350-401 Architecture Practice Test 13 — 15 Questions

Question 1

A network engineer is implementing Cisco TrustSec in a campus network. The security team wants to enforce access policies based on user identity and device type without relying on IP addresses. Which component is responsible for assigning Security Group Tags (SGTs) to traffic at the ingress point?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Catalyst switch with TrustSec support. In Cisco TrustSec, the ingress network device (such as a Catalyst switch or wireless controller) is responsible for classifying and tagging packets with SGTs. This classification is based on policies downloaded from ISE. The switch inserts the SGT into the packet, allowing subsequent devices to enforce access policies without examining IP addresses. ISE defines the policies but does not perform the tagging.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco DNA Center

Question 2

A network architect is designing a new branch office that requires a controller-based wireless solution. The branch has a single Cisco Catalyst 9800-CL appliance and needs to support 802.1X authentication with dynamic VLAN assignment for employee SSIDs. Which deployment mode should the architect use for the access points to meet these requirements with minimal configuration on the APs?

Accepted Answer

Local mode with the APs managed by the Catalyst 9800-CL controller. Local mode is the correct choice because it keeps the APs lightweight and relies on the Catalyst 9800-CL controller for all client authentication and VLAN assignment. This centralizes the complex configuration on the controller, reducing AP-side setup. The other modes either add unnecessary complexity for survivability or do not serve client traffic at all.

Answer

FlexConnect mode with central switching enabled for the employee SSIDs

Answer

Sniffer mode with the APs capturing 802.11 frames for analysis

Answer

Monitor mode with the APs dedicated to spectrum analysis and rogue detection

Question 3

A network engineer is designing a campus network that must support rapid convergence and load balancing across multiple links. The design uses Cisco StackWise Virtual technology on a pair of Catalyst 9000 switches. The engineer wants to ensure that the control plane remains active on both switches and that traffic can be forwarded by both switches simultaneously. Which statement accurately describes the StackWise Virtual operation?

Accepted Answer

Both switches share a single control plane and a single management IP address, and both forward traffic.. StackWise Virtual creates a single logical switch from two physical switches, with one control plane and one management IP. Both switches actively forward traffic, providing active-active operation and eliminating the need for FHRP. This design supports rapid convergence and load balancing across links.

Answer

Only one switch performs routing, while the other switch only performs Layer 2 switching.

Answer

One switch is active, and the other is standby; only the active switch forwards traffic.

Answer

The switches operate independently with separate control planes, and a First Hop Redundancy Protocol (FHRP) is required for gateway redundancy.

Question 4

A network engineer is comparing first-hop redundancy options for a campus access layer. The requirement is to provide gateway redundancy for IPv6 hosts while also allowing load sharing between two routers, and the solution must use an open standard rather than a Cisco-proprietary protocol. Which FHRP should the engineer select?

Accepted Answer

Virtual Router Redundancy Protocol (VRRP) version 3. VRRPv3 is an IETF open standard that supports IPv6 and allows multiple routers to participate in gateway redundancy, with load sharing achievable through multiple virtual router groups. It is the only listed option that is both open standard and suited to IPv6 first-hop redundancy with load sharing.

Answer

Proxy Address Resolution Protocol (Proxy ARP)

Answer

Gateway Load Balancing Protocol (GLBP)

Answer

Hot Standby Router Protocol (HSRP) version 2

Question 5

A network administrator is deploying a new Cisco SD-WAN solution. The administrator needs to ensure that the control plane is separated from the data plane and that the solution can dynamically select the best path for application traffic based on policies. Which component of Cisco SD-WAN is responsible for centralized control plane functions and distributing routing information to the WAN Edge devices?

Accepted Answer

vSmart. vSmart is the centralized control plane in Cisco SD-WAN, using OMP to distribute routing and policies to WAN Edge devices. It enables dynamic path selection and separates control from data plane. vManage is management, vBond is orchestration, and WAN Edge is data plane.

Answer

WAN Edge

Answer

vManage

Answer

vBond

Question 6

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) and access points in a branch office. The administrator wants to ensure that all management traffic between the WLC and APs is encrypted and that APs can discover the WLC across a Layer 3 network. Which protocol should be used for AP-to-WLC communication?

Accepted Answer

CAPWAP with DTLS encryption enabled on the management interface.. CAPWAP is the current protocol for AP-to-WLC communication, and it supports DTLS encryption for control and data traffic. It also enables Layer 3 discovery through options like DHCP option 43 or DNS. LWAPP is deprecated, Mobility Express is for controller-less setups, and SNMPv3 is for management polling, not AP tunneling. Therefore, CAPWAP with DTLS is the correct choice.

Answer

SNMPv3 with AES encryption for AP management and discovery.

Answer

LWAPP with IPsec encryption between AP and WLC.

Answer

Mobility Express with HTTPS management and no CAPWAP tunnel.

Question 7

A network architect is designing a Fabric-enabled campus with Cisco SD-Access and must choose the optimal underlay routing protocol. The fabric will use VXLAN data-plane encapsulation, and the architect wants minimal configuration on the intermediate underlay devices while supporting fast convergence and equal-cost multipath. Which underlay routing approach should be recommended?

Accepted Answer

Use Cisco SD-Access fabric with an IS-IS underlay automatically enabled by the fabric provisioning workflow.. Cisco SD-Access uses an IS-IS underlay that is automatically provisioned by Cisco DNA Center, reducing manual configuration on intermediate devices while supporting fast convergence and ECMP. OSPFv2 and eBGP require explicit per-device configuration and are not the automated fabric underlay. RIPng is unsuitable due to hop limits and slow convergence.

Answer

Enable RIPng on all underlay devices to provide simple hop-count-based routing.

Answer

Deploy eBGP between all underlay switches using unique autonomous system numbers per device.

Answer

Configure OSPFv2 in a single area on all underlay devices, including the fabric edge and border nodes.

Question 8

A network architect is evaluating Cisco SD-Access fabric deployment options for a large campus. The design team wants to understand the roles that fabric nodes play in forwarding traffic and in connecting the fabric to external networks. Which two statements accurately describe Cisco SD-Access fabric node roles? (Choose two.)

Accepted Answer

Fabric border nodes connect the SD-Access fabric to external networks and perform route redistribution between the fabric and external routing domains.. In Cisco SD-Access, fabric edge nodes encapsulate endpoint traffic in VXLAN and register EIDs with the control-plane node, while fabric border nodes connect the fabric to external networks and redistribute routes. Those two roles match the accurate statements, whereas intermediate and control-plane responsibilities are assigned incorrectly elsewhere.

Answer

Fabric intermediate nodes maintain the LISP map database and answer EID-to-RLOC queries from edge nodes.

Answer

Fabric border nodes are responsible for registering wired endpoint EIDs and building VXLAN tunnels to access switches.

Answer

Fabric edge nodes run the LISP map-server and map-resolver functions for the entire fabric.

Question 9

A network administrator is configuring a Cisco wireless controller to support a high-density auditorium. The design requires that client devices be evenly distributed across available access points and that roaming be optimized for voice traffic. Which feature should be enabled to achieve these goals?

Accepted Answer

Cisco Client Load Balancing. Cisco Client Load Balancing is designed to distribute clients evenly across access points by managing association requests. In a high-density auditorium, this prevents any single AP from becoming overloaded, improving overall performance. For voice roaming, additional features like 802.11k/v/r are recommended, but the primary feature for even distribution is load balancing, which directly addresses the stated requirement.

Answer

Cisco Aironet Extensions

Answer

Cisco Band Select

Answer

Cisco CleanAir

Question 10

A network engineer is designing a QoS policy for a campus network. The requirement is that voice traffic must be guaranteed strict priority treatment over all other traffic types, even during congestion. Which queuing mechanism should be configured on the egress interfaces to meet this requirement?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the Cisco IOS queuing mechanism that provides strict priority to designated classes, such as voice, while using CBWFQ for other classes. The priority queue is serviced first, ensuring minimal delay and jitter for voice even under congestion. A policer limits the priority queue to prevent it from starving other queues. CBWFQ, WRED, and FIFO do not provide strict priority scheduling, so LLQ is the correct choice.

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO) queuing

Answer

Weighted Random Early Detection (WRED)

Question 11

A network engineer is designing a high-availability solution for a data center using Cisco Application Centric Infrastructure (ACI). The engineer wants to ensure that the fabric can continue to operate if a spine switch fails, and that traffic is load-balanced across all available paths. Which statement accurately describes the ACI fabric architecture?

Accepted Answer

ACI uses a spine-leaf topology where every leaf connects to every spine, and a failed spine switch reduces capacity but does not cause an outage.. ACI uses a spine-leaf topology where all leaf switches connect to all spine switches, providing active-active forwarding. A failed spine reduces overall capacity but does not cause an outage because other spines continue to forward traffic. This design ensures high availability and load balancing.

Answer

ACI uses a single spine switch for all traffic, and redundancy is achieved through a standby spine that takes over on failure.

Answer

ACI uses a traditional Spanning Tree Protocol (STP) to prevent loops, and a failed spine switch causes a full fabric outage.

Answer

ACI uses a ring topology for the fabric, and a failed spine switch breaks the ring, causing a partial outage.

Question 12

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office. The office has a mix of corporate laptops and guest devices. The administrator wants to ensure that guest devices can only access the Internet and are isolated from the corporate network. Which WLC feature should be configured to achieve this?

Accepted Answer

Guest WLAN with a dedicated interface and ACL. To isolate guest traffic, the administrator should create a separate guest WLAN and map it to a dedicated interface, such as a DMZ VLAN. Then, an ACL can be applied to that WLAN to restrict traffic to only Internet-bound destinations. This prevents guests from accessing corporate resources. Other options like dynamic VLAN or FlexConnect do not inherently provide the required isolation.

Answer

FlexConnect local switching

Answer

Dynamic VLAN assignment

Answer

Access Control Lists (ACLs) on the WLC

Question 13

A network engineer is deploying a new branch office that connects to the headquarters via a Cisco SD-WAN solution. The branch has two WAN transports: an MPLS circuit and a broadband internet link. The engineer wants to ensure that business-critical traffic uses the MPLS circuit while guest traffic uses the broadband link, and that failover occurs automatically if the MPLS circuit degrades. Which Cisco SD-WAN feature should be configured to meet these requirements?

Accepted Answer

Application-aware routing policy with SLA classes and path preference.. Cisco SD-WAN application-aware routing uses SLA classes to continuously monitor path performance and select the best path per application. By mapping business-critical traffic to an SLA class that prefers MPLS and falls back to broadband, and guest traffic to a policy that prefers broadband, the engineer achieves both path separation and automatic failover on degradation.

Answer

Policy-based routing (PBR) using route maps that match on source subnet.

Answer

Static routes with administrative distance manipulation on the branch router.

Answer

Per-VPN QoS trust boundaries on the branch edge interfaces.

Question 14

A network engineer is configuring a Cisco IOS XE router to support Network Address Translation (NAT) for a small office. The router has an inside interface GigabitEthernet0/0/0 and an outside interface GigabitEthernet0/0/1. The engineer wants to translate all inside hosts to the outside interface IP address using PAT. Which configuration snippet correctly implements this?

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0/1 overload; interface GigabitEthernet0/0/0: ip nat inside; interface GigabitEthernet0/0/1: ip nat outside; access-list 1 permit 192.168.1.0 0.0.0.255. The correct PAT configuration for translating all inside hosts to the outside interface IP uses the ip nat inside source list command with the interface keyword and overload. The access list defines the inside subnet, and interfaces are marked inside and outside. Static NAT, NAT pools, and outside source NAT do not meet the specific requirement of translating all inside hosts to the outside interface IP.

Answer

ip nat inside source static 192.168.1.10 203.0.113.1; interfaces marked inside/outside; no access-list needed

Answer

ip nat inside source list 1 pool MYPOOL overload; ip nat pool MYPOOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0; interfaces marked inside/outside; access-list 1 permit 192.168.1.0 0.0.0.255

Answer

ip nat outside source list 1 interface GigabitEthernet0/0/0 overload; interfaces marked inside/outside; access-list 1 permit any

Question 15

A network engineer is planning a new branch office network. The branch will have a single Cisco IOS router that connects to the internet via a GigabitEthernet interface. The engineer wants to configure NAT to allow internal hosts to access the internet. Which NAT type should be configured to allow multiple internal hosts to share the single public IP address?

Accepted Answer

Port Address Translation (PAT). Port Address Translation (PAT), or NAT overload, is designed to allow many internal hosts to share a single public IP address. It uses unique source port numbers to distinguish between sessions, making it the most efficient use of a single public IP. This is the standard method for branch offices with a single internet connection.

Answer

Static NAT

Answer

Dynamic NAT

Answer

NAT64