350-401 Practice Test 38 — 15 Questions

Question 1

A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?

Accepted Answer

Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.. The correct answer adds an ACL entry to permit SSH from the management subnet before the deny statement, ensuring that SSH traffic is matched by the CoPP policy and not dropped. Option B is incorrect because removing the deny statement would leave the control plane unprotected. Option C is incorrect because increasing the police rate might not resolve the issue if the traffic is being dropped by an ACL deny. Option D is incorrect because removing the CoPP policy entirely removes all protection.

Answer

Remove the deny statement from the CoPP ACL to allow all traffic.

Answer

Increase the police rate for the CoPP class that matches SSH traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Question 2

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy is using a conform-action of drop, which drops all traffic that matches the class, regardless of rate. Option B is incorrect because the police rate is not exceeded. Option C is incorrect because DSCP AF41 is a valid value. Option D is incorrect because CoPP does not require a specific queue; it uses policing.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The DSCP value AF41 is not supported on Nexus switches.

Answer

The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.

Question 3

Given this configuration:

aaa new-model
aaa authentication login default group radius
aaa authorization exec default group radius
aaa accounting exec default start-stop group radius
radius-server host 192.168.1.1 auth-port 1645 acct-port 1646 key radiuskey
radius-server host 192.168.1.2 auth-port 1645 acct-port 1646 key radiuskey

Which statement is true about the RADIUS server ports?

Accepted Answer

The RADIUS authentication port is 1645 and accounting port is 1646.. RADIUS traditionally uses UDP port 1812 for authentication and 1813 for accounting, but older implementations use 1645 and 1646. The configuration explicitly sets these ports, which is valid but non-standard.

Answer

The RADIUS authentication port is 1812 and accounting port is 1813.

Answer

The RADIUS authentication port is 1646 and accounting port is 1645.

Answer

The RADIUS ports are not configurable; this command will be rejected.

Question 4

What is the purpose of the 'aaa authorization exec default local' command?

Accepted Answer

It authorizes exec sessions using the local database, determining if a user can start a shell and their privilege level.. This command authorizes exec (shell) sessions using the local user database. It determines whether a user is allowed to start an exec session and what privilege level they receive.

Answer

It authenticates users for exec access using the local database.

Answer

It enables accounting for exec commands to the local database.

Answer

It sets the privilege level for all users to 15.

Question 5

Drag and drop the steps of the TACACS+ authentication process into the correct order, from first to last.

Accepted Answer

Client sends START packet to TACACS+ server. TACACS+ uses TCP and encrypts the entire packet. It separates authentication, authorization, and accounting. The server sends a GETUSERNAME prompt first, then GETPASSWORD, and finally an ACCEPT or REJECT.

Question 6

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Accepted Answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.. The correct answer is that the CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. Option B is incorrect because the ACL is not mentioned as blocking ICMP. Option C is incorrect because the monitoring server is not the source of the issue; it is the target. Option D is incorrect because the switch's CPU is not necessarily overloaded; the drops are due to CoPP policing.

Answer

An ACL applied to the management interface is blocking ICMP from the monitoring server.

Answer

The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.

Answer

The switch's CPU is overloaded, causing CoPP to drop all packets.

Question 7

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Accepted Answer

Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.. The correct answer is to modify the CoPP ACL to permit SNMP from the NMS before the deny statement, ensuring that the traffic is matched and permitted. Option B is incorrect because increasing the police rate might not help if the traffic is being denied by an ACL. Option C is incorrect because removing the CoPP policy removes all protection. Option D is incorrect because changing the SNMP port would require reconfiguring the NMS.

Answer

Increase the police rate for the CoPP class that matches SNMP traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Answer

Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

Question 8

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Accepted Answer

The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.. The correct answer is that the ACL only matches traffic from the specific peer, but CoPP class-maps match traffic based on the ACL; if the ACL denies other BGP traffic, CoPP will not match it, and it will be processed by the default class, which may permit it. Option B is incorrect because the ACL order is not the issue. Option C is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because CoPP does not affect routing protocol sessions directly; it only polices traffic to the control plane.

Answer

The ACL is applied in the wrong order; the deny statement should be before the permit statement.

Answer

BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

Answer

CoPP does not affect BGP sessions because they are established before the policy is applied.

Question 9

A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?

Accepted Answer

The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.. The correct answer is that the ACL only filters traffic entering the interface; ping traffic is also entering the interface, but the ACL permits only HTTP, so ping should be denied. However, if the ACL is applied inbound, it should block ping. The most likely reason is that the ACL is applied outbound on the interface, not inbound. Option B is incorrect because the ACL order is correct. Option C is incorrect because ICMP is not HTTP. Option D is incorrect because the ACL is applied to the interface, not the subnet.

Answer

The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.

Answer

The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.

Answer

The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.

Question 10

A network engineer is troubleshooting a connectivity issue between two VLANs on a Cisco Catalyst 3850 switch. The switch has an ACL applied to VLAN 10 that permits traffic from VLAN 20 to VLAN 10, but denies all other traffic. Hosts in VLAN 20 can ping hosts in VLAN 10, but not vice versa. The engineer checks the ACL and finds that it is applied inbound on VLAN 10. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 10, so it only filters traffic entering VLAN 10, not traffic leaving VLAN 10.. The correct answer is that the ACL is applied inbound on VLAN 10, so it filters traffic entering VLAN 10; traffic from VLAN 20 to VLAN 10 is permitted, but traffic from VLAN 10 to VLAN 20 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the VLAN, not the SVI. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 10, so it filters traffic leaving VLAN 10, preventing replies.

Answer

The ACL is applied to the SVI for VLAN 10, but the hosts are in VLAN 10, so the ACL does not apply.

Answer

The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.

Question 11

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy has a conform-action of drop, which drops all traffic matching the class, regardless of rate. Option B is incorrect because the traffic rate is below the police rate. Option C is incorrect because the ACL permits SSH from the management subnet. Option D is incorrect because the CoPP policy is applied to the control plane, not an interface.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The ACL is denying SSH traffic from the management subnet.

Answer

The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.

Question 12

A network engineer is troubleshooting an issue where a Cisco router is not forwarding traffic between two VLANs. The router has an ACL applied to the subinterface for VLAN 100 that permits traffic from VLAN 200 to VLAN 100, but denies all other traffic. Hosts in VLAN 200 can ping hosts in VLAN 100, but hosts in VLAN 100 cannot ping hosts in VLAN 200. The engineer checks the ACL and finds that it is applied inbound on the subinterface for VLAN 100. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 100, so it only filters traffic entering VLAN 100, not traffic leaving VLAN 100.. The correct answer is that the ACL is applied inbound on VLAN 100, so it filters traffic entering VLAN 100; traffic from VLAN 200 to VLAN 100 is permitted, but traffic from VLAN 100 to VLAN 200 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the subinterface, not the VLAN. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 100, so it filters traffic leaving VLAN 100, preventing replies.

Answer

The ACL is applied to the wrong subinterface; it should be applied to the subinterface for VLAN 200.

Answer

The ACL is blocking ICMP echo replies from VLAN 100 to VLAN 200.

Question 13

A network engineer runs the following command on Router R1:

R1# show access-lists
Extended IP access list 101
    10 permit tcp host 10.1.1.1 host 192.168.1.100 eq 80 (4 matches)
    20 deny tcp any host 192.168.1.100 eq 80 (12 matches)
    30 permit ip any any (8 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.. ACL 101 has three entries. The first permits HTTP from a specific host, the second denies HTTP from any source to that host, and the third permits all other IP traffic. The match counts show that 4 packets matched the permit, 12 matched the deny, and 8 matched the final permit. The correct answer is that HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.

Answer

All HTTP traffic to 192.168.1.100 is denied.

Answer

All traffic from 10.1.1.1 to 192.168.1.100 is permitted.

Answer

The ACL is applied inbound on an interface.

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: ICMP-CLASS (match-all)
      10 packets, 1000 bytes
      5 minute offered rate 0 bps
      Match: access-group name ICMP-ACL
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 10 packets, 1000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SSH-CLASS (match-all)
      5 packets, 500 bytes
      5 minute offered rate 0 bps
      Match: access-group name SSH-ACL
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 5 packets, 500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      20 packets, 2000 bytes
      5 minute offered rate 0 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 20 packets, 2000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.. The output shows a CoPP policy applied to the control plane. The ICMP class has a CIR of 8 kbps, and all 10 ICMP packets conformed. The SSH class has a higher CIR of 16 kbps. The class-default has a CIR of 64 kbps. The correct answer is that ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.

Answer

SSH traffic to the control plane is being dropped because it exceeds the CIR.

Answer

The control-plane policy is applied in the output direction.

Answer

All traffic to the control plane is rate-limited to 64 kbps.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/0 | include access list
  Inbound  access list is 101
  Outbound access list is not set

R1# show access-lists 101
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 80 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from sources outside 192.168.1.0/24 is denied.. ACL 101 is applied inbound on GigabitEthernet0/0. It permits HTTP from subnet 192.168.1.0/24 to any destination, denies all other HTTP, and permits all other IP traffic. The match counts show 100 HTTP packets from the subnet, 50 denied HTTP packets from other sources, and 200 other packets permitted. The correct answer is that HTTP traffic from sources outside 192.168.1.0/24 is denied.

Answer

All HTTP traffic is permitted.

Answer

The ACL is applied outbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.