350-401 Mock Exam 86 — 25 Questions

Question 1

A network architect is designing a Cisco SD-Access fabric for a campus network. The architect wants to ensure that endpoints in the same virtual network can communicate with each other even when they are attached to different fabric edge nodes. Which control plane component is responsible for resolving endpoint location information across the fabric?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fabric control plane node. The fabric control plane node in Cisco SD-Access implements LISP map-server and map-resolver functions. It maintains a database of endpoint IP addresses and their corresponding fabric edge node RLOCs. When an endpoint on one edge node needs to communicate with an endpoint on another edge node, the source edge node queries the control plane node to learn the destination's location, enabling VXLAN encapsulation and delivery.

Answer

Cisco DNA Center

Answer

Fabric border node

Answer

Cisco Identity Services Engine (ISE)

Question 2

A network engineer is configuring a Cisco IOS XE router to support NETCONF over SSH for automated configuration. The management application requires that the router expose a standards-based data model and that configuration changes be applied as complete, atomic transactions. Which action must the engineer take?

Accepted Answer

Enable the NETCONF-YANG feature with the netconf-yang command and use the candidate datastore with the commit operation. NETCONF over SSH is enabled on Cisco IOS XE with the netconf-yang command, which starts the NETCONF server on TCP 830 and loads the YANG models. The candidate datastore plus commit gives transactional behavior: changes are staged, validated, and applied atomically, with rollback possible on failure. This is the standards-based, model-driven approach the automation application requires.

Answer

Configure SNMPv3 with authPriv and use SET operations to push the configuration

Answer

Enable the guest shell and run Python scripts that call the CLI parser for configuration

Answer

Enable the RESTCONF API with the ip http secure-server command and use the YANG models exposed there

Question 3

A network engineer is designing a high-availability campus network using Cisco StackWise Virtual technology on two Cisco Catalyst 9000 switches. The engineer wants to ensure that the control plane remains operational if one switch fails, and that the data plane can continue forwarding traffic with minimal disruption. Which statement accurately describes the operation of StackWise Virtual in this scenario?

Accepted Answer

One switch is active for control plane and management, while the other is standby; both switches forward data traffic using a unified data plane.. Cisco StackWise Virtual merges two physical switches into one logical switch. The active switch runs the control plane and management, while the standby switch is ready to take over. Both switches forward data traffic, providing active/active forwarding. This design ensures high availability: if the active switch fails, the standby becomes active, and data forwarding continues on the remaining switch with minimal disruption.

Answer

StackWise Virtual requires a dedicated Layer 3 link for control plane synchronization, and data traffic is forwarded only by the active switch.

Answer

The two switches load-balance control plane functions, with each switch managing a subset of VLANs and routing protocols independently.

Answer

Both switches run independent control planes and synchronize routing tables via a dedicated link, with each switch forwarding traffic independently.

Question 4

A network engineer is writing a Python script to interact with a Cisco IOS XE device using RESTCONF. The engineer wants to retrieve the current configuration of a specific interface. Which HTTP method and URI should be used?

Accepted Answer

GET https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1. To retrieve configuration data via RESTCONF, the GET method must be used with a URI that correctly identifies the resource. The URI must follow the RESTCONF syntax for list keys, which uses key=value. The correct option uses GET and the proper URI format to access the specific interface. The other options use incorrect HTTP methods or malformed URIs, which would not retrieve the desired data.

Answer

PUT https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Answer

POST https://<device>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Answer

GET https://<device>/restconf/data/ietf-interfaces:interfaces/interface/GigabitEthernet1

Question 5

A network engineer is configuring a Cisco IOS switch and needs to ensure that a port connected to a server is placed into the forwarding state immediately when the link comes up, without going through the listening and learning states. The engineer also wants to protect against accidental loops if a switch is connected to that port. Which feature should be configured on the port?

Accepted Answer

PortFast with BPDU Guard. PortFast transitions a port immediately to forwarding, which is ideal for server connections. BPDU Guard disables the port if a BPDU is received, preventing loops if a switch is mistakenly connected. The combination provides both fast connectivity and loop protection, making it the correct choice for this scenario.

Answer

UplinkFast

Answer

BackboneFast

Answer

Root Guard

Question 6

A network engineer is implementing VXLAN on a Cisco Nexus 9000 series switch running NX-OS. The underlay network uses OSPF and the loopback0 interface of each VTEP is advertised. The engineer wants to verify that the VXLAN tunnel endpoints can communicate. Which command should be used to check the VXLAN tunnel status?

Accepted Answer

show nve peers. The 'show nve peers' command is the correct way to verify VXLAN tunnel endpoint communication. It provides details about peer VTEPs, including their IP addresses and state. This command is essential for troubleshooting VXLAN overlay connectivity, as it directly shows whether tunnels are established and operational.

Answer

show interface tunnel

Answer

show vxlan interface

Answer

show ip ospf neighbor

Question 7

A security team wants to deploy MACsec on a Cisco Catalyst switch uplink between two buildings to protect Layer 2 traffic. The switches are Cisco Catalyst 9300 series running IOS XE, and the link must encrypt all frames between them. Which statement accurately describes a requirement for this deployment?

Accepted Answer

MACsec requires that both switches support the MACsec feature and that a connectivity association key be configured or negotiated before encrypted traffic can flow.. MACsec secures Layer 2 links by encrypting frames using keys derived from a connectivity association. Both endpoints must support MACsec and share matching key material, either pre-shared or via MKA. This allows the uplink between the Catalyst switches to carry encrypted traffic, meeting the requirement to protect all frames on that link.

Answer

MACsec can only be enabled on routed ports, so the uplink must be converted from a switchport to a no switchport interface.

Answer

MACsec encrypts only control plane traffic, so data frames between the switches would remain in clear text.

Answer

MACsec requires that 802.1X authentication be completed on the link before any encryption keys can be generated.

Question 8

A network engineer needs to provide secure remote-access VPN connectivity for employees using Cisco AnyConnect. The requirement is to use digital certificates issued by the corporate PKI for both server and client authentication. Which component must be configured on the Cisco ASA to validate client certificates presented during the VPN session?

Accepted Answer

A trustpoint containing the CA certificate that signed the client certificates.. Certificate-based client authentication requires the ASA to trust the CA that issued the client certificates. Configuring a trustpoint with the CA certificate allows the ASA to validate the chain presented by AnyConnect. Pre-shared keys, local user accounts, and LDAP attribute maps do not perform certificate validation and therefore cannot fulfill the PKI-based authentication requirement.

Answer

A local user account with the privilege level 15 assigned.

Answer

An IKEv2 pre-shared key configured under the tunnel group.

Answer

An LDAP attribute map for group policy assignment.

Question 9

A network engineer is configuring a new Cisco Catalyst switch that will participate in a VTP domain. The switch must not be able to create, modify, or delete VLANs, but it must synchronize its VLAN database with the current VTP server. Which VTP mode should be configured on this switch?

Accepted Answer

VTP client mode. VTP client mode is designed for switches that should receive VLAN configuration from VTP servers but not modify it. The switch will synchronize its VLAN database with advertisements from the server, ensuring consistency, while its configuration interface prevents local VLAN creation or deletion. This satisfies both constraints: no VLAN changes and synchronization with the server.

Answer

VTP transparent mode

Answer

VTP off mode

Answer

VTP server mode

Question 10

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce role-based access control between endpoints without relying on IP addresses or VLANs, and they need to ensure that access policies are consistently applied even when endpoints move between switches. The administrator has already configured Cisco ISE for authentication and authorization. Which technology should be used to propagate the security group tag (SGT) information to network devices that do not support SGT tagging natively?

Accepted Answer

SXP (SGT Exchange Protocol). SXP is designed to share SGT-to-IP bindings with devices that cannot natively tag packets with SGTs, enabling consistent role-based access control across mixed hardware. The other options either provide encryption, authentication, or tunneling but do not propagate SGT information. In a Cisco TrustSec deployment where some switches lack hardware SGT support, SXP bridges the gap so that SGACLs can still be enforced based on the endpoint's security group.

Answer

MACsec (802.1AE)

Answer

IPsec VPN tunnels

Answer

802.1X with EAP-TLS

Question 11

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer wants to ensure that the VXLAN traffic is encapsulated and forwarded correctly over the underlay network. Which statement describes the VXLAN encapsulation and forwarding process?

Accepted Answer

VXLAN encapsulates Layer 2 frames in UDP packets with a destination port of 4789, and the VTEP performs a lookup in the underlay routing table to forward the encapsulated packet to the remote VTEP.. VXLAN encapsulates original Layer 2 frames into UDP packets, with the outer UDP destination port typically 4789. The VTEP adds an outer IP header and forwards the packet based on the underlay network's routing table. This allows the overlay Layer 2 network to span across a Layer 3 underlay. The encapsulation process preserves the original frame, and the underlay routing ensures the packet reaches the remote VTEP.

Answer

VXLAN encapsulates Layer 2 frames in UDP packets with a destination port of 4789, and the VTEP uses the overlay routing table to forward the encapsulated packet to the remote VTEP.

Answer

VXLAN encapsulates Layer 3 packets in UDP packets with a destination port of 4789, and the VTEP performs a lookup in the underlay routing table to forward the encapsulated packet to the remote VTEP.

Answer

VXLAN encapsulates Layer 2 frames in GRE tunnels, and the VTEP uses the underlay routing table to forward the encapsulated packet to the remote VTEP.

Question 12

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and is managed over SSH. The administrator needs to protect the route processor from excessive BGP and SSH traffic without breaking the existing sessions. Which action should be taken when applying the CoPP policy?

Accepted Answer

Apply the policy-map to the control-plane interface using the service-policy input command.. CoPP is designed to classify and police traffic destined to the route processor. The policy-map must be attached to the control-plane interface with service-policy input so that only CPU-bound traffic is policed while transit traffic remains unaffected, preserving BGP peering and SSH management access.

Answer

Apply the policy-map to the management VRF interface using service-policy input.

Answer

Apply the policy-map globally with the service-policy command in global configuration mode.

Answer

Apply the policy-map to each ISP-facing physical interface with service-policy output.

Question 13

A network architect is designing a Cisco SD-Access fabric for a campus network. The architect wants to ensure that endpoints in the same virtual network can communicate with each other even when they are attached to different fabric edge nodes. Which control plane component is responsible for resolving endpoint location information across the fabric?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Control plane node. The control plane node hosts the LISP map-server and map-resolver, which together maintain the EID-to-RLOC mappings that tell fabric edge nodes where each endpoint is located. This mapping is essential for directing traffic to the correct edge node within the SD-Access fabric.

Answer

Fabric intermediate node

Answer

Fabric border node

Answer

Fabric wireless controller

Question 14

A network engineer is hardening a Cisco IOS XE router that terminates IPsec site-to-site tunnels with remote branches. The security policy requires that the router only accept IKEv2 negotiations using cryptographically strong parameters and that it validate peer identity via certificates issued by the corporate PKI. Which two configuration elements must the engineer apply to meet these requirements? (Choose two.)

Accepted Answer

Configure an IKEv2 proposal that includes aes-cbc-256 for encryption, sha512 for integrity, and group 19 for the DH key exchange.. Meeting the policy requires two things: an IKEv2 proposal that enforces strong encryption, integrity, and DH groups, and an IKEv2 profile that authenticates both local and remote peers with RSA signatures validated against the corporate PKI trustpoint. PSK keyrings, DPD timers, and SA throttling controls address other concerns and do not satisfy the cryptographic-strength or certificate-validation requirements.

Answer

Configure 'crypto ikev2 limit max-in-negotiation-sa 10' on the router to throttle aggressive IKEv2 negotiations.

Answer

Configure 'crypto ikev2 dpd 10 3 periodic' to detect dead peers and tear down stale SAs quickly.

Answer

Configure an IKEv2 keyring with pre-shared keys per peer and bind the keyring to the IKEv2 profile.

Question 15

A network engineer must protect the OSPF adjacency between two Cisco routers from spoofed hello packets injected by a rogue device on the same broadcast segment. The engineer wants to use a cryptographic authentication method that is natively supported by OSPFv2 and does not rely on plain-text key exchange. Which configuration should be applied to the interfaces?

Accepted Answer

ip ospf authentication message-digest and ip ospf message-digest-key 1 md5 <key>. OSPFv2 supports two authentication types: simple password and message-digest (MD5). Only message-digest provides cryptographic protection, because it hashes the packet with a shared key rather than transmitting the key. Enabling ip ospf authentication message-digest on the interface plus defining ip ospf message-digest-key with an MD5 key ensures hellos are authenticated and spoofed packets from a rogue host are rejected before the adjacency can be affected.

Answer

ip ospf authentication-key <key>

Answer

ip ospf authentication key-chain <name>

Answer

ip ospf authentication null

Question 16

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The administrator needs to verify which traffic classes are being matched and how many packets are being dropped by the policy. Which command should be used to display the CoPP policy statistics and class-map information?

Accepted Answer

show policy-map control-plane. The show policy-map control-plane command is specifically designed to display the CoPP policy configuration and per-class statistics, including matched and dropped packets. It allows the administrator to verify which traffic classes are being matched and how many packets are being dropped by the policy. The other commands either show only class-map definitions or interface-level policy statistics, which are not relevant to the control plane.

Answer

show policy-map interface

Answer

show class-map

Answer

show control-plane host open-ports

Question 17

A network engineer is configuring VXLAN on a Cisco Nexus switch. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between hosts in the same VXLAN segment across the Layer 3 underlay. Which two statements are true about VXLAN operation? (Choose two.)

Accepted Answer

VXLAN encapsulates original Ethernet frames in UDP.. VXLAN uses a 24-bit VNI to identify Layer 2 segments, supporting up to 16 million segments, and encapsulates original Ethernet frames in UDP (port 4789) to extend Layer 2 over a Layer 3 underlay. Multicast is not mandatory, and VTEPs do not require Layer 2 adjacency. The 12-bit identifier is for VLANs, not VXLAN.

Answer

VXLAN tunnel endpoints must be directly connected at Layer 2.

Answer

VXLAN requires a multicast underlay for all deployments.

Answer

VXLAN uses a 12-bit identifier to maintain compatibility with VLANs.

Question 18

A network administrator is configuring a Cisco Catalyst switch to assign a voice VLAN to IP phones. The phones will tag voice traffic with VLAN 200, and data traffic from attached PCs should be untagged in VLAN 10. Which interface configuration correctly implements this?

Accepted Answer

Switchport mode access, switchport access vlan 10, switchport voice vlan 200. The correct configuration uses an access port for data VLAN 10 and the switchport voice vlan command for voice VLAN 200. This enables the switch to send CDP/LLDP-MED instructions to the phone to tag voice traffic in VLAN 200 while data remains untagged in VLAN 10. It is the standard Cisco IP telephony deployment.

Answer

Switchport mode trunk, switchport trunk native vlan 10, switchport trunk allowed vlan 200

Answer

Switchport mode trunk, switchport trunk encapsulation dot1q, switchport trunk native vlan 200

Answer

Switchport mode access, switchport access vlan 200, switchport voice vlan 10

Question 19

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured for VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from other VTEPs. The underlay routing is working, and MP-BGP EVPN peering is established. Which configuration issue could prevent the switch from learning remote MAC addresses?

Accepted Answer

The VNI is not mapped to the correct VLAN in the EVPN configuration.. In VXLAN EVPN, the VNI must be mapped to the correct VLAN for the switch to associate EVPN routes with local VLANs and learn remote MAC addresses. If the mapping is missing or incorrect, the switch cannot install remote MACs into the MAC address table, even if EVPN peering is up and the underlay is functional.

Answer

The BGP router ID is not unique.

Answer

The underlay OSPF cost is too high.

Answer

The switch is configured with a static VXLAN tunnel instead of a dynamic one.

Question 20

A network engineer is implementing IPsec VPN on a Cisco IOS XE router to connect a branch office to headquarters. The engineer must ensure that the IKEv2 negotiation uses strong authentication and that the data plane is protected with integrity and encryption. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Configure an IKEv2 keyring or PKI trustpoint to authenticate the peers.. IKEv2 requires peer authentication, provided by a keyring with pre-shared keys or a PKI trustpoint. The data plane is protected by an IPsec transform set that specifies ESP encryption and authentication algorithms. Both elements must be configured and referenced correctly in the IPsec profile or crypto map. The other options either apply to IKEv1 or do not provide the required security functions.

Answer

Configure 'crypto isakmp policy' with pre-shared key authentication for IKEv1.

Answer

Configure 'crypto ipsec profile' with 'set security-association lifetime seconds 3600' only.

Answer

Configure a crypto ACL with 'permit ip any any' to match all traffic.