350-401 Cisco DNA Center — Timed 30 Questions

Question 1

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

Accepted Answer

The switches are not configured with NETCONF/YANG or telemetry streaming.. Cisco DNA Center Assurance relies on telemetry data collected via NETCONF/YANG or gRPC, not just SNMP. If the switches are not configured for telemetry, Assurance will not receive the necessary data. SNMP is used for inventory and basic monitoring, but not for the rich telemetry required by Assurance.

Answer

The DNA Center appliance is not licensed for the Assurance module.

Answer

The switches are not running the correct IOS-XE version for DNA Center compatibility.

Answer

The SNMP community string is incorrect on the switches.

Question 2

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Accepted Answer

The engineer did not run the Provision workflow to push the configuration to the devices.. In Cisco DNA Center, network profiles are used to define settings, but they must be applied to a site and then the devices must be provisioned with that site's settings. If the engineer only created the profile and assigned it to a site, but did not run the provisioning workflow (which pushes the configuration to devices), the VLAN will not be created.

Answer

The VLAN ID conflicts with an existing VLAN on the switches.

Answer

The switches do not support the VLAN ID range.

Answer

The DNA Center appliance is not licensed for the Automation module.

Question 3

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Accepted Answer

RF interference or poor signal-to-noise ratio on the affected APs.. Cisco DNA Center Assurance can correlate client association failures with RF interference, authentication issues, or configuration mismatches. Since the APs are registered and functional, the issue is likely related to RF interference or signal quality. DNA Center's Assurance can analyze client association events and highlight RF issues as a common cause.

Answer

The APs are not running the recommended firmware version.

Answer

The wireless controller has reached its maximum number of APs.

Answer

The DNA Center Assurance module is not properly configured to monitor wireless events.

Question 4

A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?

Accepted Answer

The devices have existing QoS configurations that conflict with the new policy.. In brownfield deployments, devices may have existing configurations that conflict with the intended policies. DNA Center performs a compliance check before provisioning. If the current device configuration does not match the intended configuration (e.g., existing QoS settings), DNA Center reports a compliance error. The engineer must either update the device configuration to match the intent or modify the intent to accommodate the existing configuration.

Answer

The devices are not running a supported IOS-XE version for QoS automation.

Answer

The DNA Center appliance does not have enough storage to process the QoS policy.

Answer

The QoS policy was created with an invalid DSCP value.

Question 5

A network engineer is using Cisco DNA Center to manage a network with multiple sites. The engineer wants to ensure that all devices at a remote site have the same NTP server configuration. The engineer creates a network profile with the NTP settings and assigns it to the site. After provisioning, the engineer checks one of the switches and finds that the NTP configuration is missing. What should the engineer check first?

Accepted Answer

Verify that the device is assigned to the correct site in DNA Center.. In Cisco DNA Center, network profiles are applied to sites, but devices must be assigned to the correct site hierarchy. If a device is not assigned to the site where the profile is applied, it will not receive the configuration. The engineer should verify that the device is in the correct site within DNA Center's hierarchy.

Answer

Check if the NTP server is reachable from the device.

Answer

Ensure that the device is running a supported IOS version.

Answer

Recreate the network profile with the correct NTP settings.

Question 6

A network engineer is troubleshooting an issue where Cisco DNA Center is not sending configuration changes to a group of switches. The engineer checks the Provisioning dashboard and sees that the devices are in 'Pending' state. The engineer has already created the intent (network profile) and assigned it to the site. What is the most likely cause?

Accepted Answer

The engineer has not executed the Provision workflow to deploy the configuration.. In Cisco DNA Center, provisioning is a multi-step process. After creating intent, the engineer must explicitly run the Provision workflow to push the configuration. The 'Pending' state indicates that the intent has been defined but not yet deployed. The engineer must start the provisioning job to push the configuration to the devices.

Answer

The devices are not reachable from DNA Center.

Answer

The DNA Center appliance is out of disk space.

Answer

The network profile contains an invalid configuration.

Question 7

A network engineer is using Cisco DNA Center to monitor network health. The Assurance dashboard shows that a particular access switch has a high CPU utilization issue. The engineer wants to investigate the root cause using DNA Center's built-in tools. Which feature should the engineer use to analyze the switch's CPU utilization over time?

Accepted Answer

Use the 'Trends' feature in Assurance to view CPU utilization over time.. Cisco DNA Center's Assurance module provides historical and real-time data for network devices. The 'Trends' feature allows engineers to view metrics like CPU utilization over a selected time period, helping to identify patterns and root causes.

Answer

Use the 'Command Runner' to execute 'show process cpu' on the switch.

Answer

Use the 'Path Trace' tool to analyze traffic paths.

Answer

Use the 'Software Image Management' to check for software bugs.

Question 8

A network engineer is planning to use Cisco DNA Center to automate the deployment of a new branch office. The engineer has already discovered the devices and added them to Inventory. The engineer wants to use a template to configure the devices consistently. Which tool in DNA Center should the engineer use to create and apply the template?

Accepted Answer

Use the 'Template Editor' to create a CLI template and apply it during provisioning.. Cisco DNA Center includes a feature called 'Template Editor' (or 'Network Templates') that allows engineers to create CLI templates for device configuration. These templates can be parameterized and applied to devices during provisioning, ensuring consistent configuration across the branch.

Answer

Use the 'Policy Editor' to create a policy-based configuration.

Answer

Use the 'Command Runner' to execute commands on multiple devices.

Answer

Use the 'Network Profiles' to define the configuration.

Question 9

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Accepted Answer

Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.. Cisco DNA Center's syslog collector listens on specific ports (default UDP 514). If the switch is configured to send syslog but DNA Center is not receiving it, a common issue is that the syslog port is blocked by a firewall or ACL between the switch and DNA Center. The engineer should verify network connectivity and port accessibility.

Answer

Check if the syslog messages are in the correct format.

Answer

Ensure that the switch is in the Inventory and managed by DNA Center.

Answer

Restart the syslog collector service on DNA Center.

Question 10

A network engineer writes the following Python script to retrieve the list of devices from Cisco DNA Center using the REST API:

import requests
import json

url = "https://dna-center.local/dna/intent/api/v1/network-device"
headers = {
    "Content-Type": "application/json",
    "X-Auth-Token": "valid-token-here"
}
response = requests.get(url, headers=headers, verify=False)
if response.status_code == 200:
    devices = response.json()
    for device in devices["response"]:
        print(device["hostname"])
else:
    print("Error:", response.status_code)

What is the issue with this code?

Accepted Answer

The code uses verify=False which is insecure but functional; the main issue is missing pagination handling.. The code does not handle pagination. Cisco DNA Center API returns a maximum of 500 devices by default, and if more exist, the response includes a 'lastIndex' or similar field. The code only processes the first page.

Answer

The URL is incorrect; it should be /dna/intent/api/v1/network-device/list.

Answer

The code does not handle authentication properly; it should use Basic Auth.

Answer

The code fails because it does not import the json module correctly.

Question 11

An Ansible playbook is written to configure a VLAN on a Cisco IOS-XE device via Cisco DNA Center's intent API:

- name: Configure VLAN via DNA Center
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Create VLAN 100
      cisco.dnac.vlan:
        host: "{{ dnac_host }}"
        username: "{{ dnac_username }}"
        password: "{{ dnac_password }}"
        validate_certs: no
        state: present
        vlan_name: "Engineering"
        vlan_id: 100
        site_id: "{{ site_id }}"
      register: result

- debug: var=result

What is a potential issue with this playbook?

Accepted Answer

The 'site_id' parameter is mandatory for creating a VLAN in DNA Center; if missing, the task will fail.. The cisco.dnac.vlan module requires the 'site_id' parameter to associate the VLAN with a specific site. If the site_id is not provided or is incorrect, the task will fail or create the VLAN in the wrong location. Additionally, the playbook assumes the DNA Center credentials are correctly set.

Answer

The module name is incorrect; it should be cisco.dnac.network_vlan.

Answer

The playbook does not include a task to obtain an authentication token, which is required by DNA Center API.

Answer

The 'state: present' is invalid; it should be 'state: create'.

Question 12

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Accepted Answer

health = response['response'][0]['overallHealth']. The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Answer

health = response['overallHealth']

Answer

health = response['response']['overallHealth']

Answer

health = response[0]['overallHealth']

Question 13

A network engineer is using Netmiko to connect to a Cisco IOS-XE device that is managed by Cisco DNA Center. The script is:

from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'host': '10.10.10.1',
    'username': 'admin',
    'password': 'cisco123',
    'secret': 'enable123'
}

connection = ConnectHandler(**device)
connection.enable()
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()

What is a potential security concern with this script in the context of DNA Center?

Accepted Answer

The enable secret is hardcoded in plain text, which is a security risk.. The script stores the enable secret in plain text. In a production environment, credentials should be stored securely, such as using environment variables or a vault. DNA Center itself stores credentials encrypted, but this script exposes them.

Answer

The script does not handle authentication failures gracefully.

Answer

The device_type should be 'cisco_xe' for IOS-XE.

Answer

The script should use SSH keys instead of passwords.

Question 14

An engineer is using the Cisco DNA Center GUI to create a new site hierarchy. They add a building under an existing area. After saving, they run a Python script to verify the site via API:

import requests

url = "https://dna-center.local/dna/intent/api/v1/site"
headers = {"X-Auth-Token": "token"}
response = requests.get(url, headers=headers, verify=False)
sites = response.json()['response']
for site in sites:
    if site['name'] == 'Building-A':
        print(site['id'])

What is the output if the building was created successfully?

Accepted Answer

A UUID string such as '123e4567-e89b-12d3-a456-426614174000'. The script prints the site ID of the building if it exists. The output will be a string representing the UUID of the building.

Answer

The script will print 'Building-A'

Answer

The script will print the entire site dictionary

Answer

The script will raise an error because the API returns paginated results

Question 15

An Ansible playbook uses the cisco.dnac.site module to create a new building site. The playbook is:

- name: Create building site
  cisco.dnac.site:
    host: "{{ dnac_host }}"
    username: "{{ dnac_username }}"
    password: "{{ dnac_password }}"
    validate_certs: no
    state: present
    site:
      name: Building-B
      type: building
      parentName: Area-1
      address: "123 Main St"
      latitude: 37.7749
      longitude: -122.4194
  register: result

What is the purpose of the 'parentName' parameter?

Accepted Answer

It specifies the name of the building's parent in the hierarchy, such as an area or global site.. The 'parentName' parameter specifies the name of the parent site (area or global) under which the building is created. This is necessary for building the site hierarchy.

Answer

It defines the DNS domain name for the building.

Answer

It sets the name of the network profile associated with the building.

Answer

It is used to specify the building's primary IP address.

Question 16

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE device that is part of a DNA Center managed fabric. The telemetry subscription configuration is:

telemetry ietf subscription 101
 encoding encode-kvgpb
 filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization
 stream yang-push
 update-policy periodic 500
 receiver ip address 10.10.10.10  port 5555 protocol grpc-tcp

What is the purpose of the 'encoding encode-kvgpb' line?

Accepted Answer

It specifies that the data should be encoded using Google Protocol Buffers (protobuf) with key-value pairs.. The 'encoding encode-kvgpb' specifies that the telemetry data should be encoded using KVGPB (Key-Value Google Protocol Buffers), which is a compact binary encoding used for efficient data transmission.

Answer

It sets the encoding to JSON format for the telemetry data.

Answer

It enables encryption of the telemetry data.

Answer

It defines the compression algorithm for the telemetry stream.

Question 17

A network engineer uses the Cisco DNA Center API to trigger a provisioning workflow for a new device. The API call returns the following JSON response:

{
  "response": {
    "taskId": "task-12345",
    "url": "/api/v1/task/task-12345"
  },
  "version": "1.0"
}

The engineer then polls the task status using the URL. Which HTTP method should be used to retrieve the task status?

Accepted Answer

GET. To retrieve the status of a task, a GET request should be sent to the provided URL. The task ID is used to query the task API endpoint.

Answer

POST

Answer

PUT

Answer

DELETE

Question 18

An engineer is writing a Python script to use the Cisco DNA Center API to assign a device to a site. The code snippet is:

import requests

url = "https://dna-center.local/dna/intent/api/v1/network-device/assign"
headers = {
    "X-Auth-Token": "token",
    "Content-Type": "application/json"
}
payload = {
    "deviceId": "device-uuid",
    "siteId": "site-uuid"
}
response = requests.post(url, headers=headers, json=payload, verify=False)
print(response.status_code)

What is a potential issue with this code?

Accepted Answer

The HTTP method should be PUT instead of POST for assigning a device to a site.. The API endpoint for assigning a device to a site typically uses a PUT method, not POST. Using POST may result in a 405 Method Not Allowed error or unexpected behavior.

Answer

The payload should include 'deviceId' and 'siteId' as a list.

Answer

The URL is missing the version number.

Question 19

Examine the following partial Cisco IOS-XE configuration:

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 ip access-group ACL_IN in
 spanning-tree portfast

What is the effect of this configuration?

Accepted Answer

The port will immediately transition to forwarding state, reducing STP convergence time for end hosts.. The configuration enables PortFast on an access port, allowing it to transition directly to forwarding state, bypassing the listening and learning phases. This is commonly used for end-host ports to avoid delays caused by spanning-tree convergence.

Answer

The port will become a trunk port and participate in VLAN trunking.

Answer

The port will use Rapid PVST+ and immediately forward after a link failure.

Answer

The port will block all inbound traffic due to the ACL.

Question 20

Consider the following configuration snippet from a Cisco IOS-XE router:

router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of the passive-interface commands?

Accepted Answer

EIGRP hellos are suppressed on all interfaces except GigabitEthernet0/0.. The command 'passive-interface default' makes all interfaces passive by default, meaning they will not send or receive EIGRP hellos. The subsequent 'no passive-interface GigabitEthernet0/0' overrides this for that specific interface, allowing EIGRP adjacency formation on it.

Answer

EIGRP hellos are sent on all interfaces, but updates are blocked.

Answer

EIGRP adjacency is formed on all interfaces except GigabitEthernet0/0.

Answer

EIGRP is disabled on all interfaces.