350-401 Practice Test 46 — 15 Questions

Question 1

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       10,20

Port        Vlans allowed and active in management domain
Gi0/1       10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       10,20

Based on this output, what can be concluded?

Accepted Answer

Only VLANs 10 and 20 are allowed on this trunk.. The output shows that the 'Vlans allowed on trunk' list contains only VLANs 10 and 20. This means the trunk has been explicitly configured to permit only those VLANs, and all other VLANs (including VLAN 1) are pruned or blocked from traversing the trunk. Therefore, only VLANs 10 and 20 are allowed, making option C correct.

Answer

VLAN 1 is allowed on this trunk.

Answer

The trunk is using DTP dynamic desirable mode.

Answer

The native VLAN is 10.

Question 2

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

Accepted Answer

Local preference. When multiple BGP paths are available for the same prefix, the first tie-breaker after comparing weight (where higher weight is preferred) is Local Preference (Local Pref). Since weight is a Cisco-proprietary attribute that is only locally significant, the next step in the BGP best-path selection algorithm is to compare the Local Preference value, with the highest value being preferred. This makes Local Preference the correct first tie-breaker when weight is equal.

Answer

AS path length

Answer

Origin code

Answer

MED

Question 3

A network engineer runs the following command on Router R2:

R2# show vrf detail

VRF CUSTOMER-B (VRF Id = 1); default RD 65000:1; default VPNID <not set>
  Interfaces:
           GigabitEthernet0/0.200
           GigabitEthernet0/1.200
  Address family IPV4 unicast:
    Export VPN route-target communities:
      RT:65000:100
    Import VPN route-target communities:
      RT:65000:100
    No export route-map
    No import route-map
  Address family IPV6 unicast:
    Export VPN route-target communities:
      RT:65000:100
    Import VPN route-target communities:
      RT:65000:100
  Members:
    10.0.0.0/24

Based on this output, what can be concluded?

Accepted Answer

The VRF supports both IPv4 and IPv6 VPNs with matching route-targets. The output shows both 'Address family IPV4 unicast' and 'Address family IPV6 unicast' sections, each with the same export and import route-target communities (RT:65000:100). This confirms the VRF CUSTOMER-B supports both IPv4 and IPv6 VPN address families with matching route-targets, enabling MPLS L3VPN services for both address families over the same VRF.

Answer

The VRF is configured for IPv4 only

Answer

The VRF uses different route-targets for import and export

Answer

The VRF has no interfaces assigned

Question 4

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reload: 5
Session Id: 1
  Unique Id: 1
  User Name: admin
  IP Address: 10.1.1.100
  Idle Time: 0
  Timeout: 0
  Type: Login
  Method: RADIUS
  Session Id: 2
  Unique Id: 2
  User Name: jdoe
  IP Address: 10.1.1.101
  Idle Time: 120
  Timeout: 0
  Type: Login
  Method: LOCAL

Based on this output, what can be concluded?

Accepted Answer

User jdoe authenticated using local authentication.. The output shows two sessions: user 'admin' authenticated via RADIUS (Method: RADIUS) and user 'jdoe' authenticated via LOCAL (Method: LOCAL). Option B correctly states that user jdoe authenticated using local authentication, as indicated by the 'Method: LOCAL' field in the session details.

Answer

All users are authenticated via RADIUS.

Answer

The RADIUS server is unreachable for all users.

Answer

Both sessions are using TACACS+ for authorization.

Question 5

A network engineer runs the following command on switch SW1:

SW1# show authentication sessions interface GigabitEthernet1/0/1

Interface: GigabitEthernet1/0/1
MAC Address: 0011.2233.4455
IP Address: 192.168.1.100
Status: Authz Success
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Common Session ID: 0A1B2C3D4E5F6G7H8I9J
Acct Session ID: 0x0000000A
Handle: 0x00000001

Current Method List: mab
Method: MAB
State: Authz Success

Based on this output, what can be concluded?

Accepted Answer

The client was authenticated based on its MAC address via MAB.. The output shows the current method list as 'mab' and the method as 'MAB' with a state of 'Authz Success'. This indicates that the client was authenticated using MAC Authentication Bypass (MAB), which uses the MAC address as the credentials, not 802.1X. The 'Status: Authz Success' confirms successful authorization, and the 'Domain: DATA' indicates it is a data device, not voice.

Answer

The client authenticated using 802.1X with a username and password.

Answer

The port is in multi-domain mode, allowing one data and one voice device.

Answer

The session is for voice traffic because the domain is DATA.

Question 6

Examine the following configuration on a Cisco 9800 WLC:

wireless profile policy test-policy
 no security wpa
 no security wpa2
 security wpa3
 security wpa3 akm sae
 security ft over-the-ds

What is the effect of the 'security ft over-the-ds' command?

Accepted Answer

It enables 802.11r fast roaming using the distribution system for key exchange.. The 'security ft over-the-ds' command enables 802.11r Fast Transition (FT) using the Distribution System (DS) for key exchange. In this mode, the client and target AP communicate via the current AP over the wired network (DS) rather than over the air, reducing over-the-air overhead and improving roaming efficiency. This is in contrast to 'over-the-air' mode, where the client directly exchanges FT authentication messages with the target AP wirelessly.

Answer

It enables 802.11r fast roaming using over-the-air messaging.

Answer

It disables fast roaming for this policy.

Answer

It configures the AP to use a different radio band.

Question 7

Drag and drop the steps of STP path cost manipulation for load balancing into the correct order, from first to last.

Accepted Answer

Identify redundant links in the topology. To load balance with STP, first identify redundant links. Then change the path cost on one switch's port to make it less preferred. This alters the root port selection. The switch recalculates the spanning tree, and traffic is redirected to the lower-cost path. Finally, verify the new root port and forwarding state.

Question 8

A network engineer runs the following command on switch SW6:

SW6# show cts role-based counters

Role-based counters:

Source Group   Dest Group   Packets Sent   Bytes Sent   Packets Denied   Bytes Denied
10             20           1500           120000       0                0
10             30           0              0            500              40000

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 10 to SGT 20 is being permitted, and traffic from SGT 10 to SGT 30 is being denied.. The output shows that for the source group (SGT) 10 to destination group (SGT) 20, packets sent and bytes sent are non-zero (1500 and 120000 respectively), while packets denied and bytes denied are zero. This indicates traffic is being permitted. For SGT 10 to SGT 30, packets sent and bytes sent are zero, but packets denied and bytes denied are non-zero (500 and 40000), indicating traffic is being denied. Therefore, option C is correct.

Answer

Traffic from SGT 10 to SGT 20 is being denied.

Answer

Traffic from SGT 10 to SGT 30 is being permitted.

Answer

No traffic has been sent between any SGTs.

Question 9

A network engineer runs the following command on Router R5:

R5# show queueing interface GigabitEthernet0/1
 Interface GigabitEthernet0/1 queueing strategy:  weighted fair
  Queueing on output: Weighted Fair Queueing
  Current fair queue configuration:
    Number of queues: 256
    Dynamic queues: 256
    Reserved queues: 0
  Current WFQ global configuration:
    Total dynamic queues: 256
    Total reserved queues: 0
  Class based weighted fair queueing: enabled
  Queueing on input: FIFO

Based on this output, what can be concluded?

Accepted Answer

The interface uses Weighted Fair Queueing for output with 256 queues.. The output explicitly states 'Queueing on output: Weighted Fair Queueing' and shows 'Number of queues: 256', confirming that the interface uses WFQ with 256 queues for output. WFQ is a flow-based queuing mechanism that dynamically assigns packets to queues based on flow characteristics, and the output confirms this configuration.

Answer

The interface uses FIFO queuing for output.

Answer

The interface uses Class-Based Weighted Fair Queueing (CBWFQ).

Answer

The interface uses Priority Queuing.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor

PIM Neighbor Table
Neighbor Address  Interface          Uptime    Expires    Mode
10.0.0.2          GigabitEthernet0/0 00:10:00  00:01:30   Dense
10.0.0.3          GigabitEthernet0/1 00:20:00  00:01:20   Sparse

Based on this output, what can be concluded?

Accepted Answer

The router is configured with mixed PIM modes on different interfaces. The output shows that interface GigabitEthernet0/0 has a PIM neighbor in Dense mode, while GigabitEthernet0/1 has a neighbor in Sparse mode. This indicates that Router R1 is configured with different PIM modes on different interfaces, which is known as mixed PIM mode. Therefore, option B is correct.

Answer

All PIM neighbors are operating in sparse mode

Answer

The router is using PIM version 2 exclusively

Answer

The neighbor 10.0.0.3 is not a valid PIM neighbor

Question 11

A network engineer runs the following command on Router R3:

R3# show mls qos interface GigabitEthernet0/1
 GigabitEthernet0/1
  trust state: trust DSCP
  trust mode: trust dscp
  COS override: dis
  default COS: 0
  DSCP Mutation Map: default dscp mutation map
  trust device: none
  qos mode: port-based

R3# show mls qos
 QoS is enabled globally
  QoS global counters: total packets not matching QoS criteria = 0
  Total packets with known CoS = 0
  Total packets dropped by policing = 0

Based on this output, what can be concluded?

Accepted Answer

The interface trusts the DSCP markings of incoming packets.. The output shows 'trust state: trust DSCP' and 'trust mode: trust dscp', which explicitly indicates that the interface trusts the DSCP markings of incoming packets. Additionally, 'qos mode: port-based' confirms that QoS is enabled on the interface, and the global QoS status shows 'QoS is enabled globally'. Therefore, the interface will preserve and use the incoming DSCP values for QoS classification.

Answer

The interface is configured to trust CoS values.

Answer

The interface will overwrite incoming DSCP values with default CoS.

Answer

QoS is disabled globally.

Question 12

Drag and drop each STP port state on the left to its matching function on the right.

Accepted Answer

Blocking: Discards frames and listens for BPDUs. Blocking discards frames and listens for BPDUs; Listening listens for BPDUs only; Learning learns MAC addresses but does not forward; Forwarding sends and receives frames; Disabled is administratively down.

Question 13

Drag and drop the steps of EIGRP route summarization configuration into the correct order, from first to last.

Accepted Answer

Enable EIGRP with router eigrp AS. EIGRP route summarization first requires enabling EIGRP, configuring the network statement, then entering interface configuration mode, applying the summary-address command, and finally verifying the summary route in the routing table.

Question 14

interface GigabitEthernet0/1
 spanning-tree portfast
 spanning-tree bpduguard enable
 end

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The `spanning-tree portfast` command causes the port to immediately transition to the forwarding state, bypassing the listening and learning states. The `spanning-tree bpduguard enable` command places the port in an error-disabled state if any BPDU is received, as BPDU reception on a PortFast-enabled port indicates an unauthorized switch connection, which could cause a bridging loop.

Answer

The port will go through normal STP states and will be error-disabled if a BPDU is received.

Answer

The port will immediately transition to forwarding and ignore any BPDUs received.

Answer

The port will remain in blocking state until a BPDU is received.

Question 15

An enterprise is migrating its data center to a leaf-spine architecture to support high east-west traffic between servers. The design must provide non-blocking forwarding and allow for easy scaling by adding more spines. Which characteristic is essential for the spine switches in this design?

Accepted Answer

Spine switches must support high port density and high forwarding capacity, and act as Layer 3 routers. In a leaf-spine architecture designed for non-blocking forwarding and high east-west traffic, spine switches must act as Layer 3 routers with high port density and forwarding capacity. This allows them to perform Equal-Cost Multi-Path (ECMP) routing, which distributes traffic across all available uplinks without blocking, ensuring that any leaf can reach any other leaf with predictable latency and full bandwidth utilization.

Answer

Spine switches must run Spanning Tree Protocol (STP) to prevent loops

Answer

Spine switches must be connected to each other to provide redundancy

Answer

Spine switches must perform NAT to translate between VLANs