350-401 Practice Exam 69 — 20 Questions

Question 1

Drag and drop each STP variant on the left to its matching standard on the right.

Accepted Answer

STP: IEEE 802.1D. STP is IEEE 802.1D; RSTP is IEEE 802.1w; MSTP is IEEE 802.1s; PVST+ is Cisco proprietary.

Question 2

Drag and drop each STP port role on the left to its matching definition on the right.

Accepted Answer

Root port: Best path to the root bridge. Root port is the best path to the root bridge; Designated port is the best path for a segment; Alternate port provides an alternative path to the root; Backup port provides a redundant path to the same segment.

Question 3

What is the default load-balancing method used by Cisco switches for EtherChannel?

Accepted Answer

Source MAC address. Cisco switches default to source MAC address-based load balancing for EtherChannel. This method distributes traffic based on the source MAC address of the frame, which can lead to uneven distribution if traffic patterns are not diverse.

Answer

Destination MAC address

Answer

Source IP address

Answer

Source and destination IP address

Question 4

Drag and drop each LACP port mode on the left to its matching negotiation behavior on the right.

Accepted Answer

active: Sends LACP packets and responds to LACP packets. Active initiates negotiation; passive waits for partner. Both must have at least one active side to form EtherChannel.

Question 5

Drag and drop each PAgP port mode on the left to its matching negotiation behavior on the right.

Accepted Answer

desirable: Sends PAgP packets and responds to PAgP packets. Desirable initiates negotiation; auto waits. At least one side must be desirable to form channel.

Question 6

Which two statements about EtherChannel configuration and verification are true? (Choose two.)

Accepted Answer

On IOS-XE, the 'channel-group 1 mode active' command creates the port-channel interface automatically if it does not exist.. EtherChannel interfaces can be configured as Layer 2 (switchport) or Layer 3 (no switchport). The 'channel-group' command assigns a physical port to a port-channel. The 'show etherchannel summary' command displays the state and bundle information. On NX-OS, the 'channel-group' command uses the 'force' option to override mismatched parameters.

Answer

In a Layer 3 EtherChannel, you must assign an IP address to the port-channel interface and also to each member interface.

Answer

The 'channel-group 1 mode desirable' command is valid on both IOS-XE and NX-OS platforms.

Answer

If physical ports in an EtherChannel have different speed or duplex settings, the EtherChannel will still form but with reduced bandwidth.

Question 7

Which four statements about LACP (Link Aggregation Control Protocol) are true? (Choose four.)

Accepted Answer

LACP uses multicast destination address 01-80-c2-00-00-02 for its frames.. Options A, B, C, and E are correct. LACP uses multicast address 01-80-c2-00-00-02 (A). The system priority determines the controlling switch (B). Port priority selects active ports when the number of ports exceeds the maximum allowed (C). On Cisco switches, the default LACP system priority is 32768 (E). Option D is incorrect because LACP and PAgP are incompatible protocols.

Answer

LACP can negotiate EtherChannels with devices that run PAgP.

Question 8

Drag and drop each RSPAN VLAN requirement on the left to its correct restriction on the right.

Accepted Answer

RSPAN VLAN: Must be dedicated solely to RSPAN traffic; no other traffic allowed.. The RSPAN VLAN must be dedicated to RSPAN only, cannot be the native VLAN, must be allowed on all trunk links between source and destination switches, and must not have any Layer 3 interface configured.

Question 9

Drag and drop each WPA security version on the left to its matching authentication method on the right.

Accepted Answer

WPA Personal: Pre-Shared Key (PSK). WPA Personal uses Pre-Shared Key (PSK); WPA Enterprise uses 802.1X/EAP; WPA2 Personal uses PSK; WPA2 Enterprise uses 802.1X/EAP; WPA3 Personal uses Simultaneous Authentication of Equals (SAE).

Question 10

Drag and drop the steps of SR-IOV configuration for VM network bypass into the correct order, from first to last.

Accepted Answer

Enable SR-IOV and VT-d in BIOS. The configuration begins with enabling SR-IOV in the BIOS, then creating virtual functions, assigning them to the VM, and finally installing drivers inside the VM.

Question 11

Drag and drop each hypervisor product on the left to its matching vendor on the right.

Accepted Answer

vSphere: VMware. All pairs are correctly matched. Note: OpenVZ is not associated with Proxmox VE; Proxmox VE uses LXC containers. The correct mapping for OpenVZ would be to a different vendor, but it is not part of this matching.

Question 12

A network engineer is troubleshooting performance issues on a VMware ESXi host running multiple VMs. The host has two physical CPUs, each with 8 cores (16 logical processors with Hyper-Threading enabled). One VM, configured with 8 vCPUs, experiences high CPU ready time. Other VMs on the host are idle. What is the most likely cause of the high CPU ready time?

Accepted Answer

The VM's vCPUs span multiple NUMA nodes, causing memory access delays.. The VM has 8 vCPUs, and each physical CPU socket has 8 cores (16 logical processors with Hyper-Threading). While the VM could theoretically be scheduled entirely within one NUMA node (one socket), hypervisors often distribute vCPUs across sockets for load balancing or to avoid resource contention, especially when the VM's vCPU count equals the number of cores per socket. This causes NUMA spanning, leading to remote memory access and higher CPU ready time due to NUMA latency. Hyper-Threading can worsen the issue as vCPUs may be placed on logical processors from different sockets.

Answer

Hyper-Threading is disabled on the ESXi host.

Answer

The host is overcommitted with too many vCPUs.

Answer

The VM has more vCPUs than physical cores on a single socket.

Question 13

Consider the following telemetry configuration on a Cisco IOS-XE device:

telemetry ietf subscription 600
 encoding encode-kvgpb
 filter xpath /interfaces/interface/state
 stream yang-push
 update-policy on-change
 receiver ip address 10.1.1.1 50000 protocol grpc

What is a potential issue with this configuration?

Accepted Answer

The filter XPath is too broad and may cause excessive CPU usage on frequent changes.. On-change subscriptions can generate high CPU load if the monitored data changes frequently, which may impact device performance.

Answer

The on-change policy will not work without a periodic fallback.

Answer

The receiver IP address must be on the same subnet as the device.

Answer

The encoding should be encode-xml for on-change subscriptions.

Question 14

Examine the following telemetry configuration on a Cisco IOS-XE device:

telemetry ietf subscription 200
 encoding encode-kvgpb
 filter xpath /interfaces/interface[name='GigabitEthernet0/0/0']/state
 stream yang-push
 update-policy on-change
 receiver ip address 192.168.1.100 50001 protocol grpc

Which statement is true about this configuration?

Accepted Answer

Data is pushed only when a change occurs in the state of GigabitEthernet0/0/0.. This subscription uses on-change update policy, so data is pushed only when a change occurs in the specified subtree.

Answer

Data is pushed every 200 seconds to the collector.

Answer

The subscription uses JSON encoding.

Answer

The filter selects all interfaces, not just GigabitEthernet0/0/0.

Question 15

A network engineer is deploying model-driven telemetry on a Cisco Nexus 9000 switch to monitor BGP prefix changes. The engineer wants to use YANG data models and prefers a transport protocol that is lightweight and uses UDP. Which transport protocol should the engineer select for the telemetry stream?

Accepted Answer

SNMP. The engineer explicitly prefers a lightweight transport protocol using UDP. Among the options, only SNMP uses UDP as its transport. Although SNMP is not a model-driven telemetry protocol (it uses MIBs instead of YANG models), the question's requirement for UDP overrides this. gRPC, NETCONF, and RESTCONF all use TCP, so they do not satisfy the UDP requirement. Therefore, SNMP is the correct answer in this scenario.

Answer

gRPC

Answer

NETCONF

Answer

RESTCONF

Question 16

Which two statements about VRF-aware services are true? (Choose two.)

Accepted Answer

VRF-lite allows multiple routing instances on a single router using separate routing tables.. VRF-aware services allow network functions to operate within the context of a specific VRF, enabling per-VRF routing and forwarding. Option A is correct because VRF-lite provides multiple routing instances on a single router by maintaining separate routing tables for each VRF, using either static or dynamic routing. Option B is correct because services like DHCP and NAT can be configured independently per VRF, allowing address translation and address assignment to be isolated per VRF. Option C is incorrect because VRF instances are not limited to MPLS VPN environments; they can be used in VRF-lite deployments without MPLS. Option D is incorrect because route leaking between VRFs is supported in Cisco IOS through manual configuration (e.g., route import/export) or using VRF-lite with route replication. Option E is incorrect because each VRF has its own routing table, separate from the global routing table; VRFs do not share a common global routing table.

Answer

VRF instances are only supported on routers running MPLS VPN.

Answer

Route leaking between VRFs is not supported in Cisco IOS.

Answer

All VRFs on a router must share the same global routing table.

Question 17

Drag and drop the steps of IPsec IKEv2 tunnel establishment into the correct order, from first to last.

Accepted Answer

IKE_SA_INIT exchange (DH, nonces). IKEv2 establishment starts with IKE_SA_INIT to negotiate cryptographic parameters and exchange Diffie-Hellman keys. Next, IKE_AUTH authenticates the peers and establishes the first CHILD_SA. Then, additional CHILD_SAs can be created via CREATE_CHILD_SA. Finally, the IPsec SA is used to encrypt data traffic.

Question 18

Which three statements about IPsec VPNs are true? (Choose three.)

Accepted Answer

IKEv2 is more resilient to network changes than IKEv1 because it supports Dead Peer Detection (DPD) as a built-in feature.. IPsec VPNs can operate in transport mode (protecting payload only) or tunnel mode (protecting entire IP packet). IKEv2 is more robust than IKEv1, supporting EAP authentication and built-in DPD. AES is a symmetric encryption algorithm used for data confidentiality. SHA is used for integrity, not encryption. IKE uses UDP port 500, not TCP. ESP can provide both encryption and authentication, but authentication is optional in some implementations.

Answer

IPsec transport mode encrypts the entire original IP packet, including the IP header.

Answer

IKE uses TCP port 500 for key exchange and negotiation of security associations.

Question 19

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

Accepted Answer

The router's interface is administratively down.. Given that the engineer verified the router interface IP is 192.168.1.1, which is within the 192.168.1.0/24 subnet, option A is factually incorrect. The most likely cause is that the interface is administratively down (option C). Although clients obtained IP addresses via DHCP, if the interface is administratively down, it will not forward traffic, making the default gateway unreachable. Option B (missing lease) would not prevent pinging the gateway. Option D (excluded-address blocking the gateway IP) would not cause unreachability because the IP is still valid on the interface.

Answer

The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.

Answer

The DHCP pool is missing the lease command.

Answer

The ip dhcp excluded-address command is blocking the default gateway IP.

Question 20

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255, which is a hard limit encoded in the protocol's metric field. This allows EIGRP to scale to much larger networks than distance-vector protocols like RIP, which have a hop count limit of 15. The hop count is not used as a primary metric in EIGRP but serves as a loop-prevention mechanism, and routes with a hop count exceeding 255 are considered unreachable.

Answer

15

Answer

16

Answer

100