350-401 Mock Exam 73 — 25 Questions

Question 1

Drag and drop the steps of VRF import/export route-target policy flow into the correct order, from first to last.

Accepted Answer

Configure export RT on local VRF. The order starts with configuring the export RT on the VRF, the PE advertising the VPNv4 route with that RT, the remote PE receiving the route and comparing the RT with its import RT list, if matched the route is imported into the VRF, and finally the route is installed in the VRF routing table.

Question 2

Drag and drop each HTTP status code on the left to its meaning on the right.

Accepted Answer

200: Request succeeded. Correct pairings: 200 OK for success; 201 Created for resource creation; 400 Bad Request for client error; 401 Unauthorized for missing/invalid credentials; 404 Not Found for missing resource; 500 Internal Server Error for server-side failure.

Question 3

Drag and drop each YANG statement on the left to its matching function on the right.

Accepted Answer

container: Groups related nodes into a subtree. In YANG, container groups related nodes, leaf holds a single scalar value, list defines a sequence of entries, leaf-list is an array of scalar values, and typedef defines a derived type.

Question 4

Drag and drop the steps of the QoS shaping and policing configuration sequence into the correct order, from first to last.

Accepted Answer

Define traffic classes using class maps. Shaping and policing require first defining traffic classes, then configuring the shaping/policing actions in a policy map, applying the policy to an interface, and finally adjusting parameters based on monitoring. This order ensures proper traffic control.

Question 5

Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.

Accepted Answer

Ingress switch classifies traffic and assigns SGT. TrustSec inline tagging starts with the ingress switch classifying traffic and adding an SGT to the frame, then forwarding it across the fabric, the egress switch reading the SGT, matching it to an SGACL, and finally enforcing the permit/deny decision.

Question 6

A network engineer is automating the collection of syslog messages from a Cisco ASA firewall using a Python script that connects via SSH and runs 'show log'. The script uses the paramiko library. The script works for a few minutes, but then the SSH connection drops with an error 'Server connection dropped'. The engineer suspects that the ASA is closing the connection due to inactivity. What is the best way to keep the connection alive?

Accepted Answer

Set the 'keepalive' parameter in the paramiko Transport object to send keepalive packets every 30 seconds.. The paramiko library provides a built-in keepalive mechanism via the `Transport` object's `set_keepalive()` method. This sends TCP keepalive packets at the specified interval (e.g., 30 seconds) to prevent the ASA firewall from closing the SSH session due to inactivity. Unlike application-layer workarounds, this operates at the transport layer and does not consume CPU cycles on the ASA for command execution.

Answer

Increase the buffer size in the paramiko SSH client.

Answer

Run a dummy command like 'show clock' every 30 seconds to keep the session active.

Answer

Use the netmiko library instead, which automatically handles keepalives.

Question 7

A service provider wants to deploy a virtualized firewall as a VNF in a service chain. The VNF must be inserted transparently into the traffic path without requiring changes to the existing IP addressing. Which service chaining method should the architect choose?

Accepted Answer

Implement policy-based routing (PBR) to redirect traffic to the VNF.. Policy-based routing (PBR) allows the architect to redirect traffic to the VNF based on match criteria such as source/destination IP or protocol, without altering the existing IP addressing scheme. This enables transparent insertion of the VNF into the service chain, as PBR overrides the routing table for selected traffic and forwards it to the virtualized firewall, while the original IP headers remain unchanged.

Answer

Use static routing to point traffic to the VNF.

Answer

Deploy the VNF in inline mode with proxy ARP.

Answer

Use VRF-lite to separate traffic and route through the VNF.

Question 8

Which two statements about REST API HTTP methods are true? (Choose two.)

Accepted Answer

GET is a safe method that must not change server state.. Option A is correct because GET is defined by the HTTP specification as a safe method, meaning it is intended only for retrieval and must not alter server state. Option D is correct because PUT is idempotent—repeating the same request yields the same result—and it replaces the entire resource representation at the target URI. Option B is wrong because POST is not idempotent; multiple identical POSTs can create multiple resources or trigger repeated side effects. Option C is wrong because DELETE is idempotent, since deleting an already-deleted resource leaves the server in the same state. Option E is wrong because PATCH is not guaranteed to be idempotent; its effect depends on the patch document and the resource's current state.

Answer

POST is idempotent, meaning multiple identical requests have the same effect.

Answer

DELETE is non-idempotent and each request may have a different outcome.

Answer

PATCH is always idempotent because it uses a patch document.

Question 9

A network engineer uses the Requests library to send a RESTCONF PATCH request to modify the hostname of a Cisco IOS-XE device:

```python
import requests
from requests.auth import HTTPBasicAuth

url = 'https://192.168.1.1/restconf/data/Cisco-IOS-XE-native:native/hostname'
headers = {'Content-Type': 'application/yang-data+json'}
auth = HTTPBasicAuth('admin', 'cisco123')
payload = {
    'Cisco-IOS-XE-native:hostname': 'NewRouter'
}
response = requests.patch(url, json=payload, headers=headers, auth=auth, verify=False)
print(response.status_code)
```

What is the expected HTTP status code if the request is successful?

Accepted Answer

204 No Content. A successful RESTCONF PATCH request returns HTTP status code 204 No Content because the operation modifies an existing resource without returning a response body. The PATCH method in RESTCONF is used for partial updates to a target resource, and per RFC 8040, a 204 response indicates that the server has successfully applied the modifications and the response has no payload.

Answer

200 OK

Answer

201 Created

Answer

202 Accepted

Question 10

Drag and drop each NAT terminology on the left to its matching definition on the right.

Accepted Answer

Inside local: The IP address of the host as seen from inside the network. Inside local is the private IP of the host; inside global is the public IP after translation; outside local is the private IP of the remote host; outside global is the public IP of the remote host.

Question 11

Drag and drop the steps of SSL VPN (AnyConnect) session establishment into the correct order, from first to last.

Accepted Answer

Client establishes TLS/DTLS tunnel to ASA. The AnyConnect client first establishes a TLS/DTLS tunnel to the ASA headend. The ASA then authenticates the user via AAA. After authentication, the ASA pushes client configuration and assigns an IP address from a pool. The client installs the virtual adapter with the assigned IP. Finally, the client can send encrypted traffic through the tunnel.

Question 12

Drag and drop the steps of SD-Access fabric border handoff configuration into the correct order, from first to last.

Accepted Answer

Define the external network and VLAN mapping. The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

Question 13

Which three statements about MPLS traffic engineering (MPLS-TE) are true? (Choose three.)

Accepted Answer

MPLS-TE uses RSVP-TE to signal LSPs and reserve resources.. Option A is correct because MPLS-TE uses RSVP-TE as its signaling protocol to establish label-switched paths (LSPs) and reserve bandwidth resources along the explicit path. Option B is correct because OSPF and IS-IS are extended with TE extensions (OSPF-TE and IS-IS-TE) to flood TE link attributes such as available bandwidth, administrative groups, and link metrics in the TE database. Option C is correct because MPLS-TE's core purpose is to route traffic over explicitly defined paths that can deviate from the IGP shortest path, enabling constraint-based routing and load balancing. Option D is incorrect because LDP distributes labels for hop-by-hop IGP-based LSPs and does not perform the resource reservation or explicit path signaling required for TE tunnels. Option E is incorrect because BGP is a path-vector routing protocol used for inter-domain routing and does not compute paths for TE LSPs; path computation is done by the headend router using the TE database (CSPF).

Answer

MPLS-TE relies on LDP to distribute labels for TE tunnels.

Answer

MPLS-TE uses BGP to compute the best path for TE LSPs.

Question 14

Drag and drop the steps of a NETCONF get-config operation into the correct order, from first to last.

Accepted Answer

Establish SSH session to the device. The NETCONF get-config operation begins with establishing a secure SSH session, then the client sends a hello message to exchange capabilities. After the server responds with its hello, the client sends the get-config request. The server retrieves the configuration and sends the reply.

Question 15

Drag and drop the steps of Cisco DNA Center device onboarding via PnP into the correct order, from first to last.

Accepted Answer

Device boots and obtains IP via DHCP with PnP options. The PnP onboarding process begins with the device obtaining an IP address via DHCP and receiving the PnP server address from DHCP options. The device then discovers the Cisco DNA Center PnP server and authenticates using a certificate or credentials. After authentication, the device downloads its Day 0 configuration and image from DNA Center. Finally, the device applies the configuration and joins the fabric or network.

Question 16

Drag and drop each data encoding format on the left to its typical use case on the right.

Accepted Answer

JSON: Human-readable, commonly used in REST APIs. Correct pairings: JSON is human-readable and widely used in REST APIs; XML is verbose with schema support; YAML is human-friendly for configuration files; Protobuf is a compact binary format for high-performance RPC.

Question 17

A network engineer runs the following command on Router R3:

R3# show dmvpn
Legend: Attrb -> S: Static, D: Dynamic, I: Incomplete
        N: NATed, L: Local, X: No Socket
# Ent -> Number of NHRP entries with same NBMA peer
NHS Status: E => Expecting Replies, R => Responding, W => Waiting
UpDn Time -> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 192.168.1.1     10.0.0.1        UP    00:12:34  D
     1 192.168.1.2     10.0.0.2        UP    00:10:20  D

Based on this output, what can be concluded?

Accepted Answer

There are two active spoke routers connected to this hub.. The output shows the router is a Hub (Type:Hub) with two NHRP peers (NHRP Peers:2), both in the UP state with dynamic (D) attribute entries. This confirms that two spoke routers have successfully registered with this hub via NHRP, making option B correct.

Answer

This router is a spoke in the DMVPN network.

Answer

The tunnel interface is down because no peers are listed.

Answer

The router is using static NHRP mappings for all peers.

Question 18

Drag and drop the steps of EIGRP DUAL route computation into the correct order, from first to last.

Accepted Answer

Identify feasible successors using reported distance. EIGRP DUAL first identifies feasible successors via reported distance, then selects the best path as successor. If the successor fails, it checks feasible successors; if none exist, it goes active and queries neighbors. After replies, it computes a new successor.

Question 19

Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.

Accepted Answer

Client associates and authenticates to AP. In DHCP bridging, the client first associates and authenticates. The AP then bridges the DHCP Discover from the client to the wired network. The DHCP server replies with Offer, the client sends Request, and the server sends Ack, completing the process.

Question 20

router bgp 65000
 bgp router-id 10.0.0.1
 neighbor 10.0.0.2 remote-as 65000
!
Which statement about this configuration is true?

Accepted Answer

This is an iBGP session because the remote AS matches the local AS.. This configuration establishes an iBGP session because the local AS number (65000) matches the remote AS number (65000). In BGP, when both routers share the same AS, the session is classified as internal BGP (iBGP), regardless of the IP addressing scheme used.

Answer

This is an eBGP session because the neighbor IP is in a different subnet.

Answer

The router will automatically set next-hop-self for routes sent to this neighbor.

Answer

The configuration is invalid because iBGP requires a loopback interface.