350-401 Mock Exam 91 — 25 Questions

Question 1

A network architect is designing a WAN with Cisco SD-WAN. The requirement is to ensure that traffic from a branch office to a critical SaaS application is prioritized and uses the best path based on real-time performance metrics. Which Cisco SD-WAN feature should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application-Aware Routing. Application-Aware Routing is the correct feature because it uses real-time performance metrics to select the best path for applications, ensuring critical SaaS traffic is prioritized and uses the optimal path. It integrates with QoS to enforce prioritization, meeting the requirement. Other features like DIA and QoS address different aspects but do not provide dynamic path selection based on performance.

Answer

Cisco Umbrella

Answer

Quality of Service (QoS)

Answer

Direct Internet Access (DIA)

Question 2

A network security architect is designing a Zero Trust architecture for a campus network using Cisco Identity Services Engine (ISE) and Cisco TrustSec. The requirement is to enforce segmentation based on user identity and device posture, and to apply policy dynamically as users move between wired and wireless access points. Which Cisco TrustSec component is responsible for tagging packets with a Security Group Tag (SGT) at the access layer?

Accepted Answer

The access layer switch or wireless controller that supports Cisco TrustSec.. In Cisco TrustSec, the access layer device performs classification and tagging by inserting the SGT into the packet after authentication and authorization. ISE nodes define and evaluate policy, but they do not tag packets. This design allows dynamic segmentation to follow users as they move between wired and wireless access points.

Answer

The Policy Administration Node (PAN) in Cisco ISE.

Answer

The Policy Enforcement Node (PEN) in Cisco ISE.

Answer

The Cisco DNA Center appliance.

Question 3

A network engineer is using Cisco DNA Center Assurance to monitor and troubleshoot a network. The engineer wants to use the Assurance features to proactively detect issues and receive recommendations. Which two statements are true about Cisco DNA Center Assurance capabilities? (Choose two.)

Accepted Answer

It integrates with Cisco Identity Services Engine (ISE) to provide client authentication details.. Cisco DNA Center Assurance uses machine learning to correlate events and identify root causes, enabling proactive issue detection. It also integrates with Cisco ISE to provide client authentication details, enhancing troubleshooting for identity-related issues. These two capabilities are fundamental to Assurance's value proposition. The other statements are false: Assurance does provide historical data, does not automatically remediate without human intervention, and supports virtual deployments.

Answer

It can automatically apply configuration changes to remediate issues without human intervention.

Answer

It provides real-time monitoring of network devices but does not offer historical data analysis.

Answer

It requires the use of Cisco DNA Center appliances only; virtual deployments are not supported.

Question 4

A network engineer is deploying Cisco DNA Center Assurance to monitor a campus fabric. The engineer needs to verify that the fabric underlay and overlay health scores are being calculated correctly. Which data source does Cisco DNA Center Assurance primarily use to compute the fabric health score?

Accepted Answer

Streaming telemetry from fabric nodes via the network data platform. Cisco DNA Center Assurance computes fabric health scores using streaming telemetry collected by the Network Data Platform. This telemetry includes underlay and overlay performance metrics, control plane status, and client health. The NDP processes this data to generate real-time health scores, enabling proactive monitoring and troubleshooting. Other data sources like SNMP, syslog, or NetFlow supplement assurance but are not the primary basis for fabric health scoring.

Answer

Syslog messages forwarded to the DNA Center syslog collector

Answer

SNMP polling of fabric edge nodes every 5 minutes

Answer

NetFlow records exported from fabric edge switches

Question 5

A network security administrator is configuring a Cisco IOS Zone-Based Firewall on a branch router. The inside zone and outside zone are defined, and the administrator wants to allow inside hosts to initiate sessions to outside servers while preventing outside hosts from initiating sessions to inside hosts. Which configuration accomplishes this?

Accepted Answer

A zone pair from inside to outside with a policy that inspects the relevant traffic, and no zone pair from outside to inside.. Zone-Based Firewall policy is directional and defined by zone pairs. An inside-to-outside zone pair with an inspect action permits inside-initiated sessions and statefully allows return traffic, while the absence of an outside-to-inside zone pair causes traffic initiated from the outside to be dropped by the default inter-zone policy, achieving the required asymmetry.

Answer

A zone pair from outside to inside with an inspect action and no zone pair from inside to outside.

Answer

A single zone pair from inside to outside with a drop action, and a class-map matching return traffic.

Answer

A zone pair from outside to inside with a policy that inspects traffic, plus a zone pair from inside to outside with a pass action.

Question 6

A network engineer is deploying a Cisco Catalyst 9300 switch stack that will host several isolated tenant environments. Each tenant must have its own separate routing table and its own independent instance of a dynamic routing protocol on the same physical switch, while sharing the same physical uplinks to the core. Which technology should the engineer implement to meet these requirements?

Accepted Answer

Virtual Routing and Forwarding (VRF). VRF is the Cisco IOS/IOS-XE feature that partitions a single physical router or switch into multiple logically separate Layer 3 routing domains. Each VRF maintains its own routing and forwarding table and can run its own routing protocol process, which is exactly what is needed when several tenants must share hardware and uplinks while remaining logically isolated.

Answer

Virtual Switching System (VSS)

Answer

Private VLAN (PVLAN) configuration

Answer

VLAN access map on the uplink

Question 7

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect against DoS attacks. The router has a management plane that must remain accessible via SSH and SNMP, and a control plane that must process BGP and OSPF routing updates. The administrator applies a CoPP policy that rate-limits all traffic destined to the control plane to 1000 pps, except for traffic from trusted management subnets. After applying the policy, BGP sessions flap intermittently. What is the most likely cause?

Accepted Answer

The CoPP policy is rate-limiting BGP keepalives and updates, causing session timeouts.. CoPP policies must be carefully designed to avoid throttling critical control plane protocols. A blanket rate limit of 1000 pps may be insufficient for BGP, especially if there are many peers or frequent updates. BGP keepalives are sent every 60 seconds by default, but updates and other messages can burst. If the policer drops these, sessions can flap. The correct approach is to create granular class-maps that match BGP and other routing protocols, and assign appropriate rates or exempt them from policing.

Answer

The CoPP policy is applied to the data plane instead of the control plane, causing routing updates to be dropped.

Answer

The CoPP policy is incorrectly classifying SSH traffic as BGP, leading to rate limiting of SSH.

Answer

The CoPP policy is dropping SNMP traps, causing BGP to lose its peer state.

Question 8

A network engineer is designing a QoS policy for a Cisco Catalyst switch that will carry voice, video, and data traffic. The engineer wants to ensure that voice traffic receives strict priority queuing, video traffic gets guaranteed bandwidth, and data traffic uses leftover bandwidth. The switch supports Cisco Modular QoS CLI (MQC). Which queuing mechanism should be configured on the egress interface to meet these requirements?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the correct queuing mechanism because it combines strict priority queuing for voice with guaranteed bandwidth for other classes like video. It is configured using MQC with a priority command for voice and bandwidth commands for other classes. CBWFQ lacks strict priority, WRED is a congestion avoidance tool, and FIFO provides no differentiation. Thus, LLQ meets all the stated requirements.

Answer

First-In, First-Out (FIFO) queuing

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

Weighted Random Early Detection (WRED)

Question 9

A network engineer is deploying Cisco SD-Access and needs to ensure that endpoint IP addresses are mapped to fabric locators so that the fabric can forward traffic between wired and wireless clients. Which control-plane node role is responsible for maintaining this mapping database?

Accepted Answer

Fabric control-plane node. In Cisco SD-Access, the control-plane node runs LISP map-server and map-resolver functions. Edge nodes register endpoint EID-to-RLOC mappings with it, and other edges query it to resolve destinations before encapsulating VXLAN traffic. Border and intermediate nodes handle external connectivity and underlay transport respectively, so they do not own the mapping database required by the scenario.

Answer

Fabric border node

Answer

Fabric intermediate node

Answer

Fabric edge node

Question 10

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has a single physical interface Gi0/0/0 that carries both management SSH traffic and transit data traffic. The administrator wants the CoPP policy to apply only to traffic destined to the router's control plane, not to transit traffic. Which CoPP configuration element must be applied to achieve this?

Accepted Answer

Apply the policy-map to the control-plane global configuration using the service-policy command under control-plane.. CoPP protects the route processor by policing traffic that is punted to the control plane. The policy-map must be attached to the control-plane interface with the service-policy command under the control-plane global configuration. Applying a policy to a physical interface or in the output direction would affect transit or outbound traffic, not the control-plane path.

Answer

Apply the policy-map to the Gi0/0/0 interface in the input direction using the service-policy command.

Answer

Apply the policy-map to the Gi0/0/0 interface in the output direction using the service-policy command.

Answer

Apply the policy-map to the management VRF using the service-policy command under vrf definition.

Question 11

A network engineer is deploying a new branch office and needs to assign IPv6 addresses to hosts on the LAN segment. The engineer wants hosts to automatically configure their own addresses using the MAC address and the network prefix, without relying on a DHCPv6 server. Which IPv6 address assignment method should be configured on the router interface?

Accepted Answer

SLAAC. SLAAC enables hosts to automatically generate IPv6 addresses using the prefix from Router Advertisements and their interface identifier, without needing a DHCPv6 server. This matches the requirement for self-configuration. Stateful DHCPv6 requires a server, static addressing is manual, and prefix delegation is for router-to-router prefix assignment, not host addressing.

Answer

Static IPv6 addressing

Answer

DHCPv6 prefix delegation

Answer

Stateful DHCPv6

Question 12

A retail company wants its network engineers to push consistent OSPF configurations to dozens of Cisco IOS XE routers using a declarative, agentless automation tool that connects over SSH and does not require installing software on the managed devices. Which tool best fits these requirements?

Accepted Answer

Ansible, using modules such as ios_config with an inventory of IOS XE devices and SSH credentials.. Ansible is the agentless, declarative tool that connects over SSH and uses network-specific modules to configure Cisco IOS XE devices. It needs no software installed on the routers, relying instead on SSH and Python executed on the control node. Puppet, Chef, and SaltStack in their default forms require an agent on the managed node, which IOS XE cannot host, so they fail the stated agentless requirement.

Answer

Puppet, using a master-agent architecture with the Puppet agent installed on each IOS XE router.

Answer

Chef, using a Chef client installed directly on each Cisco IOS XE router to converge configuration.

Answer

SaltStack, using Salt minions installed locally on every IOS XE device to receive configuration commands.

Question 13

A security team is deploying Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. They notice that after applying a CoPP policy, OSPF adjacency with a directly connected neighbor flaps intermittently. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Accepted Answer

Add a class-map matching OSPF traffic and associate it with a policer that has a higher committed information rate.. CoPP uses class-maps and policy-maps to rate-limit traffic destined to the control plane. If the default policer for routing protocols is too low, OSPF hellos can be dropped, causing adjacency flaps. Creating a dedicated class for OSPF and assigning a policer with a higher committed information rate allows legitimate routing traffic while still protecting the route processor.

Answer

Configure OSPF authentication on the interface to reduce the volume of OSPF packets processed.

Answer

Remove the CoPP policy from the control plane and rely on ACLs on the management interface.

Answer

Change the CoPP policy to use a police rate of 8000 pps for all traffic classes.

Question 14

A network administrator needs to securely manage a Cisco Catalyst switch remotely. The requirement is to encrypt all management traffic, including username and password, between the administrator's workstation and the switch. Which management protocol should be enabled on the switch to meet this requirement?

Accepted Answer

SSH version 2. SSH version 2 encrypts the full management session, protecting credentials and commands in transit, which is exactly what the policy requires. Telnet and HTTP send data in cleartext, and SNMPv2c is neither encrypted nor intended for interactive CLI management. Enabling SSHv2 and disabling insecure protocols satisfies the encrypted remote administration requirement.

Answer

Telnet

Answer

HTTP

Answer

SNMPv2c

Question 15

A network engineer is deploying a new branch office that must use dynamic ARP inspection (DAI) on its access switches. The engineer wants to minimize manual configuration while ensuring that only valid IP-to-MAC bindings are permitted. Which feature should be enabled on the switches to provide the required binding information to DAI?

Accepted Answer

DHCP snooping. Dynamic ARP inspection relies on the DHCP snooping binding table to validate ARP packets on untrusted ports. Without a source of legitimate IP-to-MAC bindings, DAI cannot distinguish spoofed ARP replies from valid ones. Enabling DHCP snooping on the access switches automatically populates that table as clients obtain leases, which satisfies the requirement to minimize manual configuration while protecting the branch office from ARP poisoning.

Answer

802.1X

Answer

IP Source Guard

Answer

Port security

Question 16

A network architect is selecting a switching platform for a data center access layer that must support lossless Ethernet for FCoE. The platform must provide per-priority flow control so that storage traffic can be paused without affecting LAN traffic. Which technology should the architect specify?

Accepted Answer

Priority Flow Control (PFC). Lossless Ethernet for FCoE requires a mechanism that can pause a specific traffic class without stopping all traffic on the link. Priority Flow Control does exactly that by acting on CoS values, allowing storage frames to be paused while ordinary LAN traffic continues. LLDP, EtherChannel, and jumbo frames each address different concerns and none provides per-priority pause.

Answer

EtherChannel with LACP

Answer

Jumbo frame support

Answer

Link Layer Discovery Protocol (LLDP)

Question 17

A network engineer is designing a Python script to interact with a Cisco Catalyst Center (formerly DNA Center) appliance using its Intent API. The script must retrieve a list of all network devices and then update the location of a specific device. Which two steps are required to authenticate and authorize the API requests? (Choose two.)

Accepted Answer

Send a POST request to /dna/system/api/v1/auth/token with Basic Authentication credentials to obtain a token.. To authenticate with the Catalyst Center Intent API, the engineer must first obtain a token by sending a POST request to the authentication endpoint with Basic Authentication. Then, that token must be included in the X-Auth-Token header for all subsequent API calls. This two-step process ensures secure, token-based access to the API.

Answer

Configure a separate API user with role-based access control (RBAC) permissions to allow read and write operations.

Answer

Enable the Intent API on the Catalyst Center appliance by running the intent-api enable command in the CLI.

Answer

Include the username and password in every API request as query parameters.

Question 18

A network engineer is using NetFlow to monitor traffic on a Cisco router. The engineer wants to export NetFlow data to a collector for analysis. Which two commands are required to configure NetFlow export on the router? (Choose two.)

Accepted Answer

ip flow-export destination 192.168.1.100 2055. To export NetFlow data, the router must be configured with the destination collector address and port, and the export version. The ip flow-export destination command specifies where to send the data, and the ip flow-export version command specifies the format. These two commands are essential for the export process. Enabling NetFlow on interfaces is also needed, but that is not part of the export configuration commands.

Answer

ip flow ingress

Answer

ip flow-cache timeout active 1

Answer

ip flow-top-talkers

Question 19

A network engineer is deploying a virtualized branch solution using Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS). The goal is to run multiple virtual network functions such as a virtual router and a virtual firewall on a single Cisco UCS E-Series or C-Series server at the branch. Which statement accurately describes how NFVIS supports this deployment?

Accepted Answer

NFVIS provides a hypervisor and lifecycle management for hosting multiple VNFs on the branch server. Cisco NFVIS is a KVM-based virtualization platform that supplies the hypervisor, VM lifecycle management, and orchestration needed to run multiple virtual network functions on a single branch server. This enables consolidating a virtual router, virtual firewall, and other services at the branch, which matches the engineer's deployment goal.

Answer

NFVIS replaces the need for any hypervisor by running VNFs directly on bare metal without virtualization

Answer

NFVIS only supports a single VNF per physical server and cannot host multiple virtual machines

Answer

NFVIS is a cloud-only orchestration tool that cannot run on branch appliances

Question 20

A network engineer is deploying 802.1X on Catalyst access switches with Cisco ISE as the RADIUS server. Some endpoints, such as printers and badge readers, do not support 802.1X supplicants. The design must allow these devices onto a restricted VLAN while still requiring authentication for laptops. Which TWO mechanisms should the engineer configure to achieve this? (Choose two.)

Accepted Answer

Configure MAB (MAC Authentication Bypass) on the switch ports to authenticate non-supplicant devices using their MAC address against ISE.. The design needs one port configuration that serves both endpoint types. MAB authenticates non-supplicant devices by MAC address through ISE, and the authentication order of dot1x followed by mab ensures supplicant-capable laptops use 802.1X while printers and badge readers fall back to MAB. Together these provide differentiated, authenticated access without per-port manual reconfiguration.

Answer

Apply an ACL that permits only MAC addresses in the OUI range of the printer vendor.

Answer

Configure the switch to use TACACS+ for endpoint authentication instead of RADIUS.

Answer

Disable 802.1X on the ports used by non-supplicant devices and assign them to a static VLAN.