350-401 Practice Test 38 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip access-lists 101

Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 23 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet traffic from any source is denied.. The ACL explicitly denies TCP traffic to port 23 (Telnet) from any source, as shown by the 'deny tcp any any eq 23' statement with 50 matches. This rule is processed before the final permit any any, so Telnet traffic is denied regardless of the source IP.

Answer

Telnet traffic from 192.168.1.0/24 is permitted.

Answer

HTTP traffic from any source is permitted.

Answer

All traffic is permitted because of the last entry.

Question 2

A network engineer is configuring an EtherChannel between a Cisco switch and a server that supports LACP. The switch ports are configured as trunk ports allowing multiple VLANs. The engineer wants to ensure the EtherChannel forms automatically without manual intervention. Which configuration should be applied on the switch?

Accepted Answer

Configure the port-channel with 'channel-group 1 mode active'.. 'mode active' enables LACP unconditionally on the switch port, causing it to actively send LACP packets to negotiate and form an EtherChannel with the server. Since the server supports LACP, this ensures automatic formation without manual intervention, and the trunk ports will carry multiple VLANs across the aggregated link.

Answer

Configure the port-channel with 'channel-group 1 mode passive'.

Answer

Configure the port-channel with 'channel-group 1 mode desirable'.

Answer

Configure the port-channel with 'channel-group 1 mode on'.

Question 3

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast neighbors 10.0.1.2 advertised-routes
Network          Next Hop            Metric LocPrf Weight Path
*> 172.16.0.0/16   10.0.1.1               0    100      0 i
*> 172.16.1.0/24   10.0.1.1               0    100      0 i

Total number of prefixes 2

Based on this output, what can be concluded?

Accepted Answer

R1 is advertising 2 prefixes to neighbor 10.0.1.2.. The command 'show bgp ipv4 unicast neighbors 10.0.1.2 advertised-routes' specifically displays the routes that Router R1 is sending to the BGP neighbor at 10.0.1.2. The output shows two prefixes (172.16.0.0/16 and 172.16.1.0/24) with a next hop of 10.0.1.1 (R1's own interface), confirming these are routes R1 is advertising. Therefore, option B is correct.

Answer

R1 is receiving 2 prefixes from neighbor 10.0.1.2.

Answer

Neighbor 10.0.1.2 is advertising these routes to R1.

Answer

The routes are being advertised with a next hop of 10.0.1.2.

Question 4

A network engineer runs the following command on a Cisco WLC:

WLC# show client summary

Client MAC Address   AP Name     WLAN   State   Protocol   RSSI   SNR
00:11:22:33:44:55   AP-1       1      Run     802.11ac   -65    25
00:11:22:33:44:66   AP-2       2      Run     802.11n    -70    20
00:11:22:33:44:77   AP-1       1      Run     802.11ac   -60    30
00:11:22:33:44:88   AP-3       3      Probe   802.11ax   -75    15

Based on this output, what can be concluded?

Accepted Answer

The client with MAC 00:11:22:33:44:88 is attempting to associate but is not yet connected.. The client with MAC 00:11:22:33:44:88 is in the 'Probe' state, which indicates it has sent a probe request and is attempting to associate with the WLC, but it has not yet completed the association process or transitioned to the 'Run' state. Only clients in the 'Run' state are fully associated and passing traffic, making option B correct.

Answer

All clients are fully associated and passing traffic.

Answer

The client with MAC 00:11:22:33:44:55 has the best signal strength.

Answer

All clients are using 802.11ac or higher.

Question 5

A network team is designing an SD-Access fabric for a large enterprise. The design must support automated provisioning and policy management. Which management platform is essential for deploying and managing the fabric?

Accepted Answer

Cisco DNA Center. Cisco DNA Center is the essential management platform for deploying and managing an SD-Access fabric because it provides a centralized, intent-based interface for automating the entire fabric lifecycle, including design, provisioning, policy creation, and assurance. It integrates with Cisco ISE for policy enforcement and with network devices via APIs (e.g., NETCONF/YANG) to push configurations such as VXLAN, LISP, and CTS SGTs. Without DNA Center, the automated provisioning and policy management required for SD-Access cannot be achieved at scale.

Answer

Cisco ISE

Answer

Cisco Prime Infrastructure

Answer

Cisco vManage

Question 6

Examine the following configuration snippet on a Cisco IOS-XE router:

interface GigabitEthernet0/1
 service-policy output QOS_POLICY

policy-map QOS_POLICY
 class VOICE
  priority percent 10
 class VIDEO
  bandwidth percent 30
 class class-default
  fair-queue

What is the effect of this configuration?

Accepted Answer

VOICE traffic is guaranteed 10% of the interface bandwidth with strict priority queuing, VIDEO traffic is guaranteed 30%, and all other traffic shares the remaining bandwidth using fair-queuing.. The 'priority percent 10' command under class VOICE enables strict priority queuing, guaranteeing that VOICE traffic is served first up to 10% of the interface bandwidth. The 'bandwidth percent 30' under class VIDEO provides a minimum bandwidth guarantee of 30% during congestion. The 'fair-queue' under class-default ensures that all other traffic shares the remaining bandwidth fairly using flow-based queuing, which is the default behavior when no explicit bandwidth is configured.

Answer

VOICE traffic is limited to 10% of bandwidth, VIDEO to 30%, and all other traffic is dropped if the interface is congested.

Answer

VOICE traffic is given priority over VIDEO, but VIDEO can use up to 30% of bandwidth only if VOICE is not using its allocation.

Answer

The policy-map is invalid because 'priority' and 'bandwidth' cannot be used together in the same policy-map.

Question 7

Given the following EIGRP configuration on a router:

router eigrp 200
 network 192.168.1.0 0.0.0.255
 network 10.0.0.0

Which statement about this configuration is true?

Accepted Answer

EIGRP will be enabled on any interface with an IP address in the 10.0.0.0/8 range, and only on interfaces with an IP address in the 192.168.1.0/24 range.. The first network statement uses a wildcard mask (0.0.0.255) to enable EIGRP only on interfaces in the 192.168.1.0/24 subnet, while the second network statement (10.0.0.0) is classful and enables EIGRP on all interfaces in the 10.0.0.0/8 range. EIGRP network statements can include a wildcard mask to specify a subnet; without one, the router assumes the classful boundary.

Answer

Both network statements are classful and will enable EIGRP on all interfaces with IP addresses in the 192.168.0.0/16 and 10.0.0.0/8 ranges.

Answer

EIGRP will only be enabled on interfaces with an IP address in the 192.168.1.0/24 range.

Answer

This configuration will cause an error because wildcard masks are not allowed in EIGRP network statements.

Question 8

A Python script uses the requests library to interact with Cisco DNA Center's REST API:

import requests

url = "https://dna-center/api/v1/network-device"
headers = {
    "X-Auth-Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

response = requests.get(url, headers=headers, verify=False)
print(response.json())

What is a security concern with this script?

Accepted Answer

The script disables SSL certificate verification, making it vulnerable to man-in-the-middle attacks.. Setting `verify=False` in the `requests.get()` call disables SSL/TLS certificate validation. This means the client will not verify the identity of the Cisco DNA Center server, making the connection vulnerable to man-in-the-middle (MITM) attacks where an attacker could intercept or modify the API traffic. In production environments, certificate validation should always be enabled to ensure the authenticity of the server.

Answer

The script uses a hardcoded token, which is a security risk.

Answer

The script does not handle HTTP errors, which could expose sensitive information.

Answer

The script uses an incorrect URL; the path should be /dna/intent/api/v1/network-device.

Question 9

Router R3 has the following OSPF configuration:

router ospf 1
 router-id 3.3.3.3
 network 10.0.0.0 0.255.255.255 area 0
 default-information originate always metric 20 metric-type 2

What is the effect of the 'default-information originate always' command?

Accepted Answer

It injects a default route into OSPF unconditionally, with metric 20 and type E2.. The 'default-information originate always' command injects a default route (0.0.0.0/0) into the OSPF link-state database unconditionally, regardless of whether the router itself has a default route in its routing table. The 'always' keyword overrides the default behavior, which requires a pre-existing default route. The metric 20 and metric-type 2 (E2) are explicitly set in the command, making the injected route an external type 2 route with a seed metric of 20.

Answer

It redistributes all connected routes into OSPF.

Answer

It injects a default route into OSPF only if a default route is present in the routing table.

Answer

It sets the OSPF router ID to 3.3.3.3 and enables default route filtering.

Question 10

A data center architect is designing a virtualized environment for a latency-sensitive application. The application requires dedicated CPU cores and memory to avoid performance degradation. Which hypervisor feature should be configured to meet this requirement?

Accepted Answer

Enable CPU pinning and memory reservation for the VM.. CPU pinning binds a VM's virtual CPUs to specific physical cores, ensuring dedicated processing resources and preventing CPU contention from other VMs. Memory reservation guarantees that the specified amount of physical memory is always available to the VM, eliminating the risk of memory swapping or ballooning that would introduce latency. Together, these features provide the deterministic performance required for latency-sensitive applications in a virtualized environment.

Answer

Use a shared storage solution to reduce I/O latency.

Answer

Configure the VM with a large vNUMA node to spread memory access.

Answer

Enable memory overcommitment to maximize utilization.

Question 11

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The router experiences high CPU utilization due to SSH and SNMP traffic. The engineer creates a class-map to match SSH (TCP/22) and SNMP (UDP/161) and applies a policy-map that polices this traffic to 1 Mbps. After applying the policy, legitimate SSH sessions from the management station start dropping intermittently. What is the most likely cause?

Accepted Answer

The police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station.. The most likely cause is that the police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station. CoPP polices all traffic matching the class-map (SSH and SNMP) as a single aggregate flow. If the management station generates bursts of SSH and SNMP traffic that together exceed 1 Mbps, the policer will drop packets, causing legitimate SSH sessions to drop intermittently.

Answer

The CoPP policy is applied to the wrong interface, affecting transit traffic instead of control plane traffic.

Answer

The class-map should match on DSCP values instead of port numbers to be effective.

Answer

The policy-map should use the 'drop' action instead of 'police' to protect the control plane.

Question 12

Review the ACL configuration:

ip access-list extended TEST
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 deny ip any any
!
interface GigabitEthernet0/3
 ip access-group TEST in

What is missing or incorrect?

Accepted Answer

The deny ip any any is redundant because ACLs have an implicit deny at the end.. The `deny ip any any` line is redundant. Cisco ACLs have an implicit deny all at the end of every ACL, so adding an explicit deny is unnecessary and does not change the behavior. The configuration is otherwise valid for filtering inbound traffic on GigabitEthernet0/3.

Answer

The ACL should use a wildcard mask of 255.255.255.0 instead of 0.0.0.255.

Answer

The ACL must be applied outbound to filter incoming traffic.

Answer

The ACL should use the keyword 'established' to allow return traffic.

Question 13

Examine the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/6
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 3
 dot1x max-req 3
 dot1x timeout supp-timeout 10

What is the total time the switch will wait for a supplicant to respond before failing authentication?

Accepted Answer

9 seconds. The switch waits for a supplicant to respond to each 802.1X EAP-Request/Identity frame. With `dot1x max-req 3`, the switch sends up to 3 retransmissions. The `dot1x timeout tx-period 3` sets the interval between retransmissions to 3 seconds. Therefore, the total time before authentication fails is 3 retransmissions × 3 seconds = 9 seconds.

Answer

30 seconds

Answer

10 seconds

Answer

13 seconds

Question 14

A network engineer is using the Cisco Meraki Dashboard API to automate the creation of VLANs across multiple networks. The engineer writes a Python script that uses the 'createNetworkVlan' endpoint. The script runs successfully for the first few networks, but then starts returning HTTP 429 errors. The engineer checks the API documentation and finds that the Meraki API has rate limits. The script currently sends requests as fast as possible. What should the engineer implement to avoid hitting the rate limit?

Accepted Answer

Add a retry mechanism with exponential backoff when a 429 response is received.. HTTP 429 errors indicate rate limiting, and the standard mitigation is to implement a retry mechanism with exponential backoff. This approach respects the API's rate limits by pausing and retrying after increasing delays, allowing the script to eventually succeed without overwhelming the server. The Meraki Dashboard API documentation explicitly recommends exponential backoff for handling 429 responses.

Answer

Reduce the number of networks being processed in a single script run.

Answer

Increase the 'per-second' rate limit by setting a higher value in the API request header.

Answer

Switch to using the Meraki API version 1.0 which has no rate limits.

Question 15

An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?

Accepted Answer

Apply a shape average policy on the egress interface of the WAN edge router, setting the CIR and burst parameters to match the provider contract.. 'shape average' on the egress interface allows the router to buffer excess traffic and transmit it at the contracted CIR, while the burst parameters (Bc and Be) enable short-term bursts above CIR to accommodate real-time traffic spikes without drops. This prevents the provider's policer from discarding packets, as the shaper ensures the outbound traffic rate stays within the agreed contract limits.

Answer

Use a policer on the ingress interface to drop traffic exceeding the CIR.

Answer

Configure a shaper on the provider's device instead of the customer router.

Answer

Set the interface bandwidth to the CIR and rely on FIFO queuing.