350-401 Practice Test 48 — 15 Questions

Question 1

Drag and drop each service chaining element on the left to its matching position in a typical chain on the right.

Accepted Answer

Ingress Router: First element in the service chain. In a typical service chain, traffic flows from the ingress router through firewall, load balancer, WAN optimizer, and finally to the egress router.

Question 2

Drag and drop each VNF category on the left to its matching example on the right.

Accepted Answer

Virtual Router: Cisco CSR 1000v. VNFs replace physical appliances; common examples include virtual routers, firewalls, and load balancers.

Question 3

Drag and drop each SD-WAN controller on the left to its matching function on the right.

Accepted Answer

vManage: Centralized management, monitoring, and GUI dashboard. vManage provides centralized management and monitoring; vSmart distributes control plane policies and OMP routes; vBond authenticates and orchestrates initial device onboarding and NAT traversal.

Question 4

Which two statements about Cisco SD-WAN control plane components are true? (Choose two.)

Accepted Answer

vSmart controllers are responsible for distributing OMP routes and policies to vEdge routers.. The Cisco SD-WAN control plane consists of vSmart controllers that distribute OMP routes and vBond orchestrators that authenticate and onboard devices. vEdge routers are data plane devices, not control plane. vManage is a management plane component. TLOCs are used for transport location identification, not for route redistribution.

Answer

vEdge routers function as the control plane devices that maintain the routing table for the entire SD-WAN domain.

Answer

vManage is the control plane component that distributes BGP routes to all WAN Edge routers.

Answer

TLOCs are used by vSmart controllers to redistribute routes between different OMP instances.

Question 5

Drag and drop each sFlow component on the left to its matching function on the right.

Accepted Answer

sFlow agent: Samples packets and exports datagrams. sFlow agent: embedded in the network device, samples packets and sends datagrams. sFlow collector: receives and analyzes datagrams. sFlow datagram: the packet sent from agent to collector containing sampled data.

Question 6

Drag and drop the steps of NFVI resource allocation and VNF instantiation into the correct order, from first to last.

Accepted Answer

NFVI admin creates tenant and allocates compute/storage/network. The correct order starts with the NFVI administrator creating a tenant and allocating compute, storage, and network resources. Then the VNF descriptor is uploaded to the NFVO, which triggers the VNFM to request resource reservation. After resources are reserved, the VNFM instantiates the VNF using the allocated resources. Finally, the VNF is configured and activated to provide the intended service.

Question 7

Drag and drop the steps of KVM VM provisioning via virsh CLI into the correct order, from first to last.

Accepted Answer

Define the VM using virsh define. The provisioning process starts with defining the VM XML, then starting it, installing the OS, and finally accessing the console.

Question 8

Drag and drop each MQC component on the left to its matching role on the right.

Accepted Answer

class-map: Defines traffic classification criteria. class-map defines traffic classification criteria, policy-map defines the QoS actions to apply, service-policy applies the policy-map to an interface, class-map uses match statements, policy-map uses class statements.

Question 9

Drag and drop the steps of SD-WAN policy creation and push via vManage into the correct order, from first to last.

Accepted Answer

Define centralized policy in vManage GUI. Policy creation starts with defining the policy in vManage GUI, then attaching it to a specific topology or group, committing the configuration, which triggers vManage to push the policy to vSmart, and finally vSmart distributes the policy to the edge devices.

Question 10

Drag and drop the steps of Docker container networking with bridge mode into the correct order, from first to last.

Accepted Answer

Create default bridge network on host. The order reflects the default bridge network creation, container attachment, IP assignment, and then communication with the outside world via NAT.

Question 11

Which two statements about the Cisco QoS trust boundary are true? (Choose two.)

Accepted Answer

The trust boundary can be set at the access layer switch port connected to an IP phone.. The trust boundary defines where the device accepts or overwrites Layer 2 CoS or Layer 3 DSCP markings. By default, Cisco switches trust the CoS value on trunk ports and set DSCP to 0 on access ports. The 'mls qos trust cos' command forces the switch to trust CoS, and 'mls qos trust dscp' forces trust of DSCP. The trust boundary can be extended to an IP phone, which then re-marks traffic from the PC. Option C is incorrect because trust is not automatically applied to all interfaces; it must be configured. Option D is incorrect because the trust boundary is at the access layer, not the core. Option E is incorrect because the switch does not automatically trust DSCP from a PC; it typically sets it to 0 unless configured otherwise.

Answer

By default, all Cisco switch interfaces trust the incoming CoS or DSCP marking.

Answer

The trust boundary is always located at the distribution layer switch.

Answer

When a PC is connected to a switch port, the switch automatically trusts the DSCP value from the PC.

Question 12

Which three statements about Cisco SD-WAN security and segmentation are true? (Choose three.)

Accepted Answer

Data plane traffic between vEdge routers is encrypted using IPsec tunnels.. Cisco SD-WAN uses IPsec for data plane encryption and supports multiple VPN segments (VRFs) for traffic isolation. Control plane encryption is also provided using DTLS or TLS. The data plane encryption is between vEdge routers, not between vSmart and vEdge. VPN segmentation is configured on vEdge routers, not on vSmart. The vBond orchestrator does not participate in data plane encryption.

Answer

Data plane encryption is performed between vSmart controllers and vEdge routers to protect OMP updates.

Answer

VPN segmentation is configured on the vSmart controller and pushed to vEdge routers via OMP.

Question 13

Drag and drop each MQC component on the left to its matching role on the right.

Accepted Answer

class-map: Defines traffic classification using match statements. class-map defines traffic classification criteria, policy-map defines the QoS actions to apply, service-policy applies the policy-map to an interface, class-map uses match statements, and policy-map uses class statements.

Question 14

Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.

Accepted Answer

LSRs send LDP Hello messages via UDP (224.0.0.2). LDP session establishment starts with Hello discovery via UDP, then TCP connection setup, LDP initialization with parameters, label exchange via KeepAlive and Label Mapping, and finally session up with full label exchange.

Question 15

Which two statements about NFV architecture and components are true? (Choose two.)

Accepted Answer

The NFV Infrastructure (NFVI) includes compute, storage, and networking resources that host VNFs.. NFV decouples network functions from dedicated hardware. The NFV Infrastructure includes compute, storage, and networking resources. VNFs run on top of the NFVI. The NFV MANO framework orchestrates and manages these components. Option A is correct because NFVI provides the virtualized resources. Option B is correct because VNFs are software implementations of network functions. Option C is incorrect because NFV does not require dedicated hardware per VNF; it relies on shared infrastructure. Option D is incorrect because VNFs are managed by the VNFM, not the VIM. Option E is incorrect because the NFV Orchestrator handles lifecycle management, not just resource allocation.

Answer

Each VNF must be deployed on its own dedicated physical server to ensure performance isolation.

Answer

The Virtualized Infrastructure Manager (VIM) is responsible for managing the lifecycle of VNFs.

Answer

The NFV Orchestrator is primarily responsible for allocating virtual resources to VNFs.