350-401 Enterprise Network Design — 10 Questions

Question 1

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

Accepted Answer

STP will cause slow convergence and inefficient use of redundant links.. STP (802.1D) converges slowly, typically taking 30-50 seconds (listening + learning states) after a topology change. In a large campus network with 5000 users, this delay causes unacceptable downtime. Additionally, STP blocks redundant links to prevent loops, wasting bandwidth that could be used for load balancing. Modern alternatives like Rapid PVST+ (802.1w) or MST (802.1s) offer sub-second convergence, making classic STP a poor choice for high-availability designs.

Answer

STP requires all switches to be in the same VLAN to function correctly.

Answer

STP cannot be used with 5000 users due to MAC address table limitations.

Answer

STP will cause broadcast storms in a three-building design.

Question 2

A company is deploying a new data center and needs to choose between a three-tier (core, aggregation, access) and a spine-leaf architecture. The network engineer is concerned about east-west traffic patterns for server virtualization. Which architecture is most suitable and why?

Accepted Answer

Spine-leaf, because it provides equal-cost multipath (ECMP) for all leaf-to-leaf traffic.. Spine-leaf architecture is most suitable for east-west traffic patterns because it provides a full mesh of connections between leaf switches and spine switches, enabling equal-cost multipath (ECMP) routing. This allows all leaf-to-leaf traffic to traverse multiple parallel paths with equal cost, maximizing bandwidth utilization and minimizing latency, which is critical for server virtualization traffic that often moves between hypervisors.

Answer

Three-tier, because it offers more redundancy with multiple aggregation layers.

Answer

Spine-leaf, because it supports legacy spanning tree protocols.

Answer

Three-tier, because it is easier to manage with traditional VLANs.

Question 3

An enterprise network is experiencing high CPU utilization on the distribution layer switches. The design uses VLANs with SVIs for inter-VLAN routing, and HSRP for first-hop redundancy. The engineer notices that the standby switch is also experiencing high CPU. What is the most likely cause?

Accepted Answer

The standby switch is processing HSRP hellos for all VLANs, causing CPU spikes.. In an HSRP setup, both the active and standby routers process incoming Hello messages for every VLAN on which HSRP is configured. Even though the standby switch does not forward inter-VLAN traffic, it must still receive and process periodic HSRP hellos (default every 3 seconds) to maintain its role and detect active failures. With a large number of VLANs, the cumulative CPU overhead from processing these hellos can cause high utilization on both switches.

Answer

The standby switch is forwarding all broadcast traffic due to a misconfigured STP root.

Answer

The standby switch is performing routing for all VLANs because the active switch failed.

Answer

The standby switch is processing VTP updates from the distribution layer.

Question 4

A network engineer is designing a WAN connection for a branch office that requires high availability and bandwidth aggregation. The branch has two internet connections from different ISPs. The engineer wants to use both links actively for load balancing and failover. Which design approach should be used?

Accepted Answer

Deploy SD-WAN to actively use both links with policy-based load balancing.. SD-WAN is the correct design because it natively supports active/active utilization of multiple WAN links with policy-based load balancing, allowing traffic to be distributed across both ISP connections based on application policies, SLA metrics, or other criteria. It also provides seamless failover by dynamically rerouting traffic if one link fails, meeting the requirements for high availability and bandwidth aggregation without relying on a single active link.

Answer

Configure static routes with different metrics for each link and use HSRP for failover.

Answer

Use BGP with both ISPs and rely on BGP best path selection for load balancing.

Answer

Implement a VPN tunnel between the branch and headquarters using only one link.

Question 5

A campus network uses a collapsed core design with two distribution switches and multiple access switches. The engineer wants to ensure that if one distribution switch fails, the access switches can still reach the core. The access switches are connected to both distribution switches. What additional configuration is required on the access switches?

Accepted Answer

Configure the access switches with VPC (Virtual Port Channel) to the distribution switches.. Option A is correct because VPC allows the access switches to form a single logical link to the pair of distribution switches, enabling active-active forwarding and seamless failover. If one distribution switch fails, the access switch continues to reach the core through the surviving distribution switch without requiring STP convergence or routing protocol changes.

Answer

Enable STP on the access switches and set the root bridge priority to 0.

Answer

Configure the access switches with HSRP to the distribution switches.

Answer

Use static routing with equal-cost paths from the access switches to the distribution switches.

Question 6

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Accepted Answer

Fabric Edge node. The Fabric Edge node is the correct answer because it is the SD-Access component that serves as the attachment point for both wired and wireless endpoints. In an SD-Access fabric, the Fabric Edge node terminates the VXLAN tunnels from the wireless LAN controller (WLC) and applies consistent policy (e.g., SGT-based ACLs) to traffic from both wired and wireless users, ensuring seamless integration of the existing wireless infrastructure.

Answer

Fabric Control node

Answer

Fabric Border node

Answer

Wireless LAN Controller (WLC)

Question 7

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 8

A company is deploying a new branch office with 50 users. The branch needs to connect to the headquarters via a WAN link. The engineer wants to use a design that minimizes the need for routing protocol configuration at the branch while still providing redundancy. Which design is most appropriate?

Accepted Answer

Use a hub-and-spoke design with static routes on the branch router and a single WAN link.. Option A is correct because a hub-and-spoke design with static routes on the branch router minimizes routing protocol configuration (no dynamic routing protocol needed) while still providing redundancy if the single WAN link is backed by a secondary path (e.g., a backup link or dual-homed connection) that can be handled via floating static routes. This approach keeps the branch router simple and avoids the complexity of running OSPF or BGP, which is unnecessary for a small branch with 50 users.

Answer

Use a full mesh design with OSPF on all routers.

Answer

Use a point-to-point design with BGP on the branch router.

Answer

Use a spine-leaf design with multiple WAN links.

Question 9

An enterprise network uses OSPF in the core and EIGRP in the campus distribution layer. The engineer needs to redistribute routes between the two protocols. Which design consideration is most important to prevent routing loops?

Accepted Answer

Set appropriate administrative distance values for redistributed routes.. Setting appropriate administrative distance values for redistributed routes is crucial to prevent routing loops when redistributing between OSPF and EIGRP. By default, EIGRP has an administrative distance of 170 for external routes and 90 for internal routes, while OSPF uses 110. If redistributed routes are not assigned a higher administrative distance, a router might prefer a redistributed route over a directly learned route, creating a feedback loop where routes are re-injected into the original protocol. Adjusting the administrative distance ensures that redistributed routes are less preferred than native routes, breaking the loop.

Answer

Use route maps to filter all redistributed routes.

Answer

Enable OSPF on all EIGRP interfaces.

Answer

Use a single routing protocol throughout the network.

Question 10

An architect is designing an SD-Access fabric for a campus network that must support dynamic endpoint grouping based on user identity and device type. The design must minimize manual policy configuration and allow the fabric to enforce access policies at the edge. Which combination of components and protocols is required to meet these requirements?

Accepted Answer

Cisco ISE for policy management, LISP for control plane, VXLAN for data plane, and Cisco TrustSec for SGT-based enforcement. Option A is correct because SD-Access uses Cisco ISE as the policy engine to define user/device-based policies, LISP as the control plane for endpoint-to-location mapping and mobility, VXLAN as the data plane for overlay encapsulation, and Cisco TrustSec for SGT-based enforcement at the edge. This combination enables dynamic endpoint grouping without manual ACLs, as SGTs are propagated via VXLAN Group Policy Option (GPO) and enforced by the fabric edge switches.

Answer

Cisco ISE for policy management, OSPF for control plane, GRE for data plane, and ACLs for enforcement

Answer

Cisco ISE for policy management, BGP for control plane, MPLS for data plane, and VLANs for enforcement

Answer

Cisco ISE for policy management, LISP for data plane, VXLAN for control plane, and 802.1X for enforcement