350-401 Practice Test 33 — 15 Questions

Question 1

Drag and drop the steps of DMVPN Phase 1 spoke-to-hub tunnel setup into the correct order, from first to last.

Accepted Answer

Configure mGRE tunnel interface on spoke. In DMVPN Phase 1, the spoke first establishes an mGRE tunnel to the hub using NHRP registration, then the hub learns the spoke's NBMA address, and finally the spoke can route traffic through the hub. The correct order is: configure mGRE tunnel interface on spoke, configure NHRP with hub as NHS, spoke registers its NBMA address via NHRP, hub adds spoke to its NHRP database, and spoke sends traffic through hub.

Question 2

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Accepted Answer

Load YANG model into DevKit environment. Validation begins with loading the YANG model, then using the tool to check path syntax, verifying existence, and confirming with device capabilities.

Question 3

Drag and drop each AAA function on the left to its correct description on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device. Authentication verifies identity, authorization determines allowed actions, and accounting tracks usage for auditing or billing.

Question 4

Which three statements about RADIUS and TACACS+ are true? (Choose three.)

Accepted Answer

RADIUS combines authentication and authorization in a single packet.. RADIUS and TACACS+ are both AAA protocols but differ in transport, encryption, and authorization granularity. RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire packet. TACACS+ supports per-command authorization, while RADIUS does not. Both can be used for device administration, but RADIUS is more common for network access.

Answer

RADIUS encrypts the entire packet payload for all attributes.

Answer

RADIUS supports per-command authorization for shell sessions.

Question 5

Which two statements about YANG data models and their role in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG is a data modeling language used to define the structure of configuration and operational state data.. YANG models define the structure and constraints of data that can be streamed via telemetry. Native models are vendor-specific, while OpenConfig models are vendor-neutral. IETF models are standards-based but not necessarily vendor-neutral. YANG is a data modeling language, not a transport protocol. Telemetry subscriptions reference YANG paths to specify which data to stream.

Answer

OpenConfig YANG models are vendor-specific and only supported on Cisco devices.

Answer

IETF YANG models are the only models that can be used for model-driven telemetry subscriptions.

Answer

YANG is a transport protocol used to stream telemetry data from network devices to collectors.

Question 6

Which three statements about configuring AAA on Cisco IOS devices are true? (Choose three.)

Accepted Answer

The aaa new-model command enables AAA services on the device.. The correct answers cover common AAA configuration steps. Option A is correct because the aaa new-model command enables AAA on a Cisco IOS device. Option C is correct because the radius-server host command specifies the RADIUS server IP and shared secret. Option E is correct because the aaa authentication login command defines a method list for login authentication. Option B is wrong because the aaa new-model command does not disable local authentication; it enables AAA. Option D is wrong because the tacacs-server host command is used for TACACS+, not RADIUS.

Answer

The aaa new-model command disables local authentication and forces the use of an external server.

Answer

The tacacs-server host command is used to specify the IP address and shared secret for a RADIUS server.

Question 7

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE router to stream BGP route updates to a collector using gRPC dial-out. The engineer wants to ensure that the telemetry data is encrypted in transit. Which additional configuration is required to secure the gRPC telemetry stream?

Accepted Answer

Enable TLS on the gRPC connection by configuring a trustpoint and using the 'transport grpc tls' command. To configure TLS on the gRPC connection. gRPC supports TLS for encryption, and on IOS-XE, this requires configuring a trustpoint and enabling TLS under the telemetry receiver. The other options are incorrect because IPsec is not directly integrated with gRPC telemetry; SSH is used for NETCONF, not gRPC; and DTLS is used for UDP-based telemetry, not gRPC.

Answer

Configure IPsec between the router and the collector

Answer

Use SSH tunneling for the gRPC connection

Answer

Configure DTLS on the telemetry receiver

Question 8

Which three statements about the classification and marking tools in Cisco IOS are true? (Choose three.)

Accepted Answer

The trust boundary can be configured using the 'mls qos trust' command on a switch port to trust the CoS or DSCP value received from an attached device.. Classification identifies traffic based on various fields, while marking sets the QoS value. Trust boundaries determine where marking is honored. NBAR can perform deep packet inspection for classification. CoS is a Layer 2 marking in 802.1Q frames, while DSCP is Layer 3. MPLS uses EXP bits.

Answer

The 'set dscp' command in a policy map can be used to mark packets with a DSCP value, but only on egress interfaces.

Answer

MPLS EXP bits are a 3-bit field used for QoS in MPLS networks and are always directly mapped from the IP DSCP value without any configuration.

Question 9

Which three statements about path isolation using VRF are true? (Choose three.)

Accepted Answer

VRFs allow overlapping IP addresses between different virtual networks on the same router.. Path isolation with VRF ensures that traffic from different tenants or departments does not interfere. The correct answers highlight that VRFs provide separate forwarding tables, that overlapping IP addresses are possible, and that VRF-lite can be used without MPLS. The incorrect options claim that VRFs guarantee end-to-end encryption (they do not) or that VRF-lite requires a full mesh of trunks (it does not).

Answer

VRF-based path isolation ensures encryption of all data between VRFs.

Answer

VRF-lite requires a full mesh of trunk links between all routers in the network.

Question 10

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

Accepted Answer

User enters command on device. TACACS+ command authorization starts with the user entering a command, which is sent to the TACACS+ server. The server checks the command against the user's authorization profile and responds with permit or deny. The device executes or blocks the command accordingly, and finally logs the result.

Question 11

An engineer retrieves telemetry data from a Cisco IOS-XE device using RESTCONF and receives the following response:

```json
{
  "ietf-interfaces:interfaces": {
    "interface": [
      {
        "name": "GigabitEthernet1",
        "type": "iana-if-type:ethernetCsmacd",
        "enabled": true,
        "ipv4": {
          "address": [
            {
              "ip": "192.168.1.1",
              "netmask": "255.255.255.0"
            }
          ]
        }
      }
    ]
  }
}
```

What is the correct way to access the IP address of the interface using Python?

Accepted Answer

data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. The JSON response is nested. To access the IP address, you need to navigate through the dictionary: data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. This returns '192.168.1.1'.

Answer

data['interface'][0]['ipv4']['address']['ip']

Answer

data['interfaces']['interface']['ipv4']['address']['ip']

Answer

data['ietf-interfaces:interfaces']['interface']['ipv4']['address'][0]['ip']

Question 12

Drag and drop each AAA method list type on the left to its correct fallback order (from first to last) on the right.

Accepted Answer

Default login authentication: local, line. The default method list for login authentication tries local first, then fallback to line password. The default for enable authentication uses enable password, then none. The default for PPP authentication uses local, then none. The default for command authorization uses local, then if-authenticated. The default for exec authorization uses local, then none.

Question 13

Drag and drop the steps of ISE RADIUS policy evaluation order into the correct order, from first to last.

Accepted Answer

ISE receives RADIUS Access-Request. Cisco ISE evaluates RADIUS policies in a specific order: first it checks authentication policies, then authorization policies (including exception policies), and finally applies the matched authorization profile. If no match, the default deny policy applies.

Question 14

Drag and drop each telemetry protocol on the left to its matching transport on the right.

Accepted Answer

gRPC: HTTP/2. gRPC uses HTTP/2, gNMI uses gRPC, NETCONF uses SSH, RESTCONF uses HTTPS, and HTTP is not a standard telemetry transport.

Question 15

An engineer creates an Ansible playbook to configure model-driven telemetry on a Cisco IOS-XE device:

```yaml
---
- name: Configure MDT subscription
  hosts: ios_xe
  gather_facts: no
  tasks:
    - name: Configure telemetry receiver
      cisco.ios.ios_config:
        lines:
          - telemetry ietf subscription 101
          - receiver ip address 10.10.10.10 port 57500 protocol grpc-tcp
          - encoding encode-kvgpb
          - filter xpath /interfaces/interface/state/counters
          - update-policy periodic 5000
```

What is the problem with this playbook?

Accepted Answer

The playbook is missing the 'source-address' command under the receiver.. The telemetry subscription configuration is missing the 'source-address' command under the receiver. Without specifying a source IP, the device may not send telemetry data if the management interface is not the correct source. Additionally, the 'update-policy' command should be 'update-policy periodic 5000' but the correct syntax is 'update-policy periodic 5000' under the subscription, not under the receiver. However, the most critical issue is that the 'telemetry ietf subscription' configuration requires a 'source-address' to specify the source IP for the telemetry stream.

Answer

The 'encoding encode-kvgpb' should be 'encoding encode-json'.

Answer

The 'update-policy periodic 5000' should be 'update-policy periodic 5000 milliseconds'.

Answer

The 'filter xpath' path is invalid for IOS-XE.