350-401 Architecture Practice Test 12 — 15 Questions

Question 1

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hot Standby Router Protocol (HSRP) version 1. HSRP version 1 is the only protocol listed that uses the virtual MAC address 0000.0c07.acXX and supports IPv4 only. VRRPv2 uses a different MAC prefix, GLBP uses 0007.b400.XXYY, and HSRPv2 uses 0000.0c9f.fXXX. The administrator should configure HSRPv1 to meet the exact virtual MAC and IPv4-only requirements.

Answer

HSRP version 2

Answer

Virtual Router Redundancy Protocol (VRRP) version 2

Answer

Gateway Load Balancing Protocol (GLBP)

Question 2

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip default-gateway 192.168.1.1. On a Layer 2 switch, the management interface (such as VLAN 1 or a management VLAN SVI) requires a default gateway to communicate with remote subnets. The 'ip default-gateway' command provides this functionality. Unlike a router, a Layer 2 switch does not run a routing protocol or maintain a routing table for management traffic, so a default route is not applicable. The correct command is 'ip default-gateway'.

Answer

ip route 0.0.0.0 0.0.0.0 192.168.1.1

Answer

ip gateway 192.168.1.1

Answer

default-router 192.168.1.1

Question 3

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Embedded Wireless Controller. The Cisco Embedded Wireless Controller is a feature available on Catalyst 9000 switches that integrates wireless controller capabilities directly into the switch. This allows the switch to manage access points and provide centralized control without an external WLC. The other options are either separate products or features not integrated into the switch. Therefore, enabling the Embedded Wireless Controller is the correct choice.

Answer

Cisco Mobility Express

Answer

Cisco DNA Center

Answer

Cisco SD-Access

Question 4

A network architect is comparing Cisco StackWise Virtual and traditional StackWise for a new data center access layer. The requirement is that the two switches operate as one logical device while remaining physically separate, with each switch having its own control plane processes that are synchronized, and that the pair support Multichassis EtherChannel to downstream servers. Which statement correctly describes Cisco StackWise Virtual in this scenario?

Accepted Answer

StackWise Virtual combines two switches into one logical entity using a StackWise Virtual Link, and each chassis maintains its own control plane that is synchronized with its peer. StackWise Virtual merges two chassis into one logical device through a StackWise Virtual Link while preserving independent, synchronized control planes on each switch. It supports Multichassis EtherChannel to downstream devices, which is exactly what the architect needs for the data center access layer.

Answer

StackWise Virtual requires a dedicated stacking cable and forms a single control plane with one master and one standby member

Answer

StackWise Virtual uses VSS with a Virtual Switch Link and requires one chassis to be active while the other is in hot standby

Answer

StackWise Virtual only supports single-chassis EtherChannel because each switch forwards independently

Question 5

A network architect is designing a new branch office that must run Cisco SD-WAN with a single WAN transport and requires all control-plane and data-plane traffic to be encrypted by default using DTLS/TLS tunnels managed by the controller. Which SD-WAN component is responsible for establishing the secure control connections and distributing route and policy information to the branch edge devices?

Accepted Answer

vSmart controller. In Cisco SD-WAN, the control plane is handled by the vSmart controller, which peers with each edge device over DTLS/TLS and uses OMP to advertise TLOCs, routes, and centralized policy. The branch edge in this design needs those control connections, so the vSmart controller is the component that satisfies the requirement.

Answer

vAnalytics engine

Answer

vManage NMS

Answer

vBond orchestrator

Question 6

A network architect is evaluating Cisco StackWise Virtual technology for a pair of Cisco Catalyst 9000 switches that will act as a single logical entity at the distribution layer. Which two statements accurately describe Cisco StackWise Virtual? (Choose two.)

Accepted Answer

It supports Multichassis EtherChannel (MEC) so that access switches can dual-home to both stack members.. Cisco StackWise Virtual combines two Catalyst 9000 switches into one logical switch via a StackWise Virtual Link, presenting a single control plane and management IP. It enables Multichassis EtherChannel so downstream devices can dual-home with active-active forwarding. The SVL requires high-speed ports, both switches must run the same IOS XE version, and the pair shares one control plane rather than maintaining independent ones.

Answer

Each switch in the StackWise Virtual pair maintains an independent control plane and separate management IP address.

Answer

It requires that both switches run different IOS XE versions to provide software redundancy.

Answer

The StackWise Virtual Link can be formed using any two 1 Gigabit Ethernet ports on the switches.

Question 7

A network administrator is configuring a Cisco IOS router to participate in a First Hop Redundancy Protocol group. The requirement is that the group must use a virtual MAC address of 0000.0c07.acXX and support only IPv4. Which protocol should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Guest anchor controller. A guest anchor controller tunnels guest traffic from the foreign controller to an anchor controller in the DMZ, isolating guest traffic from internal networks. This is the standard Cisco WLC design for guest access, ensuring that guest traffic does not traverse internal networks and is directly routed to the DMZ.

Answer

Auto-anchor with dynamic VLAN assignment

Answer

FlexConnect with local switching

Answer

Mobility group with default settings

Question 8

An engineer is deploying Cisco SD-Access and wants to separate the roles of the underlay and the fabric overlay. The design must provide a Layer 3 routed underlay using IS-IS, and the fabric edge nodes must register endpoint information with a fabric control-plane node. Which node type in Cisco SD-Access is responsible for mapping endpoint identity to location and answering EID-to-RLOC queries from fabric edge nodes?

Accepted Answer

Fabric control-plane node. In Cisco SD-Access, the fabric control-plane node hosts the LISP map-server and map-resolver. Fabric edge nodes register endpoint identifiers with it, and it answers EID-to-RLOC queries, enabling VXLAN tunnel establishment between edge nodes. That responsibility matches the requirement to map endpoint identity to location.

Answer

Fabric border node

Answer

Fabric wireless controller

Answer

Fabric intermediate node

Question 9

A network architect is designing a Cisco SD-Access fabric. The customer requires that the fabric support both IPv4 and IPv6 traffic natively without the use of any translation mechanisms. Which statement describes the correct configuration approach?

Accepted Answer

The fabric overlay can be configured as dual-stack, supporting both IPv4 and IPv6, while the underlay remains IPv4.. Cisco SD-Access supports a dual-stack overlay, allowing both IPv4 and IPv6 to be carried natively over an IPv4 underlay. The VXLAN data plane encapsulates Layer 2 frames, which can carry either IPv4 or IPv6 packets. The underlay can remain IPv4, as it only needs to route the VXLAN tunnel endpoints. This design meets the requirement for native IPv6 without translation. No translation mechanisms like NAT64 are needed.

Answer

The fabric underlay must be configured with IPv6 only, and the overlay can be dual-stack.

Answer

IPv6 is not supported in SD-Access; only IPv4 is supported in the overlay.

Answer

IPv6 traffic must be translated to IPv4 at the fabric edge using NAT64.

Question 10

A network engineer is designing a QoS policy for a WAN edge router. Voice traffic must be serviced with strict priority and guaranteed low latency, while a policer must limit voice to 30 percent of the interface bandwidth to prevent starvation of other queues. Which queuing mechanism should the engineer configure?

Accepted Answer

Low Latency Queuing (LLQ) with a priority policer. Low Latency Queuing is the correct choice because it creates a strict priority queue for voice while applying a policer that caps the priority class at a configured rate, such as 30 percent of interface bandwidth. This gives voice minimal delay and jitter while preventing it from consuming all bandwidth. CBWFQ lacks strict priority, WRED is a drop mechanism, and FIFO offers no prioritization or policing.

Answer

First-In, First-Out (FIFO) queuing on the WAN interface

Answer

Class-Based Weighted Fair Queuing (CBWFQ) with a bandwidth guarantee

Answer

Weighted Random Early Detection (WRED) on the voice class

Question 11

A network architect is designing a new branch office that must support wired and wireless users with a single unified policy and automated onboarding for guests. The design requires centralized management, fabric-based segmentation, and the ability to enforce group-based policies without manual VLAN provisioning at the branch. Which Cisco architecture should be used?

Accepted Answer

Cisco SD-Access. Cisco SD-Access is the campus fabric solution that integrates wired and wireless into a single policy domain using LISP, VXLAN, and TrustSec. It centralizes management through Cisco DNA Center and enables automated onboarding and group-based segmentation without manual VLAN configuration, making it the correct architecture for the branch requirements.

Answer

Cisco ACI

Answer

Cisco SD-WAN

Answer

Cisco Catalyst Center with traditional VLANs

Question 12

A network engineer is designing a network that uses Cisco SD-Access with a fabric that includes a border node and control plane node. The engineer must ensure that traffic from external networks can reach endpoints within the fabric. Which function does the border node provide in this architecture?

Accepted Answer

It provides connectivity between the fabric and external networks, such as WAN or data center.. The border node in Cisco SD-Access provides connectivity between the fabric and external networks, handling traffic entering and leaving the fabric. It performs VXLAN-to-VLAN translation and routing, enabling external users to reach fabric endpoints. This is distinct from the control plane node's mapping function and the edge node's policy enforcement.

Answer

It maintains the mapping of endpoint IP addresses to fabric edge nodes.

Answer

It enforces security policies between endpoints within the same virtual network.

Answer

It acts as the default gateway for all endpoints in the fabric.

Question 13

A network architect is designing a Cisco SD-WAN solution with multiple data centers and a mix of MPLS and Internet transports. The company requires that business-critical traffic (e.g., ERP) always use the MPLS transport, while guest traffic uses the Internet. Which Cisco SD-WAN feature should be used to enforce this policy?

Accepted Answer

Centralized data policy. Centralized data policy in Cisco SD-WAN is used to define traffic steering rules. By creating a policy that matches ERP traffic and sets the preferred transport to MPLS, and another that matches guest traffic and sets the transport to Internet, the architect can enforce the requirement. Other features like AAR or VPN segmentation do not provide this static transport enforcement.

Answer

Direct Internet Access (DIA)

Answer

Application-aware routing

Answer

VPN segmentation

Question 14

A network administrator is planning a new Cisco Catalyst switch stack and wants to verify that the stacking cables provide redundancy so that the loss of a single stacking link does not split the stack. The switches support StackWise-480. Which cabling practice should the administrator follow to achieve a resilient stack ring?

Accepted Answer

Connect each switch to the next and the last switch back to the first to form a ring.. A StackWise-480 stack should be cabled as a ring, with each switch connected to the next and the last switch connected back to the first. This loop gives the stack two paths for stacking traffic, so a single link failure does not split the stack, which is exactly what the administrator needs.

Answer

Connect only the first and last switches in the stack and leave the middle switches unconnected.

Answer

Connect the switches in a full mesh using a separate cable between every pair of switches.

Answer

Connect the switches in a single daisy chain using one cable between each pair of switches.

Question 15

A network architect is designing a data center network using Cisco ACI. The architect must ensure that traffic between endpoints in different EPGs is allowed only when a contract exists. Which Cisco ACI component is responsible for enforcing these contracts?

Accepted Answer

Policy Enforcement Point (PEP). In Cisco ACI, contracts define allowed communication between EPGs. The Policy Enforcement Point (PEP), implemented on leaf switches, enforces these contracts by applying the specified filters and actions. The APIC defines the policy, but enforcement occurs at the leaf. Spines and EPGs do not enforce contracts, making the PEP the correct component.

Answer

Application Policy Infrastructure Controller (APIC)

Answer

Spine switch

Answer

Endpoint Group (EPG)