350-401 Practice Test 5 — 25 Questions

Question 1

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

Accepted Answer

User authenticates to network device via TACACS+. TACACS+ separates authentication, authorization, and accounting. For command authorization, the user authenticates first, then the device sends the command to the TACACS+ server, which checks its authorization policy and responds with permit or deny. The device then executes or blocks the command accordingly.

Question 2

Consider the following partial syslog configuration on a Cisco IOS-XE switch:

logging host 10.10.10.1 transport udp port 514
logging trap 6
logging source-interface Loopback0
logging on

Which statement is true about this configuration?

Accepted Answer

Syslog messages will be sourced from the IP address of Loopback0 interface.. The `logging source-interface Loopback0` command forces all syslog messages to use the IP address of Loopback0 as the source IP in the packet, regardless of the egress interface. This ensures the syslog server sees a consistent source address, which is critical for filtering and logging reliability. The configuration is correct, so option B is true.

Answer

Syslog messages with severity level 7 (Debugging) will be sent to 10.10.10.1.

Answer

The syslog server must be configured to receive messages on TCP port 514.

Answer

Only syslog messages with severity level 6 (Informational) will be sent.

Question 3

A network engineer checks AAA accounting on a router:

R1# show aaa accounting

Accounting method list 'default':
  Type: exec
  Start-stop: group radius
  Accounting records:
    Total started: 10
    Total stopped: 8
    Total failed: 2
    Last record: user 'admin', start time 00:01:00 UTC Mar 1 2023

Based on this output, what can be concluded?

Accepted Answer

Accounting is configured for EXEC sessions using RADIUS.. The output shows an accounting method list named 'default' for type 'exec' using 'group radius' with start-stop accounting. This confirms that accounting is configured for EXEC sessions (user logins) and that RADIUS is the protocol used to send accounting records. The 'Total started: 10' and 'Total stopped: 8' indicate some records were not successfully stopped, but the configuration itself is correctly identified.

Answer

All accounting records were successfully sent.

Answer

Accounting is performed using TACACS+.

Answer

No users have logged in since accounting was enabled.

Question 4

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.

Question 5

Consider the following configuration snippet:

router bgp 65000
 bgp router-id 192.168.1.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 timers 10 30
!

What is the effect of the 'timers 10 30' command under the BGP neighbor?

Accepted Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for neighbor 10.0.0.2 only.. The 'timers 10 30' command under the BGP neighbor configuration mode sets the keepalive interval to 10 seconds and the hold time to 30 seconds specifically for that neighbor (10.0.0.2). This per-neighbor timer configuration overrides any global BGP timers set under the router bgp process, allowing granular control over individual BGP sessions.

Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for all BGP neighbors.

Answer

It sets the BGP keepalive interval to 30 seconds and the hold time to 10 seconds for neighbor 10.0.0.2.

Answer

It configures the BGP session to use a keepalive of 10 seconds and a hold time of 30 seconds, but only if the neighbor supports it.

Question 6

Consider this AAA configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
tacacs-server host 10.0.0.1 key SecretKey
line con 0
 login authentication default
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

All login attempts use local authentication; exec accounting is sent to TACACS+.. The configuration sets AAA authentication login to use the local user database (via 'aaa authentication login default local'), so all login attempts (console and VTY) authenticate against the local device. Authorization for exec sessions is also set to local ('aaa authorization exec default local'), meaning no external authorization is used. Accounting for exec sessions is configured with 'start-stop' and points to the TACACS+ server at 10.0.0.1, so all exec session start and stop records are sent to TACACS+. This matches option A.

Answer

All login attempts use TACACS+ authentication; exec accounting is local.

Answer

Console login uses TACACS+; VTY login uses local; accounting is sent to TACACS+.

Answer

Authentication and authorization are both performed by TACACS+; accounting is local.

Question 7

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 ebgp-multihop 2
 neighbor 10.0.0.2 update-source Loopback0
!
What is the purpose of the ebgp-multihop 2 command?

Accepted Answer

It allows the eBGP session to be established with a neighbor that is not directly connected, with a maximum of 2 hops.. The ebgp-multihop 2 command allows an eBGP session to be established between peers that are not directly connected at Layer 3. By setting the TTL to 2, it permits the BGP packets to traverse one intermediate router (hop) to reach the neighbor, which is necessary when using loopback interfaces for eBGP peering.

Answer

It sets the maximum number of prefixes that can be received from the neighbor to 2.

Answer

It limits the number of paths BGP can install for load balancing to 2.

Answer

It enables BGP multipath for eBGP with a hop count of 2.

Question 8

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Accepted Answer

Fabric edge node. The fabric edge node is the correct component because it is the access-layer switch in Cisco SD-Access that performs SGT-based enforcement. It receives SGT-to-SGT policy from Cisco ISE via the control plane node and applies the corresponding security ACLs (SGACLs) at the port level, ensuring segmentation between student, faculty, and guest traffic at the point of entry.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Wireless LAN controller

Question 9

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Advertise graceful restart capability. First, both peers advertise the graceful restart capability in the OPEN message. Then they exchange the restart time and stale-path timer via capabilities. Next, the helper router marks routes as stale upon session failure. After that, the restarting router re-establishes the session. Finally, the helper removes stale routes if not refreshed.

Question 10

Drag and drop the steps of disaster recovery failover process into the correct order, from first to last.

Accepted Answer

Detect failure via keepalives or BFD. Failover begins with detecting the primary failure, then activating the backup path. Traffic is redirected to the secondary site, and after the primary is restored, operations are switched back in a controlled manner.

Question 11

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The router experiences high CPU utilization due to SSH and SNMP traffic. The engineer creates a class-map to match SSH (TCP/22) and SNMP (UDP/161) and applies a policy-map that polices this traffic to 1 Mbps. After applying the policy, legitimate SSH sessions from the management station start dropping intermittently. What is the most likely cause?

Accepted Answer

The police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station.. The most likely cause is that the police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station. CoPP polices all traffic matching the class-map (SSH and SNMP) as a single aggregate flow. If the management station generates bursts of SSH and SNMP traffic that together exceed 1 Mbps, the policer will drop packets, causing legitimate SSH sessions to drop intermittently.

Answer

The CoPP policy is applied to the wrong interface, affecting transit traffic instead of control plane traffic.

Answer

The class-map should match on DSCP values instead of port numbers to be effective.

Answer

The policy-map should use the 'drop' action instead of 'police' to protect the control plane.

Question 12

Drag and drop the steps of STP root bridge election and port state transitions into the correct order, from first to last.

Accepted Answer

Elect root bridge using lowest bridge ID. STP first elects a root bridge based on lowest bridge ID. Then each non-root bridge selects one root port (lowest path cost to root). Next, each segment elects a designated port (lowest root path cost, then lowest bridge ID). All other ports become alternate (blocking). Finally, ports transition through blocking, listening, learning, and forwarding states.

Question 13

A network engineer is configuring OSPF on a router that has multiple interfaces in the same area. The engineer wants to ensure that the router does not become the designated router (DR) on any of these interfaces. What should the engineer do?

Accepted Answer

Set the OSPF priority to 0 on all interfaces.. Setting the OSPF priority to 0 on all interfaces prevents the router from participating in the DR/BDR election process. A router with priority 0 will never become the DR or BDR on any segment, regardless of its Router ID or other factors. This is the only method that guarantees the router will not be elected as DR on any interface.

Answer

Configure the OSPF network type as point-to-point on all interfaces.

Answer

Use the 'ip ospf dr-priority' command to set a high priority on other routers.

Answer

Configure the router as an ABR.

Question 14

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Accepted Answer

IKE_SA_INIT: Phase 1 key agreement. IKE_SA_INIT is phase 1 for key agreement; IKE_AUTH is phase 2 for authentication and policy; CREATE_CHILD_SA is used for rekeying or additional SAs.

Question 15

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Accepted Answer

Phase 1: Hub-and-spoke with NHRP registration. DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

Answer

Phase 4: NHRP with BGP for routing

Answer

Phase 5: NHRP with OSPF for routing

Question 16

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Accepted Answer

health = response['response'][0]['overallHealth']. The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Answer

health = response['overallHealth']

Answer

health = response['response']['overallHealth']

Answer

health = response[0]['overallHealth']

Question 17

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Accepted Answer

34. The Cisco Catalyst 9300 switch supports a maximum of 34 SPAN sessions. This includes local SPAN, RSPAN, and ERSPAN sessions combined, with the switch allocating internal resources to support up to 34 simultaneous monitoring sessions.

Answer

16

Answer

64

Answer

8

Question 18

A company is implementing a WAN optimization solution using Cisco WAAS. The engineer configures WAAS devices at the data center and remote branch. The WAAS devices are configured to use inline mode. However, the engineer notices that optimized traffic is not being intercepted. The WAAS devices are directly connected to the WAN router and the LAN switch. What is the most likely cause?

Accepted Answer

The WAN router is not configured with WCCP or PBR to redirect traffic to the WAAS device.. In inline mode, a WAAS device is physically placed in the data path between the LAN switch and the WAN router. However, for the WAAS device to intercept and optimize traffic, the WAN router must be configured to redirect traffic to the WAAS device using either Web Cache Communication Protocol (WCCP) or Policy-Based Routing (PBR). Without this redirection, the WAAS device will simply forward traffic transparently without performing any optimization, which explains why optimized traffic is not being intercepted.

Answer

The WAAS device is not configured with the correct WAN and LAN interfaces.

Answer

The WAAS device is not licensed for optimization.

Answer

The WAAS device is using a different subnet than the LAN and WAN.

Question 19

A network engineer runs the following command on switch SW6:

SW6# show cts role-based counters

Role-based counters:

Source Group   Dest Group   Packets Sent   Bytes Sent   Packets Denied   Bytes Denied
10             20           1500           120000       0                0
10             30           0              0            500              40000

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 10 to SGT 20 is being permitted, and traffic from SGT 10 to SGT 30 is being denied.. The output shows that for the source group (SGT) 10 to destination group (SGT) 20, packets sent and bytes sent are non-zero (1500 and 120000 respectively), while packets denied and bytes denied are zero. This indicates traffic is being permitted. For SGT 10 to SGT 30, packets sent and bytes sent are zero, but packets denied and bytes denied are non-zero (500 and 40000), indicating traffic is being denied. Therefore, option C is correct.

Answer

Traffic from SGT 10 to SGT 20 is being denied.

Answer

Traffic from SGT 10 to SGT 30 is being permitted.

Answer

No traffic has been sent between any SGTs.

Question 20

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

Accepted Answer

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.. For VXLAN EVPN on a Nexus 9000, the BGP address-family l2vpn evpn must explicitly contain the 'evpn' keyword and the 'vni 10100 l2' command to advertise Layer 2 VNI routes. Without this configuration, BGP does not know to inject the VNI's MAC/VTEP information into the EVPN route table, so no EVPN routes are advertised for VNI 10100.

Answer

Remove the mcast-group from the NVE member, because EVPN uses BGP for control plane.

Answer

Change the source-interface to a physical interface.

Answer

Add an IP address to the VLAN 100 interface in the default VRF.