350-401 Practice Exam 67 — 20 Questions

Question 1

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Accepted Answer

Disable unused ports: interface range GigabitEthernet0/1-24 ; shutdown. Disable unused ports with 'interface range ... shutdown'; set login banner with 'banner login'; enable SSH with 'ip ssh version 2'; disable CDP with 'no cdp run'; set password encryption with 'service password-encryption'.

Question 2

Drag and drop the steps of IGMP v3 SSM membership report process into the correct order, from first to last.

Accepted Answer

Host sends IGMPv3 membership report with (S,G) include. In IGMPv3 SSM, the host first sends a membership report with (S,G) inclusion, the querier processes it, updates its state, and then triggers PIM (S,G) join toward the source.

Question 3

Drag and drop the steps of IKEv2 IPsec tunnel establishment into the correct order, from first to last.

Accepted Answer

IKE_SA_INIT exchange. IKEv2 uses a two-phase process: Phase 1 (IKE_SA_INIT) establishes a secure channel, then Phase 2 (IKE_AUTH and CREATE_CHILD_SA) authenticates peers and creates IPsec SAs. The order is: 1. IKE_SA_INIT exchange, 2. IKE_AUTH exchange, 3. CREATE_CHILD_SA exchange, 4. IPsec SA installation, 5. Data encryption/decryption.

Question 4

Drag and drop the steps of configuring a Cisco IOS Zone-Based Firewall (ZBFW) into the correct order, from first to last.

Accepted Answer

Create zones for source and destination. ZBFW configuration begins by defining zones to group interfaces. Next, create a class-map to classify traffic of interest. Then, create a policy-map to specify actions (inspect, drop, pass) for each class. After that, assign the policy-map to a zone-pair between source and destination zones. Finally, assign interfaces to their respective zones to activate the firewall.

Question 5

What is the default OSPF hello interval on an Ethernet link?

Accepted Answer

10 seconds. The default OSPF hello interval on an Ethernet link is 10 seconds, as specified in RFC 2328. Ethernet is a broadcast multi-access network type, and OSPF uses a 10-second hello interval on such networks to maintain neighbor adjacencies and detect failures within the dead interval (default 40 seconds, or 4 times the hello interval).

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 6

A DevOps team is implementing a CI/CD pipeline that automates network configuration changes. Which design principle is most important to ensure that a failed deployment does not cause prolonged outages?

Accepted Answer

Ensure the automation framework supports rollback to a known good state. In a CI/CD pipeline for network automation, the ability to roll back to a known good state is the most critical design principle for minimizing downtime. If a deployment fails (e.g., a misapplied ACL or BGP configuration), the automation framework must be able to revert the network device to its previous stable configuration—often by reapplying a saved startup config or using a tool like Ansible's `network_backup` role or Cisco NSO's rollback mechanism. Without this, a failed deployment could leave the network in a broken state until manual intervention, causing prolonged outages.

Answer

Use a single source of truth for all configurations

Answer

Implement idempotent configuration scripts

Answer

Run the deployment in a lab environment first

Question 7

Drag and drop the steps of the DiffServ traffic classification and marking pipeline into the correct order, from first to last.

Accepted Answer

Create a class map to match traffic. In the DiffServ QoS pipeline, traffic must first be classified using class maps, then marked with a policy map, and finally applied to an interface using a service policy. The order ensures that packets are identified, marked, and then enforced on the egress interface.

Question 8

A network engineer runs the following command on Router R4:

R4# show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address       Client-ID/              Lease expiration        Type
                 Hardware address/
                 User name
10.0.0.10        0063.6973.636f.2d30.    Mar 01 2025 12:00 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 30
10.0.0.11        0063.6973.636f.2d30.    Mar 01 2025 12:05 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 31

Based on this output, what can be concluded?

Accepted Answer

The DHCP server has two active leases.. The output shows two IP addresses (10.0.0.10 and 10.0.0.11) with lease expiration times and a type of 'Automatic', which indicates that these are dynamically assigned leases from the DHCP pool. The presence of two active leases confirms that the DHCP server has successfully allocated two addresses to clients, making option B correct.

Answer

Both clients have static DHCP reservations.

Answer

The DHCP server is out of addresses.

Answer

The clients are using DHCPv6.

Question 9

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot
10.1.1.2        10.1.1.1        MM_NO_STATE       1       0

Based on this output, what can be concluded?

Accepted Answer

IKE Phase 1 is in progress but not yet complete.. The output shows an ISAKMP Security Association (SA) in MM_NO_STATE, which indicates that IKE Phase 1 (Main Mode) negotiations have been initiated but have not yet completed. The state MM_NO_STATE means no Main Mode state has been established, so the IKE SA is not fully formed, and IPsec Phase 2 cannot proceed. Therefore, the VPN tunnel is not established, and Option B correctly identifies that IKE Phase 1 is in progress but incomplete.

Answer

The IPsec VPN tunnel is fully established and passing traffic.

Answer

The ISAKMP SA has been deleted due to a timeout.

Answer

The remote peer has rejected the IKE proposal.

Question 10

Which three statements about NFV and its relationship with SDN are true? (Choose three.)

Accepted Answer

NFV can leverage SDN to dynamically create and manage network paths between VNFs.. Option A is correct because NFV commonly uses SDN controllers (e.g., OpenDaylight, ONOS) to program flow rules and dynamically establish paths between VNFs, enabling flexible traffic steering. Option B is correct because SDN's control/data plane separation and centralized abstraction let NFV decouple network functions from proprietary hardware, so VNFs can run on commodity servers with programmable connectivity. Option C is correct because NFV and SDN are complementary but architecturally independent: NFV virtualizes network functions, SDN centralizes control, and each can be deployed alone or together. Option D is wrong because NFV can be implemented without SDN, for example using traditional routing and manual configuration. Option E is wrong because service function chaining can be achieved through other mechanisms such as overlay tunnels, policy-based routing, or dedicated appliances, not strictly SDN.

Answer

SDN is a prerequisite for implementing NFV in any network environment.

Answer

NFV requires SDN to perform service function chaining.

Question 11

Consider the following configuration on a Cisco IOS-XE router:

vrf definition RED
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
interface GigabitEthernet0/2
 vrf forwarding RED
 ip address 10.10.10.1 255.255.255.0

Which statement is true about this configuration?

Accepted Answer

The VRF RED is correctly configured for MPLS L3VPN, and the interface is placed in VRF RED.. The configuration defines a VRF named RED with an RD of 100:1 and matching route-target import/export values, which is the standard setup for an MPLS L3VPN. The 'vrf forwarding RED' command under the interface assigns that interface to the VRF, isolating its routing table from the global table. This allows the router to participate in a Layer 3 VPN by importing and exporting routes with the specified route-target.

Answer

The 'rd' command is optional for VRF operation and can be omitted.

Answer

The 'route-target export' and 'route-target import' must match the RD value exactly.

Answer

This configuration will cause the interface to use the global routing table for forwarding.

Question 12

Which three statements about FlexVPN are true? (Choose three.)

Accepted Answer

FlexVPN uses IKEv2 as its underlying key exchange protocol.. Option A is correct because FlexVPN is built on IKEv2, which handles the key exchange and security association negotiation for both IPsec and FlexVPN tunnels. Option B is correct because FlexVPN is a unified framework that supports site-to-site, hub-and-spoke, and remote-access VPN topologies using the same IKEv2/IPsec infrastructure. Option D is correct because FlexVPN supports multiple authentication methods, including digital certificates (RSA/ECDSA) and pre-shared keys, as well as EAP-based methods. Option C is incorrect because FlexVPN does not require a dedicated AAA server; local authentication or certificates can be used, and AAA is optional. Option E is incorrect because NHRP is used by DMVPN, not FlexVPN; FlexVPN uses IKEv2 routing and IPsec to establish tunnels without NHRP.

Answer

FlexVPN requires a dedicated AAA server for all authentication functions.

Answer

FlexVPN uses NHRP to dynamically discover spoke routers and establish direct tunnels.

Question 13

Which three statements about Ansible modules for Cisco IOS-XE are true? (Choose three.)

Accepted Answer

The ios_config module supports idempotent configuration changes by comparing the desired state with the running configuration.. Option A is correct because ios_config is the declarative configuration module for IOS-XE: it renders the candidate lines, compares them against the device's running configuration (via the network_cli connection and the device's show running-config output), and only pushes the diff, which makes repeated runs idempotent. Option B is correct because ios_command is the read-only module designed to run arbitrary operational (show) commands on IOS-XE and return structured results in the stdout/stdout_lines keys, which can then be parsed by filters or subsequent tasks. Option D is correct because ios_vlan manages VLAN resources on Cisco IOS/IOS-XE devices, allowing VLANs to be created, modified (name, state), and removed declaratively. Option C is not correct because ios_facts collects a broad set of facts—including hardware, software version, hostname, interfaces, and IP addressing—not just interface statistics. Option E is not correct because ios_lldp supports interface-level parameters (such as enabling/disabling LLDP per interface via the interfaces option), not only the global enable/disable state.

Answer

The ios_facts module gathers only interface statistics from the device.

Answer

The ios_lldp module can only enable LLDP globally, not on specific interfaces.

Question 14

Which three statements about telemetry data collection intervals and on-change notifications are true? (Choose three.)

Accepted Answer

Periodic telemetry sends data at a configured interval regardless of whether the value has changed.. Option A is correct because periodic telemetry is interval-driven: the collector pushes the sensor value at the configured period (e.g., every 30 seconds) whether or not the value differs from the previous sample. Option B is correct because on-change telemetry is event-driven, transmitting a sample only when the monitored value crosses or changes from its prior state, which cuts the volume of updates and thus network and processing overhead. Option C is correct because a single subscription (for example, a gNMI/RFC 8641 or NETCONF telemetry subscription) can carry multiple sensor paths with different modes, so periodic and on-change sensors can coexist under one subscription. Option D is not correct because on-change reporting is not lossless: very brief transitions can be missed between sampling or dampening windows, and some implementations suppress rapid flapping, so no guarantee exists that every transient change is reported. Option E is not correct because neither mode is universally preferable; periodic suits continuous monitoring and trending, while on-change suits state or event monitoring, and the choice depends on the use case.

Answer

On-change telemetry guarantees that every change, no matter how brief, will be reported.

Answer

Periodic telemetry is always preferred over on-change for all use cases.

Question 15

Drag and drop the steps of ACL reflexive access list (dynamic inspection) flow into the correct order, from first to last.

Accepted Answer

Configure extended ACL for outbound traffic. Reflexive ACLs work by evaluating outbound traffic to create dynamic entries that allow return traffic. The order is: define extended ACL, apply outbound, define reflexive ACL, apply inbound, then the reflexive entry is created dynamically.

Question 16

Which three statements about Cisco DNA Center integration with external systems are true? (Choose three.)

Accepted Answer

Cisco DNA Center provides a RESTful API that allows external applications to retrieve network inventory and topology data.. Option A is correct because Cisco DNA Center exposes a RESTful (HTTPS/JSON) northbound API, including the Intent API, that external applications can call to retrieve inventory, topology, device health, and site data programmatically. Option B is correct because DNA Center can be configured with syslog destinations (external syslog/SIEM servers) so that device and system events are forwarded for centralized logging, correlation, and analysis. Option C is correct because DNA Center supports IP Address Management (IPAM) integration with third-party IPAM systems such as Infoblox and SolarWinds, allowing IP pools and address space to be synchronized via the IPAM API/plugin. Option D is not correct because DNA Center is a management, automation, and assurance platform; it does not peer with external routers using BGP to exchange routes. Option E is not correct because DNA Center's northbound interfaces include REST APIs, webhooks, and syslog/SNMP trap forwarding, so it is false that SNMP traps are the only event notification interface.

Answer

Cisco DNA Center establishes BGP peering sessions with external routers to exchange routing information.

Answer

Cisco DNA Center only supports SNMP traps as the northbound interface for event notifications.

Question 17

A network engineer runs the following command on Router R7:

R7# show mpls ldp capabilities
    LDP Capabilities:
      Dynamic Capability: advertised
      Typed Wildcard FEC: advertised
      MTU Signaling: advertised
      P2MP: not advertised
      MPLS OAM: advertised
      LDP Graceful Restart: advertised
        Helper mode: enabled
        Restart mode: enabled
        Reconnect time: 120 sec
        Recovery time: 180 sec

Based on this output, which capability is NOT supported by this router?

Accepted Answer

P2MP (Point-to-Multipoint). The output shows 'P2MP: not advertised', which explicitly indicates that Point-to-Multipoint (P2MP) capability is not supported on this router. All other listed capabilities, including LDP Graceful Restart, MTU Signaling, and Dynamic Capability, are shown as 'advertised' and therefore supported.

Answer

LDP Graceful Restart

Answer

MTU Signaling

Answer

Dynamic Capability

Question 18

Which three statements about Dynamic Trunking Protocol (DTP) are true? (Choose three.)

Accepted Answer

DTP is a Cisco proprietary protocol.. Option A is correct because DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol used to negotiate trunk encapsulation and trunking mode between directly connected Cisco switches. Option B is correct because DTP frames are sent untagged on the native VLAN (VLAN 1 by default), which is why both ends must agree on the native VLAN for DTP to function properly. Option C is correct because 'switchport mode dynamic desirable' makes the interface actively initiate DTP negotiation and form a trunk if the neighbor responds with trunk, desirable, or auto mode. Option D is incorrect because DTP operates at Layer 2 (data link layer), not Layer 3. Option E is incorrect because DTP negotiates trunking on switch ports, not routed ports; routed ports are configured with 'no switchport' and do not run DTP.

Answer

DTP operates at Layer 3 of the OSI model.

Answer

DTP is used to negotiate trunking on routed ports.

Question 19

Drag and drop each OSPF packet type on the left to its matching function on the right.

Accepted Answer

Hello: Discovers neighbors and maintains adjacency state. Hello packets discover and maintain neighbor relationships; DBD packets contain a summary of the LSDB; LSR packets request specific LSAs; LSU packets send full LSAs in response to LSRs; LSAck packets acknowledge receipt of LSUs.

Question 20

Which three statements about SD-WAN overlay tunnels and transport are true? (Choose three.)

Accepted Answer

Control plane communication between vSmart and edge devices uses DTLS or TLS encryption.. Option A is correct because in Cisco SD-WAN the control plane connections between vSmart controllers and edge devices (vEdge/cEdge) are secured with DTLS or TLS, protecting OMP and other control traffic. Option B is correct because the data plane overlay tunnels between edge devices are IPsec tunnels whose keys are negotiated using IKEv2, providing encryption and authentication for payload traffic. Option C is correct because a TLOC is uniquely identified by the tuple of system IP, color, and encapsulation type (for example, system-ip, color biz-internet, encapsulation ipsec), which tells OMP how to reach the transport. Option D is incorrect because SD-WAN supports many transport colors beyond MPLS and Internet, including LTE/5G, and LTE is explicitly supported. Option E is incorrect because OMP distributes routing and TLOC information but does not itself establish IPsec tunnels; tunnel establishment is handled by the data plane using IKE/IPsec based on TLOC and policy.

Answer

SD-WAN edge devices can only use MPLS or Internet as transport; LTE is not supported.

Answer

OMP is responsible for dynamically establishing IPsec tunnels between edge devices based on policy.