350-401 Infrastructure Practice Test 10 — 15 Questions

Question 1

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, authenticated users remain connected and new users are placed in a restricted VLAN. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inaccessible Authentication Bypass. Inaccessible Authentication Bypass (IAB) is the feature that allows authenticated users to stay connected and new users to be placed in a restricted VLAN when the authentication server is unreachable. This ensures minimal disruption during an outage. The other features serve different purposes: Critical VLAN moves all users to a VLAN, Guest VLAN is for non-supplicant devices, and MAB is for devices without 802.1X support.

Answer

Guest VLAN

Answer

Critical VLAN

Answer

MAC Authentication Bypass

Question 2

An engineer is configuring a Cisco IOS router to manage the device securely. The requirement is to allow SNMP read-only access using SNMPv3 with authentication and privacy, and to restrict access to the SNMP group 'NMS' with security level 'authPriv'. Which command set correctly creates the SNMPv3 user and group?

Accepted Answer

snmp-server user admin NMS v3 auth sha AuthPass123 priv aes 128 PrivPass123. The correct command must create an SNMPv3 user with a group name, authentication protocol (SHA), and privacy protocol (AES). Only one option includes both auth and priv with AES. The other options either create only a group, use DES, or omit privacy entirely. The correct syntax ensures the user can authenticate and encrypt SNMP messages as required.

Answer

snmp-server user admin NMS v3 auth sha AuthPass123 priv des PrivPass123

Answer

snmp-server group NMS v3 authPriv access 1

Answer

snmp-server user admin NMS v3 auth md5 AuthPass123

Question 3

A network engineer is deploying a new Cisco Catalyst switch and needs to configure the interface connecting to a server to support EtherChannel. The server NIC teaming supports LACP. Which two commands are required on the switch interface to correctly configure LACP EtherChannel? (Choose two.)

Accepted Answer

channel-protocol lacp. To configure LACP EtherChannel on a Cisco switch interface, you must assign the interface to a channel group with a mode that uses LACP (active or passive) and specify the channel protocol as LACP. The channel-group 1 mode active command enables active LACP negotiation, and the channel-protocol lacp command ensures LACP is used. Together, these two commands are required for the configuration.

Answer

lacp system-priority 100

Answer

switchport mode trunk

Answer

channel-group 1 mode desirable

Question 4

A network engineer is deploying a VXLAN EVPN fabric. The engineer needs to ensure that the underlay network provides redundant paths and fast convergence for the VXLAN tunnels. Which routing protocol is recommended for the underlay in a Cisco VXLAN EVPN fabric?

Accepted Answer

IS-IS with point-to-point links. IS-IS is the recommended routing protocol for the underlay in a Cisco VXLAN EVPN fabric. It provides fast convergence, scalability, and supports point-to-point links, which are essential for a robust underlay. Cisco's validated designs for VXLAN EVPN often specify IS-IS for the underlay to ensure optimal performance and reliability.

Answer

EIGRP with stub routing

Answer

eBGP with a unique ASN per leaf

Answer

OSPFv2 with point-to-point links

Question 5

A network engineer configures VRRP group 10 on two distribution switches, DS1 and DS2, to provide a redundant default gateway for VLAN 20 (10.20.0.0/24). DS1 is configured with priority 150, and DS2 with the default priority. The engineer notices that DS2 is currently the master and is forwarding traffic for the virtual IP 10.20.0.1. Which command on DS2 will make DS1 the master without disrupting connectivity?

Accepted Answer

vrrp 10 priority 100. VRRP mastership is determined first by priority; the router with the highest priority becomes master. DS1 has priority 150, while DS2 uses the default priority of 100. However, DS2 is currently master, meaning preemption is likely disabled on DS1. Lowering DS2's priority to 100 ensures DS1 has a higher priority. Once preemption is enabled on DS1, DS1 will take over as master. The other commands either increase DS2's priority or do not affect the election.

Answer

vrrp 10 preempt

Answer

vrrp 10 priority 200

Answer

vrrp 10 track 1 decrement 20

Question 6

A network engineer is deploying a Cisco Catalyst switch stack of four members. The engineer wants to guarantee that if the current stack master fails, a specific member (switch 3, with priority 200) becomes the new active master, and that no other member can preempt it. Which command must be configured on switch 3?

Accepted Answer

switch 3 priority 200. To influence which stack member becomes the active master after a failure, the priority must be set using the 'switch priority ' command in global configuration mode. A higher priority value increases the chance of election. Configuring switch 3 with priority 200 ensures it is preferred over members with lower priorities, assuming no higher priority exists.

Answer

stack-mac persistent timer 0

Answer

switch 3 provision ws-c3850-48p

Answer

master election priority 200

Question 7

A network engineer is configuring a GRE tunnel between two Cisco IOS routers. The engineer wants to ensure that the tunnel can carry multicast traffic and that the tunnel interface is treated as a point-to-point link for routing protocols. Which two configuration commands are required on the tunnel interface? (Choose two.)

Accepted Answer

ip ospf network point-to-point. The two commands required are tunnel mode gre ip, which enables GRE encapsulation that supports multicast, and ip ospf network point-to-point, which ensures OSPF treats the tunnel as a point-to-point link. The tunnel destination and IP address are necessary for basic tunnel operation but do not specifically address multicast transport or point-to-point treatment. PIM is not required on the tunnel interface just to carry multicast.

Answer

tunnel destination <remote-ip>

Answer

ip address <local-ip> <mask>

Answer

ip pim sparse-mode

Question 8

A network administrator is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The administrator wants to ensure that only routers with the correct key can form adjacencies. Which command is required to enable MD5 authentication on an interface?

Accepted Answer

ip ospf authentication message-digest. The interface-level command ip ospf authentication message-digest enables MD5 authentication for OSPF on that specific interface. It is necessary to activate MD5 authentication, while the key is configured separately. This ensures that only routers with the correct key can form adjacencies, as required.

Answer

ip ospf authentication-key cisco

Answer

ip ospf message-digest-key 1 md5 cisco

Answer

area 0 authentication message-digest

Question 9

A network engineer is configuring a Cisco Catalyst switch stack of four members. The engineer wants to ensure that if the active switch fails, the standby switch takes over immediately without requiring a full election process. Which command should be configured to achieve this?

Accepted Answer

switch 2 priority 15. In a switch stack, the active switch is elected based on priority, with the highest priority becoming active. The standby switch is the one with the next highest priority. To ensure immediate takeover, you must configure a higher priority on the desired standby switch. The command 'switch 2 priority 15' sets the priority for stack member 2 to 15, making it the preferred standby. This ensures that if the active fails, switch 2 takes over without a full election, providing fast failover.

Answer

stack-mac persistent timer 0

Answer

spanning-tree vlan 1 root primary

Answer

redundancy mode route

Question 10

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, authenticated users remain connected and new users are placed in a restricted VLAN. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router will not forward DHCP requests to the helper address if it can serve the request locally from its own DHCP pool.. When a router receives a DHCP request on an interface and has a DHCP pool configured for that subnet, it responds locally and does not forward the request to the helper address. The ip helper-address is only used when the router cannot fulfill the request from its own DHCP configuration.

Answer

The router will forward DHCP requests to the helper address and also respond locally, causing duplicate offers.

Answer

The router will ignore the ip helper-address command for DHCP and only serve DHCP locally.

Answer

The router will forward the request to the helper address and also respond locally, but the client will accept the first offer.

Question 11

A network engineer is implementing VXLAN in a data center. The engineer needs to ensure that the underlay network supports VXLAN traffic and that the overlay is configured correctly. Which two statements are true regarding VXLAN operation? (Choose two.)

Accepted Answer

VXLAN encapsulates Layer 2 frames in UDP packets with destination port 4789.. VXLAN uses a 24-bit VNI for scalability and encapsulates Layer 2 frames in UDP with destination port 4789. These are fundamental characteristics. The other statements are false: VXLAN does not require a specific underlay routing protocol, VTEPs must have unique IPs, and IPv6 underlay is not a core requirement. The correct choices highlight the key benefits and encapsulation details of VXLAN.

Answer

VXLAN supports both IPv4 and IPv6 for the underlay transport.

Answer

VXLAN requires the underlay network to run OSPF or IS-IS for multicast replication.

Answer

VTEPs must be configured with the same IP address to allow communication.

Question 12

A network administrator needs to configure a Cisco IOS switch to authenticate users connecting to a switchport using 802.1X. The authentication server is a Cisco ISC or similar RADIUS server. Which command must be applied globally to enable 802.1X authentication on the switch?

Accepted Answer

aaa authentication dot1x default group radius. Enabling 802.1X authentication on a Cisco IOS switch requires the global command aaa authentication dot1x default group radius to define the authentication method list. Additionally, dot1x system-auth-control must be enabled globally, and interface-level commands are needed. The other options are either interface-level or do not specify the authentication method.

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Answer

dot1x system-auth-control

Question 13

A network engineer is configuring a new Cisco IOS XE switch stack. The engineer wants to ensure that if the active switch fails, the standby switch takes over as quickly as possible. Which feature should be configured to reduce switchover time?

Accepted Answer

Nonstop Forwarding (NSF) with Stateful Switchover (SSO). In a Cisco IOS XE switch stack, high availability is achieved through StackWise technology. To minimize switchover time when the active switch fails, NSF with SSO should be enabled. SSO synchronizes stateful information, such as routing tables and forwarding information, between the active and standby switches. NSF allows the standby to continue forwarding traffic during the switchover. Together, they provide subsecond failover. Other features like Rapid PVST+ or EtherChannel do not address control plane redundancy.

Answer

StackWise Virtual

Answer

EtherChannel with LACP

Answer

Rapid PVST+

Question 14

A network architect is designing a new branch office that must run a first-hop redundancy protocol. The design requires that the active gateway for each VLAN be the same physical router whenever possible to simplify traffic flow, and that gateway load balancing across the two routers occur on a per-subnet basis rather than per-packet. Which first-hop redundancy protocol should be selected?

Accepted Answer

HSRP with multiple groups and MHSRP. HSRP can run multiple standby groups on one interface using MHSRP. By assigning different subnets to different groups and reversing the active/standby roles, each subnet gets a stable active gateway while the two routers share the load. This satisfies both the single-active-per-VLAN requirement and the per-subnet balancing requirement, unlike protocols that distribute per host or that elect only one master for the whole segment.

Answer

HSRP with a single group and interface tracking

Answer

GLBP

Answer

VRRP

Question 15

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, authenticated users remain connected and new users are placed in a restricted VLAN. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aaa new-model. For 802.1X authentication to function, the switch must have AAA enabled using the 'aaa new-model' command. This enables the AAA access control model, allowing the switch to send authentication requests to the RADIUS server. Other commands like 'dot1x system-auth-control' and authentication method lists are necessary but only work after AAA is enabled. The absence of Access-Requests indicates AAA is not active.

Answer

dot1x system-auth-control

Answer

aaa authentication dot1x default group radius

Answer

radius-server host 10.1.1.1 key secret