350-401 Practice Exam 66 — 20 Questions

Question 1

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The access list 100 does not permit the 172.16.0.0/16 network.. The command `ip nat inside source list 100 interface GigabitEthernet0/0 overload` uses access list 100 to define which source IP addresses are eligible for NAT. Since ACL 100 permits only the 10.0.0.0/8 network, any traffic from 172.16.0.0/16 is not matched by the ACL and therefore is not translated. Even though the 172.16.0.0/16 hosts have connectivity to the router, their packets are forwarded without NAT and likely dropped by the ISP or the next-hop router because they contain private IP addresses.

Answer

The router's interface GigabitEthernet0/0 is not configured with ip nat outside.

Answer

The 172.16.0.0/16 hosts have a default gateway pointing to a different router.

Answer

The NAT pool is exhausted for the 172.16.0.0/16 network.

Question 2

A network engineer issues the following command on Router R5:

R5# show ip pim interface
Interface          PIM  Nbrs  Hello  DR    DR
                        Count Intvl  Prior
GigabitEthernet0/0 on    2     30     1     10.1.1.1
GigabitEthernet0/1 on    1     30     1     10.2.2.2
Loopback0          on    0     30     1     10.3.3.3

Based on this output, what can be concluded?

Accepted Answer

The DR on GigabitEthernet0/0 is 10.1.1.1.. The output shows that on GigabitEthernet0/0, the DR (Designated Router) IP address is 10.1.1.1, which is listed in the 'DR' column. This indicates that 10.1.1.1 is the elected DR for that interface, making option A correct. The DR is elected based on the highest IP address when DR priorities are equal (both are 1 here), and 10.1.1.1 is the neighbor with the highest IP on that segment.

Answer

The DR on GigabitEthernet0/1 is the local router.

Answer

PIM is disabled on Loopback0.

Answer

The hello interval on GigabitEthernet0/0 is 60 seconds.

Question 3

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 will be translated to the IP address of GigabitEthernet0/0 using PAT.. This configuration uses dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The `ip nat inside source list 1 interface GigabitEthernet0/0 overload` command translates all source IP addresses matching access-list 1 (the 192.168.1.0/24 subnet) to the single IP address of the outside interface (10.0.0.1), using unique source port numbers to differentiate multiple simultaneous sessions. This allows all hosts in the inside network to share the single public IP address for internet access.

Answer

Only one host from 192.168.1.0/24 can access the internet at a time.

Answer

Traffic from the outside interface will be translated to 192.168.1.0/24.

Answer

The configuration will fail because the access list must be applied to an interface.

Question 4

What is the purpose of the 'police' command in a QoS policy-map?

Accepted Answer

To limit the rate of traffic and take action (drop or remark) on packets that exceed the rate.. The 'police' command in a Cisco QoS policy-map implements traffic policing, which enforces a rate limit by measuring traffic flow and taking immediate action—typically dropping or remarking packets—when the traffic exceeds the configured rate. Unlike shaping, policing does not buffer excess traffic; it acts on packets in real time, making it ideal for marking down or discarding non-compliant traffic at the ingress or egress of an interface.

Answer

To shape traffic to a specific rate by buffering excess packets.

Answer

To prioritize traffic by assigning it to a strict priority queue.

Answer

To classify traffic based on IP precedence or DSCP values.

Question 5

Which three statements about EIGRP named mode configuration are true? (Choose three.)

Accepted Answer

Named mode uses the 'router eigrp ' command to enter configuration mode.. Option A is correct because EIGRP named mode is entered with the global command 'router eigrp ', where is a virtual instance name rather than an AS number, distinguishing it from classic mode's 'router eigrp '. Option C is correct because a single named EIGRP process can contain multiple address families, allowing IPv4 and IPv6 to be configured together under one process using 'address-family ipv4' and 'address-family ipv6' submode commands. Option D is correct because after entering 'router eigrp ', you use the 'address-family ipv4' (or 'address-family ipv6') command to enter the address-family configuration submode where EIGRP parameters are set. Option B is not correct because named mode still uses the 'network' statement under the address family to enable EIGRP on interfaces; the 'af-interface' submode is used for per-interface settings such as authentication, hello intervals, and split-horizon, not as a replacement for 'network'. Option E is not correct because EIGRP named mode does not require a 'no shutdown' command under the address family; the process and address family are enabled by configuration and the 'shutdown' command is only used to administratively disable them if desired.

Answer

In named mode, the network statement is replaced by the 'af-interface' configuration under the address family.

Answer

Named mode requires the 'no shutdown' command under the address family to enable EIGRP.

Question 6

ip vrf RED
 rd 200:1
 route-target export 200:1
 route-target import 200:1
!
interface GigabitEthernet0/1
 ip vrf forwarding RED
 ip address 10.1.1.1 255.255.255.0
!
router bgp 65000
 neighbor 192.168.1.1 remote-as 65000
 neighbor 192.168.1.1 update-source Loopback0
 address-family vpnv4
  neighbor 192.168.1.1 activate
  neighbor 192.168.1.1 send-community extended
!
Which statement about this configuration is true?

Accepted Answer

The configuration is correct for MPLS L3VPN, but the VRF RED must also be configured under BGP with 'address-family ipv4 vrf RED'.. In an MPLS L3VPN configuration, after creating the VRF and applying it to an interface, you must also configure the VRF under BGP using the 'address-family ipv4 vrf RED' command to exchange IPv4 routes within that VRF. Without this, the VRF will not participate in BGP route exchange, and the VPNv4 address-family alone cannot import or export VRF routes. The given configuration is incomplete, as it lacks the VRF-specific address-family under BGP.

Answer

The 'send-community extended' command is unnecessary because it is enabled by default.

Answer

The interface GigabitEthernet0/1 requires 'mpls ip' to forward MPLS packets.

Answer

The VRF RED will automatically import routes from the VPNv4 address-family without additional configuration.

Question 7

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in
!
ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Accepted Answer

It blocks inbound ICMP Echo requests on GigabitEthernet0/1.. The access list FILTER_IN explicitly denies ICMP packets with the 'echo' type (ping requests) while permitting all other IP traffic. Applied inbound on GigabitEthernet0/1, this blocks only inbound ICMP Echo requests, not all ICMP traffic (e.g., Echo replies, TTL-exceeded messages are permitted). The 'permit ip any any' at the end ensures all other traffic is allowed.

Answer

It blocks all ICMP traffic inbound on GigabitEthernet0/1.

Answer

It blocks all inbound traffic on GigabitEthernet0/1.

Answer

It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

Question 8

An enterprise is migrating a legacy application from a physical server to a virtual machine on a KVM-based hypervisor. The application requires direct access to a PCIe network interface card for performance reasons. The engineer needs to provide the VM with dedicated hardware access while maintaining isolation from other VMs. Which technology should the engineer use?

Accepted Answer

Use PCI passthrough to assign the NIC directly to the VM.. PCI passthrough (Option A) is correct because it assigns the entire physical PCIe NIC directly to the VM, giving it exclusive, dedicated hardware access with full performance and no hypervisor overhead. This meets the requirement for direct access while maintaining isolation, as other VMs cannot use the same device.

Answer

Enable SR-IOV and assign a virtual function to the VM.

Answer

Configure a paravirtualized network driver (virtio).

Answer

Attach the VM to a Linux bridge using macvtap.

Question 9

Drag and drop the steps of Cisco IOS-XE mdt subscription via CLI configuration into the correct order, from first to last.

Accepted Answer

Enter global configuration mode on IOS-XE. The CLI configuration begins by entering global config, defining the receiver, setting the subscription parameters, applying the subscription, and verifying it.

Question 10

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

Accepted Answer

The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.. The most likely cause is that the destination port (Gi1/0/24) is in the same VLAN as the source interface (Gi1/0/1). When a SPAN destination port resides in the same VLAN as the source, the switch may drop the copied egress frames to prevent a switching loop, because the destination port would otherwise re-inject the traffic back into the same VLAN. This behavior is specific to local SPAN on Catalyst switches, where the destination port must be in a different VLAN or configured as a trunk with only the monitoring VLAN allowed.

Answer

The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.

Answer

The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.

Answer

The engineer must also configure 'monitor session 1 filter ip' to capture both directions.

Question 11

A network engineer is troubleshooting an issue where Cisco DNA Center is not sending configuration changes to a group of switches. The engineer checks the Provisioning dashboard and sees that the devices are in 'Pending' state. The engineer has already created the intent (network profile) and assigned it to the site. What is the most likely cause?

Accepted Answer

The engineer has not executed the Provision workflow to deploy the configuration.. In Cisco DNA Center, after creating an intent (network profile) and assigning it to a site, the configuration is not automatically deployed to devices. The engineer must explicitly run the Provision workflow to push the configuration to the devices. The 'Pending' state indicates that the devices are awaiting provisioning.

Answer

The devices are not reachable from DNA Center.

Answer

The DNA Center appliance is out of disk space.

Answer

The network profile contains an invalid configuration.

Question 12

Which three statements about hypervisor security and isolation are true? (Choose three.)

Accepted Answer

A VM escape attack occurs when an attacker breaks out of a virtual machine to access the hypervisor or other VMs.. Option A is correct because a VM escape is precisely the class of attack in which code running inside a guest breaks the virtualization boundary to reach the hypervisor or other guests, which is why hypervisor hardening matters. Option C is correct because the hypervisor (or VMM) is responsible for partitioning and enforcing isolation of memory, CPU, and I/O devices, typically via hardware-assisted virtualization features such as Intel VT-x/EPT or AMD-V/RVI, so one VM cannot read or write another VM's data. Option D is correct because the hypervisor is a high-value attack surface, so applying vendor patches and minimizing exposed services and virtual devices (reducing attack surface) are standard hardening practices. Option B is wrong because VMs are only isolated if the hypervisor and its configuration are secure; they are not inherently safe and still need patching, monitoring, and access controls. Option E is wrong because guest VMs access virtualized hardware presented by the hypervisor, not the physical CPU and memory directly, which is what enables the isolation the hypervisor enforces.

Answer

Virtual machines are inherently isolated from each other and do not require any additional security measures.

Answer

Virtual machines have direct access to physical hardware resources such as CPU and memory.

Question 13

Which three statements about SD-WAN segmentation and multi-tenancy are true? (Choose three.)

Accepted Answer

Each VPN in SD-WAN corresponds to a separate VRF on the edge device, providing Layer 3 isolation.. Option A is correct because in Cisco SD-WAN each VPN is mapped to a distinct VRF on the edge device, which provides Layer 3 routing isolation between segments. Option B is correct because OMP carries VPN membership in its routing updates, so edge devices learn which VPNs are reachable through each TLOC. Option C is correct because extranet VPN configuration enables controlled route sharing between different VPNs on the same edge device, allowing selective inter-VPN connectivity. Option D is incorrect because VPN 0 is the transport VPN used for WAN/control connections, not service-side LAN or data center connectivity. Option E is incorrect because SD-WAN multi-tenancy can be achieved logically through VPN segmentation on shared edge devices, without requiring separate physical devices per tenant.

Answer

VPN 0 is used for service-side connectivity, such as connecting to a corporate LAN or data center.

Answer

Multi-tenancy in SD-WAN requires separate physical edge devices for each tenant to ensure isolation.

Question 14

Examine the following configuration on a Cisco IOS-XE router:

ip multicast-routing distributed
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip pim sparse-dense-mode
 ip igmp version 2
!

Which statement about this configuration is true?

Accepted Answer

Multicast routing is enabled with distributed switching, and the interface will use sparse-mode if an RP is known for the group, otherwise dense-mode.. The command 'ip multicast-routing distributed' enables multicast routing with distributed switching (hardware offload) on Cisco IOS-XE. The 'ip pim sparse-dense-mode' command configures the interface to operate in sparse-mode if a valid RP is known for the multicast group; otherwise, it falls back to dense-mode. This is the standard behavior of sparse-dense mode, making option C correct.

Answer

The interface will operate in dense-mode for all multicast groups because no RP is configured.

Answer

The router will only support IGMPv2, and IGMPv3 queries will be ignored.

Answer

The configuration is invalid because 'ip multicast-routing distributed' is not a valid command.

Question 15

Which three statements about dynamic ARP inspection (DAI) are true? (Choose three.)

Accepted Answer

DAI validates ARP packets by checking the sender MAC and IP addresses against the DHCP snooping binding table.. Option A is correct because DAI works by intercepting ARP packets on untrusted ports and comparing the sender MAC and sender IP against entries in the DHCP snooping binding table (or a configured ARP ACL), dropping packets that do not match. Option B is correct because DAI is enabled per VLAN with the global configuration command 'ip arp inspection vlan ', allowing selective deployment on the VLANs that need protection. Option C is correct because DAI supports ARP packet rate limiting via the 'ip arp inspection limit rate ' interface command, which protects the switch CPU from ARP flooding and denial-of-service attacks. Option D is not correct because DAI inspects only IPv4 ARP packets; IPv6 Neighbor Discovery is handled by IPv6 First-Hop Security features such as IPv6 snooping, not DAI. Option E is not correct because DAI validates the sender MAC and sender IP (and optionally the destination MAC against the binding table), not the destination IP in ARP requests, so it does not operate in the way described.

Answer

DAI inspects both IPv4 ARP and IPv6 Neighbor Discovery packets.

Answer

DAI validates the destination IP address in ARP requests to prevent man-in-the-middle attacks.

Question 16

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Accepted Answer

VXLAN overlay with policy-based forwarding to direct traffic through VNFs. VXLAN overlay with policy-based forwarding (PBF) is the correct choice because it enables service chaining by encapsulating traffic and steering it through a sequence of VNFs based on policies, without requiring physical re-cabling. This allows dynamic insertion of new VNFs by simply updating the forwarding policies in the overlay, which is essential for NFV environments where VNFs are hosted on the same server and must be chained flexibly.

Answer

VLAN trunking between VNFs on the same hypervisor

Answer

Static routing between VNFs using dedicated interfaces

Answer

MPLS L3VPN between VNFs

Question 17

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

Accepted Answer

Policy enforcement in SD-Access is based on Scalable Group Tags (SGTs) assigned to endpoints.. Option A is correct because SD-Access group-based policy enforcement relies on Scalable Group Tags (SGTs) that are assigned to endpoints (statically or dynamically via Cisco ISE), and these tags are the basis for permitting or denying traffic between groups rather than relying solely on IP addresses. Option B is correct because Cisco Identity Services Engine (ISE) is the policy controller in SD-Access: it defines SGTs, maintains the SGT-to-policy mappings (group-based access control contracts), and distributes that policy information to the fabric control plane nodes. Option D is correct because in the SD-Access VXLAN data plane the SGT is carried in the VXLAN-GPO (Group Policy Option) header field, allowing the egress fabric edge node to enforce policy based on the source group tag without the underlay needing to inspect the packet. Option C is not correct because intra-fabric policy enforcement between endpoints in different virtual networks is performed by the fabric edge nodes (with the SGT carried in VXLAN-GPO), not by the border node, which primarily handles external connectivity and VRF-aware handoff. Option E is not correct because the underlay network only provides IP reachability between fabric nodes; it does not need to be aware of SGTs, since SGT-based policy is enforced at the fabric edge in the overlay.

Answer

The fabric border node enforces all intra-fabric policies between different virtual networks.

Answer

The underlay network devices must be aware of SGTs to forward traffic correctly.

Question 18

Drag and drop the steps of MPLS Layer 3 VPN VRF configuration on a PE router into the correct order, from first to last.

Accepted Answer

Enable MPLS globally on the PE. First, you enable MPLS globally on the PE router. Then, you create the VRF and assign an RD. Next, you configure the route-target import and export policies. After that, you apply the VRF to the customer-facing interface. Finally, you redistribute routes between the VRF and the MPLS backbone using BGP.

Question 19

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE device that is part of a DNA Center managed fabric. The telemetry subscription configuration is:

telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.10.10.10  port 5555 protocol grpc-tcp

What is the purpose of the 'encoding encode-kvgpb' line?

Accepted Answer

It specifies that the data should be encoded using Google Protocol Buffers (protobuf) with key-value pairs.. The 'encoding encode-kvgpb' line specifies that telemetry data should be encoded using Google Protocol Buffers (protobuf) in a key-value format. KV-GPB (Key-Value Google Protocol Buffers) is a compact, efficient encoding used for streaming telemetry data to a receiver, and it is the standard encoding for gRPC-based telemetry subscriptions on IOS-XE.

Answer

It sets the encoding to JSON format for the telemetry data.

Answer

It enables encryption of the telemetry data.

Answer

It defines the compression algorithm for the telemetry stream.

Question 20

Given the following snippet from a Cisco 9800 WLC:

ap ethernet-port default-ethernet-port
 description "Default Ethernet Port"
 mode trunk
 allowed vlan 10,20,30
 native vlan 10

What is the effect of this configuration on the AP?

Accepted Answer

The AP will use VLAN 10 for management traffic and VLANs 20 and 30 for client traffic.. The configuration sets the AP's Ethernet port as a trunk port with VLAN 10 as the native VLAN and allowed VLANs 10, 20, and 30. In Cisco wireless architectures, the AP uses the native VLAN (VLAN 10) for management traffic (e.g., CAPWAP control) and the other allowed VLANs (20 and 30) for client data traffic, which is tunneled via CAPWAP to the WLC. This matches option B.

Answer

The AP's Ethernet port will tag all traffic with VLAN 10.

Answer

The AP will only allow VLAN 10 traffic.

Answer

The AP's Ethernet port is configured as an access port.