350-401 Practice Test 22 — 15 Questions

Question 1

A network engineer is implementing VXLAN with an Ethernet VPN (EVPN) control plane in a data center. The underlay is a Layer 3 IP network. The engineer wants to ensure that the VXLAN tunnel endpoints (VTEPs) can discover each other and that the fabric supports multihoming with all-active forwarding. Which technology should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VXLAN with EVPN as the control plane. EVPN is the correct choice because it provides a scalable control plane for VXLAN, enabling automatic VTEP discovery and MAC learning via BGP. It also supports multihoming with all-active forwarding through Ethernet Segment configurations, which allows a device to connect to multiple VTEPs simultaneously. Other options either lack a control plane or do not support the required multihoming capabilities.

Answer

VXLAN with static unicast flooding and no control plane

Answer

VXLAN with PIM-SM multicast underlay

Answer

VXLAN with OSPF as the underlay routing protocol

Question 2

A network engineer is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The engineer notices that the client's health score is low due to onboarding failures. Which component of Cisco DNA Center Assurance should be examined first to identify the root cause?

Accepted Answer

Client 360. Client 360 is the correct component because it provides detailed information about a specific client's onboarding process, including authentication, DHCP, and DNS steps. It allows the engineer to pinpoint the exact failure point. Network Health, Application Health, and Path Trace offer broader or different perspectives that do not focus on individual client onboarding.

Answer

Network Health

Answer

Application Health

Answer

Path Trace

Question 3

A network engineer is troubleshooting why a newly added Cisco Catalyst 9300 switch is not appearing in Cisco DNA Center's topology view, even though it is reachable via SSH from the management network. The switch has been configured with the correct SNMP community string. Which protocol must be enabled on the switch for Cisco DNA Center to discover and monitor it?

Accepted Answer

SNMP. Cisco DNA Center relies on SNMP to discover and monitor network devices. Although SSH may be used for CLI-based configuration, SNMP is the protocol that provides the management data for topology and health monitoring. Without SNMP enabled and correctly configured, the switch will not be discovered, regardless of SSH reachability or correct community strings.

Answer

NETCONF

Answer

Syslog

Answer

IP SLA

Question 4

A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)

Accepted Answer

AP channel utilization and interference. To diagnose high retry rates and low SNR, the engineer should examine RF-related metrics. Client RSSI and SNR trends reveal signal quality and potential coverage gaps. AP channel utilization and interference show if the channel is congested or noisy. Together, these metrics help identify whether the issue is due to distance, interference, or channel overlap. Other metrics like switch CPU, WAN latency, or DHCP utilization do not directly address wireless RF performance.

Answer

Switch CPU utilization

Answer

DHCP pool utilization

Answer

WAN latency and jitter

Question 5

Examine the following Python script that uses the netmiko library to send configuration commands to a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '192.168.1.1',
    'username': 'admin',
    'password': 'cisco',
}

connection = ConnectHandler(**device)
config_commands = [
    'interface GigabitEthernet1/0/1',
    'description Link to Core',
    'ip address 10.1.1.1 255.255.255.0',
    'no shutdown'
]
output = connection.send_config_set(config_commands)
print(output)
connection.disconnect()
```

What is the purpose of this script?

Accepted Answer

It configures interface GigabitEthernet1/0/1 with a description, IP address, and enables it.. The script uses Netmiko's `send_config_set()` method to push a list of configuration commands to the device. The commands configure interface GigabitEthernet1/0/1 with a description, assign an IP address, and issue `no shutdown` to enable the interface. This matches option B exactly.

Answer

It retrieves the running configuration of the device.

Answer

It saves the configuration to the startup configuration.

Answer

It tests connectivity to the device using ping.

Question 6

Drag and drop the steps of Syslog severity filtering and rate-limiting configuration into the correct order, from first to last.

Accepted Answer

Enable logging on device. First, enable logging on the device (A). Second, set the logging severity level (B). Third, configure rate-limit messages (C). Fourth, specify the logging buffer size (D). Finally, display logging statistics to verify (E).

Question 7

A network administrator is using Cisco DNA Center to monitor the health of network devices. The administrator wants to see a summary of the overall network health and any issues that need attention. Which Cisco DNA Center feature provides this information?

Accepted Answer

Assurance. Cisco DNA Center Assurance is designed to give network administrators a holistic view of network health. It collects data from devices and uses machine learning to detect anomalies and provide insights. The health dashboard summarizes the status of network devices, clients, and applications, and lists issues with recommended actions. The other features are related to configuration and policy, not monitoring.

Answer

Policy

Answer

Provision

Answer

Design

Question 8

An engineer configures model-driven telemetry on a Cisco IOS-XE device with the following gRPC dial-out configuration:

```
telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state/counters
 source-address 10.1.1.1
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.2.2.2 50001 protocol grpc-tcp
```

What is the purpose of the 'encoding encode-kvgpb' command?

Accepted Answer

It specifies that the data should be encoded using the Key-Value Google Protocol Buffers format.. The command 'encoding encode-kvgpb' explicitly sets the telemetry data encoding to Key-Value Google Protocol Buffers (kvGPB). This is a compact, efficient binary format that maps YANG leaf paths to key-value pairs, optimized for high-frequency streaming telemetry over gRPC. It is not JSON, XML, or a compression mechanism; it is a specific serialization format defined for model-driven telemetry on Cisco IOS-XE.

Answer

It sets the encoding to JSON format for human readability.

Answer

It enables compression of the telemetry data.

Answer

It sets the encoding to XML format.

Question 9

A network administrator is configuring a Cisco IOS router to authenticate management users against a TACACS+ server. The administrator wants to ensure that if the TACACS+ server becomes unreachable, a local username and password can still be used to log in. Which configuration accomplishes this requirement?

Accepted Answer

aaa authentication login default group tacacs+ local. The correct method list must list 'group tacacs+' before 'local' so that TACACS+ is tried first, and local is used only if the server is unreachable. The 'local' keyword ensures that the local username database is used as a fallback. Other keywords like 'enable' or 'none' do not provide the required local username and password fallback.

Answer

aaa authentication login default local group tacacs+

Answer

aaa authentication login default group tacacs+ none

Answer

aaa authentication login default group tacacs+ enable

Question 10

A network security team is hardening a Cisco IOS-XE router that terminates a site-to-site VPN to the internet. They want to ensure that the router itself cannot be managed from untrusted networks and that its management protocols are protected. Which two configuration actions achieve these goals? (Choose two.)

Accepted Answer

Apply an access list to the VTY lines that permits only trusted management subnets and add the transport input ssh command. Hardening the management plane requires restricting who can reach the management interfaces and how. Limiting VTY access with an ACL to trusted subnets and forcing SSH eliminates cleartext and unauthorized remote logins, while an interface ACL that blocks SNMP and NETCONF from untrusted sources prevents those services from being exploited from the internet. Together these actions protect the router's management plane without disrupting the site-to-site VPN traffic.

Answer

Enable the exec-timeout 0 0 command on all VTY lines to prevent session lockouts during maintenance

Answer

Configure a local username with privilege level 15 and no password to ensure emergency access is always available

Answer

Enable the ip http server command to allow web-based management as a backup access method

Question 11

A network engineer is configuring a Cisco SD-WAN fabric with vManage, vSmart, and vBond controllers. The engineer wants to ensure that all branch routers automatically discover the vSmart and vManage controllers without manually configuring the vSmart or vManage addresses on each branch. The engineer has configured the vBond with a public IP address and enabled NAT traversal. However, branch routers are failing to establish control connections. The engineer verifies that the branch routers have the correct organization name but have not been configured with the vBond IP address. What is the most likely missing configuration?

Accepted Answer

The vBond IP address is not configured on the branch routers.. In Cisco SD-WAN, branch routers use a two-phase discovery process: they first connect to the vBond controller to authenticate and receive the list of vSmart and vManage controllers. Since the engineer has already configured the vBond with a public IP and enabled NAT traversal, and the branch routers have the correct organization name, the missing piece is that the vBond IP address must be explicitly configured on each branch router (via the 'system vbond' CLI command or the equivalent in the device template). Without this, the branch routers have no initial target to contact for the bootstrap discovery process, so they cannot automatically learn the vSmart and vManage addresses.

Answer

The vManage IP address is not configured on the branch routers.

Answer

The vSmart IP address is not configured on the branch routers.

Answer

The DTLS port 12346 is not open on the branch routers' firewall.

Question 12

A network administrator is using the Cisco DNA Center Assurance application to troubleshoot a user's slow wireless experience. The administrator notices that the client's onboarding time is high and wants to see a detailed timeline of the client's onboarding process, including association, authentication, and DHCP phases. Which Cisco DNA Center Assurance feature provides this information?

Accepted Answer

Client 360 view. The Client 360 view is designed to provide a holistic, detailed view of a single client's experience, including a timeline of onboarding phases. It allows administrators to drill down into specific events like association, authentication, and DHCP, which is essential for troubleshooting slow onboarding. Other dashboards and tools offer aggregate or path-based data, not per-client onboarding details.

Answer

Path Trace

Answer

Application Health Dashboard

Answer

Network Health Dashboard

Question 13

Examine the following configuration:

policy-map QUEUE
 class GOLD
  bandwidth percent 25
  queue-limit 64 packets
 class SILVER
  bandwidth percent 25
  queue-limit 128 packets
 class class-default
  fair-queue

interface GigabitEthernet0/2
 service-policy output QUEUE

Which statement about this configuration is true?

Accepted Answer

The GOLD class has a smaller queue limit than SILVER, which may cause more packet drops for GOLD traffic under congestion.. The GOLD class has a queue-limit of 64 packets, while the SILVER class has a queue-limit of 128 packets. Under congestion, the smaller queue for GOLD will fill up faster, leading to more tail drops for GOLD traffic, even though both classes are allocated the same bandwidth percentage. This demonstrates that queue-limit directly affects drop probability, not bandwidth allocation.

Answer

The SILVER class will always receive more bandwidth than GOLD because of its larger queue limit.

Answer

The configuration is invalid because 'queue-limit' cannot be used with 'bandwidth percent' in the same class.

Answer

The 'fair-queue' command in class-default will override the bandwidth allocation for GOLD and SILVER.

Question 14

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream interface statistics to a collector using gRPC. The engineer wants to ensure that the telemetry data is sent only when there is a change in the interface counters, rather than at a fixed interval. Which configuration parameter should the engineer use to achieve this behavior?

Accepted Answer

Configure an on-change subscription. 'on-change' subscription because it triggers updates only when the monitored data changes, unlike periodic subscriptions that send data at fixed intervals. The other options are incorrect because 'periodic' sends data at a fixed interval, 'suppress-repetition' reduces duplicate updates in periodic subscriptions but does not enable on-change behavior, and 'sample-interval' is used for periodic subscriptions.

Answer

Use a periodic subscription with a sample-interval of 0

Answer

Set the suppress-repetition flag in a periodic subscription

Answer

Use a dynamic subscription with a sample-interval of 1 second

Question 15

A network engineer runs the following command on Switch SW6:

SW6# show monitor session 6
Session 6
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 200
Destination Ports      : Gi1/0/12
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.. The output shows a Remote Destination Session, meaning this switch (SW6) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 200 and forwards it out of the destination port Gi1/0/12. The 'Source RSPAN VLAN: 200' indicates the VLAN carrying the mirrored traffic from the source switch, and 'Destination Ports: Gi1/0/12' confirms the local egress interface for the mirrored packets.

Answer

This is a local SPAN session with source VLAN 200.

Answer

The RSPAN VLAN 200 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.