350-401 Architecture Practice Test 4 — 15 Questions

Question 1

A network engineer is planning a WAN edge design for a branch office that must connect to two different service providers for redundancy. The design must support per-packet load balancing across both links and must detect link failures within one second. Which Cisco IOS XE feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco IOS XE with BFD and equal-cost multipath static routes. BFD is the standard Cisco IOS XE mechanism for sub-second link failure detection, and equal-cost multipath static routes across two providers enable per-packet load balancing when configured appropriately. Policy-Based Routing, HSRP, and a single default route do not provide both dynamic balancing and fast failure detection. The combination of BFD with ECMP static routes directly addresses the redundancy and detection requirements.

Answer

Policy-Based Routing with two next-hop statements

Answer

Cisco IOS XE with HSRP and two default routes

Answer

Per-packet load balancing on a single default route

Question 2

A network engineer is deploying a new Cisco Catalyst 9000 switch in a branch office. The switch must support Power over Ethernet (PoE) for IP phones and wireless access points, and must provide line-rate Layer 3 routing. Which Cisco IOS XE feature should the engineer verify is enabled to allow the switch to act as a DHCP server for the voice VLAN?

Accepted Answer

IP DHCP pool configuration. To make a Cisco IOS XE switch act as a DHCP server, you configure an IP DHCP pool with the appropriate network and lease settings. This enables the switch to assign IP addresses to clients on the voice VLAN. DHCP snooping and IP helper-address are related to security and relay, not to server functionality.

Answer

DHCP snooping

Answer

IP SLA

Answer

IP helper-address

Question 3

A network engineer is configuring a new Cisco IOS router for a small office. The engineer needs to enable a routing protocol that supports authentication and is easy to implement in a single-area design. Which routing protocol should be used?

Accepted Answer

OSPF. OSPF is an open-standard link-state protocol that supports authentication and is simple to deploy in a single-area design. It offers fast convergence and scalability, making it ideal for a small office. EIGRP is proprietary, RIPv2 is limited by hop count, and BGP is overly complex for this use case.

Answer

BGP

Answer

RIPv2

Answer

EIGRP

Question 4

A network architect is designing a new branch office that must support seamless roaming for wireless clients and enforce consistent security policies across both wired and wireless traffic. The design requires a centralized control plane while keeping data forwarding local to the branch for latency-sensitive applications. Which Cisco SD-Access fabric role should be deployed at the branch to meet these requirements?

Accepted Answer

Fabric edge node with embedded wireless controller functionality. SD-Access separates the control plane, data plane, and policy plane. The fabric edge node is the device that connects endpoints, including access points, and enforces policy. When it also provides embedded wireless controller functionality, wireless traffic can be terminated locally at the branch, enabling seamless roaming and consistent policy enforcement while keeping latency-sensitive traffic local. This combination meets the design goals without requiring a separate appliance.

Answer

Fabric border node

Answer

Fabric edge node

Answer

Fabric control plane node

Question 5

A network architect is designing a new branch office that requires a controller-based wireless solution. The branch has limited space and power, and the architect wants to avoid deploying a dedicated physical wireless controller appliance. The design must support centralized management of access points, guest access, and policy enforcement, and must integrate with the existing Cisco Identity Services Engine (ISE) for 802.1X authentication. Which Cisco solution should the architect choose?

Accepted Answer

Cisco Catalyst 9800-CL cloud controller. The Catalyst 9800-CL is a virtual controller that delivers centralized wireless management, guest access, and policy enforcement without dedicated hardware. It integrates with ISE for 802.1X, meeting all requirements. Other options either lack controller functionality or are not suited for the scale and integration needed.

Answer

Cisco Mobility Express

Answer

Cisco Digital Network Architecture (DNA) Center with embedded wireless controller

Answer

Cisco Aironet 4800 access point in autonomous mode

Question 6

A network engineer is designing a Cisco SD-Access fabric for a campus with 5000 endpoints. The design must support Layer 2 extension between two fabric sites and allow endpoints to retain their IP addresses when roaming between sites. Which Cisco SD-Access component enables this Layer 2 extension across sites?

Accepted Answer

SD-Access transit network using VXLAN with Layer 2 VNI mapping.. To extend Layer 2 across SD-Access fabric sites and allow endpoints to keep IP addresses when roaming, the fabric must use a transit network that carries Layer 2 VNIs over VXLAN. This stretches the subnet between sites. Control plane nodes, edge nodes, and border nodes with Layer 3 handoff do not provide Layer 2 extension across sites; only the transit network with Layer 2 VNI support does.

Answer

Fabric border node with Layer 3 handoff to the external network.

Answer

Fabric control plane node with LISP map-server and map-resolver roles.

Answer

Fabric edge node with anycast gateway and VLAN-to-VNI mapping.

Question 7

A network architect is designing a new branch office WAN that must provide dynamic, on-demand VPN tunnels between the branch and the headquarters without requiring a preconfigured full mesh. The design must support multicast traffic and use a control plane that distributes group membership information. Which Cisco technology best meets these requirements?

Accepted Answer

GET VPN with GDOI. GET VPN with GDOI is designed for group-based VPNs where a key server distributes encryption keys and group policies to all group members. It supports multicast traffic because the group members share a common security association, and the control plane distributes group membership, enabling dynamic, on-demand tunnels without a full mesh. This matches the branch office requirements for multicast and group control plane.

Answer

Cisco SD-WAN with OMP

Answer

IPsec VPN with IKEv2 dynamic peers

Answer

DMVPN with NHRP and mGRE

Question 8

A network administrator is deploying Cisco StackWise Virtual on two Catalyst 9000 switches to provide high availability at the distribution layer. The administrator wants to verify that the switches have formed a StackWise Virtual domain and are operating as a single logical entity. Which command should be used to display the StackWise Virtual link status and member information?

Accepted Answer

show stackwise-virtual. StackWise Virtual combines two Catalyst 9000 switches into a single logical switch. The show stackwise-virtual command is the correct way to verify the domain formation, link status, and member roles. Commands like show switch detail belong to traditional StackWise, show redundancy focuses on supervisor failover, and show vpc status is for Nexus vPC. Only show stackwise-virtual directly displays the StackWise Virtual domain and link information.

Answer

show switch detail

Answer

show vpc status

Answer

show redundancy

Question 9

A network architect is designing a Cisco SD-Access fabric for a large campus. The design must support seamless mobility for wireless clients across fabric edge nodes, provide segmentation for IoT devices, and integrate with an external Cisco ISE for policy. Which two components are required in the SD-Access fabric to support these requirements? (Choose two.)

Accepted Answer

Fabric control plane node. Seamless mobility and segmentation in Cisco SD-Access rely on the fabric control plane node, which maintains endpoint-to-routing locator mappings, and fabric edge nodes, which register endpoints and enforce policy. These components work together with Cisco ISE for policy integration and with fabric wireless controllers for wireless mobility.

Answer

Cisco DNA Center appliance

Answer

Fabric border node

Answer

Fabric intermediate node

Question 10

A network engineer is deploying Cisco StackWise Virtual on two Catalyst 9000 switches. Which two statements are true about the control plane and data plane operation of StackWise Virtual? (Choose two.)

Accepted Answer

Both switches actively forward traffic simultaneously using a distributed data plane.. StackWise Virtual creates a single logical switch from two physical switches, with one active and one standby control plane. However, both switches actively forward data traffic, providing a distributed data plane. The StackWise Virtual Link carries both control and data traffic. The standby switch is not idle for data forwarding.

Answer

The standby switch does not forward any data traffic until a failover occurs.

Answer

The two switches must be directly connected via their management interfaces for StackWise Virtual to form.

Answer

StackWise Virtual requires a dedicated stack cable for control plane traffic only.

Question 11

A network administrator is configuring a Cisco Catalyst 9000 switch to support a new wireless deployment. The wireless LAN controller is integrated into the switch, and the administrator needs to ensure that the switch can act as a Mobility Agent for roaming clients. Which feature must be enabled on the switch?

Accepted Answer

Cisco Embedded Wireless Controller (EWC). The Cisco Embedded Wireless Controller (EWC) is a feature on Catalyst 9000 switches that provides integrated wireless controller functionality. When enabled, the switch can serve as a Mobility Agent, facilitating seamless roaming for wireless clients. This eliminates the need for a separate physical wireless controller and is ideal for small to medium deployments.

Answer

Cisco Mobility Express

Answer

Cisco SD-Access

Answer

Cisco DNA Center

Question 12

A network architect is designing a Cisco SD-Access fabric and needs to ensure that the fabric supports overlay traffic for both IPv4 and IPv6 endpoints. Which two statements are true regarding the fabric underlay and overlay in this scenario? (Choose two.)

Accepted Answer

The underlay can be IPv4-only while the overlay supports both IPv4 and IPv6.. In Cisco SD-Access, the underlay can remain IPv4-only while the overlay supports both IPv4 and IPv6. The fabric edge nodes must be configured with anycast gateways for both protocols to provide dual-stack services. The control plane node does not need to be dual-stack, as it maps endpoints using IPv4 transport. Therefore, the true statements are that the underlay can be IPv4-only and that edge nodes need dual anycast gateways.

Answer

The fabric control plane node must be dual-stack to map IPv6 endpoints.

Answer

IPv6 multicast in the overlay requires the underlay to be IPv6 multicast-enabled.

Answer

The underlay must be dual-stack to support IPv6 in the overlay.

Question 13

A network engineer is implementing Cisco SD-Access and needs to ensure that the fabric can provide policy-based segmentation between different user groups. The engineer plans to use Cisco Identity Services Engine (ISE) for authentication and authorization. Which component of the SD-Access architecture is responsible for translating ISE group information into a fabric-specific tag that is carried in the VXLAN header?

Accepted Answer

Fabric edge node. The fabric edge node is where endpoints connect and where the SGT is applied to traffic entering the fabric. It receives the group information from ISE during authentication and inserts the SGT into the VXLAN header. This allows policy enforcement throughout the fabric based on the tag, without needing to re-authenticate at each hop.

Answer

Fabric control plane node

Answer

Cisco DNA Center

Answer

Fabric border node

Question 14

A network engineer is deploying a new Cisco Wireless LAN Controller (WLC) and needs to ensure that the management interface is configured with a specific IP address, subnet mask, and default gateway. The WLC is currently using DHCP. Which command should the engineer use to configure the management interface?

Accepted Answer

config interface address management 10.1.1.10 255.255.255.0 10.1.1.1. On Cisco Wireless LAN Controllers, the management interface is configured using the config interface address command, specifying the interface name, IP address, subnet mask, and gateway. This command sets the static IP configuration for the management interface, which is essential for controller access and AP registration.

Answer

config interface vlan management 10.1.1.10 255.255.255.0 10.1.1.1

Answer

config management ip 10.1.1.10 255.255.255.0 10.1.1.1

Answer

config interface dhcp management 10.1.1.10 255.255.255.0 10.1.1.1

Question 15

An enterprise network uses OSPF with multiple areas. Area 0 is the backbone, Area 1 is a regular area, and Area 2 is configured as a totally stubby area. A network engineer is analyzing which LSA types are allowed to be injected into Area 2 from Area 0. Which LSA types are permitted in a totally stubby area?

Accepted Answer

Type 1, Type 2, and Type 3 LSAs. A totally stubby area is a Cisco-specific extension of the stub area. The ABR blocks Type 3, Type 4, and Type 5 LSAs from entering the area, except for a default route injected as a Type 3 LSA. Within the area, Type 1 and Type 2 LSAs continue to flood, describing intra-area topology. Therefore, the allowed LSAs are Type 1, Type 2, and a single Type 3 default route. This reduces the link-state database and routing table size in the stub area.

Answer

Type 1, Type 2, Type 3, and Type 4 LSAs

Answer

Type 1, Type 2, and Type 5 LSAs

Answer

Type 1, Type 2, Type 3, Type 4, and Type 5 LSAs