350-401 Enterprise Network Design — 20 Questions

Question 1

A large enterprise is redesigning its campus network to support 5000 users across three buildings. The design must provide high availability and fast convergence in case of a link failure. The network engineer is considering using Spanning Tree Protocol (STP) in the access layer. What is the primary design concern with using STP in this scenario?

Accepted Answer

STP will cause slow convergence and inefficient use of redundant links.. STP (802.1D) converges slowly, typically taking 30-50 seconds (listening + learning states) after a topology change. In a large campus network with 5000 users, this delay causes unacceptable downtime. Additionally, STP blocks redundant links to prevent loops, wasting bandwidth that could be used for load balancing. Modern alternatives like Rapid PVST+ (802.1w) or MST (802.1s) offer sub-second convergence, making classic STP a poor choice for high-availability designs.

Answer

STP requires all switches to be in the same VLAN to function correctly.

Answer

STP cannot be used with 5000 users due to MAC address table limitations.

Answer

STP will cause broadcast storms in a three-building design.

Question 2

A company is deploying a new data center and needs to choose between a three-tier (core, aggregation, access) and a spine-leaf architecture. The network engineer is concerned about east-west traffic patterns for server virtualization. Which architecture is most suitable and why?

Accepted Answer

Spine-leaf, because it provides equal-cost multipath (ECMP) for all leaf-to-leaf traffic.. Spine-leaf architecture is most suitable for east-west traffic patterns because it provides a full mesh of connections between leaf switches and spine switches, enabling equal-cost multipath (ECMP) routing. This allows all leaf-to-leaf traffic to traverse multiple parallel paths with equal cost, maximizing bandwidth utilization and minimizing latency, which is critical for server virtualization traffic that often moves between hypervisors.

Answer

Three-tier, because it offers more redundancy with multiple aggregation layers.

Answer

Spine-leaf, because it supports legacy spanning tree protocols.

Answer

Three-tier, because it is easier to manage with traditional VLANs.

Question 3

An enterprise network is experiencing high CPU utilization on the distribution layer switches. The design uses VLANs with SVIs for inter-VLAN routing, and HSRP for first-hop redundancy. The engineer notices that the standby switch is also experiencing high CPU. What is the most likely cause?

Accepted Answer

The standby switch is processing HSRP hellos for all VLANs, causing CPU spikes.. In an HSRP setup, both the active and standby routers process incoming Hello messages for every VLAN on which HSRP is configured. Even though the standby switch does not forward inter-VLAN traffic, it must still receive and process periodic HSRP hellos (default every 3 seconds) to maintain its role and detect active failures. With a large number of VLANs, the cumulative CPU overhead from processing these hellos can cause high utilization on both switches.

Answer

The standby switch is forwarding all broadcast traffic due to a misconfigured STP root.

Answer

The standby switch is performing routing for all VLANs because the active switch failed.

Answer

The standby switch is processing VTP updates from the distribution layer.

Question 4

A network engineer is designing a WAN connection for a branch office that requires high availability and bandwidth aggregation. The branch has two internet connections from different ISPs. The engineer wants to use both links actively for load balancing and failover. Which design approach should be used?

Accepted Answer

Deploy SD-WAN to actively use both links with policy-based load balancing.. SD-WAN is the correct design because it natively supports active/active utilization of multiple WAN links with policy-based load balancing, allowing traffic to be distributed across both ISP connections based on application policies, SLA metrics, or other criteria. It also provides seamless failover by dynamically rerouting traffic if one link fails, meeting the requirements for high availability and bandwidth aggregation without relying on a single active link.

Answer

Configure static routes with different metrics for each link and use HSRP for failover.

Answer

Use BGP with both ISPs and rely on BGP best path selection for load balancing.

Answer

Implement a VPN tunnel between the branch and headquarters using only one link.

Question 5

A campus network uses a collapsed core design with two distribution switches and multiple access switches. The engineer wants to ensure that if one distribution switch fails, the access switches can still reach the core. The access switches are connected to both distribution switches. What additional configuration is required on the access switches?

Accepted Answer

Configure the access switches with VPC (Virtual Port Channel) to the distribution switches.. Option A is correct because VPC allows the access switches to form a single logical link to the pair of distribution switches, enabling active-active forwarding and seamless failover. If one distribution switch fails, the access switch continues to reach the core through the surviving distribution switch without requiring STP convergence or routing protocol changes.

Answer

Enable STP on the access switches and set the root bridge priority to 0.

Answer

Configure the access switches with HSRP to the distribution switches.

Answer

Use static routing with equal-cost paths from the access switches to the distribution switches.

Question 6

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Accepted Answer

Fabric Edge node. The Fabric Edge node is the correct answer because it is the SD-Access component that serves as the attachment point for both wired and wireless endpoints. In an SD-Access fabric, the Fabric Edge node terminates the VXLAN tunnels from the wireless LAN controller (WLC) and applies consistent policy (e.g., SGT-based ACLs) to traffic from both wired and wireless users, ensuring seamless integration of the existing wireless infrastructure.

Answer

Fabric Control node

Answer

Fabric Border node

Answer

Wireless LAN Controller (WLC)

Question 7

A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?

Accepted Answer

Tenant. In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.

Answer

VRF

Answer

Bridge Domain

Answer

Contract

Question 8

A company is deploying a new branch office with 50 users. The branch needs to connect to the headquarters via a WAN link. The engineer wants to use a design that minimizes the need for routing protocol configuration at the branch while still providing redundancy. Which design is most appropriate?

Accepted Answer

Use a hub-and-spoke design with static routes on the branch router and a single WAN link.. Option A is correct because a hub-and-spoke design with static routes on the branch router minimizes routing protocol configuration (no dynamic routing protocol needed) while still providing redundancy if the single WAN link is backed by a secondary path (e.g., a backup link or dual-homed connection) that can be handled via floating static routes. This approach keeps the branch router simple and avoids the complexity of running OSPF or BGP, which is unnecessary for a small branch with 50 users.

Answer

Use a full mesh design with OSPF on all routers.

Answer

Use a point-to-point design with BGP on the branch router.

Answer

Use a spine-leaf design with multiple WAN links.

Question 9

An enterprise network uses OSPF in the core and EIGRP in the campus distribution layer. The engineer needs to redistribute routes between the two protocols. Which design consideration is most important to prevent routing loops?

Accepted Answer

Set appropriate administrative distance values for redistributed routes.. Setting appropriate administrative distance values for redistributed routes is crucial to prevent routing loops when redistributing between OSPF and EIGRP. By default, EIGRP has an administrative distance of 170 for external routes and 90 for internal routes, while OSPF uses 110. If redistributed routes are not assigned a higher administrative distance, a router might prefer a redistributed route over a directly learned route, creating a feedback loop where routes are re-injected into the original protocol. Adjusting the administrative distance ensures that redistributed routes are less preferred than native routes, breaking the loop.

Answer

Use route maps to filter all redistributed routes.

Answer

Enable OSPF on all EIGRP interfaces.

Answer

Use a single routing protocol throughout the network.

Question 10

An architect is designing an SD-Access fabric for a campus network that must support dynamic endpoint grouping based on user identity and device type. The design must minimize manual policy configuration and allow the fabric to enforce access policies at the edge. Which combination of components and protocols is required to meet these requirements?

Accepted Answer

Cisco ISE for policy management, LISP for control plane, VXLAN for data plane, and Cisco TrustSec for SGT-based enforcement. Option A is correct because SD-Access uses Cisco ISE as the policy engine to define user/device-based policies, LISP as the control plane for endpoint-to-location mapping and mobility, VXLAN as the data plane for overlay encapsulation, and Cisco TrustSec for SGT-based enforcement at the edge. This combination enables dynamic endpoint grouping without manual ACLs, as SGTs are propagated via VXLAN Group Policy Option (GPO) and enforced by the fabric edge switches.

Answer

Cisco ISE for policy management, OSPF for control plane, GRE for data plane, and ACLs for enforcement

Answer

Cisco ISE for policy management, BGP for control plane, MPLS for data plane, and VLANs for enforcement

Answer

Cisco ISE for policy management, LISP for data plane, VXLAN for control plane, and 802.1X for enforcement

Question 11

A network team is designing an SD-WAN overlay for a multinational enterprise with 500+ branch sites. The design must ensure that control plane traffic (e.g., OMP updates) is encrypted and authenticated between all vSmart controllers and vEdge routers, while allowing data plane traffic to use IPsec tunnels between branch sites directly. Which architectural element is responsible for orchestrating the initial authentication and certificate enrollment of all SD-WAN devices?

Accepted Answer

vBond. C is correct because the vBond orchestrator is the sole component responsible for initial authentication and certificate enrollment in Cisco SD-WAN. It acts as a trusted certificate authority (CA) proxy, validating the serial numbers and certificates of all vSmart controllers and vEdge routers before they join the overlay network. Without vBond, devices cannot establish trust or receive the authorized list of vSmart and vManage IP addresses.

Answer

vManage

Answer

vSmart

Answer

vEdge

Question 12

An enterprise is redesigning its WAN QoS architecture to support real-time voice, video, and critical data applications over a limited bandwidth link. The architect must ensure that voice traffic receives strict priority queuing and that video traffic is guaranteed a minimum bandwidth, while allowing best-effort traffic to use remaining capacity. Which queuing strategy should be deployed on the WAN edge routers?

Accepted Answer

LLQ (Low Latency Queuing) with a strict priority queue for voice and CBWFQ for video and data. LLQ combines a strict priority queue for delay-sensitive voice traffic with CBWFQ for other classes, guaranteeing minimum bandwidth for video while allowing best-effort traffic to share remaining capacity. This satisfies the requirement for strict priority queuing for voice and bandwidth guarantees for video, which CBWFQ alone cannot provide because it lacks a priority queue.

Answer

FIFO (First In, First Out) with tail drop

Answer

CBWFQ (Class-Based Weighted Fair Queuing) without a priority queue

Answer

WRED (Weighted Random Early Detection) with DSCP-based drop probabilities

Question 13

A service provider is deploying NFV to host virtual network functions (VNFs) such as firewalls, routers, and WAN optimizers on a single server. The design must support service chaining, where traffic flows through multiple VNFs in a specific order, and must allow dynamic insertion of new VNFs without re-cabling. Which technology should be used to implement the service chain?

Accepted Answer

VXLAN overlay with policy-based forwarding to direct traffic through VNFs. VXLAN overlay with policy-based forwarding (PBF) is the correct choice because it enables service chaining by encapsulating traffic and steering it through a sequence of VNFs based on policies, without requiring physical re-cabling. This allows dynamic insertion of new VNFs by simply updating the forwarding policies in the overlay, which is essential for NFV environments where VNFs are hosted on the same server and must be chained flexibly.

Answer

VLAN trunking between VNFs on the same hypervisor

Answer

Static routing between VNFs using dedicated interfaces

Answer

MPLS L3VPN between VNFs

Question 14

A data center architect is designing a virtualized environment to host critical applications. The design must maximize performance by allowing virtual machines (VMs) to directly access physical CPU cores and memory without hypervisor overhead for latency-sensitive workloads. Which hypervisor configuration should be used?

Accepted Answer

Configure NUMA pinning and CPU pinning for each VM to dedicated cores and memory nodes. Option C is correct because CPU pinning and NUMA pinning allow virtual machines to directly access dedicated physical CPU cores and memory nodes, eliminating hypervisor scheduling overhead and ensuring low-latency access to local memory. This configuration is essential for latency-sensitive workloads in a virtualized data center, as it provides near-bare-metal performance by avoiding resource contention and cross-NUMA memory access penalties.

Answer

Enable hyper-threading and overcommit CPU resources

Answer

Use a Type 2 hypervisor (e.g., VMware Workstation) for better isolation

Answer

Enable memory ballooning to reclaim unused memory from VMs

Question 15

A network architect is designing a campus network for a large university with 10,000+ users. The design must provide high availability, minimize failure domains, and allow for easy scaling of the access layer. The core layer should be resilient and support fast convergence. Which hierarchical design model best meets these requirements?

Accepted Answer

Three-tier hierarchical design with access, distribution, and core layers, using redundant links and VRRP for gateway redundancy. The three-tier hierarchical design (access, distribution, core) is the correct choice because it provides clear separation of failure domains, allows easy scaling by adding access switches, and supports high availability through redundant links and VRRP (or HSRP/GLBP) for first-hop gateway redundancy. The core layer can be designed with fast-converging protocols like ECMP and BFD to meet the resilience and convergence requirements for a large campus with 10,000+ users.

Answer

Collapsed core design with core and distribution combined into one layer

Answer

Flat Layer 2 design with all switches in a single VLAN

Answer

Leaf-spine design with all switches acting as leafs and spines

Question 16

An enterprise is deploying Cisco SD-WAN and must ensure that data plane traffic between branch sites is encrypted and authenticated. The design must also allow the use of application-aware routing to steer traffic based on real-time performance metrics. Which component is responsible for establishing and managing the IPsec tunnels between branch routers?

Accepted Answer

vEdge/cEdge routers. The vEdge/cEdge routers are the correct answer because they are the SD-WAN edge devices that terminate IPsec tunnels for data plane traffic. In Cisco SD-WAN, the data plane is fully distributed: each vEdge or cEdge router establishes and manages its own IPsec tunnels (using DTLS/TLS for control and IPsec for data) directly with other branch routers. This allows the routers to apply application-aware routing by monitoring real-time performance metrics (e.g., loss, latency, jitter) and steering traffic across the encrypted tunnels accordingly.

Answer

vSmart controllers

Answer

vManage

Answer

vBond

Question 17

A network architect is designing QoS for a converged network carrying voice, video, and data. The design must use the DiffServ model and ensure that voice traffic is marked with the highest priority and that video traffic is marked with a lower priority but still above data. Which DSCP markings should be assigned to voice and video traffic, respectively, to comply with the standard Per-Hop Behavior (PHB) definitions?

Accepted Answer

Voice: DSCP 46 (EF); Video: DSCP 34 (AF41). Option A is correct because the DiffServ model defines specific Per-Hop Behaviors (PHBs) for different traffic types. Voice traffic requires low latency, jitter, and loss, which is best served by the Expedited Forwarding (EF) PHB, assigned DSCP 46. Video traffic, while still delay-sensitive, can tolerate some loss and is typically marked with Assured Forwarding (AF41, DSCP 34), which provides a lower priority queue than EF but higher than best-effort data.

Answer

Voice: DSCP 56 (CS7); Video: DSCP 48 (CS6)

Answer

Voice: DSCP 40 (AF41); Video: DSCP 46 (EF)

Answer

Voice: DSCP 26 (AF31); Video: DSCP 18 (AF21)

Question 18

An enterprise is migrating its data center to a leaf-spine architecture to support high east-west traffic between servers. The design must provide non-blocking forwarding and allow for easy scaling by adding more spines. Which characteristic is essential for the spine switches in this design?

Accepted Answer

Spine switches must support high port density and high forwarding capacity, and act as Layer 3 routers. In a leaf-spine architecture designed for non-blocking forwarding and high east-west traffic, spine switches must act as Layer 3 routers with high port density and forwarding capacity. This allows them to perform Equal-Cost Multi-Path (ECMP) routing, which distributes traffic across all available uplinks without blocking, ensuring that any leaf can reach any other leaf with predictable latency and full bandwidth utilization.

Answer

Spine switches must run Spanning Tree Protocol (STP) to prevent loops

Answer

Spine switches must be connected to each other to provide redundancy

Answer

Spine switches must perform NAT to translate between VLANs

Question 19

Examine the following configuration snippet:
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
 ip ospf dead-interval 40
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF adjacency will form with a neighbor using hello/dead intervals of 10/40 seconds.. The configuration sets the OSPF network type to point-to-point on the interface, which allows OSPF to form an adjacency with a neighbor using the configured hello interval of 10 seconds and dead interval of 40 seconds. These intervals are valid for point-to-point networks, and the network command under router ospf correctly enables OSPF on the interface. Therefore, an adjacency will form as long as the neighbor's intervals match.

Answer

OSPF adjacency will not form because the hello interval is too low for point-to-point.

Answer

The network command under router ospf will be ignored because the interface has an explicit network type.

Answer

OSPF will use the default broadcast network type because the point-to-point keyword is misspelled.

Question 20

Consider this configuration:
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,20,30
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0

Which statement is true about this configuration?

Accepted Answer

The trunk will only allow VLANs 10, 20, and 30, and VLAN 10 is the native VLAN.. Option B is correct because the configuration explicitly permits VLANs 10, 20, and 30 on the trunk using the 'switchport trunk allowed vlan' command, and VLAN 10 is set as the native VLAN with the 'switchport trunk native vlan 10' command. The native VLAN carries untagged traffic on the trunk, but it is still a valid VLAN that can be included in the allowed list and can have an SVI for routing. The SVI for VLAN 10 will come up as long as the VLAN exists and there is at least one active switchport in that VLAN, which is satisfied by the trunk port.

Answer

The native VLAN 10 cannot be used as a routed interface because it is the native VLAN.

Answer

The SVI for VLAN 10 will not come up because the native VLAN must be untagged.

Answer

The configuration is invalid because the native VLAN must be the same as the management VLAN.