350-401 Practice Exam 2 — 20 Questions

Question 1

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Accepted Answer

10 seconds. The default OSPF hello interval on an Ethernet link (which is a broadcast multi-access network type) is 10 seconds. This is defined in RFC 2328 and is the default on Cisco routers for broadcast and point-to-point network types. The hello interval determines how often a router sends hello packets to discover and maintain neighbor relationships.

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 2

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

Accepted Answer

A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.. The correct answers describe practical uses of Python for inventory management and data handling. The incorrect options either misattribute YAML's features (it does not support comments natively in all parsers) or incorrectly state that JSON is always more human-readable than YAML (YAML is often considered more readable).

Answer

YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.

Answer

JSON is always more human-readable than YAML for complex inventory structures.

Question 3

Drag and drop each NAPALM getter on the left to its matching returned data on the right.

Accepted Answer

get_facts: Device hostname, vendor, model, OS version, serial number. get_facts returns device facts like hostname and OS version, get_interfaces returns interface details, get_bgp_neighbors returns BGP neighbor information, get_lldp_neighbors returns LLDP neighbor data, and get_environment returns power and fan status.

Question 4

Which two statements about SD-WAN control plane components are true? (Choose two.)

Accepted Answer

The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.. The vSmart controller is the centralized control plane that distributes OMP routes and policies, while the vBond orchestrator handles authentication and NAT traversal. vManage is the management plane, not a control plane component. vEdge and cEdge are data plane devices. The OMP protocol runs between vSmart and edge devices, not between vManage and vSmart.

Answer

The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.

Answer

vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.

Answer

The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.

Question 5

Which two statements about Python data structures used in network automation are true? (Choose two.)

Accepted Answer

Dictionaries are used to store key-value pairs such as device IP, username, and password.. Correct answers: B and D. B is correct because dictionaries are ideal for storing key-value pairs such as device parameters (IP, username, password). D is correct because lists are ordered and can hold multiple device names or IPs, and they support iteration. A is incorrect because tuples are immutable, so they cannot be modified after creation, which limits their use for dynamic data. C is incorrect because sets are unordered and do not support indexing; they are used for unique elements, not ordered collections. E is incorrect because strings are immutable and not suitable for storing multiple separate values.

Answer

Tuples are commonly used to store device credentials because they can be modified easily.

Answer

Sets are ordered and allow indexing to retrieve specific elements.

Answer

Strings are mutable and ideal for storing multiple device configurations.

Question 6

Drag and drop the steps of the SD-Access fabric deployment sequence into the correct order, from first to last.

Accepted Answer

Configure underlay network with IS-IS or OSPF. SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Question 7

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

Accepted Answer

The control policy is not attached to the appropriate site list or VPN list.. In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

Answer

The vEdge routers have not been rebooted after the policy change.

Answer

The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.

Answer

The BFD sessions between vEdge and vSmart are flapping.

Question 8

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Accepted Answer

View current ACL with 'show access-list'. Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.

Question 9

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Accepted Answer

Ingress switch classifies endpoint and assigns SGT. Inline tagging embeds SGT in the Ethernet frame header; the ingress switch classifies the endpoint, adds the SGT tag, forwards the frame across the fabric, and the egress switch enforces policy based on the tag.

Question 10

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Accepted Answer

Create job template with playbook and inventory. In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

Question 11

Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.

Accepted Answer

Active mode ports transmit LACPDUs. LACP negotiation starts with active ports sending LACPDUs, passive ports listening, then exchanging system/port priorities, selecting aggregator, and finally forming the bundle.

Question 12

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Accepted Answer

Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status. VTP requires setting mode and domain before trunking works; verification confirms operation.

Answer

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Answer

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Answer

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Question 13

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Accepted Answer

Define prefix-list or AS-path ACL. Policy application starts with defining match criteria (prefix-list or AS-path ACL), then creating a route-map with permit/deny and set actions, applying it to a neighbor, and finally verifying the policy effect.

Question 14

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.

Question 15

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has two active member links.. The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Answer

The EtherChannel is using PAgP.

Answer

Port Gi0/3 is bundled in the channel.

Answer

The port-channel is a Layer 3 interface.

Question 16

What is the default native VLAN on a Cisco switch trunk port?

Accepted Answer

VLAN 1. The default native VLAN on a Cisco switch trunk port is VLAN 1. The native VLAN is the VLAN that carries untagged traffic over a trunk link, and by default, all switch ports (including trunk ports) belong to VLAN 1. This is defined in the IEEE 802.1Q standard, which specifies that frames on the native VLAN are not tagged with a VLAN ID.

Answer

VLAN 0

Answer

VLAN 1002

Answer

VLAN 4095

Question 17

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 18

Drag and drop the steps of Multicast RP discovery using Auto-RP into the correct order, from first to last.

Accepted Answer

Candidate-RPs send RP-Announce to 224.0.1.39. Auto-RP uses a mapping agent to discover RPs. Candidate RPs announce their services to a well-known group (224.0.1.39). The mapping agent collects these announcements and sends RP-to-group mappings to another group (224.0.1.40). Routers then learn the RP for each group.

Question 19

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. It uses the 'monitor session 1 source interface Gi1/0/1 both' command to capture all traffic (both ingress and egress) from the trunk port, and then applies the 'monitor session 1 filter vlan 20' command to restrict the SPAN session to only VLAN 20 traffic. This is the proper method to filter traffic from a trunk port to a specific VLAN on a Cisco Catalyst 3850 switch, as the filter command is applied after the source is defined.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 20

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Accepted Answer

Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.. Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Answer

Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.

Answer

Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.

Answer

Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.