350-401 Practice Test 4 — 25 Questions

Question 1

Examine the following configuration snippet:
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
 ip ospf dead-interval 40
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF adjacency will form with a neighbor using hello/dead intervals of 10/40 seconds.. The configuration sets the OSPF network type to point-to-point on the interface, which allows OSPF to form an adjacency with a neighbor using the configured hello interval of 10 seconds and dead interval of 40 seconds. These intervals are valid for point-to-point networks, and the network command under router ospf correctly enables OSPF on the interface. Therefore, an adjacency will form as long as the neighbor's intervals match.

Answer

OSPF adjacency will not form because the hello interval is too low for point-to-point.

Answer

The network command under router ospf will be ignored because the interface has an explicit network type.

Answer

OSPF will use the default broadcast network type because the point-to-point keyword is misspelled.

Question 2

A company is deploying an SD-Access fabric with a centralized policy model. The design must ensure that all traffic between virtual networks (VNs) is inspected by a firewall. Which fabric role should be used to enforce this inter-VN policy?

Accepted Answer

Fabric border node. In a centralized policy model for SD-Access, the fabric border node is the correct role to enforce inter-VN traffic policies because it is the only node that can route traffic between different virtual networks (VNs) while applying firewall inspection. The border node connects the fabric to external networks and, when configured with a firewall, can enforce policies such as IP-based ACLs or zone-based firewalls for traffic crossing VNs. This design ensures that all inter-VN traffic is funneled through the border node for inspection, aligning with the centralized policy model where policy enforcement occurs at the network edge.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric WAN router

Question 3

Which component in Cisco SD-WAN is responsible for orchestrating the overlay network, including authentication and NAT traversal?

Accepted Answer

vBond orchestrator. The vBond orchestrator is responsible for the initial authentication of all SD-WAN components (vSmart, vManage, vEdge/cEdge) into the overlay network. It also performs NAT traversal by discovering and distributing the public IP addresses and port numbers of vEdge routers behind NAT, enabling secure DTLS/TLS connections between them. Without vBond, new devices cannot securely join the fabric or establish control-plane connectivity.

Answer

vSmart controller

Answer

vManage NMS

Answer

vEdge router

Question 4

Drag and drop the steps of VNF service chain instantiation into the correct order, from first to last.

Accepted Answer

Define service chain requirements. Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.

Question 5

A network administrator is configuring a new Cisco IOS switch and wants to ensure that the management VLAN is isolated from user traffic. The administrator needs to assign an IP address to VLAN 1 for management access. Which command should be used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign an IP address to a VLAN for management, you must enter the SVI configuration using 'interface vlan 1'. This creates a logical Layer 3 interface for that VLAN. The other options either configure physical interfaces, create the VLAN without Layer 3, or are incomplete without entering the interface mode first.

Answer

ip address 192.168.1.1 255.255.255.0

Answer

interface fastethernet 0/1

Answer

vlan 1

Question 6

A network administrator is comparing configuration management tools and wants to use one that is agentless, uses YAML for playbooks, and communicates with Cisco IOS XE devices over SSH. Which tool best meets these requirements?

Accepted Answer

Ansible. Ansible is designed as an agentless automation tool that communicates over SSH and uses YAML playbooks. It provides network-specific modules for Cisco IOS XE, allowing configuration and command execution without installing software on the managed devices. This combination of agentless architecture, YAML syntax, and SSH transport exactly matches the administrator's requirements, distinguishing it from agent-based tools like Puppet, Chef, and SaltStack.

Answer

Puppet

Answer

Chef

Answer

SaltStack

Question 7

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 8

Examine the following configuration:

policy-map SHAPE_POLICY
 class class-default
  shape average 10000000
  service-policy INNER_POLICY

What is the purpose of the nested service-policy (service-policy INNER_POLICY) under the shape command?

Accepted Answer

It applies the INNER_POLICY to traffic after shaping, allowing per-class queuing within the shaped rate.. The nested service-policy under the shape command applies the INNER_POLICY to traffic after it has been shaped to 10 Mbps. This allows per-class queuing and scheduling within the shaped rate, enabling finer QoS control such as bandwidth allocation or priority queuing for specific traffic classes while ensuring the overall output does not exceed the shaped rate.

Answer

It applies the INNER_POLICY to traffic before shaping, which is not supported.

Answer

It is used to shape traffic twice, first at 10 Mbps and then again based on INNER_POLICY.

Answer

This configuration is invalid because service-policy cannot be nested under shape.

Question 9

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail
EIGRP-IPv4 Interfaces for AS(100)

Interface: GigabitEthernet0/0
  Mtu: 1500, Bandwidth: 1000000 Kbit, Delay: 100 microseconds
  Reliability: 255/255, Load: 1/255, Min MTU: 1500
  Hello interval: 5 sec, Hold time: 15 sec
  Next hello in: 3 secs
  Passive interface: No
  Split horizon: Enabled
  Authentication: None
  Neighbor count: 1

Interface: GigabitEthernet0/1
  Mtu: 1500, Bandwidth: 100000 Kbit, Delay: 1000 microseconds
  Reliability: 255/255, Load: 1/255, Min MTU: 1500
  Hello interval: 5 sec, Hold time: 15 sec
  Next hello in: 1 secs
  Passive interface: No
  Split horizon: Enabled
  Authentication: None
  Neighbor count: 1

Based on this output, what can be concluded?

Accepted Answer

GigabitEthernet0/1 will have a higher EIGRP metric than GigabitEthernet0/0 for the same prefix.. EIGRP uses the composite metric formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * (K5 / (reliability + K4)). With default K values (K1=K3=1, others=0), the metric simplifies to bandwidth + delay. Gi0/0 has bandwidth 1,000,000 Kbit and delay 100 microseconds, while Gi0/1 has bandwidth 100,000 Kbit and delay 1000 microseconds. The lower bandwidth and higher delay on Gi0/1 result in a higher metric for the same prefix.

Answer

Both interfaces have the same metric weight for bandwidth and delay.

Answer

Interface Gi0/1 is configured as a passive interface.

Answer

EIGRP authentication is enabled on both interfaces.

Question 10

Consider this configuration:

interface Port-channel1
 switchport mode trunk
 switchport trunk native vlan 999
!
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active
!
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active

What is the effect of the 'switchport trunk native vlan 999' command on the EtherChannel?

Accepted Answer

The EtherChannel will use VLAN 999 as the native VLAN, and any untagged frames will be associated with VLAN 999.. The 'switchport trunk native vlan 999' command on each physical interface and on the port-channel interface ensures that the EtherChannel uses VLAN 999 as the native VLAN. Untagged frames received on any member link are associated with VLAN 999, and frames tagged with VLAN 999 are sent untagged. Since the configuration is consistent across all interfaces, the EtherChannel forms correctly and operates with VLAN 999 as the native VLAN.

Answer

The EtherChannel will drop all untagged frames because the native VLAN is not in the allowed list.

Answer

The EtherChannel will not form because the native VLAN must be the same across all interfaces, which it is.

Answer

The EtherChannel will form but the native VLAN will be ignored on the port-channel.

Question 11

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

Accepted Answer

Type 1 hypervisor; it runs directly on the hardware, offering near-native performance for VNFs.. VMware vSphere is a Type 1 (bare-metal) hypervisor because it installs directly onto the physical server hardware without requiring a host operating system. This architecture eliminates OS overhead, allowing the Cisco CSR1000v VNF to achieve near-native performance for packet processing and routing functions, which is critical for meeting throughput and latency requirements in SD-WAN deployments.

Answer

Type 2 hypervisor; it runs on top of an operating system, providing flexibility for VNF management.

Answer

Type 1 hypervisor; it requires a host OS for management, adding overhead.

Answer

Type 2 hypervisor; it is embedded in the hardware firmware.

Question 12

An enterprise is implementing Cisco TrustSec (CTS) to enforce role-based access control. The network engineer configures the switch with 'cts role-based enforcement' and 'cts manual' on an interface connecting to a trusted Cisco switch. The engineer also configures Security Group Tags (SGTs) on the RADIUS server. However, traffic between two hosts in different SGTs is not being filtered as expected. The engineer checks 'show cts role-based counters' and sees no drops. What is the most likely reason for the lack of enforcement?

Accepted Answer

The SGTs are not being propagated to the switch; the switch lacks SGT mappings for the hosts.. Cisco TrustSec enforcement relies on the switch having the correct SGT-to-IP mapping for each host. Even if SGTs are assigned on the RADIUS server and CTS role-based enforcement is enabled, the switch must learn the SGT for each source IP address. Without these mappings, the switch cannot classify traffic into SGTs and therefore cannot apply role-based ACLs, resulting in no drops in the counters.

Answer

The switch is not configured for 802.1X on the interface.

Answer

The 'cts manual' command is incorrect; 'cts dot1x' should be used instead.

Answer

The 'show cts role-based counters' command shows no drops, indicating the ACLs are not configured.

Question 13

A network engineer is configuring IPv6 First Hop Security on a Cisco switch to mitigate rogue RA attacks. The engineer enables RA guard on the switch and applies a policy that allows only the default gateway to send RAs. After configuration, hosts are unable to obtain IPv6 addresses via SLAAC. The engineer checks the switch and sees that RA guard is dropping all RAs. What is the most likely cause?

Accepted Answer

The RA guard policy does not include the IPv6 address or MAC address of the legitimate default gateway.. RA Guard drops Router Advertisements (RAs) based on a policy that defines which devices are authorized to send them. If the policy does not include the IPv6 address or MAC address of the legitimate default gateway, the switch will treat all RAs as unauthorized and drop them, preventing hosts from performing SLAAC. This is the most likely cause because the engineer enabled RA guard with a policy but failed to specify the trusted gateway's identity.

Answer

The switch has DHCPv6 snooping enabled, which conflicts with RA guard.

Answer

SLAAC requires the host to send a router solicitation first, which is being blocked by RA guard.

Answer

RA guard is configured in 'block' mode, which drops all RAs regardless of the policy.

Question 14

A network engineer executes the following command on Router R2:

R2# show ip sla configuration 1

IP SLAs Infrastructure Engine-II
Entry number: 1
Owner: admin
Tag:
Type of operation to perform: icmp-echo
Target address: 192.168.2.10
Source address: 192.168.2.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, what is the frequency of the IP SLA operation?

Accepted Answer

60 seconds. The command output shows 'Frequency (seconds): 60', which directly indicates that the IP SLA operation repeats every 60 seconds. This is the correct answer because the frequency parameter defines the time interval between successive probe executions.

Answer

30 seconds

Answer

120 seconds

Answer

5000 milliseconds

Question 15

A network engineer runs the following command on a Cisco WLC:

WLC# show wlan summary

WLAN ID   SSID               Status   Security   Interface
1         Guest              Enabled  Open       guest-vlan
2         Corporate          Enabled  WPA2       corp-vlan
3         IoT                Disabled WPA2       iot-vlan
4         Management         Enabled  WPA2       mgmt-vlan

Based on this output, what can be concluded?

Accepted Answer

WLAN 3 is not operational because it is disabled.. The 'show wlan summary' output clearly shows that WLAN 3 (IoT) has a Status of 'Disabled', meaning it is not operational and cannot serve clients. Only enabled WLANs can transmit beacons and accept client associations. Therefore, option B is correct because a disabled WLAN is effectively non-functional.

Answer

All WLANs are currently active and serving clients.

Answer

The Guest WLAN uses WPA2 security.

Answer

The Management WLAN is on the guest-vlan interface.

Question 16

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses gRPC (Google Remote Procedure Call) as the transport protocol for model-driven telemetry from IOS-XE devices like the Catalyst 9000 series. gRPC leverages HTTP/2 and Protocol Buffers to efficiently stream structured YANG-modeled data, providing the real-time visibility required by DNA Center. This is the standard method for streaming telemetry in modern Cisco SD-Access and intent-based networking architectures.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.

Question 17

Review the following IP SLA configuration on Router R1:

ip sla 3
 icmp-echo 10.3.3.3
 frequency 30
ip sla schedule 3 life forever start-time now
ip sla reaction-configuration 3 react rtt threshold-type xof 5 threshold-value 100 action-type triggerAndReset

What is the purpose of the 'threshold-type xof 5' parameter?

Accepted Answer

It triggers an event if 5 consecutive RTT measurements exceed 100 ms.. The 'threshold-type xof 5' parameter in IP SLA triggers an action when 5 consecutive RTT measurements exceed the specified threshold of 100 ms. This is a 'consecutive violations' threshold, meaning the event fires only after a sustained pattern of failures, not based on a sliding window or time duration. The 'xof' keyword specifically indicates the number of consecutive probe results that must exceed the threshold before the reaction is triggered.

Answer

It triggers an event if 5 out of the last 10 RTT measurements exceed 100 ms.

Answer

It triggers an event if the RTT exceeds 100 ms for 5 seconds.

Answer

It triggers an event if the RTT exceeds 100 ms and then repeats 5 times.

Question 18

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

Accepted Answer

The RADIUS server is not sending the dACL attributes in the Access-Accept message.. The most likely cause is that the RADIUS server is not sending the dACL attributes in the Access-Accept message. For a downloadable ACL to be applied, the RADIUS server must include specific attributes (e.g., Cisco-AVPair with 'ip:inacl#<seq>=permit/deny...' or using IETF attributes like Filter-ID referencing a dACL name) in the Access-Accept. Without these attributes, the switch cannot apply the dACL, and the guest retains default access, which may include internal resources if no other ACL is in place.

Answer

The switchport is configured as 'switchport mode trunk', which does not support dACLs.

Answer

The guest is not being authenticated; the switch is using MAB instead.

Answer

The switch is not configured with 'ip access-group' to apply the dACL.

Question 19

An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?

Accepted Answer

Cisco ISE. Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Cisco DNA Center

Question 20

Drag and drop each IP SLA schedule parameter on the left to its function on the right.

Accepted Answer

start-time: Defines when the operation begins. Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.