350-401 Network Assurance — 20 Questions

Question 1

A network engineer notices intermittent connectivity issues between two switches connected via a trunk link. The trunk is configured with DTP in dynamic desirable mode on one side and trunk mode on the other. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure both sides with switchport mode trunk.. The correct answer is A because Dynamic Trunking Protocol (DTP) in dynamic desirable mode actively attempts to negotiate a trunk, but when the other side is set to trunk mode (which is a static trunk configuration), DTP negotiation can still cause intermittent issues due to mismatched DTP frames or timing. Configuring both sides with switchport mode trunk disables DTP negotiation entirely, ensuring a stable, static trunk link without negotiation delays or failures.

Answer

Set both sides to access mode.

Answer

Disable DTP on both sides using switchport nonegotiate.

Answer

Change one side to dynamic auto.

Question 2

A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?

Accepted Answer

Enable IP traffic export (NetFlow) on the switch.. The 'IP Input' process handles incoming IP packets that require CPU processing, such as routing protocol updates, management traffic, or packets destined to the switch itself. Enabling IP traffic export (NetFlow) on the switch allows the administrator to analyze traffic flows and identify the specific source/destination IP addresses, ports, and protocols consuming CPU cycles, without overwhelming the CPU further. NetFlow provides granular visibility into the types of packets being processed, making it the correct tool for this scenario.

Answer

Use extended ping from the switch to generate traffic.

Answer

Configure a SPAN session to capture all traffic to the CPU.

Answer

Check CDP neighbors to see if any devices are flooding.

Question 3

A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is correct because it combines strict priority queuing with CBWFQ, ensuring that voice traffic (marked with EF or CS5) is dequeued before any other traffic class. This strict priority mechanism guarantees the lowest possible latency for real-time traffic, as packets in the priority queue are always transmitted first, regardless of congestion on the WAN link.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO)

Question 4

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

Accepted Answer

The next-hop IP address is not reachable.. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Answer

The AS-path contains the local AS number.

Answer

BGP synchronization is enabled.

Answer

The maximum-prefix limit has been exceeded.

Question 5

A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?

Accepted Answer

Internet Group Management Protocol (IGMP). IGMP is the protocol used between hosts and their directly connected routers to signal membership in multicast groups. When a host wants to receive traffic for a specific IPTV multicast stream, it sends an IGMP membership report, and the router uses this information to build its multicast forwarding state for that subnet. Without IGMP, the router would have no way of knowing which groups are of interest to local hosts.

Answer

Rendezvous Point (RP)

Answer

Protocol Independent Multicast (PIM)

Answer

Multicast Source Discovery Protocol (MSDP)

Question 6

Which TWO statements are true about IP SLA? (Choose two.)

Accepted Answer

IP SLA can be used with tracking objects to trigger route changes.. Option B is correct because IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Answer

IP SLA is only supported on ASR routers.

Answer

IP SLA uses actual user traffic for measurements.

Answer

IP SLA can only measure round-trip time, not one-way delay.

Question 7

Which THREE are common causes of high CPU utilization on a Cisco Catalyst switch? (Choose three.)

Accepted Answer

Broadcast storms. A broadcast storm occurs when excessive broadcast traffic overwhelms the switch CPU, as each broadcast frame must be processed by the CPU to determine forwarding decisions. This consumes CPU cycles, especially when the storm exceeds the switch's hardware forwarding capacity, leading to high CPU utilization.

Answer

Excessive hardware switching of packets

Answer

Low memory conditions

Question 8

Refer to the exhibit. An engineer notices that interface resets have occurred. What is the most likely cause of the interface resets?

Accepted Answer

Cable or hardware issue causing link flapping. Interface resets typically indicate that the interface has gone down and come back up, which is most commonly caused by a physical layer issue such as a faulty cable, damaged connector, or hardware problem that leads to link flapping. When the link flaps, the interface counters increment the 'resets' field, reflecting the number of times the interface has been reset due to a loss of carrier or a link state change. This is distinct from errors like CRC or collisions, which do not directly cause the interface to reset.

Answer

CRC errors due to noise

Answer

Collisions on the link

Answer

Interface is administratively down

Question 9

Refer to the exhibit. Which OSPF route type is the default route?

Accepted Answer

External type 2 (E2). The exhibit shows a default route (0.0.0.0/0) being redistributed into OSPF from another routing protocol or static route. By default, OSPF redistributes routes as External Type 2 (E2), meaning the metric does not include the internal cost to the ASBR. The route is not an NSSA type because the area is not configured as a not-so-stubby area, and it is not an inter-area route because it originates outside the OSPF domain.

Answer

Inter-area (IA)

Answer

NSSA external type 2 (N2)

Answer

External type 1 (E1)

Question 10

A company has a core network running OSPF in a single area (area 0). The network consists of four routers: R1, R2, R3, and R4. R1 is connected to R2 and R3. R2 is also connected to R4. R3 is also connected to R4. All links are GigabitEthernet with OSPF cost based on bandwidth (reference bandwidth 100 Gbps). The network engineer notices that traffic from R1 to a subnet behind R4 is taking a suboptimal path: R1 -> R2 -> R4, instead of R1 -> R3 -> R4 which has lower cost. Upon checking OSPF neighbor states, all adjacencies are full. The engineer verifies that the cost on the R1-R3 link is 10 and the cost on the R3-R4 link is 10, while the R1-R2 link cost is 20 and the R2-R4 link cost is 20. The total cost via R2 is 40, via R3 is 20. However, the routing table on R1 shows the next-hop as R2 for the subnet behind R4. What is the most likely cause?

Accepted Answer

The subnet behind R4 is an external route (type 5 LSA) and the cost to the ASBR via R2 is lower than via R3 due to a mismatched reference bandwidth or manual cost setting.. Option C is correct because the subnet behind R4 is likely redistributed into OSPF as an external route (type 5 LSA). The cost to reach the ASBR (R4) via R2 is 40, while via R3 it is 20, but if the external route's advertised cost is lower via R2 (e.g., due to a mismatched reference bandwidth or manual cost setting on R4's redistribution), OSPF will prefer the path with the lower total cost (intra-area cost to ASBR + external cost). In this scenario, the external cost via R2 could be 0 or very low, making the total cost via R2 (40 + low) lower than via R3 (20 + high), overriding the intra-area cost advantage.

Answer

OSPF is load balancing across both paths equally.

Answer

The OSPF network type on R1-R3 is broadcast, causing DR/BDR election issues.

Answer

The R1-R3 link is flapping, causing OSPF to prefer the stable path via R2.

Question 11

A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?

Accepted Answer

Check the cable and connectors for damage or loose connections.. CRC errors and runts on a trunk link typically indicate a Layer 1 physical-layer issue, such as faulty cabling, damaged connectors, or poor termination. The first and most logical step is to inspect and test the physical cable and connectors, as this is the most common root cause and the easiest to verify before making configuration changes.

Answer

Increase the MTU size on the interface.

Answer

Configure the interface with a different duplex setting.

Answer

Disable Dynamic Trunking Protocol (DTP) on the interface.

Question 12

A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?

Accepted Answer

Low Latency Queuing (LLQ). LLQ is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that voice traffic is placed into a strict priority queue that is serviced before any other queues. This guarantees low latency and prevents voice packet drops during congestion by allowing the priority queue to be policed to a configured bandwidth limit, while still providing bandwidth guarantees for the voice class.

Answer

Weighted Random Early Detection (WRED)

Answer

Class-Based Weighted Fair Queuing (CBWFQ)

Answer

First-In, First-Out (FIFO) queuing

Question 13

Which TWO STP features are used to improve convergence time after a topology change?

Accepted Answer

UplinkFast. UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Answer

Root Guard

Answer

BPDU Guard

Answer

PortFast

Question 14

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

Accepted Answer

Add a static route for 192.168.1.0/24 with a lower administrative distance than OSPF.. Option B is correct because adding a static route for 192.168.1.0/24 with a lower administrative distance (e.g., 1) than OSPF (default 110) forces the router to prefer the static route over the OSPF-learned route, even though the OSPF metric is the same. This allows traffic to 192.168.1.0/24 to use a different next-hop (e.g., 10.0.0.1) while traffic to 192.168.2.0/24 continues using the OSPF-learned path via 10.0.0.2, achieving the desired path differentiation without altering OSPF metrics or using complex PBR.

Answer

Configure policy-based routing to match 192.168.1.0/24 and set the next hop to 10.0.0.1.

Answer

Use the 'distance ospf' command to change the OSPF administrative distance for all routes.

Answer

Adjust the OSPF cost on the interface to 10.0.0.2.

Question 15

A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?

Accepted Answer

Configure the new switch with a higher bridge priority (e.g., 28672) to prevent it from becoming the root bridge.. The issue is that the new switch, intended as an access switch, has a lower bridge priority (or default priority of 32768) than the existing root bridge for VLAN 100. When connected, it becomes the new root bridge, causing topology changes and intermittent connectivity. Root Guard on the Layer 3 switch port detects this superior BPDU and blocks the port to protect the root bridge position. Configuring the new switch with a higher bridge priority (e.g., 28672) ensures it cannot become the root bridge, resolving the Root Guard blocks.

Answer

Change the port configuration on the new switch to access mode for VLAN 100.

Answer

Disable Root Guard on the Layer 3 switch port connected to the new switch.

Answer

Remove the new switch from the network because it is causing a BPDU attack.

Question 16

Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?

Accepted Answer

It uses streaming telemetry to collect data for real-time analytics.. Option A is correct because Cisco DNA Center uses model-driven telemetry (e.g., gRPC, NETCONF/YANG, or UDP-based push) to stream real-time data from network devices, enabling sub-second analytics and faster troubleshooting compared to traditional polling methods like SNMP.

Answer

It supports only wired networks and not wireless.

Answer

It is a fully cloud-based solution with no on-premises components.

Answer

It only displays network device health scores and does not provide path tracing.

Question 17

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Accepted Answer

Increase the delay on GigabitEthernet0/0.. The EIGRP metric is calculated using the formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * 256, with default K values (K1=1, K3=1, others=0). Increasing the delay on the outgoing interface (GigabitEthernet0/0) directly increases the delay component in the composite metric, causing the overall metric to increase. Option D is correct because delay is a key variable in the EIGRP metric calculation.

Answer

Increase the bandwidth on GigabitEthernet0/0.

Answer

Add a redistribute static command under EIGRP.

Answer

Change the administrative distance to 90.

Question 18

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

Accepted Answer

Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.. Option C is correct because Auto QoS for VoIP automatically configures the necessary class maps, policy maps, and trust settings to properly classify and queue voice traffic (CoS 5) while ensuring data traffic is not starved. The default QoS configuration trusts CoS at the port level, but without proper queuing and scheduling, voice and data may compete for buffers, causing intermittent slow file transfers. Auto QoS sets up strict priority queuing for voice and allocates bandwidth for data, resolving the performance issue without manual misconfiguration.

Answer

Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.

Answer

Disable QoS entirely on all switches to eliminate any potential QoS-related drops.

Answer

Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.

Question 19

Drag and drop the steps for the DHCP DORA process in the correct order.

Question 20

Match each wireless standard to its frequency band and maximum data rate.