350-401 Mock Exam 75 — 25 Questions

Question 1

Drag and drop each security protocol on the left to its matching provided security service on the right.

Accepted Answer

ESP: Confidentiality and data integrity. ESP provides confidentiality, data integrity, and optional anti-replay; AH provides data integrity and authentication but no encryption; ESP with null encryption provides integrity only; combined ESP+AH provides both confidentiality and integrity; anti-replay is a service provided by both ESP and AH.

Question 2

Drag and drop each cisco.ios module on the left to its matching purpose on the right.

Accepted Answer

ios_config: Pushes configuration commands to Cisco IOS devices. ios_config pushes configuration commands; ios_command executes show commands; ios_facts gathers device facts; ios_vlans manages VLAN configuration; ios_l3_interfaces configures Layer 3 interfaces.

Question 3

Drag and drop each REST HTTP status code on the left to its matching meaning on the right.

Accepted Answer

200: Request succeeded and response body contains data. 200 OK indicates success, 201 Created indicates resource creation, 400 Bad Request indicates client error, 401 Unauthorized indicates authentication failure, 404 Not Found indicates missing resource, and 500 Internal Server Error indicates server failure.

Question 4

Which three statements about Cisco TrustSec (CTS) are true? (Choose three.)

Accepted Answer

Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity.. Cisco TrustSec uses SGTs for role-based access control, can use 802.1X for initial authentication, and supports dynamic SGT assignment via RADIUS. SGTs are not IP-based but are 16-bit tags. CTS does not replace all ACLs but augments them with SGT-based policies.

Answer

SGTs are typically assigned to IP addresses using a centralized SGT mapping database.

Answer

Cisco TrustSec eliminates the need for all traditional ACLs in the network.

Question 5

Which two statements about using Python for network automation are true? (Choose two.)

Accepted Answer

The netmiko library is commonly used to automate SSH connections to Cisco devices.. Correct answers: A and C. A is correct because the netmiko library simplifies SSH connections to network devices and is widely used for sending commands. C is correct because the requests library can be used to interact with REST APIs on devices like Cisco DNA Center or IOS-XE. B is incorrect because paramiko is a low-level SSH library, not a high-level one; netmiko is built on paramiko but adds higher-level abstractions. D is incorrect because the telnetlib library is for Telnet, which is insecure and rarely used in modern automation. E is incorrect because the scapy library is for packet manipulation and network scanning, not for sending configuration commands.

Answer

The paramiko library provides a high-level API for network automation tasks.

Answer

The telnetlib library is recommended for secure network automation.

Answer

The scapy library is used to send configuration commands to network devices.

Question 6

Which two statements about using Python for network automation with Cisco devices are true? (Choose two.)

Accepted Answer

Netmiko is a Python library that simplifies SSH connections to network devices by handling authentication and session establishment.. The correct answers highlight key aspects of Python automation: Netmiko simplifies SSH management by handling authentication and connection, and NAPALM provides a vendor-agnostic API for retrieving operational data. The incorrect options misrepresent Python's role: Python does not compile to native machine code (it is interpreted), netmiko is not limited to Cisco (it supports many vendors), and paramiko is lower-level than Netmiko, not the other way around.

Answer

Python scripts for network automation are compiled into native machine code for faster execution.

Answer

The netmiko library can only be used with Cisco IOS devices.

Answer

Paramiko is a higher-level library than Netmiko and provides additional automation features.

Question 7

Which two statements about Cisco TrustSec security group tags (SGTs) are true? (Choose two.)

Accepted Answer

Security group tags are 16-bit values used to identify groups of users or devices.. SGTs are 16-bit values used to classify traffic for policy enforcement, and they can be propagated via SXP or inline tagging. Option A is correct because SGTs are indeed 16-bit. Option D is correct because SXP is a common method for SGT propagation without hardware modification. Option B is incorrect because SGTs are not VLAN IDs (VLANs use 12-bit IDs). Option C is incorrect because SGTs are not assigned by RADIUS during 802.1X authentication (that is for dACLs or VLAN assignment). Option E is incorrect because SGTs are not used for encryption; they are for policy enforcement.

Answer

Security group tags are equivalent to VLAN IDs and are used for Layer 2 segmentation.

Answer

Security group tags are assigned to endpoints by the RADIUS server during 802.1X authentication.

Answer

Security group tags are used to encrypt traffic between endpoints in the same group.

Question 8

Drag and drop each Ansible task return value on the left to its matching meaning on the right.

Accepted Answer

changed: The task made a modification to the managed node. changed means the task modified the system; ok means the task ran without changes; failed means the task encountered an error; skipped means the task was not executed due to a condition; unreachable means the host could not be contacted.

Question 9

Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.

Accepted Answer

Spoke sends IKEv2 auth request to hub. In FlexVPN, a spoke sends an IKEv2 authentication request to the hub. The hub authenticates the spoke and sends back the IKEv2 configuration payload with the remote spoke's address. The originating spoke then initiates a direct IKEv2 session to the remote spoke. Both spokes complete IKEv2 authentication and IPsec SA setup. Finally, traffic flows directly between the spokes without going through the hub.

Question 10

Drag and drop each authentication mode on the left to its matching behavior on the right.

Accepted Answer

Open: Allows traffic before authentication completes. Open mode allows traffic before authentication, closed mode blocks until success, monitor mode logs but does not enforce.

Question 11

Which three statements about Cisco TrustSec SGT propagation and enforcement are true? (Choose three.)

Accepted Answer

SGTs can be propagated between network devices using the SXP protocol over a TCP connection.. SGTs can be propagated via SXP (a TCP-based protocol) or inline tagging. SXP uses a TCP connection to exchange SGT-to-IP mappings. Inline tagging inserts the SGT into the Ethernet frame. The enforcement device (e.g., a firewall or switch) uses the SGT to apply policy, not to rewrite the tag. SGTs are not used for routing decisions.

Answer

The enforcement device uses the SGT to make forwarding decisions based on the destination IP address.

Answer

When a packet traverses a TrustSec domain, the SGT can be rewritten by intermediate devices.

Question 12

Drag and drop the steps of ISE profiling-based dynamic ACL assignment into the correct order, from first to last.

Accepted Answer

Endpoint connects; switch sends RADIUS accounting start. ISE profiling identifies the device type via DHCP/HTTP probes, matches it to a profile, then ISE downloads a dynamic ACL to the switch, which applies it to the port, and finally the switch enforces the ACL on traffic from that endpoint.

Question 13

Which two statements about using Python for configuration management and templating in network automation are true? (Choose two.)

Accepted Answer

Jinja2 templates allow the use of variables and control structures like loops and conditionals to generate network device configurations.. The correct answers focus on Jinja2 templating and its integration with Python. The incorrect options either misstate Jinja2's capabilities (it does not execute commands), misidentify the library for YAML parsing (PyYAML, not Jinja2), or incorrectly claim that Python cannot be used for configuration generation (it can, via templates).

Answer

Jinja2 can be used to execute CLI commands on network devices directly from within the template.

Answer

Jinja2 is a Python library used for parsing YAML files.

Answer

Python cannot be used to generate configuration files because it lacks templating capabilities.

Question 14

Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.

Accepted Answer

Import threading and ConnectHandler from netmiko. The workflow begins by importing necessary modules (threading and Netmiko), then defining a function that connects and sends a show command. After that, a list of devices is created, threads are started for each device, and finally all threads are joined to collect results.

Question 15

Drag and drop each Python library on the left to its matching network use case on the right.

Accepted Answer

Netmiko: Multi-vendor SSH connection and command execution. Netmiko is used for multi-vendor SSH connections, NAPALM for network automation and configuration management, Nornir for parallel task execution, Scrapli for screen-scraping network devices, and Paramiko for low-level SSH connections.

Question 16

Which two statements about REST API HTTP methods are true? (Choose two.)

Accepted Answer

GET requests are idempotent and safe.. In REST APIs, the GET method is used to retrieve a representation of a resource without side effects (idempotent and safe). The PUT method is used to update or create a resource at a specific URI and is idempotent, meaning multiple identical requests have the same effect as a single request. POST is not idempotent; it is typically used to create a new resource at a server-defined URI. DELETE is idempotent but not safe. PATCH is used for partial updates and is not necessarily idempotent.

Answer

POST requests are idempotent and safe.

Answer

DELETE requests are safe.

Answer

PATCH requests are always idempotent.

Question 17

Which three statements about configuring model-driven telemetry on Cisco IOS-XE devices are true? (Choose three.)

Accepted Answer

The 'telemetry' command enters the telemetry configuration submode, where subscriptions and sensor groups are defined.. On IOS-XE, telemetry is configured under the 'telemetry' submode. A subscription defines the destination (e.g., IP, port, protocol) and the sensor paths (YANG paths). Multiple sensor groups can be associated with one subscription. The 'update-policy' command sets the periodic interval. The 'receiver' command specifies the collector details. TLS is supported for secure dial-out connections.

Answer

The 'update-policy' command is used to set the on-change trigger for a subscription.

Answer

A single subscription can only have one sensor group and one receiver.

Question 18

Which three statements about HTTP response status codes in REST APIs are true? (Choose three.)

Accepted Answer

200 OK is used to indicate a successful GET request.. The correct answers are A, B, and D. A is correct because 200 OK is the standard success response for GET. B is correct because 201 Created is used for successful resource creation via POST. D is correct because 400 Bad Request indicates a client error such as malformed syntax. C is incorrect because 404 Not Found indicates the resource does not exist, not a server error. E is incorrect because 500 Internal Server Error is a server-side error, not a client error.

Answer

404 Not Found indicates a server-side error.

Answer

500 Internal Server Error is a client error.

Question 19

Drag and drop the steps of DNA Center site hierarchy creation into the correct order, from first to last.

Accepted Answer

Create a top-level site (e.g., continent). The correct order starts with defining the top-level site (e.g., continent or country), then adds the area, then the building, then the floor, and finally assigns the floor plan. This hierarchical structure is required for proper network segmentation and assurance in Cisco DNA Center.

Question 20

What is the maximum number of active member links supported in a single EtherChannel on Cisco Catalyst switches?

Accepted Answer

8. Cisco Catalyst switches support a maximum of 8 active member links in a single EtherChannel. This limit is defined by the IEEE 802.3ad standard and Cisco's implementation, ensuring that the load-balancing algorithm distributes traffic effectively across all links. The 8-link limit applies to both PAgP and LACP modes.

Answer

4

Answer

16

Answer

32