350-401 Practice Test 28 — 15 Questions

Question 1

A network engineer runs the following command on Router R9:

R9# show queueing interface GigabitEthernet0/1
 Interface GigabitEthernet0/1 queueing strategy:  class-based weighted fair
  Queueing on output: Class-based Weighted Fair Queueing
  Queueing on input: FIFO

R9# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      100 packets, 10000 bytes
      5 minute offered rate 10000 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        strict priority
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 100/10000
      police cir 1000000 bc 15625 be 15625
        conformed 100 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: DATA (match-any)
      200 packets, 20000 bytes
      5 minute offered rate 20000 bps, drop rate 0 bps
      Match: ip dscp af31 (26)
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 200/20000
      bandwidth remaining percent 50

Class-map: class-default (match-any)
      300 packets, 30000 bytes
      5 minute offered rate 30000 bps, drop rate 0 bps
      Match: any
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 300/30000
      bandwidth remaining percent 50

Based on this output, what can be concluded?

Accepted Answer

Data traffic is guaranteed 50% of the remaining bandwidth after priority queuing.. The 'bandwidth remaining percent 50' command under the DATA class-map allocates 50% of the interface bandwidth that remains after the strict-priority VOICE queue has been serviced. This is the standard behavior for class-based weighted fair queuing (CBWFQ) when a priority queue is present: the priority queue is served first, and then the remaining bandwidth is distributed among the non-priority classes according to their configured percentages.

Answer

The interface uses WFQ for output queuing.

Answer

Voice traffic is being dropped because it exceeds the police rate.

Answer

The policy-map is applied to input traffic.

Question 2

A network automation team is using Ansible to push configuration changes to a fleet of Cisco IOS XE devices. The playbook uses the 'ios_config' module with the 'backup: yes' option. During a recent run, the playbook failed on one device due to a syntax error in the configuration lines. The team wants to ensure that if a failure occurs, the device automatically reverts to its previous configuration without manual intervention. Which Ansible feature should be used to achieve this?

Accepted Answer

Implement a 'block' and 'rescue' section in the playbook to run a rollback task if the configuration fails.. To automatically revert to the previous configuration upon failure, the playbook must include error handling. Ansible's block/rescue construct allows tasks to be grouped, and if any task in the block fails, the rescue section runs. Within rescue, a task can invoke 'configure replace' using a saved configuration file, restoring the device to its prior state. This approach ensures atomic rollback without manual intervention.

Answer

Use the 'ios_config' module with the 'rollback' parameter set to 'yes'.

Answer

Set the 'ansible_command_timeout' to a higher value to prevent premature failure.

Answer

Enable 'config' mode with the 'save_when' parameter set to 'modified'.

Question 3

A network automation engineer is using NETCONF to configure a Cisco IOS XE device. The engineer wants to ensure that the configuration changes are applied atomically and that the device can roll back to a previous configuration if an error occurs. Which two NETCONF capabilities should the engineer verify are supported by the device? (Choose two.)

Accepted Answer

:rollback-on-error. To achieve atomic configuration changes and rollback on error with NETCONF, the device must support the :candidate and :rollback-on-error capabilities. The :candidate capability provides a staging area for changes, allowing them to be applied as a single transaction. The :rollback-on-error capability ensures that if any part of the transaction fails, the entire change set is discarded, reverting to the previous configuration. Together, they enable reliable and safe configuration management.

Answer

:writable-running

Answer

:validate

Answer

:startup

Question 4

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer sends a GET request to the URL https://dnac.example.com/api/v1/network-device but receives a 401 Unauthorized error. The engineer has already obtained a valid authentication token. What is the most likely cause of the error?

Accepted Answer

The token was not included in the request header as an X-Auth-Token.. The Cisco DNA Center Intent API uses token-based authentication. After obtaining a token via the authentication API, the token must be included in every subsequent request as an HTTP header named 'X-Auth-Token'. Omitting this header causes a 401 Unauthorized response. The engineer should add the header with the valid token to successfully retrieve the device list. Other methods like query parameters or different HTTP methods are not used for authentication.

Answer

The request must use HTTP instead of HTTPS.

Answer

The API endpoint /api/v1/network-device requires a POST request.

Answer

The token must be passed as a query parameter named 'token'.

Question 5

A network engineer is writing a Python script using the requests library to interact with a Cisco IOS XE device's RESTCONF API. The script needs to authenticate using basic authentication and retrieve interface details. The engineer writes the following code snippet:

import requests
url = 'https://192.168.1.1/restconf/data/ietf-interfaces:interfaces'
headers = {'Accept': 'application/yang-data+json'}
response = requests.get(url, headers=headers, auth=('admin', 'password'), verify=False)

However, the script returns a 401 Unauthorized error. What is the most likely cause?

Accepted Answer

The credentials are incorrect or the user does not have sufficient privileges.. A 401 Unauthorized response from RESTCONF means the authentication credentials are missing or invalid. The script uses basic authentication with a username and password; if those are incorrect or the user lacks permissions, the server rejects the request. The engineer should confirm the credentials and user privilege level.

Answer

The verify=False parameter disables SSL verification, which causes the server to reject the request.

Answer

The Accept header is set incorrectly; it should be application/yang-data+xml.

Answer

The URL is missing the .json extension, which is required for RESTCONF.

Question 6

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Accepted Answer

health = response['response'][0]['overallHealth']. The JSON response has a top-level key 'response' whose value is a list containing one dictionary. To extract 'overallHealth', you must index into the list first: response['response'][0]['overallHealth']. This correctly navigates the nested structure. The other options either skip the list indexing or assume a different structure.

Answer

health = response['overallHealth']

Answer

health = response['response']['overallHealth']

Answer

health = response[0]['overallHealth']

Question 7

A network automation engineer is using the ncclient Python library to retrieve configuration from a Cisco IOS XE device via NETCONF. The engineer sends a <get-config> RPC with a filter for the interface configuration. The device returns a large XML response, but the engineer only needs the interface description and IP address. Which NETCONF capability should the engineer use to filter the response to only the required data?

Accepted Answer

urn:ietf:params:netconf:capability:subtree:1.0. NETCONF supports filtering of configuration data through capabilities. The subtree filtering capability allows a client to specify a filter that matches only the desired portions of the configuration tree. By using a subtree filter, the engineer can retrieve only the interface description and IP address, minimizing the response size and improving efficiency. Other capabilities like writable-running or rollback-on-error do not provide filtering.

Answer

urn:ietf:params:netconf:capability:xpath:1.0

Answer

urn:ietf:params:netconf:capability:writable-running:1.0

Answer

urn:ietf:params:netconf:capability:rollback-on-error:1.0

Question 8

A network engineer is writing a Python script to retrieve the configured hostname from a Cisco IOS XE device using RESTCONF. The device has RESTCONF enabled, and the engineer sends a GET request to https://10.1.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname with the header 'Accept: application/yang-data+json'. However, the request fails with HTTP 401 Unauthorized. The engineer verifies that the device is reachable and RESTCONF is enabled. What is the most likely reason for the failure?

Accepted Answer

The engineer did not include valid authentication credentials in the request, such as a username and password or a token.. The 401 Unauthorized status code is a clear indication that authentication failed. RESTCONF on Cisco IOS XE requires the client to provide credentials, usually via HTTP Basic Authentication. Without a valid Authorization header, the device denies access. The other options describe issues that would produce different error codes or are irrelevant to authentication.

Answer

The RESTCONF URI is incorrect; it should be /restconf/data/ietf-interfaces:interfaces to retrieve hostname information.

Answer

The RESTCONF API requires the use of HTTPS with a valid certificate, and the device's certificate is self-signed.

Answer

The request is missing the 'Content-Type' header, which is required for all RESTCONF requests.

Question 9

A network engineer runs the following command on Switch SW4:

SW4# show spanning-tree vlan 40

VLAN0040
  Spanning tree enabled protocol ieee
  Root ID    Priority    24616
             Address     aabb.cc00.0600
             Cost        8
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32768  (priority 32768 sys-id-ext 40)
             Address     aabb.cc00.0700
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 8         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p

Based on this output, which port is the root port?

Accepted Answer

GigabitEthernet0/1. The root port is the port on a non-root bridge that provides the lowest-cost path to the root bridge. In the output, SW4 is not the root bridge because its Bridge ID (priority 32768 + VLAN 40) is higher than the Root ID priority 24616, and the Root Cost is 8 via Gi0/1. The 'Role' column shows Gi0/1 as 'Root' and its 'Sts' is 'FWD', confirming it is the root port.

Answer

GigabitEthernet0/2

Answer

GigabitEthernet0/3

Answer

There is no root port because SW4 is the root bridge.

Question 10

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP polling. A class-map named CLASS-MGMT matches SNMP and SSH traffic, and a policy-map named COPP-POLICY applies a police rate of 8000 bps with a conform-action transmit and exceed-action drop for that class. After the policy is attached to the control plane, SNMP polling intermittently fails while BGP remains stable. Which action should the engineer take to resolve the SNMP failures while still protecting the route processor?

Accepted Answer

Increase the police rate in the CLASS-MGMT class to a value that accommodates the normal SNMP and SSH burst rate.. SNMP polling is bursty and can briefly exceed a very low police rate. When the exceed-action drops packets, polling becomes intermittent. The correct fix is to raise the police rate for the management class to a value that reflects real SNMP and SSH traffic while keeping CoPP in place to protect the route processor from abuse. Disabling enforcement or moving the policy to the data plane is not appropriate.

Answer

Move the policy-map from the control plane to the data plane interface facing the SNMP server.

Answer

Add a new class-map that matches BGP and apply a lower police rate to it, then reattach the policy.

Answer

Change the exceed-action from drop to transmit so that SNMP packets are never discarded.

Question 11

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is that the tunnel must support multicast traffic for OSPF neighbor adjacency across the VPN. Which IPsec configuration element is required to meet this requirement?

Accepted Answer

Configure GRE over IPsec.. IPsec security associations are inherently unicast and cannot carry multicast or broadcast traffic. To support OSPF, which relies on multicast hellos, the design must encapsulate multicast inside a GRE tunnel and then protect that GRE tunnel with IPsec. This is commonly called GRE over IPsec or IPsec profile applied to a GRE tunnel interface.

Answer

Use a dynamic VTI with IKEv1.

Answer

Use transport mode instead of tunnel mode.

Answer

Enable IKEv2 with MOBIKE.

Question 12

Which three statements about using Python for interacting with Cisco IOS-XE devices via NETCONF and RESTCONF are true? (Choose three.)

Accepted Answer

The ncclient Python library can be used to establish a NETCONF session with a Cisco IOS-XE device and retrieve YANG-modeled data.. Option A is correct because ncclient is a Python library specifically designed to implement the NETCONF protocol, allowing a script to open an SSH-based NETCONF session (typically on port 830) with a Cisco IOS-XE device, send or RPCs, and retrieve YANG-modeled configuration and state data. Option B is correct because RESTCONF is a RESTful protocol that maps YANG data to HTTP resources and uses standard HTTP methods — GET to read, POST to create, PUT/PATCH to modify, and DELETE to remove — against URIs such as /restconf/data/ietf-interfaces:interfaces. Option C is correct because YANG is the data modeling language that defines the hierarchical structure, data types, and constraints of the data exposed by both NETCONF and RESTCONF, so any Python interaction with these protocols ultimately manipulates YANG-modeled content. Option D is incorrect because RESTCONF supports XML and JSON encodings (selected via the Content-Type/Accept headers), not YAML. Option E is incorrect because NETCONF uses XML encoding, not binary, and performance depends on factors such as payload size, transport, and implementation rather than a guaranteed speed advantage over RESTCONF.

Answer

RESTCONF only supports data encoding in YAML format.

Answer

NETCONF is always faster than RESTCONF for retrieving large amounts of data because it uses a binary encoding.

Question 13

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce access policy based on a device's role rather than its IP address, so that the enforced policy remains consistent even when endpoints move between VLANs or subnets. Which Cisco TrustSec component is responsible for assigning and carrying this role-based identity through the network?

Accepted Answer

Security Group Tag (SGT) applied at ingress and propagated via inline tagging or SXP.. Role-based enforcement in TrustSec depends on Security Group Tags that travel with the traffic. The ingress device classifies the packet and inserts the SGT; downstream devices enforce the Security Group ACL based on that tag. Because the tag, not the IP address, drives policy, endpoints keep the same access rights after moving between VLANs and subnets, satisfying the stated requirement.

Answer

IPsec tunnel established between the access switch and the Cisco DNA Center appliance.

Answer

MACsec encryption applied on the uplink between access and distribution switches.

Answer

Cisco Identity Services Engine (ISE) profiling the endpoint after DHCP and HTTP probes.

Question 14

A network engineer is configuring control plane policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers and is managed over SSH from a jump host. After applying a new policy-map, the engineer notices that BGP sessions remain up but SSH logins intermittently time out during traffic spikes. Which action should the engineer take to resolve the SSH timeouts while preserving the CoPP protection model?

Accepted Answer

Add a class-map matching TCP port 22 traffic and attach it to the policy-map with an appropriate rate and conform/exceed actions.. CoPP works by classifying punted control-plane traffic into classes and applying per-class policers. If SSH is not explicitly matched, it is handled by class-default, which is often policed conservatively. Creating a dedicated class matching TCP port 22 with an adequate rate and a conform action of transmit ensures interactive management traffic survives bursts while BGP and other protocols stay protected.

Answer

Remove the service-policy from the control plane and rely on QoS on the data plane instead.

Answer

Increase the BGP class rate and move the SSH class into the BGP class-map.

Answer

Configure an ACL that permits only the jump host's IP and apply it as the match for the class-default class.

Question 15

A security team wants to protect a campus network from MAC flooding attacks that could overflow the CAM table on access switches. The requirement is to limit the number of source MAC addresses learned per switch port and to automatically err-disable a port when the limit is exceeded, while still allowing a VoIP phone and a PC on the same port. Which configuration approach meets these requirements?

Accepted Answer

Configure port security with the maximum parameter, sticky learning, and violation shutdown on each access port.. Port security limits the source MAC addresses that can be learned on a switch port. Setting a maximum value caps how many MACs are accepted, sticky learning stores dynamically learned addresses in the configuration, and the shutdown violation mode err-disables the port upon violation. Together these features neutralize MAC flooding while permitting a phone and PC by allowing at least two MACs.

Answer

Configure storm control for unicast traffic at a low threshold on each access port.

Answer

Configure port security with the maximum parameter, sticky learning, and violation restrict on each access port.

Answer

Enable BPDU Guard and Root Guard on all access ports to block MAC flooding attempts.