350-401 Infrastructure Practice Test 14 — 15 Questions

Question 1

A network engineer is configuring a VXLAN EVPN fabric on Cisco Nexus switches. The fabric must support Layer 2 extension across multiple leaf switches while maintaining optimal forwarding for Layer 3 traffic. Which control plane component is responsible for advertising MAC and IP address bindings to all leaf switches?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MP-BGP EVPN address family. MP-BGP EVPN is the standard control plane for VXLAN EVPN fabrics. It advertises MAC and IP bindings using EVPN route types, enabling leaf switches to learn remote endpoints and forward traffic optimally without flooding. The other protocols listed are either underlay routing, multicast, or fabric management tools and do not provide the required EVPN address family.

Answer

PIM sparse mode

Answer

Cisco Fabric Services (CFS)

Answer

OSPFv3 with address families

Question 2

A network engineer is implementing VXLAN on a Cisco Nexus 9000 series switch running NX-OS. The underlay network uses OSPF and the loopback0 interface of each VTEP is advertised. The engineer wants to verify that the VXLAN tunnel endpoints can communicate. Which command should be used to check the VXLAN tunnel status?

Accepted Answer

show nve peers. The 'show nve peers' command is the correct way to verify VXLAN tunnel endpoint communication. It provides details about peer VTEPs, including their IP addresses and state. This command is essential for troubleshooting VXLAN overlay connectivity, as it directly shows whether tunnels are established and operational.

Answer

show interface tunnel

Answer

show vxlan interface

Answer

show ip ospf neighbor

Question 3

A network engineer needs to configure a switch port to authenticate end hosts against a RADIUS server. The requirement is that if the RADIUS server becomes unreachable, the port should place the host on a guest VLAN instead of shutting down. Which command must be added to the interface configuration?

Accepted Answer

authentication event server dead action authorize vlan 10. When a RADIUS server becomes unreachable, the switch can be configured to authorize the port into a specific VLAN rather than shutting it down. The 'authentication event server dead action authorize vlan' command implements this by defining the VLAN to assign. The other options either handle different authentication events or alter port behaviour in ways that do not match the requirement.

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 10

Answer

authentication open

Question 4

A network administrator is configuring a switch port to support a VoIP phone and a PC connected to the phone's internal switch. The phone must be placed in VLAN 50 and the PC in VLAN 60. Which configuration on the switch port achieves this?

Accepted Answer

switchport mode access
switchport access vlan 60
switchport voice vlan 50. The correct configuration uses access VLAN 60 for the PC and voice VLAN 50 for the phone. Cisco voice VLAN allows the switch to instruct the phone to use a specific VLAN for voice traffic while the PC remains on the access VLAN. This provides proper segmentation and QoS for voice.

Answer

switchport mode access
switchport access vlan 50
switchport trunk allowed vlan 60

Answer

switchport mode access
switchport access vlan 50
switchport voice vlan 60

Answer

switchport mode trunk
switchport trunk native vlan 60
switchport trunk allowed vlan 50

Question 5

A network engineer is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5 cryptographic authentication on an interface. The engineer enters the following commands: interface GigabitEthernet0/0, ip ospf authentication message-digest, ip ospf message-digest-key 1 md5 Cisco123. However, the OSPF adjacency with the neighbor router is not forming. Which additional configuration is required on the neighbor router to establish the adjacency?

Accepted Answer

Configure the same key ID and password on the neighbor's interface with ip ospf message-digest-key 1 md5 Cisco123.. OSPF MD5 authentication requires both neighbors to have the same key ID and password configured on their interfaces. The engineer configured MD5 on one router, so the neighbor must have the identical 'ip ospf message-digest-key' command. Without matching keys, authentication fails and the adjacency does not form.

Answer

Configure the neighbor with the command area 0 authentication message-digest.

Answer

Configure the neighbor with the command ip ospf authentication-key Cisco123.

Answer

Configure the neighbor with the command ip ospf authentication null.

Question 6

A network administrator is configuring a Cisco Catalyst 9000 switch to authenticate users via 802.1X. The authentication server is a Cisco Identity Services Engine (ISE). The administrator wants to ensure that if the ISE server becomes unreachable, the switch will allow devices to connect with limited access. Which feature should be configured?

Accepted Answer

Inaccessible Authentication Bypass. Inaccessible Authentication Bypass is designed to handle the situation where the RADIUS server is unreachable. It allows the switch to apply a preconfigured access policy, often assigning the port to a critical VLAN, ensuring that devices can still connect with limited access. This meets the requirement of maintaining connectivity during server outages.

Answer

MAC Authentication Bypass

Answer

Critical VLAN

Answer

Guest VLAN

Question 7

A network administrator is configuring a Cisco Catalyst switch to allow management access only from the subnet 10.10.10.0/24. The administrator wants to apply an ACL to the VTY lines. Which command correctly applies the ACL named MGMT to the VTY lines?

Accepted Answer

access-class MGMT in. To restrict management access to a Cisco device, an ACL is defined globally and then applied to the VTY lines using the access-class command in line configuration mode. The in keyword filters incoming connections. This ensures that only hosts matching the ACL's permit statements can establish remote management sessions, effectively limiting access to the specified subnet.

Answer

ip access-group MGMT in

Answer

ip access-class MGMT in

Answer

access-list MGMT in

Question 8

A network engineer is configuring a Cisco Catalyst switch to authenticate users via 802.1X. The RADIUS server is reachable at 10.10.10.5 using the key 'Cisco123'. The switch must dynamically assign VLANs based on the RADIUS attributes returned. Which configuration is required on the switch to enable dynamic VLAN assignment?

Accepted Answer

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
radius-server host 10.10.10.5 key Cisco123
dot1x system-auth-control. For dynamic VLAN assignment with 802.1X, the switch must authenticate the user and authorize the session to receive VLAN attributes from the RADIUS server. The 'aaa authorization network default group radius' command enables the switch to process these attributes. Without it, the switch will not apply the VLAN, even if authentication succeeds. The RADIUS server and global 802.1X configuration are also required.

Answer

aaa new-model
aaa authentication dot1x default group radius
aaa accounting network default start-stop group radius
radius-server host 10.10.10.5 key Cisco123
dot1x system-auth-control

Answer

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
radius-server host 10.10.10.5 key Cisco123
no dot1x system-auth-control

Answer

aaa new-model
aaa authentication dot1x default group radius
radius-server host 10.10.10.5 key Cisco123
dot1x system-auth-control

Question 9

An engineer is implementing a QoS policy on a Cisco IOS XE router. The requirement is to prioritize voice traffic (marked DSCP EF) and ensure that it receives strict priority scheduling with a guaranteed bandwidth of 30% of the interface capacity. Which queuing mechanism should be configured on the interface?

Accepted Answer

Low Latency Queuing (LLQ) with a priority statement for the voice class.. Low Latency Queuing (LLQ) combines the bandwidth guarantees of CBWFQ with a strict priority queue. By configuring a priority statement for the voice class, packets marked DSCP EF are placed in a low-latency queue that is serviced before other queues, ensuring minimal delay and jitter. The priority bandwidth allocation of 30% guarantees that voice traffic receives the necessary bandwidth even during congestion.

Answer

First-In, First-Out (FIFO) queuing with a rate limit for voice traffic.

Answer

Weighted Random Early Detection (WRED) with a precedence-based drop policy for voice.

Answer

Class-Based Weighted Fair Queuing (CBWFQ) with a bandwidth guarantee for the voice class.

Question 10

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. Hosts in the same subnet are attached to different edge nodes. The engineer must ensure that a host retains its default gateway IP and MAC address when it moves between edge nodes. Which technology should be configured on the edge nodes?

Accepted Answer

Anycast gateway with the same IP and MAC address on all edge nodes for that subnet. A distributed anycast gateway assigns the same virtual IP and virtual MAC to the default gateway on every edge node hosting a subnet. Hosts can move between edge nodes without changing their gateway ARP entry, which preserves connectivity and avoids suboptimal paths. This is a fundamental requirement for seamless host mobility in VXLAN EVPN fabrics.

Answer

VRRP with preemption enabled on all edge nodes

Answer

HSRP group with a unique virtual IP per edge node

Answer

Proxy ARP on the edge nodes

Question 11

A network engineer is configuring a Cisco IOS router to support VRF-lite for a customer. The engineer creates a VRF named CUST_A and assigns an interface to it using the command ip vrf forwarding CUST_A. After assigning the interface, the engineer notices that the interface IP address is removed. Which action must the engineer take to restore connectivity?

Accepted Answer

Reapply the IP address to the interface after assigning it to the VRF.. Assigning an interface to a VRF with ip vrf forwarding removes any existing IP address because the interface's addressing is now scoped to the VRF. The engineer must reapply the IP address after the VRF assignment. This is a standard step in VRF-lite configuration. The other options either suggest incorrect order or misunderstand the behavior of VRF assignment.

Answer

Configure a global IP address and then assign the interface to the VRF.

Answer

Enable OSPF within the VRF to automatically restore the IP address.

Answer

Remove the VRF from the interface and then reassign it to reset the IP address.

Question 12

A network administrator is configuring a Cisco IOS switch to authenticate users via 802.1X. The administrator wants to ensure that if the RADIUS server is unreachable, users are placed into a guest VLAN with limited access. Which feature should be configured to achieve this?

Accepted Answer

Configure authentication event server dead action authorize vlan 100 under the interface.. To place users into a guest VLAN when the RADIUS server is unreachable, the authentication event server dead action authorize vlan command must be configured on the interface. This command triggers the fallback VLAN when the server is marked dead. The other options address different authentication events or host modes and do not provide the required server-dead fallback.

Answer

Configure authentication host-mode multi-auth under the interface.

Answer

Configure authentication open under the interface.

Answer

Configure authentication event fail action authorize vlan 100 under the interface.

Question 13

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN using IPsec. The engineer wants to ensure that the VPN tunnel only carries traffic for the subnet 10.1.1.0/24 to 10.2.2.0/24. Which configuration element is required to define the interesting traffic?

Accepted Answer

crypto ACL (extended access list). The crypto ACL, an extended access list, defines the interesting traffic that should be protected by IPsec. It specifies the source and destination addresses and ports. The crypto map then references this ACL to apply the IPsec policies. Without the crypto ACL, the router would not know which packets to encrypt and send through the tunnel.

Answer

ISAKMP policy

Answer

crypto map

Answer

IPsec transform set

Question 14

A network administrator is configuring a Cisco IOS router to authenticate management users against a centralized TACACS+ server. The administrator wants to ensure that if the TACACS+ server is unreachable, a locally configured user can still log in. Which command should be used to define the authentication method list for login?

Accepted Answer

aaa authentication login default group tacacs+ local. The aaa authentication login default command defines the method list for login authentication. Listing group tacacs+ before local ensures the router attempts TACACS+ first and falls back to the local database only if the server is unreachable. This provides both centralized control and a reliable local backup for management access.

Answer

aaa authorization exec default group tacacs+ local

Answer

aaa authentication login default group radius local

Answer

aaa authentication login default group tacacs+ none

Question 15

A network engineer is implementing VXLAN with a distributed anycast gateway in a Cisco SD-Access fabric. The fabric uses LISP for control plane and VXLAN for data plane. Which component is responsible for mapping endpoint IP addresses to fabric edge nodes?

Accepted Answer

Control plane node. In Cisco SD-Access, the control plane node runs LISP Map-Server and Map-Resolver. It maintains the mapping of endpoint IP addresses to the RLOC of the fabric edge node where the endpoint is connected. When an edge node needs to forward traffic to an endpoint, it queries the control plane node to obtain the mapping, enabling VXLAN encapsulation. The border and intermediate nodes do not perform this mapping function.

Answer

Fabric edge node

Answer

Fabric intermediate node

Answer

Fabric border node