350-401 Mock Exam 80 — 25 Questions

Question 1

Match each network automation tool to its purpose.

Accepted Answer

Ansible: Agentless automation tool that uses SSH and YAML playbooks. Correct matches: Ansible is agentless and uses SSH/YAML; Puppet uses client-server with DSL; Chef uses server and Ruby DSL; SaltStack uses master-minion and can be agentless. Common confusions involve mixing agentless and agent-based models.

Answer

Ansible: Uses a client-server model with agents and Puppet DSL

Answer

Puppet: Agentless automation tool using SSH and YAML playbooks

Question 2

A network engineer uses the following Python script with Netmiko to send a command to a Cisco IOS-XE device:

```python
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'ip': '10.1.1.1',
    'username': 'admin',
    'password': 'password',
    'secret': 'enable_secret'
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()
```

What is the purpose of the 'secret' parameter in the device dictionary?

Accepted Answer

It is used to enter enable mode after connecting to the device.. The 'secret' parameter is used to enter enable mode (privileged EXEC mode) on Cisco devices. Netmiko will automatically use this password to elevate privileges after connecting.

Answer

It is used for SSH key-based authentication.

Answer

It is used to encrypt the session.

Answer

It is used to set the SNMP community string.

Question 3

A network administrator checks the AAA configuration on a router:

R1# show running-config | include aaa

aaa new-model
aaa authentication login default group radius local
aaa authentication login console local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group radius

Based on this output, what can be concluded?

Accepted Answer

EXEC authorization uses TACACS+ as the primary method.. The command 'aaa authorization exec default group tacacs+ local' specifies that TACACS+ is the primary method for EXEC authorization, with local as a fallback. This means the router first attempts to authorize EXEC access via TACACS+; if the TACACS+ server does not respond, it falls back to local authentication.

Answer

Console login uses RADIUS authentication.

Answer

Accounting is performed using TACACS+.

Answer

Local authentication is never used.

Question 4

What is the purpose of the 'encapsulation replicate' keyword in a SPAN destination configuration?

Accepted Answer

It preserves the original VLAN tag of mirrored frames.. The 'encapsulation replicate' keyword in a SPAN destination configuration ensures that the mirrored frames retain their original 802.1Q VLAN tag when they are sent out the SPAN destination port. Without this keyword, the switch strips the VLAN tag from the mirrored frames, which can cause issues if the monitoring device relies on VLAN information for analysis. This keyword is specifically used to preserve the original VLAN ID for accurate traffic inspection.

Answer

It duplicates the mirrored traffic to multiple destination ports.

Answer

It enables RSPAN functionality.

Answer

It allows the destination port to send traffic as well.

Question 5

A network engineer is deploying Cisco SD-Access in a large enterprise campus. The design requires that all user traffic be segmented by Virtual Network (VN) and that the fabric edge nodes perform SGT-based enforcement. The engineer notices that traffic between two endpoints in the same IP subnet but different VNs is being forwarded directly at the fabric edge without any SGT inspection. What is the most likely cause?

Accepted Answer

The endpoints are in the same IP subnet, so they must be in the same Virtual Network; SGT enforcement only applies to inter-VN traffic.. In Cisco SD-Access, Virtual Networks (VNs) provide Layer 3 segmentation. Traffic between endpoints in the same IP subnet but different VNs is inherently Layer 2 traffic and cannot be routed or inspected by SGT-based enforcement, which only applies to inter-VN (Layer 3) traffic. Since the endpoints are in the same subnet, the fabric edge node forwards the traffic at Layer 2 without SGT inspection, making option B correct.

Answer

The fabric edge nodes have not been configured with the proper SGT mappings.

Answer

The fabric edge nodes are operating in Layer 2 mode and do not support SGT enforcement.

Answer

The control plane node has not been configured with the correct IP-SGT mappings.

Question 6

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

Accepted Answer

Type 1, Type 2, Type 3 (including default). In a totally stubby area, the ABR blocks Type 4 and Type 5 LSAs and replaces all Type 3 inter-area routes with a single default route (Type 3 LSA with link-state ID 0.0.0.0). Therefore, only Type 1 (router), Type 2 (network), and the default Type 3 LSAs are present. This matches option A.

Answer

Type 1, Type 2, Type 3, Type 5

Answer

Type 1, Type 2, Type 4, Type 5

Answer

Type 1, Type 2, Type 3 (including default), Type 4

Question 7

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:34    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:38    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The local router is the Backup Designated Router (BDR). The output shows two OSPF neighbors: one in FULL/DR state and one in 2WAY/DROTHER state. Since the local router sees a neighbor as DR and another as DROTHER, the local router must be the Backup Designated Router (BDR). In OSPF multi-access networks, the BDR forms full adjacencies with all routers, while DROTHERs remain in 2WAY state with each other.

Answer

The local router is the Designated Router (DR)

Answer

The local router is a DROTHER

Answer

The OSPF network type is point-to-point

Question 8

A network engineer runs the following command on Switch SW9:

SW9# show monitor session 9
Session 9
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 300
Destination Ports      : Gi1/0/40
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 300 and sends it to Gi1/0/40.. The output shows a Remote Destination Session, meaning this switch (SW9) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 300 and forwards it out of the destination port Gi1/0/40. The 'Source RSPAN VLAN: 300' indicates the VLAN carrying the mirrored traffic from the remote source switch, and 'Destination Ports: Gi1/0/40' confirms the local egress port.

Answer

This is a local SPAN session with source VLAN 300.

Answer

The RSPAN VLAN 300 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/40 is forwarded to the RSPAN VLAN.

Question 9

Drag and drop each AAA service on the left to its matching protocol on the right.

Accepted Answer

Authentication: RADIUS. Authentication typically uses RADIUS, authorization uses TACACS+, accounting can use either, but RADIUS is more common for accounting; TACACS+ encrypts the entire packet and separates AAA functions.

Question 10

A network engineer is writing a Python script to automate the backup of running configurations from a list of 50 Cisco IOS-XE devices. The script uses the netmiko library and a for loop to connect to each device, execute 'show run', and write the output to a file. After running the script, the engineer notices that the script fails on the 15th device with a timeout error, and the remaining devices are not processed. The engineer wants to ensure that if one device fails, the script continues with the next device. What is the best way to modify the script?

Accepted Answer

Wrap the connection and backup logic inside a try-except block within the for loop.. Wrapping the connection and backup logic inside a try-except block within the for loop catches exceptions (such as netmiko's NetMikoTimeoutException) for each device individually. This allows the loop to continue processing the remaining devices after a failure, rather than aborting the entire script. The try-except pattern is the standard Python approach for handling runtime errors without breaking iterative processes.

Answer

Increase the global timeout value in the netmiko connection handler.

Answer

Use the concurrent.futures module to run each connection in a separate thread.

Answer

Replace the for loop with a while loop that retries the connection three times before moving on.

Question 11

Which three statements about Python functions and modules for network automation are true? (Choose three.)

Accepted Answer

Using functions helps avoid code duplication and improves script maintainability.. Correct answers: A, C, and E. A is correct because functions promote code reuse and readability by encapsulating logic. C is correct because the json module is essential for parsing JSON responses from REST APIs. E is correct because the re module allows pattern matching in device outputs, such as parsing 'show' command results. B is incorrect because the os module is for operating system interactions, not for parsing JSON. D is incorrect because the csv module is for reading/writing CSV files, not for parsing JSON.

Answer

The os module is used to parse JSON data from network device responses.

Answer

The csv module is used to parse JSON data from network devices.

Question 12

An engineer is configuring a virtual machine on a Microsoft Hyper-V host. The VM runs a legacy application that requires a static MAC address. The engineer sets the MAC address in the VM settings. After the VM starts, the application cannot communicate on the network. The engineer verifies that the MAC address is not duplicated on the network. What is the most likely cause?

Accepted Answer

The static MAC address is not within the allowed range for Hyper-V virtual machines.. Hyper-V enforces a specific range for static MAC addresses assigned to virtual machines. The default allowed range is 00-15-5D-XX-XX-XX, derived from the Microsoft Organizationally Unique Identifier (OUI). If the engineer configured a MAC address outside this range (e.g., starting with a different OUI), Hyper-V will not allow the VM to use it, effectively breaking network communication even though the address is not duplicated on the network.

Answer

The VM is configured to use a dynamic MAC address, overriding the static setting.

Answer

The VM's network adapter is set to use the legacy network adapter type.

Answer

The VM is a generation 2 VM, which does not support static MAC addresses.

Question 13

An architect is designing a virtualized service chain for a campus network using NFV. The chain must include a firewall, WAN optimizer, and IPS. The architect needs to minimize latency by placing VNFs on the same hypervisor host. Which design consideration is most important?

Accepted Answer

Ensure all VNFs are pinned to the same NUMA node on the hypervisor host.. Pinning all VNFs to the same NUMA node on the hypervisor host minimizes inter-NUMA memory access latency, which is critical for achieving low-latency packet processing in an NFV service chain. When VNFs are placed on different NUMA nodes, memory accesses must traverse the QPI/UPI interconnect, adding significant latency. By co-locating the firewall, WAN optimizer, and IPS on the same NUMA node, the architect ensures that all packet processing stays within the same memory domain, reducing latency to the minimum possible on that host.

Answer

Use a Type 2 hypervisor to reduce overhead.

Answer

Place each VNF on a separate physical host to avoid resource contention.

Answer

Enable DPDK on the virtual switch to accelerate packet processing.

Question 14

Router R5 has the following OSPF configuration:

router ospf 1
 router-id 5.5.5.5
 network 10.0.0.0 0.255.255.255 area 0
 area 0 authentication message-digest
!
interface GigabitEthernet0/0
 ip address 10.1.1.5 255.255.255.0
 ip ospf message-digest-key 1 md5 cisco123

What is missing from this OSPF authentication configuration?

Accepted Answer

The interface needs the 'ip ospf authentication message-digest' command.. OSPF authentication configuration requires two components: an area-level authentication type (configured via `area 0 authentication message-digest`) and an interface-level authentication mode (configured via `ip ospf authentication message-digest`). The interface command tells the OSPF process to actually use the key defined with `ip ospf message-digest-key`. Without it, the interface defaults to no authentication, even though the area is configured for authentication.

Answer

The configuration is complete and correct.

Answer

The 'area 0 authentication' command should be 'area 0 authentication md5'.

Answer

The 'network' command should include the area authentication keyword.

Question 15

Drag and drop the steps of cisco.ios.ios_config module idempotent apply flow into the correct order, from first to last.

Accepted Answer

Connect to Cisco IOS device via SSH. The ios_config module first connects to the device, retrieves the running config, compares it with the desired config, applies only the necessary changes, and then saves the config if specified, ensuring idempotency.

Question 16

A network engineer is troubleshooting an EIGRP issue in a large enterprise network. Two routers, R1 and R2, are connected via a T1 link. R1 is learning a route to 10.0.0.0/8 from R2 with a metric of 28160, but the same route is also learned from another neighbor with a metric of 26880. The engineer notices that the route from R2 is not being installed in the routing table. What is the most likely cause?

Accepted Answer

The route with metric 28160 is not installed because EIGRP selects the route with the lowest metric.. C is correct because EIGRP installs only the route with the best (lowest) metric into the routing table. The route from R2 has a metric of 28160, while the other neighbor advertises the same route with a metric of 26880. Since 26880 is lower, R1 selects that route as the successor and does not install the higher-metric route from R2.

Answer

The route from R2 is a feasible successor, so it is not installed in the routing table.

Answer

EIGRP is using unequal-cost load balancing, so the higher metric route is not used.

Answer

The route from R2 is a summary route, so it is not installed in the routing table.

Question 17

Examine the following configuration snippet:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 100
 spanning-tree portfast
 spanning-tree bpduguard enable

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state and will be error-disabled if a BPDU is received.. The configuration enables PortFast and BPDU Guard on an access port. PortFast immediately transitions the port to forwarding state, bypassing the usual STP listening and learning phases. BPDU Guard monitors for incoming BPDUs; if any are received, it error-disables the port to prevent a potential bridging loop from an unauthorized switch connection.

Answer

The port will remain in blocking state until a BPDU is received from the root bridge.

Answer

The port will only forward BPDUs and will not forward data traffic.

Answer

The port will participate in RSTP and will not be affected by BPDU reception.

Question 18

A network team is deploying a virtualized WAN optimization appliance. The appliance must be able to process traffic at line rate on a 10 Gbps link. The hypervisor host has multiple physical NICs. Which design choice will best ensure the VM can achieve the required throughput?

Accepted Answer

Assign the VM a virtual function (VF) using SR-IOV on the physical NIC.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces CPU overhead and latency, enabling the VM to achieve near line-rate throughput on a 10 Gbps link by allowing direct hardware access for data plane traffic.

Answer

Use a standard virtual switch with a single vCPU for the VM.

Answer

Enable jumbo frames on the virtual switch only.

Answer

Configure the VM with multiple vNICs and use NIC teaming.

Question 19

Which THREE benefits does network automation provide over manual configuration?

Accepted Answer

Reduced risk of configuration errors. Network automation eliminates human error during repetitive configuration tasks. By using tools like Ansible, Python scripts, or NETCONF/YANG models, configurations are applied consistently without typos or missed commands, which are common in manual CLI entry. This directly reduces the risk of syntax errors, missing parameters, or inconsistent settings that can lead to network outages.

Answer

Increased security by eliminating the need for SSH access

Answer

Lower initial investment compared to manual processes

Question 20

A network engineer is troubleshooting an MPLS L2VPN (VPWS) where two customer sites are connected via a pseudowire. The engineer has configured the xconnect on both PE routers, but the customer reports that the link is down. The 'show mpls l2transport vc' command on PE1 shows the VC state as 'down'. What is the most likely cause?

Accepted Answer

LDP is not enabled on the core interfaces between the PEs.. The 'show mpls l2transport vc' command on PE1 shows the VC state as 'down'. For an MPLS L2VPN VPWS pseudowire to come up, LDP must be enabled on the core interfaces between the PEs to exchange label bindings for the VC. Without LDP on the core, the PEs cannot establish the LSP needed for the pseudowire, causing the VC to remain down.

Answer

The VC ID is different on the two PEs.

Answer

The VC type is not set to Ethernet.

Answer

The encapsulation is set to VLAN instead of Ethernet.