350-401 Practice Test 25 — 15 Questions

Question 1

An engineer configures a VXLAN tunnel between two Nexus switches acting as VTEPs. The underlay is a routed Layer 3 network using OSPF, and the loopback interfaces of the VTEPs are reachable. However, hosts in the same VXLAN VNI on different VTEPs cannot communicate. Which action should the engineer take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the NVE interface with the correct source-interface and ensure the VNI is mapped to the VLAN.. The NVE interface on a Cisco Nexus VTEP must have a source-interface configured, usually a loopback, and each VNI must be mapped to a VLAN. Without these, VXLAN encapsulation and decapsulation fail, so hosts in the same VNI on different VTEPs cannot communicate. The underlay is already operational, so the fix is to correct the NVE and VNI configuration.

Answer

Configure static VXLAN tunnels between the VTEPs using the destination-udp-port command.

Answer

Enable OSPF on the loopback interfaces and advertise them into the underlay.

Answer

Enable PIM sparse mode on the underlay and configure a rendezvous point for multicast replication.

Question 2

A network engineer is implementing VXLAN with an EVPN control plane in a data center. The engineer must ensure that the underlay network supports the required traffic and that the overlay provides optimal forwarding. Which two statements are true regarding this implementation? (Choose two.)

Accepted Answer

EVPN uses MP-BGP to distribute MAC and IP address reachability information.. EVPN uses MP-BGP to distribute MAC and IP reachability, enabling control-plane learning and features like ARP suppression. ARP suppression reduces broadcast traffic by allowing VTEPs to answer ARP requests locally. Multicast is not required in the underlay because EVPN uses ingress replication for BUM traffic. The underlay must be Layer 3, and VTEPs can be in different subnets as long as they are reachable.

Answer

The underlay network must be a Layer 2 network to carry VXLAN traffic.

Answer

EVPN requires that all VTEPs be in the same subnet.

Answer

The underlay network must support multicast for BUM traffic replication.

Question 3

A network engineer is configuring a Cisco IOS router to act as a DHCP server for a subnet that also contains a DHCP relay agent. The router must ensure that DHCP clients receive the correct default gateway address of 10.1.1.1, which is the router's own interface on that subnet. Which command is required to accomplish this?

Accepted Answer

ip dhcp pool POOL1 followed by default-router 10.1.1.1. To provide DHCP clients with a default gateway, the network engineer must configure the default-router command within the DHCP pool. This command specifies the IP address of the gateway that clients will use to reach other networks. The other options are either for different purposes or do not configure the DHCP server to supply gateway information.

Answer

ip dhcp excluded-address 10.1.1.1

Answer

ip default-gateway 10.1.1.1 in global configuration mode

Answer

ip helper-address 10.1.1.1 under the router's interface

Question 4

A network engineer is configuring a Cisco IOS XE router to support a site-to-site VXLAN tunnel over an existing IP underlay. The engineer must configure the NVE interface and ensure that the underlay provides the necessary transport. Which two statements are true about this configuration? (Choose two.)

Accepted Answer

VXLAN uses UDP port 4789 as the destination port for encapsulated traffic by default.. VXLAN on Cisco IOS XE uses an NVE interface that references a source interface for the tunnel source IP, and it encapsulates frames in UDP with default destination port 4789. The underlay only needs IP reachability between VTEPs; MPLS LDP, shared subnets, and Layer 2 adjacency are not required. These two statements correctly describe the configuration and transport behavior.

Answer

The NVE interface must be assigned an IP address from the same subnet as the remote VTEP.

Answer

VXLAN requires that the underlay provide Layer 2 adjacency between all VTEPs.

Answer

The underlay must run MPLS LDP to carry VXLAN traffic between VTEPs.

Question 5

A network engineer is configuring a Cisco IOS router to support NAT for a small office. The inside network uses the 192.168.1.0/24 subnet, and the outside interface is GigabitEthernet0/0 with IP address 203.0.113.5. The engineer wants to translate all inside addresses to the outside interface address. Which command is required to define the NAT source list?

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255. To define the NAT source list, an access list must be created that matches the inside local addresses. The command access-list 1 permit 192.168.1.0 0.0.0.255 accomplishes this by permitting the entire 192.168.1.0/24 subnet. This list is then referenced in the ip nat inside source list command to enable translation.

Answer

ip nat pool POOL 203.0.113.5 203.0.113.5 netmask 255.255.255.0

Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload

Answer

ip nat inside source static 192.168.1.1 203.0.113.5

Question 6

A network engineer uses NAPALM to retrieve the ARP table from a Cisco IOS-XE device:

```python
from napalm import get_network_driver
driver = get_network_driver('ios')
device = driver('192.168.1.1', 'admin', 'cisco123')
device.open()
arp_table = device.get_arp_table()
print(arp_table)
device.close()
```

What is the expected data type of arp_table?

Accepted Answer

A list of dictionaries, each with keys such as 'interface', 'ip', 'mac', and 'age'.. NAPALM's `get_arp_table()` method returns a list of dictionaries, where each dictionary represents a single ARP entry with keys such as 'interface', 'ip', 'mac', and 'age'. This is the standardized data structure across all NAPALM-supported platforms, including Cisco IOS-XE, ensuring consistent programmatic access to ARP table data.

Answer

A dictionary with keys 'arp_table' and a list of tuples.

Answer

A string containing the raw CLI output of 'show arp'.

Answer

A list of strings, each representing an ARP entry.

Question 7

A network architect is designing a Cisco SD-WAN fabric for a company with 50 branch sites. The company wants to ensure that business-critical traffic (such as VoIP and ERP) is prioritized over best-effort traffic (such as guest internet) across the overlay. The architect plans to use the vManage controller to define an application-aware routing policy. Which component of the Cisco SD-WAN solution is responsible for enforcing the application-aware routing policy on the data plane?

Accepted Answer

vEdge router. In Cisco SD-WAN, application-aware routing policies are defined centrally on vManage, but they are enforced by the data plane devices—vEdge routers (or cEdge routers). These devices inspect traffic, identify applications, and apply the policy actions such as preferred path or SLA-based forwarding. The vSmart controller distributes policy information, but it does not process user traffic. Therefore, the vEdge router is the correct answer.

Answer

vManage

Answer

vBond orchestrator

Answer

vSmart controller

Question 8

Drag and drop the steps of iBGP route reflection configuration steps into the correct order, from first to last.

Accepted Answer

Enable BGP routing process. Route reflection requires first enabling BGP, then configuring the cluster ID, designating the route reflector client, and finally verifying the reflection behavior.

Question 9

A network engineer is designing a large-scale campus network using Cisco SD-Access. The fabric must support thousands of endpoints and provide optimal forwarding paths. Which control plane component is responsible for maintaining the mapping of endpoint IP addresses to fabric edge nodes?

Accepted Answer

Fabric control plane node. In Cisco SD-Access, the fabric control plane node uses LISP to maintain a mapping database of endpoint IP addresses to their current fabric edge nodes. This enables fabric edge nodes to query the control plane and forward traffic directly to the correct edge node, ensuring optimal paths and scalability for thousands of endpoints.

Answer

Fabric intermediate node

Answer

Cisco DNA Center

Answer

Fabric edge node

Question 10

A network architect is designing a new branch office that requires a controller-based wireless solution with centralized management, but the branch has limited bandwidth and must continue forwarding client traffic locally even if the WAN link to the headquarters controller fails. The branch has a single Cisco Catalyst 9800-L controller and several Cisco Catalyst 9100 access points. Which deployment mode should the architect choose for the access points?

Accepted Answer

FlexConnect mode with local switching enabled on the access points. FlexConnect with local switching allows the access point to forward client traffic locally at the branch, reducing WAN bandwidth consumption and providing survivability if the controller becomes unreachable. The controller still manages the AP for configuration and control plane functions, but data traffic does not need to traverse the WAN. This matches the branch requirements for centralized management and local forwarding.

Answer

Local mode with CAPWAP control and data tunnels to the controller

Answer

Sniffer mode with packet capture to a remote server

Answer

Monitor mode with dedicated air monitoring on all access points

Question 11

A network architect is designing a QoS policy for a campus network. The architect needs to ensure that voice traffic is prioritized over all other traffic types, even during congestion. Which queuing mechanism should be used on the egress interface to provide strict priority to voice traffic?

Accepted Answer

Low Latency Queuing (LLQ). Low Latency Queuing (LLQ) provides strict priority queuing, which ensures that voice traffic is serviced before all other traffic. LLQ is an extension of CBWFQ that includes a priority queue for delay-sensitive traffic. The priority queue is policed to prevent bandwidth starvation of other queues. CBWFQ, WRED, and FIFO do not offer strict priority and are not suitable for voice traffic prioritization.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Weighted Random Early Detection (WRED)

Answer

First-In, First-Out (FIFO) queuing

Question 12

A network engineer is designing a Cisco SD-Access fabric for a campus network. The fabric must support both wired and wireless clients, and the engineer wants to ensure that traffic from wired endpoints is encapsulated and forwarded through the fabric without requiring the endpoints to change their IP addresses. Which component of the SD-Access architecture is responsible for encapsulating traffic from wired endpoints and forwarding it to the fabric edge?

Accepted Answer

Fabric edge node. In Cisco SD-Access, the fabric edge node is the device that connects wired endpoints to the fabric. It encapsulates traffic from wired endpoints into VXLAN and forwards it to the destination fabric edge node based on the control plane mapping. This allows endpoints to keep their IP addresses and be part of a virtual network without re-addressing.

Answer

Control plane node

Answer

Fabric intermediate node

Answer

Fabric border node

Question 13

A network designer is planning a QoS policy for a campus network that carries voice, video, and critical business applications. The design must ensure that voice traffic receives priority treatment with minimal latency and jitter, while preventing starvation of other traffic. Which queuing mechanism should be used on the egress interfaces to meet these requirements?

Accepted Answer

Low Latency Queuing (LLQ). Low Latency Queuing (LLQ) combines a strict priority queue with class-based weighted fair queuing for other traffic. The priority queue is typically used for voice, ensuring minimal delay and jitter, while a policer limits its bandwidth to prevent starvation of other classes. This makes LLQ the correct choice for meeting strict voice QoS requirements.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Weighted Random Early Detection (WRED)

Answer

First-In, First-Out (FIFO) queuing

Question 14

A network engineer is configuring a Cisco wireless LAN controller (WLC) to support a new wireless network for guests. The requirement is that guest clients must be isolated from the corporate network and only have internet access. Which feature should be configured on the WLC?

Accepted Answer

Guest anchor controller. To isolate guest wireless traffic from the corporate network and provide only internet access, a guest anchor controller is used. The guest anchor controller is typically placed in a DMZ and handles all guest traffic, while the foreign controller tunnels guest client traffic to the anchor. This design ensures that guest clients cannot reach internal corporate resources.

Answer

Radio Resource Management (RRM)

Answer

FlexConnect local switching

Answer

Quality of Service (QoS) profile

Question 15

Drag and drop the steps of configuring a Layer 2 EtherChannel using PAgP into the correct order, from first to last.

Accepted Answer

Create port-channel interface with interface port-channel command. First, create the port-channel interface globally. Then set the channel-group mode to desirable on the first interface. Next, set the same mode on the second interface. After that, verify the bundle forms using show commands. Finally, assign the port-channel to a VLAN to enable data forwarding. This sequence ensures PAgP negotiation completes before the bundle is used.