350-401 Practice Test 37 — 15 Questions

Question 1

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

Accepted Answer

User enters command on device. TACACS+ command authorization starts with the user entering a command, which is sent to the TACACS+ server. The server checks the command against the user's authorization profile and responds with permit or deny. The device executes or blocks the command accordingly, and finally logs the result.

Question 2

Drag and drop each telemetry protocol on the left to its matching transport on the right.

Accepted Answer

gRPC: HTTP/2. gRPC uses HTTP/2, gNMI uses gRPC, NETCONF uses SSH, RESTCONF uses HTTPS, and HTTP is not a standard telemetry transport.

Question 3

Which IP SLA operation type requires an IP SLA responder to be configured on the target device?

Accepted Answer

UDP jitter. UDP jitter (option B) is the correct answer because it is the only IP SLA operation type among the options that requires a dedicated IP SLA responder on the target device. The responder is necessary to generate accurate timestamps for one-way delay, jitter, and packet loss measurements, as the UDP jitter operation sends a configurable number of UDP packets and expects the responder to return precise timing information. Without the responder, the target device would not process the packets in a way that yields meaningful jitter statistics.

Answer

ICMP echo

Answer

TCP connect

Answer

HTTP get

Question 4

A network architect is designing a Cisco SD-Access fabric for a university campus that requires segmentation between student, faculty, and guest traffic. The design must use Cisco TrustSec for scalable security group tags (SGTs) and integrate with Cisco ISE for policy enforcement. Which fabric component should the architect use to enforce SGT-based policies at the access layer?

Accepted Answer

Fabric edge node. The fabric edge node is the correct component because it is the access-layer switch in Cisco SD-Access that performs SGT-based enforcement. It receives SGT-to-SGT policy from Cisco ISE via the control plane node and applies the corresponding security ACLs (SGACLs) at the port level, ensuring segmentation between student, faculty, and guest traffic at the point of entry.

Answer

Fabric border node

Answer

Fabric control plane node

Answer

Wireless LAN controller

Question 5

A large enterprise uses a centralized automation platform based on Ansible Tower to manage its network infrastructure. The network consists of 500 Cisco IOS XE routers and switches distributed across multiple sites. The automation team has created a playbook that configures BGP peerings on all devices. The playbook uses the ios_bgp module. Recently, during a maintenance window, the playbook was run against a subset of devices that were supposed to be upgraded to a new IOS XE version. However, after the run, several devices lost their BGP configurations entirely. The team discovers that the new IOS XE version introduced a new BGP configuration model that is not fully compatible with the ios_bgp module's expected CLI commands. The playbook failed silently on those devices, and the existing BGP configuration was removed. The team needs to prevent this from happening in future maintenance windows. Which action should be taken?

Accepted Answer

Add a pre-task that validates the device's OS version and conditionally applies the appropriate module or command set. It directly addresses the root cause: the new IOS XE version uses an incompatible BGP configuration model. By adding a pre-task that validates the OS version, the playbook can conditionally apply the correct module (e.g., ios_bgp for older versions or a different module/CLI for the new model), preventing silent failures and configuration loss. This ensures the automation adapts to version-specific changes, maintaining idempotency and safety.

Answer

Implement idempotency checks in the playbook using the 'check_mode' option

Answer

Set 'gather_facts: no' in the playbook to speed up execution and avoid version detection issues

Answer

Replace the ios_bgp module with the ios_config module and use raw CLI commands for BGP configuration

Question 6

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

Accepted Answer

OSPF E2 routes do not factor interface cost; but the router uses the interface cost as a tie-breaker for equal-cost routes.. OSPF E2 routes do not include the internal cost to the ASBR; the cost shown in the routing table is the external metric only. When two E2 routes have the same external metric, Cisco IOS uses the interface cost as a tie-breaker to select the best next hop. In this scenario, the interface to 10.0.1.2 has a lower cost than the interface to 10.0.2.2, so all traffic is forwarded via 10.0.1.2.

Answer

One route has a higher administrative distance.

Answer

A default route is overriding the specific route.

Answer

The route via 10.0.2.2 is an E1 route.

Question 7

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4466
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p
Gi0/3               Desg FWD 19        128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

Gi0/2 is in blocking state due to loop prevention.. The output shows Gi0/2 is in the Alternate (Altn) role with a Blocking (BLK) state. In Rapid PVST+ (IEEE 802.1w), an alternate port provides a backup path to the root bridge and is placed in a blocking state to prevent Layer 2 loops. Since SW1 is not the root bridge (its Bridge ID priority 32778 is equal to the Root ID priority, but its MAC address 0011.2233.4466 is higher than the root's 0011.2233.4455), Gi0/2 is blocking as a loop-prevention mechanism.

Answer

SW1 is the root bridge for VLAN 10.

Answer

Gi0/3 is a root port.

Answer

The root bridge has a higher priority than SW1.

Question 8

Given the following SNMP configuration on a Cisco IOS-XE router:

snmp-server community public RO
snmp-server community private RW
snmp-server location Building-A
snmp-server contact admin@example.com
snmp-server enable traps snmp linkdown linkup
snmp-server host 192.168.1.100 version 2c public

What is the effect of this configuration?

Accepted Answer

The router will send SNMP traps to 192.168.1.100 using community string 'public' for linkdown and linkup events.. The `snmp-server host` command specifies the destination for SNMP notifications, and the community string 'public' is explicitly included in the command, overriding the default behavior of using the first configured RW community. The `snmp-server enable traps snmp linkdown linkup` command enables only linkdown and linkup traps. Therefore, the router sends only those two trap types to 192.168.1.100 using the 'public' community string.

Answer

The router will send SNMP traps to 192.168.1.100 using community string 'private' for all SNMP traps.

Answer

The router will only accept SNMP read requests using community 'public' and write requests using community 'private'.

Answer

The router will send SNMPv3 traps to 192.168.1.100 using authentication.

Question 9

Consider the following EIGRP configuration on a Cisco IOS router:

router eigrp 100
 network 10.0.0.0
 passive-interface default
 no passive-interface GigabitEthernet0/1

What is the effect of this configuration?

Accepted Answer

All interfaces except GigabitEthernet0/1 are passive and will not form EIGRP adjacencies.. The 'passive-interface default' command sets all interfaces to passive by default, preventing them from sending EIGRP hellos and forming adjacencies. The 'no passive-interface GigabitEthernet0/1' command then overrides this default for that specific interface, allowing it to send hellos and form adjacencies. Therefore, only GigabitEthernet0/1 is active for EIGRP neighbor discovery, while all other interfaces remain passive.

Answer

EIGRP hellos are sent on all interfaces, but GigabitEthernet0/1 is prevented from forming adjacencies.

Answer

Only the network 10.0.0.0 is advertised, and all interfaces are passive.

Answer

EIGRP will only form adjacencies on interfaces with an IP address in the 10.0.0.0/8 range.

Question 10

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

Accepted Answer

The boot order in the VM configuration does not have the CD-ROM (ISO) as the first device.. The error 'No bootable device found' indicates that the VM attempted to boot from a device that does not contain a bootable operating system. In NFVIS, when deploying a virtual WAN edge device from an ISO, the VM's boot order must be configured to prioritize the CD-ROM (ISO) device. If the boot order defaults to the virtual hard disk (which is empty before installation), the VM will fail to find a bootable medium and produce this exact error.

Answer

The VM's virtual disk size is too small for the WAN edge image.

Answer

The VM's CPU type is set to 'host-passthrough' instead of 'qemu64'.

Answer

The ISO image is corrupted and NFVIS cannot read it.

Question 11

A company is deploying a virtual WAN optimizer (vWAAS) on a Cisco NFVIS host. The engineer needs to ensure that the vWAAS can intercept traffic between two VNFs running on the same host. The traffic currently flows directly between the VNFs without passing through the vWAAS. What should the engineer configure to redirect the traffic?

Accepted Answer

Create a service chain in NFVIS that places the vWAAS between the two VNFs.. NFVIS supports service chaining, which allows an administrator to define a sequence of VNFs that traffic must traverse. By creating a service chain that places the vWAAS between the two VNFs, NFVIS will automatically redirect the traffic through the vWAAS using internal bridging or vSwitch forwarding rules, without requiring any configuration changes on the VNFs themselves.

Answer

Configure a static route on each VNF pointing to the vWAAS.

Answer

Enable WCCP on the vWAAS and configure the VNFs to use WCCP.

Answer

Use policy-based routing on the VNFs to forward traffic to the vWAAS.

Question 12

A network architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation at Layer 2 and Layer 3 across the fabric, using a centralized control plane and policy enforcement. Which two protocols are essential for the SD-Access overlay to meet these requirements?

Accepted Answer

LISP and VXLAN. LISP (Locator/ID Separation Protocol) provides the centralized control plane for endpoint identity-to-location mapping and policy-based forwarding, while VXLAN (Virtual Extensible LAN) supplies the data-plane encapsulation needed for Layer 2 and Layer 3 segmentation across the underlay. Together, they enable scalable overlay segmentation with a centralized policy enforcement point in SD-Access.

Answer

MP-BGP and MPLS

Answer

OSPF and GRE

Answer

IS-IS and NVGRE

Question 13

Consider the following partial configuration on Router R1:

ip sla 2
 icmp-echo 10.2.2.2
 frequency 15
ip sla schedule 2 life forever start-time now
ip sla reaction-configuration 2 react timeout threshold-type immediate action-type triggerOnly

Which statement about this configuration is true?

Accepted Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and trigger an event if a timeout occurs, but the trigger will only activate once.. The IP SLA operation sends ICMP echo requests every 15 seconds (as defined by the 'frequency 15' command) and the 'reaction-configuration' with 'threshold-type immediate' and 'action-type triggerOnly' means that as soon as a timeout occurs, a trigger event is generated, but the 'triggerOnly' keyword ensures that the trigger fires only once (not repeatedly) for the first timeout event. The operation continues to run, but no further triggers are generated for subsequent timeouts unless the reaction is rearmed.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and continuously trigger events for each timeout.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and trigger an event if the round-trip time exceeds a threshold.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds, but the 'reaction-configuration' command is invalid because it requires a threshold value.

Question 14

A network engineer runs the following command on Router R8:

R8# show ip nhrp

10.0.0.1/32 via 10.0.0.1
   Tunnel0 created 00:10:00, expire 01:50:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.1
10.0.0.2/32 via 10.0.0.2
   Tunnel0 created 00:05:00, expire 01:55:00
   Type: dynamic, Flags: unique registered
   NBMA address: 192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The router is a DMVPN hub with two registered spokes.. The output shows two NHRP entries with 'Type: dynamic' and 'Flags: unique registered', which indicates that these are spokes that have dynamically registered their NBMA addresses with this router. The presence of multiple registered entries and the absence of static NHRP mappings confirm this router is acting as a DMVPN hub, as hubs maintain a registry of all connected spokes.

Answer

The router has static NHRP mappings configured.

Answer

The NHRP entries are about to expire because the expire time is less than 2 hours.

Answer

The router is a spoke because it has only two entries.

Question 15

An enterprise is deploying a virtualized network function (VNF) for a next-generation firewall on a KVM-based hypervisor. The architect must ensure that the VNF can handle high throughput without CPU bottlenecks. Which hypervisor configuration technique should the architect use to dedicate physical CPU cores to the VNF?

Accepted Answer

Configure NUMA pinning and CPU pinning to dedicate physical cores to the VNF's virtual CPUs.. CPU pinning (also called CPU affinity) binds specific virtual CPUs (vCPUs) of the VNF to dedicated physical CPU cores, eliminating context-switching overhead and ensuring deterministic performance. NUMA pinning further aligns vCPUs and memory with the same Non-Uniform Memory Access node, reducing latency. This configuration is critical for VNFs like next-generation firewalls that require high throughput and low jitter.

Answer

Enable CPU overcommitment to allow the VNF to use any available CPU cycles.

Answer

Use VMware vSphere instead of KVM for better VNF performance.

Answer

Increase the number of virtual CPUs assigned to the VNF to improve throughput.