350-401 Practice Test 20 — 15 Questions

Question 1

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run ssh-add on the control node to add the private key to the SSH agent. The error 'Permission denied (publickey)' indicates that the SSH key is not being presented to the IOS device. Running ssh-add on the control node loads the private key into the SSH agent, which Ansible uses by default when connecting via SSH. This resolves the authentication failure without requiring a passphrase or changing the inventory.

Answer

Set ansible_ssh_private_key_file in the inventory but omit the passphrase

Answer

Set ansible_user to the correct username in the inventory

Answer

Enable keyboard-interactive authentication on the IOS devices

Question 2

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, PUT, POST, DELETE, and PATCH.. Option B is correct because RESTCONF is a RESTful protocol that maps CRUD operations onto standard HTTP methods — GET to retrieve data, POST to create, PUT to replace, PATCH to modify, and DELETE to remove resources — as defined in RFC 8040. Option D is correct because RESTCONF supports both JSON (the default, media type application/yang-data+json) and XML (application/yang-data+xml) encoding for representing YANG-modeled data. Option A is incorrect because RESTCONF runs over HTTPS (HTTP over TLS, typically port 443), not SSH; SSH is the transport used by NETCONF. Option C is incorrect because RESTCONF is not intended to replace NETCONF entirely — it is a complementary, lightweight HTTP-based alternative, and NETCONF remains widely used for full configuration and RPC capabilities. Option E is incorrect because RESTCONF uses HTTP methods for operations rather than RPCs; RPC-style operations are characteristic of NETCONF, and RESTCONF only supports a limited RPC mechanism via POST to specific operation resources.

Answer

RESTCONF uses SSH for transport security.

Answer

RESTCONF is designed to replace NETCONF entirely.

Answer

RESTCONF uses remote procedure calls (RPCs) for all operations.

Question 3

Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. The correct order first defines the VRF, then configures the NAT inside and outside interfaces under the VRF, defines the NAT pool or ACL for translation, applies the NAT rule referencing the VRF, and finally verifies the translation with show ip nat translations vrf.

Question 4

A network engineer is designing a new data center leaf-spine fabric using Cisco Nexus 9000 switches. The design requires that the fabric automatically discover the IP addresses of remote VTEPs participating in a VXLAN EVPN deployment. Which control-plane protocol should be enabled on the leaf switches to provide this dynamic VTEP discovery?

Accepted Answer

Multiprotocol BGP with EVPN address family. VXLAN EVPN uses MP-BGP with the EVPN address family as the overlay control plane. It advertises Type-2 (MAC/IP) and Type-3 (IMET) routes, allowing leaf switches to learn remote VTEP IP addresses automatically. This eliminates the need for static VTEP configuration and supports efficient multi-tenancy and mobility.

Answer

OSPFv3 in the underlay network

Answer

Protocol Independent Multicast (PIM) sparse mode

Answer

Cisco Fabric Services (CFS) over the management network

Question 5

A network administrator is configuring a Cisco IOS router to provide DHCP services to a remote subnet. The router's interface on that subnet is configured with the address 10.1.1.1/24. Which command is required to exclude the router's own address from the DHCP pool?

Accepted Answer

ip dhcp excluded-address 10.1.1.1. The 'ip dhcp excluded-address' command is used to prevent specific IP addresses from being assigned by the DHCP server. In this scenario, excluding the router's interface address 10.1.1.1 ensures it remains available for the router itself and is not leased to a client.

Answer

ip dhcp pool 10.1.1.1

Answer

ip dhcp relay information option

Answer

ip dhcp excluded-address 10.1.1.0 10.1.1.255

Question 6

Drag and drop each ACL action on the left to its matching result on the right.

Accepted Answer

permit: Packet is allowed to pass through the ACL. Permit allows the packet; Deny discards the packet; Remark adds a comment; Log generates a log message for matched packets; Sequence-number assigns a line number for editing.

Question 7

A network administrator is implementing IP Source Guard (IPSG) on a Cisco Catalyst 3850 switch to prevent IP spoofing. The administrator enables DHCP snooping and IPSG on VLAN 10. A user connects a laptop with a statically assigned IP address 10.10.10.50/24 and gateway 10.10.10.1. The laptop cannot reach any network resources. What is the most likely reason?

Accepted Answer

IP Source Guard requires that the IP address be learned via DHCP snooping or be statically configured in an IP source binding.. IP Source Guard relies on the DHCP snooping binding table to validate source IP and MAC addresses. When a device uses a static IP address, no dynamic binding exists, so the switch drops its traffic. To allow the static address, an IP source binding must be manually configured with the ip source binding command, which populates the binding table.

Answer

DHCP snooping must be disabled for IP Source Guard to function with static addresses.

Answer

IP Source Guard only works with IPv6 addresses, so IPv4 static addresses are not supported.

Answer

The laptop must be configured with a DHCP address even if a static IP is desired, because IPSG blocks all non-DHCP traffic.

Question 8

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide secure segmentation for different departments without deploying separate physical networks or traditional VRFs on every switch. Which Cisco SD-Access component provides this segmentation by using a group-based policy model?

Accepted Answer

Scalable Group Tag (SGT). Cisco SD-Access uses Scalable Group Tags (SGTs) to implement group-based segmentation. Endpoints are assigned SGTs, and Security Group ACLs (SGACLs) enforce policy between groups. This approach provides micro-segmentation without the need for traditional VRFs on every switch, simplifying operations and improving security.

Answer

Access Control List (ACL)

Answer

VLAN pool

Answer

Virtual Routing and Forwarding (VRF)

Question 9

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular access point is reporting a high number of client association failures. Which Cisco DNA Center Assurance feature should be used to correlate these failures with client device types and identify the root cause?

Accepted Answer

Client 360. Client 360 in Cisco DNA Center Assurance is designed to provide detailed insights into individual client devices, including their onboarding process, association failures, and performance. By using Client 360, the administrator can filter and analyze association failures by client type, helping to pinpoint whether specific devices are experiencing issues due to compatibility or configuration problems.

Answer

Network Health dashboard

Answer

Path Trace

Answer

Application Health dashboard

Question 10

A network engineer is configuring an IP SLA operation to monitor the reachability of a critical server at 10.1.1.1. The engineer wants to generate a syslog message and trigger a track object if the response time exceeds 100 ms. Which IP SLA operation type should be used?

Accepted Answer

ICMP Echo. ICMP Echo is the most suitable IP SLA operation for monitoring basic reachability and round-trip time to a server. It allows configuration of a threshold and reactions, which can trigger syslog messages and track objects when the threshold is exceeded, directly meeting the engineer's requirements.

Answer

HTTP

Answer

UDP Jitter

Answer

TCP Connect

Question 11

A network engineer at a university is deploying Cisco HyperFlex to replace a legacy SAN-backed vSphere cluster. The design calls for fabric interconnects to be managed in Cisco UCS Manager, and the engineer wants the HyperFlex installer to fully configure the fabric interconnects and the UCS servers automatically. Which HyperFlex deployment model should the engineer choose?

Accepted Answer

HyperFlex standard cluster with fabric interconnects in UCS Manager-managed mode. Deploying a standard HyperFlex cluster with UCS Manager-managed fabric interconnects is the model in which the HyperFlex installer discovers and configures the fabric interconnects, server profiles, and networking automatically. Because the university wants full automation of fabric interconnect and UCS server configuration in a data-center cluster, the standard model is the only listed option that satisfies every stated requirement.

Answer

HyperFlex Edge with a two-node cluster managed by the HyperFlex Connect appliance

Answer

Cisco UCS Mini with HyperFlex software installed manually on each node

Answer

HyperFlex stretched cluster across two sites using Cisco Intersight-managed fabric interconnects

Question 12

Drag and drop the steps of implementing QoS trust boundaries on a Cisco switch into the correct order, from first to last.

Accepted Answer

Identify the trust boundary location. First, identify the trust boundary (e.g., access port). Then configure the trusted interface to trust CoS or DSCP. Next, set the default CoS for untrusted frames. Finally, verify the configuration and adjust as needed.

Question 13

A network administrator is deploying Cisco ACI in a data center. The administrator must configure a bridge domain that allows Layer 2 connectivity between endpoints in the same tenant while also providing Layer 3 gateway services. The design requires that the bridge domain support both unicast routing and unknown unicast flooding. Which two settings must be enabled on the bridge domain to meet these requirements? (Choose two.)

Accepted Answer

Enable unicast routing on the bridge domain.. To provide Layer 3 gateway services, the bridge domain must have unicast routing enabled so it can route between subnets. To support unknown unicast flooding, the bridge domain must have unknown unicast flooding enabled. These two settings directly address the scenario's requirements, while other features like ARP flooding, IGMP snooping, and DHCP relay serve different purposes.

Answer

Enable DHCP relay on the bridge domain.

Answer

Enable IGMP snooping on the bridge domain.

Answer

Enable ARP flooding on the bridge domain.

Question 14

A network engineer is troubleshooting a Cisco SD-WAN deployment where some branches experience intermittent packet loss. The engineer suspects that the issue is related to the control plane connections between vEdge routers and the vSmart controller. Which command should be used on a vEdge router to verify the status of the control connections?

Accepted Answer

show control connections. The 'show control connections' command on a vEdge router provides detailed information about the control plane connections to vSmart controllers, including state, uptime, and any errors. Since the engineer suspects control plane instability causing intermittent packet loss, this command is the most direct way to verify the status and health of those connections.

Answer

show bfd sessions

Answer

show interface

Answer

show omp sessions

Question 15

A network engineer is configuring a Cisco IOS router to export NetFlow data to a collector. The engineer wants to ensure that only ingress traffic on GigabitEthernet0/0 is monitored and that the NetFlow cache is optimized for high traffic volumes. Which configuration step is required to enable NetFlow on the interface?

Accepted Answer

ip flow ingress. To enable NetFlow on a specific interface for ingress traffic, the 'ip flow ingress' command must be configured in interface configuration mode. This command activates NetFlow accounting for packets entering the interface, allowing the router to collect flow statistics. The global export commands only define where and how to send the data, but the interface command is what starts the capture.

Answer

ip route-cache flow

Answer

ip flow-export version 9

Answer

ip flow-export destination