350-401 Practice Exam 65 — 20 Questions

Question 1

An enterprise is deploying a new VoIP system and wants to ensure voice traffic receives priority over data traffic on a WAN link. The engineer configures a class-map to match RTP traffic using the 'match protocol rtp' command. However, the class-map does not match any packets. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'match protocol rtp' command requires NBAR to be enabled globally with 'ip nbar protocol-discovery'.. The 'match protocol rtp' command relies on Network-Based Application Recognition (NBAR) to identify RTP traffic by inspecting packet payloads and using protocol signatures. Without NBAR enabled globally via 'ip nbar protocol-discovery', the class-map cannot match any packets because the router does not have the necessary deep packet inspection capability. Enabling NBAR allows the device to recognize RTP traffic even though it uses dynamic UDP ports.

Answer

RTP traffic uses UDP ports, and the class-map must match on the UDP port range instead.

Answer

The class-map must be configured with 'match any' to capture all traffic.

Answer

RTP traffic is always marked with DSCP EF, so the class-map should match on DSCP instead.

Question 2

A network engineer is deploying 802.1X with Cisco ISE for a wired network. The engineer wants to use CoA (Change of Authorization) to dynamically change the VLAN of a user after authentication. The engineer configures the switch with 'aaa server radius dynamic-author' and the ISE with CoA settings. When the engineer tests CoA from ISE, the switch logs show 'CoA request received' but the VLAN does not change. What is the most likely cause?

Accepted Answer

The switch is missing the 'authentication command bounce-port' or 'authentication command disable-port' configuration.. CoA requires the switch to accept and process the request. The switch must have the 'authentication command bounce-port' or 'authentication command disable-port' configured to apply changes. Option B is correct because without this, the switch may acknowledge but not act. Option A is incorrect because the switch received the request. Option C is incorrect because the RADIUS server is reachable. Option D is incorrect because the switchport mode does not prevent CoA.

Answer

The ISE is not configured with the correct shared secret for CoA.

Answer

The switch is not configured with 'dot1x pae authenticator' on the interface.

Answer

The switchport is configured as 'switchport mode trunk', which does not support VLAN changes via CoA.

Question 3

A network engineer is configuring dynamic ARP inspection (DAI) on a Cisco switch to prevent ARP spoofing. The switch has DHCP snooping enabled and the DHCP server is trusted. The engineer enables DAI on VLAN 10 and configures 'ip arp inspection trust' on the port connected to the DHCP server. After enabling DAI, some legitimate ARP replies from hosts are being dropped. The engineer checks the DAI statistics and sees 'ARP ACL drops' incrementing. What is the most likely reason?

Accepted Answer

The hosts have static IP addresses, so their MAC-IP bindings are not in the DHCP snooping database.. When DAI is enabled on a VLAN, it validates ARP packets against the DHCP snooping binding database. If a host has a static IP address, its MAC-IP binding is not automatically present in the DHCP snooping database. Without a valid binding, DAI treats the ARP reply as invalid and drops it, incrementing the 'ARP ACL drops' counter. The correct solution is to either configure static DHCP snooping bindings or use ARP ACLs to permit the static hosts.

Answer

The port connected to the DHCP server should be untrusted for DAI to work correctly.

Answer

The DHCP server is in a different VLAN, and DAI cannot validate cross-VLAN ARP.

Answer

DAI is checking the destination MAC address, which does not match the expected value.

Question 4

An engineer configures IP SLA 10 to monitor the reachability of a next-hop router at 10.1.1.1 using ICMP echo. The IP SLA is used as a track object for a static route. The engineer notices that the IP SLA operation shows 'State: Active' and 'Latest RTT: 1 ms', but the track object shows 'Track 10: up' even though the next-hop router is actually unreachable from the source. The source router has a default route pointing to 10.1.1.1. What is the most likely cause?

Accepted Answer

The IP SLA operation is using the wrong source IP address; it should be sourced from the interface that connects to the next-hop router.. If the source router has a default route pointing to the same next-hop, the IP SLA probe packets may be sent out using that default route, which could lead to the probe being sent to a different path or looping. However, the more direct cause is that the IP SLA probe is sourced from an interface that is not the one that would be used to reach the next-hop, so the probe may succeed even if the next-hop is unreachable via the expected path.

Answer

The IP SLA operation must be configured with a 'timeout' value lower than the RTT to force a failure.

Answer

The track object must be configured with a 'down' delay to prevent flapping.

Answer

The static route must be configured with a higher administrative distance to allow the IP SLA to remove it.

Question 5

A network engineer executes the following command on Router R2:

R2# show ip sla configuration 1

IP SLAs Infrastructure Engine-II
Entry number: 1
Owner: admin
Tag:
Type of operation to perform: icmp-echo
Target address: 192.168.2.10
Source address: 192.168.2.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, what is the frequency of the IP SLA operation?

Accepted Answer

60 seconds. The command output shows 'Frequency (seconds): 60', which directly indicates that the IP SLA operation repeats every 60 seconds. This is the correct answer because the frequency parameter defines the time interval between successive probe executions.

Answer

30 seconds

Answer

120 seconds

Answer

5000 milliseconds

Question 6

A network engineer is configuring a Cisco router to use TACACS+ for authentication and authorization of EXEC sessions. The engineer configures 'aaa new-model', 'aaa authentication login default group tacacs+ local', and 'aaa authorization exec default group tacacs+ local'. When a user tries to log in via SSH, the router prompts for username and password, but after entering correct credentials, the user is immediately disconnected. The TACACS+ server logs show that the authentication was successful. What is the most likely cause?

Accepted Answer

The TACACS+ server is not configured to authorize the user for EXEC access, so it sends a 'deny' response, causing the router to disconnect the user.. The TACACS+ authentication succeeded, but the user was disconnected immediately after login. This indicates that the authorization step failed. With 'aaa authorization exec default group tacacs+ local', the router sends an authorization request to the TACACS+ server for EXEC shell access. If the server responds with a 'deny' (or does not include the necessary service=shell attribute), the router denies the session and disconnects the user, even though authentication passed.

Answer

The 'aaa authorization exec' command should be 'aaa authorization commands 15' to allow the user to execute commands after login.

Answer

The router's SSH configuration is missing the 'ip ssh authentication-retries' command.

Answer

The 'local' fallback in the authorization command is overriding the TACACS+ response.

Question 7

Consider the following BGP configuration:

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50
!

What is the effect of this route-map on outbound updates to neighbor 10.0.0.2?

Accepted Answer

It sets the MED to 50 for all routes advertised to 10.0.0.2.. The route-map SET-MED is applied to outbound updates to neighbor 10.0.0.2 with a permit sequence 10 and a set metric 50 command, but no match statement. In BGP, a route-map with a permit clause and no match condition matches all routes by default. Therefore, the MED (Multi-Exit Discriminator) attribute is set to 50 for every route advertised to that neighbor.

Answer

It sets the MED to 50 for all routes advertised to 10.0.0.2, but only if they match a prefix-list.

Answer

It sets the local preference to 50 for routes received from 10.0.0.2.

Answer

It filters all routes to 10.0.0.2 because there is no match statement.

Question 8

A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?

Accepted Answer

The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.. The ACL is applied outbound on the interface, not inbound. An inbound ACL filters traffic entering the interface, while an outbound ACL filters traffic leaving the interface. If the ACL were correctly applied inbound on the interface connected to subnet 10.1.1.0/24, the 'deny ip any any' would block all non-HTTP traffic, including ICMP (ping). However, since ping is still reaching subnet 10.2.2.0/24, the ACL must not be filtering inbound traffic; it is likely applied outbound on that same interface, which does not affect traffic entering the router from subnet 10.1.1.0/24. This misapplication allows ICMP traffic to pass unhindered.

Answer

The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.

Answer

The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.

Answer

The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.

Question 9

Drag and drop the steps of configuring AAA on a Cisco IOS device into the correct order, from first to last.

Accepted Answer

Enable AAA globally with 'aaa new-model'. AAA configuration requires first enabling AAA globally, then defining the authentication method list, applying it to login, and optionally specifying a fallback method like local. Finally, verify with debug commands.

Question 10

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic from neighboring ASes. A lower MED value is preferred over a higher one, making it the correct answer for an attribute where the lowest value is favored.

Answer

Local Preference

Answer

Weight

Answer

Origin

Question 11

A network engineer runs the following command on Switch SW5:

SW5# show spanning-tree vlan 50

VLAN0050
  Spanning tree enabled protocol ieee
  Root ID    Priority    24626
             Address     aabb.cc00.0800
             Cost        4
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32768  (priority 32768 sys-id-ext 50)
             Address     aabb.cc00.0900
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ------------------------------
Gi0/1               Root FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p
Gi0/4               Altn BLK 4         128.4    P2p

Based on this output, how many ports are in the Forwarding state?

Accepted Answer

3. The output shows four interfaces: Gi0/1 (Root FWD), Gi0/2 (Desg FWD), Gi0/3 (Desg FWD), and Gi0/4 (Altn BLK). Three ports (Gi0/1, Gi0/2, Gi0/3) are in the Forwarding state, while Gi0/4 is in the Blocking state. Therefore, the correct answer is 3.

Answer

1

Answer

2

Answer

4

Question 12

Which four statements about VXLAN encapsulation in Cisco SD-Access are true? (Choose four.)

Accepted Answer

VXLAN encapsulation uses a 24-bit VNI to identify the virtual network segment.. In Cisco SD-Access, VXLAN uses a 24-bit VNI to identify virtual network segments (A). The VXLAN header includes a Group Policy ID field to carry the SGT (B). The outer IP destination address is the IP address of the destination fabric node, as the packet is routed over the underlay (D). VXLAN is MAC-in-UDP encapsulation, not IP-in-IP (C is false). The VNI is mapped to a VLAN at the fabric edge to provide Layer 2 connectivity for endpoints (E is true).

Answer

VXLAN encapsulation in SD-Access is an IP-in-IP tunneling mechanism.

Question 13

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will use a 10-second hello interval and suppress DR/BDR election.. The `ip ospf network point-to-point` command changes the OSPF network type on the interface to point-to-point, which suppresses the DR/BDR election process because point-to-point links have only two neighbors. The `ip ospf hello-interval 10` command overrides the default hello interval for point-to-point networks (which is 10 seconds by default anyway, but explicitly setting it ensures consistency). Thus, OSPF uses a 10-second hello interval and does not elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and elect a DR/BDR.

Answer

OSPF will use a 10-second hello interval but still elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and suppress DR/BDR election.

Question 14

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Port Gi0/6 is an access port in VLAN 20.. The 'show vlan brief' output lists VLANs and their assigned ports. Port Gi0/6 is listed under VLAN 20, and since it is the only port in that VLAN, it must be an access port (or a trunk port that only allows VLAN 20, but the context of a single port in a VLAN typically indicates an access port). Access ports belong to a single VLAN and do not carry tags, so Gi0/6 is an access port in VLAN 20.

Answer

VLAN 20 is not operational because it has only one port assigned.

Answer

The switch supports FDDI and Token Ring VLANs.

Answer

VLAN 10 has more broadcast traffic than VLAN 20.

Question 15

Drag and drop the steps of vSphere VM snapshot creation and revert steps into the correct order, from first to last.

Accepted Answer

Power on the virtual machine. The correct order is: first power on the VM (A) to ensure it is running, then take a snapshot (B) to capture the current state, then perform changes on the running VM (E), then power off the VM (C) before reverting, and finally revert to the snapshot (D) to restore the VM to the captured state. This sequence ensures that the snapshot is taken before changes, and the revert happens after changes are made and the VM is powered off.

Question 16

Refer to the exhibit. Which OSPF route type is the default route?

Accepted Answer

External type 2 (E2). The exhibit shows a default route (0.0.0.0/0) being redistributed into OSPF from another routing protocol or static route. By default, OSPF redistributes routes as External Type 2 (E2), meaning the metric does not include the internal cost to the ASBR. The route is not an NSSA type because the area is not configured as a not-so-stubby area, and it is not an inter-area route because it originates outside the OSPF domain.

Answer

Inter-area (IA)

Answer

NSSA external type 2 (N2)

Answer

External type 1 (E1)

Question 17

Which statement about RSPAN is true?

Accepted Answer

RSPAN uses a dedicated VLAN to transport mirrored traffic from source to destination switches.. RSPAN (Remote SPAN) uses a dedicated RSPAN VLAN to carry mirrored traffic from the source switch to one or more destination switches across a network. This allows monitoring of traffic on remote switches, unlike local SPAN which is confined to a single switch. The RSPAN VLAN must be configured on all intermediate switches and trunked appropriately to ensure the mirrored traffic reaches the destination.

Answer

RSPAN can only monitor traffic within the same switch.

Answer

RSPAN requires the use of ERSPAN encapsulation.

Answer

RSPAN destination ports must be in trunk mode.

Question 18

Drag and drop the steps of Rapid PVST+ topology change notification process into the correct order, from first to last.

Accepted Answer

Port transitions to forwarding. In Rapid PVST+, the correct order of the topology change notification process is: first, the switch sends a proposal message on its designated port (B). The neighbor receives the proposal and synchronizes port roles (C). Then the neighbor sends an agreement message back (D). After agreement, the port transitions to forwarding (A). Finally, the switch propagates the topology change via the TC-while timer (E). This sequence ensures loop-free convergence.

Question 19

Drag and drop the steps of OSPF SPF calculation steps (Dijkstra) into the correct order, from first to last.

Accepted Answer

Initialize candidate list with root router. The Dijkstra algorithm first initializes the candidate list with the root node, then iteratively moves the lowest-cost candidate to the tree, updating neighbor costs, and finally builds the routing table from the shortest-path tree.

Question 20

Drag and drop the steps of EtherChannel load-balancing hash configuration into the correct order, from first to last.

Accepted Answer

Choose global load-balancing method (e.g., src-dst-ip). The correct order begins with choosing the global load-balancing method (A) such as src-dst-ip. Next, apply the method using the 'port-channel load-balance' command (B). Optionally, override the method on a per-interface basis using the 'load-balance' command (D). Then verify the configuration with 'show etherchannel load-balance' (C). Finally, test the hash distribution by sending traffic across the bundle (E) to confirm proper load balancing.