350-401 Practice Questions 2 — 50 Questions

Question 1

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Option C is correct because voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 2

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. Option B is correct because a trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 3

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

Accepted Answer

Add a static route for 192.168.1.0/24 with a lower administrative distance than OSPF.. Option B is correct because adding a static route for 192.168.1.0/24 with a lower administrative distance (e.g., 1) than OSPF (default 110) forces the router to prefer the static route over the OSPF-learned route, even though the OSPF metric is the same. This allows traffic to 192.168.1.0/24 to use a different next-hop (e.g., 10.0.0.1) while traffic to 192.168.2.0/24 continues using the OSPF-learned path via 10.0.0.2, achieving the desired path differentiation without altering OSPF metrics or using complex PBR.

Answer

Configure policy-based routing to match 192.168.1.0/24 and set the next hop to 10.0.0.1.

Answer

Use the 'distance ospf' command to change the OSPF administrative distance for all routes.

Answer

Adjust the OSPF cost on the interface to 10.0.0.2.

Question 4

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 5

An engineer is troubleshooting a BGP routing issue. The router is not receiving routes from an eBGP neighbor. The neighbor is reachable via ping. The BGP session is established and in the Established state. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. The BGP session is established, which confirms that the TCP connection and BGP open messages have been successfully exchanged. However, routes are not being received. The most common cause in this scenario is that the next-hop IP address for the advertised routes is not reachable via the router's routing table. eBGP by default sets the next-hop to the IP address of the neighbor's interface, and if that address is not reachable (e.g., missing route, incorrect static route, or interface down), the router will not install the routes into the BGP table or the routing table.

Answer

The AS number is incorrect.

Answer

The BGP session is using an incorrect interface.

Answer

The network is not advertised under BGP.

Question 6

Which TWO actions are valid for configuring 802.1Q trunking on a Cisco switch? (Choose two.)

Accepted Answer

switchport mode trunk. Option B is correct because the 'switchport mode trunk' command unconditionally sets the interface to trunk mode, enabling 802.1Q trunking. Option E is correct because 'switchport trunk encapsulation dot1q' explicitly configures the trunk encapsulation to the IEEE 802.1Q standard, which is required on older switches that support both ISL and 802.1Q.

Answer

switchport mode dynamic auto

Answer

switchport mode access

Answer

switchport trunk native vlan 1

Question 7

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

Accepted Answer

Type 1 hypervisor; it runs directly on the hardware, offering near-native performance for VNFs.. VMware vSphere is a Type 1 (bare-metal) hypervisor because it installs directly onto the physical server hardware without requiring a host operating system. This architecture eliminates OS overhead, allowing the Cisco CSR1000v VNF to achieve near-native performance for packet processing and routing functions, which is critical for meeting throughput and latency requirements in SD-WAN deployments.

Answer

Type 2 hypervisor; it runs on top of an operating system, providing flexibility for VNF management.

Answer

Type 1 hypervisor; it requires a host OS for management, adding overhead.

Answer

Type 2 hypervisor; it is embedded in the hardware firmware.

Question 8

A company has a requirement to provide redundancy for the default gateway on a subnet. Two switches are configured with HSRP. Which two interfaces on the switches must be in the same VLAN to form the HSRP group?

Accepted Answer

The interfaces must be Layer 2 switchports.. HSRP (Hot Standby Router Protocol) requires that all routers participating in the same HSRP group share the same Layer 2 broadcast domain, which is defined by the VLAN. The interfaces on the switches must be in the same VLAN so that HSRP hello messages (multicast to 224.0.0.2 with UDP port 1985) can be exchanged and the virtual IP address can be used as the default gateway for hosts in that VLAN. Without the same VLAN, the switches cannot communicate at Layer 2, and HSRP adjacency will not form.

Answer

The interfaces must be on the same physical switch.

Answer

The interfaces must have the same IP address.

Question 9

A network administrator is troubleshooting an issue where OSPF routes are not being learned from a neighbor. The administrator checks the OSPF configuration and sees that both routers are in the same area. The neighbor state is stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU does not match.. When OSPF neighbors are stuck in the EXSTART state, it typically indicates a problem with the Database Description (DBD) packet exchange process. The most common cause is an MTU mismatch between the interfaces, because OSPF will not proceed to the Exchange state if the DBD packet is larger than the interface MTU and gets silently dropped. This prevents the routers from agreeing on the master/slave relationship and exchanging link-state information.

Answer

The router ID is the same on both routers.

Answer

The area ID is different.

Answer

The hello timer is set to 30 seconds on one router.

Question 10

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 11

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

Accepted Answer

Apply a standard ACL to the vty lines.. Option D is correct because a standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Answer

Apply an extended ACL to the vty lines.

Answer

Apply a named ACL to the interface.

Answer

Apply an ACL to the console line.

Question 12

A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?

Accepted Answer

Check the cable and connectors for damage or loose connections.. CRC errors and runts on a trunk link typically indicate a Layer 1 physical-layer issue, such as faulty cabling, damaged connectors, or poor termination. The first and most logical step is to inspect and test the physical cable and connectors, as this is the most common root cause and the easiest to verify before making configuration changes.

Answer

Increase the MTU size on the interface.

Answer

Configure the interface with a different duplex setting.

Answer

Disable Dynamic Trunking Protocol (DTP) on the interface.

Question 13

Drag and drop the steps of SD-WAN overlay routing protocol (OMP) route advertisement sequence into the correct order, from first to last.

Accepted Answer

Edge device learns local routes via connected/static/dynamic. In OMP, the sequence starts with the edge device learning routes locally (connected, static, or dynamic), then redistributing them into OMP and sending to vSmart. vSmart processes and installs routes in its RIB, then advertises the best routes to other edge devices. The receiving edge device installs the route in its forwarding table and optionally redistributes into its local routing protocol.

Question 14

Drag and drop the steps of SD-WAN edge device (vEdge/cEdge) bring-up sequence into the correct order, from first to last.

Accepted Answer

Obtain IP address via DHCP. The correct order follows the Cisco SD-WAN device bootstrapping process: first the device obtains an IP address via DHCP, then it discovers the vManage using DNS or a redirect server, establishes a DTLS/TLS control connection to vManage, downloads its configuration, and finally establishes OMP sessions with vSmart controllers.

Question 15

Drag and drop the steps of Cisco SD-WAN control plane establishment sequence into the correct order, from first to last.

Accepted Answer

vBond orchestrates initial authentication and redirect. The control plane setup begins with vBond orchestrating initial authentication and directing devices to vManage and vSmart. Then each device establishes a DTLS/TLS connection to vManage for management. Next, devices establish DTLS/TLS connections to vSmart for control. After that, OMP peering is set up between edges and vSmart. Finally, BFD sessions are established between edge devices for data plane liveliness detection.

Question 16

A network engineer is configuring QoS on a Cisco router to prioritize business-critical applications. The engineer creates a class-map that matches traffic based on the destination IP address and port. However, the class-map does not match the expected traffic. What is the most likely reason?

Accepted Answer

The class-map uses 'match-all' but the engineer intended to use 'match-any'.. Option A is correct because when a class-map uses 'match-all', all match conditions must be true for a packet to be classified. If the engineer intended to match traffic based on either the destination IP address OR the port, using 'match-any' would allow the class-map to match if any single condition is met. The mismatch occurs because the class-map is too restrictive, requiring both conditions to be satisfied simultaneously.

Answer

The access-list used for matching is not applied to the correct interface.

Answer

The router does not support matching on both IP and port in the same class-map.

Answer

The class-map must be applied to the interface before it can match traffic.

Question 17

What is the purpose of the 'police' command in a QoS policy-map?

Accepted Answer

To limit the rate of traffic and take action (drop or remark) on packets that exceed the rate.. The 'police' command in a Cisco QoS policy-map implements traffic policing, which enforces a rate limit by measuring traffic flow and taking immediate action—typically dropping or remarking packets—when the traffic exceeds the configured rate. Unlike shaping, policing does not buffer excess traffic; it acts on packets in real time, making it ideal for marking down or discarding non-compliant traffic at the ingress or egress of an interface.

Answer

To shape traffic to a specific rate by buffering excess packets.

Answer

To prioritize traffic by assigning it to a strict priority queue.

Answer

To classify traffic based on IP precedence or DSCP values.

Question 18

Drag and drop the steps of the DiffServ traffic classification and marking pipeline into the correct order, from first to last.

Accepted Answer

Create a class map to match traffic. In the DiffServ QoS pipeline, traffic must first be classified using class maps, then marked with a policy map, and finally applied to an interface using a service policy. The order ensures that packets are identified, marked, and then enforced on the egress interface.

Question 19

Drag and drop the steps of the QoS trust boundary configuration process into the correct order, from first to last.

Accepted Answer

Enable trust on the interface (e.g., trust cos). The trust boundary process starts by enabling trust on the interface, then optionally setting a default CoS/DSCP for untrusted traffic, and finally applying a service policy to enforce policing or marking. Verification ensures the trust boundary is correctly applied.

Question 20

Drag and drop the steps of the QoS shaping and policing configuration sequence into the correct order, from first to last.

Accepted Answer

Define traffic classes using class maps. Shaping and policing require first defining traffic classes, then configuring the shaping/policing actions in a policy map, applying the policy to an interface, and finally adjusting parameters based on monitoring. This order ensures proper traffic control.