350-401 Practice Test 2 — 30 Questions

Question 1

Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.

Accepted Answer

Active mode ports transmit LACPDUs. LACP negotiation starts with active ports sending LACPDUs, passive ports listening, then exchanging system/port priorities, selecting aggregator, and finally forming the bundle.

Question 2

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Accepted Answer

Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status. VTP requires setting mode and domain before trunking works; verification confirms operation.

Answer

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Answer

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Answer

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Question 3

Drag and drop the steps of BGP policy application (route-map, prefix-list, AS-path ACL) into the correct order, from first to last.

Accepted Answer

Define prefix-list or AS-path ACL. Policy application starts with defining match criteria (prefix-list or AS-path ACL), then creating a route-map with permit/deny and set actions, applying it to a neighbor, and finally verifying the policy effect.

Question 4

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.

Question 5

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has two active member links.. The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Answer

The EtherChannel is using PAgP.

Answer

Port Gi0/3 is bundled in the channel.

Answer

The port-channel is a Layer 3 interface.

Question 6

What is the default native VLAN on a Cisco switch trunk port?

Accepted Answer

VLAN 1. The default native VLAN on a Cisco switch trunk port is VLAN 1. The native VLAN is the VLAN that carries untagged traffic over a trunk link, and by default, all switch ports (including trunk ports) belong to VLAN 1. This is defined in the IEEE 802.1Q standard, which specifies that frames on the native VLAN are not tagged with a VLAN ID.

Answer

VLAN 0

Answer

VLAN 1002

Answer

VLAN 4095

Question 7

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 8

Drag and drop the steps of Multicast RP discovery using Auto-RP into the correct order, from first to last.

Accepted Answer

Candidate-RPs send RP-Announce to 224.0.1.39. Auto-RP uses a mapping agent to discover RPs. Candidate RPs announce their services to a well-known group (224.0.1.39). The mapping agent collects these announcements and sends RP-to-group mappings to another group (224.0.1.40). Routers then learn the RP for each group.

Question 9

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. It uses the 'monitor session 1 source interface Gi1/0/1 both' command to capture all traffic (both ingress and egress) from the trunk port, and then applies the 'monitor session 1 filter vlan 20' command to restrict the SPAN session to only VLAN 20 traffic. This is the proper method to filter traffic from a trunk port to a specific VLAN on a Cisco Catalyst 3850 switch, as the filter command is applied after the source is defined.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 10

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Accepted Answer

Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.. Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Answer

Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.

Answer

Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.

Answer

Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.

Question 11

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Accepted Answer

Classifier identifies traffic and maps to service chain. SFC path setup begins with classifying traffic to determine which service chain to apply. Next, the classifier encapsulates packets with an NSH header. Then the SFC path is computed by the controller using the service function path identifier. After path computation, the controller installs forwarding entries in each service function forwarder. Finally, traffic traverses the chain as SFFs forward packets between VNFs.

Question 12

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Restarting router sends OPEN with graceful restart capability. Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

Question 13

Drag and drop the steps of VLAN pruning on trunks using VTP into the correct order, from first to last.

Accepted Answer

Enable VTP pruning globally on the VTP server. To configure VTP pruning on trunks, first set the VTP domain name and version (C). Then enable VTP pruning globally on the VTP server (A). Next, configure the trunk interface with switchport mode trunk (B). Then allow VTP pruning on the trunk with the switchport trunk pruning vlan command (D). Finally, verify pruning with show vtp status and show interfaces trunk (E).

Question 14

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Accepted Answer

Create VLAN and SVI interface. First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Question 15

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Accepted Answer

Client sends SAE Commit to AP. WPA3 uses Simultaneous Authentication of Equals (SAE) handshake. The client first sends an SAE commit to the AP, the AP responds with its own SAE commit, then both compute a shared key. Next, the client sends an SAE confirm message, and finally the AP sends its SAE confirm to complete authentication.

Question 16

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Accepted Answer

Match against class-map with highest priority. CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

Question 17

Drag and drop the steps of NETCONF edit-config with candidate datastore flow into the correct order, from first to last.

Accepted Answer

Lock the candidate datastore. The candidate datastore flow begins with locking the candidate, then editing it, validating the changes, committing them to running, and finally unlocking the candidate.

Question 18

Drag and drop the steps of Embedded Packet Capture (EPC) on IOS-XE steps into the correct order, from first to last.

Accepted Answer

Create capture buffer with size. EPC requires defining a capture buffer, defining a capture point, associating them, starting the capture, and then stopping/exporting.

Question 19

Drag and drop the steps of DHCP snooping and dynamic ARP inspection flow into the correct order, from first to last.

Accepted Answer

Switch enables DHCP snooping on trusted ports. DHCP snooping builds a binding table used by DAI. The switch validates DHCP messages, creates bindings, then intercepts ARP packets and compares them against the binding table to prevent spoofing.

Question 20

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Accepted Answer

The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.. When SR-IOV is enabled on a physical NIC, the Physical Function (PF) is shared between the host management network and the Virtual Functions (VFs). If the PF is used for the host management network, enabling SR-IOV can disrupt the PF's driver or configuration, causing the management network to become unreachable. This is a common misconfiguration where the same NIC is used for both management and SR-IOV VFs.

Answer

The VM's VF is using the same MAC address as the host management interface.

Answer

The ESXi host requires a dedicated physical NIC for management when using SR-IOV.

Answer

The VM's VF is consuming all available bandwidth on the NIC.