350-401 Practice Test 2 — 30 Questions

Question 1

Consider the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 2 source interface GigabitEthernet1/0/3 rx
monitor session 2 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.. The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.

Answer

Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.

Answer

The configuration is invalid because the destination interface must be in trunk mode.

Question 2

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 3

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. If the client and the router's DHCP server interface are on different VLANs (i.e., different subnets), the DHCP discover broadcast will not cross the Layer 3 boundary unless the router interface has an ip helper-address configured. The ip helper-address command enables the router to convert the broadcast DHCP discover into a unicast and forward it to the DHCP server. Without it, the client's broadcast never reaches the server, even if the DHCP pool is correctly defined.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 4

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Accepted Answer

The interface needs the 'authentication guest-vlan ' command to specify the VLAN for non-802.1X devices.. The 'authentication guest-vlan ' command is missing. This command explicitly defines the VLAN to which the port will assign devices that fail 802.1X authentication or are non-802.1X-capable. Without it, the switch has no configured fallback VLAN, so the port remains in the unauthorized state even with 'authentication port-control auto' and 'authentication host-mode multi-host' configured.

Answer

The switch must have 'aaa authentication dot1x default group radius' configured globally.

Answer

The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.

Answer

The port must be configured as a trunk port to allow the guest VLAN.

Question 5

interface GigabitEthernet0/2
 spanning-tree link-type point-to-point
 end

What is the effect of this configuration?

Accepted Answer

The port will use RSTP fast transition mechanisms assuming a point-to-point link.. The `spanning-tree link-type point-to-point` command manually overrides the port's link type to point-to-point, forcing the port to use Rapid Spanning Tree Protocol (RSTP) fast transition mechanisms (proposal/agreement handshake) instead of the slower 802.1D listening/learning states. This is correct because RSTP relies on the link type to determine whether it can safely perform a fast transition to the forwarding state; a point-to-point link allows immediate transition without waiting for timers.

Answer

The port will become a designated port immediately.

Answer

The port will disable STP on that link.

Answer

The port will use shared medium behavior.

Question 6

Given the following SNMPv3 configuration on a Cisco IOS-XE router:

snmp-server group ADMIN v3 priv write ADMINVIEW
snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456
snmp-server view ADMINVIEW iso included

What is missing or incorrect in this configuration?

Accepted Answer

The view 'ADMINVIEW' includes the entire ISO tree, which might be too permissive for a restricted write view.. The view 'ADMINVIEW' is configured with 'iso included', which includes the entire ISO OID tree. This grants write access to all MIB objects, which is overly permissive for a restricted write view. In SNMPv3, a write view should be limited to specific OIDs or subtrees to enforce least privilege, and including the entire ISO tree violates that principle. Option D is incorrect because a read view is not required if the group is only intended for write operations. The configuration as shown only specifies a write view, which is sufficient for SNMP set operations. Adding a read view is optional and not a mandatory missing piece.

Answer

The SNMPv3 user 'admin' must also specify an engine ID for the router.

Answer

The privacy password 'cisco456' must be at least 8 characters long.

Answer

The group 'ADMIN' must be configured with a read view to allow SNMP get operations.

Question 7

A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is correct because it combines strict priority queuing with CBWFQ, ensuring that voice traffic (marked with EF or CS5) is dequeued before any other traffic class. This strict priority mechanism guarantees the lowest possible latency for real-time traffic, as packets in the priority queue are always transmitted first, regardless of congestion on the WAN link.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO)

Question 8

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. In a PPPoE setup, the dialer interface typically obtains its IP address dynamically from the ISP via IPCP (IP Control Protocol) during PPP negotiation. If IPCP fails or is not configured to negotiate an address, the dialer interface remains unnumbered or without a usable IP address. Even though the PPPoE session is established and a default route exists, the router cannot route traffic because it lacks a valid source IP address on the dialer interface to send packets to the ISP's gateway.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.

Question 9

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not advertising EVPN routes for a specific VNI. The NVE interface is up, and the VNI is configured. Which action should the engineer take to verify that the VNI is properly associated with the EVPN control plane?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' to see if the VNI is advertised in the EVPN address family.. To verify that a VNI is properly associated with the EVPN control plane, the engineer should check the BGP EVPN table using 'show bgp l2vpn evpn'. This command displays EVPN routes, including those for the VNI. If the VNI is not advertised, it indicates a configuration issue in the EVPN address family or BGP. Other commands like 'show nve vni' or 'show interface nve1' do not directly show EVPN route advertisement.

Answer

Check the output of 'show vlan id 10' to see if VLAN 10 is active and mapped to the VNI.

Answer

Check the output of 'show interface nve1' to verify that the NVE interface is operational.

Answer

Check the output of 'show nve vni' to see if the VNI is up and associated with the NVE interface.

Question 10

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

Accepted Answer

The interface bandwidth command is not set to 50000 kbps. The bandwidth percent command allocates a percentage of the interface bandwidth, which by default is derived from the physical interface speed. On a Cisco ASR 1000, if the interface bandwidth is not manually set to 50000 kbps, the router may use a different default value (e.g., 1000000 kbps for Ethernet), causing the bandwidth percent to allocate a much larger absolute amount than intended. This leads to incorrect bandwidth guarantees, such as voice not receiving its required 10 Mbps during congestion.

Answer

The voice class should use priority instead of bandwidth

Answer

The video class should use bandwidth remaining percent

Answer

The policy map is applied in the input direction

Question 11

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

60 seconds. The default quiet-period timer in Cisco IOS 802.1X configuration is 60 seconds. This timer defines the period the switch waits after a failed authentication attempt before re-initiating authentication with the same supplicant. It prevents repeated authentication attempts from overwhelming the switch and the RADIUS server.

Answer

30 seconds

Answer

120 seconds

Answer

10 seconds

Question 12

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Based on this output, what can be concluded?

Accepted Answer

DTP is enabled on this interface.. The output shows 'Negotiation of Trunking: On', which indicates that Dynamic Trunking Protocol (DTP) is enabled on the interface. DTP is a Cisco proprietary protocol used to negotiate trunking between switches. Since the interface is in trunk mode and DTP is on, option B is correct.

Answer

The interface is configured as an access port.

Answer

The native VLAN is tagged with 802.1Q.

Answer

All VLANs except 2-1001 are pruned.

Question 13

A network engineer is deploying QoS on a Cisco Catalyst 4500 switch to support four queues per port. The engineer wants to assign voice traffic to queue 1 (priority), video to queue 2, critical data to queue 3, and best-effort to queue 4. The switch is configured with the default CoS-to-queue mapping. However, video traffic is being placed in queue 1 along with voice. What should the engineer do to separate them?

Accepted Answer

Modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command. The default CoS-to-queue mapping on Cisco Catalyst 4500 switches maps CoS 5 (voice) to queue 1 (priority queue) and CoS 4 (video) also to queue 1. To separate video into queue 2, the engineer must modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command, which reassigns CoS values to specific output queues. This directly overrides the default behavior and places video traffic in the correct queue.

Answer

Change the video traffic marking to DSCP AF41 and rely on DSCP-to-queue mapping

Answer

Apply a service policy that uses a priority queue for voice only

Answer

Increase the number of queues to eight

Question 14

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module in Ansible expects the direction parameter to be specified as 'in' or 'out', not 'outbound'. When 'direction: outbound' is used, the module either ignores the value or defaults to 'in', causing the ACL to be applied inbound instead of outbound. This is a common parameter naming mismatch between the Ansible module and the engineer's expectation.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 15

An engineer is troubleshooting multicast performance issues. The network uses PIM sparse mode with a static RP. The engineer notices that the multicast traffic from a source to a group is taking a suboptimal path, causing high latency. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry has an incoming interface that is not the shortest path to the source. What is the most likely reason for this suboptimal path?

Accepted Answer

The last-hop router has not yet switched to the SPT.. In PIM sparse mode, the last-hop router initially receives multicast traffic via the shared tree (RP) and then switches to the shortest path tree (SPT) toward the source once the traffic rate exceeds a threshold (default 0 kbps in Cisco IOS). If the (S,G) entry shows an incoming interface that is not the shortest path to the source, it indicates the router has not yet performed the SPT switchover, so it is still using the RP-based path, which may be suboptimal.

Answer

The RP is not configured as the DR on its segment.

Answer

The multicast source is using a different group address.

Answer

The last-hop router has a higher metric to the source than to the RP.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip sla summary

IPSLAs Latest Operation Summary
Codes: * active, ^ inactive, ~ pending

ID       Type         Destination       Stats       Return Code      Last
1        icmp-echo    192.168.1.10      Success     OK               1
2        icmp-echo    192.168.1.20      Success     OK               2
3        udp-jitter   192.168.1.30      Success     OK               3
*4       icmp-echo    192.168.1.40      Success     OK               10

Based on this output, what can be concluded?

Accepted Answer

IP SLA operation 4 is currently active.. The asterisk (*) in the first column of the 'show ip sla summary' output indicates that IP SLA operation 4 is currently active. The other operations (IDs 1, 2, and 3) have no asterisk, meaning they are inactive. The 'Return Code' column shows 'OK' for all operations, confirming they completed successfully, but only operation 4 is actively running.

Answer

All IP SLA operations are active.

Answer

IP SLA operation 3 has failed.

Answer

IP SLA operation 1 has the highest round-trip time.

Question 17

A network engineer runs the following command on Router R6:

R6# show mpls ldp neighbor 10.6.6.7 detail
    Peer LDP Ident: 10.6.6.7:0; Local LDP Ident 10.6.6.6:0
        TCP connection: 10.6.6.7.646 - 10.6.6.6.179
        State: Oper; Msgs sent/rcvd: 200/195; Downstream
        Up time: 1d04h
        LDP discovery sources:
          Targeted Hello 10.6.6.6 -> 10.6.6.7, active, passive
        Addresses bound to peer LDP Ident:
          10.6.6.7         192.168.6.7
        Hold time: 15 seconds; keepalive interval: 5 seconds
        Peer hold time: 15 seconds; keepalive interval: 5 seconds

Based on this output, what type of LDP session is this?

Accepted Answer

This is a targeted LDP session established between two non-directly connected routers.. The output shows a targeted hello (10.6.6.6 -> 10.6.6.7) as the LDP discovery source, and the TCP connection uses port 646 (LDP) on one side and port 179 (BGP) on the other. This indicates the session is established between two routers that are not directly connected (non-adjacent), which is the definition of a targeted LDP session. The presence of 'active, passive' in the discovery source confirms that one router initiated the targeted hello and the other responded.

Answer

This is a link-local LDP session because the discovery source is an interface.

Answer

This is a multicast LDP session because the hold time is 15 seconds.

Answer

This is a BGP session because the TCP connection shows port 179.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:12:34   12   100  0  45
1   10.1.1.2                Gi0/1            12 00:10:20   15   120  0  32

Based on this output, what can be concluded?

Accepted Answer

Both neighbors are fully established and exchanging routing information.. The 'show ip eigrp neighbors' output displays two neighbors in a stable state, indicated by the 'Q Cnt' (Queue Count) of 0 for both, meaning no packets are waiting to be sent. The 'Seq Num' (Sequence Number) values (45 and 32) show that R1 has received and processed EIGRP updates from each neighbor, confirming the adjacency is fully established and routing information is being exchanged. This output does not provide any metric or authentication details, so only the conclusion that both neighbors are fully operational is valid.

Answer

Both neighbors are using MD5 authentication.

Answer

Neighbor 192.168.1.2 has a higher metric than 10.1.1.2.

Answer

Router R1 is using EIGRP named mode.

Question 19

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.

Question 20

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Interfaces Gi0/1, Gi0/2, and Gi0/3 are in VLAN 1.. The 'show vlan brief' output explicitly lists Gi0/1, Gi0/2, and Gi0/3 under VLAN 1 (default), confirming these interfaces are access ports assigned to VLAN 1. VLAN 1 is the default VLAN on Cisco switches, and all ports not explicitly configured otherwise belong to it.

Answer

All ports shown are in trunk mode.

Answer

VLANs 1002-1005 are active and supported.

Answer

VLAN 20 has no ports assigned.