350-401 Practice Test 41 — 15 Questions

Question 1

A network engineer runs the following command on Switch SW5:

SW5# show running-config | section interface port-channel
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 1-100,200-300
!
interface Port-channel2
 switchport mode access
 switchport access vlan 10
!

SW5# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Po1         on           802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-100,200-300

Port        Vlans allowed and active in management domain
Po1         1-100,200-300

Port        Vlans in spanning tree forwarding state and not pruned
Po1         1-100,200-300

Based on this output, what can be concluded?

Accepted Answer

Port-channel1 is operational as a trunk with the configured allowed VLANs.. The 'show interfaces trunk' output confirms that Port-channel1 is trunking with an operational status of 'trunking', and the 'Vlans allowed on trunk' line matches the configured allowed VLANs (1-100,200-300). This indicates the trunk is up and functioning with the intended VLAN list, making option C correct.

Answer

Port-channel2 is also trunking but not displayed due to a software bug.

Answer

Port-channel1 is trunking and allowed VLANs include VLANs 101-199.

Answer

The native VLAN on Po1 is VLAN 10.

Question 2

Consider the following configuration snippet:
```
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/2
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.1.0 0.0.0.255
```
What is the effect of this configuration?

Accepted Answer

It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.. This configuration implements dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The access list matches the 192.168.1.0/24 source network, and the 'ip nat inside source list 1 interface GigabitEthernet0/2 overload' command translates all matching inside local addresses to the single outside interface IP (203.0.113.1) using unique port numbers to differentiate sessions. This allows multiple internal hosts to share the public IP simultaneously.

Answer

It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.

Answer

It translates only traffic from 192.168.1.1 to the outside interface IP.

Answer

The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.

Question 3

Consider the following configuration:

flow exporter EXPORTER-1
 destination 10.0.0.1
 source Loopback0
 transport udp 9996
 template data timeout 60
!

Which statement about this configuration is true?

Accepted Answer

Template data records are sent every 60 seconds to the collector.. The `template data timeout 60` command under the flow exporter configuration specifies the interval in seconds at which the exporter sends NetFlow version 9 or IPFIX template data records to the collector. This ensures the collector has the current field definitions to decode incoming flow records. Option A correctly states that template data records are sent every 60 seconds to the collector.

Answer

The exporter uses UDP port 9996 to send flow data and templates.

Answer

The source interface Loopback0 is used only for flow data, not for templates.

Answer

The exporter will send template data only when a new flow is detected.

Question 4

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 5

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

Accepted Answer

The traffic is taking multiple paths, causing packets to arrive out of order.. The anti-replay check in IPsec uses sequence numbers to protect against replay attacks. When packets arrive out of order, the anti-replay window (default size 64 or 1024 packets) may reject packets that fall outside the window, causing the counter to increment. This is typical when traffic takes multiple paths, as packets can be reordered before reaching the peer.

Answer

The IPsec SA is using a weak encryption algorithm.

Answer

The IPsec SA is using ESP in tunnel mode with authentication only.

Answer

The IPsec SA lifetime is too short, causing frequent rekeying.

Question 6

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Accepted Answer

Configure ISAKMP policy, then IPsec transform set, then crypto ACL, then create and apply crypto map. IPsec VPN setup requires IKE phase 1, then phase 2 (transform set and crypto map).

Answer

Configure IPsec transform set, then ISAKMP policy, then crypto ACL, then create and apply crypto map

Answer

Configure ISAKMP policy, then IPsec transform set, then create and apply crypto map, then crypto ACL

Answer

Configure crypto ACL, then ISAKMP policy, then IPsec transform set, then create and apply crypto map

Question 7

A multinational organization has a BGP-based MPLS VPN network. The CE router at a branch office is connected to two PE routers (PE1 and PE2) in the service provider network. The branch uses eBGP to exchange routes with the PEs. The network administrator notices that the branch can reach some destinations but not others. The BGP table on the CE shows routes with next-hop set to the PE loopback addresses, but those loopbacks are not reachable. The CE has a default route pointing to the PEs. What is the most likely cause of the issue?

Accepted Answer

The next-hop addresses of the BGP routes are not reachable.. The CE router learns BGP routes from the PE routers with next-hop addresses set to the PE loopback interfaces. For these routes to be installed in the routing table, the CE must have a route to the next-hop IP address. Since the CE only has a default route pointing to the PEs and the PE loopbacks are not directly connected or reachable via any specific route, the BGP routes remain hidden (not installed) because the next-hop is unreachable. This is the most likely cause of partial reachability.

Answer

The default route on the CE is overriding the BGP routes.

Answer

The routes have an AS path that is too long.

Answer

The CE is not advertising its routes to the PEs.

Question 8

What is the purpose of the 'aaa authorization exec default local' command?

Accepted Answer

It authorizes exec sessions using the local database, determining if a user can start a shell and their privilege level.. The 'aaa authorization exec default local' command is used to authorize EXEC sessions (user shell access) by checking the local database on the device. It determines whether a user is permitted to start a shell and what privilege level they should receive, based on the local user account configuration. This is distinct from authentication, which verifies identity, and accounting, which logs actions.

Answer

It authenticates users for exec access using the local database.

Answer

It enables accounting for exec commands to the local database.

Answer

It sets the privilege level for all users to 15.

Question 9

A network engineer is deploying Cisco TrustSec (CTS) with Security Group Access Control Lists (SGACLs) on a campus network. The engineer configures the switch with 'cts role-based enforcement' and assigns SGTs to users via 802.1X. The engineer tests connectivity between a user in SGT 10 and a server in SGT 20. The SGACL permits traffic from SGT 10 to SGT 20, but the user cannot reach the server. The engineer checks 'show cts role-based sgt map' and sees that the user's SGT is 0. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to send the SGT in the Access-Accept message.. The user's SGT is shown as 0 in the 'show cts role-based sgt map' output, which is the default SGT assigned when no SGT is received from the RADIUS server. Since the SGACL permits traffic from SGT 10 to SGT 20, but the user has SGT 0, the SGACL does not match, and traffic is implicitly denied. The most likely cause is that the RADIUS server is not configured to send the SGT in the Access-Accept message, so the switch cannot dynamically assign the correct SGT.

Answer

The SGACL is applied to the wrong interface.

Answer

The switch is not configured with 'cts role-based enforcement'.

Answer

The user's SGT is 0, which is a valid SGT that denies all traffic.

Question 10

Examine the following configuration:

flow record REC-1
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect interface input
 collect interface output
 collect counter bytes
 collect counter packets
!
flow monitor MON-1
 record REC-1
 exporter EXPORTER-1
!
interface GigabitEthernet0/1
 ip flow monitor MON-1 input
!

What is the purpose of this configuration?

Accepted Answer

It collects NetFlow data for incoming traffic, including source/destination IP, protocol, and byte/packet counts.. The configuration defines a Flexible NetFlow record (REC-1) that matches IPv4 source/destination addresses and protocol, and collects interface input/output along with byte and packet counters. The flow monitor MON-1 applies this record to incoming traffic only (ip flow monitor MON-1 input), so it collects NetFlow data exclusively for inbound packets on GigabitEthernet0/1.

Answer

It collects NetFlow data for both incoming and outgoing traffic on the interface.

Answer

It configures Flexible NetFlow with a user-defined record that includes TCP flags.

Answer

It sends flow data to the exporter using IPFIX format.

Question 11

Given this OSPF configuration:

router ospf 1
 router-id 1.1.1.1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1
 default-information originate always

What is the effect of the 'default-information originate always' command?

Accepted Answer

OSPF will advertise a default route into all OSPF areas even if no default route is present in the routing table.. The 'default-information originate always' command instructs OSPF to generate and advertise a default route (0.0.0.0/0) into the OSPF domain as a Type 5 External LSA, regardless of whether a default route exists in the router's own routing table. This ensures that all OSPF routers in every area receive the default route, making the advertising router a gateway of last resort.

Answer

OSPF will only advertise a default route if a default route is already in the routing table.

Answer

OSPF will redistribute all connected routes as type 5 LSAs.

Answer

OSPF will generate a default route only for area 0.

Question 12

Examine the following interface configuration on a Cisco IOS-XE switch:
```
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
```
What is the effect of this configuration?

Accepted Answer

The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.. The configuration sets port-security with a maximum of 2 MAC addresses, violation mode 'restrict', and sticky MAC learning. When a third MAC address is seen, the 'restrict' action drops traffic from that MAC but keeps the port up, generates a syslog message, and increments the violation counter. Option A correctly describes this behavior.

Answer

The port will learn up to 2 MAC addresses and then shut down if a third is seen.

Answer

The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.

Answer

The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.

Question 13

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

Accepted Answer

Use AS path prepending on routes advertised to ISP B and set a higher local preference for routes learned from ISP A.. AS path prepending makes the route to ISP B appear less attractive for inbound traffic, while setting a higher local preference on routes learned from ISP A makes ISP A the preferred path for outbound traffic. This combination achieves the asymmetric routing goal: inbound traffic uses both links (since prepending only influences ISP B's decision, not ISP A's), and outbound traffic prefers ISP A due to the higher local preference.

Answer

Set a lower MED for routes advertised to ISP A and a higher MED for routes advertised to ISP B.

Answer

Advertise a more specific prefix (e.g., /25) to ISP A and a less specific prefix (/24) to ISP B.

Answer

Configure the CE router to use BGP multipath with both ISPs.

Question 14

A network engineer runs the following command on Switch SW9:

SW9# show etherchannel 4 port-channel
Port-channels in the group:
---------------------------

Port-channel: Po4    (Primary Aggregator)

Age of the Port-channel   = 0d:00h:20m:10s
Logical slot/port   = 16/4          Number of ports = 3
HotStandby port = null
Port state          = Port-channel Ag-Inuse
Protocol            =   LACP

Ports in the Port-channel:

Index   Load     Port     EC state        No of bits
------+------+------+----------------+----------
  0     00      Gi0/0    Active              4
  1     00      Gi0/1    Active              4
  2     00      Gi0/2    Standby            4

Time since last port bundled:    0d:00h:15m:00s    Gi0/1

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has a maximum bundle size of 2, so Gi0/2 is a hot-standby port.. The output shows three ports in the port-channel, but only two are in the 'Active' state (Gi0/0 and Gi0/1), while Gi0/2 is in 'Standby' state. This indicates that the EtherChannel has a maximum bundle size of 2, likely configured with the 'lacp max-bundle 2' command, which limits the number of active ports to two, making Gi0/2 a hot-standby port that will become active only if one of the active ports fails.

Answer

All three ports are actively forwarding traffic in the EtherChannel.

Answer

Gi0/2 is in standby mode because it is not receiving LACP packets from the neighbor.

Answer

The port-channel is not in use because the load is zero.

Question 15

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local              Remote               Status         Role
   1         10.1.1.1/4500      10.2.2.2/4500        READY          INITIATOR
      Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3600 sec

Child SA: Local selector  10.1.1.0/0 - 10.1.1.255/65535
             Remote selector 10.2.2.0/0 - 10.2.2.255/65535
             ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Accepted Answer

The tunnel is using pre-shared keys for authentication.. The output shows 'Auth sign: PSK' and 'Auth verify: PSK', which explicitly indicates that pre-shared keys (PSK) are used for IKEv2 authentication. The status 'READY' and 'UP-ACTIVE' confirm the SA is operational, not failed. Therefore, option B is correct.

Answer

The IKEv2 SA is in a failed state because it is READY.

Answer

The tunnel is using RSA signatures for authentication.

Answer

The IKEv2 SA has expired because the life time is 86400 seconds.