350-401 Architecture — All Questions With Answers

Question 1

A network engineer is designing a campus network with high availability for critical services. Which Cisco technology enables traffic to be forwarded to an alternate next hop in the event of a first-hop router failure, without requiring any configuration changes on the hosts?

Accepted Answer

HSRP. HSRP (Hot Standby Router Protocol) is a Cisco-proprietary FHRP that allows multiple routers to share a virtual IP and MAC address, providing transparent failover. Hosts are configured with the virtual IP as their default gateway, so when the active router fails, the standby router takes over without any host configuration changes. This directly meets the requirement for high availability without host reconfiguration.

Answer

Static default route with a floating static

Answer

GLBP

Answer

VRRP

Question 2

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

Accepted Answer

FlexConnect. FlexConnect (option D) is the correct architecture because it allows client data traffic to be switched locally at the remote site, while the control plane remains centralized. This design eliminates the need for a central controller to process every roaming event, as clients can roam between FlexConnect APs using local switching and 802.11r (Fast Roaming) without requiring a WLC in the data path.

Answer

Mesh networking

Answer

Autonomous APs

Answer

Centralized switching with a WLC

Question 3

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

Accepted Answer

Type 1, Type 2, Type 3 (including default). In a totally stubby area, the ABR blocks Type 4 and Type 5 LSAs and replaces all Type 3 inter-area routes with a single default route (Type 3 LSA with link-state ID 0.0.0.0). Therefore, only Type 1 (router), Type 2 (network), and the default Type 3 LSAs are present. This matches option A.

Answer

Type 1, Type 2, Type 3, Type 5

Answer

Type 1, Type 2, Type 4, Type 5

Answer

Type 1, Type 2, Type 3 (including default), Type 4

Question 4

A network engineer is troubleshooting a routing loop in an EIGRP network. Which mechanism is designed to prevent routing loops by causing a router to reject routes that are learned from a neighbor that is not the successor?

Accepted Answer

Feasibility condition. The feasibility condition is a loop-prevention mechanism unique to EIGRP. It ensures that a router only accepts a route from a neighbor if that neighbor's reported distance (RD) to the destination is less than the router's own feasible distance (FD). This guarantees that the path through that neighbor is loop-free, effectively rejecting routes learned from any neighbor that is not the successor.

Answer

Split horizon

Answer

Route poisoning

Answer

Hold-down timers

Question 5

A company is implementing QoS in a network where voice traffic must have strict priority over all other traffic. Which queuing mechanism should be used on the outbound interface of a router to ensure voice packets are always sent first?

Accepted Answer

Low Latency Queuing (LLQ). Low Latency Queuing (LLQ) is the correct choice because it combines Class-Based Weighted Fair Queuing (CBWFQ) with a strict priority queue, ensuring that voice traffic (marked with EF or CS5) is always dequeued before any other traffic class. This guarantees low latency and jitter for real-time traffic, which is essential for voice quality.

Answer

Random Early Detection (RED)

Answer

First In First Out (FIFO)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Question 6

A network administrator is configuring a new VLAN 100 on a switch and wants to ensure that the VLAN is created and active. Which command is required to create a VLAN in the VLAN database?

Accepted Answer

vlan 100. The 'vlan 100' command is executed in global configuration mode to create a VLAN in the VLAN database on a Cisco IOS switch. This command creates the VLAN and places the switch into VLAN configuration mode, where optional parameters like name can be set. The VLAN is active immediately upon creation, provided the switch is in VTP server or transparent mode.

Answer

interface vlan 100

Answer

name VLAN100

Answer

switchport access vlan 100

Question 7

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

Accepted Answer

MTU mismatch between the routers. The EXSTART state in OSPF indicates that routers have formed a bidirectional communication (2-Way state) and are now attempting to exchange Database Description (DBD) packets to negotiate the master/slave relationship and the initial sequence number. An MTU mismatch between the routers is the most common cause of neighbors being stuck in EXSTART because the router with the smaller MTU will drop DBD packets that exceed its interface MTU, preventing the exchange from progressing to the Loading state.

Answer

Dead timer mismatch

Answer

Authentication misconfiguration

Answer

Mismatched OSPF area IDs

Question 8

A company is deploying a WAN with MPLS VPN and wants to ensure that customer traffic is isolated from other customers. Which technology is used to maintain separation in the MPLS core?

Accepted Answer

Virtual Routing and Forwarding (VRF). VRF (Virtual Routing and Forwarding) is the technology used in MPLS VPN to maintain customer traffic separation within the MPLS core. Each customer is assigned a unique VRF on the Provider Edge (PE) router, which maintains a separate routing table and forwarding instance, ensuring that traffic from one customer never crosses into another customer's routing domain. This separation is enforced at Layer 3, independent of the MPLS label switching that occurs in the core.

Answer

VLAN tagging

Answer

MPLS labels

Answer

IPsec tunnels

Question 9

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

Accepted Answer

VXLAN encapsulation is used for data plane traffic within the fabric.. Option A is correct because VXLAN is the encapsulation protocol used in the Cisco SD-Access fabric to carry data plane traffic between fabric edge nodes. VXLAN provides a Layer 2 overlay over a Layer 3 underlay, enabling scalable segmentation and mobility without VLAN limitations.

Answer

Wireless access points must be directly connected to the fabric edge switches.

Answer

Fabric edge nodes are responsible for connecting the fabric to external networks.

Answer

The fabric uses VLANs to isolate tenant traffic.

Question 10

Which THREE characteristics are true about Cisco StackWise virtual technology? (Choose three.)

Accepted Answer

It allows multiple physical switches to operate as a single logical switch.. Cisco StackWise Virtual allows multiple physical switches to be interconnected and operate as a single logical entity, simplifying management and improving redundancy. This is achieved by creating a virtual switch domain where control and data planes are unified, so the stack appears as one device to the network.

Answer

Each member switch must have the same hardware model.

Answer

It requires dedicated stacking cables for interconnectivity.

Answer

It supports up to 9 member switches in a stack.

Question 11

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

Accepted Answer

Predictable latency between any two devices. A is correct because spine-leaf architecture ensures that every leaf switch is connected to every spine switch, creating a full-mesh topology. This design guarantees that traffic between any two leaf switches traverses at most one spine hop, resulting in predictable, consistent latency regardless of which devices are communicating.

Answer

Increased number of single points of failure

Answer

Increased broadcast domain size

Answer

Reduced need for VLANs

Question 12

A large enterprise has a campus network with a collapsed core design. The core switch connects to two distribution switches, each serving several access switches. The network uses OSPF as the IGP. Recently, after a link failure between the core and distribution switch A, the network experienced a 30-second outage before converging. The engineer wants to improve convergence time to under 5 seconds. The budget is limited, so hardware upgrades are not an option. The engineer is considering the following actions:
A. Enable OSPF Fast Hello on all interfaces.
B. Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.
C. Implement OSPF LSA throttling with a minimum interval of 0 ms.
D. Use OSPF incremental SPF (iSPF).

Which action will provide the most significant improvement in convergence time for this scenario?

Accepted Answer

Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.. Option B is correct because reducing the OSPF dead timer to 1 second and hello timer to 333 milliseconds directly addresses the 30-second outage caused by the link failure. The default dead timer (40 seconds on broadcast networks) is the primary contributor to convergence delay, as OSPF must wait for the dead interval to expire before declaring a neighbor down. By lowering these timers, failure detection drops from 40 seconds to approximately 1 second, which is the most impactful single change for convergence under budget constraints.

Answer

Enable OSPF Fast Hello on all interfaces.

Answer

Implement OSPF LSA throttling with a minimum interval of 0 ms.

Answer

Use OSPF incremental SPF (iSPF).

Question 13

A small business has a single router connected to the internet and a switch for the LAN. They want to implement VLANs to separate guest and corporate traffic. The router has only one physical interface to the switch. The network engineer proposes using subinterfaces with 802.1Q trunking on the router interface. Which configuration step is required on the switch port connected to the router?

Accepted Answer

Configure the port as a trunk port.. The router uses subinterfaces with 802.1Q trunking to carry multiple VLANs over a single physical link. For this to work, the switch port connected to the router must be configured as a trunk port, which tags frames with VLAN IDs as they traverse the link. This allows the router to route between VLANs using its subinterfaces, each associated with a specific VLAN.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port in VLAN 1.

Answer

Configure the port as a dynamic desirable port.

Question 14

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

Accepted Answer

Deploy two core switches configured with VSS or StackWise.. Option B is correct because deploying two core switches with VSS (Virtual Switching System) or StackWise provides both redundancy and active-active load balancing at the core layer. VSS virtualizes two physical switches into a single logical switch, eliminating the need for Spanning Tree Protocol (STP) on inter-switch links and enabling sub-second failover. This design ensures high availability by removing single points of failure and maximizing throughput between distribution and core layers.

Answer

Use a single distribution switch to simplify management.

Answer

Configure the core layer for Layer 2 switching only.

Answer

Use spanning-tree PortFast on all core switch ports.

Question 15

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

Accepted Answer

One switch is configured with active LACP and the other with passive LACP.. Option D is correct because LACP requires one side to be in active mode to initiate negotiation; if one side is active and the other is passive, the passive side will not initiate the LACP exchange, but it will respond to active-side messages. However, the question states that the link is an LACP port-channel, implying both sides should be configured to form the bundle. If one side is passive and the other is active, the port-channel can form, but intermittent packet loss can occur if the passive side fails to respond quickly enough to LACP PDUs during transient conditions, or if there is a mismatch in LACP system priority or port priority that causes the bundle to flap. More critically, a passive/passive combination would never form the port-channel, but active/passive can form it, yet the passive side's reliance on the active side for initiation can lead to instability under certain failure scenarios, causing packet loss.

Answer

MTU size is set to 1500 on one switch and 9000 on the other.

Answer

Auto-negotiation is disabled on both ends.

Answer

Spanning-tree BPDU guard is enabled on the port-channel.

Question 16

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Accepted Answer

Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).. In an SD-Access fabric, the underlay network must provide IP connectivity between all fabric devices (edge, control plane, border nodes) using a routed access layer with a link-state routing protocol like IS-IS or OSPF. This ensures fast convergence, loop-free topology, and support for the overlay's VXLAN tunnels. A routed access layer eliminates spanning-tree dependencies and aligns with the fabric's requirement for a simple, scalable IP-based transport.

Answer

Implement PIM-SM for multicast routing in the underlay.

Answer

Preserve existing VLANs across the fabric to minimize changes.

Answer

Deploy VRF-lite on all edge nodes to isolate tenants.

Question 17

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

Accepted Answer

Set trust boundary at the access layer switch and re-mark packets based on source.. Option A is correct because in a converged network, trust boundaries should be established at the access layer to ensure that marking decisions are made as close to the source as possible. By setting the trust boundary at the access layer switch and re-marking packets based on source (e.g., trusting only IP phones while re-marking workstation traffic), the network can enforce policy before traffic enters the core, preventing unauthorized or misconfigured endpoints from influencing QoS markings. This aligns with Cisco's best practice of trusting only known devices and re-marking all other traffic to a default or lower priority.

Answer

Configure marking only at the core layer to simplify policy.

Answer

Trust only the distribution layer switches to mark traffic.

Answer

Trust the DSCP values set by IP phones and workstations.

Question 18

Which TWO of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. In a spine-leaf architecture, every leaf switch connects to every spine switch, creating a full mesh topology. This design ensures that any east-west traffic (server-to-server) traverses exactly one spine hop, providing consistent and predictable latency regardless of which leaf switches the source and destination are connected to.

Answer

Eliminates the need for spanning-tree protocol.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 19

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

Accepted Answer

Use a channel reuse plan that minimizes co-channel interference.. Option A is correct because a channel reuse plan that minimizes co-channel interference is essential in high-density environments to ensure that adjacent access points (APs) do not use the same or overlapping channels, which would degrade throughput. By carefully planning channel assignments (e.g., using non-overlapping channels in the 5 GHz band), you maximize spatial reuse and overall network capacity.

Answer

Increase AP transmit power to maximize coverage.

Answer

Enable 2.4 GHz band only to maximize range.

Question 20

A mid-size enterprise is deploying a new branch office with 50 users. The branch will have its own router, switch, and wireless AP. The WAN link is a 50 Mbps MPLS circuit. The company uses VoIP and requires Quality of Service. The network administrator has configured the router with a QoS policy that marks VoIP traffic with DSCP EF and all other traffic with DSCP 0. The policy also shapes traffic to 50 Mbps. After deployment, users report that voice quality is poor during peak hours. The administrator checks the router and sees that the output queue on the WAN interface is often full and drops are occurring. Which action should the administrator take to improve voice quality?

Accepted Answer

Configure a priority queue for DSCP EF traffic within the shaper.. The shaper is limiting traffic to 50 Mbps, but during peak hours, the aggregate traffic exceeds this rate, causing the output queue to fill and drop packets indiscriminately. By configuring a priority queue for DSCP EF (VoIP) traffic within the shaper, the router will service VoIP packets before other traffic, ensuring low latency and jitter even when the link is congested. This is the standard Cisco approach for voice quality on shaped links, as priority queuing bypasses the normal FIFO or CBWFQ behavior for marked traffic.

Answer

Increase the shaping rate to 60 Mbps to allow for burst.

Answer

Replace shaping with policing to drop non-voice traffic.

Answer

Change the marking to use CoS instead of DSCP for better QoS.

350-401 Architecture — All Questions With Answers

A network engineer is designing a campus network with high availability for critical services. Which Cisco technology enables traffic to be forwarded to an alternate next hop in the event of a first-hop router failure, without requiring any configuration changes on the hosts?

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

A network engineer is troubleshooting a routing loop in an EIGRP network. Which mechanism is designed to prevent routing loops by causing a router to reject routes that are learned from a neighbor that is not the successor?

A company is implementing QoS in a network where voice traffic must have strict priority over all other traffic. Which queuing mechanism should be used on the outbound interface of a router to ensure voice packets are always sent first?

A network administrator is configuring a new VLAN 100 on a switch and wants to ensure that the VLAN is created and active. Which command is required to create a VLAN in the VLAN database?

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

A company is deploying a WAN with MPLS VPN and wants to ensure that customer traffic is isolated from other customers. Which technology is used to maintain separation in the MPLS core?

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

Which THREE characteristics are true about Cisco StackWise virtual technology? (Choose three.)

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

Which TWO of the following are benefits of implementing a spine-leaf architecture in a data center?

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps for the Spanning Tree Protocol (STP) convergence process in the correct order.

Match each routing protocol to its administrative distance.

Match each First Hop Redundancy Protocol (FHRP) to its description.

350-401 Architecture — All Questions With Answers

A network engineer is designing a campus network with high availability for critical services. Which Cisco technology enables traffic to be forwarded to an alternate next hop in the event of a first-hop router failure, without requiring any configuration changes on the hosts?

A company is deploying a wireless network in an office with high client density. Which Cisco architecture is best suited to handle client roaming without requiring a central controller for every roaming event?

An enterprise is using OSPF in a multi-area design. Area 1 is a regular area, and Area 2 is a totally stubby area. Which LSA types are present in Area 2?

A network engineer is troubleshooting a routing loop in an EIGRP network. Which mechanism is designed to prevent routing loops by causing a router to reject routes that are learned from a neighbor that is not the successor?

A company is implementing QoS in a network where voice traffic must have strict priority over all other traffic. Which queuing mechanism should be used on the outbound interface of a router to ensure voice packets are always sent first?

A network administrator is configuring a new VLAN 100 on a switch and wants to ensure that the VLAN is created and active. Which command is required to create a VLAN in the VLAN database?

An engineer is troubleshooting a network where OSPF neighbors are stuck in the EXSTART state. What is the most likely cause?

A company is deploying a WAN with MPLS VPN and wants to ensure that customer traffic is isolated from other customers. Which technology is used to maintain separation in the MPLS core?

Which TWO statements are correct about Cisco SD-Access architecture? (Choose two.)

Which THREE characteristics are true about Cisco StackWise virtual technology? (Choose three.)

Which TWO are benefits of using a spine-leaf architecture in a data center? (Choose two.)

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

Which TWO of the following are benefits of implementing a spine-leaf architecture in a data center?

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps for the Spanning Tree Protocol (STP) convergence process in the correct order.

Match each routing protocol to its administrative distance.

Match each First Hop Redundancy Protocol (FHRP) to its description.