350-401 Practice Test 39 — 15 Questions

Question 1

Consider the following configuration:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0

Which statement is true about this EIGRP configuration?

Accepted Answer

EIGRP will send and receive updates only on GigabitEthernet0/0.. The `passive-interface default` command sets all interfaces to passive by default, preventing EIGRP from sending or receiving hello packets (and thus updates) on them. The `no passive-interface GigabitEthernet0/0` command then overrides this default for that specific interface, allowing EIGRP to send and receive updates only on GigabitEthernet0/0. The network statement 10.0.0.0 0.255.255.255 enables EIGRP on any interface matching the 10.0.0.0/8 range, but the passive-interface logic restricts actual adjacency formation.

Answer

EIGRP will send updates on all interfaces except GigabitEthernet0/0.

Answer

EIGRP will not send any updates because the network statement is incorrect.

Answer

EIGRP will form adjacencies on all interfaces that have an IP address in the 10.0.0.0/8 range.

Question 2

A network engineer issues the following command on Router R2:

R2# show ip ospf interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.2/24, Area 0
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 2, Adjacent neighbor count is 2
    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)
    Adjacent with neighbor 3.3.3.3

Based on this output, what can be concluded?

Accepted Answer

R2 has a full OSPF adjacency with all neighbors on this segment.. The output shows that R2 is the Designated Router (DR) on this broadcast segment, with two neighbors listed: 1.1.1.1 (BDR) and 3.3.3.3. The 'Adjacent neighbor count is 2' and both neighbors are listed as 'Adjacent with neighbor', confirming that R2 has formed full OSPF adjacencies with all neighbors on this segment. In OSPF broadcast networks, only the DR and BDR form full adjacencies with all routers, while non-DR/BDR routers only form full adjacencies with the DR and BDR.

Answer

R2 is the Backup Designated Router on this segment.

Answer

The OSPF cost to reach the network 192.168.1.0/24 is 20.

Answer

R2 will send hello packets every 40 seconds.

Question 3

An engineer notices that syslog messages from a Cisco router are not timestamped correctly. The router is configured with 'service timestamps log datetime msec' and 'logging host 10.1.1.1'. The syslog server shows messages with the correct time but the local logs on the router show incorrect timestamps. What is the most likely cause?

Accepted Answer

The router's system clock is not synchronized via NTP or manual setting.. The 'service timestamps log datetime msec' command tells the router to include a timestamp in syslog messages, but the timestamp is derived from the router's system clock. If the clock is not synchronized via NTP or manually set, the local logs will show incorrect timestamps. The syslog server, however, receives the messages and applies its own timestamp upon receipt, which is why the server shows the correct time. Therefore, the mismatch is caused by the router's unsynchronized clock.

Answer

The 'service timestamps log datetime msec' command is not supported on this platform.

Answer

The syslog server is overwriting the timestamps.

Answer

The 'logging host' command must include the 'transport tcp' option.

Question 4

A network engineer issues the following command on Router R3:

R3# show ip sla statistics 2

Round Trip Time (RTT) for Index 2
Latest RTT: 12 ms
Latest RTT: NoConnection/Busy/Timeout
Latest Operation Start Time: 12:00:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: Timeout
Number of successes: 45
Number of failures: 5
Over thresholds: 0

Based on this output, what is the most likely issue?

Accepted Answer

The most recent probe timed out, indicating a possible connectivity issue.. The output shows a 'Latest Operation Return Code: Timeout' for the most recent probe, while the 'Number of successes: 45' and 'Number of failures: 5' indicate that the IP SLA operation has historically succeeded. This combination points to a transient or intermittent connectivity issue causing the latest probe to time out, not a persistent failure. Option C correctly identifies that the most recent probe timed out, suggesting a possible connectivity issue at that moment.

Answer

The IP SLA operation has never succeeded.

Answer

The target is unreachable due to a persistent failure.

Answer

The round-trip time is 12 ms, which is above the threshold.

Question 5

Consider the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet0/3
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 1

What is the effect of this configuration?

Accepted Answer

The interface will operate as an 802.1Q trunk, and untagged frames will be associated with VLAN 1.. The configuration sets the interface to 802.1Q trunking mode and explicitly defines VLAN 1 as the native VLAN. On an 802.1Q trunk, the native VLAN is the VLAN to which untagged frames are assigned when received on the trunk port. Since VLAN 1 is the default native VLAN and is explicitly configured here, untagged frames will be associated with VLAN 1, allowing them to traverse the trunk without an 802.1Q tag.

Answer

The interface will operate as an ISL trunk.

Answer

The interface will drop all untagged frames.

Answer

The interface will only forward traffic for VLAN 1.

Question 6

What is the default native VLAN on a Cisco switch trunk port?

Accepted Answer

VLAN 1. The default native VLAN on a Cisco switch trunk port is VLAN 1. The native VLAN is the VLAN that carries untagged traffic over a trunk link, and by default, all switch ports (including trunk ports) belong to VLAN 1. This is defined in the IEEE 802.1Q standard, which specifies that frames on the native VLAN are not tagged with a VLAN ID.

Answer

VLAN 0

Answer

VLAN 1002

Answer

VLAN 4095

Question 7

A network engineer is troubleshooting an automated configuration change that caused a routing loop. The change was pushed via an Ansible playbook that modified OSPF cost values on multiple routers simultaneously. What is the most likely reason for the loop?

Accepted Answer

The changes were applied simultaneously without allowing OSPF to converge between updates. Applying OSPF cost changes simultaneously on multiple routers without allowing convergence between updates can cause transient routing loops. OSPF relies on the SPF algorithm to calculate loop-free paths based on consistent link-state databases across the network. When costs are changed on multiple routers at once, some routers may have outdated LSAs, leading to inconsistent forwarding tables and temporary loops until all routers reconverge.

Answer

OSPF does not support changing costs on multiple routers at the same time

Answer

OSPF uses hop count as a metric, and the changes caused a count-to-infinity issue

Answer

The OSPF cost values were changed to non-standard values that OSPF cannot process

Question 8

An architect is designing a QoS policy for a campus LAN that must support real-time voice and video traffic alongside mission-critical data. The design must use the DiffServ model with consistent per-hop behavior across all switches. Which approach should the architect choose to ensure that voice traffic receives priority queuing while video traffic is guaranteed bandwidth without starving other classes?

Accepted Answer

Use the MQC framework to classify traffic based on DSCP markings, apply a priority queue for EF traffic, and allocate a minimum bandwidth guarantee for AF41 traffic.. It uses the Modular QoS CLI (MQC) framework to classify traffic by DSCP markings, which aligns with the DiffServ model's per-hop behavior consistency. By applying a strict priority queue for EF (Expedited Forwarding, DSCP 46) traffic, voice gets low-latency treatment, while a minimum bandwidth guarantee for AF41 (Assured Forwarding, DSCP 34) ensures video traffic receives a guaranteed share without starving other classes, as AF uses weighted fair queuing with bandwidth allocation.

Answer

Implement a single FIFO queue on all interfaces and rely on the default CoS-to-queue mapping to prioritize voice.

Answer

Configure strict priority queuing for all traffic marked with DSCP values greater than 0.

Answer

Use the IntServ model with RSVP to reserve bandwidth for each voice and video flow.

Question 9

Consider the following configuration on a Cisco IOS-XE router:
```
ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any
!
line vty 0 4
 access-class BLOCK_SSH in
```
Which statement is true about this configuration?

Accepted Answer

The ACL blocks all SSH traffic to the router, but permits other IP traffic.. The `access-class` command applied to the VTY lines filters inbound Telnet/SSH traffic destined to the router itself. The ACL `BLOCK_SSH` explicitly denies TCP traffic to port 22 (SSH) and permits all other IP traffic. Therefore, SSH connections to the router are blocked, while other IP traffic (e.g., HTTP, SNMP) is allowed. Option A correctly describes this behavior.

Answer

The ACL blocks all traffic to the router because the deny statement is first.

Answer

The ACL only filters traffic going through the router, not destined to it.

Answer

The ACL permits SSH traffic because the permit statement overrides the deny.

Question 10

Given the following Ansible playbook snippet:
---
- name: Configure OSPF
  hosts: routers
  gather_facts: no
  tasks:
    - name: OSPF config
      ios_config:
        lines:
          - router ospf 1
          - network 10.0.0.0 0.255.255.255 area 0
        parents: router ospf 1
What is wrong with this playbook?

Accepted Answer

The 'parents' parameter should not be used with 'router ospf 1' in lines; it causes a configuration error.. The `parents` parameter in the `ios_config` module specifies the parent configuration mode under which the `lines` should be applied. When `lines` already includes `router ospf 1`, using `parents: router ospf 1` causes Ansible to attempt entering the OSPF router configuration mode twice, leading to a configuration error. The correct approach is to either omit the `parents` parameter or include only the network statement in `lines` with the appropriate parent.

Answer

The network statement uses a wildcard mask instead of subnet mask, which is incorrect.

Answer

The OSPF process ID must be 1, but it can be any number.

Answer

There is no error; the playbook works correctly.

Question 11

A network engineer runs the following command on Router R1:

R1# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 15625 be 15625
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 10000 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 100/10000

Based on this output, what can be concluded?

Accepted Answer

Voice traffic is not being classified because no packets match the VOICE class.. The output shows 0 packets matched for the VOICE class, meaning no traffic has been classified as voice despite the policy being configured. The police action is configured but never triggered because no packets match the class. Therefore, the correct conclusion is that voice traffic is not being classified.

Answer

Voice traffic is being marked with DSCP EF and is being policed at 1 Mbps.

Answer

All traffic is being dropped due to the police action.

Answer

The policy-map is applied in the input direction.

Question 12

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Accepted Answer

Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.. ERSPAN (Encapsulated Remote SPAN) is used to send mirrored traffic across a routed network by encapsulating the mirrored packets in GRE (Generic Routing Encapsulation) and sending them to a destination IP address. Option A correctly configures an ERSPAN source session with 'monitor session 1 type erspan-source', specifies the source VLAN 100, and sets the destination IP address of the monitoring station (192.168.1.100), which allows the traffic to traverse Layer 3 boundaries.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.

Question 13

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Accepted Answer

The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.. When SR-IOV is enabled on a physical NIC, the Physical Function (PF) is shared between the host management network and the Virtual Functions (VFs). If the PF is used for the host management network, enabling SR-IOV can disrupt the PF's driver or configuration, causing the management network to become unreachable. This is a common misconfiguration where the same NIC is used for both management and SR-IOV VFs.

Answer

The VM's VF is using the same MAC address as the host management interface.

Answer

The ESXi host requires a dedicated physical NIC for management when using SR-IOV.

Answer

The VM's VF is consuming all available bandwidth on the NIC.

Question 14

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.

Question 15

A network engineer runs the following command on Router R5:

R5# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.20:1234    10.0.0.20:1234     203.0.113.1:53     203.0.113.1:53
tcp 192.0.2.20:5678    10.0.0.20:5678     198.51.100.1:80    198.51.100.1:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT) for multiple sessions from the same internal host.. The output shows two different translations (UDP and TCP) for the same inside local address 10.0.0.20, both using the same inside global address 192.0.2.20 but with different port numbers (1234 and 5678). This is characteristic of Port Address Translation (PAT), also known as NAT overload, where a single public IP address is shared among multiple sessions from the same internal host by multiplexing on the transport layer port. Option B correctly identifies this behavior.

Answer

The router is configured with static NAT for two internal hosts.

Answer

The router is performing destination NAT.

Answer

The inside local address 10.0.0.20 is using two different global addresses.