350-401 Mock Exam 88 — 25 Questions

Question 1

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide segmentation for different user groups (employees, guests, contractors) while allowing them to share the same physical infrastructure. Which Cisco SD-Access component is responsible for enforcing group-based policies between endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fabric Edge Node. In Cisco SD-Access, segmentation is achieved through the use of Scalable Group Tags (SGTs) and SGACLs. The fabric edge nodes are the enforcement points where SGACLs are applied. When an endpoint sends traffic, the edge node adds the source SGT to the VXLAN header. The destination edge node uses the source and destination SGTs to apply the correct SGACL. This allows different user groups to be segmented even when using the same physical infrastructure. ISE assigns SGTs, but enforcement is at the edge.

Answer

Identity Services Engine (ISE)

Answer

Control Plane Node (CP Node)

Answer

Fabric Border Node

Question 2

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide segmentation for different user groups (employees, guests, contractors) while allowing them to share the same physical infrastructure. Which Cisco SD-Access component is responsible for enforcing group-based policies between endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vSmart controller. In Cisco SD-WAN, the vSmart controller is the brain of the control plane. It distributes OMP routes and policies to all vEdge routers, enabling centralized policy and per-application traffic steering. The vBond orchestrator handles initial authentication, vManage provides management, and vEdge routers forward data. Only vSmart distributes fabric-wide policy and manages control plane connectivity.

Answer

vManage NMS

Answer

vEdge router

Answer

vBond orchestrator

Question 3

A network automation team is using the Cisco DNA Center Intent API to create a new site hierarchy and assign devices. The API call to create the site returns HTTP 202 Accepted, but a subsequent call to assign a device to that site fails with an error that the site does not exist. The team is polling the task endpoint but has not yet received a success status. What is the most likely explanation?

Accepted Answer

The 202 response means the request is processed asynchronously, and the site is not available until the associated task completes successfully. Cisco DNA Center Intent API operations such as site creation are asynchronous and return HTTP 202 Accepted with a task ID. The site is not available for subsequent operations until the task completes successfully. The team must poll the task endpoint until it reports success before attempting to assign devices to the new site, which resolves the site-not-found error.

Answer

The site creation API requires a PUT instead of a POST, so the site was never created

Answer

The device assignment must be performed before site creation, so the order of operations is reversed

Answer

The API token expired between the two calls, causing the second call to fail with a site-not-found error

Question 4

A network engineer is configuring a Cisco Catalyst 9000 switch for a new access layer. The engineer needs to enable a feature that allows the switch to authenticate endpoints using 802.1X and then assign them to a specific VLAN based on the result. Which Cisco feature should be configured to dynamically assign VLANs?

Accepted Answer

802.1X with VLAN assignment via RADIUS. The correct feature is 802.1X with VLAN assignment via RADIUS. When an endpoint authenticates via 802.1X, the switch acts as an authenticator and relays credentials to a RADIUS server like Cisco ISE. Upon successful authentication, the RADIUS server can return tunnel attributes that specify the VLAN. The switch then dynamically assigns the port to that VLAN, allowing for role-based access control and simplified VLAN management.

Answer

Private VLAN (PVLAN) edge

Answer

Dynamic ARP Inspection (DAI)

Answer

VLAN Membership Policy Server (VMPS)

Question 5

A network administrator is configuring a Cisco IOS router to act as a DHCP server for the 10.10.10.0/24 subnet. The router interface GigabitEthernet0/0 is configured with IP address 10.10.10.1/24. Which command is required to specify the DNS server address that will be provided to DHCP clients?

Accepted Answer

dns-server 8.8.8.8. The correct command to specify DNS servers for DHCP clients is 'dns-server' within the DHCP pool configuration mode. This command directly populates the DNS option in DHCP offers. The other options are either global router DNS settings or invalid commands. Proper configuration ensures that clients receive the necessary DNS information to resolve hostnames, which is critical for network functionality.

Answer

domain-name-server 8.8.8.8

Answer

ip name-server 8.8.8.8

Answer

ip dhcp dns 8.8.8.8

Question 6

A network architect is designing a fabric that must support Layer 2 and Layer 3 connectivity for endpoints across multiple sites without stretching VLANs between them. The design requires a control plane that separates the endpoint identifier from the routing locator, allowing traffic to be tunneled over a routed underlay. Which Cisco architecture component provides this separation in an SD-Access fabric?

Accepted Answer

LISP control plane with VXLAN data plane. The Cisco SD-Access fabric uses LISP as its control plane to separate endpoint identity from routing location, and VXLAN as the data plane to tunnel overlay traffic across a routed underlay. This combination lets endpoints remain in their Layer 2 or Layer 3 virtual networks without extending VLANs between sites, which is precisely what the architect requires.

Answer

MP-BGP EVPN with MPLS L3VPN VRFs

Answer

Cisco TrustSec with SGT Exchange Protocol

Answer

OTV with IS-IS adjacency over the WAN

Question 7

A network engineer is configuring QoS on a Cisco IOS router. The engineer needs to ensure that packets marked with DSCP AF31 are placed into a queue that guarantees at least 30% of the interface bandwidth during congestion, while allowing other traffic to use any remaining bandwidth. Which configuration should be used?

Accepted Answer

policy-map QOS
 class AF31
  bandwidth percent 30. The 'bandwidth percent 30' command in a policy map class guarantees that the class receives at least 30% of the interface bandwidth during congestion. This is part of CBWFQ and provides a minimum bandwidth guarantee, meeting the requirement while allowing other traffic to utilize remaining bandwidth.

Answer

policy-map QOS
 class AF31
  shape average percent 30

Answer

policy-map QOS
 class AF31
  bandwidth remaining percent 30

Answer

policy-map QOS
 class AF31
  priority percent 30

Question 8

A network engineer is deploying a new Cisco SD-Access fabric. The design includes underlay and overlay networks. Which two statements accurately describe the underlay network in a Cisco SD-Access fabric? (Choose two.)

Accepted Answer

The underlay provides a loop-free topology using a routing protocol and does not rely on Spanning Tree Protocol.. In Cisco SD-Access, the underlay provides IP reachability between fabric nodes using a routing protocol such as IS-IS or OSPF, and it is a loop-free Layer 3 network that does not rely on Spanning Tree Protocol. VXLAN encapsulation and LISP mapping are overlay functions. Static routing is not the typical underlay approach.

Answer

The underlay encapsulates user traffic in VXLAN to provide overlay connectivity.

Answer

The underlay is responsible for mapping endpoint IP addresses to fabric locators (RLOCs).

Answer

The underlay uses a static routing protocol to simplify configuration and reduce overhead.

Question 9

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router has management SSH access, SNMP monitoring, and BGP peering. After applying the CoPP policy shown in the exhibit, the engineer notices that SNMP polling from the management station fails, while SSH and BGP remain operational. Which action should be taken to restore SNMP polling while maintaining control plane protection?

Accepted Answer

Add a class-map that matches SNMP traffic (UDP port 161) and include it in the CoPP policy with an appropriate policer rate.. CoPP policies must explicitly classify and police all desired control plane traffic. If SNMP is not classified, it falls into the default class, which typically has a low rate and may drop legitimate SNMP. Adding a dedicated class-map for SNMP with an appropriate policer restores connectivity while preserving protection.

Answer

Increase the policer rate for the default class to allow all unmatched traffic, including SNMP.

Answer

Remove the CoPP policy from the control plane and reapply it after verifying SNMP connectivity.

Answer

Configure an ACL to permit SNMP traffic and apply it to the management interface instead of the control plane.

Question 10

A network engineer is configuring VXLAN on a Cisco Nexus 9000 series switch. The underlay network is a routed Layer 3 network using OSPF. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) IP addresses are reachable across the underlay. Which statement describes the correct configuration for the VTEP source interface?

Accepted Answer

The VTEP source interface must be a loopback interface with an IP address advertised into the underlay routing protocol.. For VXLAN, the VTEP source interface should be a loopback interface with an IP address advertised into the underlay routing protocol. This ensures that the VTEP IP remains reachable even if a physical link fails, providing redundancy. The underlay network must route the loopback IP so that remote VTEPs can establish VXLAN tunnels.

Answer

The VTEP source interface must be a VLAN interface (SVI) on the switch, and the VLAN must be allowed on all trunk links.

Answer

The VTEP source interface must be a subinterface configured with 802.1Q encapsulation.

Answer

The VTEP source interface must be a physical interface that is directly connected to the underlay network.

Question 11

A network security engineer is configuring 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch is configured with 'dot1x system-auth-control' and the interface is set to 'authentication port-control auto'. The engineer wants to allow a printer that does not support 802.1X to connect to the network by using MAC Authentication Bypass (MAB). Which additional configuration is required on the switch interface to enable MAB?

Accepted Answer

Configure 'mab' under the interface configuration mode.. MAC Authentication Bypass (MAB) is enabled on a switch interface with the 'mab' command. This allows the switch to use the connecting device's MAC address as credentials for RADIUS authentication when 802.1X is not supported. The other commands either control host mode, set the authenticator role, or define authentication order, but none enable MAB.

Answer

Configure 'authentication host-mode multi-auth' under the interface configuration mode.

Answer

Configure 'dot1x pae authenticator' under the interface configuration mode.

Answer

Configure 'authentication order dot1x mab' under the interface configuration mode.

Question 12

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The router runs OSPF, BGP, SSH management, and NTP. The engineer wants to ensure that OSPF hello packets are always prioritized and that SSH traffic from the management subnet is rate-limited. Which two statements about the CoPP configuration are true? (Choose two.)

Accepted Answer

CoPP uses a modular QoS CLI policy map applied globally with the 'service-policy' command under control-plane configuration mode.. CoPP uses MQC class maps and policy maps applied under control-plane configuration mode. Class maps reference ACLs to distinguish protocols like OSPF and SSH, allowing differentiated policing and prioritization actions. Applying the policy to physical interfaces or assuming default policies meet custom requirements are common misconceptions.

Answer

CoPP is applied to individual data plane interfaces using the 'service-policy input' command on each physical interface.

Answer

The default CoPP policy that ships with Cisco IOS XE already rate-limits SSH and OSPF traffic without any custom configuration.

Answer

CoPP can only police traffic; it cannot mark or prioritize specific control plane protocols such as OSPF.

Question 13

A network engineer is comparing YANG models used in Cisco IOS XE automation. The engineer needs to distinguish between standard IETF YANG models and Cisco-specific YANG models. Which two statements accurately describe these YANG model types? (Choose two.)

Accepted Answer

Cisco-specific YANG models often use a namespace that includes 'cisco' and are tailored to expose Cisco IOS XE features.. IETF YANG models are vendor-neutral standards from the IETF, enabling multi-vendor consistency. Cisco-specific models have namespaces indicating Cisco and expose IOS XE features. Both can be used over NETCONF or RESTCONF. The other statements are false: Cisco models are not always required, not limited to RESTCONF, and not IETF standards.

Answer

IETF YANG models can only be used with NETCONF, while Cisco-specific models can only be used with RESTCONF.

Answer

Cisco-specific YANG models are always required to configure any feature on Cisco IOS XE devices.

Answer

Cisco-specific YANG models are defined in RFCs and are open standards maintained by the IETF.

Question 14

A network engineer is implementing VXLAN with Cisco SD-Access. The engineer must ensure that the underlay network provides the necessary transport for VXLAN traffic. Which two statements about VXLAN and its underlay are true? (Choose two.)

Accepted Answer

VXLAN uses a 24-bit VNID, allowing over 16 million unique segments.. VXLAN uses a 24-bit VNID for large-scale segmentation and relies on VTEPs to encapsulate traffic. The underlay is typically Layer 3, not Layer 2, and BUM traffic can be handled via multicast or unicast control-plane replication. The two correct statements are the 24-bit VNID and the role of VTEPs.

Answer

VXLAN requires the underlay to be a Layer 2 network with STP.

Answer

VXLAN uses a 12-bit VNID, similar to VLAN IDs.

Answer

VXLAN requires a multicast-enabled underlay for BUM traffic replication.

Question 15

An engineer must secure the management plane of a Cisco IOS XE router so that only SSH version 2 is accepted for remote administration, while Telnet and SSHv1 are rejected. Which set of commands accomplishes this?

Accepted Answer

line vty 0 4
 transport input ssh
ip ssh version 2. Restricting VTY lines with 'transport input ssh' eliminates Telnet access, and 'ip ssh version 2' forces the SSH server to negotiate only version 2. Used together under the correct configuration modes, they enforce SSHv2-only remote management. Other combinations either leave Telnet enabled, use invalid syntax, or fail to restrict the transport protocol.

Answer

ip ssh server algorithm encryption aes128-ctr aes256-ctr
line vty 0 4
 transport input all

Answer

line vty 0 4
 transport input telnet ssh
ip ssh version 2

Answer

line vty 0 4
 transport input ssh
no ip ssh version 1

Question 16

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs BGP, OSPF, SSH management, and SNMP. After applying a CoPP policy that rate-limits all control-plane traffic to 1000 pps, BGP sessions flap and OSPF adjacencies reset during peak traffic. Which action should the engineer take to resolve the problem while maintaining control-plane protection?

Accepted Answer

Create separate class-maps for BGP, OSPF, SSH, and SNMP, and apply protocol-specific rate limits within the policy-map.. CoPP uses a modular QoS CLI (MQC) structure with class-maps to identify traffic types and a policy-map to apply policers per class. A single policer for all control-plane traffic causes legitimate routing protocol updates to compete with management and monitoring traffic, leading to drops and session resets. The correct solution is to define separate class-maps for BGP, OSPF, SSH, and SNMP, then assign differentiated rate limits in the policy-map. This preserves control-plane protection while ensuring routing protocols receive adequate bandwidth.

Answer

Enable Control Plane Protection (CPPr) with the aggregate option to automatically prioritize routing protocols.

Answer

Increase the global CoPP rate limit to 5000 pps to accommodate all control-plane protocols.

Answer

Remove the CoPP policy from the control plane and rely on QoS policies on data interfaces instead.

Question 17

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing intermittent connectivity drops. The administrator wants to view the historical trend of the client's connectivity and identify the root cause. Which Cisco DNA Center Assurance feature should the administrator use?

Accepted Answer

Client 360. Client 360 is the Cisco DNA Center Assurance feature designed to provide detailed, historical, and real-time information about a specific client device. It includes connectivity trends, event timelines, and root cause analysis for client issues. The Network Health dashboard, Application Health dashboard, and Path Trace serve different purposes: overall network health, application performance, and flow path analysis, respectively. Therefore, Client 360 is the correct choice for troubleshooting intermittent connectivity of a single client.

Answer

Application Health dashboard

Answer

Path Trace

Answer

Network Health dashboard

Question 18

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. Which two statements about MACsec operation are true? (Choose two.)

Accepted Answer

MACsec uses MKA (MACsec Key Agreement) to negotiate session keys between peers.. MACsec is an IEEE 802.1AE standard that provides hop-by-hop encryption and integrity on Ethernet links. It uses GCM-AES-128 for encryption and MKA for key agreement. It does not encrypt MAC addresses, and it does not use IKEv2. It is deployed on switchports, not routed interfaces. Therefore, the two true statements are that it provides hop-by-hop encryption with GCM-AES-128 and that it uses MKA to negotiate session keys.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec requires the use of IKEv2 to establish the secure channel between switches.

Answer

MACsec can only be deployed on routed interfaces, not on switchports.

Question 19

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

Accepted Answer

Hot Standby Router Protocol (HSRP) version 1. HSRP version 1 is the only protocol listed that uses the virtual MAC address 0000.0c07.acXX and supports IPv4 only. VRRPv2 uses a different MAC prefix, GLBP uses 0007.b400.XXYY, and HSRPv2 uses 0000.0c9f.fXXX. The administrator should configure HSRPv1 to meet the exact virtual MAC and IPv4-only requirements.

Answer

HSRP version 2

Answer

Virtual Router Redundancy Protocol (VRRP) version 2

Answer

Gateway Load Balancing Protocol (GLBP)

Question 20

A network administrator is configuring a switch port to support a VoIP phone and a PC connected to the phone's internal switch. The phone must be placed in VLAN 50 and the PC in VLAN 60. Which configuration on the switch port achieves this?

Accepted Answer

switchport mode access
switchport access vlan 60
switchport voice vlan 50. The correct configuration uses access VLAN 60 for the PC and voice VLAN 50 for the phone. Cisco voice VLAN allows the switch to instruct the phone to use a specific VLAN for voice traffic while the PC remains on the access VLAN. This provides proper segmentation and QoS for voice.

Answer

switchport mode access
switchport access vlan 50
switchport trunk allowed vlan 60

Answer

switchport mode access
switchport access vlan 50
switchport voice vlan 60

Answer

switchport mode trunk
switchport trunk native vlan 60
switchport trunk allowed vlan 50