350-401 Practice Test 9 — 10 Questions

Question 1

Given the following configuration on a Cisco IOS-XE device:

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip ospf cost 10
!
interface GigabitEthernet0/1
 ip address 10.2.2.1 255.255.255.0
!

Which statement is true about OSPF operation?

Accepted Answer

GigabitEthernet0/0 will have an OSPF cost of 10, and GigabitEthernet0/1 will have a default cost based on its bandwidth.. The 'ip ospf cost' command overrides the default cost calculation based on bandwidth. The network command matches both interfaces because they fall under 10.0.0.0/8.

Answer

Both interfaces will have an OSPF cost of 10.

Answer

Both interfaces will have the same OSPF cost because they are in the same area.

Answer

OSPF will not run on either interface because the network command uses a wildcard mask of 0.255.255.255.

Question 2

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). BGP uses multiple attributes in its path selection algorithm. The weight attribute is Cisco-specific and is preferred with the highest value. The local preference is also preferred with the highest value. The MED (Multi-Exit Discriminator) is preferred with the lowest value.

Answer

Weight

Answer

Local Preference

Answer

AS Path Length

Question 3

Examine the following EIGRP configuration on a Cisco IOS-XE device:

router eigrp 100
 network 10.0.0.0 0.255.255.255
 passive-interface default
 no passive-interface GigabitEthernet0/0
!
interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 10.2.2.1 255.255.255.0

Which statement is true?

Accepted Answer

EIGRP will form an adjacency only on GigabitEthernet0/0.. The 'passive-interface default' command sets all interfaces as passive, meaning they do not send or receive EIGRP hellos. The 'no passive-interface' command overrides this for specific interfaces.

Answer

EIGRP will form adjacencies on both GigabitEthernet0/0 and GigabitEthernet0/1.

Answer

EIGRP will not form any adjacencies because the network command does not match the interface subnets.

Answer

EIGRP will form adjacencies on all interfaces except those with 'passive-interface' configured.

Question 4

Consider the following configuration:

flow monitor FM-1
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache entries 16000
!

Which statement about this configuration is correct?

Accepted Answer

The flow cache can hold up to 16,000 flow entries simultaneously.. The 'cache entries 16000' command under the flow monitor specifies the maximum number of flow entries that the NetFlow cache can hold simultaneously. This is a hard limit on the size of the flow cache, not a timer or byte limit. Therefore, the flow cache can store up to 16,000 concurrent flow records before it must either export or age out older entries to make room.

Answer

The flow cache will export flows every 16,000 seconds.

Answer

The flow cache will store only 16,000 bytes of flow data.

Answer

The flow cache will automatically increase to 32,000 entries if needed.

Question 5

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 6

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 7

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Accepted Answer

Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.. Cisco DNA Center's syslog collector listens on specific ports (default UDP 514). If the switch is configured to send syslog but DNA Center is not receiving it, a common issue is that the syslog port is blocked by a firewall or ACL between the switch and DNA Center. The engineer should verify network connectivity and port accessibility.

Answer

Check if the syslog messages are in the correct format.

Answer

Ensure that the switch is in the Inventory and managed by DNA Center.

Answer

Restart the syslog collector service on DNA Center.

Question 8

Examine this DHCP configuration:
```
ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8
 lease 0 12
!
ip dhcp excluded-address 10.10.10.1 10.10.10.10
```
Which statement is true?

Accepted Answer

DHCP clients will receive a lease for 12 hours.. The `lease 0 12` command explicitly sets the DHCP lease duration to 12 hours (0 days, 12 hours). The router will assign addresses from 10.10.10.11 to 10.10.10.254, as the excluded-address range (10.10.10.1–10.10.10.10) removes the first ten addresses from the pool, and the network statement defines the 10.10.10.0/24 subnet.

Answer

The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.

Answer

The default lease is used because the lease command is incomplete.

Answer

The DNS server is set to 8.8.8.8, but clients will ignore it.

Question 9

Examine the following configuration on a Cisco 9800 WLC:

wireless profile policy test-policy
 no security wpa
 no security wpa2
 security wpa3
 security wpa3 akm sae
 security ft over-the-ds

What is the effect of the 'security ft over-the-ds' command?

Accepted Answer

It enables 802.11r fast roaming using the distribution system for key exchange.. The 'security ft over-the-ds' command enables 802.11r Fast Transition (FT) using the Distribution System (DS) for key exchange. In this mode, the client and target AP communicate via the current AP over the wired network (DS) rather than over the air, reducing over-the-air overhead and improving roaming efficiency. This is in contrast to 'over-the-air' mode, where the client directly exchanges FT authentication messages with the target AP wirelessly.

Answer

It enables 802.11r fast roaming using over-the-air messaging.

Answer

It disables fast roaming for this policy.

Answer

It configures the AP to use a different radio band.

Question 10

A network engineer runs the following command on Router R7:

R7# show crypto ikev2 sa detail

IKEv2 SAs:

Session-id:1, Status:UP-ACTIVE, IKE count:1, Child count:1

Tunnel-id Local              Remote               Status         Role
   1         10.1.1.1/4500      10.2.2.2/4500        READY          INITIATOR
      Encr: AES-CBC 256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/3600 sec

Child SA: Local selector  10.1.1.0/0 - 10.1.1.255/65535
             Remote selector 10.2.2.0/0 - 10.2.2.255/65535
             ESP spi in/out: 0x12345678/0x87654321

Based on this output, what can be concluded?

Accepted Answer

The tunnel is using pre-shared keys for authentication.. The output shows 'Auth sign: PSK' and 'Auth verify: PSK', which explicitly indicates that pre-shared keys (PSK) are used for IKEv2 authentication. The status 'READY' and 'UP-ACTIVE' confirm the SA is operational, not failed. Therefore, option B is correct.

Answer

The IKEv2 SA is in a failed state because it is READY.

Answer

The tunnel is using RSA signatures for authentication.

Answer

The IKEv2 SA has expired because the life time is 86400 seconds.