific native VLAN. Then, set the neighbor's trunk to a different native VLAN. The mismatch causes CDP to log an error. The switch then disables the trunk port. Finally, the administrator corrects the native VLAN to match.

Question 10

Drag and drop the steps of Dynamic Trunking Protocol (DTP) negotiation into the correct order, from first to last.

Accepted Answer

Set interface to switchport mode trunk. DTP negotiation begins with the interface defaulting to dynamic desirable or auto mode. If a switchport is set to trunk, DTP sends frames to negotiate. The neighbor responds if in a compatible mode. Once agreed, the link becomes trunking. Finally, both ends forward traffic for multiple VLANs.

Question 11

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Accepted Answer

The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.. Option D is correct because IP Source Guard (IPSG) on a switch port typically uses DHCP snooping bindings to validate traffic. However, when port-security is also enabled and the host's IP (10.1.1.1) falls within the configured subnet (e.g., 10.0.0.0/8), and the MAC address (00:1A:2B:3C:4D:5E) matches a port-security secure MAC address, the switch can permit the traffic. IPSG does not inherently block all non-DHCP traffic; it can be configured with static bindings or rely on DHCP snooping, but in this scenario, the combination of a valid subnet and port-security allows the traffic.

Answer

The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.

Answer

The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.

Answer

The traffic is blocked because IP Source Guard requires a static binding for the host.

Question 12

Which THREE benefits does network automation provide over manual configuration?

Accepted Answer

Reduced risk of configuration errors. Option C is correct because network automation eliminates human error during repetitive configuration tasks. By using tools like Ansible, Python scripts, or NETCONF/YANG models, configurations are applied consistently without typos or missed commands, which are common in manual CLI entry. This directly reduces the risk of syntax errors, missing parameters, or inconsistent settings that can lead to network outages.

Answer

Increased security by eliminating the need for SSH access

Answer

Lower initial investment compared to manual processes

Question 13

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.

Question 14

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Accepted Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop. Option C is correct because it uses the 'match protocol ssh' class-map to identify SSH traffic, applies a police rate of 1,000,000 bps (1 Mbps) with a burst of 2000 bytes, and includes a class-default with a police rate of 8000 bps to drop all other control-plane traffic exceeding a default rate. This matches the requirement to rate-limit SSH and drop other traffic that exceeds a default rate, which is a common CoPP best practice to protect the control plane.

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match access-group name SSH_ACL
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 2000 1000000 conform-action transmit exceed-action drop

Question 15

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Accepted Answer

access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443. In transparent mode, the ASA acts as a Layer 2 bridge, so traffic must be permitted by a global access list applied to the bridge group virtual interface (BVI). Option D correctly uses the GLOBAL access list to permit TCP traffic from the inside subnet (192.168.1.0/24) to any destination on port 443 (HTTPS), which satisfies the security policy.

Answer

access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
access-group INSIDE in interface inside

Answer

access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Answer

access-list GLOBAL extended permit tcp any any eq 443