350-401 Practice Exam 53 — 20 Questions

Question 1

Given the following SPAN configuration on a Cisco IOS-XE switch:

monitor session 4 source interface GigabitEthernet1/0/6 tx
monitor session 4 destination interface GigabitEthernet1/0/7

What does this configuration do?

Accepted Answer

Only traffic transmitted from GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.. The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.

Answer

Both ingress and egress traffic on GigabitEthernet1/0/6 is copied to GigabitEthernet1/0/7.

Answer

Traffic on GigabitEthernet1/0/7 is mirrored to GigabitEthernet1/0/6.

Answer

The configuration is invalid because the destination interface must be in the same VLAN as the source.

Question 2

Consider the following configuration snippet:
```
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/2
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.1.0 0.0.0.255
```
What is the effect of this configuration?

Accepted Answer

It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.. This configuration implements dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The access list matches the 192.168.1.0/24 source network, and the 'ip nat inside source list 1 interface GigabitEthernet0/2 overload' command translates all matching inside local addresses to the single outside interface IP (203.0.113.1) using unique port numbers to differentiate sessions. This allows multiple internal hosts to share the public IP simultaneously.

Answer

It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.

Answer

It translates only traffic from 192.168.1.1 to the outside interface IP.

Answer

The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.

Question 3

A network engineer configures VRF-lite on a router with the following snippet:

vrf definition GREEN
 rd 200:1
!
interface GigabitEthernet0/3
 vrf forwarding GREEN
 ip address 172.16.1.1 255.255.255.0
!
router ospf 10 vrf GREEN
 network 172.16.1.0 0.0.0.255 area 0

What is missing from this configuration to enable proper OSPF routing within VRF GREEN?

Accepted Answer

The configuration is complete and OSPF will operate correctly within VRF GREEN.. The configuration is complete for VRF-lite OSPF routing. In VRF-lite, the 'vrf definition GREEN' with an RD, the interface assignment via 'vrf forwarding GREEN', and the OSPF process with 'vrf GREEN' and the network statement are all that is required. OSPF will operate correctly within VRF GREEN using the specified network in area 0.

Answer

The 'network' command should specify the interface instead of the subnet.

Answer

The 'vrf definition GREEN' must include a 'route-target' command.

Answer

The OSPF process must be configured under the global VRF context, not using 'vrf GREEN'.

Question 4

A network engineer runs the following command on Router R4:

R4# show mpls interfaces
Interface              IP            Tunnel   BGP Static Operational
GigabitEthernet0/0     Yes           No       No  No     Yes
GigabitEthernet0/1     Yes           No       No  No     Yes
GigabitEthernet0/2     No            No       No  No     No

Based on this output, what can be concluded?

Accepted Answer

MPLS is enabled and operational on GigabitEthernet0/0 and GigabitEthernet0/1.. The 'show mpls interfaces' command displays MPLS status per interface. The 'Operational' column indicates whether MPLS is actively forwarding labels. GigabitEthernet0/0 and GigabitEthernet0/1 both show 'Yes' in the Operational column, confirming MPLS is enabled and operational on those interfaces. GigabitEthernet0/2 shows 'No' in both the IP and Operational columns, meaning MPLS is not enabled or operational there.

Answer

MPLS is enabled on all three interfaces, but only Gi0/0 and Gi0/1 are operational.

Answer

BGP and Static label switching are enabled on Gi0/0 and Gi0/1.

Answer

Tunnel interfaces are configured on Gi0/0 and Gi0/1.

Question 5

A router has the following configuration snippet:

vrf definition RED
 rd 100:1
!
interface Loopback0
 ip vrf forwarding RED
 ip address 10.0.0.1 255.255.255.255
!
router eigrp 100
 address-family ipv4 unicast vrf RED autonomous-system 100
  network 10.0.0.1 0.0.0.0

What is the issue with this EIGRP configuration for VRF RED?

Accepted Answer

The EIGRP address-family is not activated because 'no shutdown' is missing under the address-family configuration.. The EIGRP address-family configuration for VRF RED is missing the 'no shutdown' command under the address-family mode. In Cisco IOS, EIGRP address-families are administratively shut down by default; without 'no shutdown', the EIGRP process for that VRF will not form adjacencies or advertise routes, even though the network command is correctly configured.

Answer

The 'network' command should use a wildcard mask of 0.0.0.255 instead of 0.0.0.0.

Answer

The VRF must be defined under 'router eigrp' globally before using address-family.

Answer

The loopback interface cannot be placed in a VRF because it is a virtual interface.

Question 6

Which three statements about PAgP (Port Aggregation Protocol) are true? (Choose three.)

Accepted Answer

PAgP uses the multicast MAC address 01-00-0c-cc-cc-cc for its protocol frames.. PAgP is a Cisco proprietary protocol for EtherChannel negotiation. It uses modes 'auto', 'desirable', and 'on'. PAgP packets are sent using Cisco's proprietary multicast address 01-00-0c-cc-cc-cc. PAgP supports up to 8 ports per channel and does not support standby ports. PAgP can detect misconfigurations.

Answer

PAgP can negotiate an EtherChannel with a device that runs LACP in active mode.

Answer

The PAgP modes 'desirable' and 'auto' will form an EtherChannel only if the neighbor is set to 'desirable' or 'auto'.

Question 7

A network engineer runs the following command on Router R7:

R7# show ip ospf virtual-links

Virtual Link OSPF_VL0 to router 2.2.2.2 is up
  Run as demand circuit
  DoNotAge LSA allowed.
  Transit area 1, via interface GigabitEthernet0/1, Cost of using 10
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:07
  Adjacency State FULL

Based on this output, what can be concluded?

Accepted Answer

Router 2.2.2.2 is the other endpoint of the virtual link.. The output shows that the virtual link OSPF_VL0 to router 2.2.2.2 is up and the adjacency state is FULL. This confirms that router 2.2.2.2 is the remote endpoint of the virtual link, as the command displays the router ID of the neighbor at the other end of the virtual link.

Answer

The virtual link is used to connect area 0 to a non-backbone area.

Answer

The virtual link is down.

Answer

The virtual link uses area 0 as the transit area.

Question 8

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 mpls ip
 mpls label protocol tdp
!
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
!
router ldp
 interface GigabitEthernet0/1
!
Which statement about this configuration is true?

Accepted Answer

The interface will use TDP for label distribution, ignoring the LDP configuration under router ldp.. The interface-level command `mpls label protocol tdp` explicitly sets TDP (Tag Distribution Protocol) for that interface. When both an interface-specific `mpls label protocol` command and a global `router ldp` configuration exist, the interface-level command takes precedence. Therefore, GigabitEthernet0/1 will use TDP for label distribution, and the LDP configuration under `router ldp` is effectively ignored for that interface.

Answer

The router will use LDP because the global configuration overrides the interface command.

Answer

Both TDP and LDP will be used simultaneously on the interface.

Answer

The configuration will fail because TDP is not supported on this platform.

Question 9

A network engineer is deploying 802.1X on a Cisco switch for a mixed environment of Windows laptops and IP phones. The engineer configures the switchport with 'authentication port-control auto' and 'dot1x pae authenticator'. After connecting a Windows laptop, the switch logs show 'Authentication failed' for the laptop. The engineer verifies that the RADIUS server is reachable and the laptop's supplicant is configured correctly. What is the most likely cause of the authentication failure?

Accepted Answer

The switch is not configured to send EAP-Request/Identity packets; the 'dot1x timeout tx-period' is too long or missing.. The most likely cause is that the switch is not sending EAP-Request/Identity packets to initiate the 802.1X authentication process. Even with 'authentication port-control auto' and 'dot1x pae authenticator' configured, if the 'dot1x timeout tx-period' is too long or missing, the switch may delay or fail to transmit the initial EAP-Request/Identity, causing the laptop's supplicant to never receive a challenge and eventually time out, resulting in an 'Authentication failed' log.

Answer

The switch lacks 'aaa new-model' configuration.

Answer

The switchport is configured as 'switchport mode trunk' instead of 'switchport mode access'.

Answer

The RADIUS server is not configured with the correct shared secret.

Question 10

A network engineer runs the following command on Router R7:

R7# show vrf brief
  Name                             Default RD            Protocols   Interfaces
  Mgmt-intf                        <not set>             ipv4,ipv6    GigabitEthernet0/0
  CUSTOMER-A                       65001:100             ipv4         GigabitEthernet0/1.10
  CUSTOMER-B                       65001:200             ipv4         GigabitEthernet0/1.20

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-B is associated with subinterface GigabitEthernet0/1.20.. The 'show vrf brief' output explicitly lists GigabitEthernet0/1.20 under the Interfaces column for VRF CUSTOMER-B, confirming that this subinterface is associated with that VRF. VRFs use subinterfaces to segment traffic for different customers or tenants on the same physical link, and the output directly shows this mapping.

Answer

VRF CUSTOMER-A is using IPv6.

Answer

VRF Mgmt-intf has a route distinguisher set.

Answer

All VRFs are using the same route distinguisher.

Question 11

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
        TCP connection: 10.0.0.2.646 - 10.0.0.1.54567
        State: Oper; Msgs sent/rcvd: 100/95; Downstream
        Up time: 00:15:30
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.0.0.2
        Addresses bound to peer LDP Ident:
          10.0.0.2        192.168.1.1

Based on this output, what can be concluded?

Accepted Answer

The LDP session is established over the GigabitEthernet0/0 interface.. The output shows 'State: Oper' (Operational), which indicates the LDP session is fully established and operational. The 'LDP discovery sources' line lists GigabitEthernet0/0 as the interface through which the peer (10.0.0.2) was discovered, confirming that the LDP session is established over that interface. This is the correct interpretation of the show command.

Answer

The LDP session is down due to a TCP connection issue.

Answer

The peer is not sending any LDP messages.

Answer

The local router has only one label binding for the peer.

Question 12

Drag and drop the steps of EtherChannel troubleshooting and verification into the correct order, from first to last.

Accepted Answer

Check physical link status and errors. Troubleshooting begins with checking physical layer, then verifying protocol negotiation, inspecting bundle state, checking load balancing, and finally reviewing logs.

Question 13

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

Accepted Answer

The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.. The CE router can ping the PE's VRF interface IP, confirming Layer 2 and VRF interface configuration are correct. However, the CE cannot reach remote VPNv4 routes, which indicates that the PE is not advertising or installing those routes into the VRF. The most likely cause is that the VRF CUSTOMER_A has not been activated under BGP using the 'address-family ipv4 vrf CUSTOMER_A' command, which is required to exchange IPv4 routes between the PE and CE within the VRF context and to redistribute them into MP-BGP for VPNv4 propagation.

Answer

The route-target import/export values are mismatched with the route reflector's configuration.

Answer

The CE router is not configured with a default route pointing to the PE.

Answer

The PE router needs the mpls ip command on the interface facing the CE router.

Question 14

Given the following EIGRP configuration:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 metric weights 0 1 1 1 0 0
!

What is the effect of the 'metric weights' command?

Accepted Answer

It sets the EIGRP metric to use bandwidth, load, and delay, ignoring reliability and MTU.. The 'metric weights' command in EIGRP allows you to modify the K values used in the composite metric calculation. The syntax is 'metric weights tos k1 k2 k3 k4 k5'. Here, the values are 0 1 1 1 0 0, meaning k1 (bandwidth) = 1, k2 (load) = 1, k3 (delay) = 1, k4 (reliability) = 0, k5 (MTU) = 0. This results in the metric using bandwidth, load, and delay, while ignoring reliability and MTU. Option A correctly describes this effect.

Answer

It disables EIGRP metric calculation and uses a fixed metric of 1.

Answer

It sets the EIGRP metric to use only bandwidth and delay, ignoring load, reliability, and MTU.

Answer

It configures EIGRP to use the default K values (1,0,1,0,0).

Question 15

An architect is designing an SD-WAN policy to ensure that real-time video traffic from headquarters to branch offices is always sent over the most reliable transport, while all other traffic uses the least-cost path. Which type of policy should be used to achieve this?

Accepted Answer

Centralized data policy configured on vSmart.. A centralized data policy configured on vSmart is correct because it allows the SD-WAN controller to enforce application-aware routing decisions across the fabric. By matching real-time video traffic and steering it over the transport with the highest loss/reachability metrics (most reliable), while using a separate rule to direct all other traffic over the least-cost path, the policy is applied globally from the vSmart controller without requiring per-router configuration.

Answer

Localized data policy applied on the vEdge router.

Answer

Centralized control policy for route manipulation.

Answer

Localized app-route policy on the branch vEdge.

Question 16

Given this configuration on a Cisco IOS-XE router:

crypto ikev2 keyring KEYRING
 peer SPOKE1
  address 192.168.2.1
  pre-shared-key cisco123
!
crypto ikev2 profile IKEV2_PROF
 match identity remote address 192.168.2.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
!

What is missing from this configuration for a successful IKEv2 tunnel to the peer at 192.168.2.1?

Accepted Answer

The IKEv2 proposal and policy are not defined and must be referenced by the profile or the IPsec profile.. The configuration is missing an IKEv2 proposal and an IKEv2 policy, which define the encryption, integrity, and DH group parameters for the IKEv2 SA. The profile must reference these via the 'proposal' command under the IKEv2 proposal or the 'match proposal' command under the IKEv2 policy; without them, the router has no agreed-upon parameters to negotiate with the peer, so the tunnel cannot be established.

Answer

The configuration is complete; no additional commands are needed.

Answer

The profile is missing the 'set transform-set' command to specify the IPsec transform set.

Answer

The keyring must use a different name to match the profile.

Question 17

Examine the following AAA configuration snippet:

aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line con 0
 login authentication CONSOLE
line vty 0 4
 login authentication default

What is the effect of this configuration?

Accepted Answer

Console login uses local authentication; VTY login uses local authentication; exec accounting is sent to TACACS+.. The configuration defines two AAA authentication login lists: 'default' and 'CONSOLE'. Both lists use the 'local' method, meaning they authenticate against the local user database. The 'aaa authorization exec default local' command enables local authorization for exec sessions, and 'aaa accounting exec default start-stop group tacacs+' sends accounting records for exec sessions to the TACACS+ server. The 'line con 0' applies the 'CONSOLE' list, and 'line vty 0 4' applies the 'default' list, so both use local authentication. Therefore, option A is correct.

Answer

Console login uses TACACS+ authentication; VTY login uses local authentication; exec accounting is disabled.

Answer

Both console and VTY login use TACACS+ authentication; exec accounting is sent to TACACS+.

Answer

Console login uses local authentication; VTY login uses TACACS+ authentication; accounting is not configured.

Question 18

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Accepted Answer

Classifier identifies traffic and adds NSH. SFC path setup starts with the classifier identifying traffic to be steered, then the classifier adds an NSH encapsulation to the packet. The first SFF receives the packet and forwards it to the first SF. After processing, the SF returns the packet to the SFF, which then forwards it to the next SFF in the chain. This repeats until the packet reaches the last SFF, which removes the NSH and forwards the packet.

Question 19

Router R6 has the following OSPF configuration:

router ospf 1
 router-id 6.6.6.6
 network 192.168.0.0 0.0.255.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet0/0
!
interface GigabitEthernet0/0
 ip address 192.168.1.6 255.255.255.0
 ip ospf 1 area 0

What is the effect of the 'passive-interface default' command?

Accepted Answer

Only GigabitEthernet0/0 is active; all other OSPF interfaces are passive.. The 'passive-interface default' command sets all OSPF interfaces to passive by default, meaning they will not send or receive OSPF hello packets and thus cannot form adjacencies. The subsequent 'no passive-interface GigabitEthernet0/0' overrides this for that specific interface, making it the only active OSPF interface. This matches option B.

Answer

All OSPF interfaces become passive, including GigabitEthernet0/0.

Answer

OSPF adjacencies are formed on all interfaces.

Answer

The 'passive-interface default' command is ignored because the 'network' command is used.

Question 20

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:32    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:35    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

R1 is a DROTHER on this segment.. The output shows R1 has a neighbor with state 2WAY/DROTHER (10.0.0.3), which indicates that R1 is also a DROTHER on this broadcast multiaccess segment. The FULL/DR neighbor (10.0.0.2) is the Designated Router, and since R1 is not the BDR (no FULL/BDR state), it must be a DROTHER.

Answer

R1 is the Backup Designated Router (BDR) on this segment.

Answer

R1 has a full OSPF adjacency with the neighbor 10.0.0.3.

Answer

The OSPF network type is point-to-point.