350-401 Infrastructure Practice Test 8 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to provide first-hop redundancy using VRRP. The engineer wants to ensure that the virtual IP address is 10.1.1.1 and that the router with the highest priority becomes the master. Which configuration should be applied to the interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vrrp 1 ip 10.1.1.1 and vrrp 1 priority 200. VRRP uses a priority value to elect the master router. The default priority is 100, and higher values are preferred. The valid range is 1-254, with 255 reserved for the IP address owner. Setting a priority of 200 on the intended master ensures it becomes master over routers with default priority, without using the reserved value. The virtual IP is configured with the 'vrrp group ip' command.

Answer

vrrp 1 ip 10.1.1.1 and vrrp 1 priority 100

Answer

vrrp 1 ip 10.1.1.1 and vrrp 1 priority 255

Answer

vrrp 1 ip 10.1.1.1 and vrrp 1 priority 254

Question 2

A network engineer is configuring a new switch port as a trunk to carry VLANs 10, 20, and 30. The engineer enters the commands: 'switchport mode trunk', 'switchport trunk allowed vlan 10,20,30', and 'switchport trunk native vlan 99'. After connecting the trunk to another switch, the engineer notices that traffic from VLAN 99 is being tagged on the link. What is the most likely cause?

Accepted Answer

The other end of the trunk has a different native VLAN configured.. A native VLAN mismatch on a trunk link causes untagged frames from one switch to be tagged with the other switch's native VLAN, leading to the observed tagging of VLAN 99 traffic. The correct resolution is to ensure both ends of the trunk have the same native VLAN configured, typically using the 'switchport trunk native vlan' command. This maintains proper VLAN segmentation and prevents traffic leakage.

Answer

The native VLAN is not allowed on the trunk.

Answer

The native VLAN must be explicitly allowed with the 'switchport trunk allowed vlan add' command.

Answer

The 'switchport trunk allowed vlan' command overrides the native VLAN tagging.

Question 3

A network administrator is configuring a Cisco IOS router to support a site-to-site VPN using IPsec. The administrator wants to ensure that the VPN tunnel is established only when there is interesting traffic, and that the tunnel is torn down after a period of inactivity. Which IPsec configuration element should be adjusted?

Accepted Answer

Adjust the IPsec security association (SA) idle timeout.. The requirement is to establish the tunnel only on interesting traffic and tear it down after inactivity. This is controlled by the IPsec SA idle timeout, which specifies how long the tunnel remains idle before being torn down. The crypto ACL defines interesting traffic but does not manage the idle timeout.

Answer

Configure a crypto ACL to define interesting traffic.

Answer

Enable Perfect Forward Secrecy (PFS) in the crypto map.

Answer

Set the crypto map to use the 'respond-only' keyword.

Question 4

A network engineer is configuring OSPFv3 on a Cisco IOS router. The engineer wants to enable OSPFv3 on an interface and ensure it participates in the OSPFv3 process. Which two commands are required to enable OSPFv3 on an interface? (Choose two.)

Accepted Answer

ipv6 enable. To enable OSPFv3 on a Cisco IOS interface, you must first enable IPv6 on the interface with the 'ipv6 enable' command (or assign an IPv6 address), and then enable OSPFv3 with the 'ipv6 ospf process-id area area-id' command. These two commands are the minimum required in interface configuration mode to activate OSPFv3 on that interface.

Answer

router ospf 1

Answer

ipv6 address autoconfig

Answer

ipv6 router ospf 1

Question 5

A network engineer is configuring QoS on a Cisco IOS router. The engineer wants to classify traffic based on the DSCP value in the IP header and then mark it with a new DSCP value. The engineer also wants to ensure that the marking is applied to all packets in a flow, not just the first packet. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Configure a policy map to set the new DSCP value.. To classify traffic based on DSCP and mark it with a new DSCP value, the engineer must first create a class map to match the existing DSCP value, then create a policy map to set the new DSCP value. These two actions define the classification and marking logic. The policy map is then applied to an interface, but that is an additional step not part of the two required actions for the logic itself.

Answer

Enable NBAR protocol discovery on the interface.

Answer

Apply the policy map to the interface using the service-policy command.

Answer

Configure a route map to match the DSCP value and set the new value.

Question 6

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2. The tunnel source on R1 is GigabitEthernet0/0 with IP 192.168.1.1, and the tunnel destination is 192.168.2.2 (R2's GigabitEthernet0/0). The engineer wants to ensure that the tunnel interface can forward multicast traffic. Which additional configuration is required on the tunnel interface?

Accepted Answer

No additional configuration is required; GRE tunnels support multicast by default.. GRE tunnels support multicast traffic by default. The tunnel interface itself does not require any additional configuration to forward multicast; however, global multicast routing and PIM on the tunnel interface may be needed for multicast routing to function. The question specifically asks for configuration on the tunnel interface, and no additional command is required there for multicast forwarding.

Answer

Enable 'ip pim sparse-mode' on the tunnel interface.

Answer

Configure 'ip multicast-routing' globally on both routers.

Answer

Configure 'tunnel mode gre multipoint' on both routers.

Question 7

A network engineer is deploying a new branch office that requires a lightweight routing protocol with fast convergence and support for VLSM. The engineer wants to use EIGRP but needs to verify that the router supports the necessary feature to advertise subnet masks in routing updates. Which EIGRP feature must be enabled to allow the router to advertise VLSM information?

Accepted Answer

Disable automatic summarization with the no auto-summary command.. EIGRP automatically summarizes routes at classful boundaries by default, which can prevent the advertisement of VLSM subnets. To support VLSM, automatic summarization must be disabled using the no auto-summary command. This allows EIGRP to include subnet mask information in its updates, ensuring that specific subnets are advertised correctly. Other options do not address the VLSM requirement or may even hinder it.

Answer

Enable EIGRP automatic summarization.

Answer

Configure the router to use EIGRP named mode.

Answer

Enable EIGRP stub routing on the branch router.

Question 8

A network engineer is implementing VXLAN with BGP EVPN on Cisco Nexus switches. The engineer wants to ensure that the underlay network provides sufficient redundancy and load balancing for VXLAN traffic. Which routing protocol feature should be configured on the underlay to achieve equal-cost multipath (ECMP) load balancing?

Accepted Answer

BGP with address-family IPv4 unicast and maximum-paths. In a VXLAN EVPN fabric, the underlay network must support ECMP to distribute traffic across multiple paths. BGP with the IPv4 unicast address family and 'maximum-paths' configured enables the router to install multiple equal-cost routes, providing load balancing. This is a standard design in Cisco data center networks, ensuring high availability and efficient use of bandwidth for VXLAN-encapsulated traffic.

Answer

EIGRP with variance 1

Answer

IS-IS with default metric

Answer

OSPF with default cost metrics

Question 9

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2. R1's tunnel interface is configured with 'tunnel source GigabitEthernet0/0' and 'tunnel destination 203.0.113.2'. R2's tunnel source is GigabitEthernet0/0 and destination is 203.0.113.1. The engineer notices that the tunnel interface is up, but no traffic is passing through. What is the most likely cause?

Accepted Answer

The tunnel interface is not included in the routing protocol configuration.. When a GRE tunnel is up but traffic is not passing, a common cause is that the tunnel interface is not participating in the routing protocol. The tunnel interface must be added to the routing protocol configuration so that routes can be exchanged over the tunnel. Without this, the tunnel will not carry dynamic routing updates, and traffic may not be routed through it.

Answer

The tunnel destination IP address is not reachable from the tunnel source.

Answer

There is no route in the routing table for the tunnel destination.

Answer

The tunnel mode is not set to GRE.

Question 10

A network engineer is implementing VXLAN on Cisco Nexus 9000 switches to extend Layer 2 segments across a routed data center core. The engineer must ensure that the underlay network provides equal-cost multipathing and fast convergence for the VXLAN tunnels. Which routing protocol should be configured as the underlay?

Accepted Answer

BGP with EVPN address family. BGP EVPN is the preferred underlay routing protocol for VXLAN because it provides a scalable, standards-based control plane that supports equal-cost multipathing and fast convergence. It integrates seamlessly with VXLAN data plane encapsulation and allows for multi-tenancy and policy enforcement. The other protocols either lack the necessary convergence speed, scalability, or open-standard support required for a robust VXLAN underlay in a routed data center core.

Answer

RIPng with equal-cost load balancing

Answer

OSPFv2 with point-to-point links

Answer

EIGRP with wide metrics

Question 11

A network engineer is configuring OSPFv2 on a multiarea network. The engineer needs to ensure that OSPF routers in different areas can exchange routes and that the topology remains stable. Which two statements about OSPF area types and LSA propagation are true? (Choose two.)

Accepted Answer

An NSSA allows external routes to be injected as Type 7 LSAs and translated to Type 5 LSAs by the ABR before entering the backbone.. Stub areas block Type 5 LSAs and rely on a default route from the ABR, while NSSAs allow external routes as Type 7 LSAs that the ABR translates to Type 5 for the backbone. These area types reduce link-state database size and improve stability. The other statements misrepresent LSA flooding scope and area restrictions.

Answer

Type 1 Router LSAs are flooded unchanged across area boundaries to ensure all routers have a consistent view of the topology.

Answer

A totally stubby area allows Type 3, Type 4, and Type 5 LSAs to be flooded into the area.

Answer

Type 3 LSAs are generated by the ABR to describe interarea routes and are flooded into the backbone area only.

Question 12

A network engineer is configuring a Cisco IOS router to provide first-hop redundancy using VRRP. The engineer wants to ensure that the virtual IP address is 10.1.1.1 and that the router with the highest priority becomes the master. Which configuration should be applied to the interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure 'netconf-yang' and ensure SSH is enabled with 'ip ssh version 2'.. To enable NETCONF over SSH, you must configure 'netconf-yang' to start the NETCONF agent and ensure SSH is enabled with 'ip ssh version 2'. This allows the router to be managed via NETCONF on port 830. Other options either use incorrect commands or enable different protocols like RESTCONF.

Answer

Configure 'restconf' and 'ip http secure-server' globally.

Answer

Configure 'netconf ssh' and 'ip ssh version 2' globally.

Answer

Configure 'netconf-yang' and 'netconf-yang ssh port 830' globally.

Question 13

A network engineer is configuring a Cisco IOS router to provide first-hop redundancy using VRRP. The engineer wants to ensure that the virtual IP address is 10.1.1.1 and that the router with the highest priority becomes the master. Which configuration should be applied to the interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

interface GigabitEthernet0/0
 vrrp 1 ip 10.1.1.1
 vrrp 1 priority 255. To guarantee that a specific router becomes the VRRP master, it must have the highest priority in the group. The maximum priority is 255, which is reserved for the address owner in standard VRRP, but Cisco allows it to be configured on any router. Setting priority 255 ensures this router wins the election and becomes master. Other priorities do not provide the same guarantee.

Answer

interface GigabitEthernet0/0
 vrrp 1 ip 10.1.1.1
 vrrp 1 priority 100

Answer

interface GigabitEthernet0/0
 vrrp 1 ip 10.1.1.1
 vrrp 1 priority 254

Answer

interface GigabitEthernet0/0
 vrrp 1 ip 10.1.1.1
 vrrp 1 priority 0

Question 14

A network engineer is configuring a Cisco IOS router to provide first-hop redundancy using VRRP. The engineer wants to ensure that the virtual IP address is 10.1.1.1 and that the router with the highest priority becomes the master. Which configuration should be applied to the interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vrrp 10 timers advertise 1. To achieve sub-second VRRP failover, the advertisement interval must be configured in milliseconds. The command vrrp 10 timers advertise msec 300 sets the interval to 300 milliseconds, so the master-down interval is three times that, or 900 milliseconds, which is within 1 second. The other commands either set intervals too long, affect preemption delay, or change priority without impacting failover speed.

Answer

vrrp 10 timers advertise 3

Answer

vrrp 10 preempt delay minimum 1

Answer

vrrp 10 priority 255

Question 15

A network administrator is configuring a Cisco IOS switch to authenticate users connecting to a switch port using 802.1X. The administrator wants to ensure that if the RADIUS server is unreachable, the port is placed in a restricted VLAN. Which command should be used to configure this behavior?

Accepted Answer

authentication event server dead action authorize vlan 10 restricted. When the RADIUS server is unreachable, the 'authentication event server dead action authorize vlan' command with the 'restricted' keyword places the port into a restricted VLAN. This provides limited network access, often for remediation or guest services, while maintaining security. The restricted VLAN feature is part of Cisco's Identity-Based Networking Services (IBNS) and is configured on the switch port to handle server failures gracefully.

Answer

authentication event fail action authorize vlan 10

Answer

authentication event no-response action authorize vlan 10

Answer

authentication event server dead action authorize vlan 10