350-401 Mock Exam 83 — 25 Questions

Question 1

A network engineer needs to secure management access to a Cisco IOS XE router. The requirement is to encrypt all management traffic, including SNMP, and to authenticate administrators against a centralized server. Which combination of features should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSH for CLI access, SNMPv3 with authPriv, and TACACS+ for authentication.. SSH, SNMPv3 authPriv, and TACACS+ together provide encrypted CLI access, authenticated and encrypted SNMP, and centralized administrator authentication. The other options either use clear-text protocols like Telnet or SNMPv2c, or rely on local authentication, failing the encryption and centralization requirements.

Answer

HTTPS for CLI access, SNMPv3 with noAuthNoPriv, and TACACS+ for authentication.

Answer

SSH for CLI access, SNMPv2c with an ACL, and local authentication.

Answer

Telnet for CLI access, SNMPv2c with a community string, and RADIUS for authentication.

Question 2

A network engineer is implementing Cisco SD-Access and needs to understand the role of the LISP protocol. Which statement accurately describes the function of LISP in SD-Access?

Accepted Answer

LISP provides the control plane for mapping endpoint identities to their locations.. LISP in SD-Access acts as the control plane, separating endpoint identity from location. It maintains a mapping database that fabric edge nodes query to resolve EID-to-RLOC mappings, enabling scalable endpoint mobility and fabric operations. The data plane uses VXLAN, while policy is enforced via TrustSec SGTs.

Answer

LISP dynamically assigns IP addresses to endpoints in the fabric.

Answer

LISP enforces security policies between fabric segments.

Answer

LISP is used for data plane encapsulation between fabric nodes.

Question 3

A network engineer is deploying a new branch office that uses a single switch stack with two member switches. The stack must forward traffic between access ports in different VLANs without involving an external router. Which feature should be configured to meet this requirement?

Accepted Answer

Configure an SVI for each VLAN on the switch stack and enable IP routing with the ip routing command.. The requirement is to route traffic between VLANs using the switch stack itself. Creating switched virtual interfaces for each VLAN and enabling IP routing allows the stack to perform inter-VLAN routing without an external router. This is a standard design for collapsed core or branch offices where a multilayer switch provides both Layer 2 and Layer 3 forwarding.

Answer

Configure private VLANs on the access ports to allow communication between VLANs.

Answer

Configure VTP transparent mode on all switches and create the VLANs manually.

Answer

Configure 802.1Q trunk links between the two stack members and enable dynamic ARP inspection.

Question 4

A network engineer is writing a Python script using the ncclient library to retrieve the running configuration from a Cisco IOS XE device. The script connects using NETCONF over SSH on port 830. The engineer wants to filter the response to only include interface configuration data. Which NETCONF operation should be used to retrieve the configuration with a filter?

Accepted Answer

with a of and a element.. The operation is specifically designed to retrieve configuration data from a datastore. It supports a element to select specific portions of the configuration, such as interfaces. This allows the engineer to retrieve only the desired data, reducing payload size and processing time.

Answer

with a element.

Answer

with a of .

Answer

with a of .

Question 5

A network designer is evaluating a virtual switch deployment in a Cisco ACI fabric. The requirement is to extend a bridge domain across multiple leaf switches while allowing the fabric to perform distributed IP routing at the leaf for endpoints in that bridge domain. Which ACI construct should the designer use?

Accepted Answer

A bridge domain with hardware proxy and unicast routing enabled. In Cisco ACI, distributed first-hop routing is achieved by enabling unicast routing on the bridge domain and using the hardware proxy anycast gateway. This programs the same gateway IP and MAC on every leaf, so endpoints are routed at their ingress leaf. The other constructs address isolation, service insertion, or static endpoint attachment, none of which delivers distributed routing.

Answer

A VRF with policy-based redirect to a service graph

Answer

A tenant with a single EPG mapped to a static path

Answer

A private network with an external bridged domain

Question 6

A network engineer is configuring IPsec VPN on a Cisco IOS XE router. The requirement is to protect traffic between two sites using ESP with AES-256 encryption and SHA-256 authentication, and to ensure that the tunnel is rekeyed every 3600 seconds. Which configuration element directly controls the rekey interval?

Accepted Answer

crypto ipsec security-association lifetime seconds 3600. The IPsec SA lifetime, configured with 'crypto ipsec security-association lifetime seconds 3600', determines when the data tunnel is rekeyed. This is distinct from the IKE SA lifetime, which governs the control plane. The transform-set defines the algorithms (AES-256, SHA-256), the crypto map ties the policy together, and the pre-shared key authenticates the peers, but only the security-association lifetime command controls the rekey interval.

Answer

crypto ipsec transform-set <name> esp-aes 256 esp-sha256-hmac

Answer

crypto map <name> 10 ipsec-isakmp

Answer

crypto isakmp key address

Question 7

A network engineer is designing a QoS policy for a WAN edge router. The router must prioritize voice traffic with strict priority while ensuring that other traffic classes are not starved. The engineer decides to use Low Latency Queueing (LLQ). Which additional mechanism should be configured to prevent starvation of other queues when voice traffic exceeds its allocated bandwidth?

Accepted Answer

Policing on the voice class to limit its bandwidth. LLQ provides a strict priority queue for voice, but without a policer, the priority queue can consume all available bandwidth and starve other queues. Configuring policing on the voice class limits the priority traffic to a defined rate, ensuring that other classes receive their configured bandwidth. This is the recommended practice for LLQ.

Answer

Weighted Random Early Detection (WRED) on the voice queue

Answer

Traffic shaping on the voice class to smooth bursts

Answer

Class-Based Weighted Fair Queueing (CBWFQ) on the voice class

Question 8

A network engineer is configuring a Cisco Catalyst 9000 switch to support a VXLAN EVPN fabric. The engineer wants to enable the switch to act as a VTEP and perform VXLAN encapsulation and decapsulation. Which command must be configured to create the VXLAN tunnel interface?

Accepted Answer

interface nve 1. To enable VXLAN on a Cisco switch, you must create an NVE interface using the 'interface nve 1' command. This interface is responsible for VXLAN encapsulation and decapsulation. Other interface types like tunnel, vxlan, or vlan do not provide VXLAN functionality.

Answer

interface vlan 1

Answer

interface tunnel 1

Answer

interface vxlan 1

Question 9

A network administrator is deploying a Cisco SD-WAN solution. The administrator wants to ensure that control plane information is securely distributed between vSmart controllers and vEdge routers. Which protocol does Cisco SD-WAN use for this purpose?

Accepted Answer

OMP. Cisco SD-WAN uses Overlay Management Protocol (OMP) for control plane communication between vSmart controllers and vEdge routers. OMP distributes routing, policy, and service information, and it runs over secure TLS/DTLS sessions. While BGP, IPsec, and DTLS play roles in SD-WAN, OMP is the specific control plane protocol that enables the overlay network's dynamic routing and policy enforcement.

Answer

BGP

Answer

IPsec

Answer

DTLS

Question 10

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. Hosts in the same subnet are attached to different edge nodes. The engineer must ensure that a host retains its default gateway IP and MAC address when it moves between edge nodes. Which technology should be configured on the edge nodes?

Accepted Answer

Anycast gateway with the same IP and MAC address on all edge nodes for that subnet. A distributed anycast gateway assigns the same virtual IP and virtual MAC to the default gateway on every edge node hosting a subnet. Hosts can move between edge nodes without changing their gateway ARP entry, which preserves connectivity and avoids suboptimal paths. This is a fundamental requirement for seamless host mobility in VXLAN EVPN fabrics.

Answer

VRRP with preemption enabled on all edge nodes

Answer

HSRP group with a unique virtual IP per edge node

Answer

Proxy ARP on the edge nodes

Question 11

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones and a data VLAN to connected PCs on the same port. The phones are Cisco and use CDP to communicate VLAN information. Which configuration should be applied to the switch port?

Accepted Answer

Configure the port as an access port in the data VLAN and enable the voice VLAN with the 'switchport voice vlan' command.. The correct configuration is to set the port as an access port in the data VLAN and then specify the voice VLAN using the 'switchport voice vlan' command. This allows the switch to use CDP to inform the IP phone of the voice VLAN, so the phone tags its voice traffic with the appropriate VLAN ID while the PC's data traffic remains untagged in the access VLAN. This is the Cisco best practice for connecting IP phones and PCs to the same switch port.

Answer

Configure the port as a dynamic auto port and set the voice VLAN to be negotiated via DTP.

Answer

Configure the port as a private VLAN host port and map the voice VLAN as a secondary VLAN.

Answer

Configure the port as a trunk with native VLAN for data and allow the voice VLAN.

Question 12

A network engineer is deploying a Cisco SD-Access fabric and needs to ensure that endpoints can communicate with devices outside the fabric. The engineer configures a fabric border node. Which functionality does the border node provide in this architecture?

Accepted Answer

It provides connectivity between the fabric and external networks, such as data centers or the internet.. In Cisco SD-Access, the fabric border node serves as the gateway between the fabric and external networks. It performs VXLAN-to-traditional network translation, allowing fabric endpoints to communicate with external destinations. It also advertises external routes into the fabric and fabric prefixes to external networks. The border node does not handle endpoint authentication, mapping database services, or control plane functions; those are handled by edge nodes and control plane nodes respectively.

Answer

It authenticates endpoints and assigns them to fabric VNs based on policy.

Answer

It acts as the mapping database system that stores endpoint location information.

Answer

It encapsulates fabric traffic into VXLAN and forwards it to the control plane node.

Question 13

A network engineer is configuring a Cisco IOS router to support OSPFv3 for IPv6. The router must form adjacencies on its GigabitEthernet0/0 interface, which is assigned to area 0. Which command is required to enable OSPFv3 on the interface?

Accepted Answer

ipv6 ospf 1 area 0. To enable OSPFv3 on an interface, you use the interface configuration command 'ipv6 ospf area '. This command activates OSPFv3 on the interface and assigns it to the specified area. The process ID must match the one configured globally with 'ipv6 router ospf '. The other options are invalid commands or incorrect syntax.

Answer

ospf ipv6 1 area 0

Answer

router ospfv3 1 area 0

Answer

ipv6 router ospf 1 area 0

Question 14

A network administrator is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to a SaaS application. The administrator suspects that the issue is related to the application-aware routing policy not correctly identifying the application. Which component of Cisco SD-WAN is responsible for identifying applications in the data plane?

Accepted Answer

vEdge router. Application identification in Cisco SD-WAN is performed by the vEdge router, which uses deep packet inspection (DPI) or Cisco NBAR to recognize applications. This classification is critical for application-aware routing, as it enables the router to apply policies that steer traffic based on application performance. The vEdge router then forwards traffic accordingly, ensuring that SaaS applications receive appropriate treatment.

Answer

vBond orchestrator

Answer

vSmart controller

Answer

vManage NMS

Question 15

A network engineer is implementing Cisco TrustSec in a campus network. The requirement is to classify traffic based on the identity of the user and the device, and to enforce policy across the network without relying on IP addresses. Which component assigns the Security Group Tag (SGT) to the packet at ingress?

Accepted Answer

The ingress access layer switch or router inserts the SGT into the packet using inline tagging or SXP.. In Cisco TrustSec, the ingress network device classifies traffic and imposes the SGT after receiving the classification from ISE. Tag propagation uses inline tagging or SXP, and egress devices enforce Security Group ACLs based on source and destination SGTs. The policy decision comes from ISE, but tag imposition happens at the ingress enforcement point.

Answer

The egress switch removes the SGT and applies the Security Group ACL based on the source IP address.

Answer

The Cisco DNA Center appliance assigns the SGT during fabric VXLAN encapsulation.

Answer

The Cisco Identity Services Engine (ISE) assigns the SGT directly into the packet header.

Question 16

A network architect is evaluating Cisco SD-Access fabric deployment options for a large campus. The design team wants to understand the roles that fabric nodes play in forwarding traffic and in connecting the fabric to external networks. Which two statements accurately describe Cisco SD-Access fabric node roles? (Choose two.)

Accepted Answer

Fabric border nodes connect the SD-Access fabric to external networks and perform route redistribution between the fabric and external routing domains.. In Cisco SD-Access, fabric edge nodes encapsulate endpoint traffic in VXLAN and register EIDs with the control-plane node, while fabric border nodes connect the fabric to external networks and redistribute routes. Those two roles match the accurate statements, whereas intermediate and control-plane responsibilities are assigned incorrectly elsewhere.

Answer

Fabric intermediate nodes maintain the LISP map database and answer EID-to-RLOC queries from edge nodes.

Answer

Fabric border nodes are responsible for registering wired endpoint EIDs and building VXLAN tunnels to access switches.

Answer

Fabric edge nodes run the LISP map-server and map-resolver functions for the entire fabric.

Question 17

A network architect is designing a three-tier campus network with a pair of Cisco Catalyst 9500 switches at the core. The design requires that the core layer avoid maintaining a large MAC address table and instead forward traffic based on Layer 3 reachability. Which technology should be implemented on the core switches to meet this requirement?

Accepted Answer

Layer 3 switching with routed ports. In a three-tier campus design, the core layer should be optimized for high-speed Layer 3 forwarding. Using routed ports on the core switches eliminates Layer 2 switching and MAC address table scaling concerns, allowing the core to forward solely based on Layer 3 reachability. This aligns with Cisco's recommended design for large campus networks.

Answer

VLAN Trunking Protocol pruning

Answer

Routed access layer

Answer

Cisco StackWise Virtual

Question 18

A network engineer is implementing Cisco TrustSec in a campus network. Which two components are required to enable Security Group Tagging (SGT) and enforcement? (Choose two.)

Accepted Answer

Cisco Identity Services Engine (ISE). To implement Cisco TrustSec with SGT tagging and enforcement, Cisco ISE is required to assign SGTs and define policies, and SXP is needed to propagate SGT mappings to non-TrustSec-capable devices. Together, they enable scalable group-based access control across the network.

Answer

Spanning Tree Protocol (STP) root guard

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Access Control List (ACL) for each user

Question 19

A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when a switch's health score drops below a threshold. Which Assurance feature should be configured to generate these alerts?

Accepted Answer

Assurance Issues and Notifications. To generate alerts when a switch's health score drops below a threshold, the administrator must configure Assurance Issues and Notifications in Cisco DNA Center. This feature allows defining specific health score conditions and setting up notification channels such as email or webhooks. The Network Health Dashboard is for visualization, Path Trace for troubleshooting, and Sensor-driven tests for proactive monitoring, none of which provide threshold-based alerting directly.

Answer

Sensor-driven tests

Answer

Network Health Dashboard

Answer

Path Trace

Question 20

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco IP phone with a PC attached to the phone's data port. The requirement is to authenticate both the phone and the PC separately, with the phone in the voice VLAN and the PC in the data VLAN. Which 802.1X feature should be enabled?

Accepted Answer

Multi-Domain Authentication (MDA). Multi-Domain Authentication (MDA) is designed for scenarios where a voice device and a data device share a switch port. It allows both to authenticate independently and assigns them to their respective VLANs, meeting the requirement for separate authentication and VLAN segmentation.

Answer

Multi-Authentication (Multi-Auth)

Answer

MAC Authentication Bypass (MAB)

Answer

Web Authentication (WebAuth)