350-401 Practice Exam 57 — 20 Questions

Question 1

Drag and drop the steps of VNF life cycle management into the correct order, from first to last.

Accepted Answer

Onboard VNF package into NFVI. The correct order follows the ETSI NFV lifecycle: first onboard the VNF package, then instantiate the VNF, configure the VNF, scale the VNF as needed, and finally terminate the VNF when no longer required.

Question 2

Drag and drop the steps of BGP route aggregation and suppress-map process into the correct order, from first to last.

Accepted Answer

Define prefix-list for more-specific routes. The correct order for BGP route aggregation with suppress-map is: first, define a prefix-list to match the more-specific routes you want to suppress. Second, create a route-map with a suppress clause that references the prefix-list. Third, configure the aggregate-address in BGP under the address-family. Fourth, apply the suppress-map to the aggregate-address command (typically as part of the aggregate-address command itself). Finally, verify the summary route and the suppressed routes.

Question 3

Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.

Accepted Answer

Create VRF and assign route distinguisher. First, you create the VRF and assign an RD. Then, you configure the NAT inside and outside interfaces under the VRF. Next, you define the NAT pool and access list for translation. After that, you apply the NAT rules with 'ip nat inside source' referencing the VRF. Finally, you verify NAT translations using 'show ip nat translations vrf'.

Question 4

Drag and drop the steps of FlexVPN IKEv2 spoke registration to hub into the correct order, from first to last.

Accepted Answer

Spoke initiates IKEv2 SA to hub. FlexVPN uses IKEv2 for authentication and tunnel setup. The spoke initiates IKEv2 SA negotiation with the hub. After authentication, the hub assigns an IP address to the spoke via configuration payload. The spoke then registers its identity with the hub using IKEv2 notify messages. Finally, the spoke installs the tunnel route and can communicate.

Question 5

Which two statements about SPAN and RSPAN limitations are true? (Choose two.)

Accepted Answer

SPAN can cause increased CPU utilization on the switch if many packets are mirrored.. Option A is correct because SPAN mirrors copies of every matched frame to the destination port, and when large volumes of traffic are mirrored, the switch must replicate and forward those frames, which increases CPU and internal forwarding load. Option D is correct because a SPAN destination port is dedicated to receiving mirrored traffic; by design it does not participate in normal Layer 2 forwarding, so it cannot be used as a regular user or uplink port while configured as a destination. Option B is not correct because SPAN does not monitor control plane traffic such as routing protocol updates by default; control plane traffic is handled by the switch CPU and requires specific features like CPU port mirroring or control plane policing to observe. Option C is not correct because RSPAN VLANs should be allowed on the trunks carrying the monitored traffic, not pruned everywhere; pruning the RSPAN VLAN from all trunks would prevent the mirrored traffic from reaching the destination. Option E is not correct because RSPAN monitors traffic at Layer 2 and is not used to monitor traffic on a Layer 3 routed interface directly.

Answer

SPAN can monitor control plane traffic such as routing protocol updates by default.

Answer

RSPAN requires that the RSPAN VLAN be pruned from all trunks to avoid loops.

Answer

RSPAN can be used to monitor traffic on a Layer 3 routed interface.

Question 6

Examine this configuration for a site-to-site VPN on a Cisco router:

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/0/0
 ip address 10.0.0.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

Which statement about this configuration is true?

Accepted Answer

The access-list 101 defines the traffic that will be encrypted; traffic from 192.168.10.0/24 to 192.168.20.0/24 will be protected.. Access-list 101 is used by the crypto map to match traffic that should be encrypted via IPsec. The ACL permits traffic from source network 192.168.10.0/24 to destination network 192.168.20.0/24, so that traffic will be protected by the IPsec tunnel. This is the standard method for defining interesting traffic in a site-to-site VPN.

Answer

The crypto map uses IKEv2 for key exchange because the transform set uses SHA-256.

Answer

The ISAKMP policy lifetime of 86400 seconds is too long and will cause the tunnel to fail.

Answer

The crypto map should be applied to the tunnel interface, not the physical interface.

Question 7

Which two statements about NFV architecture and components are true? (Choose two.)

Accepted Answer

The NFV Infrastructure (NFVI) includes compute, storage, and networking resources that host VNFs.. Option A is correct because the NFV Infrastructure (NFVI) is defined by ETSI as the totality of hardware and software resources—compute (e.g., x86 servers), storage, and networking—on which VNFs are deployed and executed. Option B is correct because a Virtual Network Function (VNF) is precisely the software implementation of a network function (such as a firewall, router, or MME) that runs on virtualized infrastructure rather than on proprietary hardware. Option C is wrong because VNFs are designed to run on virtual machines or containers on shared, virtualized infrastructure, not on dedicated physical servers. Option D is wrong because VNF lifecycle management (instantiation, scaling, termination) is handled by the VNF Manager (VNFM), while the VIM manages the NFVI resources. Option E is wrong because allocating virtual resources to VNFs is the VIM's responsibility; the NFV Orchestrator focuses on end-to-end service orchestration and network service lifecycle management.

Answer

Each VNF must be deployed on its own dedicated physical server to ensure performance isolation.

Answer

The Virtualized Infrastructure Manager (VIM) is responsible for managing the lifecycle of VNFs.

Answer

The NFV Orchestrator is primarily responsible for allocating virtual resources to VNFs.

Question 8

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

Based on this output, what can be concluded?

Accepted Answer

Static NAT is configured for two internal hosts.. The output shows two inside global addresses (192.0.2.10 and 192.0.2.11) mapped one-to-one to inside local addresses (10.0.0.10 and 10.0.0.11), with no outside local or outside global entries. This is characteristic of static NAT, where each internal host is permanently assigned a specific global address, typically configured with 'ip nat inside source static' commands.

Answer

Dynamic NAT is configured with a pool of addresses.

Answer

PAT is translating multiple internal addresses to a single global address.

Answer

NAT is not operational because no outside local addresses are shown.

Question 9

Drag and drop each RESTCONF method on the left to its matching NETCONF equivalent on the right.

Accepted Answer

GET: Retrieve data (equivalent to get or get-config). RESTCONF GET retrieves data (like NETCONF get/get-config), POST creates a resource (like edit-config with operation create), PUT replaces a resource (like edit-config with operation replace), PATCH partially updates (like edit-config with operation merge), and DELETE removes a resource (like edit-config with operation delete).

Question 10

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. Option A is correct because in 802.1X the supplicant (client) exchanges EAP authentication messages with the authenticator encapsulated in EAP over LAN (EAPoL) frames, as defined by IEEE 802.1X. Option B is correct because the authenticator is the network access device that controls the port—typically a LAN switch or a wireless access point—and relays EAP messages between the supplicant and the authentication server. Option D is correct because the authentication server is normally a RADIUS server that validates the supplicant's credentials and returns an Access-Accept or Access-Reject to the authenticator. Option C is incorrect because it misidentifies the supplicant; the supplicant is the client device requesting access, while the RADIUS server acts as the authentication server. Option E is incorrect because 802.1X is defined for both wired and wireless LANs and is commonly deployed on wired switches as well as WLAN infrastructure.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 11

Drag and drop the steps of OSPF virtual link configuration into the correct order, from first to last.

Accepted Answer

Identify the ABR in the transit area. A virtual link connects a non-backbone area to Area 0 through a transit area. First, identify the ABR with the transit area, then configure the virtual link on both ABRs using the router ID of the neighbor, ensure the transit area has full OSPF adjacency, and finally verify the virtual link is operational.

Question 12

A service provider is migrating from a traditional IP core to an MPLS core. The engineer has configured LDP on all core routers and verified that LDP sessions are established. However, some prefixes learned via OSPF are not being assigned labels. The 'show mpls ldp bindings' command shows missing bindings for certain routes. What is the most likely cause?

Accepted Answer

The routes are not present in the global routing table on the router.. LDP assigns labels to every prefix present in the global routing table by default. If a prefix is not in the routing table (e.g., because it is a directly connected subnet that is not advertised via OSPF or is filtered by a route-map), LDP will not generate a label binding for it. The 'show mpls ldp bindings' command only displays bindings for routes that exist in the routing table, so missing bindings indicate the routes are absent from the global RIB.

Answer

The OSPF process is not redistributed into LDP.

Answer

LDP is configured to only assign labels to BGP routes.

Answer

The 'mpls ldp autoconfig' command is missing on OSPF.

Question 13

Drag and drop the steps of MST region configuration and operation into the correct order, from first to last.

Accepted Answer

Enter MST configuration mode and set region name. MST configuration begins with entering MST mode and defining the region name, revision number, and VLAN-to-instance mapping. After configuration, the switch computes an MD5 digest of the MST configuration to identify region membership. Switches in the same region then run IST (Internal Spanning Tree) and CIST (Common and Internal Spanning Tree) to elect a root bridge for the region. Finally, per-instance spanning trees are calculated within the region.

Question 14

Which two statements about using Python for network automation with Cisco devices are true? (Choose two.)

Accepted Answer

Netmiko is a Python library that simplifies SSH connections to network devices by handling authentication and session establishment.. Option A is correct because Netmiko is a Python library built on top of Paramiko that abstracts SSH connection details—handling authentication, session establishment, and device prompts—so scripts can interact with Cisco devices without manually managing low-level SSH. Option B is correct because NAPALM provides a vendor-agnostic API with methods such as get_facts(), get_interfaces(), and get_config() that retrieve operational state and configuration data across multiple vendors, including Cisco IOS, IOS-XR, NX-OS, and Junos. Option C is incorrect because Python is an interpreted language; scripts are executed by the Python interpreter and are not compiled into native machine code. Option D is incorrect because Netmiko supports many platforms beyond Cisco IOS, including Cisco IOS-XE, IOS-XR, NX-OS, ASA, Juniper, Arista, and others via its platform-specific drivers. Option E is incorrect because Paramiko is a lower-level SSH library, while Netmiko is the higher-level abstraction that adds network-device-specific automation features on top of Paramiko.

Answer

Python scripts for network automation are compiled into native machine code for faster execution.

Answer

The netmiko library can only be used with Cisco IOS devices.

Answer

Paramiko is a higher-level library than Netmiko and provides additional automation features.

Question 15

A network engineer runs the following command on Router R4:

R4# show ip sla monitor statistics 3

Round Trip Time (RTT) for Index 3
Latest RTT: 25 ms
Latest Operation Start Time: 14:30:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: OK
Number of successes: 100
Number of failures: 0
Over thresholds: 0

Based on this output, what can be concluded about the IP SLA operation?

Accepted Answer

The operation is working correctly with no failures.. The output shows 'Number of successes: 100' and 'Number of failures: 0', with a 'Latest Operation Return Code: OK', indicating that the IP SLA operation has been consistently successful without any failures. The latest RTT of 25 ms and the absence of threshold violations confirm the operation is working correctly.

Answer

The operation has experienced failures.

Answer

The operation is currently failing.

Answer

The round-trip time exceeds the threshold.

Question 16

Drag and drop the steps of MPLS LDP label distribution and FIB population into the correct order, from first to last.

Accepted Answer

Converge IGP (e.g., OSPF or IS-IS). First, IP routing must be operational so that the IGP converges. Then LDP is enabled on interfaces and forms neighbor relationships. LDP then assigns local labels to FECs and advertises them to neighbors. The remote label is received and installed in the LIB. Finally, the LFIB is populated with the best label bindings for forwarding.

Question 17

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

Accepted Answer

FlexConnect. FlexConnect (option D) is the correct architecture because it allows client data traffic to be switched locally at the remote site, while the control plane remains centralized. This design eliminates the need for a central controller to process every roaming event, as clients can roam between FlexConnect APs using local switching and 802.11r (Fast Roaming) without requiring a WLC in the data path.

Answer

Mesh networking

Answer

Autonomous APs

Answer

Centralized switching with a WLC

Question 18

Given the following Ansible playbook snippet:
---
- name: Backup running config
  hosts: routers
  gather_facts: no
  tasks:
    - name: Save config
      ios_config:
        backup: yes
        backup_options:
          dir_path: /backup/
What is the purpose of the 'backup_options' parameter?

Accepted Answer

It specifies the directory where the backup file will be saved.. The 'backup_options' parameter in the ios_config module allows you to customize the backup behavior. Specifically, the 'dir_path' sub-option defines the directory path where the backup file will be saved. Without this parameter, the backup file is saved in the default location (the 'backup' subdirectory of the playbook's root directory). Option A correctly identifies this purpose.

Answer

It specifies the filename for the backup.

Answer

It enables compression of the backup file.

Answer

It is ignored because backup: yes is already set.

Question 19

Drag and drop the steps of MPLS traffic engineering (MPLS-TE) tunnel setup into the correct order, from first to last.

Accepted Answer

Configure IGP with TE extensions (OSPF TE or IS-IS TE). First, IGP must be configured with TE extensions (e.g., OSPF TE) to flood link attributes. Then MPLS-TE is enabled on interfaces. The headend router computes a path using CSPF based on constraints. The tunnel interface is configured with the destination and constraints. Finally, RSVP-TE signals the LSP and reserves bandwidth along the path.

Question 20

A network engineer runs the following command on Router R2:

R2# show mpls forwarding-table
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  10.1.1.1/32      0             Gi0/0      192.168.1.1
17         18         10.2.2.0/24      1500          Gi0/1      192.168.2.3
18         Untagged   10.3.3.0/24      0             Gi0/2      192.168.3.4

Based on this output, what is the correct interpretation?

Accepted Answer

For prefix 10.1.1.1/32, the router will pop the MPLS label before forwarding because the outgoing label is 'Pop Label'.. The 'Pop Label' entry in the 'Outgoing Label' column indicates that for the prefix 10.1.1.1/32, Router R2 is the penultimate hop (PHP) in the MPLS network. According to MPLS PHP behavior, the router will remove (pop) the top label from the MPLS packet before forwarding the IP packet to the next hop (192.168.1.1), which is the egress LSR.

Answer

For prefix 10.2.2.0/24, the router will impose label 18 onto the packet.

Answer

For prefix 10.3.3.0/24, the router will forward the packet with an MPLS label of 18.

Answer

The router has received 1500 bytes for prefix 10.2.2.0/24, and the outgoing interface is Gi0/1.