350-401 Practice Questions 2 — 50 Questions

Question 1

Drag and drop the steps of RPF check verification for multicast forwarding into the correct order, from first to last.

Accepted Answer

Examine source IP address of multicast packet. The RPF check ensures that incoming multicast packets arrive on the correct interface toward the source. First, the router examines the source IP address. Then it consults the unicast routing table to find the best route. It identifies the outgoing interface for that route. It compares that interface with the arrival interface of the multicast packet. If they match, the packet is forwarded; otherwise, it is dropped.

Question 2

Drag and drop the steps of Rapid PVST+ topology change notification process into the correct order, from first to last.

Accepted Answer

Non-edge port transitions to forwarding. In Rapid PVST+, a topology change is triggered when a non-edge port transitions to forwarding. The switch then sets the proposal bit on its designated ports, sends a proposal message, and expects an agreement from the downstream switch. After receiving the agreement, the port moves to forwarding and the switch propagates the change by setting the TC flag in BPDUs sent on all designated ports. This ensures rapid convergence.

Question 3

Drag and drop the steps of the TACACS+ authentication process into the correct order, from first to last.

Accepted Answer

Client sends START packet to TACACS+ server. TACACS+ uses TCP and encrypts the entire packet. It separates authentication, authorization, and accounting. The server sends a GETUSERNAME prompt first, then GETPASSWORD, and finally an ACCEPT or REJECT.

Question 4

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

Accepted Answer

Create class map matching voice traffic. LLQ for voice requires first classifying voice traffic, then creating a policy map with a priority queue, applying it to the interface, and verifying the configuration. The priority queue ensures low latency for voice packets.

Question 5

A network engineer is troubleshooting a VRF-lite deployment on a Cisco Nexus 9000 switch. Two VRFs, PROD and DEV, are configured. The switch has an SVI for VLAN 10 in VRF PROD and VLAN 20 in VRF DEV. A firewall is connected to a Layer 3 port in VRF PROD for internet access. The engineer needs to allow the DEV VRF to reach the internet through the same firewall, but without using a separate physical interface. What should the engineer configure?

Accepted Answer

Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.. VRF-lite does not support direct route leaking between VRFs without an external mechanism. By configuring a static route in VRF DEV pointing to the firewall's IP address (which resides in VRF PROD) and using a route-map to leak the route, the engineer enables inter-VRF routing. This allows DEV traffic to reach the firewall's interface in PROD without requiring a separate physical interface, as the route-map controls which prefixes are shared between VRFs.

Answer

Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.

Answer

Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.

Answer

Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.

Question 6

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

Accepted Answer

The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 '.. The engineer's configuration includes both 'ip default-network 0.0.0.0' (which is an IGRP command, not EIGRP) and redistribution of a static default route. The appearance of the default route in the EIGRP topology table with metric 1 indicates that redistribution occurred, but the route is not being advertised to internal routers. The most likely reason is that the static default route itself is not correctly configured. For EIGRP redistribution to succeed, the static route must point to a valid next-hop IP address using the syntax 'ip route 0.0.0.0 0.0.0.0 '. If the engineer used an interface instead of a next-hop, or the next-hop is unreachable, the static route may be invalid or not installed in the routing table, preventing its advertisement to EIGRP neighbors.

Answer

The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.

Answer

The internal routers have a route to the default network with a better metric from another source.

Answer

The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.

Question 7

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

Accepted Answer

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.. gRPC uses HTTP/2 for transport and Protocol Buffers for serialization. gNMI is a gRPC-based protocol specifically for network management and telemetry. gNMI supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Set, Get). It uses YANG models to define data paths. gNMI does not require NETCONF; it operates independently over gRPC.

Answer

gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.

Answer

gNMI relies on NETCONF for session establishment and data encoding.

Question 8

A network engineer issues the following command on Router R2:

R2# show ip ospf interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet Address 192.168.1.2/24, Area 0
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 192.168.1.2
  Backup Designated router (ID) 1.1.1.1, Interface address 192.168.1.1
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 2, Adjacent neighbor count is 2
    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)
    Adjacent with neighbor 3.3.3.3

Based on this output, what can be concluded?

Accepted Answer

R2 has a full OSPF adjacency with all neighbors on this segment.. The output shows that R2 is the Designated Router (DR) on this broadcast segment, with two neighbors listed: 1.1.1.1 (BDR) and 3.3.3.3. The 'Adjacent neighbor count is 2' and both neighbors are listed as 'Adjacent with neighbor', confirming that R2 has formed full OSPF adjacencies with all neighbors on this segment. In OSPF broadcast networks, only the DR and BDR form full adjacencies with all routers, while non-DR/BDR routers only form full adjacencies with the DR and BDR.

Answer

R2 is the Backup Designated Router on this segment.

Answer

The OSPF cost to reach the network 192.168.1.0/24 is 20.

Answer

R2 will send hello packets every 40 seconds.

Question 9

Given the following Ansible playbook snippet:
---
- name: Configure interface
  hosts: routers
  gather_facts: no
  tasks:
    - name: Set IP address
      ios_config:
        lines:
          - ip address 192.168.1.1 255.255.255.0
          - no shutdown
        parents: interface GigabitEthernet0/1
What is the effect of this playbook?

Accepted Answer

It configures IP address 192.168.1.1/24 on interface GigabitEthernet0/1 and enables it.. The `ios_config` module uses the `parents` parameter to navigate into interface configuration mode before applying the `lines` commands. The `ip address 192.168.1.1 255.255.255.0` command configures the IP address with a /24 subnet mask, and `no shutdown` administratively enables the interface. This is the standard Cisco IOS behavior for interface configuration.

Answer

It configures the IP address globally, not under the interface.

Answer

It only configures the IP address; no shutdown is ignored because it is not a valid command.

Answer

It fails because 'parents' cannot be used with 'lines' in ios_config.

Question 10

Drag and drop each OSPF router role on the left to its matching function on the right.

Accepted Answer

DR: Generates the Network LSA and maintains full adjacencies with all routers on the segment. The DR (Designated Router) generates the Network LSA and manages LSDB synchronization on multiaccess networks. The BDR (Backup Designated Router) monitors the DR and takes over if the DR fails. DROTHERs form full adjacencies only with the DR and BDR, not with each other.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    30 deny tcp any any eq 22 (2 matches)
    40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Accepted Answer

SSH access from 192.168.1.0/24 would be denied.. The ACL 120 explicitly denies TCP traffic to port 22 (SSH) from any source not matching the earlier permit statements. The source 192.168.1.0/24 is not covered by the permit entries (10.0.0.0/8 or 172.16.0.0/16), so it hits line 30 (deny tcp any any eq 22) and is denied. The 5 matches on line 10 and 3 on line 20 confirm that only traffic from those specific subnets is permitted for SSH.

Answer

SSH access from 10.0.0.0/8 is denied.

Answer

All SSH traffic is permitted.

Answer

The ACL has an implicit deny at the end.

Question 12

Which two statements about IP Source Guard are true? (Choose two.)

Accepted Answer

IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.. IP Source Guard (IPSG) filters IP traffic on a per-port basis using the DHCP snooping binding database. Option A is correct because IPSG uses the binding database to validate source IP addresses. Option D is correct because IPSG can be configured with a static IP source binding for hosts with static IP addresses. Option B is incorrect because IPSG does not filter MAC addresses; that is the role of port security. Option C is incorrect because IPSG is applied on Layer 2 switch ports, not on Layer 3 interfaces. Option E is incorrect because IPSG does not require 802.1X; it can work with DHCP snooping alone.

Answer

IP Source Guard filters traffic based on the source MAC address.

Answer

IP Source Guard is applied on Layer 3 interfaces of a switch.

Answer

IP Source Guard requires 802.1X authentication to function.

Question 13

Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.

Accepted Answer

Define ERSPAN source interface(s) and direction. ERSPAN configuration requires first defining the source and destination, then enabling the session. The order ensures the session references exist before activation.

Question 14

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Certificate-based mutual authentication. EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses PAC, EAP-MD5 uses simple password hash.

Question 15

Drag and drop each NFV component on the left to its matching role on the right.

Accepted Answer

VNF: Virtualized network function software (e.g., virtual router). VNF is the virtualized network function software; NFVI is the infrastructure of compute, storage, and networking; MANO handles orchestration and lifecycle management.

Question 16

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG models are used to define the data structures streamed in telemetry subscriptions.. YANG models define the structure and constraints of telemetry data. Native models are vendor-specific, while OpenConfig models are standardized. IETF models are also standards-based but not vendor-specific. NETCONF uses YANG but is not a data model. RESTCONF is a protocol, not a model.

Answer

Native YANG models are standardized by the IETF and used universally.

Answer

NETCONF is a YANG data model used for telemetry configuration.

Answer

RESTCONF provides a YANG-based data model for streaming telemetry.

Question 17

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. 802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 18

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.. The issue is that the remote PE router does not have the correct route target import/export configuration for VRF CUSTOMER_C. In MPLS L3VPN, VRFs on different PEs must have matching route target values to import and export VPNv4 routes into the correct VRF. Even if the local PE is correctly configured, the remote PE must also import the routes from the local PE using the same route target. Without this, the remote PE will not install the VPNv4 prefixes into its VRF, causing the customer to be unable to reach sites connected to that remote PE.

Answer

Increase the MTU on the link between the PE routers.

Answer

Reconfigure LDP on the PE routers to establish a targeted session.

Answer

Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.

Question 19

A network engineer is troubleshooting an EtherChannel between two Cisco switches. The show etherchannel 1 port-channel command shows the port-channel is up, but traffic is not load-balanced evenly. The engineer notices that all traffic is using only one link. The physical ports are all configured identically. What is the most likely cause?

Accepted Answer

The load-balancing method is set to src-dst-ip, and all traffic is between the same two IP addresses.. When the load-balancing method is set to src-dst-ip, the hash is computed from the source and destination IP addresses. If all traffic flows between the same two IP addresses, the hash result will always be identical, causing all frames to be forwarded over the same physical link. This explains why the port-channel is up but only one link carries all traffic.

Answer

The load-balancing method is set to src-mac, and the traffic is from multiple MAC addresses.

Answer

The physical ports have different speeds.

Answer

The port-channel is configured with 'lacp fast-switchover'.

Question 20

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.