350-401 Practice Test 28 — 15 Questions

Question 1

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 2

Given the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

What is the effect of this configuration?

Accepted Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all untagged frames will be placed into VLAN 999.. The configuration sets the interface as a trunk port, explicitly allows only VLANs 10, 20, and 30 to traverse it, and designates VLAN 999 as the native VLAN. On a trunk, the native VLAN is used for untagged frames (e.g., DTP, CDP, or any traffic sent without an 802.1Q header), so all untagged frames received or sent on this interface will be associated with VLAN 999.

Answer

The interface will forward traffic for all VLANs except 10, 20, and 30, and the native VLAN is 1.

Answer

The interface will operate as an access port in VLAN 999.

Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all frames will be tagged including the native VLAN.

Question 3

Drag and drop the steps of implementing QoS trust boundaries on a Cisco switch into the correct order, from first to last.

Accepted Answer

Identify the trust boundary location. First, identify the trust boundary (e.g., access port). Then configure the trusted interface to trust CoS or DSCP. Next, set the default CoS for untrusted frames. Finally, verify the configuration and adjust as needed.

Question 4

Drag and drop each Cisco DNA Center workflow on the left to its matching component on the right.

Accepted Answer

Design: Creates network profiles, site hierarchy, and IP address pools. Design creates network profiles and site hierarchy, Policy defines SGTs and access contracts, Provision deploys configurations to devices, Assurance monitors network health, and Automation runs workflows like PnP and SWIM.

Question 5

An engineer is configuring a Cisco 9800 WLC for high availability using a pair of WLCs in an active/standby configuration. The engineer configures the same SSID and security settings on both WLCs. However, when the active WLC fails, clients that were connected to the active WLC do not automatically reconnect to the standby WLC. What is the most likely cause?

Accepted Answer

The APs are not configured with the standby WLC's IP address as a backup controller.. In an active/standby high availability configuration with Cisco 9800 WLCs, the APs must be configured with the IP address of both the active and standby WLCs. When the active WLC fails, APs automatically fail over to the standby WLC only if the standby WLC's IP address is listed as a backup controller in the AP's configuration. Without this, the APs have no knowledge of the standby WLC and will not attempt to reconnect, leaving clients disconnected.

Answer

Clients must be configured to roam between WLCs, which is not supported in active/standby mode.

Answer

The SSID name must be different on the standby WLC to avoid conflicts.

Answer

The APs must be rebooted after the active WLC fails to recognize the standby WLC.

Question 6

Drag and drop the steps of JSON vs XML encoding selection for RESTCONF into the correct order, from first to last.

Accepted Answer

Client decides to use JSON or XML encoding. The selection process starts with the client choosing an encoding, setting the Accept header, the server reading it, encoding the response accordingly, and the client parsing the response.

Question 7

Which of the following are requirements of an RSPAN VLAN? (Select all that apply.)

Accepted Answer

Must not be the native VLAN on any trunk. The RSPAN VLAN must not be the native VLAN; it must be allowed on all trunk ports between source and destination; no other traffic should use it; it must exist on all intermediate switches; it must be configured as an RSPAN VLAN.

Question 8

Consider the following Python script using the requests library to interact with a Cisco IOS-XE device via RESTCONF:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/interface/GigabitEthernet=1/0/1'
headers = {
    'Accept': 'application/yang-data+json',
    'Content-Type': 'application/yang-data+json'
}
auth = HTTPBasicAuth('admin', 'cisco')

response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the script attempting to do?

Accepted Answer

It retrieves the configuration of GigabitEthernet1/0/1 in JSON format.. The script uses an HTTP GET request to the RESTCONF API endpoint for GigabitEthernet1/0/1. The GET method is specifically used to retrieve data, and the 'Accept: application/yang-data+json' header tells the server to return the configuration in JSON format. This matches option B exactly.

Answer

It updates the IP address of GigabitEthernet1/0/1.

Answer

It deletes the interface configuration.

Answer

It creates a new interface.

Question 9

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

Accepted Answer

MPLS: Provides guaranteed SLA, low jitter, and private connectivity. MPLS offers predictable performance; broadband Internet provides low-cost but variable quality; LTE offers mobility; 5G adds low latency and high bandwidth.

Question 10

Drag and drop each SD-WAN controller on the left to its matching function on the right.

Accepted Answer

vManage: Centralized management, monitoring, and configuration of the SD-WAN fabric. vManage provides centralized management and monitoring; vSmart is the control plane controller that distributes routing and policy; vBond handles authentication and orchestration of the overlay network.

Question 11

Drag and drop the steps of using a REST API to retrieve interface statistics from a Cisco device into the correct order, from first to last.

Accepted Answer

Authenticate with the REST API. The process starts with authenticating to the device's REST API, then constructing the GET request for the interface statistics endpoint. The device processes the request, retrieves the data, and sends a JSON response. The client then parses the JSON to extract the statistics.

Question 12

A network engineer configures IP SLA 60 to monitor the jitter of a VoIP call path between two sites. The operation uses UDP jitter with a target of 192.168.3.3 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 10 ms', but the jitter values are all zero. The remote router has an IP SLA responder configured. What is the most likely cause?

Accepted Answer

The IP SLA operation is configured with a 'num-packets' value of 1, so only one packet is sent per probe, and jitter cannot be calculated.. UDP jitter requires multiple packets per probe to measure inter-packet delay variation. If 'num-packets' is set to 1, only a single packet is sent, so there are no successive packet pairs from which jitter can be calculated. The 'Latest RTT: 10 ms' indicates the single packet was echoed, but with only one packet, jitter values remain zero.

Answer

The remote router's IP SLA responder is not configured to calculate jitter, only to echo packets.

Answer

The IP SLA operation is using a 'frequency' that is too high, causing the probes to be sent too quickly and jitter to be zero.

Answer

The network path has no variable delay, so jitter is naturally zero.

Question 13

Examine the following configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 service-policy output QOS_POLICY

policy-map QOS_POLICY
 class VOICE
  priority percent 10
 class VIDEO
  bandwidth percent 30
 class class-default
  fair-queue

What is the effect of this configuration?

Accepted Answer

VOICE traffic is guaranteed 10% of the interface bandwidth with strict priority queuing, VIDEO traffic is guaranteed 30%, and all other traffic shares the remaining bandwidth using fair-queuing.. The 'priority percent 10' command under class VOICE enables strict priority queuing, guaranteeing that VOICE traffic is served first up to 10% of the interface bandwidth. The 'bandwidth percent 30' under class VIDEO provides a minimum bandwidth guarantee of 30% during congestion. The 'fair-queue' under class-default ensures that all other traffic shares the remaining bandwidth fairly using flow-based queuing, which is the default behavior when no explicit bandwidth is configured.

Answer

VOICE traffic is limited to 10% of bandwidth, VIDEO to 30%, and all other traffic is dropped if the interface is congested.

Answer

VOICE traffic is given priority over VIDEO, but VIDEO can use up to 30% of bandwidth only if VOICE is not using its allocation.

Answer

The policy-map is invalid because 'priority' and 'bandwidth' cannot be used together in the same policy-map.

Question 14

Which three statements about SD-WAN overlay tunnels and transport are true? (Choose three.)

Accepted Answer

Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.. SD-WAN uses DTLS or TLS for secure control plane tunnels, and IPsec for data plane tunnels. Each edge device builds multiple IPsec tunnels to other edge devices based on TLOC mapping. The transport can be any combination of MPLS, Internet, or LTE. TLOC uniquely identifies a WAN attachment point. OMP manages route distribution, not tunnel establishment.

Answer

SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.

Answer

OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.

Question 15

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

Accepted Answer

Client sends Access-Request to RADIUS server. RADIUS uses UDP and encrypts only the password in the Access-Request. The server checks credentials and responds with Access-Accept or Access-Reject. Accounting-Start is sent after authentication succeeds.