350-401 Exam Simulation — 100 Questions

Question 1

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Question 2

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Question 3

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Question 4

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Question 5

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Question 6

Drag and drop the steps for the Spanning Tree Protocol (STP) convergence process in the correct order.

Question 7

A network engineer is automating configuration backups using Ansible. The playbook uses the ios_config module to retrieve running configurations from Cisco IOS XE devices. However, the playbook fails with a timeout error on a specific device. Other devices respond correctly. What is the most likely cause of the failure?

Accepted Answer

The device has incorrect SSH credentials configured in the Ansible vault.. The ios_config module in Ansible uses SSH to connect to Cisco IOS XE devices and execute commands. A timeout error on a specific device while others succeed strongly indicates an authentication or authorization failure, such as incorrect SSH credentials stored in the Ansible vault. This prevents the SSH session from being established, causing the playbook to wait until the timeout threshold is reached.

Answer

The device is configured for HTTP/HTTPS access only.

Answer

The device has NetFlow enabled, consuming CPU cycles.

Answer

The device has SNMPv3 enabled with authentication traps.

Question 8

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Accepted Answer

Increase the delay on GigabitEthernet0/0.. The EIGRP metric is calculated using the formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * 256, with default K values (K1=1, K3=1, others=0). Increasing the delay on the outgoing interface (GigabitEthernet0/0) directly increases the delay component in the composite metric, causing the overall metric to increase. Option D is correct because delay is a key variable in the EIGRP metric calculation.

Answer

Increase the bandwidth on GigabitEthernet0/0.

Answer

Add a redistribute static command under EIGRP.

Answer

Change the administrative distance to 90.

Question 9

Which TWO statements about virtual switching in a hypervisor environment are correct?

Accepted Answer

A virtual switch can be connected to a physical network through uplink ports.. A virtual switch connects to the physical network through uplink ports, which are typically mapped to physical NICs on the hypervisor host. This allows VMs on the virtual switch to communicate with external networks, making option A correct.

Answer

A virtual switch does not support VLAN tagging.

Answer

A virtual switch performs routing between different subnets.

Answer

A virtual switch is a physical device installed in the hypervisor host.

Question 10

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Accepted Answer

Security Group Access Control Lists (SGACLs). Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

Answer

Change of Authorization (CoA)

Answer

802.1X authentication

Answer

MACsec encryption

Question 11

Which TWO characteristics are true about the operation of Rapid PVST+? (Choose two.)

Accepted Answer

It supports PortFast to enable immediate transition to forwarding.. Option C is correct because Rapid PVST+ supports the PortFast feature, which allows a switch port configured as an access port to transition immediately from the blocking state to the forwarding state, bypassing the listening and learning states. This is essential for ports connected to end hosts to avoid unnecessary STP convergence delays.

Answer

It runs a single spanning-tree instance for all VLANs.

Answer

It eliminates the need for BPDUs.

Answer

It uses a separate root bridge per VLAN.

Question 12

Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?

Accepted Answer

It uses streaming telemetry to collect data for real-time analytics.. Option A is correct because Cisco DNA Center uses model-driven telemetry (e.g., gRPC, NETCONF/YANG, or UDP-based push) to stream real-time data from network devices, enabling sub-second analytics and faster troubleshooting compared to traditional polling methods like SNMP.

Answer

It supports only wired networks and not wireless.

Answer

It is a fully cloud-based solution with no on-premises components.

Answer

It only displays network device health scores and does not provide path tracing.

Question 13

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Accepted Answer

CUSTOMER-A. The packet arrives on interface Gi0/1/0, which is configured under VRF CUSTOMER-A (as shown in the exhibit with 'ip vrf forwarding CUSTOMER-A'). When a VRF is applied to an ingress interface, the router uses that VRF's routing table (not the global table) to perform the destination IP lookup. Therefore, the packet with destination 10.1.1.2 is routed using the CUSTOMER-A VRF.

Answer

Global routing table

Answer

Mgmt-intf

Answer

CUSTOMER-B

Question 14

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

Accepted Answer

OSPF E2 routes do not factor interface cost; but the router uses the interface cost as a tie-breaker for equal-cost routes.. OSPF E2 routes do not include the internal cost to the ASBR; the cost shown in the routing table is the external metric only. When two E2 routes have the same external metric, Cisco IOS uses the interface cost as a tie-breaker to select the best next hop. In this scenario, the interface to 10.0.1.2 has a lower cost than the interface to 10.0.2.2, so all traffic is forwarded via 10.0.1.2.

Answer

One route has a higher administrative distance.

Answer

A default route is overriding the specific route.

Answer

The route via 10.0.2.2 is an E1 route.

Question 15

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

Accepted Answer

Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.. Option C is correct because Auto QoS for VoIP automatically configures the necessary class maps, policy maps, and trust settings to properly classify and queue voice traffic (CoS 5) while ensuring data traffic is not starved. The default QoS configuration trusts CoS at the port level, but without proper queuing and scheduling, voice and data may compete for buffers, causing intermittent slow file transfers. Auto QoS sets up strict priority queuing for voice and allocates bandwidth for data, resolving the performance issue without manual misconfiguration.

Answer

Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.

Answer

Disable QoS entirely on all switches to eliminate any potential QoS-related drops.

Answer

Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.

Question 16

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Accepted Answer

BGP sessions may flap due to dropped keepalives.. The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.

Answer

Data plane traffic will be dropped.

Answer

Only SSH sessions will be rate-limited.

Answer

SNMP and SSH will be unaffected because they are explicitly permitted.

Question 17

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Accepted Answer

Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.. The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.

Answer

Manually shut down the access ports that have unknown MAC addresses in the binding table.

Answer

Disable Dynamic ARP Inspection on VLAN 10.

Answer

Disable IP Source Guard on all access ports in VLAN 10.

Question 18

Which TWO statements are true about RESTCONF and NETCONF in a Cisco IOS XE environment? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods (GET, POST, PUT, DELETE) and supports JSON and XML encoding.. Option A is correct because RESTCONF is designed to use standard HTTP methods (GET, POST, PUT, DELETE, PATCH) for CRUD operations on YANG-defined data, and it supports both JSON and XML encoding formats. This aligns with its goal of providing a simpler, web-friendly interface compared to NETCONF.

Answer

RESTCONF supports the candidate datastore for editing configurations.

Answer

NETCONF uses HTTP as its transport protocol.

Answer

RESTCONF and NETCONF both support JSON and XML encoding.

Question 19

Refer to the exhibit. A network engineer sends a RESTCONF PATCH request with the above JSON payload to the URL https://192.168.1.100/restconf/data/ietf-interfaces:interface=GigabitEthernet0/0/0. What is the expected outcome?

Accepted Answer

The description and IP address of the existing interface are updated, and the interface remains enabled.. A RESTCONF PATCH request uses the HTTP PATCH method to apply a partial update to an existing resource. The payload contains only the fields to be modified (description and IP address), and the request URL targets the specific interface resource. Since the interface already exists, the PATCH updates only those fields without affecting other configuration, such as the interface's enabled state. This is why the interface remains enabled and only the description and IP address are updated.

Answer

A new interface GigabitEthernet0/0/0 is created with the specified IP address.

Answer

The request fails because a GET request must be sent first to retrieve the current configuration.

Answer

The entire interface configuration is replaced with only the fields in the payload.

Question 20

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

Accepted Answer

Deploy two core switches configured with VSS or StackWise.. Option B is correct because deploying two core switches with VSS (Virtual Switching System) or StackWise provides both redundancy and active-active load balancing at the core layer. VSS virtualizes two physical switches into a single logical switch, eliminating the need for Spanning Tree Protocol (STP) on inter-switch links and enabling sub-second failover. This design ensures high availability by removing single points of failure and maximizing throughput between distribution and core layers.

Answer

Use a single distribution switch to simplify management.

Answer

Configure the core layer for Layer 2 switching only.

Answer

Use spanning-tree PortFast on all core switch ports.