350-401 Practice Test 40 — 15 Questions

Question 1

A network engineer uses Netmiko to connect to multiple Cisco IOS XE devices and execute commands. The script runs correctly for most devices but fails for one device with the error: 'ValueError: SSH session not active'. The device is reachable and SSH credentials are correct. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device's SSH server is not fully initialized. The error 'ValueError: SSH session not active' indicates that Netmiko attempted to establish an SSH connection but the session was not fully active. The most likely cause is that the device's SSH server is not fully initialized, which can happen if the device is still booting or the SSH process has not completed startup. This is distinct from reachability or credential issues, as the device responds to pings but the SSH daemon is not ready to accept connections.

Answer

The connection timeout is set too low

Answer

The device has reached the maximum number of SSH sessions

Answer

The device requires an enable password but none was provided

Question 2

A network engineer is configuring OSPF on a router that has multiple interfaces in the same area. The engineer wants to ensure that the router does not become the designated router (DR) on any of these interfaces. What should the engineer do?

Accepted Answer

Set the OSPF priority to 0 on all interfaces.. Setting the OSPF priority to 0 on all interfaces prevents the router from participating in the DR/BDR election process. A router with priority 0 will never become the DR or BDR on any segment, regardless of its Router ID or other factors. This is the only method that guarantees the router will not be elected as DR on any interface.

Answer

Configure the OSPF network type as point-to-point on all interfaces.

Answer

Use the 'ip ospf dr-priority' command to set a high priority on other routers.

Answer

Configure the router as an ABR.

Question 3

A network engineer runs the following command on switch SW2:

SW2# show cts role-based sgt-map

Active IPv4-SGT Mapping Table:
IP Address       SGT
192.168.1.10     10
192.168.1.20     20
192.168.1.30     30

Total number of entries: 3

Based on this output, what can be concluded?

Accepted Answer

The switch maintains a mapping table that associates IP addresses with SGTs for TrustSec policy enforcement.. The command 'show cts role-based sgt-map' displays the active IPv4-to-SGT mapping table that the switch uses for Cisco TrustSec policy enforcement. This table is dynamically populated or statically configured to associate IP addresses with Security Group Tags (SGTs), which are then used to apply role-based access control. The output confirms the switch maintains this mapping, making option C correct.

Answer

The switch is using 802.1X to assign SGTs to endpoints.

Answer

The switch has a static mapping of IP addresses to SGTs.

Answer

The switch is using MAB to assign SGTs to endpoints.

Question 4

Review the following DHCP relay configuration:
```
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip helper-address 172.16.1.100
```
What is the effect of the 'ip helper-address' command?

Accepted Answer

It forwards DHCP requests from VLAN 10 to the DHCP server at 172.16.1.100.. The 'ip helper-address' command configures the router to act as a DHCP relay agent. It intercepts DHCP broadcast requests from clients on VLAN 10 (subnet 192.168.10.0/24) and unicasts them to the specified DHCP server at 172.16.1.100, allowing the server to assign an IP address from a different subnet. This is defined in RFC 1542 and is essential for centralized DHCP services across multiple VLANs.

Answer

It configures the router as a DHCP server for VLAN 10.

Answer

It translates the source IP of DHCP requests to 192.168.10.1.

Answer

It blocks DHCP traffic from VLAN 10.

Question 5

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Accepted Answer

Google Protocol Buffers (GPB) encoding.. Google Protocol Buffers (GPB) is the correct encoding because it provides a compact, binary serialization format that minimizes bandwidth and CPU overhead, making it ideal for high-volume streaming telemetry. Cisco IOS-XE devices support GPB encoding natively for model-driven telemetry, allowing efficient data transmission to analytics platforms like Kafka.

Answer

JSON encoding.

Answer

XML encoding.

Answer

CSV encoding.

Question 6

A network engineer issues the following command on Router R3:

R3# show ip bgp summary
BGP router identifier 10.0.0.3, local AS number 65003
BGP table version is 12345, main routing table version 12345
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65001   12345   12345    12345    0    0 1w2d        150
192.168.1.2     4        65002   12345   12345    12345    0    0 2w0d        200

Based on this output, what can be concluded?

Accepted Answer

Router R3 has received a total of 350 prefixes from its BGP neighbors.. The 'State/PfxRcd' column shows the number of prefixes received from each neighbor. Router R3 has received 150 prefixes from 192.168.1.1 and 200 prefixes from 192.168.1.2, totaling 350 prefixes. This confirms that both BGP sessions are established and exchanging routes.

Answer

Both BGP neighbors are in the 'Idle' state.

Answer

The BGP session with 192.168.1.1 is down.

Answer

Router R3 is in AS 65001.

Question 7

A network team is designing the underlay for an SD-Access fabric. The design must use a routing protocol that supports fast convergence and is commonly recommended for the fabric underlay. Which routing protocol should be used?

Accepted Answer

IS-IS. IS-IS is the correct choice because it is a link-state routing protocol that provides fast convergence, is highly scalable, and is the most commonly recommended routing protocol for the underlay of an SD-Access fabric. Cisco SD-Access designs frequently use IS-IS to support the fabric's control plane and data plane requirements, leveraging its ability to handle large, flat network topologies with minimal overhead.

Answer

RIP

Answer

EIGRP

Answer

BGP

Question 8

Given the following configuration on a Cisco IOS router:

policy-map SHAPE
 class class-default
  shape average 1000000

interface Serial0/0/0
 service-policy output SHAPE

What is the effect of this configuration?

Accepted Answer

The router will limit the transmit rate on Serial0/0/0 to an average of 1 Mbps by queuing excess packets.. The configuration applies a shaping policy to the Serial0/0/0 interface, which limits the transmit rate to an average of 1 Mbps. Shaping works by queuing excess packets that exceed the configured rate, smoothing the traffic burst and preventing packet loss due to interface congestion. This is why Option A is correct.

Answer

The router will drop any traffic exceeding 1 Mbps on Serial0/0/0.

Answer

The router will mark all traffic with a rate limit of 1 Mbps but not enforce it.

Answer

The configuration is invalid because 'shape average' requires a class-map with a match statement.

Question 9

Consider the following configuration:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface GigabitEthernet0/2
 ip access-group BLOCK_TELNET out

Which statement is true?

Accepted Answer

Telnet traffic leaving GigabitEthernet0/2 is blocked.. The ACL BLOCK_TELNET is applied to interface GigabitEthernet0/2 in the outbound direction using the 'ip access-group BLOCK_TELNET out' command. The ACL denies TCP traffic destined for port 23 (Telnet) and permits all other IP traffic. Since it is applied outbound, it filters traffic leaving the interface, meaning Telnet sessions initiated from the device or passing through the interface outbound will be blocked. Option B correctly states that Telnet traffic leaving GigabitEthernet0/2 is blocked.

Answer

Telnet traffic entering GigabitEthernet0/2 is blocked.

Answer

All outbound traffic is blocked.

Answer

The ACL is incorrectly applied; only named ACLs can be applied outbound.

Question 10

A network engineer writes the following Ansible playbook to configure an interface on a Cisco IOS-XE device:

---
- hosts: routers
  gather_facts: no
  tasks:
    - name: Configure interface
      cisco.ios.ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
        parents: interface GigabitEthernet0/1

What is the issue with this playbook?

Accepted Answer

The playbook will fail because the 'cisco.ios.ios_config' module requires the 'connection: network_cli' parameter in the play or inventory.. The 'cisco.ios.ios_config' module requires the connection type to be set to 'network_cli' (or 'ansible.netcommon.network_cli') in the play or inventory, because it uses a persistent SSH connection to send CLI commands to the device. Without this setting, Ansible defaults to the 'smart' connection plugin, which does not support the network-specific module's requirements, causing the playbook to fail.

Answer

The playbook will work correctly because the module automatically detects the device type.

Answer

The playbook will fail because 'cisco.ios.ios_config' is not a valid module name.

Answer

The playbook will work but only if the device is running IOS-XE 16.9 or later.

Question 11

A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS. The engineer uses 'snmp-server community public RO' and 'snmp-server host 10.1.1.1 version 2c public'. The NMS receives traps, but the engineer notices that the traps contain the IP address of the management interface (VLAN 1) instead of the loopback interface (Loopback0) that is used for management. The engineer wants the traps to use the loopback IP as the source. What should the engineer do?

Accepted Answer

Configure 'snmp-server trap-source Loopback0'.. The correct command to set the source IP address for SNMP traps on a Cisco device is 'snmp-server trap-source Loopback0'. This command forces all SNMP trap messages to use the IP address of the specified interface as the source, regardless of which interface they exit. Option B is correct because it directly configures the trap source to the loopback interface, ensuring the NMS sees the loopback IP instead of the VLAN 1 management IP.

Answer

Configure 'snmp-server source-interface traps Loopback0'.

Answer

Configure 'ip snmp source-interface Loopback0'.

Answer

Change the management interface IP to match the loopback.

Question 12

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
	TCP connection: 10.0.0.2.646 - 10.0.0.1.49231
	State: Oper; Msgs sent/rcvd: 100/95; Downstream
	Up time: 01:23:45
	LDP discovery sources:
	  GigabitEthernet0/0, Src IP addr: 192.168.1.2
        	Addresses bound to peer LDP Ident:
        	  10.0.0.2        192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is using TCP port 646.. The output shows 'TCP connection: 10.0.0.2.646 - 10.0.0.1.49231', which indicates that the LDP session is using TCP port 646 on the peer side. This is the well-known port for Label Distribution Protocol (LDP), as defined in RFC 5036. The session state is 'Oper' (Operational), confirming the session is established and functioning correctly.

Answer

The LDP session is not yet established.

Answer

The LDP neighbor is using a different router ID than 10.0.0.2.

Answer

The LDP session has been up for 1 hour 23 minutes.

Question 13

What is the default OSPF reference bandwidth used for cost calculation in Cisco IOS?

Accepted Answer

100 Mbps. In Cisco IOS, the default OSPF reference bandwidth is 100 Mbps. OSPF calculates the cost of an interface as the reference bandwidth divided by the interface bandwidth. With the default reference of 100 Mbps, a FastEthernet (100 Mbps) interface gets a cost of 1, which is the minimum cost. This default was established when FastEthernet was considered high-speed, but it can be changed using the 'auto-cost reference-bandwidth' command to accommodate faster links like GigabitEthernet.

Answer

1000 Mbps

Answer

10 Mbps

Answer

1 Mbps

Question 14

Given the following configuration on a Cisco switch:

monitor session 1 source interface GigabitEthernet1/0/1 - 3 both
monitor session 1 destination interface GigabitEthernet1/0/4

What is the effect of this configuration?

Accepted Answer

Traffic from GigabitEthernet1/0/1, 1/0/2, and 1/0/3 is copied to GigabitEthernet1/0/4.. The configuration uses a local SPAN session to mirror traffic from a range of source interfaces (GigabitEthernet1/0/1 through 1/0/3) to a single destination interface (GigabitEthernet1/0/4). The keyword 'both' indicates that both ingress and egress traffic from the source interfaces are copied. This allows network administrators to monitor all traffic on those ports without disrupting the production flow.

Answer

Only traffic from GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/4.

Answer

Traffic from GigabitEthernet1/0/4 is copied to GigabitEthernet1/0/1, 1/0/2, and 1/0/3.

Answer

The configuration is invalid because a SPAN session can only have one source interface.

Question 15

A network engineer uses the Requests library to query a Cisco IOS-XE device via RESTCONF for interface statistics:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface=GigabitEthernet1/0/1/statistics'
headers = {'Accept': 'application/yang-data+json'}
auth = HTTPBasicAuth('admin', 'cisco123')
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the most likely issue with this code?

Accepted Answer

The interface name 'GigabitEthernet1/0/1' in the URL must be URL-encoded as 'GigabitEthernet1%2F0%2F1'.. The code contains an unencoded slash in the interface name 'GigabitEthernet1/0/1', which is a special character in RESTCONF URIs. It must be URL-encoded as 'GigabitEthernet1%2F0%2F1' to be correctly interpreted as a list key value. Therefore, option B correctly identifies the issue. Option A is false because the URL already includes '/restconf/data/'. Option C is incorrect because 'application/yang-data+json' is the proper Accept header for RESTCONF YANG data. Option D is false because GET is the correct HTTP method for data retrieval.

Answer

The URL is missing the '/data' segment; it should be '/restconf/data/...'

Answer

The Accept header should be 'application/json' instead of 'application/yang-data+json'.

Answer

The HTTP method should be POST instead of GET.