350-401 Network Assurance Practice Test 3 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to use flexible NetFlow to monitor traffic. The engineer wants to export flow data to a collector at 10.1.1.100 on port 2055. Which command is required to specify the collector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

destination 10.1.1.100 2055. In flexible NetFlow, you first create a flow exporter with 'flow exporter NAME', then within that mode use 'destination IP PORT' to specify the collector. The other options are either for traditional NetFlow, incomplete, or invalid commands. Thus, the 'destination' command is required.

Answer

ip flow-export destination 10.1.1.100 2055

Answer

collector 10.1.1.100 port 2055

Answer

flow exporter EXPORTER

Question 2

A network technician is troubleshooting a connectivity issue between two switches. The technician suspects a duplex mismatch on the link. Which command should be used on a Cisco switch to verify the duplex settings of an interface?

Accepted Answer

show interfaces. The 'show interfaces' command provides comprehensive details, including the operational duplex. A duplex mismatch often shows as one side full-duplex and the other half-duplex, leading to performance issues. The other commands either show only configured settings or are not the primary tool for this purpose.

Answer

show interfaces status

Answer

show running-config interface

Answer

show controllers ethernet-controller

Question 3

A network engineer is troubleshooting a connectivity issue and suspects a routing loop. The engineer wants to generate synthetic traffic that matches a specific IP SLA operation and view the path taken by those packets. Which IP SLA operation type should be configured to generate packets with varying source and destination ports and then use the resulting data to identify the path?

Accepted Answer

UDP Echo. The UDP Echo operation is designed to send UDP packets to a target device and measure round-trip time. It allows configuration of both source and destination ports, enabling the simulation of various application flows. When used for path identification, the engineer can vary destination ports to see how traffic is load-balanced or routed. This port-level control is not available with ICMP-based operations. Thus, UDP Echo is the correct choice for generating packets with varying ports to analyze the path.

Answer

Path Echo

Answer

UDP Jitter

Answer

ICMP Echo

Question 4

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator wants to identify the top three issues affecting wireless clients. Which two Assurance features can provide this information? (Choose two.)

Accepted Answer

Client 360. The Network Health Dashboard provides a high-level view of network health, including top issues affecting wireless clients. Client 360 offers detailed per-client analysis, which can be used to identify common problems when examining multiple clients. Together, these features help the administrator pinpoint the most significant wireless issues.

Answer

Path Trace

Answer

Application Health Dashboard

Answer

Sensor-driven tests

Question 5

A network engineer is configuring a SPAN session on a Cisco Catalyst switch to capture traffic from a specific VLAN. The engineer wants to ensure that only traffic from that VLAN is sent to the destination port. Which command is required to achieve this?

Accepted Answer

monitor session 1 source vlan 10. To capture traffic from a specific VLAN in a SPAN session, the source must be defined as that VLAN using the monitor session source vlan command. This ensures that only traffic within that VLAN is replicated to the destination port. Other commands either specify a different source type or set the destination, and thus do not fulfill the requirement.

Answer

monitor session 1 filter vlan 10

Answer

monitor session 1 source interface GigabitEthernet0/1

Answer

monitor session 1 destination interface GigabitEthernet0/2

Question 6

A network engineer is configuring a Cisco IOS router to use flexible NetFlow to monitor traffic. The engineer wants to export flow data to a collector at 10.1.1.100 on port 2055. Which command is required to specify the collector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

flow exporter EXPORTER
 destination 192.0.2.1
 source Loopback0
!
interface Vlan10
 ip flow monitor MONITOR input. Flexible NetFlow on Catalyst 9300 uses flow records, flow exporters, and flow monitors. The flow exporter defines the collector destination and source interface (Loopback0). The flow monitor ties a record and exporter together and is applied to the SVI with the 'input' keyword to capture ingress traffic. This approach is scalable and meets the requirements.

Answer

flow record RECORD
 match ipv4 source address
 collect counter bytes
!
interface Vlan10
 ip flow record RECORD

Answer

interface Vlan10
 ip flow ingress
!
ip flow-export source Loopback0

Answer

interface Vlan10
 ip flow ingress
 ip flow-export source Loopback0

Question 7

A network engineer is configuring a Cisco IOS router to use flexible NetFlow to monitor traffic. The engineer wants to export flow data to a collector at 10.1.1.100 on port 2055. Which command is required to specify the collector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WPA3-Enterprise with 192-bit encryption. For the most secure enterprise WLAN, WPA3-Enterprise with 802.1X and WPA3-Enterprise with 192-bit encryption are the correct choices. WPA3-Enterprise with 802.1X provides mutual authentication and strong encryption, while the 192-bit mode offers the highest level of security with GCMP-256. WPA3 with SAE is for personal networks, and WPA2 options are less secure. TKIP is deprecated. Thus, the engineer should configure both WPA3-Enterprise with 802.1X and WPA3-Enterprise with 192-bit encryption to meet the requirement.

Answer

WPA2 with TKIP encryption

Answer

WPA3 with SAE

Answer

WPA2 with AES-CCMP encryption

Question 8

A network engineer is analyzing the output of 'show ip sla statistics' on a Cisco router. The engineer notices that the 'Latest RTT' value is consistently higher than the 'Average RTT'. Which statement best explains this observation?

Accepted Answer

The latest round-trip time is an outlier due to a temporary network spike, while the average RTT is calculated over all probes and is therefore lower.. The 'Latest RTT' is the round-trip time of the most recent probe, which can be higher due to a temporary network spike. The 'Average RTT' is the mean of all successful probes, providing a smoothed value that is less affected by short-term fluctuations. Therefore, a higher latest RTT simply indicates a recent increase in latency.

Answer

The average RTT is reset periodically, while the latest RTT is cumulative, leading to a higher value.

Answer

The average RTT is calculated only from successful probes, while the latest RTT includes failed probes, inflating its value.

Answer

The latest RTT is measured in microseconds, while the average RTT is in milliseconds, causing a numeric discrepancy.

Question 9

A network administrator is using SPAN to monitor traffic on a Cisco switch. The administrator wants to capture traffic from multiple VLANs and send it to a single destination port for analysis. Which two statements are true about configuring SPAN for this scenario? (Choose two.)

Accepted Answer

A source port can monitor traffic from multiple VLANs if it is configured as a trunk port.. VSPAN allows monitoring multiple VLANs by specifying VLAN IDs as sources. Alternatively, a trunk port can be used as a source to capture multiple VLANs. The destination port cannot be a source for another session, and multiple source VLANs can be monitored. SPAN direction must be explicitly configured; it is not automatically both.

Answer

Only one source VLAN can be monitored per SPAN session.

Answer

SPAN sessions can monitor traffic in both directions (ingress and egress) on a source port.

Answer

The destination port can be a source port for another SPAN session simultaneously.

Question 10

A network engineer is configuring a Cisco IOS router to use flexible NetFlow to monitor traffic. The engineer wants to export flow data to a collector at 10.1.1.100 on port 2055. Which command is required to specify the collector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

interface GigabitEthernet1/0/1. To export NetFlow data with autonomous system numbers, the engineer must first enable NetFlow on the desired interfaces using 'ip flow ingress' (or egress) within interface configuration mode. Then, the NetFlow cache must be configured to include BGP next-hop and AS information, typically with commands like 'ip flow-cache bgp next-hop' or by using a flow record in Flexible NetFlow. However, in the context of traditional NetFlow, entering the interface and enabling ingress are prerequisites. The other commands set export parameters but do not directly cause AS numbers to be included.

Answer

ip flow-export version 9

Answer

ip flow-export destination 192.168.1.100 2055

Answer

ip flow-cache timeout active 1

Question 11

A network engineer is configuring a Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch to capture traffic from a specific VLAN. The engineer wants to ensure that all traffic, including inter-VLAN routed traffic, is captured. Which SPAN configuration is required to achieve this?

Accepted Answer

Configure a local SPAN session with the source as the VLAN and the destination as a physical port.. To capture all traffic within a VLAN, including inter-VLAN routed traffic, a VLAN-based SPAN session must be configured with the source as the VLAN and the destination as a physical port. This type of SPAN monitors the VLAN and captures packets after routing, ensuring that traffic between VLANs is included. Port-based SPAN would miss internally routed traffic, and using an SVI as a destination is not supported. RSPAN is unnecessary for local monitoring. Thus, the correct configuration is a local SPAN with VLAN source and physical port destination.

Answer

Configure a local SPAN session with the source as the physical uplink port and the destination as a physical port.

Answer

Configure a remote SPAN (RSPAN) session with the source as the VLAN and the destination as a VLAN.

Answer

Configure a local SPAN session with the source as the VLAN and the destination as the VLAN interface (SVI).

Question 12

A network administrator is configuring a Cisco IOS XE device to send syslog messages to a remote server at 10.1.1.100. The administrator also wants to ensure that all messages with severity level 4 and above are logged. Which command sequence achieves this?

Accepted Answer

logging host 10.1.1.100
logging trap warnings. To send syslog messages to a remote server, the 'logging host' command is used, followed by the server IP address. To set the severity level, the 'logging trap' command is used, which can accept a numeric level or a keyword. 'logging trap warnings' sets the level to 4, ensuring that messages with severity 0-4 are sent. This configuration meets the administrator's requirement.

Answer

logging server 10.1.1.100
logging severity 4

Answer

logging host 10.1.1.100
logging trap 4

Answer

logging 10.1.1.100
logging level 4

Question 13

A network engineer is configuring Flexible NetFlow on a Cisco router to monitor traffic for capacity planning and security analysis. The engineer wants to capture both IPv4 and IPv6 flow information, including source and destination addresses, ports, protocol, and ToS/DSCP values. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

A flow monitor that associates the flow record with a flow exporter and applies to an interface. To capture IPv4 and IPv6 flow information with Flexible NetFlow, you must configure a flow record that defines the match and collect fields for both protocols, and a flow monitor that binds the record to an exporter and applies it to an interface. The flow exporter is necessary for exporting but does not define the captured data. IP SLA and class maps are unrelated to Flexible NetFlow configuration.

Answer

A class map to classify traffic for NetFlow export

Answer

A flow exporter that defines the destination and transport protocol for exporting flow data

Answer

An IP SLA operation to generate test traffic for both IPv4 and IPv6

Question 14

A network engineer is using SPAN (Switched Port Analyzer) to monitor traffic on a Cisco Catalyst switch. The engineer configures a SPAN session with a source of VLAN 10 and a destination of interface GigabitEthernet1/0/24. After applying the configuration, the engineer notices that the monitoring device connected to GigabitEthernet1/0/24 is not receiving any traffic. What is the most likely cause?

Accepted Answer

The destination interface is shut down.. The most likely cause is that the SPAN destination interface is shut down. A shutdown interface cannot forward any traffic, so even if the SPAN session is correctly configured, the monitoring device will receive nothing. Other options, such as trunk configuration or non-existent VLAN, might cause issues but are less likely to result in absolutely no traffic. The direction setting does not prevent traffic from being sent.

Answer

The SPAN source VLAN 10 does not exist on the switch.

Answer

The destination interface is configured as a trunk port.

Answer

The SPAN session is configured with 'both' as the direction.

Question 15

A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?

Accepted Answer

Enable IP traffic export (NetFlow) on the switch.. The 'IP Input' process handles incoming IP packets that require CPU processing, such as routing protocol updates, management traffic, or packets destined to the switch itself. Enabling IP traffic export (NetFlow) on the switch allows the administrator to analyze traffic flows and identify the specific source/destination IP addresses, ports, and protocols consuming CPU cycles, without overwhelming the CPU further. NetFlow provides granular visibility into the types of packets being processed, making it the correct tool for this scenario.

Answer

Use extended ping from the switch to generate traffic.

Answer

Configure a SPAN session to capture all traffic to the CPU.

Answer

Check CDP neighbors to see if any devices are flooding.