350-401 Practice Test 5 — 10 Questions

Question 1

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

60 seconds. The default quiet-period timer in Cisco IOS 802.1X configuration is 60 seconds. This timer defines the period the switch waits after a failed authentication attempt before re-initiating authentication with the same supplicant. It prevents repeated authentication attempts from overwhelming the switch and the RADIUS server.

Answer

30 seconds

Answer

120 seconds

Answer

10 seconds

Question 2

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Based on this output, what can be concluded?

Accepted Answer

DTP is enabled on this interface.. The output shows 'Negotiation of Trunking: On', which indicates that Dynamic Trunking Protocol (DTP) is enabled on the interface. DTP is a Cisco proprietary protocol used to negotiate trunking between switches. Since the interface is in trunk mode and DTP is on, option B is correct.

Answer

The interface is configured as an access port.

Answer

The native VLAN is tagged with 802.1Q.

Answer

All VLANs except 2-1001 are pruned.

Question 3

A network engineer is deploying QoS on a Cisco Catalyst 4500 switch to support four queues per port. The engineer wants to assign voice traffic to queue 1 (priority), video to queue 2, critical data to queue 3, and best-effort to queue 4. The switch is configured with the default CoS-to-queue mapping. However, video traffic is being placed in queue 1 along with voice. What should the engineer do to separate them?

Accepted Answer

Modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command. The default CoS-to-queue mapping on Cisco Catalyst 4500 switches maps CoS 5 (voice) to queue 1 (priority queue) and CoS 4 (video) also to queue 1. To separate video into queue 2, the engineer must modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command, which reassigns CoS values to specific output queues. This directly overrides the default behavior and places video traffic in the correct queue.

Answer

Change the video traffic marking to DSCP AF41 and rely on DSCP-to-queue mapping

Answer

Apply a service policy that uses a priority queue for voice only

Answer

Increase the number of queues to eight

Question 4

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module in Ansible expects the direction parameter to be specified as 'in' or 'out', not 'outbound'. When 'direction: outbound' is used, the module either ignores the value or defaults to 'in', causing the ACL to be applied inbound instead of outbound. This is a common parameter naming mismatch between the Ansible module and the engineer's expectation.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 5

An engineer is troubleshooting multicast performance issues. The network uses PIM sparse mode with a static RP. The engineer notices that the multicast traffic from a source to a group is taking a suboptimal path, causing high latency. The engineer checks the multicast routing table on the last-hop router and sees that the (S,G) entry has an incoming interface that is not the shortest path to the source. What is the most likely reason for this suboptimal path?

Accepted Answer

The last-hop router has not yet switched to the SPT.. In PIM sparse mode, the last-hop router initially receives multicast traffic via the shared tree (RP) and then switches to the shortest path tree (SPT) toward the source once the traffic rate exceeds a threshold (default 0 kbps in Cisco IOS). If the (S,G) entry shows an incoming interface that is not the shortest path to the source, it indicates the router has not yet performed the SPT switchover, so it is still using the RP-based path, which may be suboptimal.

Answer

The RP is not configured as the DR on its segment.

Answer

The multicast source is using a different group address.

Answer

The last-hop router has a higher metric to the source than to the RP.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip sla summary

IPSLAs Latest Operation Summary
Codes: * active, ^ inactive, ~ pending

ID       Type         Destination       Stats       Return Code      Last
1        icmp-echo    192.168.1.10      Success     OK               1
2        icmp-echo    192.168.1.20      Success     OK               2
3        udp-jitter   192.168.1.30      Success     OK               3
*4       icmp-echo    192.168.1.40      Success     OK               10

Based on this output, what can be concluded?

Accepted Answer

IP SLA operation 4 is currently active.. The asterisk (*) in the first column of the 'show ip sla summary' output indicates that IP SLA operation 4 is currently active. The other operations (IDs 1, 2, and 3) have no asterisk, meaning they are inactive. The 'Return Code' column shows 'OK' for all operations, confirming they completed successfully, but only operation 4 is actively running.

Answer

All IP SLA operations are active.

Answer

IP SLA operation 3 has failed.

Answer

IP SLA operation 1 has the highest round-trip time.

Question 7

A network engineer runs the following command on Router R6:

R6# show mpls ldp neighbor 10.6.6.7 detail
    Peer LDP Ident: 10.6.6.7:0; Local LDP Ident 10.6.6.6:0
        TCP connection: 10.6.6.7.646 - 10.6.6.6.179
        State: Oper; Msgs sent/rcvd: 200/195; Downstream
        Up time: 1d04h
        LDP discovery sources:
          Targeted Hello 10.6.6.6 -> 10.6.6.7, active, passive
        Addresses bound to peer LDP Ident:
          10.6.6.7         192.168.6.7
        Hold time: 15 seconds; keepalive interval: 5 seconds
        Peer hold time: 15 seconds; keepalive interval: 5 seconds

Based on this output, what type of LDP session is this?

Accepted Answer

This is a targeted LDP session established between two non-directly connected routers.. The output shows a targeted hello (10.6.6.6 -> 10.6.6.7) as the LDP discovery source, and the TCP connection uses port 646 (LDP) on one side and port 179 (BGP) on the other. This indicates the session is established between two routers that are not directly connected (non-adjacent), which is the definition of a targeted LDP session. The presence of 'active, passive' in the discovery source confirms that one router initiated the targeted hello and the other responded.

Answer

This is a link-local LDP session because the discovery source is an interface.

Answer

This is a multicast LDP session because the hold time is 15 seconds.

Answer

This is a BGP session because the TCP connection shows port 179.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:12:34   12   100  0  45
1   10.1.1.2                Gi0/1            12 00:10:20   15   120  0  32

Based on this output, what can be concluded?

Accepted Answer

Both neighbors are fully established and exchanging routing information.. The 'show ip eigrp neighbors' output displays two neighbors in a stable state, indicated by the 'Q Cnt' (Queue Count) of 0 for both, meaning no packets are waiting to be sent. The 'Seq Num' (Sequence Number) values (45 and 32) show that R1 has received and processed EIGRP updates from each neighbor, confirming the adjacency is fully established and routing information is being exchanged. This output does not provide any metric or authentication details, so only the conclusion that both neighbors are fully operational is valid.

Answer

Both neighbors are using MD5 authentication.

Answer

Neighbor 192.168.1.2 has a higher metric than 10.1.1.2.

Answer

Router R1 is using EIGRP named mode.

Question 9

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Interfaces Gi0/1, Gi0/2, and Gi0/3 are in VLAN 1.. The 'show vlan brief' output explicitly lists Gi0/1, Gi0/2, and Gi0/3 under VLAN 1 (default), confirming these interfaces are access ports assigned to VLAN 1. VLAN 1 is the default VLAN on Cisco switches, and all ports not explicitly configured otherwise belong to it.

Answer

All ports shown are in trunk mode.

Answer

VLANs 1002-1005 are active and supported.

Answer

VLAN 20 has no ports assigned.