350-401 Practice Exam 4 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    30 deny tcp any any eq 22 (2 matches)
    40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Accepted Answer

SSH access from 192.168.1.0/24 would be denied.. The ACL 120 explicitly denies TCP traffic to port 22 (SSH) from any source not matching the earlier permit statements. The source 192.168.1.0/24 is not covered by the permit entries (10.0.0.0/8 or 172.16.0.0/16), so it hits line 30 (deny tcp any any eq 22) and is denied. The 5 matches on line 10 and 3 on line 20 confirm that only traffic from those specific subnets is permitted for SSH.

Answer

SSH access from 10.0.0.0/8 is denied.

Answer

All SSH traffic is permitted.

Answer

The ACL has an implicit deny at the end.

Question 2

Which two statements about IP Source Guard are true? (Choose two.)

Accepted Answer

IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.. IP Source Guard (IPSG) filters IP traffic on a per-port basis using the DHCP snooping binding database. Option A is correct because IPSG uses the binding database to validate source IP addresses. Option D is correct because IPSG can be configured with a static IP source binding for hosts with static IP addresses. Option B is incorrect because IPSG does not filter MAC addresses; that is the role of port security. Option C is incorrect because IPSG is applied on Layer 2 switch ports, not on Layer 3 interfaces. Option E is incorrect because IPSG does not require 802.1X; it can work with DHCP snooping alone.

Answer

IP Source Guard filters traffic based on the source MAC address.

Answer

IP Source Guard is applied on Layer 3 interfaces of a switch.

Answer

IP Source Guard requires 802.1X authentication to function.

Question 3

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Accepted Answer

Define ERSPAN source interface(s) and direction. ERSPAN configuration requires first defining the source and destination, then enabling the session. The order ensures the session references exist before activation.

Question 4

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Certificate-based mutual authentication. EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses PAC, EAP-MD5 uses simple password hash.

Question 5

Drag and drop each NFV component on the left to its matching role on the right.

Accepted Answer

VNF: Virtualized network function software (e.g., virtual router). VNF is the virtualized network function software; NFVI is the infrastructure of compute, storage, and networking; MANO handles orchestration and lifecycle management.

Question 6

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG models are used to define the data structures streamed in telemetry subscriptions.. YANG models define the structure and constraints of telemetry data. Native models are vendor-specific, while OpenConfig models are standardized. IETF models are also standards-based but not vendor-specific. NETCONF uses YANG but is not a data model. RESTCONF is a protocol, not a model.

Answer

Native YANG models are standardized by the IETF and used universally.

Answer

NETCONF is a YANG data model used for telemetry configuration.

Answer

RESTCONF provides a YANG-based data model for streaming telemetry.

Question 7

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. 802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 8

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.

Question 9

A network engineer is troubleshooting an EtherChannel between two Cisco switches. The show etherchannel 1 port-channel command shows the port-channel is up, but traffic is not load-balanced evenly. The engineer notices that all traffic is using only one link. The physical ports are all configured identically. What is the most likely cause?

Accepted Answer

The load-balancing method is set to src-dst-ip, and all traffic is between the same two IP addresses.. When the load-balancing method is set to src-dst-ip, the hash is computed from the source and destination IP addresses. If all traffic flows between the same two IP addresses, the hash result will always be identical, causing all frames to be forwarded over the same physical link. This explains why the port-channel is up but only one link carries all traffic.

Answer

The load-balancing method is set to src-mac, and the traffic is from multiple MAC addresses.

Answer

The physical ports have different speeds.

Answer

The port-channel is configured with 'lacp fast-switchover'.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.

Question 11

A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?

Accepted Answer

The return route for the source IP points to a different interface than the one where the packet arrived.. In strict uRPF mode, the router checks that the source IP address of an incoming packet is reachable via the same interface on which the packet arrived. Even if the route for the source subnet exists in the routing table, if the best return route points to a different interface (e.g., a backup link or a different path), the packet will be dropped. This is the most common cause of legitimate traffic being dropped after enabling strict uRPF.

Answer

uRPF is checking the destination IP address, which is not reachable.

Answer

The router does not have a default route, so uRPF drops all traffic.

Answer

uRPF cannot be used with static routes; it requires a dynamic routing protocol.

Question 12

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 13

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, PUT, POST, DELETE, and PATCH.. The correct answers are B and D. B is correct because RESTCONF uses HTTP methods like GET, PUT, POST, DELETE, and PATCH. D is correct because RESTCONF supports both JSON and XML encoding. A is incorrect because RESTCONF uses HTTP, not SSH. C is incorrect because RESTCONF is not a replacement for NETCONF; they are different protocols. E is incorrect because RESTCONF does not use remote procedure calls (RPCs) in the same way as NETCONF; it uses RESTful operations.

Answer

RESTCONF uses SSH for transport security.

Answer

RESTCONF is designed to replace NETCONF entirely.

Answer

RESTCONF uses remote procedure calls (RPCs) for all operations.

Question 14

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module:

```yaml
---
- name: Configure interface
  hosts: cisco-routers
  gather_facts: no
  tasks:
    - name: Set interface description
      cisco.ios.ios_interfaces:
        config:
          - name: GigabitEthernet0/1
            description: "Uplink to Core"
            enabled: true
        state: replaced
```

What is the result of running this playbook?

Accepted Answer

The interface will be configured with only the description and enabled state, removing any other existing configuration.. The 'state: replaced' will replace the entire interface configuration with only the provided parameters. This means that any existing configuration on GigabitEthernet0/1 (like IP address, speed, duplex) will be removed and only the description and enabled state will be applied. This is a common pitfall.

Answer

The interface will have the description set and all other parameters remain unchanged.

Answer

The playbook will fail because 'enabled' is not a valid parameter for ios_interfaces.

Answer

The playbook will fail because 'state: replaced' requires a 'before' and 'after' state.

Question 15

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to define data models for NETCONF and RESTCONF.. The correct answers are A, C, and E. A is correct because YANG is used to model configuration and operational data in NETCONF and RESTCONF. C is correct because YANG uses a tree-like hierarchical structure with containers and lists. E is correct because YANG supports data types such as string, int32, and enumeration. B is incorrect because YANG models are not written in XML; they use a custom syntax similar to SMIv2. D is incorrect because YANG modules are not compiled into MIB files; MIBs are for SNMP.

Answer

YANG models are written in XML syntax.

Answer

YANG modules are compiled into MIB files for SNMP.

Question 16

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Accepted Answer

Include the 'siteId' query parameter in the request URL.. A 400 Bad Request typically indicates a malformed request, such as missing required parameters. The API documentation specifies that 'siteId' is required, so the engineer must include it as a query parameter in the request.

Answer

Change the HTTP method to POST because GET is not supported for this endpoint.

Answer

Add an 'Authorization' header with a valid token because the API requires authentication.

Answer

Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.

Question 17

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.. RESTCONF uses HTTP methods to access YANG-defined data on network devices. It supports both XML and JSON encoding. It does not use SSH or TLS natively for transport; it relies on HTTP over TLS (HTTPS) for security. The 'data' resource is the top-level resource for accessing YANG data stores. RESTCONF does not define its own data model; it uses YANG models.

Answer

RESTCONF supports only XML encoding for data.

Answer

RESTCONF uses SSH as the transport protocol.

Answer

RESTCONF defines its own data modeling language.

Question 18

Drag and drop each NETCONF operation on the left to its action on the right.

Accepted Answer

get: Retrieve running configuration and state data. Correct pairings: get retrieves running config and state data; get-config retrieves a specific datastore; edit-config modifies configuration; commit confirms a candidate configuration; lock prevents other sessions from modifying a datastore.

Question 19

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to model both configuration and operational state data.. YANG is a data modeling language used to model configuration and state data for network devices. It can define both configuration data (which is writable) and operational state data (which is read-only). YANG models can be augmented using the 'augment' statement to add nodes to an existing model without modifying it. YANG does not define transport protocols; it is used with protocols like NETCONF and RESTCONF. The 'leaf' statement defines a single, scalar data node, not a list.

Answer

YANG defines the transport protocol for data exchange.

Answer

The 'leaf' statement in YANG defines a list of key-value pairs.

Question 20

Drag and drop each RESTCONF method on the left to its equivalent NETCONF operation on the right.

Accepted Answer

GET: get-config (retrieves data). Correct pairings: GET retrieves data (like get-config); POST creates a resource (like edit-config with operation create); PUT replaces a resource (like edit-config with operation replace); PATCH partially updates (like edit-config with operation merge); DELETE removes a resource (like edit-config with operation delete).