350-401 Practice Test 3 — 25 Questions

Question 1

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fabric Edge node. The Fabric Edge node is the correct answer because it is the SD-Access component that serves as the attachment point for both wired and wireless endpoints. In an SD-Access fabric, the Fabric Edge node terminates the VXLAN tunnels from the wireless LAN controller (WLC) and applies consistent policy (e.g., SGT-based ACLs) to traffic from both wired and wireless users, ensuring seamless integration of the existing wireless infrastructure.

Answer

Fabric Control node

Answer

Fabric Border node

Answer

Wireless LAN Controller (WLC)

Question 2

An engineer configures IP SLA 30 to monitor the one-way delay to a remote site using UDP jitter. The operation is used to adjust routing metrics via route maps. The engineer notices that the IP SLA operation shows 'State: Active' but the one-way delay values are inconsistent, sometimes showing negative values. What is the most likely cause?

Accepted Answer

The source and destination routers do not have synchronized clocks via NTP, causing one-way delay calculations to be inaccurate.. IP SLA UDP jitter measures one-way delay by timestamping packets at both the source and destination. If the clocks on the two routers are not synchronized via NTP, the timestamps will be offset, leading to inaccurate (and sometimes negative) one-way delay values. Negative delay occurs when the destination timestamp appears earlier than the source timestamp due to clock skew.

Answer

The IP SLA operation is not configured with a 'request-data-size' that matches the remote router's MTU, causing fragmentation and delay variations.

Answer

The IP SLA operation is using a 'frequency' that is too high, causing the probes to overlap and corrupt the statistics.

Answer

The remote router's IP SLA responder is not configured, so the source is using a different method to estimate delay.

Question 3

A company is deploying a new campus network with a hierarchical design (core, distribution, access). The QoS design must ensure that voice traffic is prioritized end-to-end, and that marking is trusted only on access ports connected to IP phones. Which architectural approach should the architect take for classification and marking?

Accepted Answer

Configure the access switches to trust DSCP on ports connected to IP phones, and apply queuing policies on distribution and core switches that match the trusted markings.. It aligns with the Cisco QoS trust boundary model for campus networks. IP phones are trusted endpoints that mark voice traffic with the correct DSCP values (e.g., EF for voice, AF41 for video). By configuring the access switch port to trust DSCP from the IP phone, the marking is preserved end-to-end. Distribution and core switches then apply queuing policies (e.g., LLQ) based on these trusted markings, ensuring voice traffic receives priority treatment across the entire network.

Answer

Remark all traffic to a single DSCP value at the access layer and apply priority queuing at the core.

Answer

Apply QoS policies only at the core layer, ignoring markings from the access layer.

Answer

Use the distribution layer to reclassify traffic based on source MAC addresses of IP phones.

Question 4

Consider this VLAN configuration on a Cisco switch:

vlan 10
 name Sales
vlan 20
 name Engineering
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

What is missing if the switch needs to carry VLAN 30 traffic on this trunk?

Accepted Answer

VLAN 30 must be created and added to the allowed VLAN list on the trunk.. A trunk port only forwards traffic for VLANs that exist in the switch's VLAN database and are explicitly permitted in the allowed VLAN list. VLAN 30 is neither created (no 'vlan 30' command) nor added to the trunk's allowed list (missing 'switchport trunk allowed vlan add 30'), so the switch will drop any frames tagged with VLAN 30. Creating the VLAN and updating the allowed list ensures the trunk can forward VLAN 30 traffic.

Answer

The trunk must be configured as an access port for VLAN 30.

Answer

The native VLAN must be changed to VLAN 30.

Answer

The switchport mode must be changed to dynamic desirable.

Question 5

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Accepted Answer

10 seconds. The default OSPF hello interval on an Ethernet link (which is a broadcast multi-access network type) is 10 seconds. This is defined in RFC 2328 and is the default on Cisco routers for broadcast and point-to-point network types. The hello interval determines how often a router sends hello packets to discover and maintain neighbor relationships.

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 6

A network team must design a QoS policy for a WAN link that carries voice, video, and data. The policy must ensure that voice traffic is never dropped, even during congestion. Which queuing mechanism should be used for the voice class?

Accepted Answer

Low-latency queuing (LLQ).. Low-latency queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, allowing voice traffic to be placed in a strict priority queue that is serviced first before any other queues. This ensures that voice packets are never dropped due to congestion, as long as the configured policer rate is not exceeded, meeting the requirement that voice traffic is never dropped.

Answer

Class-based weighted fair queuing (CBWFQ).

Answer

Weighted random early detection (WRED).

Answer

First-in, first-out (FIFO) queuing.

Question 7

Drag and drop the steps of disaster recovery failover process into the correct order, from first to last.

Accepted Answer

Detect failure via keepalives or BFD. Failover begins with detecting the primary failure, then activating the backup path. Traffic is redirected to the secondary site, and after the primary is restored, operations are switched back in a controlled manner.

Question 8

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Accepted Answer

Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.. Flexible NetFlow allows you to define a custom flow record that includes key fields such as 'match ipv4 vrf' (VRF-aware NetFlow) to uniquely identify each customer's traffic. By applying a single flow monitor on a shared interface (e.g., a trunk or core link), the router can tag flows with the VRF or VLAN identifier, ensuring per-customer separation without needing multiple monitors or collectors. This approach is efficient and leverages the router's ability to export differentiated flow records to a single collector, which can then filter based on the VRF or VLAN field.

Answer

Configure a separate flow monitor for each customer interface and export to different collectors.

Answer

Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.

Answer

Enable SNMP interface polling to track per-customer traffic statistics.

Question 9

An architect is planning a virtualized infrastructure for a branch office that will host a Cisco ISRv router and a local DHCP server. The architect wants to minimize management overhead and ensure the VMs can be easily backed up. Which hypervisor deployment model is most appropriate?

Accepted Answer

Deploy a Type 1 hypervisor on the branch server and manage VMs via a centralized vCenter or similar tool.. A Type 1 hypervisor (bare-metal) runs directly on the server hardware, providing near-native performance for the Cisco ISRv router and DHCP server. Centralized management via vCenter or similar tools reduces administrative overhead and enables efficient VM backup and recovery, meeting the architect's requirements for minimal management overhead and easy backup.

Answer

Use a Type 2 hypervisor on a desktop PC at the branch.

Answer

Run the ISRv and DHCP server as containers on the same host.

Answer

Install the ISRv directly on physical hardware without virtualization.

Question 10

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Accepted Answer

No telemetry subscription is configured on the router for the desired data paths.. The gRPC server running and the collector being reachable indicates the transport layer is functional. However, streaming telemetry requires an explicit subscription configuration on the router that defines which data paths (e.g., YANG paths) to stream and to which collector. Without a subscription, the router has no instruction to send telemetry data, even if the gRPC server is active and network connectivity exists.

Answer

The gRPC server is configured with the wrong port number.

Answer

The collector is not listening on the same IP address as configured on the router.

Answer

The telemetry data is encoded in GPB, but the collector expects JSON.

Question 11

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Accepted Answer

Phase 1: Hub-and-spoke with NHRP registration. DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

Answer

Phase 4: NHRP with BGP for routing

Answer

Phase 5: NHRP with OSPF for routing

Question 12

A network team is designing an SD-WAN overlay for a multinational enterprise with 500+ branch sites. The design must ensure that control plane traffic (e.g., OMP updates) is encrypted and authenticated between all vSmart controllers and vEdge routers, while allowing data plane traffic to use IPsec tunnels between branch sites directly. Which architectural element is responsible for orchestrating the initial authentication and certificate enrollment of all SD-WAN devices?

Accepted Answer

vBond. C is correct because the vBond orchestrator is the sole component responsible for initial authentication and certificate enrollment in Cisco SD-WAN. It acts as a trusted certificate authority (CA) proxy, validating the serial numbers and certificates of all vSmart controllers and vEdge routers before they join the overlay network. Without vBond, devices cannot establish trust or receive the authorized list of vSmart and vManage IP addresses.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 13

Given the configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache timeout active 60
 cache timeout inactive 15
!

What is the effect of the 'cache timeout active 60' command?

Accepted Answer

Flows that are active for more than 60 seconds are exported immediately and then removed from the cache.. The 'cache timeout active 60' command configures the NetFlow cache to export and remove any flow that has been active for 60 seconds, even if it is still ongoing. This ensures that long-lived flows are reported periodically rather than waiting until the flow ends, which could delay visibility into sustained traffic patterns.

Answer

Flows that are inactive for 60 seconds are exported and removed from the cache.

Answer

The cache will hold a maximum of 60 active flows at any time.

Answer

Flow records are sent to the exporter every 60 seconds.

Question 14

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 10.1.1.2 remote-as 65001
 neighbor 10.1.1.2 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the effect of this configuration?

Accepted Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing inbound path selection in AS 65001.. The route-map SET_MED is applied to outbound updates to neighbor 10.1.1.2, setting the MED (Multi-Exit Discriminator) attribute to 50. MED is a metric that influences inbound path selection in the neighboring AS (AS 65001), telling its routers which path to prefer when multiple entry points exist into AS 65000. Therefore, option A correctly describes the effect.

Answer

Routes advertised to 10.1.1.2 will have the MED set to 50, influencing outbound path selection from AS 65000.

Answer

Routes received from 10.1.1.2 will have the MED set to 50.

Answer

The MED value will be set to 50 for all routes in the BGP table.

Question 15

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Accepted Answer

VPN segments in vManage. In Cisco SD-WAN, segmentation is achieved by creating VPN segments in vManage and mapping them to VRF instances on the WAN Edge devices. The VPN segments define the logical separation, and the VRFs enforce it by maintaining separate routing and forwarding tables. Together, they provide end-to-end isolation and allow policies to be applied per segment. Other options like VLANs or IPsec tunnels do not provide fabric-wide segmentation, and application-aware routing policies are for path selection, not isolation.

Answer

Application-aware routing policies

Answer

IPsec tunnels between branches

Answer

VLANs on the WAN Edge routers

Question 16

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied. The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 17

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Accepted Answer

The priority queue has a built-in policer that drops traffic exceeding the configured bandwidth.. The priority queue in LLQ uses a built-in policer that drops traffic exceeding the configured bandwidth. When congestion occurs, the policer enforces the bandwidth limit by dropping excess packets, which explains why voice packets are being dropped despite the priority queue being active. This is a fundamental behavior of LLQ to prevent the priority queue from starving other queues.

Answer

The priority queue is not configured with a bandwidth statement.

Answer

The class-map is not matching voice traffic correctly.

Answer

The router is using FIFO queuing instead of LLQ.

Question 18

An engineer is troubleshooting an MPLS VPN where CE1 (10.1.1.0/24) cannot reach CE2 (10.2.2.0/24). The PE routers are running OSPF with the CE routers. On PE1, the 'show ip route vrf CUSTOMER' output shows 10.2.2.0/24 as an OSPF route, but the prefix is not present in the global BGP table. What is the most likely cause?

Accepted Answer

Redistribution from OSPF into BGP under the VRF is not configured on PE1.. In an MPLS VPN, the PE router must redistribute OSPF routes learned from the CE into MP-BGP under the VRF to propagate them across the MPLS backbone. Without this redistribution, the prefix 10.2.2.0/24 appears in the VRF routing table as an OSPF route but is never injected into the BGP table, so it cannot be advertised to the remote PE. This explains why CE1 cannot reach CE2 despite the route being present locally on PE1.

Answer

The OSPF adjacency between PE1 and CE1 is down.

Answer

The VRF forwarding table on PE1 is full.

Answer

MPLS LDP is not enabled on the PE1-CE1 link.

Question 19

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 20

Which two statements about Type 1 and Type 2 hypervisors are true? (Choose two.)

Accepted Answer

A Type 1 hypervisor runs directly on the physical hardware without a host operating system.. Option A is correct because a Type 1 (bare-metal) hypervisor, such as VMware ESXi, Microsoft Hyper-V Server, or Citrix XenServer, installs and runs directly on the physical hardware and does not require an underlying host operating system. Option D is correct because VMware Workstation is a Type 2 (hosted) hypervisor that installs as an application on top of an existing host OS like Windows or Linux. Option B is incorrect because it describes a Type 1, not a Type 2, hypervisor — Type 2 hypervisors require a host operating system. Option C is incorrect because VMware ESXi is a Type 1 bare-metal hypervisor, not Type 2. Option E is incorrect because Type 1 hypervisors are typically deployed in data centers and server virtualization scenarios, whereas Type 2 hypervisors are more commonly used for desktop virtualization and testing.

Answer

A Type 2 hypervisor runs directly on the physical hardware without a host operating system.

Answer

VMware ESXi is an example of a Type 2 hypervisor.

Answer

Type 1 hypervisors are typically used for desktop virtualization in enterprise environments.