350-401 Practice Exam 58 — 20 Questions

Question 1

Which three statements about SD-WAN overlay tunnels and transport are true? (Choose three.)

Accepted Answer

Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.. SD-WAN uses DTLS or TLS for secure control plane tunnels, and IPsec for data plane tunnels. Each edge device builds multiple IPsec tunnels to other edge devices based on TLOC mapping. The transport can be any combination of MPLS, Internet, or LTE. TLOC uniquely identifies a WAN attachment point. OMP manages route distribution, not tunnel establishment.

Answer

SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.

Answer

OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.

Question 2

Drag and drop the steps of WRED configuration for TCP congestion avoidance into the correct order, from first to last.

Accepted Answer

Enable WRED on interface or in policy-map. First, enable WRED under an interface or policy-map. Then set the minimum and maximum thresholds for each IP precedence or DSCP value. Configure the mark probability denominator. Apply the policy-map to the interface. Finally, verify WRED operation using show queueing or show policy-map interface.

Question 3

Drag and drop the steps of traffic shaping vs policing configuration steps into the correct order, from first to last.

Accepted Answer

Define class-map to match traffic. First, identify the traffic to be shaped or policed using a class-map. Then configure the policy-map with either shape or police command. Apply the service-policy in the appropriate direction. For shaping, the router buffers excess traffic; for policing, it drops or re-marks. Finally, verify using show policy-map interface.

Question 4

Drag and drop the steps of NBAR2 application recognition and classification steps into the correct order, from first to last.

Accepted Answer

Enable NBAR2 with ip nbar protocol-discovery on interface. First, enable NBAR2 on the interface using ip nbar protocol-discovery. Then create a class-map to match the application using match protocol. Next, create a policy-map to mark or apply QoS actions. Apply the policy-map to the interface. Finally, verify NBAR2 statistics using show ip nbar protocol-discovery.

Question 5

Which three statements about Cisco SD-WAN architecture components and their roles are true? (Choose three.)

Accepted Answer

vManage provides a centralized dashboard for configuration, monitoring, and troubleshooting of the entire SD-WAN fabric.. The vManage is the management plane for centralized configuration and monitoring. vSmart is the control plane for route and policy distribution. vBond orchestrates initial authentication and NAT traversal. vEdge routers are data plane devices that forward traffic. vSmart does not handle NAT traversal; that is vBond's role. vManage does not distribute routes; that is vSmart's role.

Answer

vSmart controllers are responsible for NAT traversal and public IP discovery for WAN Edge routers behind NAT.

Answer

vManage distributes OMP routes to vEdge routers to populate the overlay routing table.

Question 6

Drag and drop each QoS model on the left to its matching characteristic on the right.

Accepted Answer

IntServ: Uses RSVP to signal per-flow reservations. IntServ uses RSVP for per-flow signaling, DiffServ uses DSCP marking for per-hop behavior, Best Effort provides no guarantees, IntServ requires state in routers, and DiffServ scales well for large networks.

Question 7

Drag and drop the steps of DSCP re-marking at enterprise WAN edge into the correct order, from first to last.

Accepted Answer

Define class maps to match existing DSCP values. DSCP re-marking at the WAN edge begins by identifying the trust boundary, then classifying traffic based on existing markings, applying a policy map to re-mark DSCP values, and finally applying the service policy to the interface. This ensures consistent QoS treatment across the WAN.

Question 8

Drag and drop each queuing mechanism on the left to its matching use case on the right.

Accepted Answer

PQ: Strict priority for delay-sensitive traffic. PQ provides strict priority for delay-sensitive traffic, CBWFQ guarantees bandwidth for defined classes, LLQ combines strict priority with CBWFQ for real-time traffic, WFQ provides fair queuing for all flows, CBWFQ is used for data traffic requiring bandwidth guarantees.

Question 9

Which two statements about Cisco SD-WAN control plane components are true? (Choose two.)

Accepted Answer

vSmart controllers are responsible for distributing OMP routes and policies to vEdge routers.. The Cisco SD-WAN control plane consists of vSmart controllers that distribute OMP routes and vBond orchestrators that authenticate and onboard devices. vEdge routers are data plane devices, not control plane. vManage is a management plane component. TLOCs are used for transport location identification, not for route redistribution.

Answer

vEdge routers function as the control plane devices that maintain the routing table for the entire SD-WAN domain.

Answer

vManage is the control plane component that distributes BGP routes to all WAN Edge routers.

Answer

TLOCs are used by vSmart controllers to redistribute routes between different OMP instances.

Question 10

Which three statements about Cisco SD-WAN security and segmentation are true? (Choose three.)

Accepted Answer

Data plane traffic between vEdge routers is encrypted using IPsec tunnels.. Cisco SD-WAN uses IPsec for data plane encryption and supports multiple VPN segments (VRFs) for traffic isolation. Control plane encryption is also provided using DTLS or TLS. The data plane encryption is between vEdge routers, not between vSmart and vEdge. VPN segmentation is configured on vEdge routers, not on vSmart. The vBond orchestrator does not participate in data plane encryption.

Answer

Data plane encryption is performed between vSmart controllers and vEdge routers to protect OMP updates.

Answer

VPN segmentation is configured on the vSmart controller and pushed to vEdge routers via OMP.

Question 11

Drag and drop each DSCP value on the left to its matching Per-Hop Behavior (PHB) on the right.

Accepted Answer

EF: Expedited Forwarding. DSCP values map to specific PHBs: EF is for expedited forwarding, AF41 is Assured Forwarding class 4 low drop, CS3 is class selector 3, AF21 is Assured Forwarding class 2 medium drop, and BE (0) is best-effort.

Question 12

Drag and drop each CoS value on the left to its matching traffic type on the right.

Accepted Answer

CoS 5: Voice payload. CoS values are used in 802.1Q frames: CoS 5 for voice, CoS 4 for video, CoS 3 for call signaling, CoS 2 for critical data, CoS 0 for best-effort data.

Question 13

Drag and drop each queuing mechanism on the left to its matching use case on the right.

Accepted Answer

PQ: Strict priority queuing for delay-sensitive traffic. PQ gives strict priority to one queue, CBWFQ guarantees bandwidth to classes, LLQ combines strict priority with CBWFQ, WFQ provides fair queuing for flows, and CBWFQ is often used for data classes.

Question 14

Drag and drop the steps of LLQ configuration for voice traffic into the correct order, from first to last.

Accepted Answer

Create class map matching voice traffic. LLQ for voice requires first classifying voice traffic, then creating a policy map with a priority queue, applying it to the interface, and verifying the configuration. The priority queue ensures low latency for voice packets.

Question 15

Drag and drop the steps of NBAR2 application recognition and classification steps into the correct order, from first to last.

Accepted Answer

Enable ip nbar protocol-discovery on interface. NBAR2 configuration begins by enabling the protocol discovery, then creating a class map to match the application, a policy map to mark traffic, applying it to the interface, and verifying the classification. NBAR2 uses deep packet inspection to identify applications.

Question 16

Drag and drop each QoS model on the left to its matching characteristic on the right.

Accepted Answer

IntServ: Uses RSVP to reserve resources per flow. IntServ uses RSVP for per-flow signaling, DiffServ uses DSCP markings for per-hop behavior, Best Effort provides no guarantees, IntServ is not scalable for large networks, DiffServ offers classification and policing at the edge.

Question 17

Which two statements about the QoS trust boundary on a Cisco switch are true? (Choose two.)

Accepted Answer

On a trunk port, the switch can be configured to trust the CoS value by default.. The trust boundary defines which device in the network is trusted to mark QoS values. By default, Cisco switches trust the CoS value on trunk ports but do not trust the DSCP value on access ports. The trust boundary can be extended to the endpoint by configuring the switch port as trusted, and the Cisco IP Phone can override the marking from the attached PC.

Answer

By default, a Cisco switch port in access mode trusts the CoS value received from the attached device.

Answer

When a Cisco IP Phone is connected, the switch automatically trusts the CoS values from the phone but not from the PC behind the phone.

Answer

The 'trust device cisco-phone' command enables the switch to trust all CoS values from both the phone and the attached PC.

Question 18

Drag and drop each MQC component on the left to its matching role on the right.

Accepted Answer

class-map: Defines traffic classification using match statements. class-map defines traffic classification criteria, policy-map defines the QoS actions to apply, service-policy applies the policy-map to an interface, class-map uses match statements, and policy-map uses class statements.

Question 19

Drag and drop each CoS value on the left to its matching traffic type on the right.

Accepted Answer

CoS 0: Best effort data. CoS 0 is typically best effort, CoS 3 is voice signaling, CoS 4 is video conferencing, CoS 5 is voice bearer, CoS 6 is internetwork control (e.g., routing protocols).

Question 20

Which three statements about classification and marking in a QoS architecture are true? (Choose three.)

Accepted Answer

Classification can be based on the source IP address, destination port, or protocol type using an access control list.. Classification identifies traffic based on criteria like ACLs or NBAR, while marking sets QoS fields. Marking can be done at multiple layers (Layer 2 CoS, Layer 3 DSCP/IP Precedence) and should be performed as close to the source as possible. DSCP is preferred over IP Precedence due to its finer granularity. MPLS EXP is used in MPLS networks.

Answer

The MPLS EXP field is used to mark packets only at the ingress of an MPLS network and is never changed within the core.

Answer

NBAR (Network Based Application Recognition) can classify traffic by inspecting the payload up to Layer 7.