350-401 Practice Test 35 — 15 Questions

Question 1

A network architect is designing the QoS architecture for a Cisco SD-WAN deployment that carries voice, video, and data traffic across MPLS and Internet transports. The design must use a consistent DiffServ marking strategy across all transports and ensure that voice traffic is prioritized over video. Which QoS policy type and marking approach should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a centralized QoS policy that marks traffic with DSCP and applies per-queue shaping on the WAN edge.. Cisco SD-WAN uses centralized QoS policies applied via vSmart to ensure consistent DiffServ marking (DSCP) across all transports (MPLS and Internet). Per-queue shaping on the WAN edge router allows voice traffic to be prioritized over video by assigning voice to a higher-priority queue (e.g., queue 4 with DSCP EF) and video to a lower queue (e.g., queue 3 with DSCP AF41), ensuring voice is always serviced first.

Answer

Use localized QoS policies on each WAN edge router with CoS markings based on the transport type.

Answer

Use MPLS EXP markings for MPLS transport and IP Precedence for Internet transport.

Answer

Use NBAR2 to automatically classify traffic and apply markings based on application signatures.

Question 2

Consider the following configuration on a Cisco router:

class-map match-any CRITICAL_DATA
 match ip dscp af21 af22 af23

policy-map QOS
 class CRITICAL_DATA
  bandwidth remaining percent 50
 class class-default
  fair-queue

interface GigabitEthernet0/0
 service-policy output QOS

Which statement about this configuration is true?

Accepted Answer

Traffic matching DSCP AF21, AF22, or AF23 is guaranteed 50% of the interface bandwidth, and all other traffic is subject to fair-queuing.. The 'bandwidth remaining percent 50' command under class CRITICAL_DATA guarantees that traffic matching DSCP AF21, AF22, or AF23 will receive 50% of any remaining bandwidth after any explicit bandwidth reservations are satisfied. The 'class-default' uses fair-queuing, which distributes the remaining bandwidth equally among flows in that class. Since no explicit bandwidth is reserved elsewhere, the CRITICAL_DATA class effectively gets 50% of the interface bandwidth, and all other traffic is subject to fair-queuing.

Answer

Only traffic with DSCP AF21 is matched; AF22 and AF23 are ignored because 'match-any' requires all conditions to be true.

Answer

The configuration is invalid because 'bandwidth remaining percent' cannot be used with 'fair-queue' in the same policy-map.

Answer

The policy-map will only be applied to incoming traffic on GigabitEthernet0/0.

Question 3

Drag and drop the steps of Cisco DNA Center assurance data collection workflow into the correct order, from first to last.

Accepted Answer

Devices stream telemetry to DNA Center. Assurance begins with network devices streaming telemetry data (e.g., NetFlow, SNMP, syslog) to DNA Center. DNA Center processes and correlates the data to build a baseline of normal behavior. It then applies machine learning models to detect anomalies. Alerts and insights are generated for potential issues. Finally, the dashboard displays health scores and recommended actions for the administrator.

Question 4

A network engineer is troubleshooting an OSPF issue where a router is not learning a route to a network that is advertised via a type 5 LSA from an ASBR. The engineer checks the OSPF database and sees the type 5 LSA, but the route is not in the routing table. The forwarding address in the LSA is 0.0.0.0. What is the most likely cause?

Accepted Answer

The ASBR is not reachable via an OSPF internal route.. When a Type 5 LSA has a forwarding address of 0.0.0.0, OSPF routers will use the ASBR as the next hop for the external route. For the route to be installed in the routing table, the ASBR must be reachable via an OSPF intra-area or inter-area route. If the ASBR is not reachable (e.g., no valid OSPF route to the ASBR's router ID), the Type 5 LSA is considered unreachable and is not installed, even though it exists in the OSPF database.

Answer

The type 5 LSA has a metric of 16777215.

Answer

The OSPF process ID on the ASBR is different from the other routers.

Answer

The type 5 LSA is being filtered by an outbound route filter.

Question 5

A network engineer is troubleshooting a routing loop in an EIGRP network. Which mechanism is designed to prevent routing loops by causing a router to reject routes that are learned from a neighbor that is not the successor?

Accepted Answer

Feasibility condition. The feasibility condition is a loop-prevention mechanism unique to EIGRP. It ensures that a router only accepts a route from a neighbor if that neighbor's reported distance (RD) to the destination is less than the router's own feasible distance (FD). This guarantees that the path through that neighbor is loop-free, effectively rejecting routes learned from any neighbor that is not the successor.

Answer

Split horizon

Answer

Route poisoning

Answer

Hold-down timers

Question 6

Examine the following configuration:

interface GigabitEthernet0/0
 ip address 172.16.1.1 255.255.255.0
 ipv6 address 2001:db8:1::1/64
 ipv6 ospf 100 area 0
!

What is missing from this configuration to enable OSPFv3 on this interface?

Accepted Answer

The command 'ipv6 router ospf 100' must be added globally to create the OSPFv3 process.. OSPFv3 requires an active OSPFv3 process on the router before it can be enabled on any interface. The 'ipv6 router ospf 100' global command creates the OSPFv3 process with process ID 100, which is necessary for the interface-level 'ipv6 ospf 100 area 0' command to function. Without this global process, the interface configuration is incomplete and OSPFv3 will not operate.

Answer

The configuration is complete; no additional commands are needed.

Answer

The interface needs the 'ipv6 ospf network point-to-point' command to work.

Answer

The 'ipv6 unicast-routing' command must be enabled globally.

Question 7

A network engineer is troubleshooting a VMware vSphere cluster where a VM with a large memory footprint (256 GB) is experiencing poor performance. The host has two NUMA nodes, each with 128 GB of memory. The VM is configured with 256 GB of memory and 4 vCPUs. Performance monitoring shows high memory latency and CPU ready time. What is the most likely cause?

Accepted Answer

The VM's memory size forces it to span multiple NUMA nodes, increasing memory access latency.. The VM is configured with 256 GB of memory, but each NUMA node on the host has only 128 GB. Since a single NUMA node cannot satisfy the VM's memory allocation, the hypervisor must split the VM across both NUMA nodes. This forces memory accesses to cross the NUMA interconnect (e.g., QPI or UPI), which introduces significantly higher latency compared to local memory access, directly causing the observed high memory latency and increased CPU ready time.

Answer

The VM has too few vCPUs for the memory size.

Answer

The host is using memory ballooning to reclaim memory from other VMs.

Answer

The host's memory is overcommitted.

Question 8

An enterprise is migrating its data center to a leaf-spine architecture. The design must provide high availability and support for east-west traffic patterns. Which design choice best meets these requirements?

Accepted Answer

Implement a leaf-spine topology with multiple spine switches and ECMP.. A leaf-spine topology with multiple spine switches and Equal-Cost Multi-Path (ECMP) routing provides high availability by eliminating single points of failure and supports east-west traffic patterns by ensuring that any leaf switch can reach any other leaf switch with a consistent number of hops (typically one hop via a spine). ECMP allows load balancing across all available spine links, maximizing bandwidth and redundancy for data center east-west flows.

Answer

Deploy a collapsed core with a single pair of core switches.

Answer

Use a three-tier hierarchical design with access, distribution, and core layers.

Answer

Use a ring topology connecting all switches in a loop.

Question 9

An enterprise has two BGP routers, R1 and R2, both in AS 65000. R1 peers with ISP1 (AS 100) and R2 peers with ISP2 (AS 200). The enterprise advertises a prefix 192.168.0.0/24 to both ISPs. The engineer wants to ensure that traffic from the Internet to this prefix enters the network primarily via R1, and only uses R2 if the link to ISP1 fails. Which BGP attribute should be manipulated on the updates sent to the ISPs?

Accepted Answer

Prepend AS 65000 multiple times on R2's updates to ISP2.. To influence inbound traffic from the Internet, you must manipulate attributes sent to the ISPs. AS path prepending makes a route appear less preferred by artificially lengthening the AS path. By prepending AS 65000 multiple times on R2's updates to ISP2, ISP2 will see a longer AS path for the prefix and prefer the shorter path via ISP1, causing traffic to enter primarily via R1 unless the ISP1 link fails.

Answer

Set a higher MED on R1's updates to ISP1.

Answer

Set a higher local preference on R1 for routes learned from ISP1.

Answer

Use the no-export community on R1's updates to ISP1.

Question 10

A network engineer is deploying a new virtualized application on a VMware vSphere cluster. The application requires dedicated CPU cores to meet licensing requirements, and the engineer must ensure that no other virtual machine can use those cores. The cluster uses VMware ESXi 7.0. Which configuration should the engineer apply to the virtual machine?

Accepted Answer

Configure CPU affinity to pin the VM to specific physical cores.. CPU affinity (option A) is the correct configuration because it explicitly binds a virtual machine's vCPUs to specific physical cores, ensuring that no other VM can use those cores. This meets the licensing requirement for dedicated CPU cores by preventing co-scheduling or sharing of those physical cores with other workloads, which CPU reservation alone does not guarantee.

Answer

Set a CPU reservation equal to the number of vCPUs.

Answer

Enable NUMA node affinity for the VM.

Answer

Configure a CPU limit equal to the number of vCPUs.

Question 11

A network engineer runs the following command on Switch SW2:

SW2# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     aabb.cc00.0100
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     aabb.cc00.0200
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p
Gi0/3               Desg FWD 19        128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

The root bridge for VLAN 10 has MAC address aabb.cc00.0100.. The output shows that the Root ID has MAC address aabb.cc00.0100, while the Bridge ID (SW2 itself) has MAC address aabb.cc00.0200. Since SW2 is not the root bridge (its Bridge ID differs from the Root ID), the root bridge for VLAN 10 must be the switch with MAC address aabb.cc00.0100. The Root ID field always identifies the root bridge in the spanning tree.

Answer

SW2 is the root bridge for VLAN 10.

Answer

Port Gi0/2 is in forwarding state.

Answer

The STP priority for VLAN 10 is 32768.

Question 12

Given the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

What is the effect of this configuration?

Accepted Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all untagged frames will be placed into VLAN 999.. The configuration sets the interface as a trunk port, explicitly allows only VLANs 10, 20, and 30 to traverse it, and designates VLAN 999 as the native VLAN. On a trunk, the native VLAN is used for untagged frames (e.g., DTP, CDP, or any traffic sent without an 802.1Q header), so all untagged frames received or sent on this interface will be associated with VLAN 999.

Answer

The interface will forward traffic for all VLANs except 10, 20, and 30, and the native VLAN is 1.

Answer

The interface will operate as an access port in VLAN 999.

Answer

The interface will forward traffic for VLANs 10, 20, and 30, and all frames will be tagged including the native VLAN.

Question 13

Consider the following configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip pim sparse-mode
 ip igmp version 3
!
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
!

What is the effect of this configuration?

Accepted Answer

The interface will participate in PIM sparse-mode and IGMPv3, but PIM sparse-mode requires an RP to be configured or learned.. The configuration explicitly enables PIM sparse-mode on the interface, which requires a rendezvous point (RP) to be known—either statically configured or dynamically learned via Auto-RP or BSR. The `ip igmp version 3` command enables IGMPv3, which is fully compatible with PIM sparse-mode and allows for source-specific multicast (SSM) support. OSPF is only used for unicast routing and does not affect PIM mode selection.

Answer

The interface will operate in PIM dense-mode because no RP is configured.

Answer

IGMPv3 is incompatible with PIM sparse-mode and will be ignored.

Answer

The router will automatically use dense-mode because OSPF is enabled.

Question 14

A small business has a single router connected to the internet and a switch for the LAN. They want to implement VLANs to separate guest and corporate traffic. The router has only one physical interface to the switch. The network engineer proposes using subinterfaces with 802.1Q trunking on the router interface. Which configuration step is required on the switch port connected to the router?

Accepted Answer

Configure the port as a trunk port.. The router uses subinterfaces with 802.1Q trunking to carry multiple VLANs over a single physical link. For this to work, the switch port connected to the router must be configured as a trunk port, which tags frames with VLAN IDs as they traverse the link. This allows the router to route between VLANs using its subinterfaces, each associated with a specific VLAN.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port in VLAN 1.

Answer

Configure the port as a dynamic desirable port.

Question 15

Drag and drop the steps of KVM VM provisioning via virsh CLI into the correct order, from first to last.

Accepted Answer

Define VM XML configuration file. KVM provisioning via virsh begins with defining the VM XML configuration. Then, the VM is started using virsh start. Next, the VM's console is accessed to complete OS installation. After that, the VM is shut down gracefully. Finally, the VM is restarted for production use.