350-401 Practice Test 4 — 10 Questions

Question 1

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Accepted Answer

HTTP and HTTPS traffic from 192.168.1.0/24. The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Answer

ICMP traffic from any source

Answer

FTP traffic from 192.168.1.0/24

Answer

SSH traffic from 192.168.1.0/24

Question 2

Which TWO STP features are used to improve convergence time after a topology change?

Accepted Answer

UplinkFast. UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Answer

Root Guard

Answer

BPDU Guard

Answer

PortFast

Question 3

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. Option B is correct because the 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 4

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Option B is correct because disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 5

A campus network uses a collapsed core design with two distribution switches and multiple access switches. The engineer wants to ensure that if one distribution switch fails, the access switches can still reach the core. The access switches are connected to both distribution switches. What additional configuration is required on the access switches?

Accepted Answer

Configure the access switches with VPC (Virtual Port Channel) to the distribution switches.. Option A is correct because VPC allows the access switches to form a single logical link to the pair of distribution switches, enabling active-active forwarding and seamless failover. If one distribution switch fails, the access switch continues to reach the core through the surviving distribution switch without requiring STP convergence or routing protocol changes.

Answer

Enable STP on the access switches and set the root bridge priority to 0.

Answer

Configure the access switches with HSRP to the distribution switches.

Answer

Use static routing with equal-cost paths from the access switches to the distribution switches.

Question 6

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 7

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Accepted Answer

VXLAN overlay with policy-based forwarding to direct traffic through VNFs. VXLAN overlay with policy-based forwarding (PBF) is the correct choice because it enables service chaining by encapsulating traffic and steering it through a sequence of VNFs based on policies, without requiring physical re-cabling. This allows dynamic insertion of new VNFs by simply updating the forwarding policies in the overlay, which is essential for NFV environments where VNFs are hosted on the same server and must be chained flexibly.

Answer

VLAN trunking between VNFs on the same hypervisor

Answer

Static routing between VNFs using dedicated interfaces

Answer

MPLS L3VPN between VNFs

Question 8

Given the following configuration:
router eigrp TEST
 network 10.0.0.0 0.255.255.255
 network 192.168.1.0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip summary-address eigrp TEST 10.0.0.0 255.0.0.0 5

What is the effect of the ip summary-address command?

Accepted Answer

It creates a summary route 10.0.0.0/8 with a metric of 5, advertised out GigabitEthernet0/0.. The `ip summary-address eigrp TEST 10.0.0.0 255.0.0.0 5` command creates a summary route of 10.0.0.0/8 with an administrative distance of 5, which is advertised out of GigabitEthernet0/0. The EIGRP process name TEST matches the router eigrp configuration, and the summary is generated regardless of the network statements, as long as the router has a more specific route within the summarized range.

Answer

It creates a summary route 10.0.0.0/8 with a metric of 5, but only for the EIGRP process named TEST.

Answer

It creates a summary route 10.0.0.0/8 with a hop count of 5.

Answer

The command is invalid because the summary address must match the network statement exactly.

Question 9

Drag and drop the steps of the PPDIOO network lifecycle into the correct order, from first to last.

Accepted Answer

Prepare: Define network requirements and strategy. The PPDIOO lifecycle defines six phases: Prepare, Plan, Design, Implement, Operate, and Optimize. This order ensures a structured approach from initial requirements gathering through ongoing improvement.

Question 10

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Accepted Answer

Design access layer with VLANs and port security. The hierarchical design process starts with access layer connectivity, then moves to distribution layer aggregation, core layer transport, and finally WAN edge integration. This layered approach optimizes scalability and performance.

350-401 Practice Test 4 — 10 Questions

Exhibit

350-401 Practice Test 4 — 10 Questions

Exhibit