350-401 Infrastructure Practice Test 22 — 15 Questions

Question 1

A network engineer is configuring a pair of Catalyst switches to run VRRP on VLAN 10 (10.10.10.0/24). The virtual IP must be 10.10.10.1 with a priority of 110 on the primary switch and 100 on the standby. The primary switch is currently active. Which configuration on the primary switch correctly sets the VRRP priority and virtual IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

interface vlan 10 ip address 10.10.10.2 255.255.255.0 vrrp 10 ip 10.10.10.1 vrrp 10 priority 110. VRRP on Cisco IOS uses the `vrrp ip

` command to define the virtual IP, and `vrrp priority ` to set priority. The highest priority becomes the master. The correct configuration assigns the physical IP, defines the virtual IP 10.10.10.1, and sets priority 110, ensuring this switch becomes the master. Other options contain invalid syntax or set the wrong priority.

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1 255.255.255.0
 vrrp 10 priority 110

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 100

Answer

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 vrrp 10 virtual-ip 10.10.10.1
 vrrp 10 priority 110

Question 2

An engineer is configuring a Cisco Catalyst switch with VXLAN to extend Layer 2 connectivity between two data centers. The switch will act as a VXLAN Tunnel Endpoint (VTEP) and must encapsulate traffic from VLAN 10 into VXLAN VNI 10010. Which command is required to map the VLAN to the VNI?

Accepted Answer

vlan configuration 10: vn-segment 10010. To map a VLAN to a VXLAN VNI on a Cisco Catalyst switch, the engineer must enter VLAN configuration mode for the specific VLAN and use the 'vn-segment' command. This creates the association that allows the VTEP to encapsulate traffic from that VLAN into VXLAN packets with the specified VNI. Other command forms are invalid or apply to different platforms.

Answer

vxlan vlan 10 vni 10010

Answer

interface vlan 10: vxlan vni 10010

Answer

vxlan vni 10010 vlan 10

Question 3

A network engineer is configuring a new Cisco Catalyst switch that will participate in a VTP domain. The engineer wants to ensure the switch can create, modify, and delete VLANs for the domain while also receiving updates. The switch must not overwrite the existing VLAN database on other switches in the domain. Which VTP mode should be configured?

Accepted Answer

VTP server mode. VTP server mode enables a switch to create, modify, and delete VLANs for the entire VTP domain. It also receives VTP advertisements from other servers and clients. A new switch with a default revision number of 0 will not overwrite the existing VLAN database unless its revision number is higher. Therefore, server mode satisfies the need to manage VLANs domain-wide while safely receiving updates.

Answer

VTP client mode

Answer

VTP transparent mode

Answer

VTP off mode

Question 4

A network administrator is configuring a new Cisco IOS switch and wants to ensure that the management VLAN is isolated from user traffic. The administrator needs to assign an IP address to VLAN 1 for management access. Which command should be used to enter the interface configuration mode for VLAN 1?

Accepted Answer

interface vlan 1. To assign an IP address to a VLAN for management, you must enter the SVI configuration using 'interface vlan 1'. This creates a logical Layer 3 interface for that VLAN. The other options either configure physical interfaces, create the VLAN without Layer 3, or are incomplete without entering the interface mode first.

Answer

ip address 192.168.1.1 255.255.255.0

Answer

interface fastethernet 0/1

Answer

vlan 1

Question 5

A network administrator is configuring a new Cisco IOS router and needs to enable OSPFv2 on an interface with the correct area and network type. The interface is a broadcast multi-access network. Which command should be used to enable OSPF on the interface and set the area to 0?

Accepted Answer

interface GigabitEthernet0/0: ip ospf 1 area 0. The interface-level command 'ip ospf 1 area 0' enables OSPF process 1 on the interface and assigns it to area 0. This method is preferred over network statements because it is explicit and avoids unintended OSPF activation on other interfaces. The other options are either invalid syntax or less precise methods.

Answer

router ospf 1: area 0 interface GigabitEthernet0/0

Answer

interface GigabitEthernet0/0: ip ospf area 0

Answer

router ospf 1: network 10.0.0.0 0.0.0.255 area 0

Question 6

A network engineer is deploying a new branch office that uses Cisco SD-Access. The fabric must support both wired and wireless clients, with a single control plane that provides host tracking, location, and policy enforcement. Which fabric component is responsible for these functions?

Accepted Answer

Fabric control plane node. The fabric control plane node in Cisco SD-Access runs LISP map-server and map-resolver, providing a centralized database for endpoint-to-RLOC mappings. This enables host tracking, location services, and a single control plane for both wired and wireless clients. DNA Center and ISE are supporting components for management and policy, but they do not provide the runtime control-plane functions described in the scenario.

Answer

Cisco Identity Services Engine (ISE)

Answer

Fabric edge node

Answer

Cisco DNA Center

Question 7

A network administrator is configuring a Cisco IOS router to support NAT overload for a small office. The inside network is 10.1.1.0/24, and the outside interface is GigabitEthernet0/1 with IP address 203.0.113.5. The administrator wants all inside hosts to share the outside interface address for internet access. Which command is required to define the NAT pool or interface used for translation?

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/1 overload. To configure NAT overload using the outside interface address, the correct command is 'ip nat inside source list 1 interface GigabitEthernet0/1 overload'. This command references an access list that identifies inside local addresses and translates them to the IP address of the specified interface, using port numbers to distinguish sessions. It is the standard method for enabling many inside hosts to share a single public IP address.

Answer

ip nat inside destination list 1 interface GigabitEthernet0/1 overload

Answer

ip nat inside source list 1 pool MYPOOL overload

Answer

ip nat outside source list 1 interface GigabitEthernet0/1 overload

Question 8

A network engineer is implementing VRF-Lite on a Cisco IOS router to separate traffic from two different departments. The router has two interfaces, GigabitEthernet0/0 and GigabitEthernet0/1, each assigned to a different VRF. The engineer wants to verify that the VRFs are properly configured and that routes are being populated. Which command displays the routing table for a specific VRF?

Accepted Answer

show ip route vrf DEPARTMENT1. To view the routing table for a specific VRF, the show ip route vrf command must be used. The global show ip route only displays the global table. Commands like show vrf interface and show ip vrf provide VRF configuration information but not the routes themselves. Verifying VRF routes is critical in VRF-Lite deployments to ensure proper traffic separation.

Answer

show ip vrf

Answer

show vrf interface

Answer

show ip route

Question 9

A network engineer is configuring OSPF on a multiaccess network. The engineer wants to ensure that only two specific routers become DR and BDR, and that other routers do not participate in the election. Which OSPF interface setting should be configured on the routers that should not become DR or BDR?

Accepted Answer

ip ospf priority 0. Setting OSPF priority to 0 on an interface makes the router ineligible to become DR or BDR. This is the standard method to exclude routers from the election while still allowing them to participate in OSPF as DROTHERs. Other options either do not affect eligibility or change the network type entirely.

Answer

ip ospf database-filter all out

Answer

ip ospf network point-to-point

Answer

ip ospf priority 1

Question 10

A network engineer is configuring a Cisco IOS router to support NAT overload (PAT) for a small office. The inside network is 192.168.1.0/24, and the outside interface is GigabitEthernet0/1 with IP address 203.0.113.5. The engineer wants to translate all inside addresses to the outside interface address. Which two commands are required to complete this configuration? (Choose two.)

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255. To configure NAT overload (PAT) using the outside interface address, two commands are needed: an access list to define the inside local addresses, and the 'ip nat inside source list' command with the 'overload' keyword referencing that list and the outside interface. The access list permits the 192.168.1.0/24 subnet, and the NAT command translates all permitted addresses to the outside interface's IP. The other options either use a pool, configure the wrong direction, or create a static translation, none of which meet the requirement.

Answer

ip nat outside source list 1 interface GigabitEthernet0/1 overload

Answer

ip nat inside source static 192.168.1.10 203.0.113.5

Answer

ip nat inside source list 1 pool MYPOOL overload

Question 11

A network engineer is configuring a Cisco IOS XE router to support NETCONF over SSH for automated configuration. The management application requires that the router expose a standards-based data model and that configuration changes be applied as complete, atomic transactions. Which action must the engineer take?

Accepted Answer

Enable the NETCONF-YANG feature with the netconf-yang command and use the candidate datastore with the commit operation. NETCONF over SSH is enabled on Cisco IOS XE with the netconf-yang command, which starts the NETCONF server on TCP 830 and loads the YANG models. The candidate datastore plus commit gives transactional behavior: changes are staged, validated, and applied atomically, with rollback possible on failure. This is the standards-based, model-driven approach the automation application requires.

Answer

Configure SNMPv3 with authPriv and use SET operations to push the configuration

Answer

Enable the guest shell and run Python scripts that call the CLI parser for configuration

Answer

Enable the RESTCONF API with the ip http secure-server command and use the YANG models exposed there

Question 12

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbors using SHA-256 HMAC cryptographic authentication on an interface. Which command sequence correctly enables this authentication?

Accepted Answer

ip ospf authentication key-chain and configure a key chain with key 1 using cryptographic-algorithm hmac-sha-256. OSPFv2 supports SHA-256 HMAC authentication through key chains. The interface command ip ospf authentication key-chain references a key chain configured with key 1 and cryptographic-algorithm hmac-sha-256. This provides cryptographic authentication with stronger hashing than MD5. Simple authentication and MD5 do not meet the SHA-256 requirement, and null disables authentication.

Answer

ip ospf authentication followed by ip ospf authentication-key <password>

Answer

ip ospf authentication null

Answer

ip ospf authentication message-digest followed by ip ospf message-digest-key 1 md5 <key>

Question 13

A network engineer is configuring VXLAN on a Cisco Nexus switch. The engineer needs to ensure that the VXLAN tunnel endpoint (VTEP) can forward traffic between hosts in the same VXLAN segment across the Layer 3 underlay. Which two statements are true about VXLAN operation? (Choose two.)

Accepted Answer

VXLAN encapsulates original Ethernet frames in UDP.. VXLAN uses a 24-bit VNI to identify Layer 2 segments, supporting up to 16 million segments, and encapsulates original Ethernet frames in UDP (port 4789) to extend Layer 2 over a Layer 3 underlay. Multicast is not mandatory, and VTEPs do not require Layer 2 adjacency. The 12-bit identifier is for VLANs, not VXLAN.

Answer

VXLAN tunnel endpoints must be directly connected at Layer 2.

Answer

VXLAN requires a multicast underlay for all deployments.

Answer

VXLAN uses a 12-bit identifier to maintain compatibility with VLANs.

Question 14

A network engineer is configuring a Cisco IOS router to establish a site-to-site VPN with a remote peer using IKEv2. The engineer wants to ensure that the router uses a pre-shared key for authentication and that the IKEv2 proposal uses AES-256 for encryption and SHA-256 for integrity. Which configuration sequence correctly sets up the IKEv2 proposal and keyring?

Accepted Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123. The correct configuration includes the proper IKEv2 proposal with encryption aes-cbc-256 and integrity sha256, and a keyring with both local and remote pre-shared keys. This ensures the router can authenticate with the remote peer using the correct cryptographic parameters.

Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123

Answer

crypto ikev2 policy POLICY1; encryption aes-cbc-256; integrity sha256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key local Cisco123; pre-shared-key remote Cisco123

Answer

crypto ikev2 proposal PROPOSAL1; encryption aes-256; integrity sha-256; group 14; crypto ikev2 keyring KEYRING1; peer PEER1; address 203.0.113.1; pre-shared-key Cisco123

Question 15

A network engineer is configuring a new Cisco IOS router and wants to ensure that OSPFv2 adjacencies form only on the interface that connects to the trusted internal network. The router has three interfaces: GigabitEthernet0/0 (internal), GigabitEthernet0/1 (DMZ), and GigabitEthernet0/2 (Internet). The engineer enables OSPF process 1 and wants to advertise the internal network 10.1.1.0/24 while preventing OSPF from sending or receiving hello packets on the other interfaces. Which configuration accomplishes this goal?

Accepted Answer

router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet0/0. The requirement is to allow OSPF adjacencies only on the internal interface while suppressing them on all others. Setting 'passive-interface default' disables OSPF hello processing on every interface, and then 'no passive-interface GigabitEthernet0/0' re-enables it only on the internal interface. This ensures that OSPF runs exclusively where intended and prevents unintended adjacencies on the DMZ and Internet links.

Answer

router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 passive-interface GigabitEthernet0/1
 passive-interface GigabitEthernet0/2

Answer

router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 ip ospf passive-interface GigabitEthernet0/1
 ip ospf passive-interface GigabitEthernet0/2

Answer

router ospf 1
 network 10.1.1.0 0.0.0.255 area 0
 passive-interface GigabitEthernet0/0