350-401 Practice Test 43 — 15 Questions

Question 1

A network engineer is configuring MPLS TE (Traffic Engineering) in an MPLS core to optimize bandwidth utilization. After enabling MPLS TE on all core routers and configuring tunnels, the engineer notices that traffic is not being rerouted when a link fails. The 'show mpls traffic-eng tunnels' shows the tunnels are up but not using the backup path. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MPLS TE FRR (Fast Reroute) is not configured on the tunnels.. MPLS TE Fast Reroute (FRR) is the mechanism that provides local protection and rapid traffic rerouting upon link or node failure. Without FRR configured on the tunnels, the head-end router must detect the failure, recompute the path, and signal a new LSP, which is a slow process. The fact that tunnels are up but not using a backup path indicates that FRR backup tunnels (e.g., link or node protection) have not been configured, so traffic continues to flow through the failed link until the head-end reacts.

Answer

LDP is not enabled on the core interfaces.

Answer

RSVP is not configured on the core routers.

Answer

OSPF is not configured with MPLS TE extensions.

Question 2

Examine the following IP SLA configuration:

ip sla 1
 icmp-echo 10.1.1.1
 frequency 10
ip sla schedule 1 life forever start-time now

What is the effect of this configuration?

Accepted Answer

It sends ICMP echo requests to 10.1.1.1 every 10 seconds, starting immediately and running forever.. The configuration creates an IP SLA operation (ID 1) that uses ICMP echo to monitor reachability to 10.1.1.1. The 'frequency 10' command sets the interval between probes to 10 seconds, and 'ip sla schedule 1 life forever start-time now' starts the operation immediately and runs it indefinitely. This is the standard behavior for a basic ICMP echo IP SLA operation.

Answer

It sends ICMP echo requests to 10.1.1.1 every 10 seconds, but only for 10 minutes.

Answer

It sends ICMP echo requests to 10.1.1.1 every 60 seconds by default.

Answer

It sends ICMP echo requests to 10.1.1.1 every 10 seconds, but only if an IP SLA responder is configured on the target.

Question 3

Consider the following DHCP snooping configuration on a Cisco IOS-XE switch:
```
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
!
interface GigabitEthernet0/2
 ip dhcp snooping limit rate 10
```
Which statement is true?

Accepted Answer

Gi0/1 is trusted for DHCP snooping, and Gi0/2 will drop DHCP packets exceeding 10 per second.. The 'ip dhcp snooping trust' command on Gi0/1 explicitly marks that interface as trusted, allowing all DHCP messages through without inspection. On Gi0/2, the 'ip dhcp snooping limit rate 10' command applies a rate limit of 10 packets per second to DHCP traffic; any DHCP packets exceeding this rate are dropped, which is a standard DHCP snooping rate-limiting behavior.

Answer

Gi0/2 is trusted and will forward all DHCP packets without rate limiting.

Answer

The switch will only snoop DHCP on VLAN 10, but rate limiting applies to all VLANs.

Answer

Gi0/1 will rate-limit DHCP packets to 10 per second.

Question 4

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reset: 10

Session Id: 5
  Unique Id: 5
  User Name: admin
  IP Address: 192.168.1.100
  Idle Time: 0:00:05
  Timeout: 0:10:00
  Type: SSH
  Method: local

Session Id: 6
  Unique Id: 6
  User Name: neteng
  IP Address: 10.0.0.2
  Idle Time: 0:02:30
  Timeout: 0:10:00
  Type: SSH
  Method: tacacs+

Based on this output, what can be concluded?

Accepted Answer

Session 5 is authenticated locally.. The output shows that Session 5 has 'Method: local', which means the user 'admin' was authenticated using the local database on the router, not an external AAA server. Session 6 uses 'Method: tacacs+', confirming TACACS+ authentication for that session. Therefore, only Session 5 is authenticated locally, making option B correct.

Answer

Both sessions are authenticated using TACACS+.

Answer

Session 6 will be disconnected due to idle timeout.

Answer

Both sessions are using RADIUS for authentication.

Question 5

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

Accepted Answer

The IKE Phase 1 lifetime is set too low.. The most likely reason for the tunnel dropping and re-establishing after a few hours is that the IKE Phase 1 lifetime is set too low. When the Phase 1 SA expires, it must be rekeyed, which can cause a brief interruption in the VPN tunnel. The logs confirm a Phase 1 SA rekey, directly pointing to a short lifetime as the root cause.

Answer

The Dead Peer Detection (DPD) interval is too short.

Answer

The IPsec transform set is misconfigured.

Answer

The Phase 2 lifetime is longer than Phase 1.

Question 6

Examine the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet0/5
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate

What is the effect of the 'switchport nonegotiate' command?

Accepted Answer

The interface will not send or process DTP frames, and remains a trunk.. The 'switchport nonegotiate' command disables Dynamic Trunking Protocol (DTP) on the interface. When configured on a trunk port, the interface will neither send nor process any DTP frames, ensuring the port remains in trunk mode regardless of the neighbor's DTP configuration. This is commonly used when connecting to non-Cisco devices that do not support DTP, or to prevent unwanted trunk negotiation.

Answer

The interface will not send DTP frames, but will still respond to incoming DTP frames.

Answer

The interface will revert to an access port.

Answer

The interface will negotiate trunking using ISL instead of DTP.

Question 7

Consider the following partial configuration on Router R1:

ip sla 5
 icmp-echo 10.5.5.5
 frequency 10
ip sla schedule 5 life forever start-time now
ip sla reaction-configuration 5 react rtt threshold-type immediate threshold-value 200 action-type triggerAndReset

What is the effect of the 'action-type triggerAndReset' parameter?

Accepted Answer

It triggers an event each time the RTT exceeds 200 ms and resets the counter after each trigger.. The 'action-type triggerAndReset' parameter in the IP SLA reaction configuration causes the router to generate an event (e.g., a syslog message or SNMP trap) each time the measured round-trip time (RTT) exceeds the specified threshold of 200 ms. After each trigger, the monitoring state is reset, allowing the router to continue monitoring and trigger again on subsequent threshold violations. This is why option B is correct.

Answer

It triggers an event once and then stops monitoring.

Answer

It triggers an event only if the RTT exceeds 200 ms for 5 consecutive probes.

Answer

It triggers an event and then immediately stops the IP SLA operation.

Question 8

Examine this DHCP configuration:
```
service dhcp
ip dhcp pool POOL2
 network 10.20.20.0 255.255.255.0
 default-router 10.20.20.1
 lease infinite
```
What is the effect of the 'lease infinite' command?

Accepted Answer

Clients will receive an infinite lease and never need to renew.. The 'lease infinite' command in a Cisco DHCP pool configuration sets the lease duration to never expire, meaning clients will not need to renew their IP addresses. This is a valid Cisco IOS command that overrides the default lease time of 1 day, and DHCP clients will treat the lease as having an infinite lifetime, so they will not attempt renewal.

Answer

The lease time is set to the default value of 1 day.

Answer

Clients will be unable to obtain an IP address because infinite is invalid.

Answer

The router will ignore the lease command and use the default.

Question 9

Drag and drop the steps of adding a new VLAN to a trunk link into the correct order, from first to last.

Accepted Answer

Create VLAN 100 in global configuration. First, create the VLAN globally on the switch. Then, verify the VLAN exists. Next, ensure the trunk allows that VLAN. After that, check the trunk's allowed VLAN list. Finally, test connectivity for hosts in the new VLAN.

Question 10

A network engineer runs the following command on a Cisco WLC:

WLC# show ap config general AP-2

AP Name: AP-2
MAC Address: aabb.cc00.0200
Country Code: US - United States
Regulatory Domain: 802.11bg: -A 802.11a: -A
AP Submode: FlexConnect
AP Mode: FlexConnect
AP Join Priority: 2
Primary Controller: WLC-1
Secondary Controller: WLC-2
Tertiary Controller: WLC-3

Based on this output, what can be concluded?

Accepted Answer

The AP can locally switch client traffic and maintain connectivity even if the WLC is unreachable.. The output shows 'AP Submode: FlexConnect' and 'AP Mode: FlexConnect', which indicates the AP is operating in FlexConnect mode. In FlexConnect mode, the AP can locally switch client traffic (data plane) and maintain client connectivity even if the WLC becomes unreachable, as the control plane is separated from the data plane. This is a key characteristic of FlexConnect, unlike Local mode where all traffic must be tunneled to the WLC.

Answer

The AP is operating in Local mode and will tunnel all traffic to the WLC.

Answer

The AP will only work if the WLC is directly connected at Layer 2.

Answer

The AP is in Monitor mode and will not serve clients.

Question 11

Examine the following configuration:

policy-map MARKING
 class VOICE
  set dscp ef
 class VIDEO
  set dscp af41
 class class-default
  set dscp default

interface GigabitEthernet0/0
 service-policy input MARKING

Which statement is true?

Accepted Answer

Incoming packets matching the VOICE class will have their DSCP set to EF (46), VIDEO to AF41 (34), and all others to default (0).. The configuration applies the MARKING policy-map as a service-policy input on GigabitEthernet0/0. This means all incoming packets are classified and have their DSCP values set according to the policy: VOICE class packets get DSCP EF (46), VIDEO class packets get DSCP AF41 (34), and all other packets (class-default) get DSCP default (0). The 'set dscp' action is valid in the input direction and does not require congestion to take effect.

Answer

The policy-map will only mark packets if the interface is congested.

Answer

The configuration is invalid because 'set dscp' cannot be used in a 'service-policy input' direction.

Answer

The policy-map will remark the DSCP of outgoing packets on GigabitEthernet0/0.

Question 12

Given the following CoPP configuration:

class-map match-all COPP_ICMP
 match access-group name ICMP_ACL
!
policy-map COPP_POLICY
 class COPP_ICMP
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

What is the effect?

Accepted Answer

All ICMP traffic to the control plane is rate-limited to 8000 bps.. The CoPP policy matches ICMP traffic via the class-map and applies a police rate of 8000 bps to the control plane. The 'conform-action transmit exceed-action drop' ensures that traffic within the rate is forwarded, while excess traffic is dropped, effectively rate-limiting ICMP to the control plane.

Answer

ICMP traffic is permitted unconditionally.

Answer

The policy is applied to all interfaces, not just the control plane.

Answer

The class-map is missing a match-all statement.

Question 13

Router R1 has the following OSPF configuration:

interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip ospf 1 area 0
 ip ospf network point-to-point
!
router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.255.255.255 area 0

What is the effect of the 'ip ospf network point-to-point' command on this interface?

Accepted Answer

It changes the OSPF network type to point-to-point, eliminating DR/BDR election and reducing hello timer to 10 seconds.. The 'ip ospf network point-to-point' command changes the OSPF network type on the interface from the default (broadcast for Ethernet) to point-to-point. This eliminates the need for a Designated Router (DR) and Backup Designated Router (BDR) election, as point-to-point links have only two neighbors. Additionally, the OSPF hello timer on a point-to-point network defaults to 10 seconds (versus 30 seconds for non-broadcast), and the dead timer is 40 seconds.

Answer

It disables OSPF on the interface.

Answer

It enables OSPF authentication on the interface.

Answer

It sets the OSPF cost to 1.

Question 14

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Accepted Answer

Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.. Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Answer

Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.

Answer

Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.

Answer

Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.

Question 15

A network engineer runs the following command on Router R8:

R8# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        strict priority
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 15625 be 15625
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: DATA (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp af31 (26)
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      bandwidth remaining percent 50

Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      bandwidth remaining percent 50

Based on this output, what can be concluded?

Accepted Answer

The interface is not passing any traffic.. The output shows all counters at zero for every class, including the class-default, and the '5 minute offered rate' is 0 bps for all classes. This indicates that no packets have been processed by this policy-map on GigabitEthernet0/1, meaning the interface is not passing any traffic. The presence of policing and queuing configurations does not imply traffic is being dropped; the counters confirm zero activity.

Answer

Voice traffic is being prioritized but not policed.

Answer

Data traffic is being dropped due to policing.

Answer

The policy-map is applied to input traffic.