350-401 Practice Test 4 — 25 Questions

Question 1

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Include the 'siteId' query parameter in the request URL.. A 400 Bad Request typically indicates a malformed request, such as missing required parameters. The API documentation specifies that 'siteId' is required, so the engineer must include it as a query parameter in the request.

Answer

Change the HTTP method to POST because GET is not supported for this endpoint.

Answer

Add an 'Authorization' header with a valid token because the API requires authentication.

Answer

Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.

Question 2

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.. RESTCONF uses HTTP methods to access YANG-defined data on network devices. It supports both XML and JSON encoding. It does not use SSH or TLS natively for transport; it relies on HTTP over TLS (HTTPS) for security. The 'data' resource is the top-level resource for accessing YANG data stores. RESTCONF does not define its own data model; it uses YANG models.

Answer

RESTCONF supports only XML encoding for data.

Answer

RESTCONF uses SSH as the transport protocol.

Answer

RESTCONF defines its own data modeling language.

Question 3

Drag and drop each NETCONF operation on the left to its action on the right.

Accepted Answer

get: Retrieve running configuration and state data. Correct pairings: get retrieves running config and state data; get-config retrieves a specific datastore; edit-config modifies configuration; commit confirms a candidate configuration; lock prevents other sessions from modifying a datastore.

Question 4

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to model both configuration and operational state data.. YANG is a data modeling language used to model configuration and state data for network devices. It can define both configuration data (which is writable) and operational state data (which is read-only). YANG models can be augmented using the 'augment' statement to add nodes to an existing model without modifying it. YANG does not define transport protocols; it is used with protocols like NETCONF and RESTCONF. The 'leaf' statement defines a single, scalar data node, not a list.

Answer

YANG defines the transport protocol for data exchange.

Answer

The 'leaf' statement in YANG defines a list of key-value pairs.

Question 5

Drag and drop each RESTCONF method on the left to its equivalent NETCONF operation on the right.

Accepted Answer

GET: get-config (retrieves data). Correct pairings: GET retrieves data (like get-config); POST creates a resource (like edit-config with operation create); PUT replaces a resource (like edit-config with operation replace); PATCH partially updates (like edit-config with operation merge); DELETE removes a resource (like edit-config with operation delete).

Question 6

Given the following configuration on a Cisco IOS-XE device:

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip ospf cost 10
!
interface GigabitEthernet0/1
 ip address 10.2.2.1 255.255.255.0
!

Which statement is true about OSPF operation?

Accepted Answer

GigabitEthernet0/0 will have an OSPF cost of 10, and GigabitEthernet0/1 will have a default cost based on its bandwidth.. The 'ip ospf cost' command overrides the default cost calculation based on bandwidth. The network command matches both interfaces because they fall under 10.0.0.0/8.

Answer

Both interfaces will have an OSPF cost of 10.

Answer

Both interfaces will have the same OSPF cost because they are in the same area.

Answer

OSPF will not run on either interface because the network command uses a wildcard mask of 0.255.255.255.

Question 7

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). BGP uses multiple attributes in its path selection algorithm. The weight attribute is Cisco-specific and is preferred with the highest value. The local preference is also preferred with the highest value. The MED (Multi-Exit Discriminator) is preferred with the lowest value.

Answer

Weight

Answer

Local Preference

Answer

AS Path Length

Question 8

Examine the following EIGRP configuration on a Cisco IOS-XE device:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 10.2.2.1 255.255.255.0

Which statement is true?

Accepted Answer

EIGRP will form an adjacency only on GigabitEthernet0/0.. The 'passive-interface default' command sets all interfaces as passive, meaning they do not send or receive EIGRP hellos. The 'no passive-interface' command overrides this for specific interfaces.

Answer

EIGRP will form adjacencies on both GigabitEthernet0/0 and GigabitEthernet0/1.

Answer

EIGRP will not form any adjacencies because the network command does not match the interface subnets.

Answer

EIGRP will form adjacencies on all interfaces except those with 'passive-interface' configured.

Question 9

Consider the following configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache entries 16000
!

Which statement about this configuration is correct?

Accepted Answer

The flow cache can hold up to 16,000 flow entries simultaneously.. The 'cache entries 16000' command under the flow monitor specifies the maximum number of flow entries that the NetFlow cache can hold simultaneously. This is a hard limit on the size of the flow cache, not a timer or byte limit. Therefore, the flow cache can store up to 16,000 concurrent flow records before it must either export or age out older entries to make room.

Answer

The flow cache will export flows every 16,000 seconds.

Answer

The flow cache will store only 16,000 bytes of flow data.

Answer

The flow cache will automatically increase to 32,000 entries if needed.

Question 10

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 11

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 12

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Accepted Answer

Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.. Cisco DNA Center's syslog collector listens on specific ports (default UDP 514). If the switch is configured to send syslog but DNA Center is not receiving it, a common issue is that the syslog port is blocked by a firewall or ACL between the switch and DNA Center. The engineer should verify network connectivity and port accessibility.

Answer

Check if the syslog messages are in the correct format.

Answer

Ensure that the switch is in the Inventory and managed by DNA Center.

Answer

Restart the syslog collector service on DNA Center.

Question 13

Examine this DHCP configuration:
```
ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8
 lease 0 12
!
ip dhcp excluded-address 10.10.10.1 10.10.10.10
```
Which statement is true?

Accepted Answer

DHCP clients will receive a lease for 12 hours.. The `lease 0 12` command explicitly sets the DHCP lease duration to 12 hours (0 days, 12 hours). The router will assign addresses from 10.10.10.11 to 10.10.10.254, as the excluded-address range (10.10.10.1–10.10.10.10) removes the first ten addresses from the pool, and the network statement defines the 10.10.10.0/24 subnet.

Answer

The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.

Answer

The default lease is used because the lease command is incomplete.

Answer

The DNS server is set to 8.8.8.8, but clients will ignore it.

Question 14

Examine the following configuration on a Cisco 9800 WLC:

wireless profile policy test-policy
 no security wpa
 no security wpa2
 security wpa3
 security wpa3 akm sae
 security ft over-the-ds

What is the effect of the 'security ft over-the-ds' command?

Accepted Answer

It enables 802.11r fast roaming using the distribution system for key exchange.. The 'security ft over-the-ds' command enables 802.11r Fast Transition (FT) using the Distribution System (DS) for key exchange. In this mode, the client and target AP communicate via the current AP over the wired network (DS) rather than over the air, reducing over-the-air overhead and improving roaming efficiency. This is in contrast to 'over-the-air' mode, where the client directly exchanges FT authentication messages with the target AP wirelessly.

Answer

It enables 802.11r fast roaming using over-the-air messaging.

Answer

It disables fast roaming for this policy.

Answer

It configures the AP to use a different radio band.

Question 15

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local              Remote               Status         Role
   1         10.1.1.1/4500      10.2.2.2/4500        READY          INITIATOR
      Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3600 sec

Child SA: Local selector  10.1.1.0/0 - 10.1.1.255/65535
             Remote selector 10.2.2.0/0 - 10.2.2.255/65535
             ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Accepted Answer

The tunnel is using pre-shared keys for authentication.. The output shows 'Auth sign: PSK' and 'Auth verify: PSK', which explicitly indicates that pre-shared keys (PSK) are used for IKEv2 authentication. The status 'READY' and 'UP-ACTIVE' confirm the SA is operational, not failed. Therefore, option B is correct.

Answer

The IKEv2 SA is in a failed state because it is READY.

Answer

The tunnel is using RSA signatures for authentication.

Answer

The IKEv2 SA has expired because the life time is 86400 seconds.

Question 16

Drag and drop the steps of NBAR2 application recognition and classification steps into the correct order, from first to last.

Accepted Answer

Enable ip nbar protocol-discovery on interface. NBAR2 configuration begins by enabling the protocol discovery, then creating a class map to match the application, a policy map to mark traffic, applying it to the interface, and verifying the classification. NBAR2 uses deep packet inspection to identify applications.

Question 17

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

60 seconds. The default quiet-period timer in Cisco IOS 802.1X configuration is 60 seconds. This timer defines the period the switch waits after a failed authentication attempt before re-initiating authentication with the same supplicant. It prevents repeated authentication attempts from overwhelming the switch and the RADIUS server.

Answer

30 seconds

Answer

120 seconds

Answer

10 seconds

Question 18

A network engineer is configuring a new Cisco Catalyst switch to connect to an existing network. The uplink to the distribution switch is configured as a trunk. The engineer wants to ensure that the trunk uses 802.1Q encapsulation and that the native VLAN is set to VLAN 100. The distribution switch is a Cisco Catalyst 3850. Which configuration should the engineer apply on the uplink interface?

Accepted Answer

switchport mode trunk; switchport trunk native vlan 100. On modern Cisco Catalyst switches that run LAN Base or IP Base software, the default trunk encapsulation is 802.1Q, so the 'switchport trunk encapsulation dot1q' command is not required. The 'switchport mode trunk' forces the interface into trunking mode, and 'switchport trunk native vlan 100' sets the native VLAN to 100, which matches the requirement.

Answer

switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 100

Answer

switchport mode dynamic desirable; switchport trunk native vlan 100

Answer

switchport mode trunk; switchport trunk allowed vlan 100

Question 19

Drag and drop each NetFlow version on the left to its matching feature on the right.

Accepted Answer

NetFlow v5: Fixed-format records with no templates. NetFlow v5 sends fixed-format records with no user-defined fields. v9 supports templates and flexible field definitions. IPFIX is the standardized version of v9 with additional fields and variable-length support.

Question 20

A network engineer is troubleshooting a model-driven telemetry deployment on a Cisco IOS-XE router. The telemetry subscription is configured to stream interface statistics using gRPC dial-out to a collector at 10.1.1.100:50051. The engineer verifies that the collector is listening on the port and the router can reach it. However, the collector shows no data received. The engineer checks the router's telemetry logs and sees 'Connection refused' errors. What is the most likely cause?

Accepted Answer

The gRPC server on the collector is not running or is listening on a different port. That the collector is not configured to accept gRPC connections, or the gRPC server on the collector is not running. The 'Connection refused' error indicates that the TCP connection is being rejected, typically because the collector's gRPC server is not listening on that port. The other options are incorrect because the router can reach the collector, so firewall is not blocking; the subscription is configured correctly; and the encoding is not the cause of connection refusal.

Answer

The collector's firewall is blocking the connection from the router

Answer

The telemetry subscription is missing the 'encoding' configuration

Answer

The router's source-interface is not configured, causing the router to use an unreachable IP