350-401 Multiple Select — 40 Questions

Question 1

Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)

Accepted Answer

A Python script can read a YAML file containing device hostnames and IP addresses, then use that data to connect to each device and gather inventory information.. The correct answers describe practical uses of Python for inventory management and data handling. The incorrect options either misattribute YAML's features (it does not support comments natively in all parsers) or incorrectly state that JSON is always more human-readable than YAML (YAML is often considered more readable).

Answer

YAML files in Python cannot contain comments, so all inventory data must be described without explanatory text.

Answer

JSON is always more human-readable than YAML for complex inventory structures.

Question 2

Which two statements about SD-WAN control plane components are true? (Choose two.)

Accepted Answer

The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.. The vSmart controller is the centralized control plane that distributes OMP routes and policies, while the vBond orchestrator handles authentication and NAT traversal. vManage is the management plane, not a control plane component. vEdge and cEdge are data plane devices. The OMP protocol runs between vSmart and edge devices, not between vManage and vSmart.

Answer

The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.

Answer

vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.

Answer

The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.

Question 3

Which two statements about Python data structures used in network automation are true? (Choose two.)

Accepted Answer

Dictionaries are used to store key-value pairs such as device IP, username, and password.. Correct answers: B and D. B is correct because dictionaries are ideal for storing key-value pairs such as device parameters (IP, username, password). D is correct because lists are ordered and can hold multiple device names or IPs, and they support iteration. A is incorrect because tuples are immutable, so they cannot be modified after creation, which limits their use for dynamic data. C is incorrect because sets are unordered and do not support indexing; they are used for unique elements, not ordered collections. E is incorrect because strings are immutable and not suitable for storing multiple separate values.

Answer

Tuples are commonly used to store device credentials because they can be modified easily.

Answer

Sets are ordered and allow indexing to retrieve specific elements.

Answer

Strings are mutable and ideal for storing multiple device configurations.

Question 4

Which three statements about gRPC and gNMI in the context of model-driven telemetry are true? (Choose three.)

Accepted Answer

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers as its interface definition language.. gRPC uses HTTP/2 for transport and Protocol Buffers for serialization. gNMI is a gRPC-based protocol specifically for network management and telemetry. gNMI supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Set, Get). It uses YANG models to define data paths. gNMI does not require NETCONF; it operates independently over gRPC.

Answer

gNMI telemetry subscriptions can only use YANG paths from OpenConfig models.

Answer

gNMI relies on NETCONF for session establishment and data encoding.

Question 5

Which two statements about IP Source Guard are true? (Choose two.)

Accepted Answer

IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.. IP Source Guard (IPSG) filters IP traffic on a per-port basis using the DHCP snooping binding database. Option A is correct because IPSG uses the binding database to validate source IP addresses. Option D is correct because IPSG can be configured with a static IP source binding for hosts with static IP addresses. Option B is incorrect because IPSG does not filter MAC addresses; that is the role of port security. Option C is incorrect because IPSG is applied on Layer 2 switch ports, not on Layer 3 interfaces. Option E is incorrect because IPSG does not require 802.1X; it can work with DHCP snooping alone.

Answer

IP Source Guard filters traffic based on the source MAC address.

Answer

IP Source Guard is applied on Layer 3 interfaces of a switch.

Answer

IP Source Guard requires 802.1X authentication to function.

Question 6

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

Accepted Answer

YANG models are used to define the data structures streamed in telemetry subscriptions.. YANG models define the structure and constraints of telemetry data. Native models are vendor-specific, while OpenConfig models are standardized. IETF models are also standards-based but not vendor-specific. NETCONF uses YANG but is not a data model. RESTCONF is a protocol, not a model.

Answer

Native YANG models are standardized by the IETF and used universally.

Answer

NETCONF is a YANG data model used for telemetry configuration.

Answer

RESTCONF provides a YANG-based data model for streaming telemetry.

Question 7

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Accepted Answer

The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.. 802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator. Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Answer

The supplicant is the device that provides authentication services, such as a RADIUS server.

Answer

802.1X is only supported on wireless networks and cannot be used on wired switches.

Question 8

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, PUT, POST, DELETE, and PATCH.. The correct answers are B and D. B is correct because RESTCONF uses HTTP methods like GET, PUT, POST, DELETE, and PATCH. D is correct because RESTCONF supports both JSON and XML encoding. A is incorrect because RESTCONF uses HTTP, not SSH. C is incorrect because RESTCONF is not a replacement for NETCONF; they are different protocols. E is incorrect because RESTCONF does not use remote procedure calls (RPCs) in the same way as NETCONF; it uses RESTful operations.

Answer

RESTCONF uses SSH for transport security.

Answer

RESTCONF is designed to replace NETCONF entirely.

Answer

RESTCONF uses remote procedure calls (RPCs) for all operations.

Question 9

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to define data models for NETCONF and RESTCONF.. The correct answers are A, C, and E. A is correct because YANG is used to model configuration and operational data in NETCONF and RESTCONF. C is correct because YANG uses a tree-like hierarchical structure with containers and lists. E is correct because YANG supports data types such as string, int32, and enumeration. B is incorrect because YANG models are not written in XML; they use a custom syntax similar to SMIv2. D is incorrect because YANG modules are not compiled into MIB files; MIBs are for SNMP.

Answer

YANG models are written in XML syntax.

Answer

YANG modules are compiled into MIB files for SNMP.

Question 10

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.. RESTCONF uses HTTP methods to access YANG-defined data on network devices. It supports both XML and JSON encoding. It does not use SSH or TLS natively for transport; it relies on HTTP over TLS (HTTPS) for security. The 'data' resource is the top-level resource for accessing YANG data stores. RESTCONF does not define its own data model; it uses YANG models.

Answer

RESTCONF supports only XML encoding for data.

Answer

RESTCONF uses SSH as the transport protocol.

Answer

RESTCONF defines its own data modeling language.

Question 11

Which three statements about YANG data models are true? (Choose three.)

Accepted Answer

YANG is used to model both configuration and operational state data.. YANG is a data modeling language used to model configuration and state data for network devices. It can define both configuration data (which is writable) and operational state data (which is read-only). YANG models can be augmented using the 'augment' statement to add nodes to an existing model without modifying it. YANG does not define transport protocols; it is used with protocols like NETCONF and RESTCONF. The 'leaf' statement defines a single, scalar data node, not a list.

Answer

YANG defines the transport protocol for data exchange.

Answer

The 'leaf' statement in YANG defines a list of key-value pairs.

Question 12

Which two statements about IP SLA with object tracking are true? (Choose two.)

Accepted Answer

A tracking object can monitor the state of an IP SLA operation and change state when the operation fails.. Object tracking allows IP SLA operations to influence routing decisions. The 'track' command is used to create a tracking object that monitors the state of an IP SLA operation. When the IP SLA operation fails, the tracked object changes state, which can then be used to adjust routing, such as floating static routes. The tracking object can be referenced by multiple routing protocols or static routes. The tracking object does not directly modify the routing table; it provides a state that other features use. The IP SLA operation must be configured before the tracking object can reference it.

Answer

Object tracking can only be used with static routes, not with dynamic routing protocols like EIGRP or OSPF.

Answer

The tracking object automatically modifies the routing table when the IP SLA operation fails.

Answer

An IP SLA operation can be configured after the tracking object that references it.

Question 13

Which two statements about NetFlow flow records and export are correct? (Choose two.)

Accepted Answer

NetFlow v9 uses a template-based export format.. NetFlow v5 has a fixed format with 7 key fields, while v9 is template-based and flexible. IPFIX is the IETF standard based on v9. NetFlow export uses UDP by default (port 2055 for v5, 4729 for IPFIX). TCP is not the default transport.

Answer

NetFlow v5 supports variable-length fields and custom flow keys.

Answer

NetFlow export uses TCP by default to ensure reliable delivery.

Answer

NetFlow v5 can export IPv6 flow information.

Question 14

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 15

Which THREE of the following are benefits of implementing a spine-leaf architecture in a data center?

Accepted Answer

Provides predictable latency for east-west traffic.. Spine-leaf architecture provides predictable latency for east-west traffic because every leaf switch connects to every spine switch, ensuring consistent hop count. It simplifies scalability: adding a new leaf switch requires connecting it to all spine switches without redesign. Additionally, spine-leaf eliminates the need for Spanning Tree Protocol (STP) because it uses Layer 3 routing between leaf and spine switches, removing Layer 2 loops. Therefore, options A, B, and D are correct. Option C is incorrect because spine-leaf increases cabling due to full mesh connectivity. Option E is incorrect because firewall appliances are still required for security.

Answer

Reduces the amount of cabling required.

Answer

Eliminates the need for firewall appliances.

Question 16

Which two statements about PIM sparse mode are true? (Choose two.)

Accepted Answer

PIM sparse mode uses an explicit join model to receive multicast traffic.. PIM sparse mode uses an explicit join model where routers send PIM Join messages toward the RP to join a multicast group. It builds a shared tree (RP-tree) initially, and optionally switches to a source tree (SPT) when traffic exceeds a threshold. PIM dense mode uses flood-and-prune, not sparse mode. PIM-BSR is one method for RP distribution, but not a requirement for sparse mode operation.

Answer

PIM sparse mode routers always use the shortest path tree (SPT) immediately after the first packet is received.

Answer

PIM sparse mode uses a flood-and-prune mechanism to distribute multicast traffic.

Answer

PIM sparse mode requires the use of a bootstrap router (BSR) to operate.

Question 17

Which three statements about virtual networking and hypervisor switches are true? (Choose three.)

Accepted Answer

A standard virtual switch (vSwitch) operates at Layer 2 and can forward frames between virtual machines on the same host.. Virtual switches (vSwitch) forward frames between VMs and physical NICs. They support VLANs and port groups. A distributed switch spans multiple hosts. Virtual switches do not require STP because loops are prevented by design.

Answer

Spanning Tree Protocol (STP) must always be enabled on virtual switches to prevent loops in the virtual network.

Answer

A virtual switch can only be configured with a single port group for all virtual machines.

Question 18

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Accepted Answer

description. The 'description' leaf is a standard attribute in YANG models for interface configuration, providing a human-readable text string to document the interface's purpose. It is defined in the IETF interface model (RFC 8343) and is widely supported across Cisco IOS-XE and NX-OS YANG models.

Answer

switchport mode

Answer

mac address

Question 19

Which three statements about DMVPN phase 2 are true? (Choose three.)

Accepted Answer

Spokes can dynamically establish direct tunnels with each other after learning the destination spoke's public address via NHRP.. DMVPN phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses NHRP to resolve spoke addresses, and supports spoke-to-spoke direct communication without hub forwarding of data traffic. The hub still participates in routing updates. Phase 2 does not support spoke-to-spoke without NHRP resolution, and the spoke does not need a static crypto map for each peer.

Answer

The hub router must be configured with a static crypto map for each spoke.

Answer

Data traffic between spokes is forwarded through the hub by default.

Question 20

Which three statements about Cisco SD-WAN architecture components and their roles are true? (Choose three.)

Accepted Answer

vManage provides a centralized dashboard for configuration, monitoring, and troubleshooting of the entire SD-WAN fabric.. The vManage is the management plane for centralized configuration and monitoring. vSmart is the control plane for route and policy distribution. vBond orchestrates initial authentication and NAT traversal. vEdge routers are data plane devices that forward traffic. vSmart does not handle NAT traversal; that is vBond's role. vManage does not distribute routes; that is vSmart's role.

Answer

vSmart controllers are responsible for NAT traversal and public IP discovery for WAN Edge routers behind NAT.

Answer

vManage distributes OMP routes to vEdge routers to populate the overlay routing table.