350-401 Mock Exam 81 — 25 Questions

Question 1

Consider the following configuration snippet:

interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
!
interface GigabitEthernet0/1
 channel-group 1 mode active
!
interface GigabitEthernet0/2
 channel-group 1 mode passive

What is the effect of this configuration?

Accepted Answer

The EtherChannel will form using LACP, and the port-channel will operate as a trunk carrying VLANs 10, 20, and 30.. The configuration uses LACP with one side in active mode (GigabitEthernet0/1) and the other in passive mode (GigabitEthernet0/2). LACP allows an active/passive combination to form an EtherChannel, unlike PAgP which requires at least one side to be in desirable mode. The trunk and allowed VLANs are configured on the port-channel interface, which applies to all member ports once the channel is established.

Answer

The EtherChannel will not form because both sides must use the same LACP mode.

Answer

The EtherChannel will form using PAgP because the mode is not specified as lacp.

Answer

The EtherChannel will form but only VLAN 1 will be allowed on the trunk.

Question 2

Which two statements about DMVPN Phase 3 are true? (Choose two.)

Accepted Answer

NHRP redirect messages are sent by the hub to inform a spoke that a better path exists directly to another spoke.. Option C is correct because in DMVPN Phase 3 the hub uses NHRP redirect messages to tell a spoke that a more optimal direct path to the destination spoke exists, prompting the spoke to resolve the destination's NBMA address and build a direct tunnel. Option E is correct because Phase 3 retains mGRE interfaces and NHRP so spokes can dynamically establish direct spoke-to-spoke tunnels, while the hub only handles initial resolution and redirects rather than remaining in the data path. Option A is wrong because Phase 3 specifically enables spoke-to-spoke traffic to bypass the hub after NHRP resolution, so the hub is not always in the data path. Option B is wrong because spokes registering their physical NBMA addresses with the NHRP server is characteristic of DMVPN in general (including Phase 1/2), not a Phase 3-specific truth. Option D is wrong because DMVPN uses mGRE (multipoint GRE) with NHRP, not point-to-point GRE tunnels, for spoke-to-spoke connections.

Answer

In DMVPN Phase 3, the hub router must always be in the data path for all traffic between spokes.

Answer

Spokes register their physical (non-NBMA) addresses with the NHRP server (hub) to enable dynamic tunnel establishment.

Answer

DMVPN Phase 3 uses point-to-point GRE tunnels for spoke-to-spoke connections.

Question 3

Which three statements about CoPP configuration and operation are true? (Choose three.)

Accepted Answer

CoPP uses a class map to classify traffic destined for the control plane.. Option A is correct because CoPP (Control Plane Policing) relies on a class map to identify and classify traffic that is destined to the control plane, typically using ACLs or match statements to select protocols such as routing updates, management traffic, or ICMP. Option B is correct because the rate-limiting action in CoPP is implemented by configuring the 'police' command inside a policy map, which enforces a committed information rate (CIR) and burst parameters on the classified control-plane traffic. Option C is correct because the 'control-plane' global configuration command enters control plane configuration mode, where the service policy is attached to the control plane using the 'service-policy' command. Option D is not correct because CoPP is not applied with 'ip access-group' on a control plane interface; instead, the policy map is attached under control plane configuration mode with 'service-policy'. Option E is not correct because CoPP can match and police more than IPv4 traffic, including IPv6, ARP, and other non-IP control-plane protocols, depending on the platform and class-map configuration.

Answer

CoPP is applied using the 'ip access-group' command on the control plane interface.

Answer

CoPP can only filter IPv4 traffic.

Question 4

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: MGMT-CLASS (match-all)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: access-group name MGMT-ACL
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 80 packets, 4000 bytes; actions:
          transmit
        exceeded 15 packets, 750 bytes; actions:
          drop
        violated 5 packets, 250 bytes; actions:
          drop

Class-map: class-default (match-any)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 200 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

Management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.. The output shows that the CoPP-POLICY policy map is applied to the control plane in the input direction. For the MGMT-CLASS class, the policer has a CIR of 32000 bps, and the counters show 15 packets exceeded and 5 packets violated, both with a drop action. This confirms that some management traffic is being dropped because it exceeds the configured rate, making option A correct.

Answer

All management traffic is being transmitted without drops.

Answer

The policer is configured in the output direction.

Answer

The class-default is dropping packets.

Question 5

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

Accepted Answer

10 seconds. On a broadcast multi-access network like Ethernet, OSPF defaults to a hello interval of 10 seconds. This is defined in RFC 2328 and is used to quickly detect neighbor failures while keeping control traffic overhead manageable. The corresponding dead interval is 40 seconds (4 times the hello interval).

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 6

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The TACACS+ server is reachable at 10.1.1.100. The administrator wants to ensure that if the TACACS+ server becomes unreachable, the router will fall back to local authentication using the local username 'admin' with password 'Cisco123'. Which configuration should be applied?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key SecretKey
username admin privilege 15 secret Cisco123. The correct configuration enables AAA, specifies TACACS+ with local fallback in the authentication method list, defines the TACACS+ server using the modern 'tacacs server' command, and creates a local username with a secret. This ensures authentication works even if the TACACS+ server is down.

Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs-server host 10.1.1.100 key SecretKey
username admin privilege 15 secret Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+
tacacs server TAC1
 address ipv4 10.1.1.100
 key SecretKey
username admin privilege 15 secret Cisco123

Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key SecretKey
username admin privilege 15 password Cisco123

Question 7

A network automation engineer is developing a Python script that will retrieve interface statistics from a Cisco IOS XE device using NETCONF. The engineer needs to discover which YANG models are supported by the device before constructing the RPC. Which NETCONF capability exchange message should the script send first to obtain this information?

Accepted Answer

Establish an SSH session and read the message sent by the device immediately after the NETCONF subsystem is started.. The NETCONF protocol requires a capability exchange during session establishment. The server sends a message containing a element that lists all supported YANG models and protocol features. The client must parse this message to discover available models before sending any RPCs. This is fundamental to NETCONF operation and is defined in RFC 6241.

Answer

Send a RESTCONF GET request to the /restconf/data/ietf-yang-library:modules-state endpoint.

Answer

Issue a NETCONF <get-config> RPC with a filter specifying the urn:ietf:params:xml:ns:yang:ietf-interfaces namespace.

Answer

Send an message with a operation targeting the ietf-netconf-monitoring model.

Question 8

A network engineer is evaluating Cisco SD-WAN (Viptela) for a large enterprise. The engineer needs to automate the deployment of vEdge routers using zero-touch provisioning. Which two components are required to enable zero-touch provisioning for vEdge routers? (Choose two.)

Accepted Answer

vManage NMS. Zero-touch provisioning for vEdge routers requires the vBond orchestrator and vManage. vBond authenticates the vEdge and provides the addresses of the other controllers. vManage then delivers the configuration. vSmart is not required for initial provisioning, though it is needed for control plane functionality. DNA Center and APIC-EM are unrelated to SD-WAN.

Answer

vSmart controller

Answer

APIC-EM

Answer

Cisco DNA Center

Question 9

A network engineer is using Cisco SD-WAN vManage APIs to automate the deployment of a new branch site. The engineer needs to retrieve a list of all devices in the overlay network. Which REST API endpoint should the engineer use?

Accepted Answer

GET /dataservice/device. The vManage REST API provides the /dataservice/device endpoint to retrieve a list of all devices in the SD-WAN overlay. This endpoint returns details such as device IP, hostname, model, and status. It is the standard way to obtain device inventory for automation scripts. Other endpoints serve different purposes, such as templates or connections.

Answer

GET /dataservice/network/connections

Answer

GET /dataservice/template/device

Answer

GET /dataservice/system/device

Question 10

A network engineer is deploying 802.1X on a Cisco switch with Cisco ISE as the RADIUS server. The engineer wants to allow devices that do not support 802.1X supplicant to connect to a guest VLAN. Which feature should be configured on the switch port to accomplish this?

Accepted Answer

Enable MAB (MAC Authentication Bypass) on the port.. MAC Authentication Bypass (MAB) enables non-802.1X devices to authenticate using their MAC address. The switch sends the MAC to ISE, which can authorize the device and assign it to a guest VLAN via RADIUS attributes. This allows devices like printers or legacy IP phones to gain network access without supplicant software, while still enforcing policy.

Answer

Configure the port as a trunk port with native VLAN set to the guest VLAN.

Answer

Set the port to force-authorized mode.

Answer

Configure the port as a multi-auth port with an authentication open mode.

Question 11

A network engineer is implementing VXLAN with an EVPN control plane. The underlay is a routed Layer 3 network. Which statement describes the role of the VXLAN Tunnel Endpoint (VTEP)?

Accepted Answer

The VTEP encapsulates Layer 2 frames into VXLAN packets and forwards them over the IP underlay.. The VTEP encapsulates Layer 2 frames into VXLAN packets and forwards them over the IP underlay. It is the device that provides the overlay encapsulation and decapsulation, enabling Layer 2 connectivity across a Layer 3 network.

Answer

The VTEP acts as a Layer 3 gateway for inter-subnet routing.

Answer

The VTEP is responsible for advertising MAC addresses to the EVPN control plane.

Answer

The VTEP maps VLAN IDs to VXLAN Network Identifiers (VNIs).

Question 12

A network administrator is configuring a Cisco Catalyst switch to support a new VLAN 200 for a guest network. The administrator wants to ensure that VLAN 200 is created and active on the switch. Which command should be used?

Accepted Answer

vlan 200. To create a VLAN on a Cisco Catalyst switch, the 'vlan 200' command is used in global configuration mode. This command creates the VLAN and enters VLAN configuration mode, where additional parameters like name can be set. The VLAN is active by default. Other commands like 'switchport access vlan' assign ports to the VLAN but do not create it, and 'interface vlan' creates an SVI, not the VLAN itself.

Answer

interface vlan 200

Answer

vlan database

Answer

switchport access vlan 200

Question 13

A network engineer is using Cisco SD-WAN vManage APIs to automate the creation of a new VPN template. The engineer needs to authenticate to the vManage REST API using a Python script. Which authentication method is natively supported by the vManage API for programmatic access?

Accepted Answer

Session-based authentication using a cookie obtained from /j_security_check. The vManage REST API uses session-based authentication. A client sends a POST request to /j_security_check with username and password, receives a JSESSIONID cookie, and includes it in subsequent requests. This method is standard for automating vManage operations. Other methods like OAuth or API keys are not natively supported for the vManage API.

Answer

API key authentication using a static key generated in the vManage GUI

Answer

Certificate-based authentication using X.509 client certificates

Answer

OAuth 2.0 with JWT tokens issued by vManage

Question 14

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and NTP. The requirement is to protect the route processor from excessive BGP keepalive traffic while still allowing all legitimate BGP peering. Which CoPP module should the administrator use to classify and police this traffic before the policy is applied to the control plane?

Accepted Answer

A class map that matches BGP traffic using an ACL or NBAR, referenced by a policy map, which is then applied with the service-policy command under control-plane configuration mode.. Control Plane Policing requires a modular QoS configuration: class maps to identify traffic, a policy map to define policer actions, and the service-policy command applied under control-plane configuration mode. This structure allows BGP keepalives to be matched and policed while other traffic is handled separately, directly protecting the route processor as the scenario requires.

Answer

A route map applied inbound on the BGP neighbor session that sets a lower precedence for keepalive packets.

Answer

A class map referenced by a policy map that is applied outbound on the WAN interface toward the BGP peer.

Answer

An access list applied directly to the physical interface facing the BGP peer using the ip access-group command.

Question 15

An engineer is configuring 802.1X on a Cisco Catalyst switch port where a PC is connected. The requirement is that if the authentication server becomes unreachable, the port should still allow the PC to send traffic in a restricted VLAN rather than being shut down. Which configuration meets this requirement?

Accepted Answer

authentication event server dead action authorize vlan 999. When RADIUS becomes unreachable, the switch needs an explicit policy for the resulting dead-server condition. The authentication event server dead action authorize vlan command places the port into a designated restricted VLAN, allowing limited connectivity while the outage persists. Other commands address failed credentials, host count, or pre-authentication access, none of which provide the required restricted-VLAN fallback.

Answer

authentication open

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 999

Question 16

A security team wants to protect a web application hosted behind a Cisco IOS router from cross-site scripting and SQL injection attacks without modifying the application itself. Which Cisco IOS feature is designed for this purpose?

Accepted Answer

Cisco IOS IPS with signature-based inspection. Detecting and blocking application-layer attacks like cross-site scripting and SQL injection requires payload inspection, which is what Cisco IOS IPS provides through its signature set. Firewalls, CoPP, and IPsec operate at other layers and cannot identify malicious HTTP content, so signature-based IPS is the appropriate feature when the application itself cannot be modified.

Answer

Zone-Based Policy Firewall

Answer

IPsec VPN with AES encryption

Answer

Control Plane Policing

Question 17

A network architect is designing a new branch office that requires a controller-based wireless solution. The branch has a single Cisco Catalyst 9800-CL appliance and needs to support 802.1X authentication with dynamic VLAN assignment for employee SSIDs. Which deployment mode should the architect use for the access points to meet these requirements with minimal configuration on the APs?

Accepted Answer

Local mode with the APs managed by the Catalyst 9800-CL controller. Local mode is the correct choice because it keeps the APs lightweight and relies on the Catalyst 9800-CL controller for all client authentication and VLAN assignment. This centralizes the complex configuration on the controller, reducing AP-side setup. The other modes either add unnecessary complexity for survivability or do not serve client traffic at all.

Answer

FlexConnect mode with central switching enabled for the employee SSIDs

Answer

Sniffer mode with the APs capturing 802.11 frames for analysis

Answer

Monitor mode with the APs dedicated to spectrum analysis and rogue detection

Question 18

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a specific client device is experiencing poor performance. Which feature in DNA Center Assurance provides a detailed timeline of events, including onboarding, authentication, and application usage for a specific client?

Accepted Answer

Client 360. Client 360 in Cisco DNA Center Assurance provides a holistic view of a specific client, including a detailed timeline of onboarding, authentication, DHCP, DNS, and application usage. This is essential for troubleshooting client-specific performance issues because it correlates all relevant events in one place. The other options provide broader infrastructure or application views but lack the per-client event timeline needed here.

Answer

Path Trace

Answer

Application Health dashboard

Answer

Network Health dashboard

Question 19

A network administrator is using Cisco DNA Center to monitor a campus network. The administrator wants to receive an alert when a switch's CPU utilization exceeds 80% for more than 5 minutes. Which feature should be configured?

Accepted Answer

Assurance custom threshold rules. Custom threshold rules in Cisco DNA Center Assurance are designed to trigger alerts when a monitored metric crosses a defined threshold for a specified duration. Configuring a rule for CPU utilization above 80% for 5 minutes directly fulfills the administrator's requirement, unlike health score or issue-based features.

Answer

Issue definitions with custom severity

Answer

Assurance health score thresholds

Answer

Syslog forwarding to an external server

Question 20

A network automation team is evaluating YANG models to manage Cisco IOS XE devices. They need to ensure that the models they choose can be used with both NETCONF and RESTCONF. Which two statements about YANG models are true in this context? (Choose two.)

Accepted Answer

YANG models can be augmented to add vendor-specific data.. YANG is a data modeling language that defines both configuration and state data, and it is used by both NETCONF and RESTCONF. It supports augmentations for vendor-specific extensions. These characteristics make YANG suitable for multi-protocol automation. The other statements are incorrect because they misrepresent YANG's protocol independence, encoding, or scope.

Answer

YANG models can only define configuration data, not operational state data.

Answer

YANG models are written in XML and must be converted to JSON for RESTCONF.

Answer

YANG models are specific to NETCONF and cannot be used with RESTCONF.