350-401 Mock Exam 79 — 25 Questions

Question 1

Consider the following EIGRP configuration:

router eigrp 100
 metric weights 0 1 0 1 0 0

What does this configuration accomplish?

Accepted Answer

It sets the EIGRP metric to use bandwidth and delay only, which is the default behavior.. The `metric weights` command in EIGRP allows you to modify the K values used in the composite metric calculation. The default K values are K1=1, K2=0, K3=1, K4=0, K5=0, which means only bandwidth (K1) and delay (K3) are used. The configuration `metric weights 0 1 0 1 0 0` explicitly sets K1=1, K2=0, K3=1, K4=0, K5=0, which matches the default behavior. Therefore, option A is correct.

Answer

It disables the use of bandwidth in the metric calculation.

Answer

It enables the use of load and reliability in the metric calculation.

Answer

It changes the metric to use only delay.

Question 2

Given the following configuration on a Cisco IOS switch:

interface GigabitEthernet0/4
 switchport mode trunk
 switchport trunk allowed vlan except 100-200

What is the effect of this configuration?

Accepted Answer

The trunk will forward traffic for all VLANs except VLANs 100 through 200.. The 'switchport trunk allowed vlan except 100-200' command explicitly removes VLANs 100 through 200 from the allowed VLAN list on the trunk. All other VLANs (1-99 and 201-4094) remain permitted. This is the standard behavior of the 'except' keyword in Cisco IOS trunk configuration.

Answer

The trunk will only forward traffic for VLANs 100 through 200.

Answer

The trunk will forward traffic for all VLANs.

Answer

The trunk will not forward any traffic because the allowed list is empty.

Question 3

Given the following Ansible playbook snippet:
---
- name: Configure SNMP
  hosts: routers
  gather_facts: no
  tasks:
    - name: SNMP community
      ios_config:
        lines:
          - snmp-server community public RO
What is the result of this playbook?

Accepted Answer

It configures an SNMP community string 'public' with read-only access.. The ios_config module pushes the line 'snmp-server community public RO' into the device's running configuration. On Cisco IOS, 'RO' is the valid abbreviation for read-only when defining an SNMP community string, so the playbook successfully creates a read-only community named 'public'. The playbook does not gather facts and does not specify a 'save_when' parameter, so it modifies the running config only.

Answer

It fails because 'RO' is not a valid keyword; it should be 'read-only'.

Answer

It configures the community string only for SNMPv3.

Answer

It removes any existing SNMP community strings.

Question 4

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module:

```yaml
---
- name: Configure interface
  hosts: cisco-routers
  gather_facts: no
  tasks:
    - name: Set interface description
      cisco.ios.ios_interfaces:
        config:
          - name: GigabitEthernet0/1
            description: "Uplink to Core"
            enabled: true
        state: replaced
```

What is the result of running this playbook?

Accepted Answer

The interface will be configured with only the description and enabled state, removing any other existing configuration.. The cisco.ios.ios_interfaces module with state: replaced enforces the exact declared configuration on the interface, meaning any parameters not specified in the task are reset to their defaults. Since only 'description' and 'enabled' are declared, all other existing interface settings (such as IP addressing, MTU, speed, duplex, or other L2/L3 attributes) are removed or reverted. This is the defining behavior of 'replaced' versus 'merged' in declarative Ansible network modules.

Answer

The interface will have the description set and all other parameters remain unchanged.

Answer

The playbook will fail because 'enabled' is not a valid parameter for ios_interfaces.

Answer

The playbook will fail because 'state: replaced' requires a 'before' and 'after' state.

Question 5

Which three statements about QoS trust boundaries and marking are true? (Choose three.)

Accepted Answer

The 'mls qos trust cos' command configures the switch to trust the CoS marking on incoming packets.. The trust boundary defines where the device trusts or re-marks QoS markings. Typically, the boundary is at the access layer switch. The 'mls qos trust' command sets trust. By default, Cisco switches do not trust CoS or DSCP; they must be configured. Trust can be extended to IP phones via CDP. Marking can be done at Layer 2 (CoS) or Layer 3 (DSCP).

Answer

By default, Cisco Catalyst switches trust the CoS value received from connected devices.

Answer

Marking at Layer 2 uses DSCP values in the IP header.

Question 6

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Accepted Answer

Customer edge (CE) routers exchange routing information with provider edge (PE) routers using static routing, RIP, OSPF, EIGRP, or BGP.. Option A is correct because the CE-PE routing relationship is a standard routing adjacency in which the CE router can run static routing, RIP, OSPF, EIGRP, or BGP with the PE router; the PE router then redistributes those routes into the appropriate VRF. Option B is correct because VRF instances on PE routers create separate routing and forwarding tables per VPN customer, which keeps overlapping customer address space isolated. Option C is correct because PE routers use MP-BGP to exchange VPNv4 prefixes, and each VPNv4 route carries a route distinguisher (RD) to make the prefix unique plus route targets (RTs) to control import/export into VRFs. Option D is not correct because P routers in the MPLS core only switch labeled packets and do not maintain customer VPN routing tables; VPN awareness resides at the PE routers. Option E is not correct because route targets are extended BGP community attributes used to control VPN route import and export between VRFs, not to uniquely identify a customer VPN; that uniqueness function is performed by the route distinguisher (RD).

Answer

The MPLS core routers (P routers) maintain full VPN routing tables to forward traffic based on customer IP prefixes.

Answer

Route targets (RT) are used to uniquely identify each customer VPN across the provider network.

Question 7

A network engineer is using the Cisco Meraki REST API to update the SSID settings for a wireless network. The engineer sends a PUT request to 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids/{ssidNumber}' with a JSON payload containing the new settings. The API returns a 429 Too Many Requests error. What should the engineer do to resolve this issue?

Accepted Answer

Implement exponential backoff and retry the request after a delay.. A 429 error indicates rate limiting; the API has received too many requests from the client within a given time frame. The engineer should implement exponential backoff and retry logic, or reduce the request rate.

Answer

Change the HTTP method to POST because PUT is not supported for this endpoint.

Answer

Add an 'X-Cisco-Meraki-API-Key' header with a higher rate limit key.

Answer

Use a different API endpoint, such as 'https://api.meraki.com/api/v1/organizations/{orgId}/ssids'.

Question 8

Given the following configuration snippet on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

All traffic entering and leaving GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.. The configuration uses a local SPAN session to copy traffic from a source interface (GigabitEthernet1/0/1) to a destination interface (GigabitEthernet1/0/2). The keyword 'both' specifies that both ingress and egress traffic on the source port are mirrored, so all traffic entering and leaving GigabitEthernet1/0/1 is sent to the destination port for monitoring.

Answer

Only traffic entering GigabitEthernet1/0/1 is copied to GigabitEthernet1/0/2.

Answer

Traffic on GigabitEthernet1/0/2 is replicated to GigabitEthernet1/0/1.

Answer

The configuration is invalid because the destination port must be in trunk mode.

Question 9

Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?

Accepted Answer

It uses streaming telemetry to collect data for real-time analytics.. Option A is correct because Cisco DNA Center Assurance relies on streaming telemetry (model-driven telemetry pushed from devices) rather than legacy SNMP polling, enabling near real-time analytics and faster issue detection. Option E is correct because Assurance applies machine learning and baseline analytics to historical data, allowing it to proactively identify trends and predict potential problems before they impact users. Option B is incorrect because Assurance covers both wired and wireless networks, including wireless client onboarding and RF health monitoring. Option C is incorrect because DNA Center is typically deployed as an on-premises appliance (with cloud-managed options like DNA Center in the cloud, but not exclusively cloud-based). Option D is incorrect because Assurance provides far more than health scores, including path trace, client 360 views, and network topology analysis.

Answer

It supports only wired networks and not wireless.

Answer

It is a fully cloud-based solution with no on-premises components.

Answer

It only displays network device health scores and does not provide path tracing.

Question 10

Examine the following telemetry configuration on a Cisco IOS-XE device:

telemetry ietf subscription 200
 encoding encode-kvgpb
 filter xpath /interfaces/interface[name='GigabitEthernet0/0/0']/state
 stream yang-push
 update-policy on-change
 receiver ip address 192.168.1.100 50001 protocol grpc

Which statement is true about this configuration?

Accepted Answer

Data is pushed only when a change occurs in the state of GigabitEthernet0/0/0.. This subscription uses on-change update policy, so data is pushed only when a change occurs in the specified subtree.

Answer

Data is pushed every 200 seconds to the collector.

Answer

The subscription uses JSON encoding.

Answer

The filter selects all interfaces, not just GigabitEthernet0/0/0.

Question 11

A network architect is designing a campus network for a large university with 10,000+ users. The design must provide high availability, minimize failure domains, and allow for easy scaling of the access layer. The core layer should be resilient and support fast convergence. Which hierarchical design model best meets these requirements?

Accepted Answer

Three-tier hierarchical design with access, distribution, and core layers, using redundant links and VRRP for gateway redundancy. The three-tier hierarchical design (access, distribution, core) is the correct choice because it provides clear separation of failure domains, allows easy scaling by adding access switches, and supports high availability through redundant links and VRRP (or HSRP/GLBP) for first-hop gateway redundancy. The core layer can be designed with fast-converging protocols like ECMP and BFD to meet the resilience and convergence requirements for a large campus with 10,000+ users.

Answer

Collapsed core design with core and distribution combined into one layer

Answer

Flat Layer 2 design with all switches in a single VLAN

Answer

Leaf-spine design with all switches acting as leafs and spines

Question 12

Which two statements about MPLS VPN (Layer 3 VPN) are true? (Choose two.)

Accepted Answer

PE routers maintain separate VRF tables for each VPN customer.. Option A is correct because in an MPLS Layer 3 VPN, each PE router instantiates a separate VRF (Virtual Routing and Forwarding) table per customer VPN, which keeps customer routes isolated and allows overlapping address spaces. Option C is correct because PE routers use MP-BGP (Multiprotocol BGP, specifically the VPNv4 address family) to exchange customer routes with the appropriate route targets and VPN labels. Option B is wrong because P routers only need to forward labeled packets based on the outer IGP/LDP label and do not hold per-VPN customer routing tables. Option D is wrong because CE routers are typically plain IP routers that do not run MPLS or exchange labels with the PE. Option E is wrong because the inner VPN label is used by the egress PE (not the P routers) to identify the customer VRF; P routers forward based on the outer transport label.

Answer

P routers must maintain a full routing table for each VPN customer.

Answer

CE routers run MPLS and participate in label distribution with the PE.

Answer

The VPN label is used by P routers to forward traffic across the MPLS core.

Question 13

Consider the following configuration snippet from a Cisco IOS-XE router:

router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of the passive-interface commands?

Accepted Answer

EIGRP hellos are suppressed on all interfaces except GigabitEthernet0/0.. The command 'passive-interface default' sets all interfaces to passive mode, meaning EIGRP hello packets are suppressed on all interfaces. The subsequent 'no passive-interface GigabitEthernet0/0' re-enables EIGRP hellos on that specific interface. Therefore, EIGRP hellos are sent only on GigabitEthernet0/0 and suppressed on all other interfaces. This is a common configuration to prevent EIGRP from forming adjacencies on unwanted interfaces.

Answer

EIGRP hellos are sent on all interfaces, but updates are blocked.

Answer

EIGRP adjacency is formed on all interfaces except GigabitEthernet0/0.

Answer

EIGRP is disabled on all interfaces.

Question 14

Which two statements about IP Source Guard are true? (Choose two.)

Accepted Answer

IP Source Guard uses the DHCP snooping binding table to validate the source IP address of packets received on a port.. Option A is correct because IP Source Guard (IPSG) relies on the DHCP snooping binding table (and optionally static IP source bindings) to check that the source IP address of frames arriving on an untrusted port matches an entry, dropping spoofed traffic. Option B is correct because IPSG is often deployed together with port security: port security validates source MAC addresses while IPSG validates source IP addresses, giving combined Layer 2/Layer 3 source filtering. Option C is wrong because IPSG also supports manually configured static IP source bindings via the 'ip source binding' command, so it is not limited to DHCP-assigned addresses. Option D is wrong because IPSG inspects the source IP address (and source MAC), not the destination MAC address. Option E is wrong because IPSG does not require 802.1X; it depends on DHCP snooping or static bindings, and 802.1X is an independent access-control feature.

Answer

IP Source Guard only works with DHCP-assigned IP addresses, not static IP addresses.

Answer

IP Source Guard filters traffic based on the destination MAC address.

Answer

IP Source Guard requires 802.1X authentication to be enabled on the port.

Question 15

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Accepted Answer

Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.. Syslog uses UDP port 514 by default, and if a firewall or ACL between the switch and Cisco DNA Center is blocking that port, the collector will never receive messages even though both endpoints are correctly configured. Since the collector is enabled and the switch is configured to send, the next logical troubleshooting step is verifying network path reachability for UDP 514. This is the most common cause of silent syslog failures in production.

Answer

Check if the syslog messages are in the correct format.

Answer

Ensure that the switch is in the Inventory and managed by DNA Center.

Answer

Restart the syslog collector service on DNA Center.

Question 16

Which three statements about MPLS VPN (Layer 3 VPN) are true? (Choose three.)

Accepted Answer

PE routers maintain separate VRF instances for each customer.. Option A is correct because in an MPLS Layer 3 VPN, each PE router maintains separate VRF (Virtual Routing and Forwarding) instances per customer, which keeps customer routing tables isolated on the shared PE device. Option B is correct because a route distinguisher (RD) is prepended to a customer IPv4 prefix to create a unique VPNv4 address, allowing overlapping customer prefixes (such as duplicate 10.0.0.0/8 networks) to coexist in the provider's BGP table. Option C is correct because route targets (RTs) are extended BGP community attributes that control which VRFs import and export specific routes, thereby defining the VPN topology (hub-and-spoke, full mesh, etc.). Option D is not correct because P (provider) routers only forward labeled packets through the core and do not hold customer VPN routing information; that responsibility belongs to PE routers. Option E is not correct because MPLS VPN forwarding typically uses a two-label stack: an outer label (LDP or RSVP-TE) to reach the egress PE and an inner label (VPN label) to identify the customer VRF or next hop.

Answer

P routers must maintain customer VPN routing information.

Answer

MPLS VPNs use a single label to forward packets across the service provider core.

Question 17

Which three statements about NAT64 and NPTv6 are true? (Choose three.)

Accepted Answer

NAT64 translates IPv6 packets to IPv4 packets and vice versa, allowing IPv6-only clients to access IPv4 servers.. Option A is correct because NAT64 is a stateful translation mechanism defined in RFC 6146 that converts IPv6 packet headers into IPv4 headers (and back), enabling IPv6-only hosts to reach IPv4-only servers using a NAT64 prefix such as 64:ff9b::/96. Option B is correct because NPTv6 (RFC 6296) is a stateless prefix translator that rewrites only the IPv6 network prefix while leaving the interface identifier (host portion) intact, preserving end-to-end checksum neutrality. Option C is correct because NAT64 alone cannot resolve IPv4-only destinations for an IPv6-only client; a DNS64 resolver is needed to synthesize AAAA records from A records so the client obtains a routable IPv6 address that the NAT64 gateway can translate. Option D is incorrect because NPTv6 is stateless and does not perform port address translation; PAT is a feature of stateful NAT44/NAT64, not NPTv6. Option E is incorrect because NPTv6 is explicitly stateless and does not inspect or track flows, whereas only NAT64 maintains stateful bindings.

Answer

NPTv6 provides port address translation similar to PAT in IPv4 NAT.

Answer

Both NAT64 and NPTv6 require stateful inspection of all traffic flows.

Question 18

Which three statements about telemetry data collection methods are true? (Choose three.)

Accepted Answer

Syslog messages can be used as a form of telemetry to report events and state changes.. Option B is correct because syslog is a standard event-notification mechanism in which devices send severity-tagged messages about events and state changes to a collector, making it a valid (if unstructured) telemetry source. Option C is correct because model-driven telemetry (MDT) on platforms like IOS XE/NX-OS supports subscription types including periodic (sample-interval based) and event-driven (on-change) subscriptions, often configured via NETCONF/RESTCONF or gNMI. Option D is correct because gNMI (gRPC Network Management Interface) provides Get, Set, and Subscribe RPCs, so it both retrieves/manipulates configuration and state and carries streaming telemetry subscriptions. Option A is not correct as stated: SNMP traps are indeed agent-initiated (push), but the option's framing is misleading because SNMP polling is pull-based and traps are only one part of SNMP, so it is not a true blanket statement about SNMP being push-based telemetry. Option E is not correct because telemetry data can be encoded in multiple formats, including JSON (e.g., JSON-IETF), Protobuf/GPB, and XML, so XML is not the only encoding.

Answer

SNMP is a push-based telemetry method where agents send traps to the NMS.

Answer

Telemetry data can only be encoded in XML format.

Question 19

Which three statements about SD-WAN (Cisco Catalyst SD-WAN) are true? (Choose three.)

Accepted Answer

The vSmart controller is responsible for distributing control plane information such as OMP routes and policies to the WAN edge routers.. Option A is correct because in Cisco Catalyst SD-WAN the vSmart controller owns the control plane: it receives OMP routes and policies from WAN edge devices, runs the route/policy decision process, and redistributes the resulting OMP routes and policies to the other WAN edge routers. Option B is correct because the vBond controller (orchestrator) performs initial device authentication and authorization, and it tells each WAN edge router how to reach the vManage and vSmart controllers so the overlay tunnels can be established. Option D is correct because a WAN edge router supports multiple WAN transport interfaces (MPLS, Internet, LTE/5G, etc.) and can build secure IPsec/GRE overlay tunnels over each, enabling application-aware path selection and transport failover. Option C is wrong because vManage is the management/analytics plane and does not forward data-plane traffic between branches; user traffic traverses the IPsec/GRE overlay tunnels directly between WAN edge routers. Option E is wrong because OMP is a control-plane protocol that runs between WAN edge routers and the vSmart controller (over DTLS/TLS), not between WAN edge routers and vManage.

Answer

The vManage controller forwards all data traffic between branch sites.

Answer

OMP (Overlay Management Protocol) runs between vEdge routers and the vManage controller.

Question 20

Which three statements about classification and marking in a QoS architecture are true? (Choose three.)

Accepted Answer

Classification can be based on the source IP address, destination port, or protocol type using an access control list.. Option A is correct because classification commonly uses ACLs to match fields such as source IP address, destination port, and protocol type, which are exactly the Layer 3/Layer 4 criteria listed. Option B is correct because Layer 3 marking uses the 6-bit DSCP field in the IP header, giving 2^6 = 64 values, whereas the older IP Precedence field is only 3 bits, giving 2^3 = 8 values. Option E is correct because NBAR performs deep packet inspection and can recognize applications by examining payload content up to Layer 7, beyond simple header-based classification. Option C is not correct because the MPLS EXP field can be modified within the MPLS core, for example at label swap or PHP operations, and is not restricted to ingress-only marking. Option D is not correct as a universal QoS statement because marking is often recommended near the source or at the trust boundary, but it is not an absolute rule and can be performed at aggregation or edge devices depending on policy and trust models.

Answer

The MPLS EXP field is used to mark packets only at the ingress of an MPLS network and is never changed within the core.

Answer

Marking should be performed as close to the source as possible to ensure consistent treatment across the network.