350-401 Mock Exam 71 — 25 Questions

Question 1

Drag and drop the steps of IP SLA HTTP operation for application monitoring into the correct order, from first to last.

Accepted Answer

Create IP SLA HTTP operation with URL. First, the HTTP operation is defined with the target URL. Then optional parameters like HTTP method or version are set. The operation is configured to monitor HTTP response. Next, the operation is scheduled. Finally, verification is done to confirm the operation is active.

Question 2

Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.

Accepted Answer

Import threading and ConnectHandler from netmiko. The workflow begins by importing required modules (threading and Netmiko), defining a function for device connection and command execution, creating a list of devices, then using threading.Thread to spawn threads for each device, and finally joining threads to wait for completion.

Question 3

Drag and drop the steps of WPA3 client authentication process into the correct order, from first to last.

Accepted Answer

AP advertises WPA3 in beacon frames. WPA3 uses SAE (Simultaneous Authentication of Equals) handshake. First, the AP announces WPA3 capability in beacons. The client then initiates the SAE commit exchange, followed by the SAE confirm exchange. After SAE completes, the 4-Way Handshake occurs, and finally group key is installed.

Question 4

Drag and drop the steps of connecting to a network device via Netmiko into the correct order, from first to last.

Accepted Answer

Import netmiko library. The correct order starts with importing the Netmiko library, then creating a device dictionary with connection parameters, establishing the SSH connection using ConnectHandler, sending a command (e.g., 'show ip interface brief'), and finally closing the connection with disconnect(). This sequence follows standard Netmiko workflow for device access.

Question 5

Drag and drop each RADIUS attribute on the left to its correct attribute number on the right.

Accepted Answer

User-Name: Attribute 1. RADIUS attribute numbers are standardized: User-Name is 1, NAS-IP-Address is 4, Service-Type is 6, Framed-IP-Address is 8, and NAS-Port is 5.

Question 6

Drag and drop each streaming telemetry mode on the left to its matching trigger on the right.

Accepted Answer

periodic: Data is sent at a fixed interval. Periodic sends at intervals, on-change sends on value change, target-defined leaves timing to the device, on-change-with-policy adds conditions, and periodic-and-on-change combines both.

Question 7

Consider the following Python script that uses the requests library to delete a VLAN via RESTCONF on a Cisco IOS-XE device:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/vlan=10'
headers = {
    'Accept': 'application/yang-data+json',
    'Content-Type': 'application/yang-data+json'
}
auth = HTTPBasicAuth('admin', 'cisco')

response = requests.delete(url, headers=headers, auth=auth, verify=False)
print(response.status_code)
```

What is the expected outcome if the VLAN 10 exists?

Accepted Answer

It will delete VLAN 10 from the device configuration.. The `requests.delete()` method sends an HTTP DELETE request to the RESTCONF API endpoint for VLAN 10. When the VLAN exists, the device processes the DELETE operation and removes the VLAN configuration from the running config, returning a 204 No Content status code upon success.

Answer

It will retrieve the configuration of VLAN 10.

Answer

It will create VLAN 10 if it does not exist.

Answer

It will return an error because the payload is missing.

Question 8

Drag and drop the steps of QoS policing with two-rate three-color marker (RFC 2698) into the correct order, from first to last.

Accepted Answer

Check committed token bucket for packet. RFC 2698 two-rate three-color marker uses committed and peak token buckets. The correct order is: first check the committed bucket (A). If tokens are available, mark the packet green (B). If not, check the peak bucket (C). If tokens are available, mark the packet yellow (D). If no tokens are available, mark the packet red and drop (E). This sequence ensures proper conformance classification.

Question 9

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

Accepted Answer

A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.. Option A is correct because Python can load a YAML inventory file with libraries such as PyYAML (yaml.safe_load), iterate over the parsed hostnames and IP addresses, and use those values to drive connections to each device for inventory collection. Option B is correct because Python's built-in json module provides json.dumps() to serialize a dictionary of inventory data into a JSON string suitable for storage or transmission, and json.loads() to deserialize it. Option C is correct because the standard csv module (e.g., csv.DictReader) can parse CSV inventory files containing fields like hostname, IP, and credentials and feed them into an automation script. Option D is incorrect because YAML explicitly supports comments using the # character, so inventory files can include explanatory text. Option E is incorrect because JSON is not always more human-readable than YAML; YAML's indentation-based, comment-friendly syntax is often considered more readable for complex nested structures.

Answer

YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.

Answer

JSON is always more human-readable than YAML for complex inventory structures.

Question 10

Drag and drop each EIGRP packet type on the left to its matching function on the right.

Accepted Answer

Hello: Discovers and maintains neighbor relationships. Hello packets discover and maintain neighbors; Update packets carry routing information; Query packets ask for alternate paths; Reply packets respond to queries; ACK packets acknowledge reliable delivery.

Question 11

Drag and drop each SNMP component on the left to its matching role on the right.

Accepted Answer

Manager: Network management station that polls agents. The manager collects data, the agent runs on the device, MIB defines the data structure, and OID identifies specific variables.

Question 12

Drag and drop the steps of OSPF redistribution from EIGRP with metric conversion into the correct order, from first to last.

Accepted Answer

Configure redistribute eigrp under OSPF. Redistribution requires enabling redistribution, setting a seed metric (or using default-metric), optionally matching routes, and then verifying. The order ensures routes are properly injected.

Question 13

Drag and drop each STP variant on the left to its matching standard on the right.

Accepted Answer

STP: IEEE 802.1D. STP is IEEE 802.1D; RSTP is IEEE 802.1w; MSTP is IEEE 802.1s; PVST+ is Cisco proprietary.

Question 14

Drag and drop each STP port role on the left to its matching definition on the right.

Accepted Answer

Root port: Best path to the root bridge. Root port is the best path to the root bridge; Designated port is the best path for a segment; Alternate port provides an alternative path to the root; Backup port provides a redundant path to the same segment.

Question 15

Given the following Ansible playbook snippet:
---
- name: Configure EIGRP
  hosts: routers
  gather_facts: no
  tasks:
    - name: EIGRP config
      ios_config:
        lines:
          - router eigrp 100
          - network 192.168.1.0
        parents: router eigrp 100
What is the effect of this playbook?

Accepted Answer

It fails because the network statement requires a wildcard mask.. The `network` statement in EIGRP requires a wildcard mask to define the exact interfaces on which EIGRP will run. Without a wildcard mask, the command `network 192.168.1.0` is incomplete and will be rejected by the Cisco IOS device, causing the playbook task to fail. The Ansible `ios_config` module sends the lines as-is to the device, so the missing wildcard mask results in a configuration error.

Answer

It configures EIGRP AS 100 and advertises network 192.168.1.0/24.

Answer

It only enters EIGRP configuration mode without applying any network statement.

Answer

It works correctly because the network statement defaults to a classful mask.

Question 16

Examine the following configuration:

interface Port-channel1
 switchport mode trunk
!
interface GigabitEthernet0/1
 switchport mode trunk
 channel-group 1 mode active
 spanning-tree portfast
!
interface GigabitEthernet0/2
 switchport mode trunk
 channel-group 1 mode active
 spanning-tree portfast

What is the effect of the 'spanning-tree portfast' command on the member interfaces of this EtherChannel?

Accepted Answer

The PortFast on the member interfaces will be ignored because they are part of an EtherChannel.. When interfaces are configured as members of an EtherChannel, any spanning-tree configuration applied directly to the member interfaces (such as 'spanning-tree portfast') is ignored. Spanning-tree operates on the logical port-channel interface, not the individual physical members. Therefore, the PortFast command on GigabitEthernet0/1 and GigabitEthernet0/2 has no effect; instead, PortFast must be configured on the Port-channel interface itself to apply to the bundle.

Answer

The PortFast will be applied to the EtherChannel, causing it to immediately transition to forwarding.

Answer

The PortFast will cause the EtherChannel to form faster.

Answer

The configuration will cause a spanning-tree loop because PortFast is used on trunk ports.

Question 17

Which two statements about configuring SPAN on Cisco IOS-XE switches are true? (Choose two.)

Accepted Answer

A SPAN source can be a physical port or an EtherChannel interface.. The correct answers are A and E. A is true because SPAN source interfaces can be individual physical ports or EtherChannel interfaces (port channels). E is true because a SPAN destination port is a switch port put into SPAN monitoring mode and cannot be a Layer 3 routed port. B is false: a port configured as a SPAN destination cannot simultaneously serve as a SPAN source. C is false: a SPAN session can have multiple source ports. D is false: the destination port is placed into a special SPAN mode and does not need to belong to the same VLAN as the source.

Answer

A SPAN destination port can also be configured as a SPAN source port.

Answer

Only one source port can be configured per SPAN session.

Answer

The SPAN destination port must belong to the same VLAN as the source port.

Question 18

An engineer is deploying a wireless network in a hospital that requires strict security and client isolation. The network must support 802.1X authentication for employees and a separate guest SSID with a captive portal. The engineer configures the WLC with RADIUS servers for 802.1X and a local web server for the captive portal. However, guest users can access the internal network after authentication. What configuration change is needed?

Accepted Answer

Apply a VLAN ACL on the guest VLAN to block access to internal subnets.. Applying a VLAN ACL on the guest VLAN explicitly blocks traffic from the guest wireless network to the internal subnets. This ensures that after captive portal authentication, guest users cannot access internal resources. Option A is incorrect because client isolation (peer-to-peer blocking) only prevents wireless clients from communicating with each other on the same SSID; it does not block traffic from wireless clients to wired hosts on the internal network. Option B is incorrect because 802.1X authentication is for employees, and requiring it for guests would defeat the purpose of an open guest SSID with captive portal. Option D is incorrect because placing the guest SSID on the same VLAN as the employee SSID would give guest users Layer 2 access to internal hosts, which is exactly what needs to be prevented.

Answer

Enable client isolation (peer-to-peer blocking) on the guest SSID.

Answer

Configure 802.1X authentication for the guest SSID as well.

Answer

Place the guest SSID on the same VLAN as the employee SSID.

Question 19

In Cisco SD-WAN, what is the maximum number of TLOCs that can be associated with a single OMP route?

Accepted Answer

8. In Cisco SD-WAN, a single OMP route can have up to 8 TLOCs (Transport Locations) associated with it. This limit is enforced by the OMP protocol to balance path diversity and control-plane scalability, ensuring that the vSmart controller does not advertise an excessive number of next-hop paths for a single prefix.

Answer

4

Answer

16

Answer

Unlimited

Question 20

Drag and drop the steps of SR-IOV configuration for VM network bypass into the correct order, from first to last.

Accepted Answer

Enable SR-IOV and VT-d in BIOS. The configuration begins with enabling SR-IOV in the BIOS, then creating virtual functions, assigning them to the VM, and finally installing drivers inside the VM.