350-401 Practice Test 33 — 15 Questions

Question 1

A network engineer is configuring BGP on a Cisco router that connects to two ISPs. The router has a default route pointing to each ISP. The engineer wants to load balance outbound traffic across both ISPs. The router receives a default route from both ISPs. Which BGP configuration approach will allow the router to install both default routes in the routing table and load balance traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the maximum-paths command under the BGP address family and use the bgp bestpath as-path multipath-relax command.. The `maximum-paths` command under the BGP address family enables the router to install multiple paths for the same prefix (in this case, the default route 0.0.0.0/0) into the routing table. The `bgp bestpath as-path multipath-relax` command is necessary because the two default routes from different ISPs will have different AS_PATH lengths; this command relaxes the requirement for equal AS_PATH length, allowing the router to consider them as multipath candidates. Together, they allow both default routes to be installed and used for load balancing outbound traffic.

Answer

Configure the network command to advertise the default route from both ISPs.

Answer

Set the local preference to the same value on both default routes.

Answer

Use the redistribute command to redistribute the default routes into BGP.

Question 2

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 3

An enterprise network has two routers, R1 and R2, both running BGP. R1 is an eBGP speaker with ISP1, and R2 is an eBGP speaker with ISP2. Both routers are in the same AS 65000. The engineer wants to ensure that traffic from the enterprise to the Internet prefers the path through ISP1 when both links are up. R1 learns a default route from ISP1, and R2 learns a default route from ISP2. Which BGP attribute should the engineer modify on R1 to influence outbound traffic selection?

Accepted Answer

Set a higher local preference on R1 for the default route learned from ISP1.. Local preference is the BGP attribute used to influence outbound traffic from an AS. It is propagated within the AS and a higher value is preferred. By setting a higher local preference on R1 for the default route learned from ISP1, R1 will prefer that route over the default route from ISP2, ensuring traffic from the enterprise to the Internet exits via ISP1.

Answer

Set a lower MED on R1 for the default route learned from ISP1.

Answer

Prepend AS 65000 multiple times on R2's updates to ISP2.

Answer

Configure a community on R1 to mark the default route as no-export.

Question 4

An architect is designing an SD-Access fabric for a campus network that must support dynamic endpoint grouping based on user identity and device type. The design must minimize manual policy configuration and allow the fabric to enforce access policies at the edge. Which combination of components and protocols is required to meet these requirements?

Accepted Answer

Cisco ISE for policy management, LISP for control plane, VXLAN for data plane, and Cisco TrustSec for SGT-based enforcement. SD-Access uses Cisco ISE as the policy engine to define user/device-based policies, LISP as the control plane for endpoint-to-location mapping and mobility, VXLAN as the data plane for overlay encapsulation, and Cisco TrustSec for SGT-based enforcement at the edge. This combination enables dynamic endpoint grouping without manual ACLs, as SGTs are propagated via VXLAN Group Policy Option (GPO) and enforced by the fabric edge switches.

Answer

Cisco ISE for policy management, OSPF for control plane, GRE for data plane, and ACLs for enforcement

Answer

Cisco ISE for policy management, BGP for control plane, MPLS for data plane, and VLANs for enforcement

Answer

Cisco ISE for policy management, LISP for data plane, VXLAN for control plane, and 802.1X for enforcement

Question 5

A network engineer is troubleshooting a Layer 2 loop that occurred in a network using Rapid PVST+. The network has three switches: SW1 (root), SW2, and SW3. The engineer examines the topology and finds that SW2 and SW3 are connected via a link that is not supposed to be there. The engineer suspects that an unauthorized switch was connected to the network, causing the loop. The engineer wants to prevent such loops in the future by configuring a feature that will disable any port that receives a BPDU from an unauthorized switch. Which feature should the engineer configure on the access ports?

Accepted Answer

Enable BPDU Guard on all access ports.. BPDU Guard is the correct feature because it immediately error-disables a port when a BPDU is received, preventing loops from unauthorized switches. Since the engineer wants to protect access ports from receiving BPDUs (which should never occur on a properly configured access port), BPDU Guard directly addresses the scenario of an unauthorized switch being connected and sending BPDUs.

Answer

Enable Loop Guard on all access ports.

Answer

Enable Root Guard on all access ports.

Answer

Enable UDLD on all access ports.

Question 6

An enterprise network uses OSPF in the core and EIGRP in the campus distribution layer. The engineer needs to redistribute routes between the two protocols. Which design consideration is most important to prevent routing loops?

Accepted Answer

Set appropriate administrative distance values for redistributed routes.. Setting appropriate administrative distance values for redistributed routes is crucial to prevent routing loops when redistributing between OSPF and EIGRP. By default, EIGRP has an administrative distance of 170 for external routes and 90 for internal routes, while OSPF uses 110. If redistributed routes are not assigned a higher administrative distance, a router might prefer a redistributed route over a directly learned route, creating a feedback loop where routes are re-injected into the original protocol. Adjusting the administrative distance ensures that redistributed routes are less preferred than native routes, breaking the loop.

Answer

Use route maps to filter all redistributed routes.

Answer

Enable OSPF on all EIGRP interfaces.

Answer

Use a single routing protocol throughout the network.

Question 7

Given the following partial configuration on a Cisco IOS-XE router:

ip pim rp-address 10.0.0.1 10
access-list 10 permit 224.0.0.0 0.255.255.255
!
interface GigabitEthernet0/0
 ip pim sparse-mode
!

What is the effect of this configuration?

Accepted Answer

The router will use 10.0.0.1 as the RP for all multicast groups from 224.0.0.0 to 224.255.255.255, and the interface will operate in sparse-mode.. The configuration statically assigns 10.0.0.1 as the RP for multicast groups matching access-list 10, which permits the range 224.0.0.0 through 224.255.255.255 (a /8 prefix). The interface GigabitEthernet0/0 is set to PIM sparse-mode, which is required for sparse-mode operation. This combination allows the router to use the static RP for groups in that range, and the interface will participate in sparse-mode multicast forwarding.

Answer

The router will ignore the static RP because the ACL includes the reserved link-local range (224.0.0.0/24).

Answer

The interface must also be configured with 'ip pim dense-mode' for the RP to work.

Answer

The RP address 10.0.0.1 must be configured on a loopback interface on the same router.

Question 8

An architect is designing an SD-Access fabric for a large campus network. The design must support wireless clients that roam across different access switches without requiring a centralized wireless LAN controller. Which fabric component and protocol combination should the architect use to enable this mobility?

Accepted Answer

Fabric edge switches with VXLAN and LISP; APs in fabric mode (SD-Access enabled).. SD-Access fabric uses fabric edge switches with VXLAN (data plane) and LISP (control plane) to create a distributed overlay that supports seamless wireless client roaming. APs in fabric mode (SD-Access enabled) integrate directly with the fabric, allowing the fabric edge to handle mobility without a centralized WLC, as the client's context is maintained across the VXLAN overlay.

Answer

Fabric edge switches with VXLAN and LISP; APs in local mode with a centralized WLC.

Answer

Fabric border nodes with VXLAN and LISP; APs in flexconnect mode with a local switch.

Answer

Fabric control plane nodes with VXLAN and LISP; APs in monitor mode.

Question 9

A network engineer runs the following command on Router R1:

R1# show bgp summary
BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 14, main routing table version 14
4 network entries using 1152 bytes of memory
4 path entries using 320 bytes of memory
2/1 BGP path/bestpath attribute entries using 560 bytes of memory
0 BGP route reflector client to client reflections
2 BGP community entries using 80 bytes of memory

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.1.2        4        65002    2345    2346       14    0    0 00:12:34        3
10.0.1.3        4        65003    1234    1235       14    0    0 00:08:21        2
10.0.1.4        4        65004     567     568       14    0    0 00:05:45        0

Based on this output, what can be concluded?

Accepted Answer

Neighbor 10.0.1.4 is not advertising any prefixes to R1.. The 'State/PfxRcd' column shows the number of prefixes received from each neighbor. Neighbor 10.0.1.4 has a value of 0, meaning it has not advertised any prefixes to R1. The session is established (Up/Down shows 00:05:45), so the neighbor is reachable and the BGP session is up, but it is not sending any prefixes.

Answer

Neighbor 10.0.1.4 is in the 'Active' state because it received 0 prefixes.

Answer

Neighbor 10.0.1.4 has sent 0 prefixes to R1.

Answer

The BGP session with 10.0.1.4 is down.

Question 10

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Accepted Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.. The most likely cause is that traffic is exceeding the police rate in bursts, even though the average rate is 500 kbps and the configured police rate is 1 Mbps. Policing uses a token bucket, and TCP SSH traffic from the management subnet can burst above the configured rate. When bursts exceed the police rate, the exceed-action (by default, drop) drops the excess packets, causing intermittent SSH drops. If the conform-action were set to drop, all conforming traffic would be dropped consistently, not intermittently. The default conform-action is transmit, and there is no indication it was changed.

Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.

Answer

The ACL is denying SSH traffic from the management subnet.

Answer

The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.

Question 11

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: ICMP-CLASS (match-all)
      10 packets, 1000 bytes
      5 minute offered rate 0 bps
      Match: access-group name ICMP-ACL
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 10 packets, 1000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SSH-CLASS (match-all)
      5 packets, 500 bytes
      5 minute offered rate 0 bps
      Match: access-group name SSH-ACL
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 5 packets, 500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      20 packets, 2000 bytes
      5 minute offered rate 0 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 20 packets, 2000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.. The output shows that for the ICMP-CLASS, the police command sets a CIR of 8000 bps (8 kbps). The counters show 10 packets conformed and 0 packets exceeded or violated, meaning all ICMP traffic to the control plane has been within the conform rate and transmitted. This directly confirms that ICMP traffic is rate-limited to 8 kbps and has not yet exceeded that limit.

Answer

SSH traffic to the control plane is being dropped because it exceeds the CIR.

Answer

The control-plane policy is applied in the output direction.

Answer

All traffic to the control plane is rate-limited to 64 kbps.

Question 12

Examine the following SD-WAN configuration on a Cisco vEdge router:

vpn 0
 interface ge0/0
 ip address 10.0.0.1/24
 tunnel-interface
 encapsulation ipsec
 color public-internet
 allow-service all
!
 interface ge0/1
 ip address 10.0.0.2/24
 tunnel-interface
 encapsulation ipsec
 color 3g
 allow-service all
!

Which statement is correct?

Accepted Answer

Both interfaces are in VPN 0, which is the transport VPN, and they will establish tunnels with the vSmart controller.. VPN 0 is the transport VPN in Cisco SD-WAN, used exclusively for underlay network connectivity and control plane traffic. The two interfaces ge0/0 and ge0/1 are configured as tunnel interfaces with IPsec encapsulation and different colors (public-internet and 3g), which allows them to establish secure DTLS/TLS tunnels to the vSmart controller for orchestration and policy distribution. This is correct because transport VPN interfaces are designed to carry overlay control traffic, not customer data.

Answer

The interfaces are in VPN 0, which is the service VPN, and they will be used for customer traffic.

Answer

The configuration is invalid because tunnel interfaces cannot have IP addresses in the same VPN.

Answer

The 'allow-service all' command is not supported on vEdge routers.

Question 13

A network engineer is configuring a Cisco router to use TACACS+ for command authorization. The engineer configures 'aaa authorization commands 15 default group tacacs+ local'. When a user with privilege level 15 tries to execute the 'reload' command, the router sends an authorization request to the TACACS+ server. The server responds with an 'Access-Accept' but the command is still denied. The engineer checks the router's configuration and sees that 'aaa accounting commands 15 default start-stop group tacacs+' is also configured. What could be the issue?

Accepted Answer

The TACACS+ server's 'Access-Accept' response does not include the necessary authorization attributes to permit the 'reload' command, so the router denies it.. The TACACS+ 'Access-Accept' response must include the specific command (e.g., 'reload') in an authorization attribute (like 'cmd=reload') for the router to permit it. Without these attributes, the router treats the response as a denial, even though the authentication succeeded. The 'local' fallback in the authorization command only applies if the TACACS+ server is unreachable, not when it responds without the required attributes.

Answer

The 'aaa accounting commands 15' command is causing the router to send accounting records before authorization, which delays the response and causes a timeout.

Answer

The router's 'aaa authorization commands 15' should use 'group tacacs+' without 'local' to ensure only TACACS+ is used.

Answer

The user's privilege level on the router is not actually 15, despite the configuration.

Question 14

Consider the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 5
 spanning-tree portfast

What is the effect of this configuration?

Accepted Answer

The switch will act as an 802.1X authenticator and the port will be unauthorized until a successful authentication.. The configuration enables 802.1X authentication on the port with `authentication port-control auto`, making the port start in the unauthorized state. The `dot1x pae authenticator` command configures the switch as the authenticator (not a supplicant). The `spanning-tree portfast` command allows the port to transition to forwarding quickly after authentication succeeds, but until then, the port remains unauthorized and blocks traffic. Option B correctly states that the switch acts as an authenticator and the port is unauthorized until successful authentication.

Answer

The port will immediately transition to forwarding state and then wait for authentication.

Answer

The port will be placed in a VLAN assigned by the RADIUS server after authentication.

Answer

The switch will act as a supplicant and respond to EAP requests from an upstream authenticator.

Question 15

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4466
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p

Based on this output, what can be concluded?

Accepted Answer

The local switch is not the root bridge for VLAN 10. The output shows that the local switch (Bridge ID 0011.2233.4466) has a Root ID of 0011.2233.4455, which is different from its own Bridge ID. Additionally, the Root Cost is 19, and the Root Port is Gi0/1. This confirms that the local switch is not the root bridge for VLAN 10; it is a non-root switch with a root port in the forwarding state.

Answer

The local switch is the root bridge for VLAN 10

Answer

Interface Gi0/2 is in a forwarding state

Answer

The spanning-tree mode is Rapid PVST+