350-401 Practice Exam 61 — 20 Questions

Question 1

An engineer is using a Python script to configure a new VLAN on a Cisco Nexus 9000 switch using the NX-API REST API. The script sends a POST request to 'https://switch/api/mo/org.json' with a JSON payload containing the VLAN configuration. The switch responds with a 403 Forbidden error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user account does not have the required RBAC privileges to configure VLANs.. A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. In NX-API, this often occurs when the user does not have sufficient privileges to perform the operation. The engineer should check that the user account used for authentication has the necessary RBAC roles to configure VLANs.

Answer

The payload format is incorrect; the engineer must use XML instead of JSON.

Answer

The switch does not support NX-API; the engineer must use NETCONF instead.

Answer

The URI is incorrect; the correct URI should be 'https://switch/api/node/mo/org.json'.

Question 2

Drag and drop the steps of 4G/LTE WAN failover with IP SLA tracking into the correct order, from first to last.

Accepted Answer

Configure primary WAN and LTE interfaces. First, configure the primary WAN interface and the LTE backup interface. Then, create an IP SLA probe to monitor the primary link. Track the SLA with a tracking object. Set a static route with a higher metric for the LTE interface, tied to the track. When the primary fails, the track goes down, and the LTE route becomes active.

Question 3

Drag and drop the steps of STP portfast and BPDU guard configuration into the correct order, from first to last.

Accepted Answer

Enable PortFast globally on all access ports. PortFast is enabled globally or per interface to bypass listening/learning. BPDU guard is then configured to disable the port if a BPDU is received. The configuration is applied to the interface, and the port transitions to forwarding immediately. Finally, errdisable recovery can be set.

Question 4

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 mpls ip
!
interface GigabitEthernet0/2
 ip address 10.2.2.1 255.255.255.0
 mpls ip
!
router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
!
router ldp
 interface GigabitEthernet0/1
!
What is the effect of this configuration?

Accepted Answer

LDP will only form an adjacency over GigabitEthernet0/1; no label exchange occurs on GigabitEthernet0/2.. LDP is explicitly enabled only on GigabitEthernet0/1 under the 'router ldp' configuration. Although MPLS IP is enabled on GigabitEthernet0/2, LDP does not automatically form an adjacency or exchange labels on that interface unless it is explicitly configured under the LDP router process. LDP adjacencies are interface-specific and require the 'interface' command under 'router ldp' to be activated.

Answer

LDP will automatically enable on GigabitEthernet0/2 because MPLS is enabled there.

Answer

The configuration will fail because LDP must be enabled on all MPLS interfaces.

Answer

OSPF will automatically enable LDP on all interfaces in area 0.

Question 5

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

Accepted Answer

The policy is not attached to the correct VPN or site list.. The most likely cause is that the policy is not attached to the correct VPN or site list. In Cisco SD-WAN, a centralized data policy must be applied to a specific VPN (e.g., VPN 0 for transport, VPN 10 for service-side) and/or a site list to take effect. Even if the policy correctly sets the preferred color to 'mpls', it will not influence traffic forwarding unless it is properly associated with the VPN carrying the voice traffic and the site list containing the affected routers.

Answer

The voice traffic is using a different DSCP value than the one defined in the policy.

Answer

The MPLS link is not in the 'up' state in the vManage overlay.

Answer

The policy is configured as a local policy instead of a centralized policy.

Question 6

Drag and drop the steps of hierarchical LAN design implementation phases into the correct order, from first to last.

Accepted Answer

Deploy access layer switches with VLANs. Hierarchical LAN design starts with the access layer for endpoint connectivity, then the distribution layer for policy and aggregation, followed by the core layer for high-speed transport. After physical design, VLANs and trunking are configured, and finally routing protocols are deployed for inter-VLAN communication.

Question 7

Which three statements about policing and shaping are true? (Choose three.)

Accepted Answer

Policing can be applied in both the inbound and outbound directions on an interface.. Policing drops or re-marks traffic exceeding a rate and does not buffer, while shaping buffers and smooths traffic to a lower rate. Both use token bucket algorithms. Shaping introduces delay but reduces drops, whereas policing can cause TCP retransmissions due to drops. Policing can be applied inbound or outbound, shaping typically outbound.

Answer

Shaping can be applied inbound to limit traffic entering an interface.

Answer

Policing always drops packets that exceed the configured rate and never re-marks them.

Question 8

Drag and drop each syslog severity level on the left to its matching numeric value on the right.

Accepted Answer

Emergency: 0. Syslog severity levels range from 0 (Emergency) to 7 (Debug).

Question 9

Drag and drop the steps of Flexible NetFlow flow record and exporter setup into the correct order, from first to last.

Accepted Answer

Define flow record with match and collect fields. The correct order begins with defining the flow record, then the flow exporter, then the flow monitor, then applying it to an interface, and finally verifying with show commands.

Question 10

Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.

Accepted Answer

Agent samples packets at configured rate. sFlow begins with the agent sampling packets at a configured rate, then extracts header and counter information, encapsulates the sample into an sFlow datagram, sends the datagram to the collector via UDP, and finally the collector analyzes the samples for monitoring.

Question 11

Drag and drop the steps of Netconf/Yang-based device monitoring subscription into the correct order, from first to last.

Accepted Answer

Establish NETCONF over SSH session. First establish NETCONF session, then subscribe to YANG data, then receive periodic updates, and finally unsubscribe.

Question 12

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

Accepted Answer

VXLAN encapsulation is used for data plane traffic within the fabric.. VXLAN is the encapsulation protocol used in the Cisco SD-Access fabric to carry data plane traffic between fabric edge nodes. VXLAN provides a Layer 2 overlay over a Layer 3 underlay, enabling scalable segmentation and mobility without VLAN limitations.

Answer

Wireless access points must be directly connected to the fabric edge switches.

Answer

Fabric edge nodes are responsible for connecting the fabric to external networks.

Answer

The fabric uses VLANs to isolate tenant traffic.

Question 13

Drag and drop the steps of AAA accounting for command logging setup into the correct order, from first to last.

Accepted Answer

Enable AAA globally on device. AAA accounting for commands requires first enabling AAA globally, then defining an accounting method list for commands. The method list is applied to a line (e.g., vty or console). The device then sends command logs to the accounting server, which records them.

Question 14

Drag and drop the steps of IP SLA scheduling with frequency and lifetime into the correct order, from first to last.

Accepted Answer

Create IP SLA operation. First, the IP SLA operation is created. Then the frequency (how often to run) is configured. The lifetime (how long to run) is set. The operation is scheduled to start. Finally, the schedule is verified.

Question 15

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Accepted Answer

Trust DSCP on the ingress interface. At the LAN boundary (switch port), DSCP is mapped to CoS for 802.1Q trunking. The order ensures proper trust, mapping, and queuing for consistent QoS across the campus network.

Question 16

Drag and drop the steps of IP SLA with threshold and reaction configuration into the correct order, from first to last.

Accepted Answer

Define IP SLA operation with type and target. First, define the IP SLA operation with a type and target. Then set the threshold values for the monitored metric. Next, configure the reaction to trigger on threshold violation. After that, schedule the operation to start. Finally, verify the configuration to ensure it works.

Question 17

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf hello-interval 20
 ip ospf dead-interval 80

What is the effect of this configuration?

Accepted Answer

The OSPF hello interval is changed to 20 seconds, and the dead interval is changed to 80 seconds, maintaining the default 4:1 ratio.. The configuration explicitly sets the OSPF hello interval to 20 seconds and the dead interval to 80 seconds, which maintains the default 4:1 ratio (dead = hello × 4). OSPF allows manual configuration of these timers, and as long as both sides of the adjacency match, the ratio can be any value; the 4:1 default is not enforced by the protocol.

Answer

The OSPF hello interval is changed to 20 seconds, but the dead interval remains at the default of 40 seconds.

Answer

The OSPF hello interval is changed to 20 seconds, and the dead interval is automatically set to 60 seconds.

Answer

This configuration will cause OSPF adjacency failure because the dead interval must be exactly 4 times the hello interval.

Question 18

Drag and drop the steps of IKEv2 fragmentation and DPD keepalive process into the correct order, from first to last.

Accepted Answer

Sender fragments IKE packet if over MTU. During IKEv2, if the IKE packet exceeds the MTU, the sender fragments it into smaller pieces. The receiver reassembles the fragments into the original packet. After the IKE SA is established, the peers send Dead Peer Detection (DPD) keepalives to verify connectivity. If no response is received, the peer retransmits the DPD. After multiple failures, the peer declares the SA dead and deletes it.

Question 19

Drag and drop each REST HTTP status code on the left to its matching meaning on the right.

Accepted Answer

200: Request succeeded and response body contains data. 200 OK indicates success, 201 Created indicates resource creation, 400 Bad Request indicates client error, 401 Unauthorized indicates authentication failure, 404 Not Found indicates missing resource, and 500 Internal Server Error indicates server failure.

Question 20

Drag and drop each authentication mode on the left to its matching behavior on the right.

Accepted Answer

Open: Allows traffic before authentication completes. Open mode allows traffic before authentication, closed mode blocks until success, monitor mode logs but does not enforce.