350-401 Practice Test 34 — 15 Questions

Question 1

A network engineer is configuring a new Cisco Catalyst switch to connect to an existing network. The uplink to the distribution switch is configured as a trunk. The engineer wants to ensure that the trunk uses 802.1Q encapsulation and that the native VLAN is set to VLAN 100. The distribution switch is a Cisco Catalyst 3850. Which configuration should the engineer apply on the uplink interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

switchport mode trunk; switchport trunk native vlan 100. On modern Cisco Catalyst switches that run LAN Base or IP Base software, the default trunk encapsulation is 802.1Q, so the 'switchport trunk encapsulation dot1q' command is not required. The 'switchport mode trunk' forces the interface into trunking mode, and 'switchport trunk native vlan 100' sets the native VLAN to 100, which matches the requirement.

Answer

switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 100

Answer

switchport mode dynamic desirable; switchport trunk native vlan 100

Answer

switchport mode trunk; switchport trunk allowed vlan 100

Question 2

An engineer is configuring a new access switch for a branch office. The switch must support multiple VLANs for different departments: VLAN 10 (Engineering), VLAN 20 (Sales), and VLAN 30 (Management). The uplink to the distribution switch is a trunk. The engineer wants to ensure that only the required VLANs are allowed on the trunk and that the native VLAN is changed from the default to VLAN 99 for security reasons. Which configuration commands should the engineer apply on the access switch's uplink interface?

Accepted Answer

switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30. It explicitly sets the interface to trunk mode, changes the native VLAN from the default VLAN 1 to VLAN 99 for security, and uses the 'allowed vlan' command to permit only VLANs 10, 20, and 30 on the trunk. This ensures that only the required department VLANs are carried, reducing unnecessary broadcast traffic and preventing VLAN hopping attacks by changing the native VLAN.

Answer

switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan except 10,20,30

Answer

switchport mode dynamic desirable; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30

Answer

switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 99

Question 3

An engineer is writing an Ansible playbook to configure OSPF on a fleet of Cisco Nexus 9000 switches. The playbook uses the nxos_ospf module. When executed, the playbook reports 'changed' for every switch, even on subsequent runs when no configuration changes are made. The engineer wants to achieve idempotent behavior. What is the most likely cause of the non-idempotent results?

Accepted Answer

The playbook does not specify all OSPF parameters, such as 'router-id', causing the module to detect a difference with the running configuration.. The nxos_ospf module requires all mandatory OSPF parameters to be explicitly defined in the playbook to achieve idempotency. If parameters such as 'router-id' are omitted, the module compares the current running configuration (which may have a default or previously configured router-id) against the playbook's parameters. Since the playbook does not specify the router-id, the module interprets this as a missing parameter and attempts to reconfigure OSPF, resulting in a 'changed' status on every run. Specifying all OSPF parameters ensures the module can accurately detect that the desired state matches the current state.

Answer

The Ansible control node is using an outdated version of the nxos_ospf module that does not support idempotency.

Answer

The switches have different NX-OS versions, causing the module to behave inconsistently.

Answer

The engineer forgot to use the '--check' flag to verify idempotency.

Question 4

Examine the following configuration snippet:

ip pim send-rp-announce Loopback0 scope 10 group-list 10
ip pim send-rp-discovery scope 10
access-list 10 permit 239.0.0.0 0.255.255.255
!
interface Loopback0
 ip address 192.168.0.1 255.255.255.255
 ip pim sparse-mode
!

What is the purpose of this configuration?

Accepted Answer

The router will act as both a candidate RP for groups 239.0.0.0/8 and a mapping agent for Auto-RP within a scope of 10 hops.. The configuration enables Auto-RP, where the `ip pim send-rp-announce` command designates the router as a candidate RP for the multicast group range 239.0.0.0/8 (permitted by access-list 10), using Loopback0's IP address (192.168.0.1) as the RP address. The `ip pim send-rp-discovery` command makes the router act as the mapping agent, distributing RP-to-group mappings via Auto-RP discovery messages within a scope of 10 hops. Together, these commands fulfill both roles: candidate RP and mapping agent.

Answer

The router will only act as a mapping agent and will not advertise itself as an RP.

Answer

The router will use the IP address of GigabitEthernet0/0 as the RP address.

Answer

The router will only accept RP announcements from other routers within 10 hops.

Question 5

Consider the following SD-WAN configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.0
 tunnel-interface
 encapsulation ipsec
 color biz-internet
 no allow-service bgp
 allow-service dhcp
 allow-service dns
 allow-service icmp
!

What is the effect of this configuration?

Accepted Answer

The interface is configured as an SD-WAN tunnel interface with color biz-internet, allowing DHCP, DNS, and ICMP traffic but blocking BGP.. The configuration applies to a GigabitEthernet interface that is placed into SD-WAN tunnel mode using the 'tunnel-interface' command. The 'color biz-internet' assigns the transport color, and the 'allow-service' and 'no allow-service' commands explicitly control which control-plane services are permitted over the tunnel. DHCP, DNS, and ICMP are allowed, while BGP is explicitly denied, making option A correct.

Answer

The interface is configured as a standard WAN interface with IPsec encryption, allowing all services including BGP.

Answer

The configuration enables the interface as a loopback tunnel for OMP traffic only, blocking all other services.

Answer

The interface is configured for SD-WAN with color biz-internet, but the 'no allow-service bgp' command is invalid on a tunnel interface.

Question 6

A network engineer is designing an OSPF network with multiple areas. The engineer wants to ensure that routers in area 2 can reach networks in area 0, but they should not learn any external routes from other ASs. Which OSPF area type should be configured for area 2?

Accepted Answer

Stub area. A stub area blocks Type 5 LSAs (external routes from other ASs) while allowing Type 3 summary LSAs from area 0. This ensures routers in area 2 can reach networks in area 0 via inter-area routes but do not learn external routes, meeting the requirement exactly.

Answer

Not-so-stubby area (NSSA)

Answer

Totally stubby area

Answer

Standard area

Question 7

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 192.168.1.0
BGP routing table entry for 192.168.1.0/24, version 10
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  Local
    10.0.0.2 from 10.0.1.2 (10.0.0.2)
      Origin IGP, metric 0, localpref 100, valid, internal
      rx pathid: 0, tx pathid: 0x0
  Local, (received & used)
    10.0.0.3 from 10.0.1.3 (10.0.0.3)
      Origin IGP, metric 0, localpref 200, valid, internal, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what can be concluded?

Accepted Answer

The path from 10.0.1.3 is preferred because of a higher local preference.. The output shows two BGP paths for 192.168.1.0/24, both with Origin IGP and metric 0. The path from 10.0.1.3 has a local preference of 200, while the path from 10.0.1.2 has a local preference of 100. BGP selects the path with the highest local preference as the best path, making the path from 10.0.1.3 the best (marked as 'best' in the output).

Answer

The path from 10.0.1.2 is the best path because it is received first.

Answer

Both paths are from external BGP peers.

Answer

The path from 10.0.1.2 is marked as best because it has a lower metric.

Question 8

A financial services company has deployed Cisco UCS servers with VMware vSphere 7.0 to host critical trading applications. The network uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric with BGP as the underlay. The environment includes 50 ESXi hosts, each connected via two 40G interfaces to two different leaf switches in a VPC. The VMs are spread across multiple hosts and communicate over VXLAN. Recently, the operations team migrated a set of VMs from an old VLAN-based network to a new VXLAN segment (VNI 50000). After the migration, users report intermittent connectivity issues and packet loss. The engineering team captures traffic and notices that some VMs send ARP requests that are not being replied to, even though the target VM is active. Further analysis shows that the ARP requests are being flooded to all VTEPs, but the replies are not reaching the source. The team checks the underlay and finds no issues with BGP or routing. The NVE interfaces are up, and the VNI is configured. Which of the following is the most likely cause of the issue?

Accepted Answer

The MAC address of the target VM is not being advertised in EVPN type-2 routes because the VM's MAC is learned on a different leaf switch than expected.. The issue is that the target VM's MAC address is not being advertised via EVPN Type-2 routes from the leaf switch where it resides. When the source VM sends an ARP request, the ingress VTEP floods it to all VTEPs in the VNI's ingress replication list, but the reply from the target VM must be unicast back. If the target's MAC is not in the EVPN control plane (e.g., because it was learned on a different leaf than expected due to asymmetric MAC learning or stale entries), the reply cannot be forwarded correctly, causing intermittent connectivity.

Answer

The ingress replication list is missing some VTEPs.

Answer

The symmetric routing configuration is missing on the leaf switches.

Answer

The VPC configuration between the leaf switches and ESXi hosts is incorrect.

Question 9

A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?

Accepted Answer

The switch uses a single queue for all traffic unless multiple queues are configured.. By default, Cisco switches use a single queue for all traffic. Creating a policy-map that sets a queue-limit for the AF41 class does not automatically create a separate queue for that class; the switch must have multiple egress queues configured (e.g., via the 'priority-queue out' command or by mapping DSCP values to specific queues). Without multiple queues, all traffic shares the same queue, and setting a queue-limit on a class within a single-queue system does not prevent drops during congestion.

Answer

The queue-limit is set too low, causing tail drops.

Answer

The video traffic is not being marked with DSCP AF41.

Answer

The policy-map must be applied to the output direction.

Question 10

A campus network architect is redesigning the LAN to support high availability and east-west traffic growth. The current design uses a traditional three-tier hierarchy with a collapsed core. The architect must choose a new design that provides predictable latency, simple scalability, and efficient use of uplinks. Which design should the architect select?

Accepted Answer

Leaf-spine design with all leaf switches connected to all spine switches.. The leaf-spine design (option B) provides predictable latency because every leaf switch is exactly one hop away from any other leaf switch via the spine, regardless of traffic path. This design also scales simply by adding more leaf or spine switches without reconfiguring existing connections, and it uses uplinks efficiently through equal-cost multipath (ECMP) load balancing, making it ideal for east-west traffic growth in a modern data center or campus LAN.

Answer

Collapsed core design with redundant core switches and distribution layers.

Answer

Mesh design where every switch connects to every other switch.

Answer

Traditional three-tier design with access, distribution, and core layers.

Question 11

Which two statements about SNMPv3 security models are true? (Choose two.)

Accepted Answer

The authNoPriv security model provides authentication but no encryption.. Option A is correct because the authNoPriv security level in SNMPv3 authenticates messages using HMAC with MD5 or SHA (verifying integrity and origin) but does not encrypt the payload, so data travels in cleartext. Option C is correct because authPriv combines authentication with encryption, using a privacy protocol such as DES, 3DES, or AES to protect the PDU contents. Option B is wrong because noAuthNoPriv performs no authentication at all, relying only on a username (security name) with no password or HMAC verification. Option D is wrong because SNMPv3 does not require a separate engine ID per manager and agent; each SNMP engine has one unique engine ID, and managers can communicate with multiple agents using their respective IDs. Option E is wrong because authPriv supports multiple encryption algorithms (DES, 3DES, AES-128/192/256 depending on implementation), not only AES-256.

Answer

The noAuthNoPriv security model uses both a username and a password for authentication.

Answer

SNMPv3 requires the use of a separate engine ID for each SNMP manager and agent.

Answer

The authPriv model supports only AES-256 for encryption.

Question 12

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

Accepted Answer

The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.. When a port is configured as a SPAN destination port, the switch automatically disables normal switching (Layer 2 forwarding) on that interface. This is because the destination port is dedicated to receiving mirrored copies of traffic from the source port and forwarding them to an external monitoring device. As a result, the destination port will not forward any normal traffic, which explains the engineer's observation.

Answer

The destination port must be configured as a trunk port to forward SPAN traffic.

Answer

The destination port must be configured as an access port to forward SPAN traffic.

Answer

The destination port is in an err-disabled state due to a loop.

Question 13

Given the following configuration on a Cisco IOS-XE router:

interface Tunnel100
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0/0
 tunnel destination 192.168.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile MYPROFILE

What is the effect of this configuration?

Accepted Answer

It creates a VTI (Virtual Tunnel Interface) that encrypts all traffic routed into the tunnel using IPsec.. The configuration creates a Virtual Tunnel Interface (VTI) that encrypts all traffic routed into the tunnel using IPsec. The 'tunnel mode ipsec ipv4' command explicitly sets the tunnel to operate in IPsec tunnel mode (not GRE), and 'tunnel protection ipsec profile MYPROFILE' applies IPsec encryption directly to the tunnel interface. This is a standard static VTI configuration, which encrypts any IPv4 traffic that is routed into the tunnel without requiring a separate crypto map.

Answer

It creates a GRE tunnel with IPsec encryption.

Answer

It creates a DMVPN phase 1 tunnel with mGRE.

Answer

It creates a L2TPv3 tunnel for layer 2 transport.

Question 14

A network engineer executes the following command on Router R5:

R5# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.6         1   FULL/DR         00:00:35    192.168.1.6    GigabitEthernet0/0
10.0.0.7         1   FULL/BDR        00:00:32    192.168.1.7    GigabitEthernet0/0
10.0.0.8         1   2WAY/DROTHER    00:00:38    192.168.1.8    GigabitEthernet0/0

Based on this output, what can be concluded about the OSPF network?

Accepted Answer

The OSPF network type is broadcast.. The output shows neighbors in states FULL/DR, FULL/BDR, and 2WAY/DROTHER, which are characteristic of a broadcast multiaccess network where a Designated Router (DR) and Backup Designated Router (BDR) are elected. The presence of a 2WAY/DROTHER state indicates that non-DR/BDR routers maintain a two-way adjacency without exchanging full LSDBs, which only occurs on broadcast or non-broadcast multiaccess (NBMA) networks. Since the network type is not point-to-point (which would show only FULL states) and the DR/BDR roles are present, the OSPF network type must be broadcast.

Answer

The OSPF network type is point-to-point.

Answer

Router R5 is the DR on this segment.

Answer

All neighbors are in the FULL state.

Question 15

An engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, connected via a trunk. The trunk is configured with switchport mode trunk on both sides. The engineer notices that some VLANs are not passing traffic, even though they are in the allowed list. The output of 'show interfaces trunk' on SW1 shows that VLANs 10, 20, and 30 are in the allowed list and are active. However, hosts in VLAN 30 cannot reach the distribution switch. What is the most likely cause?

Accepted Answer

VLAN 30 is not created in the VLAN database on SW2.. VLAN 30 must exist in the VLAN database on both switches for traffic to be forwarded across the trunk. Even if VLAN 30 is in the allowed list and active on SW1, if it has not been created on SW2, SW2 will discard frames tagged with VLAN 30 because it has no VLAN 30 interface or forwarding table entry. This is a common misconfiguration where the VLAN is allowed on the trunk but not present on the remote switch.

Answer

The native VLAN is mismatched between SW1 and SW2.

Answer

VTP pruning is removing VLAN 30 from the trunk.

Answer

The trunk is not forming due to DTP negotiation.