350-401 Practice Test 12 — 15 Questions

Question 1

Examine the following EIGRP configuration snippet:

interface GigabitEthernet0/0
 ip bandwidth-percent eigrp 100 50

What is the effect of this command?

Accepted Answer

EIGRP will use up to 50% of the interface bandwidth for its control traffic.. The `ip bandwidth-percent eigrp 100 50` command configures EIGRP to use up to 50% of the interface's configured bandwidth for its control traffic (hello, update, query, and reply packets). This limits the amount of bandwidth EIGRP can consume to prevent it from starving other traffic. The percentage is applied to the interface's `bandwidth` setting, not the actual physical link speed.

Answer

EIGRP will only advertise routes that have a metric within 50% of the best path.

Answer

EIGRP will use 50% of the interface bandwidth for data traffic.

Answer

EIGRP will reduce its hello interval by 50%.

Question 2

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 3

A network engineer issues the following command on Router R6:

R6# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.100      10.0.0.10          ---                ---
--- 192.168.1.101      10.0.0.11          ---                ---
udp 192.168.1.100:1234 10.0.0.10:1234     203.0.113.5:53     203.0.113.5:53
tcp 192.168.1.101:80   10.0.0.11:80       198.51.100.2:443   198.51.100.2:443

Based on this output, what is true about the NAT translations?

Accepted Answer

The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.. The output shows two static-like entries (the first two lines with no protocol or port) and two dynamic entries with PAT (the UDP and TCP lines). The first translation for 10.0.0.10 to 192.168.1.100 has no protocol or port information, indicating it is a dynamic NAT entry without PAT (port address translation), because PAT would show specific ports. Option B correctly identifies this translation as dynamic NAT without PAT.

Answer

All translations are static NAT entries.

Answer

The router is performing only PAT (overload).

Answer

The outside global address is the same for all translations.

Question 4

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Accepted Answer

Design access layer with VLANs and port security. The correct order begins with implementing the core layer to establish high-speed backbone switching. Next, connect WAN edge routers for remote site access, followed by verifying end-to-end connectivity and redundancy to ensure the infrastructure works before adding edge services. Then, design the access layer with VLANs and port security, and finally configure the distribution layer for inter-VLAN routing. This sequence ensures the foundational transport is in place before adding user-facing and aggregation services.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor
PIM Neighbor Table
Neighbor Address  Interface           Uptime    Expires   Mode
10.1.1.2          GigabitEthernet0/0  2w0d      00:01:25  DR
10.1.1.3          GigabitEthernet0/0  2w0d      00:01:20  B

Based on this output, what can be concluded?

Accepted Answer

PIM Bidir mode is configured on this interface.. The output shows PIM neighbor modes of 'DR' and 'B'. In PIM Bidir mode, the Designated Router (DR) is elected to forward traffic upstream, and the 'B' flag indicates a Bidir-capable neighbor. This mode is explicitly identified by the 'B' flag in the PIM neighbor table, which is not present in sparse or dense mode. Therefore, the interface is operating in PIM Bidir mode.

Answer

PIM sparse mode is operating on this interface.

Answer

PIM dense mode is in use on this interface.

Answer

PIM SSM is enabled on this interface.

Question 6

A company is deploying a multi-tenant data center using VMware vSphere. The architect must ensure that each tenant’s virtual machines (VMs) are isolated at Layer 2 while sharing the same physical NICs. Which design approach best meets this requirement?

Accepted Answer

Configure a single standard virtual switch and assign each VM to a separate port group with unique VLAN IDs.. Configuring a standard virtual switch with separate port groups and unique VLAN IDs provides Layer 2 isolation between tenants by leveraging 802.1Q VLAN tagging. Each VM’s traffic is tagged with its assigned VLAN ID, ensuring that VMs in different port groups cannot communicate directly at Layer 2, even though they share the same physical NICs.

Answer

Deploy a separate physical NIC for each tenant and bridge them to the VMs.

Answer

Use a distributed virtual switch with VLAN trunking and assign all VMs to the same port group.

Answer

Enable promiscuous mode on the virtual switch to allow all VMs to see each other’s traffic.

Question 7

An organization is implementing 802.1X for wireless users using Cisco ISE as the RADIUS server. The network engineer configures the wireless LAN controller (WLC) with 802.1X authentication. Users report that they can connect to the SSID but cannot access any network resources. The engineer checks the WLC and sees that users are authenticated and assigned to VLAN 100. The engineer also checks the switchport connecting the WLC and sees it is a trunk. What is the most likely issue?

Accepted Answer

The switch trunk port does not have VLAN 100 allowed.. The users are authenticated and assigned to VLAN 100 by the RADIUS server, but the switch trunk port connecting the WLC does not have VLAN 100 in its allowed list. This means traffic from the WLC for VLAN 100 is dropped at the switch, preventing network access even though authentication succeeded. The trunk must explicitly permit VLAN 100 for the dynamic VLAN assignment to work.

Answer

The RADIUS server is not sending the correct VLAN ID in the Access-Accept.

Answer

The WLC is not configured for 802.1X on the uplink to the switch.

Answer

The users' devices are not configured for MAB.

Question 8

A network engineer is troubleshooting an EtherChannel between two Cisco switches. The show etherchannel 1 port-channel command shows the port-channel is up, but traffic is not load-balanced evenly. The engineer notices that all traffic is using only one link. The physical ports are all configured identically. What is the most likely cause?

Accepted Answer

The load-balancing method is set to src-dst-ip, and all traffic is between the same two IP addresses.. When the load-balancing method is set to src-dst-ip, the hash is computed from the source and destination IP addresses. If all traffic flows between the same two IP addresses, the hash result will always be identical, causing all frames to be forwarded over the same physical link. This explains why the port-channel is up but only one link carries all traffic.

Answer

The load-balancing method is set to src-mac, and the traffic is from multiple MAC addresses.

Answer

The physical ports have different speeds.

Answer

The port-channel is configured with 'lacp fast-switchover'.

Question 9

An enterprise is deploying Cisco SD-WAN with multiple vSmart controllers for redundancy. The engineer configures the vEdge routers to connect to two vSmart controllers. After deployment, the engineer notices that the vEdge routers are only connected to one vSmart, and the second vSmart is not being used. The vEdge routers show that the second vSmart is reachable. What is the most likely reason for this behavior?

Accepted Answer

The vEdge routers are designed to use only one vSmart at a time; the second is for redundancy.. In Cisco SD-WAN, vEdge routers are designed to establish a control connection to only one active vSmart controller at a time, even when multiple vSmart controllers are configured for redundancy. The second vSmart serves as a standby; the vEdge will fail over to it only if the primary vSmart becomes unreachable. Since the vEdge shows the second vSmart is reachable but not actively used, this confirms the expected behavior of active/standby redundancy rather than load balancing.

Answer

The vEdge routers can only connect to one vSmart at a time.

Answer

The vEdge routers need to be rebooted to establish a connection to the second vSmart.

Answer

The second vSmart has a different site ID than the first.

Question 10

Which three statements about VRF path isolation in a service provider network are true? (Choose three.)

Accepted Answer

VRFs allow multiple customers to share the same physical infrastructure while keeping their traffic isolated.. Option A is correct because a VRF (Virtual Routing and Forwarding) instance creates a separate routing table on the same physical router, so multiple customers can share the provider's physical infrastructure while their traffic and routing information remain logically isolated. Option B is correct because in MPLS L3VPN, each VRF is associated with route targets (extended BGP communities) that control which routes are exported from and imported into the VRF, thereby governing route distribution between PE routers. Option C is correct because VRF-aware features such as NAT, QoS, and ACLs can be configured within a specific VRF context, allowing per-VRF policy enforcement that maintains path isolation between customers. Option D is not correct because VRFs operate at Layer 3 by separating routing tables, whereas VLANs provide Layer 2 broadcast-domain isolation; VRF does not replace VLANs for Layer 2 segmentation. Option E is not correct because VRF-lite achieves isolation using separate routing/forwarding tables and interfaces (typically without MPLS), not by using MPLS labels.

Answer

VRF can be used to replace VLANs for Layer 2 isolation.

Answer

In VRF-lite, path isolation is achieved using MPLS labels.

Question 11

Consider the following configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache entries 16000
!

Which statement about this configuration is correct?

Accepted Answer

The flow cache can hold up to 16,000 flow entries simultaneously.. The 'cache entries 16000' command under the flow monitor specifies the maximum number of flow entries that the NetFlow cache can hold simultaneously. This is a hard limit on the size of the flow cache, not a timer or byte limit. Therefore, the flow cache can store up to 16,000 concurrent flow records before it must either export or age out older entries to make room.

Answer

The flow cache will export flows every 16,000 seconds.

Answer

The flow cache will store only 16,000 bytes of flow data.

Answer

The flow cache will automatically increase to 32,000 entries if needed.

Question 12

Consider this AAA configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
line con 0
 login authentication default
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

All login attempts use local authentication; exec accounting is sent to TACACS+.. The configuration sets AAA authentication login to use the local user database (via 'aaa authentication login default local'), so all login attempts (console and VTY) authenticate against the local device. Authorization for exec sessions is also set to local ('aaa authorization exec default local'), meaning no external authorization is used. Accounting for exec sessions is configured with 'start-stop' and points to the TACACS+ server at 10.0.0.1, so all exec session start and stop records are sent to TACACS+. This matches option A.

Answer

All login attempts use TACACS+ authentication; exec accounting is local.

Answer

Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.

Answer

Authentication and authorization are both performed by TACACS+; accounting is local.

Question 13

Drag and drop the steps of Ansible playbook execution flow into the correct order, from first to last.

Accepted Answer

Parse inventory file to determine target hosts. Ansible playbook execution begins with inventory parsing to identify target hosts, then loads variables from group_vars/host_vars. Next, it gathers facts from the managed nodes, applies tasks from the playbook in order, and finally runs post-task handlers if notified.

Question 14

A network engineer configures VRF-lite on a router with the following snippet:

vrf definition GREEN
 rd 200:1
!
interface GigabitEthernet0/3
 vrf forwarding GREEN
 ip address 172.16.1.1 255.255.255.0
!
router ospf 10 vrf GREEN
 network 172.16.1.0 0.0.0.255 area 0

What is missing from this configuration to enable proper OSPF routing within VRF GREEN?

Accepted Answer

The configuration is complete and OSPF will operate correctly within VRF GREEN.. The configuration is complete for VRF-lite OSPF routing. In VRF-lite, the 'vrf definition GREEN' with an RD, the interface assignment via 'vrf forwarding GREEN', and the OSPF process with 'vrf GREEN' and the network statement are all that is required. OSPF will operate correctly within VRF GREEN using the specified network in area 0.

Answer

The 'network' command should specify the interface instead of the subnet.

Answer

The 'vrf definition GREEN' must include a 'route-target' command.

Answer

The OSPF process must be configured under the global VRF context, not using 'vrf GREEN'.

Question 15

Drag and drop each CoS value on the left to its matching traffic type on the right.

Accepted Answer

CoS 5: Voice payload. CoS values are used in 802.1Q frames: CoS 5 for voice, CoS 4 for video, CoS 3 for call signaling, CoS 2 for critical data, CoS 0 for best-effort data.