350-401 Practice Test 8 — 10 Questions

Question 1

Drag and drop each NetFlow version on the left to its matching feature on the right.

Accepted Answer

NetFlow v5: Fixed-format records with no templates. NetFlow v5 sends fixed-format records with no user-defined fields. v9 supports templates and flexible field definitions. IPFIX is the standardized version of v9 with additional fields and variable-length support.

Question 2

A network engineer is troubleshooting a model-driven telemetry deployment on a Cisco IOS-XE router. The telemetry subscription is configured to stream interface statistics using gRPC dial-out to a collector at 10.1.1.100:50051. The engineer verifies that the collector is listening on the port and the router can reach it. However, the collector shows no data received. The engineer checks the router's telemetry logs and sees 'Connection refused' errors. What is the most likely cause?

Accepted Answer

The gRPC server on the collector is not running or is listening on a different port. That the collector is not configured to accept gRPC connections, or the gRPC server on the collector is not running. The 'Connection refused' error indicates that the TCP connection is being rejected, typically because the collector's gRPC server is not listening on that port. The other options are incorrect because the router can reach the collector, so firewall is not blocking; the subscription is configured correctly; and the encoding is not the cause of connection refusal.

Answer

The collector's firewall is blocking the connection from the router

Answer

The telemetry subscription is missing the 'encoding' configuration

Answer

The router's source-interface is not configured, causing the router to use an unreachable IP

Question 3

Drag and drop the steps of TACACS+ command authorization flow into the correct order, from first to last.

Accepted Answer

User authenticates to network device via TACACS+. TACACS+ separates authentication, authorization, and accounting. For command authorization, the user authenticates first, then the device sends the command to the TACACS+ server, which checks its authorization policy and responds with permit or deny. The device then executes or blocks the command accordingly.

Question 4

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.

Question 5

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Advertise graceful restart capability. First, both peers advertise the graceful restart capability in the OPEN message. Then they exchange the restart time and stale-path timer via capabilities. Next, the helper router marks routes as stale upon session failure. After that, the restarting router re-establishes the session. Finally, the helper removes stale routes if not refreshed.

Question 6

Drag and drop the steps of disaster recovery failover process into the correct order, from first to last.

Accepted Answer

Detect failure via keepalives or BFD. Failover begins with detecting the primary failure, then activating the backup path. Traffic is redirected to the secondary site, and after the primary is restored, operations are switched back in a controlled manner.

Question 7

Drag and drop the steps of STP root bridge election and port state transitions into the correct order, from first to last.

Accepted Answer

Elect root bridge using lowest bridge ID. STP first elects a root bridge based on lowest bridge ID. Then each non-root bridge selects one root port (lowest path cost to root). Next, each segment elects a designated port (lowest root path cost, then lowest bridge ID). All other ports become alternate (blocking). Finally, ports transition through blocking, listening, learning, and forwarding states.

Question 8

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Accepted Answer

IKE_SA_INIT: Phase 1 key agreement. IKE_SA_INIT is phase 1 for key agreement; IKE_AUTH is phase 2 for authentication and policy; CREATE_CHILD_SA is used for rekeying or additional SAs.

Question 9

Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.

Accepted Answer

Phase 1: Hub-and-spoke with NHRP registration. DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

Answer

Phase 4: NHRP with BGP for routing

Answer

Phase 5: NHRP with OSPF for routing

Question 10

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Accepted Answer

health = response['response'][0]['overallHealth']. The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Answer

health = response['overallHealth']

Answer

health = response['response']['overallHealth']

Answer

health = response[0]['overallHealth']