350-401 Mock Exam 77 — 25 Questions

Question 1

A network engineer runs the following command on switch SW4:

SW4# show cts environment-data

CTS Environment Data:

Device ID: SW4.cisco.com
Device Name: SW4
CTS Capabilities: SGT, SXP, CTSD, CTSA
SGT: 100
SXP Node: Enabled
SXP Connection: 10.1.1.1:64999

Based on this output, what can be concluded?

Accepted Answer

The switch has an SXP connection to a peer at 10.1.1.1.. The output shows 'SXP Connection: 10.1.1.1:64999', which directly indicates that the switch has an active SXP (Security Exchange Protocol) connection to a peer at IP address 10.1.1.1. SXP is used to propagate Security Group Tags (SGTs) between Cisco TrustSec devices, and the presence of this line confirms the connection is established.

Answer

The switch is using 802.1X for authentication.

Answer

The switch's SGT is 10.

Answer

The switch is not capable of SGT assignment.

Question 2

Examine the following configuration snippet:

interface GigabitEthernet1/0/2
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

Which statement about this configuration is true?

Accepted Answer

802.1X will be attempted first; if the client does not respond, MAB will be used as a fallback.. The configuration sets the switchport as an 802.1X authenticator (dot1x pae authenticator) with MAB enabled. By default, 802.1X is attempted first; if the client does not respond to EAPOL requests (e.g., due to lack of 802.1X supplicant), the switch falls back to MAB, which uses the source MAC address for authentication. The dot1x timeout tx-period 10 sets the interval for retransmitting EAPOL-Start frames, reinforcing the initial 802.1X attempt before fallback.

Answer

MAB will be attempted first, and if it fails, 802.1X will be used.

Answer

The port will be placed in a guest VLAN if both 802.1X and MAB fail.

Answer

The switch will act as a supplicant for MAB and an authenticator for 802.1X.

Question 3

An enterprise is deploying QoS across a network that includes both Cisco and non-Cisco devices. The engineer wants to use a marking scheme that is end-to-end and not stripped at Layer 3 boundaries. Which marking field should the engineer use?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct choice because it is defined in RFC 2474 as a Layer 3 marking field in the IP header. Unlike CoS (Layer 2) or MPLS EXP (which is stripped at MPLS boundaries), DSCP markings are preserved across Layer 3 boundaries (routers) and can be used end-to-end across both Cisco and non-Cisco devices, as long as the intermediate devices trust the DSCP value.

Answer

CoS

Answer

IP Precedence

Answer

MPLS EXP

Question 4

Drag and drop each DSCP value on the left to its matching Per-Hop Behavior (PHB) on the right.

Accepted Answer

DSCP 46: EF. DSCP 46 maps to EF (Expedited Forwarding), DSCP 10 maps to AF11 (Assured Forwarding class 1 low drop), DSCP 18 maps to AF21 (Assured Forwarding class 2 low drop), DSCP 26 maps to AF31 (Assured Forwarding class 3 low drop), DSCP 34 maps to AF41 (Assured Forwarding class 4 low drop).

Question 5

A large enterprise uses Cisco SD-WAN with multiple transport clouds (MPLS and Internet). The network team wants to ensure that voice traffic between two branch offices always uses the MPLS link, even if the Internet link has lower latency. The engineer creates a centralized data policy on the vSmart to match voice traffic based on DSCP EF and sets the preferred color to 'mpls'. After applying the policy, the engineer tests and finds that voice traffic is still using the Internet link. The vEdge routers show that the policy is received and active. What is the most likely reason for this failure?

Accepted Answer

The policy does not include a match condition for the correct VPN or site list.. A centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.

Answer

The vEdge routers have not rebooted after the policy was applied.

Answer

The data policy was applied on the vEdge instead of the vSmart.

Answer

The DSCP EF marking is not supported in SD-WAN data policies.

Question 6

An enterprise network uses 802.1X for wired access. The authentication server is a Cisco ISE. Recently, some Windows 10 clients fail to authenticate, while others succeed. The engineer checks the switch configuration and finds 'authentication port-control auto' and 'dot1x pae authenticator' are configured. The failing clients show 'EAP failure' in the logs. The engineer suspects a mismatch in EAP method. Which EAP method is most likely causing the issue if the ISE is configured to require EAP-TLS but the Windows clients are configured for PEAP-MSCHAPv2?

Accepted Answer

EAP-TLS requires a client certificate, which the Windows clients do not have.. EAP-TLS requires a client-side certificate for authentication. If the ISE is configured to require EAP-TLS but the Windows 10 clients are configured for PEAP-MSCHAPv2, the clients will not present a certificate, causing the ISE to send an EAP failure. This mismatch in EAP method explains why only clients without the proper certificate configuration fail.

Answer

EAP-FAST requires a PAC file that the Windows clients do not have.

Answer

LEAP uses a shared secret that is not configured on the clients.

Answer

EAP-MD5 does not support mutual authentication, causing the failure.

Question 7

A network engineer is troubleshooting an Ansible playbook that uses the ios_config module to apply ACLs. The playbook runs without errors, but the ACLs are not applied to the device. The engineer verifies that the device is reachable and the credentials are correct. What is the most likely cause?

Accepted Answer

The playbook is missing the connection parameter set to 'network_cli'. The ios_config module requires the connection parameter to be set to 'network_cli' (or 'ansible.netcommon.network_cli') to use the CLI transport for sending configuration commands to network devices. Without this, Ansible defaults to the 'smart' connection, which may not properly interact with network device CLIs, causing the playbook to run without errors but not apply the ACLs.

Answer

The device is in a different VRF and not reachable

Answer

The ACL syntax in the playbook is incorrect

Answer

The ios_config module requires the netmiko library to be installed on the control node

Question 8

An engineer is configuring a new VLAN 100 on a switch. Which command must be used to create the VLAN?

Accepted Answer

vlan 100. The correct command to create a new VLAN on a Cisco IOS switch is 'vlan 100' entered in global configuration mode. This command creates VLAN 100 and enters VLAN configuration mode, allowing you to assign a name or other parameters. The other options either apply an existing VLAN to an interface, use a deprecated method, or create a switched virtual interface (SVI) for Layer 3 routing, none of which actually create the VLAN itself.

Answer

switchport access vlan 100

Answer

vlan database

Answer

interface vlan 100

Question 9

A network engineer is deploying a new virtualized application on a VMware vSphere cluster. The application requires dedicated CPU cores to meet licensing requirements, and the engineer must ensure that no other virtual machine can use those cores. The cluster uses VMware ESXi 7.0. Which configuration should the engineer apply to the virtual machine?

Accepted Answer

Configure CPU affinity to pin the VM to specific physical cores.. CPU affinity (option A) is the correct configuration because it explicitly binds a virtual machine's vCPUs to specific physical cores, ensuring that no other VM can use those cores. This meets the licensing requirement for dedicated CPU cores by preventing co-scheduling or sharing of those physical cores with other workloads, which CPU reservation alone does not guarantee.

Answer

Set a CPU reservation equal to the number of vCPUs.

Answer

Enable NUMA node affinity for the VM.

Answer

Configure a CPU limit equal to the number of vCPUs.

Question 10

A network engineer is troubleshooting a connectivity issue between two VLANs on a Cisco Catalyst 3850 switch. The switch has an ACL applied to VLAN 10 that permits traffic from VLAN 20 to VLAN 10, but denies all other traffic. Hosts in VLAN 20 can ping hosts in VLAN 10, but not vice versa. The engineer checks the ACL and finds that it is applied inbound on VLAN 10. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 10, so it only filters traffic entering VLAN 10, not traffic leaving VLAN 10.. The ACL is applied inbound on VLAN 10, meaning it filters traffic as it enters the VLAN 10 interface (the SVI). Traffic from VLAN 20 to VLAN 10 is permitted, so pings from VLAN 20 succeed. However, when hosts in VLAN 10 try to ping hosts in VLAN 20, the ICMP echo request leaves VLAN 10 (outbound) and is not inspected by the inbound ACL; the return ICMP echo reply from VLAN 20 enters VLAN 10 inbound and is permitted by the ACL. The issue is that the ACL does not filter traffic leaving VLAN 10, so the problem is not with the ACL blocking replies but with the fact that the ACL is applied inbound and thus does not control traffic sourced from VLAN 10.

Answer

The ACL is applied outbound on VLAN 10, so it filters traffic leaving VLAN 10, preventing replies.

Answer

The ACL is applied to the SVI for VLAN 10, but the hosts are in VLAN 10, so the ACL does not apply.

Answer

The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.

Question 11

A network engineer runs the following command on Switch SW3:

SW3# show etherchannel summary

Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel is using LACP protocol.. The output shows the EtherChannel is using LACP as the protocol, as indicated in the 'Protocol' column. The 'SU' flags on Po1 mean the port-channel is Layer 2 (S) and in use (U), confirming it is active. Therefore, option B is correct because LACP is explicitly listed as the protocol for this EtherChannel.

Answer

All three ports are actively participating in the EtherChannel.

Answer

The EtherChannel is a Layer 3 port-channel.

Answer

Port Gi0/3 is in standby mode.

Question 12

A network engineer writes the following Python script using the Requests library to retrieve interface information from a Cisco IOS-XE device via RESTCONF:

```python
import requests
import json

url = "https://10.1.1.1:443/restconf/data/ietf-interfaces:interfaces"
headers = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json"
}
auth = ("admin", "password")
response = requests.get(url, headers=headers, auth=auth, verify=False)
print(response.json())
```

What is the primary issue with this code?

Accepted Answer

The 'Content-Type' header is misspelled as 'Contet-Type', which will cause the server to reject the request.. The primary issue is a typo in the 'Content-Type' header: it is written as 'Contet-Type'. RESTCONF requires the correct header to indicate the YANG data format. This misspelling will cause the server to reject the request with a 400 Bad Request error because it does not recognize the media type. The code is otherwise correct for RESTCONF access.

Answer

The URL uses HTTPS but the device only supports HTTP, causing a connection error.

Answer

The 'verify=False' parameter is not valid for the requests library; it should be 'ssl_verify=False'.

Answer

The 'auth' tuple should be passed as a dictionary with 'username' and 'password' keys.

Question 13

A network engineer runs the following command on Router R6:

R6# show ip route vrf CUSTOMER-D

VRF CUSTOMER-D:
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.400
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.400
      192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask
B        192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00

R6# show ip bgp vpnv4 vrf CUSTOMER-D

BGP table version is 5, local router ID is 10.0.0.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24   10.0.0.2                 0    100      0 i

Based on this output, what can be concluded?

Accepted Answer

The route 192.168.1.0/24 is installed in the VRF routing table from BGP. The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Answer

The route 192.168.1.0/24 is learned via OSPF

Answer

The next-hop 10.0.0.2 is not reachable

Answer

VRF CUSTOMER-D has no directly connected networks

Question 14

Drag and drop each DNA Center Intent API on the left to its matching use on the right.

Accepted Answer

inventory: Retrieves detailed device information including serial numbers and software versions. Intent APIs: inventory retrieves device details; topology maps network connections; issues identifies network problems; events provides real-time notifications.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip eigrp topology
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.1.1)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.1.1.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
P 10.2.2.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0
P 10.3.3.0/24, 1 successors, FD is 1310720
        via 192.168.1.2 (1310720/1310720), GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

Each route has exactly one successor and no feasible successor.. The output shows each route with a code 'P' (Passive) and exactly one successor, with no feasible successor listed. In EIGRP, a feasible successor is only present if there is a backup route that satisfies the feasibility condition (reported distance < feasible distance). Since only one next-hop is shown per route and no additional entries exist, there is no feasible successor. Option C correctly identifies this.

Answer

All routes have a feasible successor.

Answer

The routes are in Active state, meaning the router is querying for alternate paths.

Answer

The router is using EIGRP stub routing.

Question 16

A network engineer uses the following Python code to subscribe to telemetry data from a Cisco IOS-XE device via NETCONF using the YANG module 'Cisco-IOS-XE-mdt-oper': ```python from ncclient import manager m = manager.connect( host='192.168.1.1', port=830, username='admin', password='cisco', hostkey_verify=False ) # Create a telemetry subscription subscription = '''

400

yang-push encode-kvgpb 5000 /interfaces/interface/state/counters

10.1.1.100

50051 grpc-tcp

''' reply = m.edit_config(target='running', config=subscription) print(reply.xml) m.close_session() ``` What is the issue with this code?

Accepted Answer

The code uses target='running' which may not be writable; it should use target='candidate' and then commit.. The NETCONF edit-config operation with target='running' is used to directly modify the running configuration. However, on many Cisco IOS-XE devices, the running configuration is not directly writable via NETCONF; you must use target='candidate' and then commit. Additionally, the XML namespace for mdt-config-data may be incorrect; the correct namespace is 'http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-cfg' but the module name is 'Cisco-IOS-XE-mdt-cfg'. However, the primary issue is that the code uses target='running' instead of target='candidate' and a separate commit operation.

Answer

The XML namespace is incorrect; it should be 'http://cisco.com/ns/yang/Cisco-IOS-XE-mdt-oper'.

Answer

The xpath is invalid; it should be '/interfaces/interface/state/counters'.

Answer

The subscription-id should be a string, not an integer.

Question 17

Examine the following configuration:

flow record REC-1
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect interface input
 collect interface output
 collect counter bytes
 collect counter packets
!
flow monitor MON-1
 record REC-1
 exporter EXPORTER-1
!
interface GigabitEthernet0/1
 ip flow monitor MON-1 input
!

What is the purpose of this configuration?

Accepted Answer

It collects NetFlow data for incoming traffic, including source/destination IP, protocol, and byte/packet counts.. The configuration defines a Flexible NetFlow record (REC-1) that matches IPv4 source/destination addresses and protocol, and collects interface input/output along with byte and packet counters. The flow monitor MON-1 applies this record to incoming traffic only (ip flow monitor MON-1 input), so it collects NetFlow data exclusively for inbound packets on GigabitEthernet0/1.

Answer

It collects NetFlow data for both incoming and outgoing traffic on the interface.

Answer

It configures Flexible NetFlow with a user-defined record that includes TCP flags.

Answer

It sends flow data to the exporter using IPFIX format.

Question 18

An engineer is configuring multicast on a Cisco router. The router receives multicast traffic from a source on interface GigabitEthernet0/0 and needs to forward it to receivers on interface GigabitEthernet0/1. The engineer enables PIM sparse mode on both interfaces and configures a static RP. However, the router does not create a multicast routing entry for the (S,G) pair. What is the most likely missing configuration?

Accepted Answer

The global command 'ip multicast-routing' is not configured.. The most likely missing configuration is the global command 'ip multicast-routing'. Without this command, the router cannot enable multicast forwarding or build multicast routing tables, regardless of PIM configuration on interfaces or static RP definition. PIM sparse mode and RP configuration are dependent on multicast routing being globally enabled first.

Answer

The interface GigabitEthernet0/0 is not configured with an IP address.

Answer

The RP address is not reachable from the router.

Answer

The router is not configured as a candidate RP.

Question 19

Which four statements about multicast group addresses and Layer 2 mapping are true? (Choose four.)

Accepted Answer

The multicast MAC address is derived by placing the lower 23 bits of the multicast IP address into the OUI 01-00-5E.. Multicast IP addresses in the 224.0.0.0/4 range map to Layer 2 MAC addresses using the OUI 01-00-5E. The lower 23 bits of the IP address are placed into the last three bytes of the MAC address, with the 24th bit set to 0. This mapping is not unique, so multiple IP addresses can map to the same MAC (e.g., 224.0.0.1 maps to 01-00-5E-00-00-01, and 224.128.0.1 also maps to the same MAC). Statement A is correct because it describes the derivation. Statement B is correct because of the 23-bit mapping. Statement C is correct: 224.0.0.1 maps to 01-00-5E-00-00-01. Statement D is false because 224.0.0.0/24 is the local network control block used for link-local communication and is not routable across the internet. Statement E is correct: 01-00-5E-00-00-05 corresponds to 224.0.0.5 since the low 23 bits (0.0.5) match.

Answer

The multicast IP address range 224.0.0.0/24 is reserved for global scope and can be routed across the internet.

Question 20

A network engineer runs the following command on Router R7:

R7# show ip sla monitor statistics 6

Round Trip Time (RTT) for Index 6
Latest RTT: NoConnection/Busy/Timeout
Latest Operation Start Time: 18:00:00.000 UTC Mon Mar 1 2021
Latest Operation Return Code: Timeout
Number of successes: 0
Number of failures: 15
Over thresholds: 0

Based on this output, what is the status of the IP SLA operation?

Accepted Answer

The target is unreachable, as all probes have timed out.. The output shows 15 failures with a 'Timeout' return code and no successes, indicating that every probe sent has timed out. In IP SLA, a 'NoConnection/Busy/Timeout' RTT and a 'Timeout' return code mean the target is not responding to the probe, confirming unreachability. Option C correctly states the target is unreachable because all probes have failed.

Answer

The operation is functioning normally with occasional timeouts.

Answer

The target is reachable but with high latency.

Answer

The operation has been configured but not started.