350-401 Practice Exam 3 — 20 Questions

Question 1

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Accepted Answer

Classifier identifies traffic and maps to service chain. SFC path setup begins with classifying traffic to determine which service chain to apply. Next, the classifier encapsulates packets with an NSH header. Then the SFC path is computed by the controller using the service function path identifier. After path computation, the controller installs forwarding entries in each service function forwarder. Finally, traffic traverses the chain as SFFs forward packets between VNFs.

Question 2

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Restarting router sends OPEN with graceful restart capability. Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Question 3

Drag and drop the steps of VLAN pruning on trunks using VTP into the correct order, from first to last.

Accepted Answer

Enable VTP pruning globally on the VTP server. To configure VTP pruning on trunks, first set the VTP domain name and version (C). Then enable VTP pruning globally on the VTP server (A). Next, configure the trunk interface with switchport mode trunk (B). Then allow VTP pruning on the trunk with the switchport trunk pruning vlan command (D). Finally, verify pruning with show vtp status and show interfaces trunk (E).

Question 4

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Accepted Answer

Create VLAN and SVI interface. First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Question 5

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Accepted Answer

Client sends SAE Commit to AP. WPA3 uses Simultaneous Authentication of Equals (SAE) handshake. The client first sends an SAE commit to the AP, the AP responds with its own SAE commit, then both compute a shared key. Next, the client sends an SAE confirm message, and finally the AP sends its SAE confirm to complete authentication.

Question 6

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Accepted Answer

Match against class-map with highest priority. CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

Question 7

Drag and drop the steps of NETCONF edit-config with candidate datastore flow into the correct order, from first to last.

Accepted Answer

Lock the candidate datastore. The candidate datastore flow begins with locking the candidate, then editing it, validating the changes, committing them to running, and finally unlocking the candidate.

Question 8

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Accepted Answer

Create capture buffer with size. EPC requires defining a capture buffer, defining a capture point, associating them, starting the capture, and then stopping/exporting.

Question 9

Drag and drop the steps of DHCP snooping and dynamic ARP inspection flow into the correct order, from first to last.

Accepted Answer

Switch enables DHCP snooping on trusted ports. DHCP snooping builds a binding table used by DAI. The switch validates DHCP messages, creates bindings, then intercepts ARP packets and compares them against the binding table to prevent spoofing.

Question 10

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Accepted Answer

The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.. When SR-IOV is enabled on a physical NIC, the Physical Function (PF) is shared between the host management network and the Virtual Functions (VFs). If the PF is used for the host management network, enabling SR-IOV can disrupt the PF's driver or configuration, causing the management network to become unreachable. This is a common misconfiguration where the same NIC is used for both management and SR-IOV VFs.

Answer

The VM's VF is using the same MAC address as the host management interface.

Answer

The ESXi host requires a dedicated physical NIC for management when using SR-IOV.

Answer

The VM's VF is consuming all available bandwidth on the NIC.

Question 11

Drag and drop the steps of RPF check verification for multicast forwarding into the correct order, from first to last.

Accepted Answer

Examine source IP address of multicast packet. The RPF check ensures that incoming multicast packets arrive on the correct interface toward the source. First, the router examines the source IP address. Then it consults the unicast routing table to find the best route. It identifies the outgoing interface for that route. It compares that interface with the arrival interface of the multicast packet. If they match, the packet is forwarded; otherwise, it is dropped.

Question 12

Drag and drop the steps of Rapid PVST+ topology change notification process into the correct order, from first to last.

Accepted Answer

Non-edge port transitions to forwarding. In Rapid PVST+, a topology change is triggered when a non-edge port transitions to forwarding. The switch then sets the proposal bit on its designated ports, sends a proposal message, and expects an agreement from the downstream switch. After receiving the agreement, the port moves to forwarding and the switch propagates the change by setting the TC flag in BPDUs sent on all designated ports. This ensures rapid convergence.

Question 13

Drag and drop the steps of the TACACS+ authentication process into the correct order, from first to last.

Accepted Answer

Client sends START packet to TACACS+ server. TACACS+ uses TCP and encrypts the entire packet. It separates authentication, authorization, and accounting. The server sends a GETUSERNAME prompt first, then GETPASSWORD, and finally an ACCEPT or REJECT.

Question 14

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

Accepted Answer

Create class map matching voice traffic. LLQ for voice requires first classifying voice traffic, then creating a policy map with a priority queue, applying it to the interface, and verifying the configuration. The priority queue ensures low latency for voice packets.

Question 15

A network engineer is troubleshooting a VRF-lite deployment on a Cisco Nexus 9000 switch. Two VRFs, PROD and DEV, are configured. The switch has an SVI for VLAN 10 in VRF PROD and VLAN 20 in VRF DEV. A firewall is connected to a Layer 3 port in VRF PROD for internet access. The engineer needs to allow the DEV VRF to reach the internet through the same firewall, but without using a separate physical interface. What should the engineer configure?

Accepted Answer

Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.. VRF-lite does not support direct route leaking between VRFs without an external mechanism. By configuring a static route in VRF DEV pointing to the firewall's IP address (which resides in VRF PROD) and using a route-map to leak the route, the engineer enables inter-VRF routing. This allows DEV traffic to reach the firewall's interface in PROD without requiring a separate physical interface, as the route-map controls which prefixes are shared between VRFs.

Answer

Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.

Answer

Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.

Answer

Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.

Question 16

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

Accepted Answer

The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 '.. The engineer's configuration includes both 'ip default-network 0.0.0.0' (which is an IGRP command, not EIGRP) and redistribution of a static default route. The appearance of the default route in the EIGRP topology table with metric 1 indicates that redistribution occurred, but the route is not being advertised to internal routers. The most likely reason is that the static default route itself is not correctly configured. For EIGRP redistribution to succeed, the static route must point to a valid next-hop IP address using the syntax 'ip route 0.0.0.0 0.0.0.0 '. If the engineer used an interface instead of a next-hop, or the next-hop is unreachable, the static route may be invalid or not installed in the routing table, preventing its advertisement to EIGRP neighbors.

Answer

The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.

Answer

The internal routers have a route to the default network with a better metric from another source.

Answer

The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.

Question 17

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

Accepted Answer

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.. gRPC uses HTTP/2 for transport and Protocol Buffers for serialization. gNMI is a gRPC-based protocol specifically for network management and telemetry. gNMI supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Set, Get). It uses YANG models to define data paths. gNMI does not require NETCONF; it operates independently over gRPC.

Answer

gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.

Answer

gNMI relies on NETCONF for session establishment and data encoding.

Question 18

A network engineer issues the following command on Router R2:

R2# show ip ospf interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.2/24, Area 0
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 2, Adjacent neighbor count is 2
    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)
    Adjacent with neighbor 3.3.3.3

Based on this output, what can be concluded?

Accepted Answer

R2 has a full OSPF adjacency with all neighbors on this segment.. The output shows that R2 is the Designated Router (DR) on this broadcast segment, with two neighbors listed: 1.1.1.1 (BDR) and 3.3.3.3. The 'Adjacent neighbor count is 2' and both neighbors are listed as 'Adjacent with neighbor', confirming that R2 has formed full OSPF adjacencies with all neighbors on this segment. In OSPF broadcast networks, only the DR and BDR form full adjacencies with all routers, while non-DR/BDR routers only form full adjacencies with the DR and BDR.

Answer

R2 is the Backup Designated Router on this segment.

Answer

The OSPF cost to reach the network 192.168.1.0/24 is 20.

Answer

R2 will send hello packets every 40 seconds.

Question 19

Given the following Ansible playbook snippet:
---
- name: Configure interface
  hosts: routers
  gather_facts: no
  tasks:
    - name: Set IP address
      ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
          - no shutdown
        parents: interface GigabitEthernet0/1
What is the effect of this playbook?

Accepted Answer

It configures IP address 192.168.1.1/24 on interface GigabitEthernet0/1 and enables it.. The `ios_config` module uses the `parents` parameter to navigate into interface configuration mode before applying the `lines` commands. The `ip address 192.168.1.1 255.255.255.0` command configures the IP address with a /24 subnet mask, and `no shutdown` administratively enables the interface. This is the standard Cisco IOS behavior for interface configuration.

Answer

It configures the IP address globally, not under the interface.

Answer

It only configures the IP address; no shutdown is ignored because it is not a valid command.

Answer

It fails because 'parents' cannot be used with 'lines' in ios_config.

Question 20

Drag and drop each OSPF router role on the left to its matching function on the right.

Accepted Answer

DR: Generates the Network LSA and maintains full adjacencies with all routers on the segment. The DR (Designated Router) generates the Network LSA and manages LSDB synchronization on multiaccess networks. The BDR (Backup Designated Router) monitors the DR and takes over if the DR fails. DROTHERs form full adjacencies only with the DR and BDR, not with each other.