350-401 Mock Exam 96 — 25 Questions

Question 1

A network engineer is deploying a new Cisco wireless network using a 9800 Series Wireless Controller. The engineer wants to ensure that the management interface is properly configured for out-of-band management. Which interface type should be configured with an IP address for management access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management interface. The management interface on a Cisco 9800 Series Wireless Controller is specifically designed for out-of-band management. It requires an IP address, subnet mask, and default gateway to allow administrators to access the controller via SSH, HTTPS, or SNMP. Other interfaces like the redundancy management interface, service port, and virtual interface serve different purposes and are not used for primary management access.

Answer

Virtual interface

Answer

Redundancy management interface

Answer

Service port

Question 2

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. The engineer must ensure that the control plane and data plane are secure and that routers can authenticate to the controllers. Which two statements are true regarding the Cisco SD-WAN controller components? (Choose two.)

Accepted Answer

vSmart distributes control plane policies and routes to vEdge routers using OMP.. In Cisco SD-WAN, vBond orchestrates initial authentication and helps routers find other controllers. vSmart distributes control plane policies and routes using OMP. These two components are essential for establishing the secure overlay and enabling centralized control. The management plane (vManage) and data plane (vEdge routers) have different roles.

Answer

vSmart stores the full configuration and acts as the CA for certificate management.

Answer

vManage is responsible for forwarding data plane traffic between branches.

Answer

vBond establishes IPsec tunnels for data plane traffic between vEdge routers.

Question 3

A network engineer is analyzing the output of the show processes cpu sorted command on a Cisco Catalyst 9300 switch and notices that the CPU utilization is consistently high. Which two methods can help identify the cause of high CPU utilization? (Choose two.)

Accepted Answer

Use the show processes cpu history command to view CPU utilization over time.. The show processes cpu history command provides historical CPU utilization graphs, helping correlate spikes with events. The show processes cpu sorted command lists processes by CPU usage, directly identifying the top consumers. Together, they allow an engineer to pinpoint which process is causing high CPU and when it occurs. The other commands provide additional context but are not the primary methods for identifying the cause of high CPU.

Answer

Use the show interfaces counters errors command to check for interface errors.

Answer

Use the show tech-support command to collect all diagnostic information.

Answer

Use the show platform resources command to view hardware resource utilization.

Question 4

A network architect is designing a Fabric-enabled campus with Cisco SD-Access and must choose the optimal underlay routing protocol. The fabric will use VXLAN data-plane encapsulation, and the architect wants minimal configuration on the intermediate underlay devices while supporting fast convergence and equal-cost multipath. Which underlay routing approach should be recommended?

Accepted Answer

Use Cisco SD-Access fabric with an IS-IS underlay automatically enabled by the fabric provisioning workflow.. Cisco SD-Access uses an IS-IS underlay that is automatically provisioned by Cisco DNA Center, reducing manual configuration on intermediate devices while supporting fast convergence and ECMP. OSPFv2 and eBGP require explicit per-device configuration and are not the automated fabric underlay. RIPng is unsuitable due to hop limits and slow convergence.

Answer

Enable RIPng on all underlay devices to provide simple hop-count-based routing.

Answer

Deploy eBGP between all underlay switches using unique autonomous system numbers per device.

Answer

Configure OSPFv2 in a single area on all underlay devices, including the fabric edge and border nodes.

Question 5

A network engineer is implementing a Cisco TrustSec solution. The engineer needs to classify traffic based on user identity and apply security policies accordingly. Which component is responsible for tagging packets with a Security Group Tag (SGT) at the ingress point?

Accepted Answer

Ingress Policy Enforcement Point (Ingress PEP). In Cisco TrustSec, the Ingress Policy Enforcement Point (Ingress PEP) is the device that first receives traffic into the TrustSec domain. It classifies the traffic, determines the source Security Group Tag (SGT), and inserts the SGT into the packet. This tag is then used by other enforcement points to apply security policies. The PDP (ISE) provides the policy, but the Ingress PEP performs the tagging.

Answer

Policy Enforcement Point (PEP)

Answer

Policy Decision Point (PDP)

Answer

Network Device Admission Control (NDAC)

Question 6

A network engineer is using Cisco DNA Center Assurance to troubleshoot a wireless client that frequently disconnects. The engineer wants to identify the root cause by examining relevant assurance data. Which two types of information are available in the Client 360 view to help diagnose the issue? (Choose two.)

Accepted Answer

RF statistics for the client. Client 360 in Cisco DNA Center Assurance provides a comprehensive view of a specific client's connectivity, including onboarding history and RF statistics. Onboarding history reveals the steps and failures during connection attempts, while RF statistics show signal quality and interference. Together, they enable the engineer to diagnose why the client disconnects, such as authentication failures or poor coverage.

Answer

Wireless controller CPU utilization

Answer

Application response time

Answer

Switch interface error counters

Question 7

A network engineer is implementing Cisco TrustSec in a campus network. The engineer needs to configure the enforcement of security group tags (SGTs) on Cisco Catalyst switches. Which two statements are true regarding SGT enforcement and propagation? (Choose two.)

Accepted Answer

SGTs are assigned to endpoints by Cisco ISE during authentication and can be used for role-based access control.. SGTs can be propagated via inline tagging or SXP, allowing enforcement across devices that may not support inline tagging. Cisco ISE assigns SGTs to endpoints during authentication, enabling role-based access control. Enforcement is performed on network devices using SGACLs, not on ISE itself.

Answer

SGTs are only supported on Cisco ASA firewalls and not on Cisco Catalyst switches.

Answer

SGT enforcement is performed by security group ACLs (SGACLs) on Cisco ISE, which pushes them to switches.

Answer

SGTs are encrypted in the packet to prevent tampering, and only Cisco ISE can decrypt them.

Question 8

A network administrator is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch. The network uses DHCP for most endpoints, but a few servers have static IP addresses. Which two actions are required to ensure DAI allows legitimate traffic while blocking ARP spoofing? (Choose two.)

Accepted Answer

Configure static ARP ACLs for hosts with statically assigned IP addresses.. DAI validates ARP packets against the DHCP snooping binding table, so DHCP snooping must be enabled on the same VLANs. Static hosts are not in that table, so an ARP ACL must be configured to permit their specific IP-to-MAC bindings. Together, these actions allow legitimate DHCP and static traffic while blocking spoofed ARP packets.

Answer

Enable port security with sticky MAC addresses on all access ports.

Answer

Configure DAI to trust all access ports.

Answer

Disable IP Source Guard on all access ports.

Question 9

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer needs to specify the loopback0 interface as the source for VXLAN tunnels. Which command must be entered under the NVE interface configuration?

Accepted Answer

source-interface loopback0. The correct command to set the source interface for VXLAN tunnels on a Cisco Nexus 9000 NVE interface is 'source-interface loopback0'. This command ensures that the loopback0 IP address is used as the source IP for VXLAN encapsulated traffic, which is critical for VTEP reachability and proper tunnel establishment. Without it, the NVE interface cannot function correctly.

Answer

vxlan source-interface loopback0

Answer

interface loopback0

Answer

source loopback0

Question 10

A network engineer is deploying Cisco DNA Center Assurance and wants to ensure that the system can accurately monitor and troubleshoot network issues. Which two statements about Cisco DNA Center Assurance are true? (Choose two.)

Accepted Answer

Assurance uses streaming telemetry to collect data from network devices.. Cisco DNA Center Assurance uses streaming telemetry for real-time data collection and provides a graphical topology view of network health. These features enable proactive monitoring and rapid troubleshooting. The other statements are false: Assurance does not require SNMP polling for all devices, it supports both wired and wireless, and it does not require manual per-device configuration for monitoring.

Answer

Assurance requires SNMP polling for all device monitoring.

Answer

Assurance requires manual configuration of each device to enable monitoring.

Answer

Assurance can only monitor wired devices, not wireless.

Question 11

A network administrator is deploying a new branch office that requires a redundant default gateway for hosts on VLAN 10. The administrator wants to use a Cisco-proprietary protocol that provides sub-second failover and supports load sharing between two routers. Which First Hop Redundancy Protocol should be used?

Accepted Answer

Gateway Load Balancing Protocol (GLBP). Gateway Load Balancing Protocol (GLBP) is the correct choice because it is Cisco-proprietary and provides both redundancy and load sharing. Unlike HSRP, which has a single active router, GLBP uses an Active Virtual Gateway to distribute traffic across multiple Active Virtual Forwarders, each with its own virtual MAC address. This allows hosts to share the load while maintaining sub-second failover.

Answer

Hot Standby Router Protocol (HSRP)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Intermediate System to Intermediate System (IS-IS)

Question 12

A network engineer is implementing Cisco TrustSec in a campus network. The security team wants to assign a security group tag to traffic based on the identity of the user authenticated via 802.1X, and then enforce policy based on that tag in the data center. Which Cisco TrustSec component is responsible for classifying the traffic with the appropriate security group tag at the access layer?

Accepted Answer

Identity Services Engine (ISE) as the policy server combined with the access switch enforcing the authorization result. Cisco TrustSec classification begins with authentication. ISE authenticates the user and returns an authorization profile containing the SGT, and the access switch applies that tag to the user's traffic. This inline tagging at the access layer allows enforcement devices to apply group-based policies. SXP propagates mappings, SGACLs enforce policy, and MACsec protects links, but none of them assign the tag based on identity.

Answer

Security Group ACLs (SGACLs) on the destination device

Answer

Security Group Tag Exchange Protocol (SXP)

Answer

MACsec encryption on the uplink between access and distribution switches

Question 13

A network engineer is designing a new branch office that must support wired and wireless users with unified policy enforcement and automation. The company wants to minimize manual configuration and ensure consistent security policies across all access ports. Which Cisco architecture should the engineer recommend?

Accepted Answer

Cisco SD-Access. Cisco SD-Access is a campus fabric architecture that integrates wired and wireless access with centralized policy using Cisco ISE and VXLAN. It automates fabric provisioning and enforces consistent security policies across all access ports, directly addressing the need for unified policy and minimal manual configuration in a branch office.

Answer

Cisco SD-WAN

Answer

Cisco ACI

Answer

Cisco TrustSec

Question 14

A network engineer is deploying IP SLA to monitor network performance. The engineer needs to configure an IP SLA operation that measures jitter and packet loss between two Cisco routers. Which two statements are true about configuring IP SLA for this purpose? (Choose two.)

Accepted Answer

The ip sla responder command must be configured on the destination router.. To measure jitter and packet loss with IP SLA, the engineer should use the udp-jitter operation type and configure the ip sla responder on the destination router. The responder ensures accurate timestamping and response, while scheduling is mandatory to start the operation. The icmp-echo operation does not measure jitter, and the responder belongs on the destination, not the source.

Answer

The ip sla schedule command is optional and only needed for historical data collection.

Answer

The operation can be configured using the icmp-echo operation type to measure jitter.

Answer

The ip sla responder command must be configured on the source router.

Question 15

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs. After applying a policer to the control plane, the BGP sessions tear down repeatedly while OSPF adjacencies stay stable. The administrator confirms CPU utilization is low. Which action should be taken to resolve the issue?

Accepted Answer

Increase the CIR of the policer class matching BGP traffic and permit the BGP class in the control-plane service policy.. CoPP policies inspect and police traffic punted to the route processor. When a policer for a critical routing protocol is too restrictive, protocol hellos and keepalives are dropped, causing peering failures even though CPU load is low. Adjusting the policer rate and ensuring the protocol class is permitted restores the required control-plane traffic while retaining protection against abuse.

Answer

Apply the CoPP policy to the data plane interfaces using the service-policy input command.

Answer

Disable CEF switching on the router so BGP packets are process-switched and bypass the policer.

Answer

Enable NetFlow on the WAN interfaces and export records to a collector for BGP traffic analysis.

Question 16

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS-XE router that also runs OSPF, BGP, and SSH management. The engineer needs to protect the control plane while ensuring that routing protocol traffic and management sessions are not disrupted. Which CoPP design approach best meets these requirements?

Accepted Answer

Create multiple granular classes (for example, routing protocols, management, and exception traffic) and apply class-specific policers, while ensuring control plane traffic is not dropped by the default class.. CoPP protects the route processor by classifying and policing traffic destined to the control plane. Granular classes allow routing protocols and management traffic to receive enough bandwidth, while the default class should be configured not to drop so that legitimate unclassified traffic survives. This design balances protection with operational stability for OSPF, BGP, and SSH.

Answer

Configure a CoPP policy that only rate-limits ICMP and Telnet, leaving all other control plane traffic unclassified and unpolished.

Answer

Apply a single CoPP policy that classifies all control plane traffic into one class and rate-limits it to a conservative value.

Answer

Apply the CoPP policy to all data plane interfaces in the inbound direction, which will indirectly protect the control plane.

Question 17

A network engineer is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The engineer enters the following commands under the OSPF process: area 0 authentication message-digest, and under the interface: ip ospf message-digest-key 1 md5 Cisco123. However, the neighbor relationship does not form. What is the most likely cause?

Accepted Answer

The key ID and key string must match on both routers, and the area authentication command must be consistent.. OSPF MD5 authentication requires consistent configuration on both neighbors: the same key ID, the same key string, and the same authentication mode (area or interface). The area authentication command enables MD5 for the area, and the interface command provides the key. If any of these differ, OSPF authentication fails, and the routers will not become adjacent.

Answer

The area authentication command must be configured on all routers in the area, but the interface command is optional.

Answer

The key ID must match on both routers, but the key string can be different.

Answer

The router must be reloaded for the MD5 key to take effect.

Question 18

A network engineer is configuring a Cisco IOS router to support OSPFv3 for IPv6. The router is connected to two OSPFv3 areas: area 0 and area 1. The engineer wants to summarize the IPv6 routes from area 1 into area 0 using the prefix 2001:DB8:1::/48. Which command should be used on the area border router (ABR)?

Accepted Answer

area 1 range 2001:DB8:1::/48. In OSPFv3, inter-area route summarization is configured on an ABR using the 'area range ' command. The area ID specifies the source area whose routes are to be summarized. Here, routes from area 1 are summarized into area 0 using the prefix 2001:DB8:1::/48. The other commands either do not exist, are for external summarization, or specify the wrong area.

Answer

summary-address 2001:DB8:1::/48

Answer

ipv6 ospf summary-prefix 2001:DB8:1::/48

Answer

area 0 range 2001:DB8:1::/48

Question 19

A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor performance. The administrator wants to see detailed information about the client's connectivity, including the path taken through the network and any issues encountered. Which Cisco DNA Center Assurance feature should the administrator use?

Accepted Answer

Client 360. Client 360 in Cisco DNA Center Assurance offers a detailed, client-centric view that includes onboarding, connectivity, and application experience. It displays the network path taken by the client and any issues encountered, such as authentication failures or roaming problems. This makes it the appropriate feature for troubleshooting a specific client's performance.

Answer

Application Health dashboard

Answer

Path Trace

Answer

Network Health dashboard

Question 20

A network engineer is configuring a GRE tunnel between two Cisco IOS routers to transport multicast traffic over an IP network that does not support multicast. The engineer must ensure the tunnel is operational and multicast is forwarded correctly. Which two statements are true about GRE tunnel configuration and operation? (Choose two.)

Accepted Answer

Multicast routing must be enabled on the tunnel interface and the underlying physical interface.. A GRE tunnel requires that the tunnel source and destination be reachable via the underlay. Additionally, to carry multicast, multicast routing must be enabled on both the tunnel and the physical interface. These two conditions ensure the tunnel is up and multicast is forwarded. The other options describe incorrect or unnecessary configurations.

Answer

The tunnel interface must be configured with the 'tunnel mode gre multipoint' command to support multicast.

Answer

The tunnel interface must be configured with an IP address from the same subnet as the physical interface.

Answer

GRE tunnels automatically encrypt all traffic, so no additional security configuration is required.