350-401 Practice Exam 64 — 20 Questions

Question 1

Drag and drop each DHCP option on the left to its matching purpose on the right.

Accepted Answer

Option 43: Provides vendor-specific information such as TFTP server address. Option 43 provides vendor-specific info; Option 60 identifies vendor class; Option 82 is relay agent information.

Question 2

A network engineer runs the following command on Router R5:

R5# show ip route vrf CUSTOMER-A

Routing Table: CUSTOMER-A
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C       10.1.1.0/24 is directly connected, GigabitEthernet0/0
B       10.2.2.0/24 [20/0] via 10.1.1.1, 00:10:20

Based on this output, what can be concluded?

Accepted Answer

The VRF has a default route pointing to 10.1.1.1.. The output shows a VRF routing table with a gateway of last resort set to 10.1.1.1 for network 0.0.0.0, which is a default route. This indicates that the VRF has a default route pointing to 10.1.1.1, making option C correct. The presence of a connected route and a BGP-learned route further confirms the VRF is functional.

Answer

The VRF has no routes and is not functional.

Answer

The route 10.2.2.0/24 is learned via OSPF.

Answer

The BGP route is sourced from an internal BGP peer.

Question 3

Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.

Accepted Answer

PE learns CE prefix via IGP or static. The correct order starts with the PE learning the customer route via IGP or static, then redistributing it into MP-BGP as a VPNv4 route with a route distinguisher, advertising it to the other PE via MP-BGP update, the receiving PE importing the route based on matching route targets, and finally installing the route into the appropriate VRF.

Question 4

Which two statements about Cisco DNA Center integration with Cisco SD-Access are true? (Choose two.)

Accepted Answer

Cisco DNA Center is used to design and provision the SD-Access fabric, including defining virtual networks and host pools.. Option A is correct because Cisco DNA Center provides the SD-Access design and provisioning workflow, where the administrator defines the fabric sites, virtual networks (VNs), and host pools that map to IP address pools used for endpoint assignment. Option C is correct because Cisco DNA Center integrates with Cisco Identity Services Engine (ISE) to enforce group-based policies by assigning and propagating Scalable Group Tags (SGTs) through the SD-Access fabric, enabling micro-segmentation via Cisco TrustSec. Option B is incorrect because SD-Access uses LISP as the control plane protocol for the fabric overlay, not OSPF; OSPF or IS-IS may be used as the underlay routing protocol, but DNA Center does not automatically configure OSPF as the SD-Access control plane. Option D is incorrect because SD-Access border nodes are managed directly by Cisco DNA Center as part of the fabric, and no separate WAN controller is required for that purpose. Option E is incorrect because SD-Access edge nodes are access-layer devices that connect endpoints to the fabric, not core routers; the core layer is handled by underlay devices and the fabric's border/control plane nodes.

Answer

Cisco DNA Center automatically configures OSPF as the control plane protocol for SD-Access.

Answer

Cisco DNA Center requires a separate WAN controller to manage SD-Access border nodes.

Answer

Cisco DNA Center configures SD-Access edge nodes as the core routers of the network.

Question 5

Drag and drop the steps of Cisco Flex (FlexConnect) AP mode operation into the correct order, from first to last.

Accepted Answer

AP discovers and joins the WLC. A FlexConnect AP first discovers and joins the WLC, then downloads its configuration and policy. When a client associates, the AP locally switches traffic if configured. The AP sends client data to the WLC for authentication and then applies the downloaded policy locally.

Question 6

Drag and drop the steps of SVI configuration for inter-VLAN routing into the correct order, from first to last.

Accepted Answer

Create the VLAN with vlan <id>. SVI configuration requires first creating the VLAN, then the SVI interface, assigning an IP address, enabling the interface, and finally verifying routing. This order ensures the VLAN exists before the SVI is created and routing is enabled.

Question 7

Drag and drop the steps of SD-Access fabric node onboarding into DNA Center into the correct order, from first to last.

Accepted Answer

Physically connect the node to the network and power it on. The correct order begins with physical connectivity and discovery, followed by adding the device to inventory, assigning it to a site, configuring the network profile and fabric role, and finally provisioning the node. This sequence ensures the device is discovered, recognized, and properly configured within the SD-Access fabric.

Question 8

Match each network automation tool to its purpose.

Accepted Answer

Ansible: Agentless automation tool that uses SSH and YAML playbooks. Correct matches: Ansible is agentless and uses SSH/YAML; Puppet uses client-server with DSL; Chef uses server and Ruby DSL; SaltStack uses master-minion and can be agentless. Common confusions involve mixing agentless and agent-based models.

Answer

Ansible: Uses a client-server model with agents and Puppet DSL

Answer

Puppet: Agentless automation tool using SSH and YAML playbooks

Question 9

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

Accepted Answer

Predictable latency between any two devices. A is correct because spine-leaf architecture ensures that every leaf switch is connected to every spine switch, creating a full-mesh topology. This design guarantees that traffic between any two leaf switches traverses at most one spine hop, resulting in predictable, consistent latency regardless of which devices are communicating.

Answer

Increased number of single points of failure

Answer

Increased broadcast domain size

Answer

Reduced need for VLANs

Question 10

A network administrator checks the AAA configuration on a router:

R1# show running-config | include aaa

aaa new-model
aaa authentication login default group radius local
aaa authentication login console local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group radius

Based on this output, what can be concluded?

Accepted Answer

EXEC authorization uses TACACS+ as the primary method.. The command 'aaa authorization exec default group tacacs+ local' specifies that TACACS+ is the primary method for EXEC authorization, with local as a fallback. This means the router first attempts to authorize EXEC access via TACACS+; if the TACACS+ server does not respond, it falls back to local authentication.

Answer

Console login uses RADIUS authentication.

Answer

Accounting is performed using TACACS+.

Answer

Local authentication is never used.

Question 11

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Accepted Answer

It preserves the original VLAN tag of mirrored frames.. The 'encapsulation replicate' keyword in a SPAN destination configuration ensures that the mirrored frames retain their original 802.1Q VLAN tag when they are sent out the SPAN destination port. Without this keyword, the switch strips the VLAN tag from the mirrored frames, which can cause issues if the monitoring device relies on VLAN information for analysis. This keyword is specifically used to preserve the original VLAN ID for accurate traffic inspection.

Answer

It duplicates the mirrored traffic to multiple destination ports.

Answer

It enables RSPAN functionality.

Answer

It allows the destination port to send traffic as well.

Question 12

A network engineer is writing a Python script to automate the backup of running configurations from a list of 50 Cisco IOS-XE devices. The script uses the netmiko library and a for loop to connect to each device, execute 'show run', and write the output to a file. After running the script, the engineer notices that the script fails on the 15th device with a timeout error, and the remaining devices are not processed. The engineer wants to ensure that if one device fails, the script continues with the next device. What is the best way to modify the script?

Accepted Answer

Wrap the connection and backup logic inside a try-except block within the for loop.. Wrapping the connection and backup logic inside a try-except block within the for loop catches exceptions (such as netmiko's NetMikoTimeoutException) for each device individually. This allows the loop to continue processing the remaining devices after a failure, rather than aborting the entire script. The try-except pattern is the standard Python approach for handling runtime errors without breaking iterative processes.

Answer

Increase the global timeout value in the netmiko connection handler.

Answer

Use the concurrent.futures module to run each connection in a separate thread.

Answer

Replace the for loop with a while loop that retries the connection three times before moving on.

Question 13

Which three statements about Python functions and modules for network automation are true? (Choose three.)

Accepted Answer

Using functions helps avoid code duplication and improves script maintainability.. Option A is correct because defining reusable functions encapsulates logic so the same code can be called from multiple places, eliminating copy-paste duplication and making scripts easier to read, test, and maintain. Option C is correct because the json module provides json.loads() to deserialize a JSON-formatted string into Python dictionaries/lists, which is exactly how automation scripts convert device API responses into usable Python objects. Option E is correct because the re module supplies regular-expression matching (re.search, re.findall, re.match) that is ideal for pulling structured values such as interface names, IP addresses, or uptime out of unstructured 'show' command output. Option B is not correct because the os module handles operating-system interactions like paths and environment variables, not JSON parsing. Option D is not correct because the csv module reads and writes comma-separated value files, not JSON data returned by network devices.

Answer

The os module is used to parse JSON data from network device responses.

Answer

The csv module is used to parse JSON data from network devices.

Question 14

Drag and drop the steps of cisco.ios.ios_config module idempotent apply flow into the correct order, from first to last.

Accepted Answer

Connect to Cisco IOS device via SSH. The ios_config module first connects to the device, retrieves the running config, compares it with the desired config, applies only the necessary changes, and then saves the config if specified, ensuring idempotency.

Question 15

A network engineer is troubleshooting an EIGRP issue in a large enterprise network. Two routers, R1 and R2, are connected via a T1 link. R1 is learning a route to 10.0.0.0/8 from R2 with a metric of 28160, but the same route is also learned from another neighbor with a metric of 26880. The engineer notices that the route from R2 is not being installed in the routing table. What is the most likely cause?

Accepted Answer

The route with metric 28160 is not installed because EIGRP selects the route with the lowest metric.. C is correct because EIGRP installs only the route with the best (lowest) metric into the routing table. The route from R2 has a metric of 28160, while the other neighbor advertises the same route with a metric of 26880. Since 26880 is lower, R1 selects that route as the successor and does not install the higher-metric route from R2.

Answer

The route from R2 is a feasible successor, so it is not installed in the routing table.

Answer

EIGRP is using unequal-cost load balancing, so the higher metric route is not used.

Answer

The route from R2 is a summary route, so it is not installed in the routing table.

Question 16

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The configuration enables PortFast and BPDU Guard on an access port. PortFast immediately transitions the port to forwarding state, bypassing the usual STP listening and learning phases. BPDU Guard monitors for incoming BPDUs; if any are received, it error-disables the port to prevent a potential bridging loop from an unauthorized switch connection.

Answer

The port will remain in blocking state until a BPDU is received from the root bridge.

Answer

The port will only forward BPDUs and will not forward data traffic.

Answer

The port will participate in RSTP and will not be affected by BPDU reception.

Question 17

A network team is deploying a virtualized WAN optimization appliance. The appliance must be able to process traffic at line rate on a 10 Gbps link. The hypervisor host has multiple physical NICs. Which design choice will best ensure the VM can achieve the required throughput?

Accepted Answer

Assign the VM a virtual function (VF) using SR-IOV on the physical NIC.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces CPU overhead and latency, enabling the VM to achieve near line-rate throughput on a 10 Gbps link by allowing direct hardware access for data plane traffic.

Answer

Use a standard virtual switch with a single vCPU for the VM.

Answer

Enable jumbo frames on the virtual switch only.

Answer

Configure the VM with multiple vNICs and use NIC teaming.

Question 18

Which THREE benefits does network automation provide over manual configuration?

Accepted Answer

Reduced risk of configuration errors. Network automation eliminates human error during repetitive configuration tasks. By using tools like Ansible, Python scripts, or NETCONF/YANG models, configurations are applied consistently without typos or missed commands, which are common in manual CLI entry. This directly reduces the risk of syntax errors, missing parameters, or inconsistent settings that can lead to network outages.

Answer

Increased security by eliminating the need for SSH access

Answer

Lower initial investment compared to manual processes

Question 19

Consider the following configuration:
router bgp 65000
 bgp router-id 192.168.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 ebgp-multihop 2
 neighbor 10.0.0.2 update-source Loopback0
!
interface Loopback0
 ip address 192.168.0.1 255.255.255.255

What is missing for this BGP session to establish?

Accepted Answer

A route to reach 10.0.0.2 is missing; the neighbor must be reachable via the routing table.. For an eBGP session to establish, the neighbor IP address (10.0.0.2) must be reachable via the routing table. The configuration uses `ebgp-multihop 2` and an update-source of Loopback0, but there is no route (static or dynamic) to reach 10.0.0.2, so the TCP connection cannot be initiated. Without reachability, BGP will remain in the Idle state.

Answer

The ebgp-multihop value should be 1 for a directly connected neighbor.

Answer

The remote-as must be the same as the local AS for EBGP.

Answer

The router-id must be the same as the update-source interface IP.

Question 20

Which three statements about Cisco TrustSec security group access control lists (SGACLs) are true? (Choose three.)

Accepted Answer

SGACLs define policies based on source and destination security group tags.. Option A is correct because Cisco TrustSec SGACLs are policy constructs that match on source and destination Security Group Tags (SGTs) rather than IP addresses, enabling group-based rather than topology-based enforcement. Option B is correct because in a TrustSec deployment, SGACL policies are defined and managed on Cisco ISE (the policy server) and downloaded to the enforcing network devices (such as switches and routers) via the SXP or native TrustSec enforcement mechanisms. Option D is correct because the fundamental purpose of an SGACL is to permit or deny traffic flowing between different security groups, with each SGACL specifying the actions (permit, deny, or logging) for traffic from a source SGT to a destination SGT. Option C is not correct because SGACLs are not applied with the ip access-group command; that command applies traditional IP ACLs to interfaces, whereas SGACLs are enforced through TrustSec policy and referenced by the device's role-based enforcement configuration. Option E is not correct because SGACLs do not rewrite the SGT in the packet header; the SGT is inserted or propagated by the TrustSec classification and tagging functions (for example, on the ingress device or via SXP), while SGACLs only enforce permit/deny decisions based on the existing tags.

Answer

SGACLs are applied directly to switch ports using the ip access-group command.

Answer

SGACLs can rewrite the security group tag in the packet header.