350-401 Infrastructure Practice Test 12 — 15 Questions

Question 1

A network engineer is implementing NETCONF on a Cisco IOS XE device to automate configuration changes. The engineer must ensure secure communication and reliable delivery of configuration data. Which two protocols or standards are used by NETCONF to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSH. NETCONF uses SSH as its secure transport and XML as its message encoding format. SSH provides encrypted and authenticated communication, while XML offers a structured way to represent configuration and protocol operations. These two standards are integral to NETCONF's operation, ensuring secure and reliable configuration management.

Answer

TLS

Answer

SNMP

Answer

JSON

Question 2

A network engineer is configuring a Cisco IOS router for IP SLA to monitor reachability of a remote server. The engineer wants to ensure that if the server becomes unreachable, a static route is removed from the routing table. Which two configuration steps are required to accomplish this? (Choose two.)

Accepted Answer

Define an IP SLA operation that sends ICMP echo requests to the server.. To use IP SLA to remove a static route when a server becomes unreachable, you must first define an IP SLA operation that sends probes to the server, then create a track object that monitors the operation's reachability. The static route is then configured with the 'track' keyword referencing the track object. These two steps, defining the IP SLA operation and configuring the track object, are essential prerequisites for the tracking mechanism to function.

Answer

Configure the static route with the track option referencing the track object.

Answer

Configure a floating static route with a higher administrative distance.

Answer

Enable OSPF on the interface connected to the server.

Question 3

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IKEv2. The engineer must ensure that the VPN tunnel uses certificate-based authentication and that the IKEv2 proposal includes AES-256 encryption and SHA-256 hashing. Which configuration is required?

Accepted Answer

crypto ikev2 proposal PROP1 with encryption aes-cbc-256 and integrity sha256, then crypto ikev2 policy POL1 with proposal PROP1, and crypto ikev2 profile PROF1 with authentication local rsa-sig and authentication remote rsa-sig. For IKEv2 site-to-site VPN with certificate-based authentication, the IKEv2 profile must use authentication local rsa-sig and authentication remote rsa-sig. The proposal must include the required encryption and integrity algorithms. The profile must also reference a PKI trustpoint to use certificates. Pre-shared keys and EAP do not meet the certificate-based requirement. The correct configuration includes the proposal, policy, and profile with RSA signatures and trustpoint association.

Answer

crypto ikev2 proposal PROP1 with encryption aes-cbc-256 and integrity sha256, then crypto ikev2 policy POL1 with proposal PROP1, and crypto ikev2 profile PROF1 with authentication local eap and authentication remote eap

Answer

crypto ikev2 proposal PROP1 with encryption aes-cbc-256 and integrity sha256, then crypto ikev2 policy POL1 with proposal PROP1, and crypto ikev2 profile PROF1 with authentication local pre-share and authentication remote pre-share

Answer

crypto ikev2 proposal PROP1 with encryption aes-cbc-256 and integrity sha256, then crypto ikev2 policy POL1 with proposal PROP1, and crypto ikev2 profile PROF1 with authentication local rsa-sig and authentication remote rsa-sig, and a crypto pki trustpoint configured

Question 4

A network administrator is configuring a Cisco IOS router for QoS. The goal is to ensure that VoIP traffic is marked with DSCP EF and receives priority treatment in the queue. Which command set correctly classifies and marks VoIP traffic in a policy map?

Accepted Answer

class-map match-any VOIP
 match access-group 100
policy-map QOS
 class VOIP
  set dscp ef
  priority 100
access-list 100 permit udp any any range 16384 32767. To properly classify and mark VoIP traffic, an access list matching RTP ports (16384-32767) is commonly used. The policy map then sets DSCP EF and applies priority queueing. This ensures voice packets are marked and given strict priority. The other options either match already-marked traffic, wrong DSCP, or only signaling, not the voice media.

Answer

class-map match-any VOIP
 match dscp ef
policy-map QOS
 class VOIP
  set dscp ef
  priority 100

Answer

class-map match-any VOIP
 match dscp af31
policy-map QOS
 class VOIP
  set dscp ef
  priority 100

Answer

class-map match-any VOIP
 match protocol sip
policy-map QOS
 class VOIP
  set dscp ef
  priority 100

Question 5

An engineer is configuring a Cisco IOS router to participate in an OSPFv2 broadcast network. The router must form adjacencies with neighbors on the same subnet and must ensure that the DR/BDR election is deterministic. Which two configuration elements are required? (Choose two.)

Accepted Answer

Configure the router's OSPF interface priority to a value higher than other routers on the segment.. On a broadcast OSPF segment, adjacency formation requires matching area ID and hello/dead timers, and deterministic DR/BDR election is achieved by setting a higher interface priority on the intended DR. Authentication and router ID changes do not by themselves guarantee the election outcome, and point-to-point network type removes the election entirely.

Answer

Set the router ID to the highest IP address on the segment using the router-id command.

Answer

Enable OSPF authentication using MD5 on the interface.

Answer

Configure the OSPF network type as point-to-point on the interface.

Question 6

A network engineer is configuring a Cisco IOS router to use NETCONF over SSH for automated configuration. The engineer has enabled the NETCONF-YANG feature with the 'netconf-yang' command and configured SSH. However, when attempting to connect using a NETCONF client, the connection is refused. Which additional configuration is required?

Accepted Answer

Enable the NETCONF subsystem with the 'netconf-yang agent ssh' command.. To enable NETCONF over SSH on a Cisco IOS router, after enabling the NETCONF-YANG feature with 'netconf-yang', you must also configure the NETCONF agent to use SSH with the 'netconf-yang agent ssh' command. This command starts the NETCONF subsystem listening on the SSH port. Without it, the router does not accept NETCONF sessions, leading to connection refused. The other options are either for different protocols or not required for this purpose.

Answer

Enable the RESTCONF protocol with the 'restconf' command.

Answer

Configure the 'ip http secure-server' command.

Answer

Configure the 'aaa authorization exec default local' command.

Question 7

A network engineer is configuring a Cisco IOS router to support PIM Sparse Mode. The engineer must ensure that the rendezvous point (RP) information is distributed to all routers in the multicast domain. Which two methods can be used to advertise the RP? (Choose two.)

Accepted Answer

Auto-RP. In Cisco IOS, RP information can be distributed via static configuration on each router or dynamically using Auto-RP. Auto-RP uses candidate RPs and mapping agents to advertise mappings. BSR is an open standard but not typically the answer in Cisco-specific contexts. MSDP and Anycast RP are for inter-domain or redundancy and do not advertise RP mappings within a domain.

Answer

Bootstrap Router (BSR)

Answer

PIM Anycast RP

Answer

MSDP

Question 8

A network administrator is configuring QoS on a Cisco switch. The administrator wants to ensure that voice traffic is marked with DSCP EF and that the switch trusts the DSCP markings from an IP phone. Which command should be applied to the interface connected to the IP phone?

Accepted Answer

mls qos trust dscp. The command mls qos trust dscp configures the interface to trust DSCP markings, allowing voice traffic marked EF (DSCP 46) to be prioritized. This is essential when an IP phone marks its traffic and the switch needs to honor those markings for QoS processing.

Answer

mls qos trust device cisco-phone

Answer

mls qos map dscp 46 to 46

Answer

mls qos trust cos

Question 9

A network engineer is configuring a new Cisco Catalyst switch. The company requires that the switch automatically learn and forward traffic for VLANs that are not explicitly configured, but also wants to prevent unauthorized VLANs from being created on the switch. Which VTP mode should be configured on the switch?

Accepted Answer

VTP client mode. VTP client mode allows a switch to receive and use VLAN information from VTP servers without permitting local VLAN creation. This satisfies both requirements: automatic learning of VLANs for forwarding and prevention of unauthorized VLAN creation. Server and transparent modes allow local VLAN configuration, while off mode disables VTP entirely.

Answer

VTP off mode

Answer

VTP server mode

Answer

VTP transparent mode

Question 10

A network engineer is implementing a first-hop redundancy protocol on a pair of Cisco switches. The design requires that the virtual IP address be the same as the physical IP address of the active router, and that the standby router preempts if it has a higher priority. Which protocol should be used?

Accepted Answer

Virtual Router Redundancy Protocol (VRRP). VRRP is designed so that the virtual IP address can be the same as the physical IP address of the master router. It also supports preemption, allowing a backup with a higher priority to become master. HSRP requires a separate virtual IP, GLBP is for load balancing without that IP flexibility, and IS-IS is a routing protocol.

Answer

Gateway Load Balancing Protocol (GLBP)

Answer

Intermediate System to Intermediate System (IS-IS)

Answer

Hot Standby Router Protocol (HSRP)

Question 11

A network administrator is configuring a Cisco IOS router to authenticate management users via TACACS+. The requirement is to authenticate, authorize, and account for all administrative sessions to the router. Which set of commands must be applied?

Accepted Answer

aaa new-model, aaa authentication login default group tacacs+ local, aaa authorization exec default group tacacs+ local, aaa accounting exec default start-stop group tacacs+. To authenticate, authorize, and account for administrative sessions using TACACS+, you must enable AAA, then configure aaa authentication login, aaa authorization exec, and aaa accounting exec with group tacacs+. Including local fallback is a best practice for redundancy. Using RADIUS or network authorization does not meet the TACACS+ and exec session requirements.

Answer

aaa new-model, aaa authentication login default group tacacs+, aaa authorization network default group tacacs+, aaa accounting network default start-stop group tacacs+

Answer

aaa new-model, aaa authentication login default group tacacs+, aaa authorization exec default group tacacs+, aaa accounting exec default start-stop group tacacs+

Answer

aaa new-model, aaa authentication login default group radius, aaa authorization exec default group radius, aaa accounting exec default start-stop group radius

Question 12

A network engineer is troubleshooting an EIGRP adjacency issue between two routers. The engineer verifies that both routers have the same K-values and autonomous system number. However, the adjacency does not form. Which configuration issue is most likely the cause?

Accepted Answer

Authentication is configured on one router but not on the other.. In EIGRP, authentication (MD5 or SHA) must be configured identically on both peers. If one router has authentication enabled and the other does not, the routers will reject each other's hello packets, preventing adjacency formation even if K-values and AS numbers match. This is a common misconfiguration that breaks neighbor relationships silently.

Answer

The network statement uses an incorrect subnet mask.

Answer

One router has a loopback interface that is not advertised.

Answer

The hello and hold timers do not match.

Question 13

A company is implementing QoS in a campus network. Voice traffic must be prioritized over data traffic, and all traffic should be marked at Layer 2 and Layer 3. Which combination of marking values should be used on access ports to achieve this?

Accepted Answer

CoS 5, DSCP EF. Voice traffic requires strict priority queuing, which is achieved by marking with CoS 5 at Layer 2 and DSCP EF (46) at Layer 3. CoS 5 maps to the priority queue in Cisco switches, and DSCP EF is the standard per-hop behavior for Expedited Forwarding (RFC 3246), ensuring low latency and jitter for voice. Access ports must trust these markings to prioritize voice over data traffic.

Answer

CoS 5, DSCP AF41

Answer

CoS 5, DSCP CS3

Answer

CoS 4, DSCP EF

Question 14

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

Accepted Answer

Configure the port as a trunk port.. A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Answer

Configure the port as a dynamic desirable port.

Answer

Configure the port as a routed port.

Answer

Configure the port as an access port.

Question 15

A network engineer is deploying a new WLAN and needs to ensure that client traffic is encrypted using AES with a pre-shared key. Which security configuration should be applied to the wireless SSID?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because the requirement specifies AES encryption with a pre-shared key. WPA2-PSK (Wi-Fi Protected Access 2 – Pre-Shared Key) mandates AES-CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) as the encryption protocol, providing strong, standards-compliant security for client traffic. This configuration directly satisfies the need for both AES encryption and PSK authentication.

Answer

WPA3-PSK with AES

Answer

WPA2-PSK with TKIP

Answer

WEP with AES