350-401 Multiple Select — 50 Questions

Question 1

A network engineer is deploying Cisco SD-WAN in a hybrid cloud environment. The company requires secure segmentation between guest, employee, and IoT traffic across all branches. The engineer must ensure that traffic from each segment is isolated and that policies can be applied per segment. Which two components are used to achieve this segmentation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPN segments in vManage. In Cisco SD-WAN, segmentation is achieved by creating VPN segments in vManage and mapping them to VRF instances on the WAN Edge devices. The VPN segments define the logical separation, and the VRFs enforce it by maintaining separate routing and forwarding tables. Together, they provide end-to-end isolation and allow policies to be applied per segment. Other options like VLANs or IPsec tunnels do not provide fabric-wide segmentation, and application-aware routing policies are for path selection, not isolation.

Answer

Application-aware routing policies

Answer

IPsec tunnels between branches

Answer

VLANs on the WAN Edge routers

Question 2

Which two statements about Type 1 and Type 2 hypervisors are true? (Choose two.)

Accepted Answer

A Type 1 hypervisor runs directly on the physical hardware without a host operating system.. Option A is correct because a Type 1 (bare-metal) hypervisor, such as VMware ESXi, Microsoft Hyper-V Server, or Citrix XenServer, installs and runs directly on the physical hardware and does not require an underlying host operating system. Option D is correct because VMware Workstation is a Type 2 (hosted) hypervisor that installs as an application on top of an existing host OS like Windows or Linux. Option B is incorrect because it describes a Type 1, not a Type 2, hypervisor — Type 2 hypervisors require a host operating system. Option C is incorrect because VMware ESXi is a Type 1 bare-metal hypervisor, not Type 2. Option E is incorrect because Type 1 hypervisors are typically deployed in data centers and server virtualization scenarios, whereas Type 2 hypervisors are more commonly used for desktop virtualization and testing.

Answer

A Type 2 hypervisor runs directly on the physical hardware without a host operating system.

Answer

VMware ESXi is an example of a Type 2 hypervisor.

Answer

Type 1 hypervisors are typically used for desktop virtualization in enterprise environments.

Question 3

Which three statements about BGP route reflectors are true? (Choose three.)

Accepted Answer

Route reflectors allow iBGP speakers to advertise routes learned from other iBGP speakers without requiring a full mesh.. Option A is correct because a route reflector relaxes the iBGP full-mesh requirement by reflecting routes learned from one iBGP peer to other iBGP peers (its clients and non-clients), so speakers no longer need direct sessions with every other iBGP speaker. Option C is correct because route reflectors can be arranged in a hierarchy: a route reflector can itself be a client of a higher-level route reflector, allowing large ASes to scale beyond a single cluster. Option D is correct because the CLUSTER_ID attribute (a 4-byte value, often derived from the router ID) identifies the cluster and lets a route reflector detect and drop routes that have already been reflected, preventing loops within the cluster. Option B is not correct because route reflector clients do not need to be fully meshed with each other; they only peer with the route reflector, which is the whole point of the design. Option E is not correct because loop prevention in route reflection is handled by ORIGINATOR_ID and CLUSTER_ID (and CLUSTER_LIST), not by modifying AS_PATH, which is used for inter-AS loop prevention in eBGP.

Answer

A route reflector client must be fully meshed with all other clients in the same cluster.

Answer

The route reflector modifies the AS_PATH attribute to prevent loops.

Question 4

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 5

Which three statements about VRF path isolation in a service provider network are true? (Choose three.)

Accepted Answer

VRFs allow multiple customers to share the same physical infrastructure while keeping their traffic isolated.. Option A is correct because a VRF (Virtual Routing and Forwarding) instance creates a separate routing table on the same physical router, so multiple customers can share the provider's physical infrastructure while their traffic and routing information remain logically isolated. Option B is correct because in MPLS L3VPN, each VRF is associated with route targets (extended BGP communities) that control which routes are exported from and imported into the VRF, thereby governing route distribution between PE routers. Option C is correct because VRF-aware features such as NAT, QoS, and ACLs can be configured within a specific VRF context, allowing per-VRF policy enforcement that maintains path isolation between customers. Option D is not correct because VRFs operate at Layer 3 by separating routing tables, whereas VLANs provide Layer 2 broadcast-domain isolation; VRF does not replace VLANs for Layer 2 segmentation. Option E is not correct because VRF-lite achieves isolation using separate routing/forwarding tables and interfaces (typically without MPLS), not by using MPLS labels.

Answer

VRF can be used to replace VLANs for Layer 2 isolation.

Answer

In VRF-lite, path isolation is achieved using MPLS labels.

Question 6

Which two statements about VRF-lite configuration are true? (Choose two.)

Accepted Answer

In VRF-lite, each VRF maintains its own independent routing table.. Option A is correct because VRF-lite creates separate virtual routing and forwarding instances, each with its own independent routing and forwarding table (RIB/FIB), which is the core purpose of VRF-lite—traffic isolation without MPLS. Option B is correct because on Cisco IOS/IOS-XE, an interface is bound to a VRF by entering interface configuration mode and issuing the 'ip vrf forwarding <vrf-name>' command, which associates the interface's Layer 3 traffic with that VRF's routing table. Option C is incorrect because VRF-lite specifically does not require MPLS; it is the MPLS-free variant of VRF used for path isolation on a single device or with plain 802.1Q trunks. Option D is incorrect because inter-VRF communication can be achieved with various methods, including route leaking via static routes, dynamic routing protocols, or external devices—not static routes exclusively. Option E is incorrect because a router can support many VRFs (hundreds or thousands depending on platform resources), not a maximum of two.

Answer

VRF-lite requires MPLS enabled on all interfaces.

Answer

VRF-lite can only use static routes for inter-VRF communication.

Answer

A router can have at most two VRFs configured.

Question 7

Which two statements about Ansible modules and idempotency are true? (Choose two.)

Accepted Answer

Idempotency means that running a playbook multiple times will always result in the same final state on the managed node.. Option A is correct because idempotency in Ansible means that executing the same playbook repeatedly converges the managed node to the same desired final state without making unnecessary changes on subsequent runs. Option C is correct because the copy module compares the checksum (SHA-1 by default) of the source content against the destination file and only transfers the file when they differ, so repeated runs report 'ok' instead of 'changed'. Option B is wrong because the command module is not idempotent by default—it executes the given command every time unless you add guards such as creates, removes, or changed_when. Option D is wrong because idempotency is a property of how each module is implemented, not an automatic guarantee for all modules. Option E is wrong because idempotency applies broadly across module types, including Linux system modules like yum, apt, service, and file.

Answer

The 'command' module is idempotent by default because it always runs the given command.

Answer

All Ansible modules are inherently idempotent regardless of how they are implemented.

Answer

Idempotency only applies to network modules, not to Linux system modules.

Question 8

A network administrator is deploying a Cisco SD-Access fabric and needs to ensure that the underlay network is properly configured. Which two statements about the underlay network in SD-Access are true? (Choose two.)

Accepted Answer

The underlay must support MTU sizes large enough to accommodate VXLAN encapsulation overhead.. The underlay in SD-Access provides IP connectivity between fabric nodes using a routing protocol like IS-IS or OSPF, and it must support a larger MTU to accommodate VXLAN encapsulation overhead. The underlay does not carry endpoint subnet information; that is the role of the overlay. It is a Layer 3 network, not Layer 2, and it does not use VXLAN for encapsulation.

Answer

The underlay can be configured as a Layer 2 network with VLANs to simplify deployment.

Answer

The underlay network carries endpoint subnet information and is used for endpoint-to-endpoint communication.

Answer

The underlay uses VXLAN to encapsulate traffic between fabric nodes.

Question 9

Which two statements about RESTCONF are true? (Choose two.)

Accepted Answer

RESTCONF uses HTTP methods such as GET, PUT, POST, DELETE, and PATCH.. Option B is correct because RESTCONF is a RESTful protocol that maps CRUD operations onto standard HTTP methods — GET to retrieve data, POST to create, PUT to replace, PATCH to modify, and DELETE to remove resources — as defined in RFC 8040. Option D is correct because RESTCONF supports both JSON (the default, media type application/yang-data+json) and XML (application/yang-data+xml) encoding for representing YANG-modeled data. Option A is incorrect because RESTCONF runs over HTTPS (HTTP over TLS, typically port 443), not SSH; SSH is the transport used by NETCONF. Option C is incorrect because RESTCONF is not intended to replace NETCONF entirely — it is a complementary, lightweight HTTP-based alternative, and NETCONF remains widely used for full configuration and RPC capabilities. Option E is incorrect because RESTCONF uses HTTP methods for operations rather than RPCs; RPC-style operations are characteristic of NETCONF, and RESTCONF only supports a limited RPC mechanism via POST to specific operation resources.

Answer

RESTCONF uses SSH for transport security.

Answer

RESTCONF is designed to replace NETCONF entirely.

Answer

RESTCONF uses remote procedure calls (RPCs) for all operations.

Question 10

A network administrator is deploying Cisco ACI in a data center. The administrator must configure a bridge domain that allows Layer 2 connectivity between endpoints in the same tenant while also providing Layer 3 gateway services. The design requires that the bridge domain support both unicast routing and unknown unicast flooding. Which two settings must be enabled on the bridge domain to meet these requirements? (Choose two.)

Accepted Answer

Enable unicast routing on the bridge domain.. To provide Layer 3 gateway services, the bridge domain must have unicast routing enabled so it can route between subnets. To support unknown unicast flooding, the bridge domain must have unknown unicast flooding enabled. These two settings directly address the scenario's requirements, while other features like ARP flooding, IGMP snooping, and DHCP relay serve different purposes.

Answer

Enable DHCP relay on the bridge domain.

Answer

Enable IGMP snooping on the bridge domain.

Answer

Enable ARP flooding on the bridge domain.

Question 11

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that provides Layer 2 connectivity between endpoints in the same tenant. Which two statements about Cisco ACI bridge domains are true? (Choose two.)

Accepted Answer

A bridge domain can contain multiple subnets.. In Cisco ACI, a bridge domain is a Layer 2 construct that can contain multiple subnets and must be associated with a VRF to enable Layer 3 routing. The VRF provides the routing context, and multiple subnets allow flexible IP addressing within the same bridge domain. VLAN pools are used for VLAN allocation but are not a direct requirement for the bridge domain itself.

Answer

A bridge domain requires a VLAN pool to be defined in the fabric access policies.

Answer

A bridge domain can only contain a single subnet.

Answer

A bridge domain provides Layer 3 routing between subnets by default.

Question 12

A network architect is designing a data center fabric that uses VXLAN with an EVPN control plane on Cisco Nexus 9000 switches. The architect must justify why EVPN is preferred over a flood-and-learn VXLAN data plane. Which two statements correctly describe advantages of using an EVPN control plane in this design? (Choose two.)

Accepted Answer

It distributes MAC address reachability through BGP so VTEPs do not need to flood frames to learn remote host locations. An EVPN control plane advertises MAC and IP reachability via BGP, avoiding data-plane flooding for host learning, and it supports standards-based all-active multihoming through Ethernet Segment identifiers and DF election. It does not remove the underlay routing requirement, convert VXLAN to MPLS, or eliminate the VTEP loopback, so those statements are incorrect for this design.

Answer

It converts VXLAN tunnels into MPLS LSPs to improve forwarding performance between leaf switches

Answer

It eliminates the need for any underlay routing protocol because BGP carries all traffic between leaf switches

Answer

It removes the requirement for a loopback interface on each VTEP by using physical interface addresses

Question 13

Which three statements about IP SLA probe types and their characteristics are true? (Choose three.)

Accepted Answer

The UDP jitter operation measures one-way delay, jitter, and packet loss in both directions.. Option A is correct because the UDP jitter operation sends a stream of UDP packets and, with an IP SLA responder on the far end, reports one-way delay (both directions), positive and negative jitter (inter-packet delay variation), and packet loss in each direction. Option B is correct because the ICMP echo operation measures round-trip time by sending ICMP Echo Requests, and the resulting per-probe RTT samples can be used to derive jitter statistics. Option C is correct because the TCP connect operation times how long it takes to complete the TCP three-way handshake (SYN, SYN-ACK, ACK) with a target host and port, which is useful for verifying application reachability. Option D is not correct because DNS resolution timing is provided by the DNS operation, not the HTTP operation, which measures transaction time such as connect, request, and response. Option E is not correct because ICMP echo works without an IP SLA responder on the target; the responder is required for operations like UDP jitter that need timestamping and packet generation support.

Answer

The HTTP operation measures the time to resolve the DNS name of the target web server.

Answer

The ICMP echo operation requires the IP SLA responder to be enabled on the target device.

Question 14

A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)

Accepted Answer

AP channel utilization and interference. To diagnose high retry rates and low SNR, the engineer should examine RF-related metrics. Client RSSI and SNR trends reveal signal quality and potential coverage gaps. AP channel utilization and interference show if the channel is congested or noisy. Together, these metrics help identify whether the issue is due to distance, interference, or channel overlap. Other metrics like switch CPU, WAN latency, or DHCP utilization do not directly address wireless RF performance.

Answer

Switch CPU utilization

Answer

DHCP pool utilization

Answer

WAN latency and jitter

Question 15

A network security team is hardening a Cisco IOS-XE router that terminates a site-to-site VPN to the internet. They want to ensure that the router itself cannot be managed from untrusted networks and that its management protocols are protected. Which two configuration actions achieve these goals? (Choose two.)

Accepted Answer

Apply an access list to the VTY lines that permits only trusted management subnets and add the transport input ssh command. Hardening the management plane requires restricting who can reach the management interfaces and how. Limiting VTY access with an ACL to trusted subnets and forcing SSH eliminates cleartext and unauthorized remote logins, while an interface ACL that blocks SNMP and NETCONF from untrusted sources prevents those services from being exploited from the internet. Together these actions protect the router's management plane without disrupting the site-to-site VPN traffic.

Answer

Enable the exec-timeout 0 0 command on all VTY lines to prevent session lockouts during maintenance

Answer

Configure a local username with privilege level 15 and no password to ensure emergency access is always available

Answer

Enable the ip http server command to allow web-based management as a backup access method

Question 16

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Accepted Answer

Enables Layer 2 extension across Layer 3 boundaries.. VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Answer

Eliminates the need for STP by using a centralized controller.

Answer

Uses only multicast for control plane learning.

Answer

Provides native encryption for data in transit.

Question 17

A network engineer is implementing VXLAN with an EVPN control plane in a data center. The engineer must ensure that the underlay network supports the required traffic and that the overlay provides optimal forwarding. Which two statements are true regarding this implementation? (Choose two.)

Accepted Answer

EVPN uses MP-BGP to distribute MAC and IP address reachability information.. EVPN uses MP-BGP to distribute MAC and IP reachability, enabling control-plane learning and features like ARP suppression. ARP suppression reduces broadcast traffic by allowing VTEPs to answer ARP requests locally. Multicast is not required in the underlay because EVPN uses ingress replication for BUM traffic. The underlay must be Layer 3, and VTEPs can be in different subnets as long as they are reachable.

Answer

The underlay network must be a Layer 2 network to carry VXLAN traffic.

Answer

EVPN requires that all VTEPs be in the same subnet.

Answer

The underlay network must support multicast for BUM traffic replication.

Question 18

A network engineer is configuring a Cisco IOS XE router to support a site-to-site VXLAN tunnel over an existing IP underlay. The engineer must configure the NVE interface and ensure that the underlay provides the necessary transport. Which two statements are true about this configuration? (Choose two.)

Accepted Answer

VXLAN uses UDP port 4789 as the destination port for encapsulated traffic by default.. VXLAN on Cisco IOS XE uses an NVE interface that references a source interface for the tunnel source IP, and it encapsulates frames in UDP with default destination port 4789. The underlay only needs IP reachability between VTEPs; MPLS LDP, shared subnets, and Layer 2 adjacency are not required. These two statements correctly describe the configuration and transport behavior.

Answer

The NVE interface must be assigned an IP address from the same subnet as the remote VTEP.

Answer

VXLAN requires that the underlay provide Layer 2 adjacency between all VTEPs.

Answer

The underlay must run MPLS LDP to carry VXLAN traffic between VTEPs.

Question 19

A network architect is evaluating Cisco SD-Access for a large campus. The architect must ensure the fabric supports policy enforcement based on user identity and group membership, and that the fabric can scale to thousands of endpoints without flooding the underlay. Which two statements are correct about how SD-Access achieves these goals? (Choose two.)

Accepted Answer

The LISP control plane in SD-Access registers endpoint EID-to-RLOC mappings so fabric edge nodes can resolve destinations without flooding the underlay.. SD-Access scales by moving endpoint reachability into the LISP control plane, where EID-to-RLOC mappings are registered and resolved, avoiding underlay flooding. Policy is enforced with Cisco TrustSec group tags carried in the VXLAN Group Policy Option header, enabling group-based ACLs at fabric edge nodes. The underlay is a routed IS-IS fabric that does not carry endpoint host routes or rely on VXLAN flooding, and the overlay does not require a single stretched bridge domain.

Answer

The fabric uses a single shared bridge domain across all edge nodes to avoid VLAN proliferation.

Answer

The underlay uses VXLAN flooding to propagate endpoint reachability to all fabric edge nodes.

Answer

Fabric edge nodes use OSPF to advertise endpoint host routes into the underlay for reachability.

Question 20

A network architect is evaluating Cisco StackWise Virtual technology for a pair of Cisco Catalyst 9000 switches that will act as a single logical entity at the distribution layer. Which two statements accurately describe Cisco StackWise Virtual? (Choose two.)

Accepted Answer

It supports Multichassis EtherChannel (MEC) so that access switches can dual-home to both stack members.. Cisco StackWise Virtual combines two Catalyst 9000 switches into one logical switch via a StackWise Virtual Link, presenting a single control plane and management IP. It enables Multichassis EtherChannel so downstream devices can dual-home with active-active forwarding. The SVL requires high-speed ports, both switches must run the same IOS XE version, and the pair shares one control plane rather than maintaining independent ones.

Answer

Each switch in the StackWise Virtual pair maintains an independent control plane and separate management IP address.

Answer

It requires that both switches run different IOS XE versions to provide software redundancy.

Answer

The StackWise Virtual Link can be formed using any two 1 Gigabit Ethernet ports on the switches.