350-401 Practice Exam 63 — 20 Questions

Question 1

An engineer is designing a Layer 2 network with redundancy. The network uses MST (Multiple Spanning Tree) to reduce the number of STP instances. The engineer has configured two regions: Region 1 and Region 2. The engineer notices that switches in Region 1 are not forming a single MST region, and instead, they are treating each other as if they are in different regions. The engineer checks the configuration and finds that the region name and revision number are the same on all switches in Region 1, but the VLAN-to-instance mapping is different on one switch. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VLAN-to-instance mapping is not consistent across all switches in Region 1.. In MST, all switches within a region must agree on three parameters: the region name, the revision number, and the VLAN-to-instance mapping. Even if the region name and revision number match, a single mismatch in the VLAN-to-instance mapping causes the switches to treat each other as if they belong to different regions, preventing them from forming a single MST region.

Answer

The root bridge for each MST instance is not configured correctly.

Answer

BPDU Guard is enabled on the inter-switch links, preventing BPDU exchange.

Answer

PortFast is enabled on the inter-switch links, causing the switches to ignore BPDUs.

Question 2

Drag and drop the steps of RESTCONF GET with depth and field query parameters into the correct order, from first to last.

Accepted Answer

Construct the base RESTCONF URI for the resource. The process starts with constructing the URI, then appending depth and field parameters, sending the GET request, the server filtering the response, and finally the client parsing the returned data.

Question 3

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 4

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Create access-list to match control plane traffic. CoPP protects the control plane by filtering traffic. First, define an access-list to match the traffic of interest (e.g., SSH, BGP). Second, create a class-map to reference the access-list. Third, create a policy-map that assigns a police action (rate-limit) to the class. Fourth, apply the policy-map to the control plane in the inbound direction. Finally, verify the policy with show commands to ensure correct operation.

Question 5

Drag and drop each WPA security version on the left to its matching authentication method on the right.

Accepted Answer

WPA Personal: Pre-Shared Key (PSK). WPA Personal uses Pre-Shared Key (PSK); WPA Enterprise uses 802.1X/EAP; WPA2 Personal uses PSK; WPA2 Enterprise uses 802.1X/EAP; WPA3 Personal uses Simultaneous Authentication of Equals (SAE).

Question 6

A network engineer runs the following command on Router R4:

R4# show ip pim rp mapping
PIM Group-to-RP Mappings
This system is an RP (Auto-RP)
This system is an RP (BSR)
Group(s) 224.0.0.0/4
  RP 10.0.0.2 (?), v2v1
    Info source: 10.0.0.2 (?), elected via Auto-RP, expires in 00:01:30
  RP 10.0.0.3 (?), v2v1
    Info source: 10.0.0.3 (?), elected via BSR, expires in 00:02:00

Based on this output, what can be concluded?

Accepted Answer

Both Auto-RP and BSR are configured, causing multiple RP mappings.. The output shows two separate RP mappings for the same group range 224.0.0.0/4: one from Auto-RP (RP 10.0.0.2) and one from BSR (RP 10.0.0.3). The router also explicitly states 'This system is an RP (Auto-RP)' and 'This system is an RP (BSR)', confirming that both protocols are actively configured and providing RP information, leading to multiple RP mappings.

Answer

Only Auto-RP is being used for RP mapping.

Answer

Only BSR is being used for RP mapping.

Answer

The router is not an RP.

Question 7

Which three statements about the benefits and challenges of NFV are true? (Choose three.)

Accepted Answer

NFV reduces capital expenditure by allowing network functions to run on standard, off-the-shelf hardware.. Option A is correct because NFV replaces purpose-built, proprietary appliances with Virtual Network Functions (VNFs) running on commercial off-the-shelf (COTS) x86 servers, which lowers capital expenditure on specialized hardware. Option B is correct because decoupling network functions from proprietary hardware lets operators deploy and scale new services as software images, dramatically shortening service creation and time-to-market cycles. Option C is correct because the hypervisor/virtualization layer and virtual switching (e.g., vSwitch, SR-IOV, DPDK overhead) add processing latency and throughput penalties compared with bare-metal network functions, which is a recognized NFV performance challenge. Option D is not correct because consolidating many functions onto shared hardware and hypervisors actually enlarges the attack surface and creates new hypervisor and multi-tenancy risks rather than reducing it. Option E is not correct because NFV virtualizes network functions, not physical links; physical cabling and the underlying transport network are still required to interconnect servers, switches, and storage.

Answer

NFV reduces the overall security attack surface by consolidating multiple functions into a single physical device.

Answer

NFV eliminates the need for physical cabling in the data center.

Question 8

Drag and drop the steps of LDP session establishment between LSRs into the correct order, from first to last.

Accepted Answer

LSRs send LDP Hello messages (UDP). LDP session establishment starts with discovering neighbors via Hello messages over UDP, then opening a TCP connection. The LSRs exchange initialization parameters over TCP, followed by Keepalive messages to confirm the session. Finally, label mappings are exchanged for FECs.

Question 9

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. Standard ACLs are configured by first entering global configuration mode, then defining ACL entries with permit or deny statements, where each entry specifies a source IP and wildcard mask. After defining all entries, the ACL is applied to an interface in the inbound or outbound direction. Finally, verification with 'show access-lists' confirms the ACL is active and shows hit counts.

Question 10

A company uses VRF-lite to separate management traffic (VRF MGMT) from user traffic (VRF USER) on a Cisco Catalyst 3850 stack. The management network is 10.0.0.0/24, and the user network is 192.168.1.0/24. The engineer wants to allow SSH access from the user network to the management network for device administration. The switch has an SVI for each VRF. What is the simplest way to achieve this while maintaining VRF isolation?

Accepted Answer

Configure a static route in VRF USER pointing to the VRF MGMT's SVI IP address, and enable route leaking between the VRFs.. VRF-lite inherently isolates routing tables, so to allow SSH from VRF USER to VRF MGMT while maintaining isolation, you must leak routes between the VRFs. A static route in VRF USER pointing to the VRF MGMT SVI IP address, combined with route leaking (e.g., using `route-map` and `import/export` commands), enables the necessary reachability without merging the VRFs. This is the simplest method as it avoids additional hardware or complex configurations.

Answer

Place both SVIs in the same VRF and use access-lists to restrict traffic.

Answer

Use a firewall between the VRFs to filter traffic.

Answer

Configure the switch to use the global routing table for SSH traffic only.

Question 11

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Accepted Answer

Step 1: Enable port security (switchport port-security), Step 2: Set maximum MAC addresses (switchport port-security maximum), Step 3: Define secure MAC addresses (switchport port-security mac-address sticky or static), Step 4: Configure violation mode (switchport port-security violation shutdown/restrict/protect). Port security limits unauthorized MAC addresses; violation mode defines action on violation.

Answer

Step 1: Set maximum MAC addresses, Step 2: Enable port security, Step 3: Define secure MAC addresses, Step 4: Configure violation mode

Answer

Step 1: Configure violation mode, Step 2: Enable port security, Step 3: Set maximum MAC addresses, Step 4: Define secure MAC addresses

Answer

Step 1: Enable port security, Step 2: Define secure MAC addresses, Step 3: Set maximum MAC addresses, Step 4: Configure violation mode

Question 12

A network engineer runs the following command on switch SW9:

SW9# show cts role-based policy

Role-based policy:

Source Group   Dest Group   Action
10             20           PERMIT
10             30           DENY
20             30           PERMIT

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 20 to SGT 30 is permitted.. The command 'show cts role-based policy' displays Cisco TrustSec (CTS) role-based policies that define access control between source and destination Security Group Tags (SGTs). The output shows that traffic from SGT 20 to SGT 30 is explicitly permitted (PERMIT action), making option B correct. These policies are unidirectional, meaning the action applies only from the specified source group to the specified destination group.

Answer

Traffic from SGT 10 to SGT 20 is denied.

Answer

Traffic from SGT 30 to SGT 10 is denied.

Answer

The policy is configured on an ISE server.

Question 13

A network engineer runs the following command on Router R6:

R6# show ip bgp vpnv4 all summary

BGP router identifier 10.0.0.6, local AS number 65000
BGP table version is 10, main routing table version 10
10 network entries using 1440 bytes of memory
10 path entries using 800 bytes of memory
4/3 BGP path/bestpath attribute entries using 576 bytes of memory
2 BGP AS-PATH entries using 48 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
Bitfield cache entries: current 1 (at peak 2) using 32 bytes of memory
BGP using 2896 total bytes of memory
BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.7        4        65001    1000    1000       10    0    0 00:20:00        5
10.0.0.8        4        65002     500     500       10    0    0 00:10:00        3

Based on this output, what can be concluded?

Accepted Answer

The router is receiving VPNv4 prefixes from both neighbors.. The output shows that neighbor 10.0.0.7 (AS 65001) has 5 prefixes received (State/PfxRcd = 5) and neighbor 10.0.0.8 (AS 65002) has 3 prefixes received (State/PfxRcd = 3). Since the command 'show ip bgp vpnv4 all summary' specifically displays VPNv4 address family information, these received prefixes are VPNv4 routes. Therefore, Router R6 is successfully receiving VPNv4 prefixes from both BGP neighbors.

Answer

Both BGP sessions are in the Idle state.

Answer

The BGP table has no entries because the table version is 10.

Answer

The neighbor 10.0.0.8 is not configured for VPNv4.

Question 14

Drag and drop each Ansible task return value on the left to its matching meaning on the right.

Accepted Answer

changed: The task made a change to the target system. changed indicates a modification was made, ok means no change but success, failed means error, skipped means condition not met, and unreachable means host could not be contacted.

Question 15

Drag and drop the steps of configuring NETCONF YANG-based telemetry with on-change subscription into the correct order, from first to last.

Accepted Answer

Enable NETCONF on the device. First, enable NETCONF on the device. Then, define a sensor group that includes the YANG paths to monitor for changes. Next, create a subscription that specifies the sensor group, a receiver, and the on-change update policy. After that, apply the subscription to activate it. Finally, the device sends updates only when the monitored data changes.

Question 16

Drag and drop each SD-WAN policy type on the left to its matching application point on the right.

Accepted Answer

Control policy: Applied on vSmart to influence OMP route and TLOC propagation. Control policies affect routing decisions; data policies affect forwarding; app-route policies affect per-tunnel path selection; cflowd policies enable traffic flow monitoring.

Question 17

A network engineer runs the following command on Switch SW4:

SW4# show etherchannel 1 detail
Channel-group number: 1
Group state = L2

Ports in the group:
-------------------

Port: Gi0/0
--------

Port state    = Up, In-Bundle
Channel group = 1           Mode = Active/PagNego
Gcchange = -
Port-channel  = Po1         GC =  0x00010001
Pseudo port-channel = Po1

Port index = 0           Load = 0x00

Flags:  S - Device is sending Slow LACPDUs
        F - Device is sending Fast LACPDUs
        A - Device is in active mode.
        P - Device is in passive mode.

Local information:

LACP port     Admin     Oper    Port        Port
Port      Flags   State     Priority      Key       Key     Number      State
Gi0/0     SA      bndl      32768         0x1       0x1     0x101       0x3D

Partner information:

LACP port     Admin     Oper    Port        Port
Port      Flags   State     Priority      Key       Key     Number      State
Gi0/0     SA      bndl      32768         0x1       0x1     0x102       0x3D

Age of the port = 0d:00h:15m:20s

Based on this output, what can be concluded?

Accepted Answer

The port is bundled and the LACP state is synchronized.. The output shows both the local and partner ports in 'bndl' state with LACP state 0x3D, which indicates the port is bundled and synchronized. The 'SA' flags confirm active mode and slow LACPDUs, and the 'bndl' state means the EtherChannel is fully operational with LACP in sync.

Answer

The port is in passive mode and waiting for the partner to initiate.

Answer

The port is sending fast LACPDUs because the flag is 'F'.

Answer

The port is not in use because the load is 0x00.

Question 18

Drag and drop the steps of creating and applying an Ansible role for network device configuration into the correct order, from first to last.

Accepted Answer

Create role directory structure with subdirectories. First, define the role structure with defaults, vars, tasks, and handlers. Then, write the tasks in main.yml to configure interfaces. Next, set default variables in defaults/main.yml. After that, create a playbook that references the role. Finally, execute the playbook against the target inventory.

Question 19

Drag and drop the steps of using Ansible to push a new VLAN configuration to a Cisco IOS switch into the correct order, from first to last.

Accepted Answer

Define VLAN variables in group_vars file. First, define the VLAN ID and name in a variable file. Then, write a playbook task using ios_vlan module. Next, specify the connection parameters (ansible_network_os, ansible_user, etc.) in the inventory. After that, run the playbook to apply the configuration. Finally, verify the VLAN on the switch using show vlan.

Question 20

Drag and drop the steps of EIGRP authentication using MD5 key-chain into the correct order, from first to last.

Accepted Answer

Create a key chain using key chain command. The correct order for configuring EIGRP MD5 authentication with a key chain is: first, create a key chain using the 'key chain' command. Next, configure a key number and key-string under the key chain. Then, enter interface configuration mode for the interface on which EIGRP is enabled. After that, issue the command 'ip authentication mode eigrp md5' to set the authentication mode. Finally, issue the command 'ip authentication key-chain eigrp <name>' to apply the key chain to the interface.