350-401 Practice Test 50 — 15 Questions

Question 1

A network engineer configures IP SLA 60 to monitor the jitter of a VoIP call path between two sites. The operation uses UDP jitter with a target of 192.168.3.3 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 10 ms', but the jitter values are all zero. The remote router has an IP SLA responder configured. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP SLA operation is configured with a 'num-packets' value of 1, so only one packet is sent per probe, and jitter cannot be calculated.. UDP jitter requires multiple packets per probe to measure inter-packet delay variation. If 'num-packets' is set to 1, only a single packet is sent, so there are no successive packet pairs from which jitter can be calculated. The 'Latest RTT: 10 ms' indicates the single packet was echoed, but with only one packet, jitter values remain zero.

Answer

The remote router's IP SLA responder is not configured to calculate jitter, only to echo packets.

Answer

The IP SLA operation is using a 'frequency' that is too high, causing the probes to be sent too quickly and jitter to be zero.

Answer

The network path has no variable delay, so jitter is naturally zero.

Question 2

Consider this configuration:
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,20,30
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0

Which statement is true about this configuration?

Accepted Answer

The trunk will only allow VLANs 10, 20, and 30, and VLAN 10 is the native VLAN.. The configuration explicitly permits VLANs 10, 20, and 30 on the trunk using the 'switchport trunk allowed vlan' command, and VLAN 10 is set as the native VLAN with the 'switchport trunk native vlan 10' command. The native VLAN carries untagged traffic on the trunk, but it is still a valid VLAN that can be included in the allowed list and can have an SVI for routing. The SVI for VLAN 10 will come up as long as the VLAN exists and there is at least one active switchport in that VLAN, which is satisfied by the trunk port.

Answer

The native VLAN 10 cannot be used as a routed interface because it is the native VLAN.

Answer

The SVI for VLAN 10 will not come up because the native VLAN must be untagged.

Answer

The configuration is invalid because the native VLAN must be the same as the management VLAN.

Question 3

A network engineer runs the following command on switch SW7:

SW7# show authentication registrations

Authentication Method Registrations:

Method    Priority   Type
dot1x     10         Interface
mab       20         Interface
webauth   30         Interface

Based on this output, what can be concluded?

Accepted Answer

The switch will try 802.1X first, then MAB, then web authentication.. The command output shows authentication methods registered with their priorities. The 'Priority' column indicates the order in which the switch attempts each method: lower numbers are tried first. Since dot1x has priority 10, mab has 20, and webauth has 30, the switch will attempt 802.1X first, then MAB, then web authentication. This is the default fallback behavior for interface-based authentication on Cisco switches.

Answer

The switch will try MAB before 802.1X.

Answer

Web authentication is the primary method.

Answer

Only 802.1X is registered.

Question 4

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Accepted Answer

Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.. The CoPP policy is dropping SNMP packets from the NMS because the class-map matching SNMP traffic (UDP port 161) is applied without an exception for the specific management station. By modifying the ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement, the router will match and allow those packets before they hit the drop action, preserving control plane protection while permitting the NMS polls.

Answer

Increase the police rate for the CoPP class that matches SNMP traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Answer

Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

Question 5

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Accepted Answer

The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.. The missing 'aaa authentication enable default group tacacs+ local' command means the device does not require TACACS+ authentication to enter enable mode. Since the user is already at privilege level 15 after login (due to the 'aaa authorization exec' command or local user configuration), they are not prompted for a password and are granted full privileges immediately. Additionally, command authorization is only configured for privilege level 15 ('aaa authorization commands 15'), so once the user is at level 15, no further authorization checks are performed for commands like 'debug', bypassing the intended per-role enforcement.

Answer

The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.

Answer

Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.

Answer

The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.

Question 6

Consider the following configuration on a Cisco IOS-XE router:

ip multicast-routing
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip pim sparse-mode
 ip igmp static-group 239.1.1.1
!

What is the effect of the 'ip igmp static-group 239.1.1.1' command?

Accepted Answer

The router will include this interface in the outgoing interface list for group 239.1.1.1, even without any IGMP hosts.. The 'ip igmp static-group 239.1.1.1' command configures the router to include the interface in the outgoing interface list (OIL) for the multicast group 239.1.1.1, regardless of whether any IGMP hosts are present on that subnet. This is used to forward multicast traffic for that group out of the interface as if a host had joined, without relying on dynamic IGMP membership reports.

Answer

The router will send IGMP membership reports for group 239.1.1.1 out of this interface.

Answer

The router will drop all multicast traffic for group 239.1.1.1 on this interface.

Answer

The router will create a static multicast route for 239.1.1.1 via this interface.

Question 7

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

Accepted Answer

The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.. The CE router can ping the PE's VRF interface IP, confirming Layer 2 and VRF interface configuration are correct. However, the CE cannot reach remote VPNv4 routes, which indicates that the PE is not advertising or installing those routes into the VRF. The most likely cause is that the VRF CUSTOMER_A has not been activated under BGP using the 'address-family ipv4 vrf CUSTOMER_A' command, which is required to exchange IPv4 routes between the PE and CE within the VRF context and to redistribute them into MP-BGP for VPNv4 propagation.

Answer

The route-target import/export values are mismatched with the route reflector's configuration.

Answer

The CE router is not configured with a default route pointing to the PE.

Answer

The PE router needs the mpls ip command on the interface facing the CE router.

Question 8

Given the following configuration snippet on a Cisco 9800 WLC:

wireless profile policy test-policy
 no security ft
 aaa-override
 no mac-filtering
 no wlan-switch
 central-switching

What is the effect of this configuration?

Accepted Answer

Client traffic is centrally switched through the WLC.. The `central-switching` command in the wireless profile policy forces all client traffic to be tunneled back to the WLC for processing, rather than being bridged locally at the AP. This is the definition of central switching, making option B correct. The `no wlan-switch` command further confirms that local switching is disabled.

Answer

Client traffic is locally switched at the AP.

Answer

Fast roaming (802.11r) is enabled for this policy.

Answer

MAC filtering is enabled for client authentication.

Question 9

A company is deploying a virtualized router (CSR1000v) on VMware vSphere. The VNF must support high throughput and low latency. Which vSphere configuration option should the architect select to optimize network performance?

Accepted Answer

Enable SR-IOV on the physical NIC and assign virtual functions to the VM.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces latency and CPU overhead, making it ideal for high-throughput, low-latency VNFs like the CSR1000v. Option B is correct because SR-IOV provides near-native performance by allowing the VM to directly access the NIC hardware.

Answer

Use the default e1000 NIC driver.

Answer

Use VMXNET3 paravirtualized NIC.

Answer

Configure the VM with multiple vCPUs and large memory.

Question 10

A network engineer configures SNMPv2c on a Cisco router to monitor CPU and memory utilization. The NMS is reachable and configured with the same community string 'public'. However, the NMS receives no traps from the router. The engineer verifies that the router's SNMP configuration includes 'snmp-server enable traps' and 'snmp-server host 192.168.1.100 version 2c public'. What is the most likely cause of the missing traps?

Accepted Answer

The router lacks specific trap configuration for CPU and memory utilization.. SNMPv2c requires explicit trap configuration for specific MIB objects. The 'snmp-server enable traps' command enables generic trap notifications (like linkUp/linkDown), but CPU and memory utilization traps are defined in the CISCO-PROCESS-MIB and CISCO-MEMORY-POOL-MIB, which require additional 'snmp-server enable traps cpu' and 'snmp-server enable traps memory' commands. Without these specific configurations, the router will not send CPU or memory utilization traps even if the NMS is reachable.

Answer

The router's SNMP agent is disabled.

Answer

The community string 'public' is not defined on the router.

Answer

The NMS is using SNMPv3, which is incompatible with SNMPv2c traps.

Question 11

Consider this configuration for TrustSec on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/5
 cts manual
 sap pmk AABBCCDDEEFF00112233445566778899 mode-list both
 propagate sgt

What is the purpose of the 'propagate sgt' command under the interface?

Accepted Answer

It enables the switch to insert SGT tags into packets forwarded out of this interface.. The 'propagate sgt' command under a TrustSec manual interface instructs the switch to insert the Security Group Tag (SGT) into packets that are forwarded out of this interface. This is essential for downstream devices to receive the SGT and enforce role-based access control (RBAC) based on the source's security group. Option B correctly identifies this behavior.

Answer

It allows the switch to receive SGT information from the connected device.

Answer

It enables the switch to enforce role-based access control on this interface.

Answer

It configures the interface to use SXP for SGT propagation.

Question 12

An architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation based on user identity and device type, and must integrate with Cisco ISE. Which fabric component and protocol should be used to enforce micro-segmentation?

Accepted Answer

Deploy Cisco TrustSec with SGTs and integrate with ISE.. Cisco TrustSec with Security Group Tags (SGTs) is the correct choice because it provides identity- and device-type-based micro-segmentation in an SD-Access fabric. SGTs are assigned by Cisco ISE based on user/device attributes, and the fabric enforces policies by tagging packets with SGTs, allowing granular traffic filtering regardless of IP address or VLAN.

Answer

Use VXLAN with BGP EVPN for segmentation.

Answer

Use LISP to map endpoints to virtual networks.

Answer

Implement VLAN-based segmentation with 802.1X.

Question 13

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

Accepted Answer

The switch is not configured to assign SGTs to users via 802.1X or static mapping.. The SXP protocol only propagates SGT-to-IP mappings that already exist on the speaker device. If the switch is not configured to assign SGTs to users via 802.1X or static mapping, no SGT mappings will be generated to send to ISE. The 'show cts role-based sgt map' command displays the local SGT mapping table, which remains empty because the switch has no mechanism to associate users with SGTs.

Answer

The SXP version mismatch between the switch and ISE.

Answer

The ISE is configured as an SXP speaker instead of a listener.

Answer

The SXP connection is using the wrong TCP port.

Question 14

An engineer is using the Cisco DNA Center REST API to retrieve a list of network devices and their health scores. The engineer writes a Python script using the requests library. The script successfully retrieves data for the first 100 devices, but when trying to get the next 100, the API returns an empty list. The engineer checks the API documentation and finds that the endpoint supports pagination with the 'offset' and 'limit' parameters. The current script does not handle pagination. What should the engineer do to retrieve all devices?

Accepted Answer

Write a loop that increments the 'offset' parameter by the 'limit' value until all pages are retrieved.. The Cisco DNA Center REST API uses offset-based pagination, where the 'offset' parameter specifies the starting index and 'limit' defines the number of records per page. To retrieve all devices, the engineer must write a loop that increments the offset by the limit value (e.g., 100) in each iteration until the API returns an empty list, indicating all pages have been fetched. This approach ensures complete data retrieval without exceeding any API-imposed maximum limit.

Answer

Increase the 'limit' parameter to 1000 in a single API call.

Answer

Use the 'next' URL from the response headers to automatically fetch the next page.

Answer

Switch to using the Cisco DNA Center Python SDK which handles pagination automatically.

Question 15

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

Accepted Answer

STP will cause slow convergence and inefficient use of redundant links.. STP (802.1D) converges slowly, typically taking 30-50 seconds (listening + learning states) after a topology change. In a large campus network with 5000 users, this delay causes unacceptable downtime. Additionally, STP blocks redundant links to prevent loops, wasting bandwidth that could be used for load balancing. Modern alternatives like Rapid PVST+ (802.1w) or MST (802.1s) offer sub-second convergence, making classic STP a poor choice for high-availability designs.

Answer

STP requires all switches to be in the same VLAN to function correctly.

Answer

STP cannot be used with 5000 users due to MAC address table limitations.

Answer

STP will cause broadcast storms in a three-building design.