350-401 Mock Exam 92 — 25 Questions

Question 1

A network administrator is new to automation and wants to use a simple, agentless tool to push configuration changes to Cisco IOS XE devices. The administrator prefers using YAML for playbook definitions and wants to avoid installing software on the managed devices. Which tool best fits these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ansible. Ansible is an agentless automation tool that uses YAML for playbooks, making it easy to learn and use. It connects to network devices via SSH or NETCONF and does not require installing software on the devices. This aligns perfectly with the administrator's need for a simple, agentless solution.

Answer

Chef

Answer

SaltStack

Answer

Puppet

Question 2

A network engineer has configured an IP SLA operation on a Cisco router to monitor the reachability of a remote server. The engineer wants to ensure that the operation sends ICMP echo requests every 30 seconds and that the router tracks the operation's state to influence a static route. Which command is required to associate the IP SLA operation with the static route?

Accepted Answer

ip route 10.1.1.0 255.255.255.0 192.168.1.1 track 1. To associate an IP SLA operation with a static route, the engineer must use the 'track' keyword in the static route configuration. The tracked object is created separately and linked to the IP SLA operation. This allows the static route to be withdrawn if the IP SLA operation fails, providing reliable path failover based on reachability.

Answer

ip route 10.1.1.0 255.255.255.0 192.168.1.1 sla 1

Answer

ip route 10.1.1.0 255.255.255.0 192.168.1.1 ip sla 1

Answer

ip route 10.1.1.0 255.255.255.0 192.168.1.1 monitor 1

Question 3

A network automation team needs to securely retrieve the running configuration from 200 Cisco IOS XE routers daily using a Python script. The script must authenticate with individual user credentials, use a structured data format, and avoid screen-scraping. Which approach best meets these requirements?

Accepted Answer

Use the ncclient Python library to send NETCONF RPCs over SSH, requesting the datastore with a YANG-modeled filter.. NETCONF over SSH with ncclient delivers secure, credential-based access and returns configuration data as structured XML governed by YANG models. This eliminates the fragility of parsing CLI text and avoids screen-scraping. The other approaches either return unstructured output, cannot retrieve full configurations reliably, or rely on UI scraping, so they do not meet the stated automation requirements.

Answer

Use SNMPv3 GET requests with the OID for the running configuration MIB object to retrieve the full configuration.

Answer

Use the requests library to send HTTP GET requests to the device's web UI login page, then scrape the configuration page HTML.

Answer

Use the paramiko library to open an SSH session and execute the 'show running-config' command, then parse the raw text output.

Question 4

A network security team is hardening a Cisco IOS-XE router that terminates IPsec VPN tunnels. They want to protect the control plane from CPU-intensive IKE and management traffic without dropping legitimate tunnel establishment packets. They decide to apply a Control Plane Policing (CoPP) policy. Which statement best describes how CoPP interacts with the forwarding plane and the control plane on this router?

Accepted Answer

CoPP uses MQC to classify traffic destined to the route processor and applies a policer in the control-plane host path, so it can rate-limit IKE and SSH without affecting transit traffic that is forwarded in hardware.. CoPP applies MQC classification and policing to packets destined for the route processor via the control-plane host path, protecting the CPU from floods of IKE, SSH, or SNMP without touching hardware-forwarded transit traffic. It is configured once under 'control-plane', not per interface, and does not require distributed CEF or NBAR2 to match common control-plane protocols.

Answer

CoPP can only classify traffic using NBAR2 deep packet inspection, so it cannot match IKE or SSH and requires a separate Zone-Based Firewall policy to protect the control plane.

Answer

CoPP requires enabling 'ip cef distributed' and a PFC on the supervisor to offload policed control traffic to hardware, otherwise it cannot rate-limit IKE packets.

Answer

CoPP classifies and polices all packets entering any interface, including transit traffic, so it must be applied with 'service-policy input' on every physical interface to be effective.

Question 5

A network administrator is deploying Cisco ACI in a data center. The administrator needs to ensure that a new tenant's application profile can communicate with an external Layer 2 network that is connected to a border leaf switch. Which ACI construct must be configured to extend the tenant's bridge domain to the external network?

Accepted Answer

A Layer 2 Outside (L2Out). To extend a Cisco ACI bridge domain to an external Layer 2 network, an L2Out must be configured. This construct defines the external bridged domain and network, and is applied to a border leaf interface. It allows Layer 2 traffic to pass between the ACI fabric and external devices, preserving VLAN tags or mapping them as needed.

Answer

A Layer 3 Outside (L3Out)

Answer

A VXLAN tunnel to the external switch

Answer

A bridge domain with a flood scope of 'external'

Question 6

A network administrator is configuring a Cisco IOS XE router to protect against spoofed source addresses on an internal interface facing user subnets. The requirement is to drop packets whose source address does not match the routing table entry for the incoming interface. Which feature should be enabled?

Accepted Answer

Unicast Reverse Path Forwarding (uRPF) in strict mode on the interface. Unicast RPF in strict mode checks the routing table for the source address of each incoming packet and verifies that the source is reachable via the same interface the packet arrived on. If not, the packet is dropped, which prevents source address spoofing. This is the standard IOS XE feature for validating source addresses on an interface against the routing table.

Answer

Access Control List with the log keyword applied to the interface

Answer

IP Source Guard on the interface

Answer

Dynamic ARP Inspection on the interface

Question 7

A network architect is designing a campus network that must support thousands of endpoints with a fabric overlay. The design requires that the underlay provide fast convergence and equal-cost multipathing without running a separate routing protocol in the overlay. Which underlay routing protocol should be selected to meet these requirements?

Accepted Answer

Intermediate System-to-Intermediate System (IS-IS). Cisco SD-Access recommends IS-IS as the underlay routing protocol because it provides fast convergence, scalable ECMP, and clean separation from the LISP/VXLAN overlay. OSPF, EIGRP, and BGP can provide routing but are not the standard underlay choice for large fabric deployments and may add complexity or converge more slowly in this context.

Answer

Enhanced Interior Gateway Routing Protocol (EIGRP)

Answer

Border Gateway Protocol (BGP)

Answer

Open Shortest Path First (OSPF) with multiple areas

Question 8

A network automation engineer is using the Cisco DNA Center Intent API to retrieve a list of all network devices. The engineer needs to authenticate to the API. Which authentication method should be used to obtain a token for subsequent API calls?

Accepted Answer

POST to the /dna/system/api/v1/auth/token endpoint with Basic authentication.. The Cisco DNA Center Intent API uses token-based authentication. The client must POST to the /dna/system/api/v1/auth/token endpoint with Basic authentication credentials. The response includes a token that is then used in the X-Auth-Token header for subsequent API calls. This is the documented and required method for API access.

Answer

OAuth 2.0 client credentials grant flow.

Answer

API key passed in the X-Auth-Token header.

Answer

Basic authentication with username and password in the Authorization header.

Question 9

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) for a high-density auditorium. The engineer wants to ensure that clients can roam seamlessly between access points while maintaining consistent security policies. Which Cisco wireless architecture feature should be enabled to allow controllers to share client context and facilitate inter-controller roaming?

Accepted Answer

Mobility Group. A Mobility Group is a set of Cisco WLCs configured to share client context and support seamless roaming. When a client roams between controllers, the controllers exchange information via the mobility group, ensuring that security policies and client state are maintained. This is critical in high-density environments with multiple controllers. Mobility Express, FlexConnect, and OfficeExtend serve different purposes.

Answer

FlexConnect

Answer

OfficeExtend

Answer

Mobility Express

Question 10

A network administrator is configuring a Cisco wireless controller to support a high-density auditorium. The design requires that client devices be evenly distributed across available access points and that roaming be optimized for voice traffic. Which feature should be enabled to achieve these goals?

Accepted Answer

Cisco Client Load Balancing. Cisco Client Load Balancing is designed to distribute clients evenly across access points by managing association requests. In a high-density auditorium, this prevents any single AP from becoming overloaded, improving overall performance. For voice roaming, additional features like 802.11k/v/r are recommended, but the primary feature for even distribution is load balancing, which directly addresses the stated requirement.

Answer

Cisco Aironet Extensions

Answer

Cisco Band Select

Answer

Cisco CleanAir

Question 11

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, the switch will allow devices to connect with limited access. Which feature should be configured?

Accepted Answer

Inaccessible Authentication Bypass. Inaccessible Authentication Bypass is designed to handle the situation where the RADIUS server is unreachable. It allows the switch to apply a preconfigured access policy, often assigning the port to a critical VLAN, ensuring that devices can still connect with limited access. This meets the requirement of maintaining connectivity during server outages.

Answer

MAC Authentication Bypass

Answer

Critical VLAN

Answer

Guest VLAN

Question 12

A network administrator is configuring a Cisco IOS switch to authenticate users via 802.1X. The administrator wants to ensure that if the RADIUS server is unreachable, users are placed into a guest VLAN with limited access. Which feature should be configured to achieve this?

Accepted Answer

Configure authentication event server dead action authorize vlan 100 under the interface.. To place users into a guest VLAN when the RADIUS server is unreachable, the authentication event server dead action authorize vlan command must be configured on the interface. This command triggers the fallback VLAN when the server is marked dead. The other options address different authentication events or host modes and do not provide the required server-dead fallback.

Answer

Configure authentication host-mode multi-auth under the interface.

Answer

Configure authentication open under the interface.

Answer

Configure authentication event fail action authorize vlan 100 under the interface.

Question 13

A network engineer is implementing Cisco SD-Access and needs to ensure that the fabric provides policy-based segmentation and mobility for endpoints. Which component is responsible for maintaining the endpoint location and identity information?

Accepted Answer

LISP Map-Server. The LISP Map-Server is responsible for maintaining endpoint location and identity information in Cisco SD-Access. It registers EID-to-RLOC mappings from fabric edge nodes and provides them to other nodes upon request. This enables seamless mobility and policy-based segmentation, as endpoints can be reached regardless of their physical location. Other components like DNA Center and ISE play different roles in management and policy.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco DNA Center

Answer

VXLAN Tunnel Endpoint (VTEP)

Question 14

A network architect is designing a QoS policy for a Cisco Catalyst switch. The architect needs to ensure that voice traffic is marked with the appropriate DSCP value for expedited forwarding. Which DSCP value should be used for voice traffic?

Accepted Answer

EF (46). Voice traffic should be marked with DSCP EF (46) to ensure expedited forwarding, which provides low latency, jitter, and loss. Other DSCP values like AF31 are used for call signaling, while CS6 and CS7 are reserved for network control. Proper marking ensures that voice packets receive priority treatment in QoS-enabled networks.

Answer

CS7 (56)

Answer

CS6 (48)

Answer

AF31 (26)

Question 15

An engineer is configuring a Cisco IOS XE switch to secure the management plane. The requirement is to allow SSH only from the management subnet 10.10.10.0/24 and block all other management protocols such as Telnet and HTTP. Which configuration approach best meets this requirement?

Accepted Answer

Apply an ACL to the VTY lines with transport input ssh and configure the ACL to permit 10.10.10.0/24 only.. The VTY lines control remote management access. Setting transport input ssh disables Telnet and other line protocols, while an access-class ACL applied to the VTY lines filters source addresses before login. Permitting only 10.10.10.0/24 satisfies the subnet restriction. Together these settings secure the management plane by limiting both the protocol and the source of administrative connections.

Answer

Configure an ACL on the management VLAN SVI to deny Telnet and HTTP, and rely on the default transport input all on the VTY lines.

Answer

Enable AAA with a local database and configure privilege levels so that only users from 10.10.10.0/24 can log in.

Answer

Configure ip http secure-server, disable ip http server, and apply an ACL to the VTY lines that permits any source using SSH.

Question 16

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint. The engineer needs to define the source interface used for the VXLAN tunnels and map VLANs to a VNI. Which command sequence accomplishes this?

Accepted Answer

feature nv overlay, interface nve1, source-interface loopback1, member vni 10000, then under interface Vlan100 configure vn-segment 10000. On Nexus 9000 NX-OS, VXLAN configuration requires enabling the NV overlay feature, creating interface nve1, specifying the loopback as the tunnel source, adding the VNI as a member, and mapping the VLAN to the VNI with vn-segment under the VLAN interface. The other options misplace commands or use syntax from other platforms.

Answer

interface nve1, then source-interface loopback1, then member vni 10000 associated-vrf tenant1

Answer

interface nve1, then source-interface loopback1, then member vni 10000, then vlan 100 under the VNI

Answer

interface vxlan1, then source-interface loopback1, then vni 10000 vlan 100 mapping

Question 17

A network engineer is configuring a Cisco IOS router to act as a DHCP relay agent for a subnet that has no local DHCP server. The DHCP server is at 10.10.10.5, and the router interface facing the clients is GigabitEthernet0/1 with IP address 10.20.20.1. Which command must be applied to the interface so that client DHCP broadcasts are forwarded to the server?

Accepted Answer

ip helper-address 10.10.10.5. DHCP relay is enabled by placing ip helper-address on the interface receiving client broadcasts. The router then converts those broadcasts into unicast packets toward the specified server and populates the giaddr field so the server can identify the correct subnet. The other commands either do not exist, do not specify a server, or configure the router as a server rather than a relay, so they do not meet the requirement.

Answer

ip dhcp relay 10.10.10.5

Answer

ip forward-protocol udp 67

Answer

ip dhcp pool CLIENT relay 10.10.10.5

Question 18

A network engineer is configuring a Cisco Catalyst switch to send flow data to a NetFlow collector for traffic analysis. The engineer wants to ensure that only ingress traffic on a specific interface is exported. Which command is required to enable NetFlow on that interface?

Accepted Answer

ip flow ingress. To enable NetFlow for ingress traffic on a specific interface, the 'ip flow ingress' command must be applied in interface configuration mode. This command activates flow capture for packets entering the interface. The other options either enable egress flow, use an outdated method, or configure the export destination rather than enabling flow capture.

Answer

ip flow egress

Answer

ip route-cache flow

Answer

ip flow-export destination

Question 19

A network engineer is using the Python requests library to interact with a Cisco IOS XE device's RESTCONF API. The engineer wants to retrieve the configured hostname. Which HTTP method and URI should be used?

Accepted Answer

GET https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname. To retrieve the hostname via RESTCONF, the engineer must use the GET method with the correct URI that points to the hostname leaf in the Cisco IOS XE native YANG model. The URI structure includes the module name (Cisco-IOS-XE-native), the container (native), and the leaf (hostname). This is a straightforward read operation.

Answer

PUT https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname

Answer

POST https://<device-ip>/restconf/data/Cisco-IOS-XE-native:native/hostname

Answer

GET https://<device-ip>/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1

Question 20

A network engineer is configuring a new Cisco Catalyst 9300 switch stack. The design requires that if the active switch fails, the standby switch takes over the active role, and the member switch that was formerly standby becomes the new standby. The engineer needs to verify and influence the election order. Which mechanism determines the active and standby switch election in a switch stack?

Accepted Answer

The switch with the highest priority value becomes active, and the switch with the second-highest priority becomes standby.. Stack priority is the primary factor in electing the active and standby switches. A higher priority wins; if priorities are equal, the lower MAC address wins. This allows administrators to design deterministic failover by setting priorities appropriately. The other options incorrectly cite MAC address, serial number, or power-on order as the primary election criteria.

Answer

The switch that is powered on first becomes active, and the switch that is powered on last becomes standby.

Answer

The switch with the lowest MAC address is always active, and the switch with the highest MAC address is always standby.

Answer

The switch with the highest serial number becomes active, and the switch with the second-highest serial number becomes standby.