350-401 Mock Exam 87 — 25 Questions

Question 1

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that carries eBGP, OSPF, SSH management, and SNMP traffic. The engineer wants to ensure that BGP and OSPF routing updates are never dropped while still rate-limiting SSH and SNMP. Which CoPP configuration approach best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate class-maps for BGP, OSPF, SSH, and SNMP, then apply a policy-map where routing classes use police with a high conform rate and management classes use a lower police rate.. CoPP is designed to classify control-plane traffic into distinct classes and apply independent policers. Separating routing protocols from management protocols allows the engineer to protect BGP and OSPF adjacencies while still enforcing limits on SSH and SNMP. A single class-map or class-default cannot provide this granularity, and an ACL would block rather than rate-limit management traffic.

Answer

Apply a single class-map matching all control-plane traffic and set a single police rate that is high enough for routing protocols.

Answer

Use MQC with a single class-default and configure a priority queue for BGP and OSPF packets.

Answer

Configure an ACL that denies SSH and SNMP to the control plane and apply it inbound on all interfaces.

Question 2

A financial services firm wants to automate configuration backups of 200 Cisco IOS XE switches. The team prefers an imperative, script-driven approach where Python code calls a structured API and stores the retrieved configuration in a version-controlled repository. Which method best aligns with this goal?

Accepted Answer

Write a Python script using the requests library to issue RESTCONF GET requests against each switch and save the JSON responses to files.. RESTCONF GET requests return model-driven, structured data over HTTPS, and Python's requests library can issue them programmatically from a central control host. Saving the structured responses to a repository supports version control and diffing. Guest shell Bash scripting, SNMP, and TFTP all either rely on CLI output, cannot retrieve full configurations, or lack structured API semantics, so they miss the stated goal.

Answer

Schedule a TFTP copy of the startup configuration from each switch to a central server using a cron job.

Answer

Use SNMP set operations to write the running configuration into a management server's MIB database.

Answer

Enable the Cisco IOS XE guest shell and run a Bash script that executes 'show running-config' on a schedule.

Question 3

A network architect is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches to replace a traditional three-tier data center design. The architect wants to use a distributed anycast gateway so that hosts can move between leaf switches without changing their default gateway. Which two statements correctly describe the anycast gateway design? (Choose two.)

Accepted Answer

The same gateway IP and MAC address are configured on every leaf switch that hosts the VLAN. A distributed anycast gateway places the same virtual gateway IP and virtual MAC on every leaf switch that hosts the VLAN. Hosts keep a consistent default gateway no matter which leaf they attach to, and ARP is answered locally on the attached leaf. This supports seamless workload mobility and avoids stretching traffic to a central gateway.

Answer

Only the spine switches can host the anycast gateway function

Answer

Hosts must be reconfigured with a new default gateway each time they migrate

Answer

Each leaf switch must use a unique gateway MAC address to avoid duplicate MAC detection

Question 4

A network automation engineer is using the ncclient Python library to retrieve the running configuration from a Cisco IOS XE device via NETCONF. The engineer writes a script that establishes a NETCONF session and sends a <get-config> RPC. However, the script fails with an error indicating the source datastore is not specified. What should the engineer do to correct the script?

Accepted Answer

Add a element with inside the RPC.. The RPC in NETCONF requires a element to identify the datastore (e.g., running, candidate, startup). Without it, the server cannot process the request. The correct fix is to include in the RPC. This is a common oversight when building NETCONF scripts.

Answer

Add a <filter> element to specify the configuration subtree.

Answer

Change the RPC to instead of .

Answer

Include a element with in the RPC.

Question 5

A network engineer is implementing VXLAN on a Cisco Nexus switch. The engineer wants to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between VLANs by mapping them to VNIs. Which component is responsible for the mapping of VLANs to VNIs on the VTEP?

Accepted Answer

The VXLAN Network Identifier (VNI) to VLAN mapping table. In VXLAN, each VLAN that needs to be extended across the overlay is mapped to a unique VNI. This mapping is configured on the VTEP, typically in a VLAN-to-VNI mapping table. When a frame from a VLAN enters the VTEP, the switch uses this mapping to determine the VNI and encapsulates the frame accordingly. Therefore, the VNI-to-VLAN mapping table is the component responsible for this function.

Answer

The MAC address table

Answer

The ARP table

Answer

The underlay routing protocol

Question 6

A network engineer is implementing Cisco TrustSec in a data center. The engineer wants to enforce security policies based on logical groupings of endpoints rather than IP addresses. Which component is used to assign a Security Group Tag (SGT) to traffic at the ingress point?

Accepted Answer

Ingress enforcement device. In Cisco TrustSec, the ingress enforcement device assigns the Security Group Tag (SGT) to packets as they enter the network. This can be done statically by configuring a port or dynamically via 802.1X authentication and authorization with Cisco ISE. The SGT is then carried in the packet, enabling egress enforcement devices to apply SGACLs based on the tag without re-examining IP addresses.

Answer

Security Group ACL (SGACL)

Answer

Egress enforcement device

Answer

Cisco Identity Services Engine (ISE)

Question 7

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that all leaf switches act as VTEPs and that each leaf learn remote MAC addresses only from the fabric control plane rather than from data-plane flooding. Which configuration on the leaf switches accomplishes this requirement?

Accepted Answer

Configure the NVE interface with `source-interface loopback0` and enable `host-reachability protocol bgp`.. The requirement is control-plane MAC learning across the VXLAN fabric. Binding the NVE interface to a loopback and enabling BGP as the host-reachability protocol makes the leaf a VTEP that exchanges EVPN MAC/IP and IMET routes with its peers. Remote MAC addresses are then resolved from BGP EVPN advertisements, eliminating flood-and-learn. Flooding, static ingress replication, and ARP suppression alone cannot satisfy that control-plane requirement.

Answer

Configure `arp suppression` on all leaf switches so that ARP requests are answered locally without control-plane involvement.

Answer

Configure `flooding enable` globally on each leaf so unknown unicast frames are replicated to all VTEPs in the fabric.

Answer

Configure `ingress-replication protocol static` on the NVE interface with a list of all remote VTEP addresses.

Question 8

An engineer is configuring a new switch stack using Cisco StackWise technology. The stack must be resilient to the failure of the active switch, and the engineer wants to ensure that the standby switch takes over with minimal disruption. The engineer has four switches in the stack. Which statement describes the role of the standby switch in a StackWise stack?

Accepted Answer

The standby switch takes over as the active switch if the active switch fails, and it is kept synchronized with the active switch's configuration and state.. The standby switch in a StackWise stack is a hot-standby that maintains a synchronized copy of the active switch's configuration and state. Upon failure of the active switch, the standby switch assumes the active role, providing redundancy and minimal downtime. This mechanism is critical for stack resilience, allowing the stack to continue operating seamlessly.

Answer

The standby switch is responsible for managing the stack and is the primary switch for forwarding traffic.

Answer

The standby switch is elected based on the highest priority value, and it only becomes active if the current active switch fails.

Answer

The standby switch actively forwards traffic and maintains a synchronized copy of the active switch's configuration and state.

Question 9

A network engineer is using Ansible to manage a group of Cisco IOS XE devices. The engineer wants to ensure that the playbook can securely connect to the devices without prompting for passwords and without storing passwords in plaintext in the playbook. Which method should be used to provide the credentials?

Accepted Answer

Store the passwords in an encrypted file using Ansible Vault and reference them in the playbook.. Ansible Vault provides a secure way to encrypt sensitive data like passwords. By storing credentials in an encrypted file and referencing them in the playbook, the engineer can run playbooks without interactive prompts and without exposing passwords in plaintext. This is the standard best practice for securing credentials in Ansible automation, including for Cisco IOS XE devices.

Answer

Use the ansible_ssh_pass variable in the inventory file and encrypt the inventory with Ansible Vault.

Answer

Use the --ask-pass command-line option when running the playbook.

Answer

Set the ANSIBLE_PASSWORD environment variable on the control node before running the playbook.

Question 10

A network engineer configures a Cisco IOS router to authenticate administrative SSH logins against a Cisco ISE server using TACACS+. After applying the configuration, a valid ISE user can log in but receives no privilege level and cannot enter privileged EXEC mode. The relevant configuration is:

aaa new-model
 aaa authentication login default group tacacs+ local
 aaa authorization exec default group tacacs+ local
 tacacs server ISE
  address ipv4 10.10.10.50
  key Cisco123

Which action most directly resolves the problem?

Accepted Answer

Configure the ISE TACACS+ device to return the cisco-av-pair shell:priv-lvl=15 attribute for authorized users.. Successful TACACS+ authentication only proves the user's identity; the privilege level comes from authorization AV pairs. Because the router shows the user authenticated but stuck at unprivileged EXEC, the ISE authorization policy must be returning no shell:priv-lvl value. Adding the cisco-av-pair shell:priv-lvl=15 attribute to the matching authorization rule gives the router the privilege level to apply after login.

Answer

Enable AAA accounting with the aaa accounting exec default start-stop group tacacs+ command so ISE records the session.

Answer

Add the aaa authorization commands 15 default group tacacs+ local command to the router.

Answer

Change the aaa authentication login method list to use the local database before the tacacs+ group.

Question 11

A network administrator is troubleshooting a network issue using Cisco DNA Center Assurance. The administrator wants to identify which network devices are experiencing the highest number of errors, such as CRC errors and interface flaps. Which Assurance dashboard should the administrator use?

Accepted Answer

Network Health. The Network Health dashboard in Cisco DNA Center Assurance aggregates health metrics for network devices and links, including error counters like CRC errors and interface flaps. It ranks devices by health and highlights those with the most issues, enabling administrators to quickly pinpoint and address problems. This makes it the right choice for identifying devices with high error rates.

Answer

Client Health

Answer

Application Health

Answer

Path Trace

Question 12

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is to ensure that only SSH version 2 is used for remote CLI access, and that Telnet is disabled. Which configuration achieves this?

Accepted Answer

Configure 'transport input ssh' on the VTY lines and set 'ip ssh version 2' globally.. Restricting VTY access to SSH with 'transport input ssh' and forcing SSH version 2 with 'ip ssh version 2' ensures that only secure SSHv2 sessions are accepted. This combination disables Telnet and prevents fallback to the weaker SSH version 1, satisfying the management access hardening requirement.

Answer

Configure 'transport input telnet ssh' on the VTY lines and set 'ip ssh version 2' globally.

Answer

Configure 'transport output ssh' on the VTY lines and set 'ip ssh version 1' globally.

Answer

Configure 'line vty 0 4' with 'login local' and 'password cisco', then set 'ip ssh version 2' globally.

Question 13

A network engineer is deploying a new branch office with a single Cisco Catalyst switch that will connect to the corporate network via a routed uplink. The switch must be able to forward traffic for VLANs 10, 20, and 30 over that single uplink to a router. The router interface is configured with subinterfaces and dot1Q encapsulation. Which switchport configuration should be applied to the uplink port?

Accepted Answer

switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,30. The uplink must be a trunk to carry multiple VLANs to the router's subinterfaces. Configuring the port as a static trunk with 802.1Q encapsulation and limiting allowed VLANs to the ones in use ensures tagged frames reach the correct router subinterfaces. Dynamic trunking or access mode would not reliably support multiple VLANs over a single physical link.

Answer

switchport mode access
switchport access vlan 10

Answer

switchport mode dynamic desirable
switchport trunk allowed vlan 10,20,30

Answer

switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 20,30

Question 14

A network engineer is configuring OSPF on a Cisco router. The router is connected to a broadcast network with multiple OSPF neighbors. The engineer wants to ensure that this router does not become the Designated Router (DR) or Backup Designated Router (BDR) on this network. Which configuration achieves this goal?

Accepted Answer

Set the OSPF priority to 0 on the interface.. The OSPF priority is an 8-bit field in the Hello packet used in DR/BDR election. A router with priority 0 is never elected as DR or BDR. Setting the interface priority to 0 achieves the goal while allowing the router to remain a DROTHER and fully participate in OSPF. Other methods like changing network type or making the interface passive have side effects that are not desired.

Answer

Set the OSPF network type to point-to-point.

Answer

Configure the interface as passive.

Answer

Configure the router as a stub router.

Question 15

A network engineer is configuring a new Cisco IOS router and needs to ensure that the router can be managed remotely via SSH. The engineer has already generated RSA keys and configured a username and password. Which additional command is required to enable SSH access on the VTY lines?

Accepted Answer

transport input ssh. To enable SSH access on a Cisco IOS router, after generating RSA keys and configuring local authentication, the VTY lines must be configured with 'transport input ssh'. This command restricts incoming connections to SSH, ensuring secure remote management. The other commands are either prerequisites already completed or additional security settings that do not directly enable SSH on the VTY lines.

Answer

ip ssh version 2

Answer

login local

Answer

crypto key generate rsa

Question 16

A network engineer is configuring a Cisco CSR 1000v router to support a virtual routing and forwarding (VRF) instance for a customer. The engineer wants to enable OSPFv2 within the VRF and ensure that OSPF routes are installed in the VRF's routing table. Which command is required to start the OSPF process for the VRF?

Accepted Answer

router ospf 1 vrf CUSTOMER. The correct command to enable OSPFv2 in a VRF on Cisco IOS-XE is 'router ospf vrf '. This associates the OSPF process with the specified VRF, allowing it to run in that VRF's routing context. The other options either use incorrect syntax or are appropriate for different platforms or protocols.

Answer

ip router ospf 1 vrf CUSTOMER

Answer

router ospf 1
 address-family ipv4 vrf CUSTOMER

Answer

router ospf 1
 vrf CUSTOMER

Question 17

A network security engineer is configuring an IPsec site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) and that the encryption is AES-256. Which combination of commands achieves this?

Accepted Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group14. To achieve AES-256 encryption and perfect forward secrecy, the transform-set must specify esp-aes 256 and esp-sha256-hmac, and the crypto map must include set pfs with a strong Diffie-Hellman group such as group14. This ensures that each new IPsec SA uses a unique key derived from a fresh Diffie-Hellman exchange, providing forward secrecy. The combination of these commands meets the security requirements.

Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp without set pfs

Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group5

Answer

crypto ipsec transform-set TS esp-3des esp-md5-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group2

Question 18

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Accepted Answer

GRE over IPsec using a tunnel interface protected by IPsec. GRE over IPsec creates a virtual tunnel interface that supports multicast and broadcast, enabling dynamic routing protocols to run across the VPN. IPsec then protects the GRE-encapsulated packets. This design satisfies both the routing update and multicast requirements that standard IPsec tunnel mode with a crypto map cannot deliver.

Answer

IPsec tunnel mode with a crypto map applied to the physical interface

Answer

IPsec transport mode with an access list matching only protocol 47

Answer

DMVPN phase 1 with only mGRE and no IPsec protection

Question 19

A network administrator is configuring MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. Which two statements about MACsec are true? (Choose two.)

Accepted Answer

MACsec provides encryption and integrity for Ethernet frames at Layer 2.. MACsec (802.1AE) provides Layer 2 encryption and integrity for Ethernet frames, and it is commonly deployed with Cisco TrustSec for switch-to-switch links. It uses MKA for key agreement, not IPsec. It does not encrypt MAC addresses, and it is hop-by-hop rather than end-to-end.

Answer

MACsec requires IPsec to establish the secure channel.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec provides end-to-end encryption between any two hosts in a campus network.

Question 20

A network security team is implementing Cisco TrustSec in a campus network. They need to deploy Security Group Tags (SGTs) and enforce policies using Security Group ACLs (SGACLs). Which two statements are true regarding SGT propagation and enforcement in this environment? (Choose two.)

Accepted Answer

SGT Exchange Protocol (SXP) is used to propagate SGTs to devices that do not support hardware-based tagging.. SGTs can be propagated inline using Cisco Metadata on supported hardware, and SXP is used for devices that cannot do inline tagging. These two methods allow flexible deployment in mixed environments. SGACLs can be enforced at various points, not just ingress, and SGTs are not carried in DSCP. SXP does not mandate IPsec.

Answer

SXP requires the use of IPsec for secure communication between peers.

Answer

SGACLs are enforced only on the ingress interface where the SGT is assigned.

Answer

SGTs are always carried in the IP header using the DSCP field.