350-401 Practice Test 44 — 15 Questions

Question 1

Examine the following configuration on a Cisco 9800 WLC:

ap profile default-ap-profile
 description "Default AP Profile"
 country US
 management-user admin

Which statement is true about this configuration?

Accepted Answer

The country code is set to the United States, affecting allowed channels and transmit power.. The 'country US' command in the AP profile sets the regulatory domain to the United States, which determines the allowed channels, maximum transmit power levels, and DFS requirements for the AP. This is a fundamental wireless configuration that ensures compliance with local regulations.

Answer

This profile configures the SSID for the AP.

Answer

This profile enables 802.11r fast roaming.

Answer

The management user 'admin' is used for client authentication.

Question 2

A network engineer is implementing MACsec on a Cisco switch-to-switch link to provide encryption. Both switches support MACsec and are configured with the same pre-shared key (PSK). The engineer configures 'mka' and 'macsec' on the interfaces. After configuration, the link does not come up, and the engineer sees 'MKA not operational' in the show macsec status. What is the most likely cause?

Accepted Answer

The pre-shared key (PSK) configured on both switches does not match.. The 'MKA not operational' error indicates that the MACsec Key Agreement (MKA) protocol cannot establish a secure session. Since both switches are configured with a pre-shared key (PSK), the most likely cause is that the PSK values do not match, preventing MKA from completing the mutual authentication and key derivation process. MKA relies on the Connectivity Association Key (CAK) derived from the PSK; mismatched PSKs result in different CAKs, causing the MKA exchange to fail.

Answer

MACsec requires a RADIUS server for key distribution, which is not configured.

Answer

The interfaces are configured with different VLANs, causing MACsec to fail.

Answer

The interfaces must be configured as trunk ports for MACsec to work.

Question 3

A network engineer configures model-driven telemetry on a Cisco IOS-XE device using gRPC dial-out. The subscription configuration snippet is:

```
telemetry ietf subscription 100
 encoding encode-kvgpb
 filter xpath /interfaces/interface/statistics
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.1.1.1 50001 protocol grpc-tcp
```

What is the primary issue with this configuration?

Accepted Answer

The 'encoding' should be 'encode-json' or 'encode-gpb' instead of 'encode-kvgpb' for gRPC.. GRPC dial-out on Cisco IOS-XE requires the encoding to be 'encode-gpb' (GPB) or 'encode-json' (JSON), not 'encode-kvgpb'. The 'encode-kvgpb' encoding is used for gRPC dial-in (subscriptions initiated by the collector), not dial-out. Using the wrong encoding will cause the telemetry data to be malformed or rejected by the receiver.

Answer

The 'stream' should be 'yang-notif' instead of 'yang-push'.

Answer

The 'update-policy periodic' value must be between 100 and 1000 milliseconds.

Answer

The 'receiver' command should specify 'protocol grpc' instead of 'grpc-tcp'.

Question 4

A network engineer writes a Python script using Paramiko to execute a command on a Cisco IOS device:

```python
import paramiko

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('192.168.1.1', username='admin', password='cisco123')
stdin, stdout, stderr = ssh.exec_command('show version')
output = stdout.read().decode()
print(output)
ssh.close()
```

What is a potential issue with this approach?

Accepted Answer

The script will fail because Cisco IOS does not support SSH command execution; it requires an interactive shell session.. Cisco IOS devices typically require an interactive shell session for command execution over SSH. The Paramiko `exec_command()` method sends a single command and expects a response, but IOS does not natively support this non-interactive mode; it expects a VTY interactive session. As a result, the script may hang, return no output, or fail to execute the command properly.

Answer

The script will work fine because exec_command() sends the command over SSH.

Answer

The script will fail because the username and password are passed as plaintext; Paramiko requires key-based authentication.

Answer

The script will fail because the output should be read using stdout.readlines() instead of stdout.read().

Question 5

Which two statements about SPAN and RSPAN are true? (Choose two.)

Accepted Answer

SPAN mirrors traffic only on the local switch.. SPAN mirrors traffic locally on the same switch. RSPAN uses a dedicated VLAN to carry mirrored traffic across switches. SPAN can monitor both ingress and egress traffic. RSPAN supports only ingress mirroring on source ports, not egress. SPAN cannot be used across switches without RSPAN or ERSPAN. RSPAN does not require a separate management VLAN.

Answer

SPAN can be used to mirror traffic between switches without additional configuration.

Answer

RSPAN supports both ingress and egress mirroring on the source switch.

Answer

RSPAN requires a separate management VLAN to function.

Question 6

Examine the following CoPP configuration on a Cisco IOS-XE router:
```
class-map match-all CONTROL-PLANE
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class CONTROL-PLANE
 police 1000000 200000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY
```
What is the effect of this configuration?

Accepted Answer

Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.. The CoPP configuration uses a `police` command with a committed information rate (CIR) of 1,000,000 bits per second (1 Mbps) and a burst size of 200,000 bytes. Traffic that matches the class-map (via the named ACL) is subject to this policer; conforming traffic is transmitted, while exceeding traffic is dropped. This effectively rate-limits the matched control-plane traffic to 1 Mbps.

Answer

All control plane traffic is rate-limited to 1 Mbps.

Answer

Traffic exceeding 1 Mbps is marked down but still transmitted.

Answer

The policy-map is applied to the data plane, not the control plane.

Question 7

A network engineer runs the following command on Switch SW1:

SW1# show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
    Both               : Gi1/0/2
Destination Ports     : Gi1/0/10
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.. The output shows a local SPAN session where source ports Gi1/0/1 and Gi1/0/2 are configured to capture both ingress and egress traffic, and the destination port is Gi1/0/10. This means all traffic entering or leaving the source ports is copied to Gi1/0/10 for monitoring. The 'Both' keyword under source ports confirms bidirectional traffic capture, and the destination port is not involved in any forwarding back to the sources.

Answer

This is an RSPAN session that sends traffic to a remote VLAN.

Answer

Ingress traffic on Gi1/0/10 is forwarded to the source ports.

Answer

The destination port is configured to capture only egress traffic.

Question 8

Given the following configuration on a Cisco IOS switch:

interface GigabitEthernet0/6
 switchport mode dynamic desirable

What is the effect of this configuration?

Accepted Answer

The interface will actively try to form a trunk and will succeed if the other side is set to trunk, desirable, or auto.. The `switchport mode dynamic desirable` command configures the interface to actively send Dynamic Trunking Protocol (DTP) frames to negotiate trunking. If the neighboring interface is set to trunk, dynamic desirable, or dynamic auto, the negotiation will succeed and the link will become a trunk. This is because dynamic desirable actively initiates the negotiation, unlike dynamic auto which only responds.

Answer

The interface will only become a trunk if the other side is set to trunk.

Answer

The interface will always remain an access port.

Answer

The interface will not send DTP frames.

Question 9

What is the default port used by TACACS+ for communication?

Accepted Answer

49. TACACS+ uses TCP port 49 by default for communication between the Network Access Server (NAS) and the TACACS+ server. This port is defined in the TACACS+ protocol specification (RFC 1492) and is the well-known port reserved for the TACACS+ authentication, authorization, and accounting (AAA) service. Unlike RADIUS, which uses UDP, TACACS+ relies on TCP for reliable, connection-oriented transport.

Answer

1812

Answer

1645

Answer

389

Question 10

In OSPF, which LSA type is used to describe routes to networks within the same area and is generated by the router that owns the network?

Accepted Answer

Type 1 (Router LSA). Type 1 (Router LSA) is correct because each OSPF router generates a Type 1 LSA to describe its directly connected links and networks within the same area. This LSA is flooded only within the originating area and is the fundamental building block for intra-area route calculation using the SPF algorithm.

Answer

Type 2 (Network LSA)

Answer

Type 3 (Summary LSA)

Answer

Type 5 (External LSA)

Question 11

A network engineer runs the following debug on a router:

R1# debug aaa authentication

*Mar  1 00:01:23.456: AAA/BIND(00000001): Bind iplist
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pick method list 'default'
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Method=RADIUS
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): RADIUS server 10.1.1.10:1812, timeout 5, retransmit 2
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Sent username 'admin', password ****
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Received PASS response
*Mar  1 00:01:23.456: AAA/AUTHEN/LOGIN (00000001): Pass

Based on this output, what can be concluded?

Accepted Answer

The RADIUS server 10.1.1.10 authenticated the user successfully.. The debug output shows a successful AAA authentication process: the router binds to an IP list, selects the default method list, attempts RADIUS authentication against server 10.1.1.10:1812, sends the username 'admin' with a masked password, and receives a 'PASS response' followed by 'Pass'. This confirms that the RADIUS server authenticated the user successfully, making option C correct.

Answer

Authentication failed due to incorrect password.

Answer

The router used TACACS+ for authentication.

Answer

The user 'admin' was authenticated using local database.

Question 12

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The hash algorithm is not specified and defaults may differ between routers.. The most likely cause is that the hash algorithm is not specified in the ISAKMP policy. By default, Cisco IOS uses SHA-1 (or MD5 on older versions) for the hash algorithm, but if one router defaults to SHA-1 and the other defaults to MD5, the IKE Phase 1 proposals will not match, causing the tunnel to fail. The configuration must explicitly include the `hash` command to ensure both peers agree on the same hash algorithm.

Answer

The lifetimes are set too high; they should be 3600 seconds.

Answer

The Diffie-Hellman group 14 is not supported on these routers.

Answer

Pre-shared keys cannot be used with AES-256 encryption.

Question 13

Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.

Accepted Answer

Classify traffic using class-map matching DSCP or ACL. At the enterprise WAN edge, traffic is first classified based on existing markings or other criteria. Then a policy-map is created to set the new DSCP value. The policy is applied outbound on the WAN interface. The router re-marks packets as they exit. Finally, the new DSCP value is verified using show commands.

Question 14

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map SET_MED out
!
route-map SET_MED permit 10
 set metric 50
!
What is the effect of this configuration on routes advertised to 10.0.0.2?

Accepted Answer

All routes sent to 10.0.0.2 will have the MED value set to 50.. The route-map SET_MED is applied to outbound updates to neighbor 10.0.0.2, and the 'set metric 50' command sets the Multi-Exit Discriminator (MED) attribute to 50 for all routes advertised to that neighbor. The MED is a metric used to influence inbound traffic from the AS of the neighbor, and it is propagated to the neighbor's BGP table.

Answer

Routes received from 10.0.0.2 will have their MED set to 50.

Answer

The local preference of routes sent to 10.0.0.2 is set to 50.

Answer

The configuration is invalid because MED cannot be set on outbound updates.

Question 15

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 192.168.1.0/24
BGP routing table entry for 192.168.1.0/24, version 15
Paths: (1 available, best #1, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65050, (received & used)
    10.0.1.2 from 10.0.1.2 (10.0.0.2)
      Origin IGP, metric 0, localpref 100, weight 0, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what can be concluded?

Accepted Answer

The route is from AS 65050 and is the best path.. The output shows the BGP table entry for 192.168.1.0/24 with path 65050, and the line 'valid, external, best' confirms that this route is from AS 65050 and is selected as the best path. The 'best' keyword in the status flags directly indicates that this path is the best among all available paths for this prefix.

Answer

The route was learned from an internal BGP peer.

Answer

The route has a local preference of 0.

Answer

The route is not valid because it is external.