350-401 Architecture Practice Test 6 — 15 Questions

Question 1

A large enterprise has a campus network with a collapsed core design. The core switch connects to two distribution switches, each serving several access switches. The network uses OSPF as the IGP. Recently, after a link failure between the core and distribution switch A, the network experienced a 30-second outage before converging. The engineer wants to improve convergence time to under 5 seconds. The budget is limited, so hardware upgrades are not an option. The engineer is considering the following actions:
A. Enable OSPF Fast Hello on all interfaces.
B. Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.
C. Implement OSPF LSA throttling with a minimum interval of 0 ms.
D. Use OSPF incremental SPF (iSPF).

Which action will provide the most significant improvement in convergence time for this scenario?

Accepted Answer

Reduce OSPF dead timer to 1 second and hello timer to 333 milliseconds.. Reducing the OSPF dead timer to 1 second and hello timer to 333 milliseconds directly addresses the 30-second outage caused by the link failure. The default dead timer (40 seconds on broadcast networks) is the primary contributor to convergence delay, as OSPF must wait for the dead interval to expire before declaring a neighbor down. By lowering these timers, failure detection drops from 40 seconds to approximately 1 second, which is the most impactful single change for convergence under budget constraints.

Answer

Enable OSPF Fast Hello on all interfaces.

Answer

Implement OSPF LSA throttling with a minimum interval of 0 ms.

Answer

Use OSPF incremental SPF (iSPF).

Question 2

A small business has a single router connected to the internet and a switch for the LAN. They want to implement VLANs to separate guest and corporate traffic. The router has only one physical interface to the switch. The network engineer proposes using subinterfaces with 802.1Q trunking on the router interface. Which configuration step is required on the switch port connected to the router?

Accepted Answer

Configure the port as a trunk port.. The router uses subinterfaces with 802.1Q trunking to carry multiple VLANs over a single physical link. For this to work, the switch port connected to the router must be configured as a trunk port, which tags frames with VLAN IDs as they traverse the link. This allows the router to route between VLANs using its subinterfaces, each associated with a specific VLAN.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port in VLAN 1.

Answer

Configure the port as a dynamic desirable port.

Question 3

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

Accepted Answer

Deploy two core switches configured with VSS or StackWise.. Deploying two core switches with VSS (Virtual Switching System) or StackWise provides both redundancy and active-active load balancing at the core layer. VSS virtualizes two physical switches into a single logical switch, eliminating the need for Spanning Tree Protocol (STP) on inter-switch links and enabling sub-second failover. This design ensures high availability by removing single points of failure and maximizing throughput between distribution and core layers.

Answer

Use a single distribution switch to simplify management.

Answer

Configure the core layer for Layer 2 switching only.

Answer

Use spanning-tree PortFast on all core switch ports.

Question 4

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

Accepted Answer

MTU size is set to 1500 on one switch and 9000 on the other.. An MTU mismatch between two switches in a port-channel can cause packet fragmentation or drops. With LACP, both sides must have matching MTU settings to ensure proper frame forwarding. If one switch has an MTU of 1500 and the other 9000 (jumbo frames), packets exceeding 1500 bytes will be dropped by the switch with the smaller MTU, causing intermittent packet loss. In contrast, an active/passive LACP configuration is valid and commonly used; it does not cause packet loss if both sides are properly configured. Passive-passive would prevent the port-channel from forming, but that is not the case here.

Answer

Auto-negotiation is disabled on both ends.

Answer

Spanning-tree BPDU guard is enabled on the port-channel.

Answer

One switch is configured with active LACP and the other with passive LACP.

Question 5

A global enterprise is transitioning from a traditional three-tier campus architecture to a software-defined access (SD-Access) fabric. Which architectural consideration is most critical for the underlay network?

Accepted Answer

Configure a routed access layer with a link-state routing protocol (IS-IS or OSPF).. In an SD-Access fabric, the underlay network must provide IP connectivity between all fabric devices (edge, control plane, border nodes) using a routed access layer with a link-state routing protocol like IS-IS or OSPF. This ensures fast convergence, loop-free topology, and support for the overlay's VXLAN tunnels. A routed access layer eliminates spanning-tree dependencies and aligns with the fabric's requirement for a simple, scalable IP-based transport.

Answer

Implement PIM-SM for multicast routing in the underlay.

Answer

Preserve existing VLANs across the fabric to minimize changes.

Answer

Deploy VRF-lite on all edge nodes to isolate tenants.

Question 6

A network administrator is deploying QoS in a converged network. Which approach correctly implements trust boundaries and marking?

Accepted Answer

Set trust boundary at the access layer switch and re-mark packets based on source.. In a converged network, trust boundaries should be established at the access layer to ensure that marking decisions are made as close to the source as possible. By setting the trust boundary at the access layer switch and re-marking packets based on source (e.g., trusting only IP phones while re-marking workstation traffic), the network can enforce policy before traffic enters the core, preventing unauthorized or misconfigured endpoints from influencing QoS markings. This aligns with Cisco's best practice of trusting only known devices and re-marking all other traffic to a default or lower priority.

Answer

Configure marking only at the core layer to simplify policy.

Answer

Trust only the distribution layer switches to mark traffic.

Answer

Trust the DSCP values set by IP phones and workstations.

Question 7

Which THREE of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. Spine-leaf architecture provides predictable latency for east-west traffic because every leaf switch connects to every spine switch, ensuring consistent hop count. It simplifies scalability: adding a new leaf switch requires connecting it to all spine switches without redesign. Additionally, spine-leaf eliminates the need for Spanning Tree Protocol (STP) because it uses Layer 3 routing between leaf and spine switches, removing Layer 2 loops. Therefore, options A, B, and D are correct. Option C is incorrect because spine-leaf increases cabling due to full mesh connectivity. Option E is incorrect because firewall appliances are still required for security.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 8

Which THREE of the following are valid considerations when planning a wireless network for high-density environments?

Accepted Answer

Use a channel reuse plan that minimizes co-channel interference.. A channel reuse plan that minimizes co-channel interference is essential in high-density environments to ensure that adjacent access points (APs) do not use the same or overlapping channels, which would degrade throughput. By carefully planning channel assignments (e.g., using non-overlapping channels in the 5 GHz band), you maximize spatial reuse and overall network capacity.

Answer

Increase AP transmit power to maximize coverage.

Answer

Enable 2.4 GHz band only to maximize range.

Question 9

A mid-size enterprise is deploying a new branch office with 50 users. The branch will have its own router, switch, and wireless AP. The WAN link is a 50 Mbps MPLS circuit. The company uses VoIP and requires Quality of Service. The network administrator has configured the router with a QoS policy that marks VoIP traffic with DSCP EF and all other traffic with DSCP 0. The policy also shapes traffic to 50 Mbps. After deployment, users report that voice quality is poor during peak hours. The administrator checks the router and sees that the output queue on the WAN interface is often full and drops are occurring. Which action should the administrator take to improve voice quality?

Accepted Answer

Configure a priority queue for DSCP EF traffic within the shaper.. The shaper is limiting traffic to 50 Mbps, but during peak hours, the aggregate traffic exceeds this rate, causing the output queue to fill and drop packets indiscriminately. By configuring a priority queue for DSCP EF (VoIP) traffic within the shaper, the router will service VoIP packets before other traffic, ensuring low latency and jitter even when the link is congested. This is the standard Cisco approach for voice quality on shaped links, as priority queuing bypasses the normal FIFO or CBWFQ behavior for marked traffic.

Answer

Increase the shaping rate to 60 Mbps to allow for burst.

Answer

Replace shaping with policing to drop non-voice traffic.

Answer

Change the marking to use CoS instead of DSCP for better QoS.

Question 10

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Accepted Answer

Enter global configuration mode, then specify the destination network and subnet mask, then specify the next-hop IP address or exit interface.. Static routes require global config mode and must specify the destination network, subnet mask, and next-hop address or exit interface.

Answer

Specify the destination network and subnet mask, then enter global configuration mode, then specify the next-hop IP address or exit interface.

Answer

Specify the next-hop IP address or exit interface, then specify the destination network and subnet mask, then enter global configuration mode.

Answer

Enter global configuration mode, then specify the next-hop IP address or exit interface, then specify the destination network and subnet mask.

Question 11

Match each First Hop Redundancy Protocol (FHRP) to its description.

Accepted Answer

HSRP: A Cisco-proprietary FHRP that uses an active/standby model with a virtual IP and MAC address, disabled preemption by default.. FHRPs provide default gateway redundancy. HSRP is Cisco proprietary, active/standby, preemption disabled by default. VRRP is open standard, preemption enabled. GLBP allows load balancing among multiple routers.

Answer

HSRP: An open standard FHRP that uses a virtual IP and MAC, preemption enabled.

Answer

VRRP: A Cisco-proprietary FHRP that uses active/standby model.

Answer

GLBP: An FHRP that uses active/standby model with no load balancing.

Question 12

A network architect is designing a Cisco SD-Access fabric for a campus network. The architect wants to ensure that endpoints in the same virtual network can communicate with each other even when they are attached to different fabric edge nodes. Which control plane component is responsible for resolving endpoint location information across the fabric?

Accepted Answer

Fabric control plane node. The fabric control plane node in Cisco SD-Access implements LISP map-server and map-resolver functions. It maintains a database of endpoint IP addresses and their corresponding fabric edge node RLOCs. When an endpoint on one edge node needs to communicate with an endpoint on another edge node, the source edge node queries the control plane node to learn the destination's location, enabling VXLAN encapsulation and delivery.

Answer

Cisco DNA Center

Answer

Fabric border node

Answer

Cisco Identity Services Engine (ISE)

Question 13

A network architect is designing a Cisco SD-WAN fabric for a retail chain with 200 branch sites. The design must provide a single control-plane protocol that distributes routing and policy information between the SD-WAN controllers and the WAN Edge devices, while keeping data-plane traffic direct between branches. Which technology should the architect select for the control plane?

Accepted Answer

Cisco Overlay Management Protocol (OMP). Cisco SD-WAN uses OMP as the single control-plane protocol between the vSmart controller and WAN Edge devices. OMP carries TLOC, route, and policy information, allowing the controller to make forwarding decisions while data traffic flows directly between branches. BGP and IS-IS are underlay or service-side protocols, and LISP belongs to SD-Access, so they do not meet the stated design requirement.

Answer

Intermediate System-to-Intermediate System (IS-IS)

Answer

Locator/ID Separation Protocol (LISP)

Answer

Border Gateway Protocol (BGP) with route reflectors

Question 14

A network architect is designing a controller-based wireless deployment for a large campus. The customer wants centralized management, policy enforcement, and the ability to deploy a single wireless LAN controller that can handle up to 6,000 access points. Which Cisco platform should the architect recommend?

Accepted Answer

Cisco Catalyst 9800-80 Wireless Controller. The Catalyst 9800-80 is purpose-built for large-scale wireless deployments, supporting up to 6,000 access points and 64,000 clients. It offers centralized management, policy enforcement, and runs on IOS-XE, aligning with modern intent-based networking. The other options either lack the required scale or are designed for smaller environments.

Answer

Cisco Mobility Express

Answer

Cisco 5520 Wireless Controller

Answer

Cisco Catalyst 9800-L Wireless Controller

Question 15

A network engineer is implementing Cisco TrustSec in a data center. The engineer wants to enforce security policies based on logical groupings of endpoints rather than IP addresses. Which component is used to assign a Security Group Tag (SGT) to traffic at the ingress point?

Accepted Answer

Ingress enforcement device. In Cisco TrustSec, the ingress enforcement device assigns the Security Group Tag (SGT) to packets as they enter the network. This can be done statically by configuring a port or dynamically via 802.1X authentication and authorization with Cisco ISE. The SGT is then carried in the packet, enabling egress enforcement devices to apply SGACLs based on the tag without re-examining IP addresses.

Answer

Security Group ACL (SGACL)

Answer

Egress enforcement device

Answer

Cisco Identity Services Engine (ISE)