350-401 Practice Exam 51 — 20 Questions

Question 1

What is the purpose of the Dynamic Trunking Protocol (DTP) on Cisco switches?

Accepted Answer

To automatically negotiate trunking between two Cisco switches.. DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol used to automatically negotiate the operational mode (access or trunk) of a switch port between two Cisco switches. When both ends are configured with DTP modes like dynamic desirable or dynamic auto, the link can become a trunk without manual configuration, simplifying deployment in environments where trunking is needed.

Answer

To dynamically assign VLANs to access ports.

Answer

To provide security by encrypting trunk traffic.

Answer

To prevent loops in the network.

Question 2

Which two statements about the QoS trust boundary on a Cisco switch are true? (Choose two.)

Accepted Answer

On a trunk port, the switch can be configured to trust the CoS value by default.. The trust boundary defines which device in the network is trusted to mark QoS values. By default, Cisco switches trust the CoS value on trunk ports but do not trust the DSCP value on access ports. The trust boundary can be extended to the endpoint by configuring the switch port as trusted, and the Cisco IP Phone can override the marking from the attached PC.

Answer

By default, a Cisco switch port in access mode trusts the CoS value received from the attached device.

Answer

When a Cisco IP Phone is connected, the switch automatically trusts the CoS values from the phone but not from the PC behind the phone.

Answer

The 'trust device cisco-phone' command enables the switch to trust all CoS values from both the phone and the attached PC.

Question 3

Examine this Python script that uses the napalm library to manage a Cisco IOS-XE device:

```python
from napalm import get_network_driver
driver = get_network_driver('ios')
device = driver('192.168.1.1', 'admin', 'cisco')
device.open()
print(device.get_facts())
device.close()
```

What is the output of this script?

Accepted Answer

It prints a dictionary containing device facts like hostname, model, uptime, etc.. The script uses the napalm library with the 'ios' driver to connect to a Cisco IOS-XE device. The `get_facts()` method returns a dictionary containing device facts such as hostname, vendor, model, serial number, uptime, and OS version. Therefore, the output is a dictionary of these facts, not a configuration or connectivity test.

Answer

It displays the running configuration of the device.

Answer

It applies a configuration change to the device.

Answer

It tests connectivity to the device using ICMP.

Question 4

A company is deploying an SD-Access fabric with multiple sites connected via a WAN. The design must allow inter-site traffic to be forwarded without requiring a full mesh of VXLAN tunnels between all edge nodes. Which fabric role should be used to interconnect the sites?

Accepted Answer

Fabric border node. A Fabric Border Node is the correct role because it acts as the gateway between the SD-Access fabric and external networks, including WAN connections. It performs Network-to-Network Interconnection (NNI) by translating VXLAN-encapsulated traffic into the appropriate WAN transport (e.g., IPsec, MPLS) and handles inter-site routing without requiring a full mesh of VXLAN tunnels between all Edge Nodes. This design leverages the Border Node to aggregate traffic and forward it over the WAN, reducing tunnel overhead and simplifying the fabric architecture.

Answer

Fabric control plane node

Answer

Fabric edge node

Answer

Fabric WAN controller

Question 5

A network team is designing QoS for a multi-tenant data center using leaf-spine architecture. Each tenant requires guaranteed bandwidth for their mission-critical applications, while best-effort traffic must not interfere. The design must use hierarchical queuing to enforce per-tenant fairness. Which queuing mechanism should the architect implement on the leaf switches?

Accepted Answer

Implement hierarchical QoS (HQoS) with a parent policy shaping per-tenant traffic and a child policy applying class-based weighted fair queuing (CBWFQ) for each tenant's applications.. Hierarchical QoS (HQoS) is the correct choice because it allows the architect to enforce per-tenant bandwidth guarantees using a parent policy (shaping) while applying class-based weighted fair queuing (CBWFQ) in a child policy to prioritize each tenant's mission-critical applications. This two-level structure ensures that best-effort traffic from one tenant cannot starve another tenant's guaranteed traffic, meeting the multi-tenant fairness requirement.

Answer

Use a single level of CBWFQ on all interfaces, classifying traffic by tenant using VLANs.

Answer

Apply strict priority queuing for all mission-critical traffic across all tenants.

Answer

Configure separate physical interfaces for each tenant and apply independent QoS policies.

Question 6

A network engineer runs the following command on Router R1:

R1# show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 02:30:15       5
192.168.1.3     4        65003     500     498       10    0    0 00:15:20       3
10.0.0.2        4        65004       0       0        0    0    0 never    Active

Based on this output, what can be concluded?

Accepted Answer

The BGP session to 10.0.0.2 is down due to a TCP connection issue.. The BGP session to neighbor 10.0.0.2 is in the 'Active' state with 'never' uptime and zero messages sent/received. This indicates that the router is actively trying to establish a TCP connection (port 179) but has not yet succeeded, typically due to a connectivity issue such as an unreachable IP, ACL blocking, or incorrect neighbor configuration. The 'Active' state specifically means the BGP process is waiting for the TCP connection to complete, confirming a TCP-level problem.

Answer

All BGP neighbors are fully established.

Answer

The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

Answer

The router is receiving prefixes from all neighbors.

Question 7

An Ansible playbook uses the cisco.nxos.nxos_config module to configure a Nexus switch:

---
- hosts: nxos_switches
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure VLAN
      cisco.nxos.nxos_config:
        lines:
          - vlan 100
          - name Test_VLAN
        parents: vlan 100

What will be the result of this playbook?

Accepted Answer

The playbook will fail because the 'parents' parameter cannot be the same as the lines.. The `parents` parameter in the `cisco.nxos.nxos_config` module specifies the parent configuration context (e.g., `vlan 100`) under which the `lines` should be applied. When `lines` includes the same command as `parents` (e.g., `vlan 100`), it creates a conflict because the module attempts to enter the parent context and then apply the line again, which is invalid in NX-OS CLI syntax. This results in a playbook failure.

Answer

The playbook will successfully create VLAN 100 and set its name to Test_VLAN.

Answer

The playbook will fail because 'cisco.nxos.nxos_config' does not support VLAN configuration.

Answer

The playbook will work but only if the Nexus switch runs NX-OS 7.0 or later.

Question 8

Given the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 4 source interface GigabitEthernet1/0/6 tx
monitor session 4 destination interface GigabitEthernet1/0/7

What does this configuration do?

Accepted Answer

Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.. The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.

Answer

Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.

Answer

The configuration is invalid because the destination interface must be in the same VLAN as the source.

Question 9

A network engineer runs the following command on Router R7:

R7# show ip ospf virtual-links

Virtual Link OSPF_VL0 to router 2.2.2.2 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/1, Cost of using 10
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:07
  Adjacency State FULL

Based on this output, what can be concluded?

Accepted Answer

Router 2.2.2.2 is the other endpoint of the virtual link.. The output shows that the virtual link OSPF_VL0 to router 2.2.2.2 is up and the adjacency state is FULL. This confirms that router 2.2.2.2 is the remote endpoint of the virtual link, as the command displays the router ID of the neighbor at the other end of the virtual link.

Answer

The virtual link is used to connect area 0 to a non-backbone area.

Answer

The virtual link is down.

Answer

The virtual link uses area 0 as the transit area.

Question 10

Review the following configuration:

vrf definition CUSTOMER_A
 rd 65000:100
 route-target export 65000:100
 route-target import 65000:100
!
interface GigabitEthernet0/4
 vrf forwarding CUSTOMER_A
 ip address 192.168.100.1 255.255.255.0
!
router bgp 65000
 address-family ipv4 vrf CUSTOMER_A
  redistribute connected

What is the purpose of the 'redistribute connected' command under the VRF address-family?

Accepted Answer

It advertises the directly connected network of GigabitEthernet0/4 into BGP for VRF CUSTOMER_A.. The 'redistribute connected' command under the BGP address-family for VRF CUSTOMER_A injects the directly connected network on GigabitEthernet0/4 (192.168.100.0/24) into the BGP table for that VRF. This allows BGP to advertise that subnet to BGP peers within the VRF, enabling reachability to the VRF's local interface network.

Answer

It redistributes all BGP routes into the VRF's routing table.

Answer

It enables BGP to exchange routes with other VRFs on the same router.

Answer

It is used to leak routes between VRF CUSTOMER_A and the global routing table.

Question 11

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.54567
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:15:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.1.1

Based on this output, what can be concluded?

Accepted Answer

The LDP session is established over the GigabitEthernet0/0 interface.. The output shows 'State: Oper' (Operational), which indicates the LDP session is fully established and operational. The 'LDP discovery sources' line lists GigabitEthernet0/0 as the interface through which the peer (10.0.0.2) was discovered, confirming that the LDP session is established over that interface. This is the correct interpretation of the show command.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The peer is not sending any LDP messages.

Answer

The local router has only one label binding for the peer.

Question 12

Examine this IP SLA configuration on Router R1:

ip sla 4
 icmp-echo 10.4.4.4
 frequency 10
ip sla schedule 4 life forever start-time now
ip sla reaction-configuration 4 react timeout threshold-type immediate action-type triggerOnly

Which of the following is missing from this configuration to make it useful for tracking?

Accepted Answer

A 'track' object that references the IP SLA operation is missing.. The IP SLA operation is configured to monitor reachability to 10.4.4.4 and trigger an action on timeout, but without a 'track' object that references this IP SLA operation, the router has no mechanism to use the SLA state to influence routing decisions (e.g., via route policy or static route tracking). The 'track' object is essential to bridge the IP SLA monitoring to a routing or policy action, making the configuration useful for failover or conditional routing.

Answer

The 'frequency' command is missing; it should be set to 60 seconds.

Answer

The 'ip sla responder' must be configured on the target router.

Answer

The 'life' parameter should be set to a specific number of repetitions.

Question 13

Consider the following configuration for a FlexVPN spoke router:

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre ip
 tunnel protection ipsec profile FLEXPROF
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 ip nhrp map 10.0.0.1 192.168.1.1

What is the purpose of the 'ip nhrp map 10.0.0.1 192.168.1.1' command?

Accepted Answer

It provides a static mapping from the hub's tunnel IP (10.0.0.1) to the hub's physical IP (192.168.1.1) so the spoke can reach the hub.. The 'ip nhrp map 10.0.0.1 192.168.1.1' command statically maps the hub's tunnel IP address (10.0.0.1) to its physical (NBMA) IP address (192.168.1.1). This is required on the spoke because NHRP is used to resolve the hub's tunnel IP to its underlying transport address so the spoke can build the GRE/IPsec tunnel. Without this static mapping, the spoke would not know where to send packets destined for the hub's tunnel interface.

Answer

It maps the spoke's tunnel IP to its own physical interface IP for local routing.

Answer

It enables multicast mapping for dynamic spoke discovery.

Answer

It configures the spoke to register with the hub using the specified physical address.

Question 14

A network engineer runs the following command on Router R1:

R1# show bgp ipv4 unicast 10.0.0.0/8
BGP routing table entry for 10.0.0.0/8, version 25
Paths: (2 available, best #2, table default)
  Advertised to update-groups:
     1
  Refresh Epoch 1
  65050 65100
    10.0.1.2 from 10.0.1.2 (10.0.0.2)
      Origin IGP, metric 0, localpref 100, weight 0, valid, external
      rx pathid: 0, tx pathid: 0x0
  65050
    10.0.1.3 from 10.0.1.3 (10.0.0.3)
      Origin IGP, metric 0, localpref 100, weight 0, valid, external, best
      rx pathid: 0, tx pathid: 0x0

Based on this output, what can be concluded?

Accepted Answer

Path #2 is the best path because it has a shorter AS_PATH.. BGP selects the best path based on a set of well-defined tie-breaking rules. After comparing weight, local preference, and origin, the next step is AS_PATH length. Path #2 has an AS_PATH of '65050' (one AS), while Path #1 has '65050 65100' (two ASes). Since a shorter AS_PATH is preferred, Path #2 is chosen as the best path, making option B correct.

Answer

Path #1 is the best path because it has a longer AS_PATH, indicating more specific routing.

Answer

Both paths are equally preferred, and BGP uses tie-breaking rules like router ID.

Answer

Path #2 is the best path because it is received from a higher IP address.

Question 15

Given the following SD-WAN CLI output on a Cisco IOS-XE router:

show sdwan omp routes

10.1.1.0/24, received, admin-distance: 250
   via 10.0.0.1, interface GigabitEthernet0/0/1, color biz-internet, loss: 0, latency: 10
   via 10.0.0.2, interface GigabitEthernet0/0/2, color 3g, loss: 1, latency: 50

Which statement is true?

Accepted Answer

The route via 10.0.0.1 (biz-internet) is preferred because it has lower loss and latency.. OMP (Overlay Management Protocol) in Cisco SD-WAN selects the best path based on the lowest path cost, which is calculated using metrics such as loss, latency, and jitter. In this output, the route via 10.0.0.1 (biz-internet) has loss 0 and latency 10, which is lower than the route via 10.0.0.2 (3g) with loss 1 and latency 50, making it the preferred path. The admin-distance of 250 is specific to OMP routes and does not affect this comparison.

Answer

The route via 10.0.0.2 (3g) is preferred because it has a higher latency, which indicates a more stable path.

Answer

Both routes are equally preferred because OMP uses ECMP by default.

Answer

The admin-distance of 250 indicates that these routes are learned via BGP.

Question 16

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 17

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will use a 10-second hello interval and suppress DR/BDR election.. The `ip ospf network point-to-point` command changes the OSPF network type on the interface to point-to-point, which suppresses the DR/BDR election process because point-to-point links have only two neighbors. The `ip ospf hello-interval 10` command overrides the default hello interval for point-to-point networks (which is 10 seconds by default anyway, but explicitly setting it ensures consistency). Thus, OSPF uses a 10-second hello interval and does not elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and elect a DR/BDR.

Answer

OSPF will use a 10-second hello interval but still elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and suppress DR/BDR election.

Question 18

Refer to the exhibit. An engineer notices that interface resets have occurred. What is the most likely cause of the interface resets?

Accepted Answer

Cable or hardware issue causing link flapping. Interface resets typically indicate that the interface has gone down and come back up, which is most commonly caused by a physical layer issue such as a faulty cable, damaged connector, or hardware problem that leads to link flapping. When the link flaps, the interface counters increment the 'resets' field, reflecting the number of times the interface has been reset due to a loss of carrier or a link state change. This is distinct from errors like CRC or collisions, which do not directly cause the interface to reset.

Answer

CRC errors due to noise

Answer

Collisions on the link

Answer

Interface is administratively down

Question 19

An engineer configures IP SLA 50 to monitor the response time of a TCP connection to a server at 10.1.1.1 on port 80. The operation is used to trigger a backup path. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 100 ms', but the server is actually down and not responding to TCP SYN packets. What is the most likely reason?

Accepted Answer

A stateful firewall or load balancer is responding to the TCP SYN on behalf of the server, causing the probe to succeed.. A stateful firewall or load balancer can intercept the TCP SYN packet sent by the IP SLA probe and respond with a SYN-ACK on behalf of the actual server, even if the server is down. This causes the IP SLA TCP connect operation to complete the three-way handshake and report a successful state with a valid RTT, misleading the engineer into thinking the server is reachable.

Answer

The IP SLA TCP connect probe does not actually verify that the server responds; it only checks if the port is open.

Answer

The IP SLA operation must be configured with a 'timeout' value lower than 100 ms to detect the failure.

Answer

The server is actually responding to the probe but not to other traffic because the probe uses a different source IP.

Question 20

An engineer is configuring a new access switch that connects to two distribution switches via trunk links. The distribution switches are configured with Rapid PVST+ and are both running as root bridges for different VLANs. The engineer wants to ensure that the access switch does not become the root bridge for any VLAN, even if the distribution switches fail. The engineer also wants to prevent any unauthorized switch from becoming root. What configuration should the engineer apply on the access switch?

Accepted Answer

Configure 'spanning-tree vlan 1-4094 priority 61440' and enable Root Guard on the uplink ports.. Setting the spanning-tree priority to 61440 (the highest possible value) ensures the access switch will never become the root bridge, even if the current root bridges fail. Enabling Root Guard on the uplink ports prevents any unauthorized switch from becoming root by placing the port into a root-inconsistent state if a superior BPDU is received, thus protecting the root bridge election.

Answer

Configure 'spanning-tree vlan 1-4094 priority 0' and enable BPDU Guard on the uplink ports.

Answer

Configure 'spanning-tree vlan 1-4094 priority 4096' and enable Loop Guard on the uplink ports.

Answer

Configure 'spanning-tree vlan 1-4094 priority 61440' and enable BPDU Guard on the uplink ports.