350-401 Hard Questions — 25 Difficult Questions

Question 1

A network engineer runs the following command on Switch SW5:

SW5# show monitor session 5
Session 5
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi1/0/1-3
Destination Ports     : Gi1/0/24
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.. The output shows a Remote Source SPAN (RSPAN) session. The 'Type: Remote Source Session' indicates that traffic from source ports Gi1/0/1-3 is mirrored and sent to a remote VLAN (the RSPAN VLAN) via the destination port Gi1/0/24, which acts as a reflector port. The 'Encapsulation: Replicate' means the destination port replicates the original frames without adding an extra VLAN tag, forwarding them onto the RSPAN VLAN for transport to a remote switch.

Answer

This is a local SPAN session that sends traffic to Gi1/0/24.

Answer

The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.

Answer

Only egress traffic from Gi1/0/1-3 is captured.

Question 2

A network engineer is troubleshooting an STP issue in a network that uses Rapid PVST+. The network has a root bridge (SW1) and a secondary root bridge (SW2). The engineer notices that after a link failure between SW1 and SW2, the network takes longer than expected to converge. The engineer checks the configuration and finds that SW2 has the 'spanning-tree uplinkfast' command enabled. The engineer also notices that SW2 has a lower priority than SW1. What is the most likely cause of the slow convergence?

Accepted Answer

UplinkFast is enabled, which is incompatible with Rapid PVST+ and causes the switch to use legacy STP convergence.. UplinkFast is a legacy STP feature that is incompatible with Rapid PVST+. When enabled on a switch running Rapid PVST+, it forces the switch to revert to 802.1D STP convergence behavior on the affected ports, disabling the rapid transition mechanisms (such as proposal/agreement and sync). This causes the network to take longer to converge after a link failure, as the switch falls back to the slower listening and learning states.

Answer

SW2 has a lower priority than SW1, so it takes longer to become the root bridge after failure.

Answer

BPDU Guard is enabled on the uplink ports, which prevents BPDU exchange.

Answer

Loop Guard is enabled on the uplink ports, which delays port transition.

Question 3

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

Accepted Answer

The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 '.. The engineer's configuration includes both 'ip default-network 0.0.0.0' (which is an IGRP command, not EIGRP) and redistribution of a static default route. The appearance of the default route in the EIGRP topology table with metric 1 indicates that redistribution occurred, but the route is not being advertised to internal routers. The most likely reason is that the static default route itself is not correctly configured. For EIGRP redistribution to succeed, the static route must point to a valid next-hop IP address using the syntax 'ip route 0.0.0.0 0.0.0.0 '. If the engineer used an interface instead of a next-hop, or the next-hop is unreachable, the static route may be invalid or not installed in the routing table, preventing its advertisement to EIGRP neighbors.

Answer

The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.

Answer

The internal routers have a route to the default network with a better metric from another source.

Answer

The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.

Question 4

Which three statements about Cisco SD-Access policy enforcement are true? (Choose three.)

Accepted Answer

Scalable Group Tags (SGTs) are used to enforce micro-segmentation and policy in the fabric.. Option A is correct because Scalable Group Tags (SGTs) are the fundamental mechanism for micro-segmentation in Cisco SD-Access, allowing group-based policy enforcement rather than traditional IP-based ACLs. Option D is correct because Cisco Identity Services Engine (ISE) serves as the policy plane in SD-Access, defining and managing group-based policies, SGT assignments, and TrustSec matrix rules. Option E is correct because the fabric edge node enforces policy by inspecting the SGT carried in the VXLAN-GPO header (Group Policy Option) of encapsulated traffic, applying the appropriate SGACL or contract. Option B is incorrect because SGTs can be assigned dynamically via ISE using 802.1X, MAC authentication bypass, or static mapping, not based on IP address alone. Option C is incorrect because policy enforcement in SD-Access occurs primarily at the fabric edge nodes (and fabric border for external traffic), not exclusively at the border node for all intra-fabric traffic.

Answer

SGTs are assigned to endpoints based on their IP address only.

Answer

The fabric border node enforces all policies for traffic within the fabric.

Question 5

Drag and drop each RESTCONF method on the left to its equivalent NETCONF operation on the right.

Accepted Answer

GET: get-config (retrieves data). Correct pairings: GET retrieves data (like get-config); POST creates a resource (like edit-config with operation create); PUT replaces a resource (like edit-config with operation replace); PATCH partially updates (like edit-config with operation merge); DELETE removes a resource (like edit-config with operation delete).

Question 6

A network engineer is deploying Cisco SD-Access in a large enterprise campus. The design requires that all user traffic be segmented by Virtual Network (VN) and that the fabric edge nodes perform SGT-based enforcement. The engineer notices that traffic between two endpoints in the same IP subnet but different VNs is being forwarded directly at the fabric edge without any SGT inspection. What is the most likely cause?

Accepted Answer

The endpoints are in the same IP subnet, so they must be in the same Virtual Network; SGT enforcement only applies to inter-VN traffic.. In Cisco SD-Access, Virtual Networks (VNs) provide Layer 3 segmentation. Traffic between endpoints in the same IP subnet but different VNs is inherently Layer 2 traffic and cannot be routed or inspected by SGT-based enforcement, which only applies to inter-VN (Layer 3) traffic. Since the endpoints are in the same subnet, the fabric edge node forwards the traffic at Layer 2 without SGT inspection, making option B correct.

Answer

The fabric edge nodes have not been configured with the proper SGT mappings.

Answer

The fabric edge nodes are operating in Layer 2 mode and do not support SGT enforcement.

Answer

The control plane node has not been configured with the correct IP-SGT mappings.

Question 7

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Accepted Answer

The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.. The RADIUS server is receiving authentication requests and sending 'Access-Reject' responses, but the WLC logs show 'RADIUS server not responding'. This indicates the WLC is not receiving the responses. The most likely cause is a source IP mismatch: the RADIUS server sends responses from a different IP address than the one configured on the WLC. The WLC drops these responses because they do not match the expected source IP, making it appear as if the server is not responding.

Answer

The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.

Answer

The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.

Answer

The WLC is not configured with a valid management interface IP address to reach the RADIUS server.

Question 8

An engineer configures IP SLA 100 to monitor the jitter and latency of a VoIP call path between two branch routers. The configuration uses UDP jitter with a target of 192.168.2.2 on port 16384. The engineer notices that the IP SLA operation shows 'State: Active' but no jitter or latency statistics are collected. The router is generating the probe packets, but the remote router does not respond. What is the most likely reason?

Accepted Answer

The remote router must have an IP SLA responder configured to process the UDP jitter probes.. For UDP jitter IP SLA operations to collect jitter and latency statistics, the remote router must be configured as an IP SLA responder. The responder processes the probe packets and sends back time-stamped responses, which are essential for calculating jitter and one-way delay. Without the responder, the source router can send probes (showing 'Active' state) but cannot compute meaningful statistics because it never receives the required response packets.

Answer

The IP SLA operation must be configured with a 'request-data-size' value to match the remote router's MTU.

Answer

The source router needs a 'frequency' setting that matches the remote router's response interval.

Answer

The firewall on the remote router is blocking the UDP port 16384, preventing the probe from reaching the target.

Question 9

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. RSPAN traffic is carried over an RSPAN VLAN that must be allowed on all trunk links between the source switches and the central switch. If the RSPAN VLAN (999) is not included in the allowed VLAN list on the trunk ports, the mirrored frames will be dropped, and the monitoring station will receive no traffic. This is the most likely missing configuration because the engineer verified the VLAN is active and the destination session is set, but did not check the trunk pruning.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.

Question 10

A network engineer is deploying Cisco ACI in a data center to automate tenant network provisioning. The engineer needs to ensure that the ACI fabric can integrate with an existing VMware vSphere environment using the Cisco Application Virtual Switch (AVS). Which two components are required to enable this integration? (Choose two.)

Accepted Answer

Cisco APIC controller. Integrating Cisco ACI with VMware vSphere using Cisco AVS requires the Cisco APIC controller and VMware vCenter Server. The APIC manages the ACI fabric and communicates with the AVS via OpFlex to enforce network policies. vCenter is needed to deploy and manage the AVS and to coordinate virtual machine networking. Other options like Nexus 1000V, DCNM, and UCS Manager are not required for this specific integration.

Answer

Cisco UCS Manager

Answer

Cisco DCNM

Answer

Cisco Nexus 1000V

Question 11

A network engineer is troubleshooting a Cisco IOS-XE router that supports VRF-Lite. Interfaces Gi0/1 and Gi0/2 are assigned to VRF CUSTOMER_A, while Gi0/3 remains in the global routing table. A static route for 192.168.50.0/24 is configured inside VRF CUSTOMER_A, but traffic sourced from the global table cannot reach that prefix. What is the most likely cause?

Accepted Answer

The static route must be redistributed into the global table because VRFs cannot be reached without route leaking.. VRF-Lite isolates routing and forwarding tables, so a prefix known only inside VRF CUSTOMER_A cannot be reached from the global table without an explicit leak. IOS-XE supports leaks through static routes that reference the global table, or by configuring a matching return route in the global table pointing at the VRF interface. Redistribution alone does not merge VRF and global tables; a deliberate route-leaking construct is required for the two contexts to exchange reachability.

Answer

The static route must be configured on the global table using a next-hop inside VRF CUSTOMER_A, because IOS-XE forbids static routes within VRFs.

Answer

The interfaces Gi0/1 and Gi0/2 need `ip vrf forwarding CUSTOMER_A` removed so all interfaces share the global table.

Answer

A route distinguisher must be configured on VRF CUSTOMER_A before any static route becomes usable.

Question 12

Which three statements about Cisco DNA Center Assurance are true? (Choose three.)

Accepted Answer

Cisco DNA Center Assurance uses NetFlow, SNMP, and syslog data to analyze network performance and client experience.. Option A is correct because Cisco DNA Center Assurance aggregates telemetry from multiple sources—NetFlow for flow-level traffic analysis, SNMP for device health and interface statistics, and syslog for event and fault data—to build a holistic view of network and client performance. Option B is correct because Assurance computes a per-client health score derived from metrics such as RSSI/signal strength, latency, packet loss, and onboarding/connectivity success, giving a quantifiable measure of client experience. Option C is correct because Assurance applies machine learning and baselining to detect anomalies (e.g., deviations from normal behavior) and to surface predictive insights about potential network issues before they impact users. Option D is not correct because Assurance does not capture and analyze full packet captures in real time for every flow; it relies primarily on summarized telemetry (NetFlow, SNMP, syslog) rather than universal full-packet capture. Option E is not correct because Assurance provides visibility into both wired and wireless clients, including wireless-specific metrics like signal strength, roaming, and onboarding, so it is not limited to wired clients.

Answer

Cisco DNA Center Assurance can capture and analyze full packet captures in real time for every flow.

Answer

Cisco DNA Center Assurance only monitors wired clients and does not provide visibility into wireless client performance.

Question 13

Which three statements about RADIUS and TACACS+ are true? (Choose three.)

Accepted Answer

TACACS+ encrypts the entire packet body, whereas RADIUS only encrypts the password.. Option A is correct because TACACS+ encrypts the entire body of the packet, while RADIUS encrypts only the password field (using MD5 with the shared secret) and leaves other attributes such as username and accounting data in cleartext. Option C is correct because RADIUS combines authentication and authorization into a single request/response exchange, whereas TACACS+ performs authentication, authorization, and accounting as separate functions that can be handled independently. Option E is correct because RADIUS uses UDP (ports 1812/1813, or legacy 1645/1646) as its transport, while TACACS+ uses TCP port 49 for reliable delivery. Option B is incorrect because it reverses the transports: RADIUS uses UDP, not TCP, and TACACS+ uses TCP, not UDP. Option D is incorrect because it reverses the encryption behavior: TACACS+ encrypts the whole packet body, not just the password, and RADIUS is the protocol that encrypts only the password.

Answer

RADIUS uses TCP for reliable transport, while TACACS+ uses UDP.

Answer

TACACS+ encrypts only the password in the packet, similar to RADIUS.

Question 14

A network engineer is using Ansible to push ACL changes to a group of Cisco IOS routers. The playbook uses the ios_acl_interfaces module to bind ACLs to interfaces. After running the playbook, the engineer notices that some routers have the ACL applied inbound instead of outbound as intended. The playbook specifies 'direction: outbound'. What is the most likely cause of this issue?

Accepted Answer

The playbook uses 'direction: outbound' but the module expects 'direction: out'.. The ios_acl_interfaces module in Ansible expects the direction parameter to be specified as 'in' or 'out', not 'outbound'. When 'direction: outbound' is used, the module either ignores the value or defaults to 'in', causing the ACL to be applied inbound instead of outbound. This is a common parameter naming mismatch between the Ansible module and the engineer's expectation.

Answer

The routers have a different IOS version that interprets 'outbound' as 'in'.

Answer

The engineer forgot to include the 'state: present' parameter, so the module did not apply the ACL.

Answer

The ACL itself is defined with the wrong direction in the playbook.

Question 15

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Accepted Answer

Fabric Edge node. The Fabric Edge node is the correct answer because it is the SD-Access component that serves as the attachment point for both wired and wireless endpoints. In an SD-Access fabric, the Fabric Edge node terminates the VXLAN tunnels from the wireless LAN controller (WLC) and applies consistent policy (e.g., SGT-based ACLs) to traffic from both wired and wireless users, ensuring seamless integration of the existing wireless infrastructure.

Answer

Fabric Control node

Answer

Fabric Border node

Answer

Wireless LAN Controller (WLC)

Question 16

An engineer configures IP SLA 30 to monitor the one-way delay to a remote site using UDP jitter. The operation is used to adjust routing metrics via route maps. The engineer notices that the IP SLA operation shows 'State: Active' but the one-way delay values are inconsistent, sometimes showing negative values. What is the most likely cause?

Accepted Answer

The source and destination routers do not have synchronized clocks via NTP, causing one-way delay calculations to be inaccurate.. IP SLA UDP jitter measures one-way delay by timestamping packets at both the source and destination. If the clocks on the two routers are not synchronized via NTP, the timestamps will be offset, leading to inaccurate (and sometimes negative) one-way delay values. Negative delay occurs when the destination timestamp appears earlier than the source timestamp due to clock skew.

Answer

The IP SLA operation is not configured with a 'request-data-size' that matches the remote router's MTU, causing fragmentation and delay variations.

Answer

The IP SLA operation is using a 'frequency' that is too high, causing the probes to overlap and corrupt the statistics.

Answer

The remote router's IP SLA responder is not configured, so the source is using a different method to estimate delay.

Question 17

Which three statements about virtual machine (VM) resource allocation and overcommitment are true? (Choose three.)

Accepted Answer

Memory overcommitment allows a hypervisor to run VMs with total allocated memory exceeding physical RAM.. Option A is correct because memory overcommitment lets a hypervisor assign more total guest RAM than the host physically has, relying on techniques like ballooning, transparent page sharing, and swapping to reclaim memory on demand. Option B is correct because CPU overcommitment means more virtual CPUs are assigned than physical cores exist, so contention forces the scheduler to queue vCPUs, causing ready time and latency that degrade performance under heavy load. Option D is correct because thin-provisioned storage overcommitment presents more logical capacity than is physically available, and when the datastore actually fills, writes fail or slow dramatically as the array struggles to allocate blocks. Option C is wrong because overcommitment inherently introduces contention and does not guarantee dedicated, interference-free resources. Option E is wrong because overcommitment applies to memory, CPU, and storage, as demonstrated by the other correct options.

Answer

Overcommitment guarantees that each VM receives its allocated resources without interference.

Answer

Resource overcommitment is only applicable to memory, not CPU or storage.

Question 18

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to model both configuration and operational state data.. Option A is correct because YANG (RFC 7950) is a data modeling language that describes both configuration data (writable, e.g., under the 'config true' default) and operational state data (read-only, marked 'config false'), which is why models like ietf-interfaces contain both types. Option B is correct because YANG provides the 'augment' statement, which allows a module to add additional nodes (e.g., extra leaves or containers) to an existing module's data tree, enabling extensibility without modifying the original model. Option E is correct because YANG itself only defines the model/schema; the actual data instances are encoded in formats such as XML (RFC 7950) or JSON (RFC 7951), with protocol operations like NETCONF using XML and RESTCONF supporting both XML and JSON. Option C is not correct because YANG does not define any transport protocol; protocols such as NETCONF (RFC 6241), RESTCONF (RFC 8040), or gNMI handle transport and data exchange. Option D is not correct because the 'leaf' statement defines a single scalar node with a type, not a list of key-value pairs; keyed collections of entries are defined with the 'list' statement, where 'key' identifies the key leaf(s).

Answer

YANG defines the transport protocol for data exchange.

Answer

The 'leaf' statement in YANG defines a list of key-value pairs.

Question 19

A network engineer is implementing Cisco ACI in a data center. The design requires that an endpoint be reachable across multiple leaf switches while maintaining a consistent policy, and that a Layer 2 bridge domain extend to a remote site over an L3Out. Which two ACI constructs are required to meet these goals? (Choose two.)

Accepted Answer

A VXLAN network identifier (VNI) mapped to an EPG to define the Layer 2 overlay segment.. ACI stretches a Layer 2 segment by mapping an EPG to a VNI, which identifies the overlay across leaf switches. The tenant's VRF provides the isolated routing context required for the bridge domain and for the L3Out that connects to the remote site. Contracts, SPAN, and the L3Out itself address policy, monitoring, or external peering rather than the overlay segment identity and routing isolation needed here.

Answer

An L3Out configured on a leaf switch to peer with the remote site's router.

Answer

A contract applied between EPGs to permit the required traffic flows.

Answer

A fabric-wide SPAN session that mirrors all endpoint traffic to an external analyzer.

Question 20

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Accepted Answer

Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.. Flexible NetFlow allows you to define a custom flow record that includes key fields such as 'match ipv4 vrf' (VRF-aware NetFlow) to uniquely identify each customer's traffic. By applying a single flow monitor on a shared interface (e.g., a trunk or core link), the router can tag flows with the VRF or VLAN identifier, ensuring per-customer separation without needing multiple monitors or collectors. This approach is efficient and leverages the router's ability to export differentiated flow records to a single collector, which can then filter based on the VRF or VLAN field.

Answer

Configure a separate flow monitor for each customer interface and export to different collectors.

Answer

Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.

Answer

Enable SNMP interface polling to track per-customer traffic statistics.