350-401 Practice Test 6 — 10 Questions

Question 1

Drag and drop each EAP method on the left to its matching authentication type on the right.

Accepted Answer

EAP-TLS: Certificate-based mutual authentication. EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses PAC, EAP-MD5 uses simple password hash.

Question 2

Drag and drop each NFV component on the left to its matching role on the right.

Accepted Answer

VNF: Virtualized network function software (e.g., virtual router). VNF is the virtualized network function software; NFVI is the infrastructure of compute, storage, and networking; MANO handles orchestration and lifecycle management.

Question 3

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG models are used to define the data structures streamed in telemetry subscriptions.. YANG models define the structure and constraints of telemetry data. Native models are vendor-specific, while OpenConfig models are standardized. IETF models are also standards-based but not vendor-specific. NETCONF uses YANG but is not a data model. RESTCONF is a protocol, not a model.

Answer

Native YANG models are standardized by the IETF and used universally.

Answer

NETCONF is a YANG data model used for telemetry configuration.

Answer

RESTCONF provides a YANG-based data model for streaming telemetry.

Question 4

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. 802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 5

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.

Question 6

A network engineer runs the following command on Switch SW7:

SW7# show monitor session 7
Session 7
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
Destination Ports     : Gi1/0/20
    Encapsulation      : Native
    Ingress            : Enabled

Based on this output, what can be concluded?

Accepted Answer

The destination port Gi1/0/20 can forward incoming traffic in addition to sending mirrored traffic.. The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Answer

This is an RSPAN session with a remote VLAN.

Answer

Only egress traffic from Gi1/0/1 is mirrored.

Answer

The destination port is configured to block all incoming traffic.

Question 7

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, PUT, POST, DELETE, and PATCH.. The correct answers are B and D. B is correct because RESTCONF uses HTTP methods like GET, PUT, POST, DELETE, and PATCH. D is correct because RESTCONF supports both JSON and XML encoding. A is incorrect because RESTCONF uses HTTP, not SSH. C is incorrect because RESTCONF is not a replacement for NETCONF; they are different protocols. E is incorrect because RESTCONF does not use remote procedure calls (RPCs) in the same way as NETCONF; it uses RESTful operations.

Answer

RESTCONF uses SSH for transport security.

Answer

RESTCONF is designed to replace NETCONF entirely.

Answer

RESTCONF uses remote procedure calls (RPCs) for all operations.

Question 8

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module:

```yaml
---
- name: Configure interface
  hosts: cisco-routers
  gather_facts: no
  tasks:
    - name: Set interface description
      cisco.ios.ios_interfaces:
        config:
          - name: GigabitEthernet0/1
            description: "Uplink to Core"
            enabled: true
        state: replaced
```

What is the result of running this playbook?

Accepted Answer

The interface will be configured with only the description and enabled state, removing any other existing configuration.. The 'state: replaced' will replace the entire interface configuration with only the provided parameters. This means that any existing configuration on GigabitEthernet0/1 (like IP address, speed, duplex) will be removed and only the description and enabled state will be applied. This is a common pitfall.

Answer

The interface will have the description set and all other parameters remain unchanged.

Answer

The playbook will fail because 'enabled' is not a valid parameter for ios_interfaces.

Answer

The playbook will fail because 'state: replaced' requires a 'before' and 'after' state.

Question 9

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to define data models for NETCONF and RESTCONF.. The correct answers are A, C, and E. A is correct because YANG is used to model configuration and operational data in NETCONF and RESTCONF. C is correct because YANG uses a tree-like hierarchical structure with containers and lists. E is correct because YANG supports data types such as string, int32, and enumeration. B is incorrect because YANG models are not written in XML; they use a custom syntax similar to SMIv2. D is incorrect because YANG modules are not compiled into MIB files; MIBs are for SNMP.

Answer

YANG models are written in XML syntax.

Answer

YANG modules are compiled into MIB files for SNMP.

Question 10

A network engineer is using the Cisco DNA Center REST API to retrieve the list of network devices. The engineer sends a GET request to '/dna/intent/api/v1/network-device' and receives a 400 Bad Request response. The API documentation indicates that the request requires a query parameter 'siteId'. What should the engineer do to resolve the issue?

Accepted Answer

Include the 'siteId' query parameter in the request URL.. A 400 Bad Request typically indicates a malformed request, such as missing required parameters. The API documentation specifies that 'siteId' is required, so the engineer must include it as a query parameter in the request.

Answer

Change the HTTP method to POST because GET is not supported for this endpoint.

Answer

Add an 'Authorization' header with a valid token because the API requires authentication.

Answer

Use a different API endpoint, such as '/dna/intent/api/v1/site', to retrieve device information.