350-401 Infrastructure Practice Test 4 — 15 Questions

Question 1

A network engineer is configuring QoS on a Cisco Catalyst switch. The engineer needs to classify traffic based on Layer 2 CoS values and then mark it with a specific DSCP value for use in the IP network. Which two actions should be taken to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a class-map to match CoS values.. To classify traffic based on CoS and mark with DSCP, you need a class-map to match CoS values and a policy-map to set DSCP values. These two configurations define the QoS policy. After creating them, you would apply the policy-map to an interface, but that is an additional step beyond the core classification and marking configuration.

Answer

Configure a class-map to match DSCP values.

Answer

Apply the policy-map to the interface.

Answer

Configure a policy-map to set CoS values.

Question 2

A network administrator is implementing VXLAN with a Cisco Nexus switch acting as a VTEP. The administrator needs to ensure that the underlay network supports the VXLAN traffic. Which two requirements must be met? (Choose two.)

Accepted Answer

The underlay must provide IP reachability between VTEP loopback interfaces.. VXLAN requires that the underlay network provides IP reachability between VTEP loopback interfaces to establish tunnels, and it should support jumbo frames to handle the added encapsulation overhead without fragmentation. Other options like specific routing protocols, multicast, or dedicated VRFs are design choices but not mandatory requirements.

Answer

The underlay must run OSPF or IS-IS for routing.

Answer

The underlay must be configured with a dedicated VRF for VXLAN traffic.

Answer

The underlay must support multicast for BUM traffic replication.

Question 3

A network administrator is deploying a new branch office with a single Cisco IOS router. The administrator needs to configure the router to act as a DHCP server for the local LAN 192.168.10.0/24. Which command must be used to exclude the router's own interface address from the DHCP pool?

Accepted Answer

ip dhcp excluded-address 192.168.10.1. To prevent the DHCP server from assigning the router's own interface address, the 'ip dhcp excluded-address' command must be used. It specifies addresses that are not to be leased. While a range can be excluded, the precise requirement is to exclude the single address. The other options either do not exclude addresses or exclude a range unnecessarily.

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10

Answer

ip dhcp pool LAN; network 192.168.10.0 255.255.255.0; lease 0 8

Answer

ip dhcp pool LAN; network 192.168.10.0 255.255.255.0; default-router 192.168.10.1

Question 4

A network technician is configuring a Cisco IOS switch and needs to verify the current running configuration for VLAN assignments on a specific interface. Which command should the technician use?

Accepted Answer

show running-config interface GigabitEthernet0/1. The correct command is show running-config interface GigabitEthernet0/1, as it displays the current configuration of that specific interface, including VLAN assignments. The other commands either provide summary information, cover all interfaces, or show Layer 3 details, which do not meet the requirement to verify the VLAN configuration on a specific interface.

Answer

show ip interface brief

Answer

show vlan brief

Answer

show interfaces switchport

Question 5

A network engineer is configuring a Cisco IOS switch to authenticate users via 802.1X. The RADIUS server is reachable at 10.1.1.100. The engineer wants to ensure that if the RADIUS server becomes unreachable, authenticated users remain connected and new users are placed in a guest VLAN. Which command set should be applied to the switch?

Accepted Answer

aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet0/1
 authentication port-control auto
 authentication event server dead action authorize vlan 999
 authentication event server dead action authorize keep. The correct configuration uses authentication event server dead action authorize vlan 999 to assign new users to the guest VLAN when the RADIUS server is unreachable, and authentication event server dead action authorize keep to maintain existing authenticated sessions in their current VLAN. This ensures uninterrupted service for authenticated users while providing limited access for new users.

Answer

aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet0/1
 authentication port-control auto
 authentication event server dead action authorize vlan 999
 authentication event server alive action reinitialize

Answer

aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet0/1
 authentication port-control auto
 authentication event server dead action authorize vlan 999
 authentication event fail action authorize vlan 999

Answer

aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet0/1
 authentication port-control auto
 authentication event server dead action authorize vlan 999
 authentication event server dead action reinitialize vlan 999

Question 6

A network engineer is configuring QoS on a Cisco Catalyst switch. The engineer needs to classify traffic based on Layer 2 CoS values and then mark it with a specific DSCP value for use in the IP network. Which two actions should be taken to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

class-map match-any VOICE
 match dscp ef. To classify voice traffic marked with DSCP EF, a class-map with 'match dscp ef' is used. This identifies the traffic for further QoS actions, such as priority queuing. While marking and queuing are important, the classification step is fundamental. The class-map is then referenced in a policy-map where actions like priority are applied. The other options either perform marking without classification or apply queuing without classification.

Answer

policy-map MARKING
 class VOICE
  set dscp ef

Answer

interface GigabitEthernet0/1
 service-policy input MARKING

Answer

policy-map PRIORITY
 class VOICE
  priority percent 30

Question 7

A network engineer is implementing QoS on a Cisco IOS-XE router. The engineer needs to ensure that voice traffic is marked with DSCP EF and that the router trusts the markings from an IP phone while re-marking traffic from a PC connected to the phone's PC port. Which trust boundary configuration should be applied on the switch port connected to the IP phone?

Accepted Answer

mls qos trust device cisco-phone. The correct configuration is mls qos trust device cisco-phone, which provides conditional trust for Cisco IP phones. This ensures that DSCP markings from the phone are trusted, while traffic from a PC attached to the phone's PC port is not trusted and can be re-marked. Other trust commands either trust all traffic or extend trust to the PC, which is not desired.

Answer

mls qos trust cos

Answer

mls qos trust extend

Answer

mls qos trust dscp

Question 8

A network engineer is configuring a GRE tunnel between two Cisco routers. The engineer notices that the tunnel interface is up, but OSPF adjacencies are not forming over the tunnel. The physical interfaces are up, and there is IP connectivity between the tunnel endpoints. What is the most likely cause?

Accepted Answer

The OSPF network type on the tunnel interface is not configured correctly.. When a GRE tunnel is up but OSPF adjacencies fail, the OSPF network type on the tunnel interface is often the culprit. GRE tunnels can default to different network types depending on configuration, and if the network type does not allow multicast hello packets, adjacencies will not form. Ensuring the correct network type (e.g., point-to-point or broadcast) resolves the issue. Other options are less likely given the tunnel is up and IP connectivity exists.

Answer

The tunnel source and destination are not reachable.

Answer

The tunnel interface IP addresses are in different subnets.

Answer

The OSPF hello and dead timers are mismatched.

Question 9

A network engineer is configuring a Cisco IOS router to authenticate OSPFv2 neighbor adjacencies with SHA-256 HMAC on interface GigabitEthernet0/0. The router must not send the key in cleartext. Which configuration sequence correctly enables this authentication on the interface?

Accepted Answer

Create a key chain with key 1, set cryptographic-algorithm hmac-sha-256 and a key-string, then under the interface configure ip ospf authentication key-chain <name>.. OSPFv2 supports SHA-256 HMAC authentication through key chains, which provide stronger security than MD5. The interface command ip ospf authentication key-chain references a globally defined key chain that specifies the algorithm and key string. This avoids cleartext transmission and meets the requirement. Other methods either use MD5, disable authentication, or apply to OSPFv3.

Answer

Under the interface, configure ip ospf authentication null, then enable ip ospf message-digest-key 1 sha-256 <key>.

Answer

Under the OSPF process, configure area 0 authentication message-digest, then define a key chain with key 1 and cryptographic-algorithm hmac-sha-256, and apply the key chain under the interface.

Answer

Under the interface, configure ip ospf authentication message-digest, then under the OSPF process configure area 0 authentication message-digest, and set the key with ip ospf message-digest-key 1 md5 <key>.

Question 10

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires client traffic to be tunneled back to the WLC and then switched onto the wired network. The engineer also needs to ensure that the WLAN supports seamless roaming for voice clients. Which two statements are true regarding the configuration of this WLAN? (Choose two.)

Accepted Answer

The WLAN must be configured in central switching mode to tunnel client traffic to the WLC.. The correct statements are that the WLAN must be in central switching mode to tunnel traffic to the WLC, and that 802.11r must be configured to support fast roaming for voice clients. Central switching ensures traffic is tunneled, and 802.11r reduces roaming latency, which is critical for voice. Other options are either incorrect modes or not required for the scenario.

Answer

The WLAN must be configured in local switching mode to support seamless roaming.

Answer

The WLAN must be configured with 802.11k to support seamless roaming.

Answer

The WLAN must be configured with a mobility anchor to support seamless roaming.

Question 11

A network administrator is configuring a switch port as a trunk to a downstream switch. The interface is currently in access mode. Which command sequence correctly places the interface into trunk mode and restricts allowed VLANs to 10 and 20?

Accepted Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20. The correct configuration requires setting the interface to trunk mode and then specifying the allowed VLANs. The order matters: 'switchport mode trunk' must be entered before 'switchport trunk allowed vlan' to ensure the port is in trunk mode when applying VLAN restrictions.

Answer

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode access
 switchport trunk allowed vlan 10,20

Answer

interface GigabitEthernet0/1
 switchport mode dynamic desirable
 switchport trunk allowed vlan 10,20

Answer

interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,20
 switchport mode trunk

Question 12

A network engineer is configuring a Cisco IOS router to use PBR to route traffic from a specific subnet to a next-hop that is not in the routing table. The engineer applies a route map to the incoming interface. Which additional configuration is required for PBR to work correctly?

Accepted Answer

Ensure the next-hop IP address is reachable via a route in the routing table or a static route.. PBR can override the routing table for matching traffic, but the next-hop specified in the route map must be reachable. If the next-hop is not in the routing table, you must add a static route to it, even if it is not the final destination. Without reachability, PBR will fail to forward the packet. The other options are either already done or irrelevant to the scenario.

Answer

Enable 'ip policy route-map' on the interface.

Answer

Configure 'ip route-cache policy' on the interface.

Answer

Enable 'ip local policy route-map' globally.

Question 13

A network engineer is configuring a GRE tunnel between two Cisco IOS routers. The tunnel source is GigabitEthernet0/0 (IP 10.1.1.1) and the tunnel destination is 10.2.2.2. The engineer wants to ensure that the tunnel interface has an IP address of 172.16.1.1/30 and that the tunnel uses the default GRE protocol. Which command set is correct?

Accepted Answer

interface Tunnel0
 ip address 172.16.1.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 10.2.2.2
 tunnel mode gre ip. The correct configuration creates a GRE tunnel with the specified IP address, sets the source to GigabitEthernet0/0, sets the destination to 10.2.2.2, and explicitly sets the tunnel mode to GRE IP. The tunnel mode gre ip command is the default, but including it ensures the correct encapsulation. This establishes a basic GRE tunnel without encryption.

Answer

interface Tunnel0
 ip address 172.16.1.1 255.255.255.252
 tunnel source 10.1.1.1
 tunnel destination 10.2.2.2
 tunnel mode gre ip

Answer

interface Tunnel0
 ip address 172.16.1.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 10.2.2.2
 tunnel mode ipsec ipv4

Answer

interface Tunnel0
 ip address 172.16.1.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 10.2.2.2
 tunnel protection ipsec profile default

Question 14

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus switches. The underlay is a Layer 3 IP network, and the overlay uses BGP EVPN as the control plane. Which two statements are true regarding the operation of this fabric? (Choose two.)

Accepted Answer

The NVE interface is used to define the local VTEP and is associated with the VXLAN VNIs.. The NVE interface defines the local VTEP and associates VNIs, while BGP EVPN Route Type 2 advertisements distribute MAC and IP bindings. These are core to EVPN operation. The other statements are either incorrect or not directly related to the control plane behavior described.

Answer

The underlay network must run OSPF to support EVPN route distribution.

Answer

VTEPs establish VXLAN tunnels by flooding unknown unicast traffic to all VTEPs in the same VNI.

Answer

VXLAN uses a 24-bit VNI field, allowing up to 16 million unique network segments.

Question 15

A network engineer is deploying a Cisco SD-Access fabric and needs to configure the underlay network. The engineer must ensure that the underlay provides reachability between all fabric nodes and supports the overlay. Which two routing protocol characteristics are recommended for the underlay? (Choose two.)

Accepted Answer

Use BGP as the underlay routing protocol.. The recommended underlay routing protocols for Cisco SD-Access are IS-IS and BGP. IS-IS is preferred for its scalability and flexibility, while BGP is used for larger or more complex fabrics. Both provide the necessary reachability between fabric nodes and support the overlay. OSPF and EIGRP are not primary recommendations, and VXLAN is an overlay technology, not an underlay routing protocol.

Answer

Use OSPF as the underlay routing protocol.

Answer

Use EIGRP as the underlay routing protocol.

Answer

Enable VXLAN encapsulation on all underlay links.