350-401 Practice Exam 58 — 20 Questions

Question 1

Drag and drop the steps of syslog message generation and storage into the correct order, from first to last.

Accepted Answer

Application or kernel generates syslog message. A process or kernel generates a syslog message with a facility and severity, the syslogd daemon compares the severity to the configured logging level, then writes the message to the local buffer, optionally forwards it to a remote syslog server, and finally the message is stored or displayed.

Question 2

A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?

Accepted Answer

Enable IP traffic export (NetFlow) on the switch.. The 'IP Input' process handles incoming IP packets that require CPU processing, such as routing protocol updates, management traffic, or packets destined to the switch itself. Enabling IP traffic export (NetFlow) on the switch allows the administrator to analyze traffic flows and identify the specific source/destination IP addresses, ports, and protocols consuming CPU cycles, without overwhelming the CPU further. NetFlow provides granular visibility into the types of packets being processed, making it the correct tool for this scenario.

Answer

Use extended ping from the switch to generate traffic.

Answer

Configure a SPAN session to capture all traffic to the CPU.

Answer

Check CDP neighbors to see if any devices are flooding.

Question 3

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

Accepted Answer

The hub router is configured with 'ip next-hop-self eigrp' under the tunnel interface.. In DMVPN Phase 3, spoke-to-spoke direct communication relies on the hub sending an NHRP Redirect to inform the source spoke of a better path. However, if the hub has 'ip next-hop-self eigrp' configured under the tunnel interface, EIGRP updates sent from the hub will set the next-hop to the hub's own tunnel IP address. This causes the spoke routers to install routes with the hub as the next-hop, preventing them from triggering an NHRP resolution for a direct spoke-to-spoke tunnel. The correct behavior for Phase 3 is to use 'no ip next-hop-self eigrp' so that the original spoke's next-hop is preserved, allowing spokes to resolve the destination via NHRP.

Answer

The hub router is configured with 'no ip next-hop-self eigrp' under the tunnel interface.

Answer

The spoke routers have 'ip nhrp shortcut' configured but the hub does not have 'ip nhrp redirect'.

Answer

The spoke routers are using static NHRP mappings to the hub only, without dynamic NHRP registration.

Question 4

Which TWO statements are true about RESTCONF and NETCONF in a Cisco IOS XE environment? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods (GET, POST, PUT, DELETE) and supports JSON and XML encoding.. RESTCONF is designed to use standard HTTP methods (GET, POST, PUT, DELETE, PATCH) for CRUD operations on YANG-defined data, and it supports both JSON and XML encoding formats. This aligns with its goal of providing a simpler, web-friendly interface compared to NETCONF.

Answer

RESTCONF supports the candidate datastore for editing configurations.

Answer

NETCONF uses HTTP as its transport protocol.

Answer

RESTCONF and NETCONF both support JSON and XML encoding.

Question 5

A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?

Accepted Answer

Internet Group Management Protocol (IGMP). IGMP is the protocol used between hosts and their directly connected routers to signal membership in multicast groups. When a host wants to receive traffic for a specific IPTV multicast stream, it sends an IGMP membership report, and the router uses this information to build its multicast forwarding state for that subnet. Without IGMP, the router would have no way of knowing which groups are of interest to local hosts.

Answer

Rendezvous Point (RP)

Answer

Protocol Independent Multicast (PIM)

Answer

Multicast Source Discovery Protocol (MSDP)

Question 6

A network engineer is troubleshooting a BGP issue where a router is not installing a specific prefix in its routing table, even though the prefix is present in the BGP table. The engineer runs 'show ip bgp 10.0.0.0/24' and sees that the route is valid but not best. The BGP table shows that the route has a higher local preference than the current best path, but the AS_PATH is longer. What is the most likely reason the route is not being selected as best?

Accepted Answer

The route with higher local preference has a lower weight than the current best path.. BGP selects the best path based on a sequence of comparison steps. Local preference is checked before AS_PATH length, so a higher local preference should normally win. However, weight is the very first criterion in the BGP best-path selection algorithm. If the current best path has a higher weight than the route with higher local preference, weight overrides local preference, making the higher-local-preference route not best.

Answer

The route with higher local preference has a higher MED value.

Answer

The route with higher local preference is not synchronized with IGP.

Answer

The route with higher local preference was learned from an eBGP peer, while the current best path is from an iBGP peer.

Question 7

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

Accepted Answer

The spoke is configured with a static IP address on the tunnel interface that is not in the hub's IP pool.. In a FlexVPN hub-and-spoke topology with IKEv2, the hub assigns IP addresses to spokes from a local pool. If the spoke's tunnel interface is configured with a static IP address that is not within the hub's pool, the hub will not recognize the spoke's tunnel IP as a valid address from its pool. This causes asymmetric routing: the hub can reach the spoke because it has a route to the static IP, but the spoke cannot reach the hub because the hub has no route back to the spoke's tunnel IP (or the hub's reverse route injection fails). The correct behavior is for the spoke to obtain its tunnel IP dynamically via IKEv2 configuration exchange or to use an IP from the hub's pool.

Answer

The hub is missing the 'tunnel protection ipsec' command on the tunnel interface.

Answer

The spoke's crypto map is not using the correct pre-shared key.

Answer

The hub's IKEv2 profile is not configured with 'authentication remote rsa-sig'.

Question 8

Drag and drop the steps of the 802.1X/EAP authentication process for a wireless client into the correct order, from first to last.

Accepted Answer

Client sends EAPoL-Start to AP. The correct order is: 1. Client sends EAPoL-Start to the AP (A). 2. AP sends EAP-Request Identity (B). 3. Client sends EAP-Response Identity (C). 4. RADIUS sends EAP-Request credentials (D). 5. Client sends EAP-Response credentials (E). This sequence is standard for 802.1X/EAP wireless authentication.

Question 9

Drag and drop the steps of SNMP trap generation and forwarding into the correct order, from first to last.

Accepted Answer

Agent detects event matching a trap condition. The SNMP agent monitors the device for a defined event, then builds a trap message including the OID and value, encapsulates it in a UDP packet, looks up the trap destination in the SNMP configuration, and finally forwards the packet to the NMS.

Question 10

A network engineer is configuring an EtherChannel between two Cisco switches. The engineer wants to use PAgP and ensure that the channel forms only if the neighboring switch is also configured for PAgP. Which mode should be configured on the local switch?

Accepted Answer

Configure 'channel-group 1 mode desirable' on the physical ports.. PAgP (Port Aggregation Protocol) is a Cisco proprietary protocol that negotiates EtherChannel links. The 'desirable' mode actively sends PAgP packets to initiate negotiation and will form a channel only with a neighbor also running PAgP (either in 'desirable' or 'auto' mode). This meets the requirement of ensuring the channel forms only if the neighbor is configured for PAgP.

Answer

Configure 'channel-group 1 mode auto' on the physical ports.

Answer

Configure 'channel-group 1 mode active' on the physical ports.

Answer

Configure 'channel-group 1 mode on' on the physical ports.

Question 11

Drag and drop the steps of configuring model-driven telemetry with gRPC on a Cisco IOS-XE device into the correct order, from first to last.

Accepted Answer

Enable telemetry feature globally. First, enable telemetry and define the destination. Then, create a subscription with a sensor path. Next, set the update policy. Finally, verify the telemetry data is being sent.

Question 12

Examine this configuration:

aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 privilege level 15

What is missing to ensure that VTY users are authenticated via TACACS+?

Accepted Answer

The 'aaa authentication login default' command should include 'group tacacs+' before 'local'.. The 'aaa authentication login default local' command specifies that the default login authentication method is local, meaning VTY users are authenticated against the local user database. To authenticate via TACACS+, the command must include 'group tacacs+' before 'local' so that TACACS+ is tried first, with local as a fallback. Without this, TACACS+ is never consulted for authentication, even though authorization and accounting are configured for TACACS+.

Answer

The 'aaa authorization exec default' command should include 'group tacacs+'.

Answer

The 'aaa accounting exec default' command should include 'group tacacs+'.

Answer

The 'privilege level 15' command under VTY lines is missing.

Question 13

A network engineer runs the following command on Router R1:

R1# show access-lists 130
Extended IP access list 130
    10 permit icmp host 10.1.1.1 any echo (8 matches)
    20 permit icmp host 10.1.1.1 any echo-reply (5 matches)
    30 deny icmp any any (3 matches)
    40 permit ip any any (12 matches)

Based on this output, what can be concluded?

Accepted Answer

ICMP packets from sources other than 10.1.1.1 are denied.. The ACL explicitly denies all ICMP traffic (line 30) except for echo and echo-reply from host 10.1.1.1 (lines 10 and 20). The 'deny icmp any any' statement matches ICMP packets from any source other than 10.1.1.1, and the 'permit ip any any' at line 40 only permits non-ICMP traffic. Therefore, ICMP packets from sources other than 10.1.1.1 are denied.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all traffic from 10.1.1.1.

Answer

The ACL is applied inbound on an interface.

Question 14

Drag and drop the steps of Ansible inventory grouping and variable inheritance into the correct order, from first to last.

Accepted Answer

Define group variables in group_vars directory. Ansible inventory grouping and variable inheritance follows a hierarchy: first, group variables are defined in group_vars files; then, host variables are defined in host_vars files; next, the inventory parser resolves group parent-child relationships; after that, variables are merged with child groups overriding parent groups; finally, host-specific variables take highest precedence.

Question 15

A network engineer is implementing model-driven telemetry on a Cisco Nexus 9000 switch to monitor VLAN and STP changes. The engineer wants to use the native telemetry protocol with UDP as the transport. After configuring the telemetry subscription with the 'destination-group' and 'sensor-group', the engineer notices that the collector is not receiving any data. The collector is reachable and the UDP port is open. What is the most likely missing configuration?

Accepted Answer

The engineer did not create a 'policy' that binds the sensor-group and destination-group. On Nexus 9000 model-driven telemetry, a subscription requires three components: a destination-group (collector address/port), a sensor-group (YANG paths), and a subscription policy that binds them together. Without the policy, the sensor-group and destination-group are defined but never associated, so no data is exported.

Answer

The engineer forgot to configure a 'source-interface' under the destination-group

Answer

The YANG models for VLAN and STP are not supported in the native telemetry protocol

Answer

The engineer used GPB encoding instead of JSON, and the collector only accepts JSON

Question 16

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50
!

What is the effect of this route-map on outbound updates to neighbor 10.0.0.2?

Accepted Answer

It sets the MED to 50 for all routes advertised to 10.0.0.2.. The route-map SET-MED is applied to outbound updates to neighbor 10.0.0.2 with a permit sequence 10 and a set metric 50 command, but no match statement. In BGP, a route-map with a permit clause and no match condition matches all routes by default. Therefore, the MED (Multi-Exit Discriminator) attribute is set to 50 for every route advertised to that neighbor.

Answer

It sets the MED to 50 for all routes advertised to 10.0.0.2, but only if they match a prefix-list.

Answer

It sets the local preference to 50 for routes received from 10.0.0.2.

Answer

It filters all routes to 10.0.0.2 because there is no match statement.

Question 17

Drag and drop the steps of configuring AAA on a Cisco IOS device into the correct order, from first to last.

Accepted Answer

Enable AAA globally with 'aaa new-model'. AAA configuration requires first enabling AAA globally, then defining the authentication method list, applying it to login, and optionally specifying a fallback method like local. Finally, verify with debug commands.

Question 18

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Port Gi0/6 is an access port in VLAN 20.. The 'show vlan brief' output lists VLANs and their assigned ports. Port Gi0/6 is listed under VLAN 20, and since it is the only port in that VLAN, it must be an access port (or a trunk port that only allows VLAN 20, but the context of a single port in a VLAN typically indicates an access port). Access ports belong to a single VLAN and do not carry tags, so Gi0/6 is an access port in VLAN 20.

Answer

VLAN 20 is not operational because it has only one port assigned.

Answer

The switch supports FDDI and Token Ring VLANs.

Answer

VLAN 10 has more broadcast traffic than VLAN 20.

Question 19

Drag and drop the steps of OSPF SPF calculation steps (Dijkstra) into the correct order, from first to last.

Accepted Answer

Initialize candidate list with root router. The Dijkstra algorithm first initializes the candidate list with the root node, then iteratively moves the lowest-cost candidate to the tree, updating neighbor costs, and finally builds the routing table from the shortest-path tree.

Question 20

Drag and drop the steps of Layer 3 EtherChannel (routed port-channel) setup into the correct order, from first to last.

Accepted Answer

Create port-channel interface with 'interface port-channel'. The correct order for Layer 3 EtherChannel (routed port-channel) setup is: first, create the port-channel interface using 'interface port-channel'. Next, configure the member ports as Layer 3 interfaces with 'no switchport' and assign them to the port-channel using 'channel-group'. Then, assign an IP address to the port-channel interface. After that, enable the port-channel interface with 'no shutdown'. Finally, verify routing using 'show ip route' and ping.