350-401 Mock Exam 83 — 25 Questions

Question 1

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.. The most likely cause is that the destination port (Gi1/0/24) is in the same VLAN as the source interface (Gi1/0/1). When a SPAN destination port resides in the same VLAN as the source, the switch may drop the copied egress frames to prevent a switching loop, because the destination port would otherwise re-inject the traffic back into the same VLAN. This behavior is specific to local SPAN on Catalyst switches, where the destination port must be in a different VLAN or configured as a trunk with only the monitoring VLAN allowed.

Answer

The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.

Answer

The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.

Answer

The engineer must also configure 'monitor session 1 filter ip' to capture both directions.

Question 2

Which two statements about VRF route leaking are true? (Choose two.)

Accepted Answer

Route leaking between VRFs can be achieved by configuring static routes with the 'global' keyword.. Correct: Route leaking can be done using static routes or BGP with import/export maps. Incorrect: Route leaking does not merge routing tables; VRF-lite does not inherently support it; it does not require MPLS; it is not automatic.

Answer

Route leaking merges the routing tables of two VRFs into one.

Answer

VRF-lite automatically supports route leaking without any additional configuration.

Answer

Route leaking requires MPLS to be enabled.

Question 3

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode ipsec ipv4
!
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 203.0.113.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TSET
 match address 100
!
interface GigabitEthernet0/0
 crypto map CMAP
!
access-list 100 permit ip 10.0.0.0 0.0.0.3 10.0.0.4 0.0.0.3

What is the effect of this configuration?

Accepted Answer

The configuration will fail because a crypto map cannot be used with an IPsec VTI; the tunnel interface should use 'tunnel protection ipsec profile' instead.. This configuration is invalid because it mixes a crypto map policy-based VPN with a VTI configuration using `tunnel mode ipsec ipv4`. For a proper IPsec VTI, you must configure an IPsec profile and apply it to the tunnel interface using `tunnel protection ipsec profile`. The crypto map on the physical interface is incompatible with the VTI and will prevent the tunnel from establishing correctly. Therefore, the configuration will fail to create an operational IPsec VPN.

Answer

The configuration creates an IPsec VTI that encrypts traffic between the two tunnel endpoints.

Answer

The configuration will only encrypt traffic from 10.0.0.0/30 to 10.0.0.4/30, but not the reverse.

Answer

The configuration uses IKEv2 because of the transform-set and crypto map.

Question 4

An engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, connected via a trunk. The trunk is configured with switchport mode trunk on both sides. The engineer notices that some VLANs are not passing traffic, even though they are in the allowed list. The output of 'show interfaces trunk' on SW1 shows that VLANs 10, 20, and 30 are in the allowed list and are active. However, hosts in VLAN 30 cannot reach the distribution switch. What is the most likely cause?

Accepted Answer

VLAN 30 is not created in the VLAN database on SW2.. VLAN 30 must exist in the VLAN database on both switches for traffic to be forwarded across the trunk. Even if VLAN 30 is in the allowed list and active on SW1, if it has not been created on SW2, SW2 will discard frames tagged with VLAN 30 because it has no VLAN 30 interface or forwarding table entry. This is a common misconfiguration where the VLAN is allowed on the trunk but not present on the remote switch.

Answer

The native VLAN is mismatched between SW1 and SW2.

Answer

VTP pruning is removing VLAN 30 from the trunk.

Answer

The trunk is not forming due to DTP negotiation.

Question 5

Which two statements about BGP route selection are true? (Choose two.)

Accepted Answer

A route with a higher LOCAL_PREF is preferred over a route with a lower LOCAL_PREF.. BGP prefers a route with a higher LOCAL_PREF (local preference) over a lower one. A route learned via eBGP is preferred over iBGP because eBGP routes have a lower administrative distance in the BGP decision process (step 7: prefer eBGP over iBGP). The MED is compared only if the routes are from the same neighboring AS. The shortest AS_PATH is preferred, not the longest. The IGP metric to the next hop is compared only after many other steps.

Answer

A route with a longer AS_PATH is preferred over a route with a shorter AS_PATH.

Answer

The MED attribute is always compared regardless of the AS of the neighbor.

Answer

The IGP metric to the next hop is the first criterion in BGP path selection.

Question 6

Which three statements about virtual machine (VM) resource allocation and overcommitment are true? (Choose three.)

Accepted Answer

Memory overcommitment allows a hypervisor to run VMs with total allocated memory exceeding physical RAM.. Resource overcommitment allows a hypervisor to allocate more virtual resources than physical resources, but careful monitoring is required to avoid performance issues. Option A is correct because memory overcommitment uses techniques like ballooning or swapping. Option B is correct because CPU overcommitment can lead to contention if many VMs compete for CPU time. Option D is correct because storage overcommitment can cause performance degradation if thin provisioning leads to oversubscription. Option C is incorrect because overcommitment does not guarantee isolation; it can actually reduce isolation. Option E is incorrect because overcommitment is not limited to memory; it applies to CPU and storage as well.

Answer

Overcommitment guarantees that each VM receives its allocated resources without interference.

Answer

Resource overcommitment is only applicable to memory, not CPU or storage.

Question 7

A network engineer runs the following command on Router R1:

R1# show ip access-lists 101

Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 23 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet traffic from any source is denied.. The ACL explicitly denies TCP traffic to port 23 (Telnet) from any source, as shown by the 'deny tcp any any eq 23' statement with 50 matches. This rule is processed before the final permit any any, so Telnet traffic is denied regardless of the source IP.

Answer

Telnet traffic from 192.168.1.0/24 is permitted.

Answer

HTTP traffic from any source is permitted.

Answer

All traffic is permitted because of the last entry.

Question 8

An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?

Accepted Answer

The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.. The DHCP server resides in VRF CORP, but the DHCP relay agent on the guest SVI forwards the discover packet within VRF GUEST. Without a route from VRF GUEST to the DHCP server's subnet in VRF CORP, the relayed packet cannot reach the server. Inter-VRF routing (e.g., a route leak or VRF-aware service) is required for the relay to forward the packet across VRFs.

Answer

The DHCP relay agent is not configured to use the VRF GUEST; the ip helper-address command must be applied under the VRF interface, but the DHCP server is in a different VRF, requiring inter-VRF routing or the use of the ip dhcp relay information option.

Answer

The DHCP server is not configured with a scope for the guest subnet.

Answer

The guest VRF is missing the ip dhcp relay command globally.

Question 9

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Accepted Answer

Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.. The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.

Answer

Manually shut down the access ports that have unknown MAC addresses in the binding table.

Answer

Disable Dynamic ARP Inspection on VLAN 10.

Answer

Disable IP Source Guard on all access ports in VLAN 10.

Question 10

Which three statements about Cisco DNA Center software image management are true? (Choose three.)

Accepted Answer

Cisco DNA Center allows administrators to define a golden image for each device family to enforce consistent software versions.. DNA Center provides centralized image management with golden images, distributed upgrades, and compliance checks. The correct answers cover these key features. The incorrect options confuse image management with configuration backup or misstate the upgrade process (no automatic reboot without approval).

Answer

Cisco DNA Center automatically reboots devices after an image upgrade without any administrator confirmation.

Answer

Cisco DNA Center uses the device's configuration file to determine the required image version.

Question 11

Drag and drop the steps of EtherChannel load-balancing hash configuration into the correct order, from first to last.

Accepted Answer

Choose hash algorithm (src-dst-ip, src-dst-mac). Configuration begins with selecting hash algorithm, then applying it globally, verifying on interfaces, checking load distribution, and finally adjusting if needed.

Question 12

Which two statements about Cisco SD-WAN overlay routing and OMP are true? (Choose two.)

Accepted Answer

OMP (Overlay Management Protocol) is used to exchange routing, policy, and service information between vSmart controllers and vEdge routers.. OMP is the protocol used to exchange routing and service information between vSmart and vEdge devices. It supports both IPv4 and IPv6 prefixes. OMP does not run between vEdge routers directly; it is a client-server protocol with vSmart as the server. OMP routes are not redistributed into BGP by default; redistribution must be configured. OMP uses TCP port 12346, not UDP.

Answer

OMP runs directly between vEdge routers to establish a full mesh of routing adjacencies.

Answer

OMP routes are automatically redistributed into the local BGP process on the vEdge router.

Answer

OMP uses UDP port 12346 for communication between vSmart and vEdge devices.

Question 13

A network engineer is using the Cisco Meraki Dashboard API to automate the creation of VLANs across multiple networks. The engineer writes a Python script that uses the 'createNetworkVlan' endpoint. The script runs successfully for the first few networks, but then starts returning HTTP 429 errors. The engineer checks the API documentation and finds that the Meraki API has rate limits. The script currently sends requests as fast as possible. What should the engineer implement to avoid hitting the rate limit?

Accepted Answer

Add a retry mechanism with exponential backoff when a 429 response is received.. HTTP 429 errors indicate rate limiting, and the standard mitigation is to implement a retry mechanism with exponential backoff. This approach respects the API's rate limits by pausing and retrying after increasing delays, allowing the script to eventually succeed without overwhelming the server. The Meraki Dashboard API documentation explicitly recommends exponential backoff for handling 429 responses.

Answer

Reduce the number of networks being processed in a single script run.

Answer

Increase the 'per-second' rate limit by setting a higher value in the API request header.

Answer

Switch to using the Meraki API version 1.0 which has no rate limits.

Question 14

Examine the following configuration on a Cisco IOS-XE router:

ip multicast-routing distributed
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip pim sparse-dense-mode
 ip igmp version 2
!

Which statement about this configuration is true?

Accepted Answer

Multicast routing is enabled with distributed switching, and the interface will use sparse-mode if an RP is known for the group, otherwise dense-mode.. The command 'ip multicast-routing distributed' enables multicast routing with distributed switching (hardware offload) on Cisco IOS-XE. The 'ip pim sparse-dense-mode' command configures the interface to operate in sparse-mode if a valid RP is known for the multicast group; otherwise, it falls back to dense-mode. This is the standard behavior of sparse-dense mode, making option C correct.

Answer

The interface will operate in dense-mode for all multicast groups because no RP is configured.

Answer

The router will only support IGMPv2, and IGMPv3 queries will be ignored.

Answer

The configuration is invalid because 'ip multicast-routing distributed' is not a valid command.

Question 15

Drag and drop the steps of NFV MANO (VNFM/NFVO/VIM) interaction flow into the correct order, from first to last.

Accepted Answer

NFVO receives service request from OSS/BSS. The interaction flow begins with the NFVO receiving a service request from OSS/BSS. The NFVO then requests resource allocation from the VIM. The VIM allocates resources and reports back. Next, the NFVO instructs the VNFM to instantiate the VNF. Finally, the VNFM configures and starts the VNF on the allocated resources.

Question 16

Given this OSPF configuration:

router ospf 1
 router-id 1.1.1.1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 1
 default-information originate always

What is the effect of the 'default-information originate always' command?

Accepted Answer

OSPF will advertise a default route into all OSPF areas even if no default route is present in the routing table.. The 'default-information originate always' command instructs OSPF to generate and advertise a default route (0.0.0.0/0) into the OSPF domain as a Type 5 External LSA, regardless of whether a default route exists in the router's own routing table. This ensures that all OSPF routers in every area receive the default route, making the advertising router a gateway of last resort.

Answer

OSPF will only advertise a default route if a default route is already in the routing table.

Answer

OSPF will redistribute all connected routes as type 5 LSAs.

Answer

OSPF will generate a default route only for area 0.

Question 17

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Accepted Answer

Security Group Access Control Lists (SGACLs). Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

Answer

Change of Authorization (CoA)

Answer

802.1X authentication

Answer

MACsec encryption

Question 18

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

Accepted Answer

10 seconds. On broadcast multi-access networks like Ethernet, OSPF defaults to a hello interval of 10 seconds. This is defined in RFC 2328 and is used to maintain neighbor relationships and detect failures quickly. The corresponding dead interval is 40 seconds (4 times the hello interval).

Answer

5 seconds

Answer

30 seconds

Answer

40 seconds

Question 19

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Accepted Answer

VXLAN overlay with policy-based forwarding to direct traffic through VNFs. VXLAN overlay with policy-based forwarding (PBF) is the correct choice because it enables service chaining by encapsulating traffic and steering it through a sequence of VNFs based on policies, without requiring physical re-cabling. This allows dynamic insertion of new VNFs by simply updating the forwarding policies in the overlay, which is essential for NFV environments where VNFs are hosted on the same server and must be chained flexibly.

Answer

VLAN trunking between VNFs on the same hypervisor

Answer

Static routing between VNFs using dedicated interfaces

Answer

MPLS L3VPN between VNFs

Question 20

Drag and drop each multicast tree type on the left to its matching description on the right.

Accepted Answer

Shortest Path Tree (SPT): A source-specific multicast tree rooted at the source. SPT is a source-specific tree rooted at the source; RPT is a shared tree rooted at the RP; Bidir tree is a shared tree used in Bidir PIM; (*,G) tree is a shared tree for all sources; (S,G) tree is a source-specific tree.