350-401 Practice Test 5 — 25 Questions

Question 1

spanning-tree mode rapid-pvst

What is the effect of this global configuration command?

Accepted Answer

The switch will use Rapid PVST+ for all VLANs, providing faster convergence than classic STP.. The command 'spanning-tree mode rapid-pvst' enables Rapid PVST+ (Per-VLAN Spanning Tree Plus) on the switch, which runs a separate instance of RSTP (802.1w) for each VLAN. This provides faster convergence than classic STP (802.1D) by using mechanisms such as sync/agreement handshakes, edge ports, and link types, while still maintaining per-VLAN topology independence.

Answer

The switch will use MSTP for all VLANs.

Answer

The switch will use classic STP for all VLANs.

Answer

The switch will disable STP on all ports.

Question 2

A network administrator issues the following command on a Cisco switch:

Switch# show aaa servers

RADIUS: id 1, priority 1, host 192.168.1.10, auth-port 1812, acct-port 1813
  State: current UP, duration 3600s, previous duration 0s
  Dead: total 0, retransmit 0
RADIUS: id 2, priority 2, host 192.168.1.20, auth-port 1812, acct-port 1813
  State: current UP, duration 100s, previous duration 300s
  Dead: total 3, retransmit 2

Based on this output, what can be concluded?

Accepted Answer

Server 192.168.1.20 has a history of failures.. The output shows that server 192.168.1.20 has a 'Dead: total 3' and 'retransmit 2', indicating it has been marked dead three times and two retransmissions occurred, confirming a history of failures. In contrast, server 192.168.1.10 shows 'Dead: total 0, retransmit 0', meaning it has no failure history. The 'current UP' state for both servers only reflects their present status, not their reliability history.

Answer

Both RADIUS servers are currently unreachable.

Answer

Server 192.168.1.10 is the backup server.

Answer

TACACS+ is also configured on these servers.

Question 3

Consider the following configuration snippet:

router bgp 65000
 bgp router-id 192.168.1.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 timers 10 30
!

What is the effect of the 'timers 10 30' command under the BGP neighbor?

Accepted Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for neighbor 10.0.0.2 only.. The 'timers 10 30' command under the BGP neighbor configuration mode sets the keepalive interval to 10 seconds and the hold time to 30 seconds specifically for that neighbor (10.0.0.2). This per-neighbor timer configuration overrides any global BGP timers set under the router bgp process, allowing granular control over individual BGP sessions.

Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for all BGP neighbors.

Answer

It sets the BGP keepalive interval to 30 seconds and the hold time to 10 seconds for neighbor 10.0.0.2.

Answer

It configures the BGP session to use a keepalive of 10 seconds and a hold time of 30 seconds, but only if the neighbor supports it.

Question 4

A company is deploying a virtualized network function (VNF) on a KVM-based host. The VNF requires dedicated CPU cores and must avoid performance interference from other VMs. Which hypervisor configuration best meets these requirements?

Accepted Answer

Configure CPU pinning and use dedicated NUMA nodes.. CPU pinning binds the VNF's vCPUs to specific physical cores, ensuring dedicated CPU resources and preventing interference from other VMs. Using dedicated NUMA nodes further optimizes memory locality, reducing latency and avoiding cross-NUMA memory access, which is critical for performance-sensitive VNFs.

Answer

Enable CPU overcommitment and use a single NUMA node.

Answer

Use VMware vSphere with DRS set to Aggressive.

Answer

Deploy the VNF as a container instead of a VM.

Question 5

Drag and drop the steps of the CAPWAP discovery and join process between a lightweight AP and a WLC into the correct order, from first to last.

Accepted Answer

AP obtains IP address via DHCP. The CAPWAP process starts with the AP obtaining an IP address (via DHCP), then discovering the WLC (via DHCP option 43 or DNS). The AP sends a Discovery Request, the WLC replies with a Discovery Response, and finally the AP sends a Join Request to establish the control tunnel.

Question 6

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Accepted Answer

The engineer forgot to add the ip nat inside source static command for the web server.. The scenario describes a need for both dynamic PAT (for internal hosts to reach the internet) and static NAT (to make the internal web server reachable from the internet). The 'ip nat inside source list' command alone performs dynamic NAT/PAT, translating multiple inside addresses to the single public IP. To allow inbound connections to the web server, a static one-to-one mapping is required using the 'ip nat inside source static tcp' command, which creates a permanent translation entry. Without this static command, the router has no way to know which inside host should receive incoming traffic destined for the public IP on port 80.

Answer

The access list used for NAT does not permit the web server's IP address.

Answer

The ip nat inside and ip nat outside commands are applied on the wrong interfaces.

Answer

The global configuration mode is missing the ip nat pool command.

Question 7

A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?

Accepted Answer

The group 'GRP' is not associated with a view that allows read access to the MIB tree.. The 'snmp-server group GRP v3 priv' command creates an SNMPv3 group with privacy (encryption) but does not associate it with any view. By default, SNMPv3 groups have no read, write, or notify access unless a view is explicitly configured. Without a view that permits read access to the MIB tree, the NMS cannot perform SNMP walks, even though the router responds to other queries (e.g., from different groups or versions).

Answer

The user's authentication key is too short.

Answer

The NMS is using SNMPv2c community strings instead of SNMPv3.

Answer

The router's SNMP engine ID has changed since the user was created.

Question 8

A company has a large network of 500 Cisco IOS XE routers and switches spread across multiple sites. The network team wants to automate the collection of interface statistics every hour and store them in a central database for historical analysis. The team has a Linux server with Python 3 and access to all devices via SSH with key-based authentication. They have written a Python script using Netmiko to connect to each device, run 'show interfaces', and parse the output to extract key metrics (e.g., input/output errors, packets per second). The script works correctly when tested on a small subset of devices, but when run against all 500 devices, it takes too long (over 2 hours) and sometimes fails due to SSH connection timeouts. The team needs to reduce the execution time and improve reliability. Which approach should they take?

Accepted Answer

Implement multiprocessing or multithreading in the Python script to connect to devices concurrently. The primary bottleneck is sequential SSH connections to 500 devices. By using Python's multiprocessing or multithreading (e.g., concurrent.futures.ThreadPoolExecutor), the script can open multiple SSH sessions in parallel, drastically reducing total wall-clock time. Netmiko itself is not the issue; the serial execution pattern causes the 2-hour runtime and timeouts, which concurrent connections resolve by overlapping I/O wait times.

Answer

Reduce the collection frequency to every 4 hours

Answer

Replace Netmiko with SNMP polling using the pysnmp library

Answer

Use Ansible playbooks instead of a custom Python script

Question 9

A company has a campus network with two distribution switches (DSW1 and DSW2) connected via a Layer 2 trunk. Each distribution switch connects to two access switches. Spanning Tree Protocol (STP) is running with default settings. Recently, a network administrator added a new access switch (ASW3) and connected it to both distribution switches. After the connection, network performance degraded significantly, and users in VLAN 10 reported intermittent connectivity. The administrator checked the logs and saw multiple TCN notifications. What is the most likely cause of the issue?

Accepted Answer

The new switch is causing a Layer 2 loop due to redundant links without proper STP configuration.. When ASW3 is connected to both DSW1 and DSW2 via Layer 2 trunk links, it creates a physical loop in the network. With default STP settings, the new switch will participate in the spanning tree algorithm, but the sudden addition of redundant links can cause a temporary loop or instability until STP converges. The multiple TCN (Topology Change Notification) messages indicate that the spanning tree topology is flapping, leading to MAC address table flushes and intermittent connectivity for VLAN 10 users. This is the classic symptom of a Layer 2 loop caused by redundant links without proper STP configuration or before convergence completes.

Answer

The new switch is not configured with the same VLANs as the distribution switches.

Answer

The new switch has a lower bridge priority than the current root bridge.

Answer

The new switch has become the root bridge and is sending inferior BPDUs.

Question 10

A network engineer is configuring dynamic ARP inspection (DAI) on a Cisco switch to prevent ARP spoofing. The switch has DHCP snooping enabled and the DHCP server is trusted. The engineer enables DAI on VLAN 10 and configures 'ip arp inspection trust' on the port connected to the DHCP server. After enabling DAI, some legitimate ARP replies from hosts are being dropped. The engineer checks the DAI statistics and sees 'ARP ACL drops' incrementing. What is the most likely reason?

Accepted Answer

The hosts have static IP addresses, so their MAC-IP bindings are not in the DHCP snooping database.. When DAI is enabled on a VLAN, it validates ARP packets against the DHCP snooping binding database. If a host has a static IP address, its MAC-IP binding is not automatically present in the DHCP snooping database. Without a valid binding, DAI treats the ARP reply as invalid and drops it, incrementing the 'ARP ACL drops' counter. The correct solution is to either configure static DHCP snooping bindings or use ARP ACLs to permit the static hosts.

Answer

The port connected to the DHCP server should be untrusted for DAI to work correctly.

Answer

The DHCP server is in a different VLAN, and DAI cannot validate cross-VLAN ARP.

Answer

DAI is checking the destination MAC address, which does not match the expected value.

Question 11

In BGP best path selection, which of the following is compared first?

Accepted Answer

Highest weight. BGP best path selection begins by comparing the weight attribute, which is Cisco-proprietary and local to the router. The path with the highest weight is preferred first, making option A correct. Weight is evaluated before any other BGP attribute, including local preference, AS-path length, and MED.

Answer

Highest local preference

Answer

Shortest AS-path

Answer

Lowest MED

Question 12

Examine the following BGP configuration:

router bgp 65001
 bgp log-neighbor-changes
 neighbor 10.1.1.1 remote-as 65002
 neighbor 10.1.1.1 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50

What is the purpose of this configuration?

Accepted Answer

It sets the MED value to 50 for all routes sent to the neighbor 10.1.1.1.. The configuration applies a route-map named SET_MED to outbound updates toward neighbor 10.1.1.1. The route-map permits all routes (no match statement) and sets the Multi-Exit Discriminator (MED) to 50. MED is a BGP path attribute that influences inbound traffic from the neighbor AS, making this path less preferred if the neighbor has a lower MED from another entry point. Thus, all routes sent to 10.1.1.1 will carry a MED of 50.

Answer

It sets the local preference to 50 for routes received from the neighbor.

Answer

It filters routes with a metric of 50 from being advertised to the neighbor.

Answer

It sets the weight to 50 for routes learned from the neighbor.

Question 13

Examine the following configuration snippet:

interface GigabitEthernet1/0/2
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

Which statement about this configuration is true?

Accepted Answer

802.1X will be attempted first; if the client does not respond, MAB will be used as a fallback.. The configuration sets the switchport as an 802.1X authenticator (dot1x pae authenticator) with MAB enabled. By default, 802.1X is attempted first; if the client does not respond to EAPOL requests (e.g., due to lack of 802.1X supplicant), the switch falls back to MAB, which uses the source MAC address for authentication. The dot1x timeout tx-period 10 sets the interval for retransmitting EAPOL-Start frames, reinforcing the initial 802.1X attempt before fallback.

Answer

MAB will be attempted first, and if it fails, 802.1X will be used.

Answer

The port will be placed in a guest VLAN if both 802.1X and MAB fail.

Answer

The switch will act as a supplicant for MAB and an authenticator for 802.1X.

Question 14

Which three statements about BGP route reflectors are true? (Choose three.)

Accepted Answer

Route reflectors allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh.. Option A is correct because a route reflector relaxes the iBGP full-mesh requirement by reflecting routes learned from one iBGP peer to other iBGP peers (its clients and non-clients), so speakers no longer need direct sessions with every other iBGP speaker. Option C is correct because route reflectors can be arranged in a hierarchy: a route reflector can itself be a client of a higher-level route reflector, allowing large ASes to scale beyond a single cluster. Option D is correct because the CLUSTER_ID attribute (a 4-byte value, often derived from the router ID) identifies the cluster and lets a route reflector detect and drop routes that have already been reflected, preventing loops within the cluster. Option B is not correct because route reflector clients do not need to be fully meshed with each other; they only peer with the route reflector, which is the whole point of the design. Option E is not correct because loop prevention in route reflection is handled by ORIGINATOR_ID and CLUSTER_ID (and CLUSTER_LIST), not by modifying AS_PATH, which is used for inter-AS loop prevention in eBGP.

Answer

A route reflector client must be fully meshed with all other clients in the same cluster.

Answer

The route reflector modifies the AS_PATH attribute to prevent loops.

Question 15

Drag and drop the steps of MSTP region and instance configuration steps into the correct order, from first to last.

Accepted Answer

Enter MST configuration mode. MSTP configuration begins with entering MST configuration mode, assigning a region name and revision number, mapping VLANs to instances, and then activating the configuration. Finally, the MST instance priority is set to influence root bridge selection.

Question 16

Examine the following EIGRP configuration snippet:

interface GigabitEthernet0/0
 ip bandwidth-percent eigrp 100 50

What is the effect of this command?

Accepted Answer

EIGRP will use up to 50% of the interface bandwidth for its control traffic.. The `ip bandwidth-percent eigrp 100 50` command configures EIGRP to use up to 50% of the interface's configured bandwidth for its control traffic (hello, update, query, and reply packets). This limits the amount of bandwidth EIGRP can consume to prevent it from starving other traffic. The percentage is applied to the interface's `bandwidth` setting, not the actual physical link speed.

Answer

EIGRP will only advertise routes that have a metric within 50% of the best path.

Answer

EIGRP will use 50% of the interface bandwidth for data traffic.

Answer

EIGRP will reduce its hello interval by 50%.

Question 17

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 18

A network engineer issues the following command on Router R6:

R6# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.100      10.0.0.10          ---                ---
--- 192.168.1.101      10.0.0.11          ---                ---
udp 192.168.1.100:1234 10.0.0.10:1234     203.0.113.5:53     203.0.113.5:53
tcp 192.168.1.101:80   10.0.0.11:80       198.51.100.2:443   198.51.100.2:443

Based on this output, what is true about the NAT translations?

Accepted Answer

The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.. The output shows two static-like entries (the first two lines with no protocol or port) and two dynamic entries with PAT (the UDP and TCP lines). The first translation for 10.0.0.10 to 192.168.1.100 has no protocol or port information, indicating it is a dynamic NAT entry without PAT (port address translation), because PAT would show specific ports. Option B correctly identifies this translation as dynamic NAT without PAT.

Answer

All translations are static NAT entries.

Answer

The router is performing only PAT (overload).

Answer

The outside global address is the same for all translations.

Question 19

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Accepted Answer

Design access layer with VLANs and port security. The correct order begins with implementing the core layer to establish high-speed backbone switching. Next, connect WAN edge routers for remote site access, followed by verifying end-to-end connectivity and redundancy to ensure the infrastructure works before adding edge services. Then, design the access layer with VLANs and port security, and finally configure the distribution layer for inter-VLAN routing. This sequence ensures the foundational transport is in place before adding user-facing and aggregation services.

Question 20

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor
PIM Neighbor Table
Neighbor Address  Interface           Uptime    Expires   Mode
10.1.1.2          GigabitEthernet0/0  2w0d      00:01:25  DR
10.1.1.3          GigabitEthernet0/0  2w0d      00:01:20  B

Based on this output, what can be concluded?

Accepted Answer

PIM Bidir mode is configured on this interface.. The output shows PIM neighbor modes of 'DR' and 'B'. In PIM Bidir mode, the Designated Router (DR) is elected to forward traffic upstream, and the 'B' flag indicates a Bidir-capable neighbor. This mode is explicitly identified by the 'B' flag in the PIM neighbor table, which is not present in sparse or dense mode. Therefore, the interface is operating in PIM Bidir mode.

Answer

PIM sparse mode is operating on this interface.

Answer

PIM dense mode is in use on this interface.

Answer

PIM SSM is enabled on this interface.