350-401 Practice Test 9 — 10 Questions

Question 1

A network administrator is comparing configuration management tools and wants to use one that is agentless, uses YAML for playbooks, and communicates with Cisco IOS XE devices over SSH. Which tool best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ansible. Ansible is designed as an agentless automation tool that communicates over SSH and uses YAML playbooks. It provides network-specific modules for Cisco IOS XE, allowing configuration and command execution without installing software on the managed devices. This combination of agentless architecture, YAML syntax, and SSH transport exactly matches the administrator's requirements, distinguishing it from agent-based tools like Puppet, Chef, and SaltStack.

Answer

Puppet

Answer

Chef

Answer

SaltStack

Question 2

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 3

Examine the following configuration:

policy-map SHAPE_POLICY
 class class-default
  shape average 10000000
  service-policy INNER_POLICY

What is the purpose of the nested service-policy (service-policy INNER_POLICY) under the shape command?

Accepted Answer

It applies the INNER_POLICY to traffic after shaping, allowing per-class queuing within the shaped rate.. The nested service-policy under the shape command applies the INNER_POLICY to traffic after it has been shaped to 10 Mbps. This allows per-class queuing and scheduling within the shaped rate, enabling finer QoS control such as bandwidth allocation or priority queuing for specific traffic classes while ensuring the overall output does not exceed the shaped rate.

Answer

It applies the INNER_POLICY to traffic before shaping, which is not supported.

Answer

It is used to shape traffic twice, first at 10 Mbps and then again based on INNER_POLICY.

Answer

This configuration is invalid because service-policy cannot be nested under shape.

Question 4

A network engineer runs the following command on Router R1:

R1# show ip eigrp interfaces detail
EIGRP-IPv4 Interfaces for AS(100)

Interface: GigabitEthernet0/0
  Mtu: 1500, Bandwidth: 1000000 Kbit, Delay: 100 microseconds
  Reliability: 255/255, Load: 1/255, Min MTU: 1500
  Hello interval: 5 sec, Hold time: 15 sec
  Next hello in: 3 secs
  Passive interface: No
  Split horizon: Enabled
  Authentication: None
  Neighbor count: 1

Interface: GigabitEthernet0/1
  Mtu: 1500, Bandwidth: 100000 Kbit, Delay: 1000 microseconds
  Reliability: 255/255, Load: 1/255, Min MTU: 1500
  Hello interval: 5 sec, Hold time: 15 sec
  Next hello in: 1 secs
  Passive interface: No
  Split horizon: Enabled
  Authentication: None
  Neighbor count: 1

Based on this output, what can be concluded?

Accepted Answer

GigabitEthernet0/1 will have a higher EIGRP metric than GigabitEthernet0/0 for the same prefix.. EIGRP uses the composite metric formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * (K5 / (reliability + K4)). With default K values (K1=K3=1, others=0), the metric simplifies to bandwidth + delay. Gi0/0 has bandwidth 1,000,000 Kbit and delay 100 microseconds, while Gi0/1 has bandwidth 100,000 Kbit and delay 1000 microseconds. The lower bandwidth and higher delay on Gi0/1 result in a higher metric for the same prefix.

Answer

Both interfaces have the same metric weight for bandwidth and delay.

Answer

Interface Gi0/1 is configured as a passive interface.

Answer

EIGRP authentication is enabled on both interfaces.

Question 5

Consider this configuration:

interface Port-channel1
 switchport mode trunk
 switchport trunk native vlan 999
!
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active
!
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 999
 channel-group 1 mode active

What is the effect of the 'switchport trunk native vlan 999' command on the EtherChannel?

Accepted Answer

The EtherChannel will use VLAN 999 as the native VLAN, and any untagged frames will be associated with VLAN 999.. The 'switchport trunk native vlan 999' command on each physical interface and on the port-channel interface ensures that the EtherChannel uses VLAN 999 as the native VLAN. Untagged frames received on any member link are associated with VLAN 999, and frames tagged with VLAN 999 are sent untagged. Since the configuration is consistent across all interfaces, the EtherChannel forms correctly and operates with VLAN 999 as the native VLAN.

Answer

The EtherChannel will drop all untagged frames because the native VLAN is not in the allowed list.

Answer

The EtherChannel will not form because the native VLAN must be the same across all interfaces, which it is.

Answer

The EtherChannel will form but the native VLAN will be ignored on the port-channel.

Question 6

A company is deploying a virtualized network function (VNF) for a Cisco CSR1000v router on a VMware vSphere hypervisor. The architect must choose the hypervisor type to ensure the best performance for the VNF. Which hypervisor type is VMware vSphere classified as, and why is it suitable for VNF deployment?

Accepted Answer

Type 1 hypervisor; it runs directly on the hardware, offering near-native performance for VNFs.. VMware vSphere is a Type 1 (bare-metal) hypervisor because it installs directly onto the physical server hardware without requiring a host operating system. This architecture eliminates OS overhead, allowing the Cisco CSR1000v VNF to achieve near-native performance for packet processing and routing functions, which is critical for meeting throughput and latency requirements in SD-WAN deployments.

Answer

Type 2 hypervisor; it runs on top of an operating system, providing flexibility for VNF management.

Answer

Type 1 hypervisor; it requires a host OS for management, adding overhead.

Answer

Type 2 hypervisor; it is embedded in the hardware firmware.

Question 7

An enterprise is implementing Cisco TrustSec (CTS) to enforce role-based access control. The network engineer configures the switch with 'cts role-based enforcement' and 'cts manual' on an interface connecting to a trusted Cisco switch. The engineer also configures Security Group Tags (SGTs) on the RADIUS server. However, traffic between two hosts in different SGTs is not being filtered as expected. The engineer checks 'show cts role-based counters' and sees no drops. What is the most likely reason for the lack of enforcement?

Accepted Answer

The SGTs are not being propagated to the switch; the switch lacks SGT mappings for the hosts.. Cisco TrustSec enforcement relies on the switch having the correct SGT-to-IP mapping for each host. Even if SGTs are assigned on the RADIUS server and CTS role-based enforcement is enabled, the switch must learn the SGT for each source IP address. Without these mappings, the switch cannot classify traffic into SGTs and therefore cannot apply role-based ACLs, resulting in no drops in the counters.

Answer

The switch is not configured for 802.1X on the interface.

Answer

The 'cts manual' command is incorrect; 'cts dot1x' should be used instead.

Answer

The 'show cts role-based counters' command shows no drops, indicating the ACLs are not configured.

Question 8

A network engineer is configuring IPv6 First Hop Security on a Cisco switch to mitigate rogue RA attacks. The engineer enables RA guard on the switch and applies a policy that allows only the default gateway to send RAs. After configuration, hosts are unable to obtain IPv6 addresses via SLAAC. The engineer checks the switch and sees that RA guard is dropping all RAs. What is the most likely cause?

Accepted Answer

The RA guard policy does not include the IPv6 address or MAC address of the legitimate default gateway.. RA Guard drops Router Advertisements (RAs) based on a policy that defines which devices are authorized to send them. If the policy does not include the IPv6 address or MAC address of the legitimate default gateway, the switch will treat all RAs as unauthorized and drop them, preventing hosts from performing SLAAC. This is the most likely cause because the engineer enabled RA guard with a policy but failed to specify the trusted gateway's identity.

Answer

The switch has DHCPv6 snooping enabled, which conflicts with RA guard.

Answer

SLAAC requires the host to send a router solicitation first, which is being blocked by RA guard.

Answer

RA guard is configured in 'block' mode, which drops all RAs regardless of the policy.

Question 9

A network engineer executes the following command on Router R2:

R2# show ip sla configuration 1

IP SLAs Infrastructure Engine-II
Entry number: 1
Owner: admin
Tag:
Type of operation to perform: icmp-echo
Target address: 192.168.2.10
Source address: 192.168.2.1
Type Of Service parameter: 0x0
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Frequency (seconds): 60
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday, Starting Time: 00:00:01)
Status of entry (SNMP RowStatus): Active
Threshold (milliseconds): 5000
Distribution Statistics:
Number of statistic hours kept: 2
Number of statistic distribution buckets kept: 1
Statistic distribution interval (milliseconds): 20
Enhanced History:

Based on this output, what is the frequency of the IP SLA operation?

Accepted Answer

60 seconds. The command output shows 'Frequency (seconds): 60', which directly indicates that the IP SLA operation repeats every 60 seconds. This is the correct answer because the frequency parameter defines the time interval between successive probe executions.

Answer

30 seconds

Answer

120 seconds

Answer

5000 milliseconds

Question 10

A network engineer runs the following command on a Cisco WLC:

WLC# show wlan summary

WLAN ID   SSID               Status   Security   Interface
1         Guest              Enabled  Open       guest-vlan
2         Corporate          Enabled  WPA2       corp-vlan
3         IoT                Disabled WPA2       iot-vlan
4         Management         Enabled  WPA2       mgmt-vlan

Based on this output, what can be concluded?

Accepted Answer

WLAN 3 is not operational because it is disabled.. The 'show wlan summary' output clearly shows that WLAN 3 (IoT) has a Status of 'Disabled', meaning it is not operational and cannot serve clients. Only enabled WLANs can transmit beacons and accept client associations. Therefore, option B is correct because a disabled WLAN is effectively non-functional.

Answer

All WLANs are currently active and serving clients.

Answer

The Guest WLAN uses WPA2 security.

Answer

The Management WLAN is on the guest-vlan interface.