350-401 Practice Exam 64 — 20 Questions

Question 1

Drag and drop the steps of configuring an IP SLA UDP jitter operation into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order for configuring an IP SLA UDP jitter operation is: first enter global configuration mode (A), then define the IP SLA operation with type udp-jitter (B), then specify the destination IP address and UDP port (C), then schedule the operation using a start-time (D), and finally verify the operation with 'show ip sla statistics' (E).

Question 2

Drag and drop each security protocol on the left to its matching service on the right.

Accepted Answer

ESP: Encryption and authentication. ESP provides confidentiality (encryption) and authentication; AH provides integrity and authentication but no encryption; ESP with NULL encryption provides authentication only.

Question 3

Drag and drop the steps of DNA Center site hierarchy creation into the correct order, from first to last.

Accepted Answer

Create a top-level area (e.g., continent). Site hierarchy creation begins with defining the top-level area (e.g., continent), then building down to building, floor, and finally assigning devices to the floor.

Question 4

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Answer

Phase 1: Spoke-to-hub only via NHRP registration

Answer

Phase 2: Spoke-to-spoke via NHRP redirect

Answer

Phase 3: Spoke-to-spoke via NHRP shortcut

Answer

Phase 2 NHRP: Redirect from hub to trigger direct tunnel

Answer

Phase 3 NHRP: Shortcut resolution by spoke

Question 5

Drag and drop each VPN type on the left to its matching tunnel technology on the right.

Accepted Answer

DMVPN: mGRE with NHRP. DMVPN uses mGRE with NHRP; FlexVPN uses IKEv2 with per-peer tunnels; GET VPN uses GDOI for group encryption; AnyConnect uses TLS/DTLS for client-based remote access.

Question 6

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Accepted Answer

MP-BGP is used to exchange VPNv4 routes between PE routers.. MPLS L3VPNs use MP-BGP to exchange VPNv4 routes, require a VRF per customer, and use two labels (IGP label for transport, VPN label for VRF lookup). The PE router performs the routing between CE and the MPLS core.

Answer

The P router maintains a full routing table for all VPN customers.

Answer

A single MPLS label is used for both transport and VPN identification.

Question 7

Which three statements about BGP route reflectors are true? (Choose three.)

Accepted Answer

Route reflectors reduce the number of required iBGP sessions in an AS.. Route reflectors reduce the number of required iBGP sessions by allowing clients to peer only with the route reflector. The route reflector does not modify the AS_PATH or NEXT_HOP attributes when reflecting routes, preserving path information. The ORIGINATOR_ID attribute is used to prevent routing loops by identifying the originator of a route. Option E is incorrect because non-client peers of a route reflector do not need to be fully meshed; they may be clients of other route reflectors, and the full mesh requirement applies only to iBGP speakers that are not clients of any route reflector.

Answer

A route reflector client must be fully meshed with all other clients.

Answer

Non-client peers of a route reflector must be fully meshed with each other.

Question 8

Drag and drop each BGP community on the left to its standard behavior on the right.

Accepted Answer

NO_EXPORT: Do not advertise to eBGP peers (except within confederation). NO_EXPORT prevents advertisement outside confederation; NO_ADVERTISE prevents any advertisement; LOCAL_AS prevents advertisement to external peers; INTERNET advertises to all BGP peers.

Answer

NO_PEER: Do not advertise to any BGP peer

Question 9

Which two statements about VLAN configuration and verification are true? (Choose two.)

Accepted Answer

A VLAN can be created using the 'vlan vlan-id' command in global configuration mode.. The correct statements are A and B. Statement A is true because the 'vlan vlan-id' command in global configuration mode creates a VLAN. Statement B is true because 'show vlan brief' displays all VLANs, including reserved VLANs 1002-1005 (though they are not user-created). Statement C is false because VLAN 1 is a default VLAN and cannot be deleted. Statement D is false because the 'switchport access vlan' command does not automatically create the VLAN; the VLAN must already exist. Statement E is false because 'show interfaces trunk' displays trunking interfaces along with their allowed VLAN list and native VLAN, not solely the native VLAN.

Answer

VLAN 1 can be deleted from the switch.

Answer

The 'switchport access vlan' command automatically creates the VLAN if it does not already exist.

Answer

The 'show interfaces trunk' command shows only the trunking interfaces and their native VLAN.

Question 10

Which two statements about classification and marking in QoS are true? (Choose two.)

Accepted Answer

Classification can be based on IP precedence, DSCP, or CoS values.. Classification can be based on various Layer 2 and Layer 3 fields such as IP precedence, DSCP, and CoS values. The 'match ip dscp' command is used in class maps to match packets based on DSCP values. Marking is performed using the 'set' command in a policy-map class configuration, but the statement in B is considered too absolute because marking can also be done using other methods like 'police' for marking. Therefore, options A and E are correct.

Answer

Marking is performed using the 'set' command in a policy-map class configuration.

Answer

Layer 2 CoS marking uses the first 6 bits of the 802.1Q tag.

Answer

DSCP uses the first 3 bits of the ToS byte and is not compatible with IP precedence.

Question 11

Drag and drop the steps of MAB (MAC Authentication Bypass) fallback flow into the correct order, from first to last.

Accepted Answer

Host connects; switch detects link up. MAB is a fallback method when 802.1X fails: the switch detects the host MAC, sends a RADIUS Access-Request with the MAC as username/password, ISE checks the MAC against its database, and then either grants access (placing the port in the authorized VLAN) or denies it.

Question 12

Which two statements about AAA authentication methods are true? (Choose two.)

Accepted Answer

The enable method for authentication uses the enable password or secret.. Statements B and D are true. The enable method uses the enable password or secret, and the login local method authenticates against the local username database. Statement A is false because the local method uses the local username database, not the enable password. Statement C is false because the none method provides no authentication and has no fallback. Statement E is false because the line password method uses the password configured under the line, not the enable secret.

Answer

The local method for authentication uses the enable password for privilege level 15 access.

Answer

The none method for authentication provides fallback to the local database if the server is unreachable.

Answer

The line password method for authentication uses the enable secret password.

Question 13

Which three statements about SD-WAN (Cisco Catalyst SD-WAN) are true? (Choose three.)

Accepted Answer

The vSmart controller is responsible for distributing control plane information such as OMP routes and policies to the WAN edge routers.. Cisco SD-WAN uses a centralized vSmart controller for policy and routing, vBond for orchestration and authentication, and vManage for management. vEdge routers establish secure DTLS/TLS tunnels to controllers and can use multiple transport interfaces. The control plane is separate from the data plane. vSmart does not forward data traffic.

Answer

The vManage controller forwards all data traffic between branch sites.

Answer

OMP (Overlay Management Protocol) runs between vEdge routers and the vManage controller.

Question 14

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Accepted Answer

IKE_SA_INIT: Phase 1 - establish IKE SA. IKEv2 consists of only two phases: Phase 1 (IKE_SA_INIT) and Phase 2 (IKE_AUTH). CREATE_CHILD_SA, INFORMATIONAL, and rekey are exchanges that occur within the established IKE SA, not separate phases.

Question 15

Drag and drop each VLAN type on the left to its matching purpose on the right.

Accepted Answer

data VLAN: Carries user data traffic. Data VLAN carries user traffic; voice VLAN carries VoIP; management VLAN for device access; native VLAN for untagged frames on trunk; default VLAN is VLAN 1.

Question 16

Drag and drop each VLAN type on the left to its matching purpose on the right.

Accepted Answer

data VLAN: Carries user data traffic. Data VLAN carries user traffic. Voice VLAN carries VoIP traffic (typically VLAN 100–199). Management VLAN carries management traffic (e.g., SSH, SNMP). Native VLAN carries untagged frames on a trunk (default VLAN 1). Black-hole VLAN is unused and dropped to prevent loops.

Question 17

Drag and drop each VTP mode on the left to its matching capability on the right.

Accepted Answer

server: Can create, modify, and delete VLANs; advertises VLAN database. VTP server can create/modify/delete VLANs and advertises them. VTP client learns VLANs but cannot modify them. VTP transparent forwards VTP messages but does not participate. VTP off ignores VTP messages entirely.

Question 18

Drag and drop the steps of VLAN mapping on trunk interfaces into the correct order, from first to last.

Accepted Answer

Enter trunk interface configuration mode. First enter the trunk interface, configure encapsulation, then apply the VLAN mapping policy (translate or map), and finally verify the mapping.

Question 19

Drag and drop each DTP mode on the left to its matching trunking behavior on the right.

Accepted Answer

dynamic desirable: Actively sends DTP frames; forms trunk if neighbor is trunk, desirable, or auto. Dynamic desirable actively sends DTP frames and forms a trunk if the neighbor is trunk, dynamic desirable, or dynamic auto. Dynamic auto forms a trunk only if the neighbor is trunk or dynamic desirable. Trunk always forms a trunk. Access never forms a trunk. None disables DTP.

Question 20

Drag and drop the steps of the PPDIOO network lifecycle into the correct order, from first to last.

Accepted Answer

Prepare: Define network requirements and strategy. The PPDIOO network lifecycle consists of six phases: Prepare, Plan, Design, Implement, Operate, and Optimize. The correct sequence from first to last is: Prepare, Plan, Design, Implement, Operate, Optimize.