350-401 Practice Test 4 — 10 Questions

Question 1

Consider the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 2 source interface GigabitEthernet1/0/3 rx
monitor session 2 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Only traffic received on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.. The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/3 is copied to GigabitEthernet1/0/4.

Answer

Traffic on GigabitEthernet1/0/4 is mirrored to GigabitEthernet1/0/3.

Answer

The configuration is invalid because the destination interface must be in trunk mode.

Question 2

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 3

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. If the client and the router's DHCP server interface are on different VLANs (i.e., different subnets), the DHCP discover broadcast will not cross the Layer 3 boundary unless the router interface has an ip helper-address configured. The ip helper-address command enables the router to convert the broadcast DHCP discover into a unicast and forward it to the DHCP server. Without it, the client's broadcast never reaches the server, even if the DHCP pool is correctly defined.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 4

A network engineer is configuring a Cisco switch for 802.1X port-based authentication. The switch is configured with a RADIUS server for authentication. The engineer wants to allow devices that fail 802.1X authentication to still access a limited guest VLAN. The engineer configures 'authentication port-control auto' and 'authentication host-mode multi-host' on the interface. However, when a non-802.1X-capable device is connected, the port remains in the unauthorized state and does not fall into the guest VLAN. What is missing?

Accepted Answer

The interface needs the 'authentication guest-vlan ' command to specify the VLAN for non-802.1X devices.. The 'authentication guest-vlan ' command is missing. This command explicitly defines the VLAN to which the port will assign devices that fail 802.1X authentication or are non-802.1X-capable. Without it, the switch has no configured fallback VLAN, so the port remains in the unauthorized state even with 'authentication port-control auto' and 'authentication host-mode multi-host' configured.

Answer

The switch must have 'aaa authentication dot1x default group radius' configured globally.

Answer

The 'authentication host-mode multi-host' command should be replaced with 'authentication host-mode multi-domain' to support guest VLAN.

Answer

The port must be configured as a trunk port to allow the guest VLAN.

Question 5

interface GigabitEthernet0/2
 spanning-tree link-type point-to-point
 end

What is the effect of this configuration?

Accepted Answer

The port will use RSTP fast transition mechanisms assuming a point-to-point link.. The `spanning-tree link-type point-to-point` command manually overrides the port's link type to point-to-point, forcing the port to use Rapid Spanning Tree Protocol (RSTP) fast transition mechanisms (proposal/agreement handshake) instead of the slower 802.1D listening/learning states. This is correct because RSTP relies on the link type to determine whether it can safely perform a fast transition to the forwarding state; a point-to-point link allows immediate transition without waiting for timers.

Answer

The port will become a designated port immediately.

Answer

The port will disable STP on that link.

Answer

The port will use shared medium behavior.

Question 6

Given the following SNMPv3 configuration on a Cisco IOS-XE router:

snmp-server group ADMIN v3 priv write ADMINVIEW
snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456
snmp-server view ADMINVIEW iso included

What is missing or incorrect in this configuration?

Accepted Answer

The view 'ADMINVIEW' includes the entire ISO tree, which might be too permissive for a restricted write view.. The view 'ADMINVIEW' is configured with 'iso included', which includes the entire ISO OID tree. This grants write access to all MIB objects, which is overly permissive for a restricted write view. In SNMPv3, a write view should be limited to specific OIDs or subtrees to enforce least privilege, and including the entire ISO tree violates that principle. Option D is incorrect because a read view is not required if the group is only intended for write operations. The configuration as shown only specifies a write view, which is sufficient for SNMP set operations. Adding a read view is optional and not a mandatory missing piece.

Answer

The SNMPv3 user 'admin' must also specify an engine ID for the router.

Answer

The privacy password 'cisco456' must be at least 8 characters long.

Answer

The group 'ADMIN' must be configured with a read view to allow SNMP get operations.

Question 7

A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is correct because it combines strict priority queuing with CBWFQ, ensuring that voice traffic (marked with EF or CS5) is dequeued before any other traffic class. This strict priority mechanism guarantees the lowest possible latency for real-time traffic, as packets in the priority queue are always transmitted first, regardless of congestion on the WAN link.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO)

Question 8

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. In a PPPoE setup, the dialer interface typically obtains its IP address dynamically from the ISP via IPCP (IP Control Protocol) during PPP negotiation. If IPCP fails or is not configured to negotiate an address, the dialer interface remains unnumbered or without a usable IP address. Even though the PPPoE session is established and a default route exists, the router cannot route traffic because it lacks a valid source IP address on the dialer interface to send packets to the ISP's gateway.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.

Question 9

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not advertising EVPN routes for a specific VNI. The NVE interface is up, and the VNI is configured. Which action should the engineer take to verify that the VNI is properly associated with the EVPN control plane?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' to see if the VNI is advertised in the EVPN address family.. To verify that a VNI is properly associated with the EVPN control plane, the engineer should check the BGP EVPN table using 'show bgp l2vpn evpn'. This command displays EVPN routes, including those for the VNI. If the VNI is not advertised, it indicates a configuration issue in the EVPN address family or BGP. Other commands like 'show nve vni' or 'show interface nve1' do not directly show EVPN route advertisement.

Answer

Check the output of 'show vlan id 10' to see if VLAN 10 is active and mapped to the VNI.

Answer

Check the output of 'show interface nve1' to verify that the NVE interface is operational.

Answer

Check the output of 'show nve vni' to see if the VNI is up and associated with the NVE interface.

Question 10

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

Accepted Answer

The interface bandwidth command is not set to 50000 kbps. The bandwidth percent command allocates a percentage of the interface bandwidth, which by default is derived from the physical interface speed. On a Cisco ASR 1000, if the interface bandwidth is not manually set to 50000 kbps, the router may use a different default value (e.g., 1000000 kbps for Ethernet), causing the bandwidth percent to allocate a much larger absolute amount than intended. This leads to incorrect bandwidth guarantees, such as voice not receiving its required 10 Mbps during congestion.

Answer

The voice class should use priority instead of bandwidth

Answer

The video class should use bandwidth remaining percent

Answer

The policy map is applied in the input direction