350-401 Practice Exam 70 — 20 Questions

Question 1

Drag and drop the steps of VLAN mapping on trunk interfaces into the correct order, from first to last.

Accepted Answer

Enter trunk interface configuration mode. First enter the trunk interface, configure encapsulation, then apply the VLAN mapping policy (translate or map), and finally verify the mapping.

Question 2

Drag and drop each DTP mode on the left to its matching trunking behavior on the right.

Accepted Answer

dynamic desirable: Actively sends DTP frames; forms trunk if neighbor is trunk, desirable, or auto. Dynamic desirable actively sends DTP frames and forms a trunk if the neighbor is trunk, dynamic desirable, or dynamic auto. Dynamic auto forms a trunk only if the neighbor is trunk or dynamic desirable. Trunk always forms a trunk. Access never forms a trunk. None disables DTP.

Question 3

Drag and drop each syslog severity level on the left to its matching severity number on the right.

Accepted Answer

Emergency: 0. Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notice=5, Informational=6, Debug=7.

Question 4

Which two statements about telemetry subscription types in model-driven telemetry are true? (Choose two.)

Accepted Answer

In a dial-out subscription, the network device pushes telemetry data to a configured collector.. Option B is correct because in a dial-out (also called push) subscription the network device itself initiates the session and pushes telemetry data to a preconfigured collector address, rather than waiting for the collector to connect. Option D is correct because periodic subscriptions send updates at a fixed, user-defined interval controlled by the sample-interval parameter, delivering data continuously regardless of whether values changed. Option A is incorrect because in a dial-in subscription it is the collector (receiver) that initiates the connection to the device, not the device. Option C is incorrect because on-change subscriptions stream data only when a monitored value changes, not at a regular cadence. Option E is incorrect because dial-out is generally considered more scalable for large deployments, since the collector passively receives streams and does not have to poll or maintain a session per device.

Answer

In a dial-in subscription, the network device initiates the connection to the telemetry collector.

Answer

On-change subscriptions stream data at a regular, user-defined cadence.

Answer

Dial-out subscriptions are less scalable than dial-in subscriptions because each device must manage its own connections.

Question 5

A network engineer is configuring QoS on a Cisco router to prioritize business-critical applications. The engineer creates a class-map that matches traffic based on the destination IP address and port. However, the class-map does not match the expected traffic. What is the most likely reason?

Accepted Answer

The class-map uses 'match-all' but the engineer intended to use 'match-any'.. When a class-map uses 'match-all', all match conditions must be true for a packet to be classified. If the engineer intended to match traffic based on either the destination IP address OR the port, using 'match-any' would allow the class-map to match if any single condition is met. The mismatch occurs because the class-map is too restrictive, requiring both conditions to be satisfied simultaneously.

Answer

The access-list used for matching is not applied to the correct interface.

Answer

The router does not support matching on both IP and port in the same class-map.

Answer

The class-map must be applied to the interface before it can match traffic.

Question 6

Which three statements about Cisco DNA Center software image management are true? (Choose three.)

Accepted Answer

Cisco DNA Center allows administrators to define a golden image for each device family to enforce consistent software versions.. DNA Center provides centralized image management with golden images, distributed upgrades, and compliance checks. The correct answers cover these key features. The incorrect options confuse image management with configuration backup or misstate the upgrade process (no automatic reboot without approval).

Answer

Cisco DNA Center automatically reboots devices after an image upgrade without any administrator confirmation.

Answer

Cisco DNA Center uses the device's configuration file to determine the required image version.

Question 7

Drag and drop the steps of parsing 'show interfaces' output using TextFSM into the correct order, from first to last.

Accepted Answer

Capture CLI output from device. The correct order of steps for parsing 'show interfaces' output using TextFSM is: first, capture CLI output from the device (A); second, load the TextFSM template file (B); third, initialize the TextFSM parser with the template (C); fourth, parse the output using the ParseText method (D); finally, access the structured data as a list of dictionaries (E). This sequence follows the logical workflow of a script: obtain raw data, set up the template, apply the parser, and retrieve structured results.

Question 8

What is the default SNMP trap port number?

Accepted Answer

UDP 162. SNMP traps are unsolicited notifications sent from an SNMP agent to a network management system (NMS) to alert about significant events. By default, these trap messages are sent over UDP port 162, as defined in RFC 1157. UDP is used because traps are connectionless and do not require acknowledgment, making them efficient for event-driven notifications.

Answer

UDP 161

Answer

TCP 161

Answer

TCP 162

Question 9

A network engineer runs the following command on Router R3:

R3# show interfaces GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Hardware is ISR4331-2x1GE, address is aabb.cc00.0300 (bia aabb.cc00.0300)
  Internet address is 10.0.0.3/24
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 1000 bits/sec, 2 packets/sec
  5 minute output rate 2000 bits/sec, 3 packets/sec
     12345 packets input, 1234567 bytes, 0 no buffer
     Received 123 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     12345 packets output, 2345678 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

Based on this output, what can be concluded?

Accepted Answer

The interface has had one reset since the last counter clear.. The output shows '1 interface resets' under the output statistics. Interface resets occur when the interface is reset by software or hardware, often due to a configuration change, a cable issue, or a temporary link flap. Since the last clearing of counters, this single reset indicates a past event, not a current hardware failure.

Answer

The interface has experienced a hardware failure.

Answer

The interface is experiencing high input errors.

Answer

The interface is operating at half-duplex.

Question 10

A network engineer is configuring port security on a Cisco switch. The requirement is to allow only the first MAC address that appears on the port to be learned and to automatically disable the port if a violation occurs. The engineer configures 'switchport port-security mac-address sticky' but does not specify a maximum number of secure MAC addresses. After connecting a single host, the port works. However, when the host is replaced with a different device, the port is error-disabled. What is the most likely reason?

Accepted Answer

The default maximum number of secure MAC addresses is 1, so the second MAC address triggers a violation.. The default maximum number of secure MAC addresses on a switchport is 1. When the engineer configured 'switchport port-security mac-address sticky' without specifying a maximum, the port learned the first host's MAC address as a sticky entry. When a different device was connected, its MAC address exceeded the default limit of 1, triggering a security violation. Since the default violation mode is 'shutdown', the port was error-disabled.

Answer

The sticky keyword requires the engineer to first manually configure a maximum number of MAC addresses.

Answer

The violation mode is set to 'restrict' by default, which causes the port to error-disable after one violation.

Answer

The port security aging type is set to 'absolute' by default, causing the sticky address to expire immediately.

Question 11

A network engineer is configuring OSPF in a multi-area design. The engineer wants to reduce the amount of LSA flooding and the size of the LSDB in area 0. Which OSPF feature should be implemented on the ABR to achieve this goal?

Accepted Answer

Configure the ABR with an area filter-list to filter type 3 LSAs.. Configuring an area filter-list on the ABR allows the engineer to filter Type 3 summary LSAs entering or leaving area 0. This directly reduces LSA flooding and shrinks the LSDB in area 0 by preventing specific inter-area prefixes from being advertised into the backbone, without altering the area type or requiring additional redistribution.

Answer

Configure area 0 as a stub area.

Answer

Configure OSPF database overflow protection.

Answer

Configure the ABR as an ASBR.

Question 12

Drag and drop each ACL type on the left to its matching capability on the right.

Accepted Answer

Standard ACL: Filters based on source IP address only. Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow identification by name; Time-based ACLs use time ranges; Dynamic ACLs authenticate per-user.

Question 13

Drag and drop each wireless AP mode on the left to its matching function on the right.

Accepted Answer

Local: Serves clients with CAPWAP control and data to WLC. Local mode serves clients with CAPWAP control and data; FlexConnect mode switches client data locally; Monitor mode listens for rogue APs; Sniffer mode captures packets for analysis; Rogue Detector mode detects rogue devices via wired network.

Question 14

Drag and drop each 802.11 standard on the left to its matching frequency band and maximum speed on the right.

Accepted Answer

802.11b: 2.4 GHz, 11 Mbps. 802.11b operates at 2.4 GHz with 11 Mbps; 802.11a at 5 GHz with 54 Mbps; 802.11g at 2.4 GHz with 54 Mbps; 802.11n can use both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates only at 5 GHz with up to 6.9 Gbps.

Question 15

Drag and drop each IP SLA threshold type on the left to its trigger condition on the right.

Accepted Answer

over-threshold: Trigger when metric exceeds threshold. Over-threshold triggers when a metric exceeds the configured value; immediate triggers on the first violation; consecutive triggers after a specified number of consecutive violations.

Question 16

An organization uses Chef to manage network device configurations. A cookbook that configures SNMP community strings is applied to a group of routers. After the run, one router loses SNMP access. The cookbook uses the following resource: snmp_community 'public' do action :remove end. What is the most likely cause of the issue?

Accepted Answer

The cookbook removed the only configured SNMP community string. The `snmp_community 'public' do action :remove end` resource explicitly removes the SNMP community string named 'public'. If 'public' was the only SNMP community string configured on the router, its removal would leave the router with no valid SNMP community, causing all SNMP access to be lost. Chef applies the resource as defined; the issue is not a syntax error or misapplication of a different string, but the direct consequence of removing the sole community.

Answer

The router's Chef client encountered a syntax error and stopped mid-execution

Answer

The cookbook accidentally applied a 'private' community string instead of 'public'

Answer

The cookbook is not idempotent and reapplied the change multiple times

Question 17

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Accepted Answer

The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.. The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic. This explains why BGP sessions from other peers are still being established.

Answer

The ACL is applied in the wrong order; the deny statement should be before the permit statement.

Answer

BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

Answer

CoPP does not affect BGP sessions because they are established before the policy is applied.

Question 18

Drag and drop each PnP workflow step on the left to its matching action on the right.

Accepted Answer

Claim: Assigns a discovered device to a specific site and profile. PnP steps: Claim assigns a device to a site; Day0 Template applies initial configuration; Image Upgrade updates the device software; Provision deploys the full configuration.

Question 19

Drag and drop the steps of DNA Center assurance issue detection and root cause analysis into the correct order, from first to last.

Accepted Answer

Collect telemetry from network devices. Assurance starts with collecting telemetry, detecting an anomaly, raising an issue, correlating data for root cause, and then recommending a remediation action.

Question 20

Drag and drop the steps of SPAN session on EtherChannel member ports into the correct order, from first to last.

Accepted Answer

Create SPAN session number. SPAN on EtherChannel requires configuring the session, specifying source ports (member or port-channel), setting destination, and enabling.