350-401 Mock Exam 82 — 25 Questions

Question 1

Consider the following configuration:

class-map match-all HTTP
 match protocol http

policy-map QOS
 class HTTP
  police 2000000 1500 3000 conform-action transmit exceed-action drop

interface GigabitEthernet0/1
 service-policy input QOS

What is the effect of this configuration?

Accepted Answer

HTTP traffic is policed to an average rate of 2 Mbps; packets that exceed the rate are dropped, while conforming packets are transmitted.. The 'police' command in the policy-map enforces a traffic policer on HTTP traffic matched by the class-map. The parameters '2000000' (2 Mbps) define the committed information rate (CIR), '1500' is the normal burst (Bc), and '3000' is the excess burst (Be). Conforming packets are transmitted, while packets exceeding the rate are dropped, which is the standard behavior of a policer in the input direction.

Answer

HTTP traffic is shaped to an average rate of 2 Mbps; excess packets are buffered.

Answer

The police command will mark HTTP packets with a DSCP value of 0 if they exceed the rate.

Answer

The configuration is invalid because 'police' cannot be used in a 'service-policy input' direction.

Question 2

A network engineer runs the following command on Switch SW5:

SW5# show running-config | section interface port-channel
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 1-100,200-300
!
interface Port-channel2
 switchport mode access
 switchport access vlan 10
!

SW5# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Po1         on           802.1q         trunking      1

Port        Vlans allowed on trunk
Po1         1-100,200-300

Port        Vlans allowed and active in management domain
Po1         1-100,200-300

Port        Vlans in spanning tree forwarding state and not pruned
Po1         1-100,200-300

Based on this output, what can be concluded?

Accepted Answer

Port-channel1 is operational as a trunk with the configured allowed VLANs.. The 'show interfaces trunk' output confirms that Port-channel1 is trunking with an operational status of 'trunking', and the 'Vlans allowed on trunk' line matches the configured allowed VLANs (1-100,200-300). This indicates the trunk is up and functioning with the intended VLAN list, making option C correct.

Answer

Port-channel2 is also trunking but not displayed due to a software bug.

Answer

Port-channel1 is trunking and allowed VLANs include VLANs 101-199.

Answer

The native VLAN on Po1 is VLAN 10.

Question 3

Which TWO STP features are used to improve convergence time after a topology change?

Accepted Answer

UplinkFast. UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Answer

Root Guard

Answer

BPDU Guard

Answer

PortFast

Question 4

A network engineer runs the following command on Router R8:

R8# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

Service-policy output: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        strict priority
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 15625 be 15625
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: DATA (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp af31 (26)
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      bandwidth remaining percent 50

Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      Queueing
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      bandwidth remaining percent 50

Based on this output, what can be concluded?

Accepted Answer

The interface is not passing any traffic.. The output shows all counters at zero for every class, including the class-default, and the '5 minute offered rate' is 0 bps for all classes. This indicates that no packets have been processed by this policy-map on GigabitEthernet0/1, meaning the interface is not passing any traffic. The presence of policing and queuing configurations does not imply traffic is being dropped; the counters confirm zero activity.

Answer

Voice traffic is being prioritized but not policed.

Answer

Data traffic is being dropped due to policing.

Answer

The policy-map is applied to input traffic.

Question 5

An enterprise is deploying Cisco SD-WAN with vManage, vSmart, vBond, and vEdge routers. The architect must design the control plane to securely onboard new vEdge routers and establish DTLS/TLS tunnels. Which component is responsible for the initial authentication and coordination of control plane connections?

Accepted Answer

vBond. In Cisco SD-WAN, vBond is the orchestrator responsible for the initial authentication and coordination of control plane connections. When a new vEdge router attempts to join the fabric, it first contacts vBond, which authenticates the device using its serial number and certificate, then provides the IP addresses of the vSmart controllers and vManage. This establishes the DTLS/TLS tunnels for the control plane.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 6

Drag and drop the steps of NBAR2 application recognition and classification steps into the correct order, from first to last.

Accepted Answer

Enable NBAR2 with ip nbar protocol-discovery on interface. First, enable NBAR2 on the interface using ip nbar protocol-discovery. Then create a class-map to match the application using match protocol. Next, create a policy-map to mark or apply QoS actions. Apply the policy-map to the interface. Finally, verify NBAR2 statistics using show ip nbar protocol-discovery.

Question 7

A network engineer runs the following command on Router R3:

R3# show ip route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
O IA     10.1.1.0/24 [110/20] via 192.168.1.1, 00:12:34, GigabitEthernet0/0
O        10.2.2.0/24 [110/10] via 192.168.1.2, 00:15:22, GigabitEthernet0/0
O E2     10.3.3.0/24 [110/20] via 192.168.1.3, 00:08:11, GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The route to 10.3.3.0/24 is an external route redistributed into OSPF.. The route to 10.3.3.0/24 is marked as 'O E2' in the output, which stands for OSPF external type 2. This indicates that the route was redistributed into OSPF from another routing protocol or a different OSPF process, making it an external route. The 'E2' designation confirms it is an external route with a fixed metric that does not include the internal cost to the ASBR.

Answer

The route to 10.1.1.0/24 is in the same OSPF area as R3.

Answer

The metric for 10.3.3.0/24 includes the internal cost to the ASBR.

Answer

R3 is an ASBR.

Question 8

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Accepted Answer

The access list 100 does not permit the 172.16.0.0/16 network.. The command `ip nat inside source list 100 interface GigabitEthernet0/0 overload` uses access list 100 to define which source IP addresses are eligible for NAT. Since ACL 100 permits only the 10.0.0.0/8 network, any traffic from 172.16.0.0/16 is not matched by the ACL and therefore is not translated. Even though the 172.16.0.0/16 hosts have connectivity to the router, their packets are forwarded without NAT and likely dropped by the ISP or the next-hop router because they contain private IP addresses.

Answer

The router's interface GigabitEthernet0/0 is not configured with ip nat outside.

Answer

The 172.16.0.0/16 hosts have a default gateway pointing to a different router.

Answer

The NAT pool is exhausted for the 172.16.0.0/16 network.

Question 9

Review the ACL configuration:

ip access-list extended TEST
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 deny ip any any
!
interface GigabitEthernet0/3
 ip access-group TEST in

What is missing or incorrect?

Accepted Answer

The deny ip any any is redundant because ACLs have an implicit deny at the end.. The `deny ip any any` line is redundant. Cisco ACLs have an implicit deny all at the end of every ACL, so adding an explicit deny is unnecessary and does not change the behavior. The configuration is otherwise valid for filtering inbound traffic on GigabitEthernet0/3.

Answer

The ACL should use a wildcard mask of 255.255.255.0 instead of 0.0.0.255.

Answer

The ACL must be applied outbound to filter incoming traffic.

Answer

The ACL should use the keyword 'established' to allow return traffic.

Question 10

A network engineer issues the following command on Router R5:

R5# show ip pim interface
Interface          PIM  Nbrs  Hello  DR    DR
                        Count Intvl  Prior
GigabitEthernet0/0 on    2     30     1     10.1.1.1
GigabitEthernet0/1 on    1     30     1     10.2.2.2
Loopback0          on    0     30     1     10.3.3.3

Based on this output, what can be concluded?

Accepted Answer

The DR on GigabitEthernet0/0 is 10.1.1.1.. The output shows that on GigabitEthernet0/0, the DR (Designated Router) IP address is 10.1.1.1, which is listed in the 'DR' column. This indicates that 10.1.1.1 is the elected DR for that interface, making option A correct. The DR is elected based on the highest IP address when DR priorities are equal (both are 1 here), and 10.1.1.1 is the neighbor with the highest IP on that segment.

Answer

The DR on GigabitEthernet0/1 is the local router.

Answer

PIM is disabled on Loopback0.

Answer

The hello interval on GigabitEthernet0/0 is 60 seconds.

Question 11

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 will be translated to the IP address of GigabitEthernet0/0 using PAT.. This configuration uses dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The `ip nat inside source list 1 interface GigabitEthernet0/0 overload` command translates all source IP addresses matching access-list 1 (the 192.168.1.0/24 subnet) to the single IP address of the outside interface (10.0.0.1), using unique source port numbers to differentiate multiple simultaneous sessions. This allows all hosts in the inside network to share the single public IP address for internet access.

Answer

Only one host from 192.168.1.0/24 can access the internet at a time.

Answer

Traffic from the outside interface will be translated to 192.168.1.0/24.

Answer

The configuration will fail because the access list must be applied to an interface.

Question 12

A network engineer is troubleshooting multicast video distribution across an enterprise campus. The multicast source is connected to a switch that is the PIM Designated Router (DR) on a multi-access segment. Receivers in a different VLAN report that they are not receiving the multicast stream, although the DR shows the correct (S,G) entry. The engineer checks the RPF neighbor for the source and notices that the unicast route to the source points to a different interface than the one where the multicast stream is received. What is the most likely cause of the issue?

Accepted Answer

The multicast stream is arriving on an interface that is not the RPF interface for the source.. PIM uses the unicast routing table to determine the Reverse Path Forwarding (RPF) interface for a multicast source. If the multicast stream arrives on an interface that is not the RPF interface (the interface the unicast route uses to reach the source), the router will perform an RPF check and fail, dropping the multicast traffic. This is the most likely cause of the issue, as the DR has the (S,G) entry but the stream is not being forwarded due to the RPF mismatch.

Answer

The DR is not configured as the RP (Rendezvous Point).

Answer

The switchport connected to the source is not configured as a trunk.

Answer

IGMP snooping is disabled on the receiver VLAN.

Question 13

Consider the following partial configuration on Router R1:

ip sla 2
 icmp-echo 10.2.2.2
 frequency 15
ip sla schedule 2 life forever start-time now
ip sla reaction-configuration 2 react timeout threshold-type immediate action-type triggerOnly

Which statement about this configuration is true?

Accepted Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and trigger an event if a timeout occurs, but the trigger will only activate once.. The IP SLA operation sends ICMP echo requests every 15 seconds (as defined by the 'frequency 15' command) and the 'reaction-configuration' with 'threshold-type immediate' and 'action-type triggerOnly' means that as soon as a timeout occurs, a trigger event is generated, but the 'triggerOnly' keyword ensures that the trigger fires only once (not repeatedly) for the first timeout event. The operation continues to run, but no further triggers are generated for subsequent timeouts unless the reaction is rearmed.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and continuously trigger events for each timeout.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds and trigger an event if the round-trip time exceeds a threshold.

Answer

The IP SLA operation will send ICMP echo requests every 15 seconds, but the 'reaction-configuration' command is invalid because it requires a threshold value.

Question 14

What is the purpose of the 'police' command in a QoS policy-map?

Accepted Answer

To limit the rate of traffic and take action (drop or remark) on packets that exceed the rate.. The 'police' command in a Cisco QoS policy-map implements traffic policing, which enforces a rate limit by measuring traffic flow and taking immediate action—typically dropping or remarking packets—when the traffic exceeds the configured rate. Unlike shaping, policing does not buffer excess traffic; it acts on packets in real time, making it ideal for marking down or discarding non-compliant traffic at the ingress or egress of an interface.

Answer

To shape traffic to a specific rate by buffering excess packets.

Answer

To prioritize traffic by assigning it to a strict priority queue.

Answer

To classify traffic based on IP precedence or DSCP values.

Question 15

A network engineer issues the following command on a router:

R1# show tacacs

TACACS+ Server: 10.1.1.10/49
  Socket opens: 5
  Socket closes: 3
  Socket aborts: 0
  Total packets sent: 10
  Total packets received: 9
  Retransmissions: 1
  Timeouts: 1
  Current idle time: 30 seconds

Based on this output, what can be concluded?

Accepted Answer

The TACACS+ server experienced a single timeout.. The output shows 'Timeouts: 1', which indicates that exactly one TACACS+ request did not receive a response within the expected time. This confirms that the TACACS+ server experienced a single timeout, making option C correct. The server is reachable (socket opens/closes show successful connections), and authentication attempts have occurred (total packets sent/received).

Answer

The TACACS+ server is unreachable.

Answer

There have been no authentication attempts.

Answer

All packets were successfully acknowledged.

Question 16

interface GigabitEthernet0/2
 spanning-tree link-type point-to-point
 end

What is the effect of this configuration?

Accepted Answer

The port will use RSTP fast transition mechanisms assuming a point-to-point link.. The `spanning-tree link-type point-to-point` command manually overrides the port's link type to point-to-point, forcing the port to use Rapid Spanning Tree Protocol (RSTP) fast transition mechanisms (proposal/agreement handshake) instead of the slower 802.1D listening/learning states. This is correct because RSTP relies on the link type to determine whether it can safely perform a fast transition to the forwarding state; a point-to-point link allows immediate transition without waiting for timers.

Answer

The port will become a designated port immediately.

Answer

The port will disable STP on that link.

Answer

The port will use shared medium behavior.

Question 17

Drag and drop the steps of SD-WAN traffic engineering app-aware routing steps into the correct order, from first to last.

Accepted Answer

Traffic is classified by application. The correct order for SD-WAN traffic engineering app-aware routing steps is: first, traffic is classified by application (A); then path performance is measured via probes (B); then metrics are compared to SLA thresholds (C); then the best path meeting the SLA is selected (D); and finally traffic is forwarded over the chosen path (E).

Question 18

ip vrf RED
 rd 200:1
 route-target export 200:1
 route-target import 200:1
!
interface GigabitEthernet0/1
 ip vrf forwarding RED
 ip address 10.1.1.1 255.255.255.0
!
router bgp 65000
 neighbor 192.168.1.1 remote-as 65000
 neighbor 192.168.1.1 update-source Loopback0
 address-family vpnv4
  neighbor 192.168.1.1 activate
  neighbor 192.168.1.1 send-community extended
!
Which statement about this configuration is true?

Accepted Answer

The configuration is correct for MPLS L3VPN, but the VRF RED must also be configured under BGP with 'address-family ipv4 vrf RED'.. In an MPLS L3VPN configuration, after creating the VRF and applying it to an interface, you must also configure the VRF under BGP using the 'address-family ipv4 vrf RED' command to exchange IPv4 routes within that VRF. Without this, the VRF will not participate in BGP route exchange, and the VPNv4 address-family alone cannot import or export VRF routes. The given configuration is incomplete, as it lacks the VRF-specific address-family under BGP.

Answer

The 'send-community extended' command is unnecessary because it is enabled by default.

Answer

The interface GigabitEthernet0/1 requires 'mpls ip' to forward MPLS packets.

Answer

The VRF RED will automatically import routes from the VPNv4 address-family without additional configuration.

Question 19

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in
!
ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Accepted Answer

It blocks inbound ICMP Echo requests on GigabitEthernet0/1.. The access list FILTER_IN explicitly denies ICMP packets with the 'echo' type (ping requests) while permitting all other IP traffic. Applied inbound on GigabitEthernet0/1, this blocks only inbound ICMP Echo requests, not all ICMP traffic (e.g., Echo replies, TTL-exceeded messages are permitted). The 'permit ip any any' at the end ensures all other traffic is allowed.

Answer

It blocks all ICMP traffic inbound on GigabitEthernet0/1.

Answer

It blocks all inbound traffic on GigabitEthernet0/1.

Answer

It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

Question 20

Examine the following interface configuration on a Cisco IOS-XE switch:
```
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
```
What is the effect of this configuration?

Accepted Answer

The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.. The configuration sets port-security with a maximum of 2 MAC addresses, violation mode 'restrict', and sticky MAC learning. When a third MAC address is seen, the 'restrict' action drops traffic from that MAC but keeps the port up, generates a syslog message, and increments the violation counter. Option A correctly describes this behavior.

Answer

The port will learn up to 2 MAC addresses and then shut down if a third is seen.

Answer

The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.

Answer

The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.