350-401 Mock Exam 89 — 25 Questions

Question 1

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

switchport mode trunk. To configure a switch port as a trunk, the command 'switchport mode trunk' must be used. This enables the port to carry traffic for multiple VLANs using 802.1Q encapsulation. While other commands like 'switchport trunk encapsulation dot1q' may be required on some platforms, the essential command to set the mode is 'switchport mode trunk'. This is a fundamental configuration for connecting devices that need multiple VLANs, such as a WLC.

Answer

switchport nonegotiate

Answer

switchport trunk encapsulation dot1q

Answer

switchport mode access

Question 2

A network engineer is deploying a new branch office that uses Cisco SD-Access. The fabric must support both wired and wireless clients, with a single control plane that provides host tracking, location, and policy enforcement. Which fabric component is responsible for these functions?

Accepted Answer

Fabric control plane node. The fabric control plane node in Cisco SD-Access runs LISP map-server and map-resolver, providing a centralized database for endpoint-to-RLOC mappings. This enables host tracking, location services, and a single control plane for both wired and wireless clients. DNA Center and ISE are supporting components for management and policy, but they do not provide the runtime control-plane functions described in the scenario.

Answer

Cisco Identity Services Engine (ISE)

Answer

Fabric edge node

Answer

Cisco DNA Center

Question 3

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

switch convert mode virtual. To join a StackWise Virtual domain, a standalone switch must first be converted using 'switch convert mode virtual'. This command changes the switch's mode of operation and allows it to form a virtual domain with another switch. After conversion, the domain ID and other parameters can be configured.

Answer

switch virtual domain 1

Answer

stackwise-virtual domain 1

Answer

stackwise-virtual enable

Question 4

A network engineer is deploying MACsec on a Cisco Catalyst 9300 switch to secure a point-to-point link between two access switches. The engineer configures the switchport with the macsec command and a pre-shared key. After applying the configuration, the link comes up but MACsec is not encrypting traffic. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the key server protocol (MKA) with a matching connectivity association key (CAK) on both switches and ensure the key server priority is set.. MACsec relies on MKA to establish a secure channel between two directly connected devices. For MKA to succeed, both peers must share the same connectivity association key and agree on the key server. If these parameters are missing or mismatched, the link remains up but MACsec encryption does not activate. Verifying and matching the MKA configuration on both switches is the correct troubleshooting step.

Answer

Apply the macsec command under the VLAN interface instead of the physical interface.

Answer

Change the switchport mode to trunk to allow MACsec frames to pass.

Answer

Enable MACsec globally using the macsec command in global configuration mode.

Question 5

A network engineer is designing a high-availability campus network using Cisco StackWise Virtual. The engineer wants to ensure that if the virtual link fails, the switches do not both become active and cause a split-brain scenario. Which mechanism should be implemented to detect and prevent a dual-active situation?

Accepted Answer

Configure a separate physical link as a dual-active detection link and enable dual-active detection.. StackWise Virtual uses a dual-active detection link to prevent a split-brain scenario. This is a separate physical link between the two switches that is used to detect a virtual link failure. When the virtual link fails, the switches communicate over the dual-active detection link to determine which switch should remain active. Configuring this link and enabling dual-active detection is the correct approach.

Answer

Enable PAgP on the virtual link to detect dual-active condition.

Answer

Enable BFD on the virtual link to rapidly detect failures.

Answer

Configure VRRP on the switches to monitor the virtual link.

Question 6

A network administrator is deploying 802.1X on Cisco Catalyst switches with Cisco ISE as the RADIUS server. The administrator wants to allow devices that do not support 802.1X, such as printers, to connect to the network. Which feature should be configured on the switch ports to support these devices while maintaining security?

Accepted Answer

Enable MAC Authentication Bypass (MAB) on the switch ports so that the MAC address of non-802.1X devices is sent to ISE for authentication.. MAC Authentication Bypass allows devices that lack 802.1X supplicant software to be authenticated by their MAC address against Cisco ISE. The switch sends the MAC address as both username and password, and ISE applies the appropriate authorization policy. This enables printers and similar devices to connect while still enforcing centralized access control.

Answer

Configure the switch ports as 802.1X supplicants so they can authenticate on behalf of connected devices.

Answer

Implement 802.1X with EAP-TLS and install certificates on the printers.

Answer

Disable 802.1X on the ports and rely on port security to restrict access based on MAC addresses.

Question 7

A network engineer is configuring OSPF on a multiaccess network. The engineer wants to ensure that only two specific routers become DR and BDR, and that other routers do not participate in the election. Which OSPF interface setting should be configured on the routers that should not become DR or BDR?

Accepted Answer

ip ospf priority 0. Setting OSPF priority to 0 on an interface makes the router ineligible to become DR or BDR. This is the standard method to exclude routers from the election while still allowing them to participate in OSPF as DROTHERs. Other options either do not affect eligibility or change the network type entirely.

Answer

ip ospf database-filter all out

Answer

ip ospf network point-to-point

Answer

ip ospf priority 1

Question 8

A network administrator is deploying a new Cisco Catalyst switch and wants to enable a feature that provides per-port MAC address limiting to prevent MAC flooding attacks. The administrator also wants to ensure that when the limit is exceeded, the port is err-disabled. Which command set accomplishes this?

Accepted Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation shutdown. To limit MAC addresses per port and err-disable the port on violation, the administrator must enable port security, set the maximum, and configure the shutdown violation mode. The shutdown mode places the port into an err-disabled state when the limit is exceeded, which is exactly what the scenario requires.

Answer

switchport port-security maximum 5, switchport port-security violation shutdown

Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation restrict

Answer

switchport port-security, switchport port-security maximum 5, switchport port-security violation protect

Question 9

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vrrp 1 priority 150. The command vrrp 1 priority 150 correctly sets the VRRP priority to 150 for group 1. A higher priority increases the chance of becoming the master. The default priority is 100, and the range is 1–254. Preemption is enabled by default, so no additional command is needed. This ensures the router becomes master and takes over quickly if needed.

Answer

vrrp 1 priority 150 preempt

Answer

vrrp 1 preempt priority 150

Answer

standby 1 priority 150

Question 10

A network engineer is configuring QoS on a Cisco IOS XE router. The router must mark all ingress traffic from a specific subnet with DSCP AF31 and ensure that this marking is trusted throughout the network. Which configuration step is required to achieve this?

Accepted Answer

Create a class map matching the subnet, then a policy map that sets DSCP AF31, and apply it as a service policy on the ingress interface.. To mark traffic from a specific subnet with DSCP AF31, you need a class map to identify the traffic, a policy map to set the DSCP, and the policy applied as an ingress service policy. This ensures packets are marked before any queuing or forwarding decisions, allowing downstream devices to trust and act on the marking.

Answer

Apply a policy map that sets DSCP AF31 as an output service policy on the router's uplink interface.

Answer

Configure 'mls qos trust dscp' on the ingress interface and rely on the subnet's existing markings.

Answer

Use a route map to set DSCP AF31 for all routes matching the subnet and redistribute into OSPF.

Question 11

A network administrator is configuring a Cisco Catalyst switch and needs to assign a port to VLAN 20 as an access port. Which command sequence is correct?

Accepted Answer

interface GigabitEthernet0/1, then switchport mode access, then switchport access vlan 20. To assign a switch port to a specific VLAN as an access port, you must enter interface configuration mode, set the port to access mode with switchport mode access, and then assign the VLAN with switchport access vlan 20. This ensures the port operates correctly as an access port in the desired VLAN.

Answer

interface GigabitEthernet0/1, then switchport mode trunk, then switchport trunk vlan 20

Answer

interface GigabitEthernet0/1, then switchport access vlan 20, then switchport mode access

Answer

vlan 20, then interface GigabitEthernet0/1, then switchport access vlan 20

Question 12

A network engineer is implementing VXLAN with BGP EVPN on Cisco Nexus switches. The underlay network is OSPF, and the overlay uses MP-BGP EVPN. The engineer wants to ensure that the VXLAN tunnel endpoints (VTEPs) can discover each other and exchange MAC and IP address information. Which statement correctly describes the role of the BGP EVPN address family in this scenario?

Accepted Answer

It distributes MAC and IP address reachability information for hosts and enables VTEP peer discovery.. The BGP EVPN address family is used to distribute MAC and IP address reachability information across VTEPs. This enables control plane learning, reducing flooding and allowing VTEPs to discover remote hosts and VTEPs. The other options incorrectly attribute underlay routing, data plane encapsulation, or flooding-based learning to BGP EVPN.

Answer

It provides a routing underlay for the VXLAN tunnels by advertising VTEP loopback addresses.

Answer

It synchronizes the MAC address tables of all VTEPs by flooding unknown unicast traffic.

Answer

It encapsulates the original Ethernet frames into VXLAN packets and forwards them across the underlay.

Question 13

A network engineer is new to automation and wants to use a simple, agentless tool to push configuration changes to a group of Cisco IOS XE switches. The engineer prefers to write playbooks in YAML and use SSH for connectivity. Which tool should the engineer choose?

Accepted Answer

Ansible. Ansible is an agentless automation tool that uses SSH for connectivity and YAML for playbooks. It provides dedicated modules for Cisco IOS XE, such as ios_config and ios_command, enabling straightforward configuration pushes. The engineer's requirements for agentless operation, YAML playbooks, and SSH align perfectly with Ansible's design, making it the correct choice among the options.

Answer

Puppet

Answer

SaltStack

Answer

Chef

Question 14

A network automation engineer is using the Python 'ncclient' library to manage a Cisco IOS XE device via NETCONF. The engineer wants to retrieve the running configuration. Which NETCONF operation should be used to accomplish this?

Accepted Answer

with a source of . NETCONF provides specific operations for different tasks. To retrieve configuration data, the operation is used with a source datastore, such as . This returns the configuration without state data. Other operations like retrieve both config and state, while and are for writing or copying. The correct choice is .

Answer

with a filter for

Answer

with a target of

Answer

<copy-config> from <running/> to <startup/>

Question 15

A network administrator is deploying a new Cisco Catalyst 9200 switch at a branch office. The security policy requires that when a device connected to a port is shut down or moved, the switch must immediately send a SNMP trap and place the port into an error-disabled state while also incrementing a violation counter. The administrator configures port security with the violation mode that meets these requirements. Which command must be applied to the interface to achieve this?

Accepted Answer

switchport port-security violation shutdown. The security policy requires the switch to send an SNMP trap and place the port into an error-disabled state when a violation occurs. The shutdown violation mode does exactly that: it error-disables the port, generates a syslog/SNMP notification, and increments the violation counter. The restrict mode only increments counters and sends notifications without disabling the port, while protect mode silently drops frames. Disable is not a valid keyword.

Answer

switchport port-security violation disable

Answer

switchport port-security violation restrict

Answer

switchport port-security violation protect

Question 16

A network security team is evaluating Cisco TrustSec (CTS) for deployment in a campus network. The team wants to understand which components are essential for enforcing security group tags (SGTs) and providing role-based access control. Which two of the following are required to implement CTS with SGT enforcement? (Choose two.)

Accepted Answer

Cisco Identity Services Engine (ISE) for policy and SGT assignment. Implementing Cisco TrustSec requires a policy engine to assign SGTs and a method to propagate those tags. Cisco ISE provides the centralized policy and SGT assignment, while inline tagging or SXP ensures that SGTs are carried across network devices. Together, they enable enforcement of SGACLs. STP, DHCP snooping, and AnyConnect NAM are not essential for SGT-based access control, though they may be used in a broader security architecture.

Answer

Cisco AnyConnect Network Access Manager for endpoint posture

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Spanning Tree Protocol (STP) for loop prevention

Question 17

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An ACL defining interesting traffic, an ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface.. A Cisco IOS site-to-site IPsec VPN requires an extended ACL to identify interesting traffic, an ISAKMP policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that ties the ACL and transform set together and is applied to the WAN interface. All of these elements work together to negotiate and encrypt traffic between the peers.

Answer

An ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface without an ACL for interesting traffic.

Answer

A route map defining interesting traffic, a crypto map, and a transform set applied to the LAN interface.

Answer

An ACL defining interesting traffic, a transform set, and a crypto map applied to the LAN interface without an ISAKMP policy.

Question 18

A network engineer is configuring a pair of Catalyst switches to run VRRP on VLAN 10 (10.10.10.0/24). The virtual IP must be 10.10.10.1 with a priority of 110 on the primary switch and 100 on the standby. The primary switch is currently active. Which configuration on the primary switch correctly sets the VRRP priority and virtual IP?

Accepted Answer

interface vlan 10 ip address 10.10.10.2 255.255.255.0 vrrp 10 ip 10.10.10.1 vrrp 10 priority 110. VRRP on Cisco IOS uses the `vrrp ip

` command to define the virtual IP, and `vrrp priority ` to set priority. The highest priority becomes the master. The correct configuration assigns the physical IP, defines the virtual IP 10.10.10.1, and sets priority 110, ensuring this switch becomes the master. Other options contain invalid syntax or set the wrong priority.

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1 255.255.255.0
 vrrp 10 priority 110

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 100

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 virtual-ip 10.10.10.1
 vrrp 10 priority 110

Question 19

A network engineer is deploying Cisco SD-Access and wants to ensure that traffic from employee endpoints is tunneled to a fabric border node for external connectivity. Which component is responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border?

Accepted Answer

Fabric edge node. Fabric edge nodes are the VTEPs that encapsulate endpoint traffic into VXLAN and forward it toward the border for external connectivity. They handle the mapping and tunneling of endpoint traffic, ensuring that employee endpoints can reach external networks through the fabric border. Control plane nodes manage mapping, border nodes decapsulate, and intermediate nodes only forward encapsulated packets.

Answer

Fabric border node

Answer

Fabric intermediate node

Answer

Fabric control plane node

Question 20

A network administrator is configuring a Cisco switch to support a new wireless LAN controller (WLC) that requires the switch port to carry traffic for multiple VLANs. The WLC will be connected to a trunk port. Which command must be used to configure the switch port as a trunk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

logging trap 4. The 'logging trap' command specifically controls the severity level of messages sent to remote syslog servers. Setting it to 4 ensures that only messages with severity 4 and higher (more severe) are sent. The other commands control console, buffer, and monitor logging, which are local destinations and do not affect remote syslog.

Answer

logging monitor 4

Answer

logging console 4

Answer

logging buffered 4