350-401 Infrastructure Practice Test 18 — 15 Questions

Question 1

A network engineer is configuring a Cisco Catalyst switch to authenticate users via 802.1X. The switch must place authenticated users into a specific VLAN based on the RADIUS server's response, and unauthenticated users should have no network access. Which configuration element is required on the switch to support dynamic VLAN assignment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the RADIUS server to return the IETF attributes Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID, and ensure the switch interface is in access mode with 802.1X enabled.. Dynamic VLAN assignment in 802.1X requires the RADIUS server to return specific tunnel attributes that the switch interprets to place the authenticated user into a designated VLAN. The switch port must be configured for 802.1X and usually in access mode. The combination of the correct RADIUS attributes and the proper switch configuration enables the switch to move the port to the VLAN specified by the server after successful authentication, providing the required access control.

Answer

Configure the switch to use MAC authentication bypass (MAB) and assign a static VLAN to the interface.

Answer

Configure the interface as a trunk port and allow all VLANs.

Answer

Configure the switch to use RADIUS Change of Authorization (CoA) and enable dynamic VLAN assignment on the interface.

Question 2

A network administrator is implementing a VXLAN EVPN fabric in a data center. The requirement is to provide Layer 2 connectivity between two leaf switches for a VLAN that must be stretched across the fabric. Which EVPN route type is used to advertise MAC address reachability information?

Accepted Answer

Type 2 - MAC/IP Advertisement route. In a VXLAN EVPN fabric, MAC address reachability is advertised using Type 2 EVPN routes, also known as MAC/IP Advertisement routes. These routes allow leaf switches to learn remote MAC addresses and provide Layer 2 connectivity across the fabric. Type 2 routes are fundamental for the operation of EVPN-based VXLAN networks.

Answer

Type 1 - Ethernet Auto-Discovery route

Answer

Type 3 - Inclusive Multicast Ethernet Tag route

Answer

Type 4 - Ethernet Segment route

Question 3

A network administrator is configuring a new Cisco Catalyst switch and needs to assign a management IP address to VLAN 1. Which command is used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign a management IP address to VLAN 1 on a Cisco switch, you must configure the switched virtual interface (SVI) for VLAN 1. The command 'interface vlan 1' enters interface configuration mode for that SVI, where you can then use the 'ip address' command to assign an IP address and enable the interface with 'no shutdown'.

Answer

interface fastethernet 0/1

Answer

interface range vlan 1

Answer

vlan 1

Question 4

A network administrator is configuring a Cisco IOS router to provide DHCP services to a remote subnet. The router's interface on that subnet is configured with the address 10.1.1.1/24. Which command is required to exclude the router's own address from the DHCP pool?

Accepted Answer

ip dhcp excluded-address 10.1.1.1. The 'ip dhcp excluded-address' command is used to prevent specific IP addresses from being assigned by the DHCP server. In this scenario, excluding the router's interface address 10.1.1.1 ensures it remains available for the router itself and is not leased to a client.

Answer

ip dhcp pool 10.1.1.1

Answer

ip dhcp relay information option

Answer

ip dhcp excluded-address 10.1.1.0 10.1.1.255

Question 5

A network engineer is configuring a new Cisco Catalyst switch that will participate in a VTP domain. The switch must not be able to create, modify, or delete VLANs, but it must synchronize its VLAN database with the current VTP server. Which VTP mode should be configured on this switch?

Accepted Answer

VTP client mode. VTP client mode is designed for switches that should receive VLAN configuration from VTP servers but not modify it. The switch will synchronize its VLAN database with advertisements from the server, ensuring consistency, while its configuration interface prevents local VLAN creation or deletion. This satisfies both constraints: no VLAN changes and synchronization with the server.

Answer

VTP transparent mode

Answer

VTP off mode

Answer

VTP server mode

Question 6

A network administrator is configuring a Cisco wireless LAN controller (WLC) to support a new employee SSID. The SSID must use WPA2-Enterprise with 802.1X authentication against an external RADIUS server. The administrator has already configured the RADIUS server on the WLC. Which additional step is required to complete the configuration?

Accepted Answer

Create a new WLAN and set the Layer 2 Security to WPA2 with 802.1X, and set the Layer 3 Security to None.. For WPA2-Enterprise with 802.1X, the WLAN must use Layer 2 Security set to WPA2 with 802.1X, which leverages the configured RADIUS server for authentication. Layer 3 Security should remain None to avoid additional web authentication. This setup ensures that clients authenticate via 802.1X and receive AES encryption.

Answer

Create a new WLAN and set the Layer 2 Security to WPA2 with PSK, and set the Layer 3 Security to Web Policy.

Answer

Create a new WLAN and set the Layer 2 Security to None, and set the Layer 3 Security to Web Policy with RADIUS authentication.

Answer

Create a new WLAN and set the Layer 2 Security to WPA2 with 802.1X, and set the Layer 3 Security to Web Policy.

Question 7

A network engineer is configuring a switch to support 802.1X authentication for wired clients. The requirement is to authenticate users against a centralized RADIUS server and assign dynamic VLANs based on the user's role. Which command must be configured on the switch to enable 802.1X authentication globally?

Accepted Answer

dot1x system-auth-control. To enable 802.1X authentication globally on a Cisco switch, the 'dot1x system-auth-control' command must be configured. This command activates the 802.1X process and allows the switch to act as an authenticator. Other commands, such as those for RADIUS or interface-level settings, are necessary but do not globally enable 802.1X.

Answer

aaa authentication dot1x default group radius

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Question 8

A network engineer is configuring a new Cisco IOS switch and needs to ensure that the management VLAN is properly secured. The engineer wants to restrict management access to only the IT department subnet 10.10.10.0/24. Which configuration should be applied to the VTY lines?

Accepted Answer

access-class 10 in. To restrict management access to a specific subnet on Cisco IOS devices, you configure an ACL that permits that subnet and denies others, then apply it to the VTY lines using the access-class command. The access-class command filters incoming connections to the VTY lines. The correct syntax is 'access-class 10 in'. This ensures that only hosts from the IT department subnet can establish management sessions, meeting the security requirement.

Answer

ip access-class 10 in

Answer

access-list 10 permit 10.10.10.0 0.0.0.255

Answer

ip access-group 10 in

Question 9

A network engineer is implementing QoS on a Cisco IOS router. The requirement is to classify traffic based on the DSCP value in the IP header and then mark it with a new DSCP value. Which QoS mechanism should be used to accomplish this?

Accepted Answer

Modular QoS CLI (MQC). The Modular QoS CLI (MQC) is the correct framework for classifying traffic based on DSCP and marking it with a new DSCP value. It involves creating a class-map to match the desired DSCP, a policy-map to set the new DSCP, and applying the service-policy to an interface. This provides a flexible and standardized way to implement QoS policies.

Answer

Class-based weighted fair queueing (CBWFQ)

Answer

Policy-based routing (PBR)

Answer

Low latency queueing (LLQ)

Question 10

A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer needs to ensure that the VXLAN overlay can carry traffic for multiple tenants while maintaining isolation. Which component is responsible for identifying the VXLAN segment and providing tenant isolation?

Accepted Answer

VXLAN Network Identifier (VNI). The VXLAN Network Identifier (VNI) is a 24-bit field in the VXLAN header that uniquely identifies each VXLAN segment. It allows up to 16 million segments, enabling massive multi-tenancy. Tenant isolation is achieved because each VNI represents a separate logical network, and traffic from different VNIs is not mixed. The VNI is the key component for identifying the segment and ensuring isolation.

Answer

Destination IP address in the outer IP header

Answer

UDP source port number

Answer

VLAN ID in the outer Ethernet header

Question 11

A network engineer is deploying a new branch office with a single Cisco Catalyst 9300 switch. The branch has three VLANs: VLAN 10 (users), VLAN 20 (voice), and VLAN 30 (management). The engineer needs to route traffic between these VLANs directly on the switch without using an external router. Which feature should be configured on the switch to enable inter-VLAN routing?

Accepted Answer

Configure Switch Virtual Interfaces (SVIs) for each VLAN and enable IP routing.. Inter-VLAN routing on a multilayer switch is achieved by creating a Switch Virtual Interface (SVI) for each VLAN and enabling IP routing. SVIs act as default gateways for hosts in each VLAN, and the switch routes packets between them. This method is efficient, scalable, and does not require an external router, making it ideal for the branch office scenario.

Answer

Configure 802.1Q trunking to an external router and enable Router-on-a-Stick.

Answer

Configure a routed port on the switch and connect it to each VLAN's subnet.

Answer

Enable private VLANs to isolate traffic between VLANs.

Question 12

A network engineer is deploying a new branch office with a Cisco Catalyst 9300 switch. The switch must participate in the corporate OSPF domain but must not become a designated router (DR) or backup designated router (BDR) on any broadcast segment. Which configuration should the engineer apply to the switch's OSPF interface?

Accepted Answer

ip ospf priority 0. The OSPF interface priority determines which routers are eligible to become DR or BDR on a broadcast or non-broadcast multi-access segment. A priority of 0 makes the router ineligible for these roles, so it will remain a DROTHER regardless of its router ID. This is the correct way to ensure the switch never becomes DR or BDR while still participating in OSPF.

Answer

ip ospf network point-to-point

Answer

ip ospf database-filter all out

Answer

ip ospf cost 65535

Question 13

A network engineer is implementing VXLAN on a Cisco Nexus switch. The engineer wants to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between VLANs by mapping them to VNIs. Which component is responsible for the mapping of VLANs to VNIs on the VTEP?

Accepted Answer

The VXLAN Network Identifier (VNI) to VLAN mapping table. In VXLAN, each VLAN that needs to be extended across the overlay is mapped to a unique VNI. This mapping is configured on the VTEP, typically in a VLAN-to-VNI mapping table. When a frame from a VLAN enters the VTEP, the switch uses this mapping to determine the VNI and encapsulates the frame accordingly. Therefore, the VNI-to-VLAN mapping table is the component responsible for this function.

Answer

The MAC address table

Answer

The ARP table

Answer

The underlay routing protocol

Question 14

A network engineer is deploying a Cisco SD-WAN solution using vManage, vSmart, and vBond controllers. Which two statements accurately describe the roles of these controllers in the SD-WAN overlay? (Choose two.)

Accepted Answer

vBond orchestrates the initial authentication and brings up the control plane connections between vEdge routers and vSmart controllers.. In Cisco SD-WAN, vBond orchestrates initial authentication and control plane connectivity, while vManage provides centralized management. vSmart handles control plane routing and policy distribution, and vEdge routers handle data plane forwarding. The correct statements are about vBond's orchestration role and vManage's management role.

Answer

vBond controllers are responsible for distributing routing information and policies to vEdge routers.

Answer

vSmart controllers are responsible for the data plane forwarding and encryption of traffic between vEdge routers.

Answer

vSmart controllers establish permanent data plane tunnels with each vEdge router for traffic forwarding.

Question 15

A network engineer is deploying a new Cisco Catalyst switch and must ensure that the management VLAN 50 is the only VLAN allowed on the trunk link to the distribution switch, while also ensuring that the native VLAN matches on both ends. The distribution switch is already configured with switchport trunk native vlan 999 and switchport trunk allowed vlan 50. Which configuration on the new switch will satisfy these requirements?

Accepted Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 50. To match the distribution switch, the new switch must be configured as a static trunk with native VLAN 999 and allowed VLAN 50. This ensures native VLAN consistency and restricts the trunk to only the management VLAN, preventing unnecessary traffic and security risks.

Answer

interface GigabitEthernet0/1
 switchport mode dynamic desirable
 switchport trunk native vlan 999
 switchport trunk allowed vlan 50

Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 50
 switchport trunk allowed vlan 50

Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 50
 switchport trunk native vlan 1