350-401 QoS Architecture — 20 Questions

Question 1

A network engineer is configuring QoS on a Cisco Catalyst 9300 switch to prioritize voice traffic. The switch has multiple access ports connected to IP phones and PCs. The engineer applies a policy-map that matches DSCP EF and sets the CoS to 5. However, after testing, the voice packets are not being marked correctly. What is the most likely cause?

Accepted Answer

The interface is missing the 'mls qos trust cos' or 'mls qos trust dscp' command.. On Cisco Catalyst switches like the 9300, QoS marking policies applied via a policy-map only re-mark packets if the interface port is configured to trust a specific marking. Without the 'mls qos trust dscp' command, the switch defaults to an untrusted state and may ignore or overwrite the DSCP-to-CoS mapping set by the policy-map. Option C is correct because the missing trust command prevents the policy-map from correctly applying the CoS 5 marking to voice packets.

Answer

The policy-map is not applied to the correct interface direction.

Answer

The switch does not support DSCP-to-CoS mapping.

Answer

The IP phone is not sending packets with DSCP EF.

Question 2

An enterprise is deploying a new VoIP system and wants to ensure voice traffic receives priority over data traffic on a WAN link. The engineer configures a class-map to match RTP traffic using the 'match protocol rtp' command. However, the class-map does not match any packets. What is the most likely reason?

Accepted Answer

The 'match protocol rtp' command requires NBAR to be enabled globally with 'ip nbar protocol-discovery'.. The 'match protocol rtp' command relies on Network-Based Application Recognition (NBAR) to identify RTP traffic by inspecting packet payloads and using protocol signatures. Without NBAR enabled globally via 'ip nbar protocol-discovery', the class-map cannot match any packets because the router does not have the necessary deep packet inspection capability. Enabling NBAR allows the device to recognize RTP traffic even though it uses dynamic UDP ports.

Answer

RTP traffic uses UDP ports, and the class-map must match on the UDP port range instead.

Answer

The class-map must be configured with 'match any' to capture all traffic.

Answer

RTP traffic is always marked with DSCP EF, so the class-map should match on DSCP instead.

Question 3

A network engineer is designing a QoS policy for a Cisco router that connects to an MPLS VPN. The service provider expects all traffic to be marked with IP Precedence values. The engineer wants to ensure that voice traffic (DSCP EF) is mapped to IP Precedence 5. What configuration is required on the router to perform this mapping?

Accepted Answer

Configure a policy-map that sets the IP precedence to 5 using 'set ip precedence 5'.. Option A is correct because the 'set ip precedence 5' command in a policy-map explicitly marks the IP Precedence field to 5, which corresponds to the same value as DSCP EF (46) in the IP header. This ensures that voice traffic is marked with IP Precedence 5 as required by the service provider, regardless of any existing DSCP markings.

Answer

Configure a policy-map that sets the DSCP to EF, and the router will automatically set IP precedence to 5.

Answer

Use the 'qos map dscp-ip-precedence' command to create a mapping table.

Answer

The router will automatically map DSCP EF to IP precedence 5 without any configuration.

Question 4

A company is implementing QoS on its campus network. The network engineer configures a policy-map that sets the CoS value for voice traffic to 5 on a switch interface. However, when the traffic reaches the router, the CoS marking is lost. What is the most likely reason?

Accepted Answer

CoS is a Layer 2 marking and is not carried across a Layer 3 hop; the router must map CoS to DSCP.. CoS (Class of Service) is a Layer 2 marking field in the 802.1Q VLAN tag, which is stripped when a frame passes through a Layer 3 device (router). Since the router operates at Layer 3, it does not preserve the CoS value; instead, the router must map the CoS to a DSCP (Differentiated Services Code Point) value at Layer 3 to maintain QoS across the routed hop. Option B correctly identifies this fundamental Layer 2 vs. Layer 3 boundary issue.

Answer

The router does not trust the CoS marking and re-marks it to 0.

Answer

The switch must be configured to set DSCP instead of CoS.

Answer

The router must have 'mls qos trust cos' configured on the interface.

Question 5

A network engineer is troubleshooting voice quality issues on a WAN link. The engineer notices that voice packets are being dropped during congestion. The QoS policy uses LLQ for voice traffic, but the priority queue is not providing the expected bandwidth. What is the most likely cause?

Accepted Answer

The priority queue has a built-in policer that drops traffic exceeding the configured bandwidth.. The priority queue in LLQ uses a built-in policer that drops traffic exceeding the configured bandwidth. When congestion occurs, the policer enforces the bandwidth limit by dropping excess packets, which explains why voice packets are being dropped despite the priority queue being active. This is a fundamental behavior of LLQ to prevent the priority queue from starving other queues.

Answer

The priority queue is not configured with a bandwidth statement.

Answer

The class-map is not matching voice traffic correctly.

Answer

The router is using FIFO queuing instead of LLQ.

Question 6

An enterprise is deploying QoS across a network that includes both Cisco and non-Cisco devices. The engineer wants to use a marking scheme that is end-to-end and not stripped at Layer 3 boundaries. Which marking field should the engineer use?

Accepted Answer

DSCP. DSCP (Differentiated Services Code Point) is the correct choice because it is defined in RFC 2474 as a Layer 3 marking field in the IP header. Unlike CoS (Layer 2) or MPLS EXP (which is stripped at MPLS boundaries), DSCP markings are preserved across Layer 3 boundaries (routers) and can be used end-to-end across both Cisco and non-Cisco devices, as long as the intermediate devices trust the DSCP value.

Answer

CoS

Answer

IP Precedence

Answer

MPLS EXP

Question 7

A network engineer is configuring QoS on a Cisco router to prioritize business-critical applications. The engineer creates a class-map that matches traffic based on the destination IP address and port. However, the class-map does not match the expected traffic. What is the most likely reason?

Accepted Answer

The class-map uses 'match-all' but the engineer intended to use 'match-any'.. Option A is correct because when a class-map uses 'match-all', all match conditions must be true for a packet to be classified. If the engineer intended to match traffic based on either the destination IP address OR the port, using 'match-any' would allow the class-map to match if any single condition is met. The mismatch occurs because the class-map is too restrictive, requiring both conditions to be satisfied simultaneously.

Answer

The access-list used for matching is not applied to the correct interface.

Answer

The router does not support matching on both IP and port in the same class-map.

Answer

The class-map must be applied to the interface before it can match traffic.

Question 8

A network engineer is configuring QoS on a Cisco switch to ensure that video traffic (DSCP AF41) is not dropped during congestion. The engineer creates a policy-map that sets the queue-limit for the AF41 class. However, the switch is still dropping video packets. What is the most likely cause?

Accepted Answer

The switch uses a single queue for all traffic unless multiple queues are configured.. By default, Cisco switches use a single queue for all traffic. Creating a policy-map that sets a queue-limit for the AF41 class does not automatically create a separate queue for that class; the switch must have multiple egress queues configured (e.g., via the 'priority-queue out' command or by mapping DSCP values to specific queues). Without multiple queues, all traffic shares the same queue, and setting a queue-limit on a class within a single-queue system does not prevent drops during congestion.

Answer

The queue-limit is set too low, causing tail drops.

Answer

The video traffic is not being marked with DSCP AF41.

Answer

The policy-map must be applied to the output direction.

Question 9

A network engineer is implementing QoS on a Cisco router that connects to a service provider. The provider uses MPLS and expects the MPLS EXP bits to be set for voice traffic. The engineer configures a policy-map that sets the MPLS EXP to 5. However, the provider reports that the EXP bits are not being set. What is the most likely reason?

Accepted Answer

The policy-map is applied to the incoming interface, but MPLS EXP marking must be done on the outgoing interface.. The most likely reason is that the policy-map is applied to the incoming interface, but MPLS EXP marking must be applied on the outgoing interface. MPLS EXP bits are set at the imposition (ingress) of the MPLS label stack, which occurs when the packet is forwarded out of an interface that has MPLS enabled. If the policy-map is applied inbound, it marks the IP packet before MPLS encapsulation, and the EXP bits are not set on the MPLS label. The correct approach is to apply the policy-map outbound on the interface facing the service provider, so that the 'set mpls experimental' command marks the EXP bits on the imposed label.

Answer

The router does not support setting MPLS EXP bits.

Answer

The MPLS EXP bits are set automatically based on the IP precedence.

Answer

The policy-map must use 'set mpls experimental imposition 5' instead of 'set mpls experimental 5'.

Question 10

An architect is designing a QoS policy for a campus LAN that must support real-time voice and video traffic alongside mission-critical data. The design must use the DiffServ model with consistent per-hop behavior across all switches. Which approach should the architect choose to ensure that voice traffic receives priority queuing while video traffic is guaranteed bandwidth without starving other classes?

Accepted Answer

Use the MQC framework to classify traffic based on DSCP markings, apply a priority queue for EF traffic, and allocate a minimum bandwidth guarantee for AF41 traffic.. Option A is correct because it uses the Modular QoS CLI (MQC) framework to classify traffic by DSCP markings, which aligns with the DiffServ model's per-hop behavior consistency. By applying a strict priority queue for EF (Expedited Forwarding, DSCP 46) traffic, voice gets low-latency treatment, while a minimum bandwidth guarantee for AF41 (Assured Forwarding, DSCP 34) ensures video traffic receives a guaranteed share without starving other classes, as AF uses weighted fair queuing with bandwidth allocation.

Answer

Implement a single FIFO queue on all interfaces and rely on the default CoS-to-queue mapping to prioritize voice.

Answer

Configure strict priority queuing for all traffic marked with DSCP values greater than 0.

Answer

Use the IntServ model with RSVP to reserve bandwidth for each voice and video flow.

Question 11

A network team is designing QoS for a Cisco SD-WAN fabric connecting multiple branch offices to a central data center. The design must ensure that VoIP traffic from branch sites receives priority treatment across the WAN overlay, regardless of the underlying transport (MPLS, Internet, LTE). Which architectural component should the team configure to enforce consistent QoS policies across all WAN edges?

Accepted Answer

Configure a centralized QoS policy on vManage that matches VoIP DSCP markings and applies priority queuing on all WAN edge routers.. Option A is correct because vManage serves as the centralized SD-WAN management plane, allowing administrators to define a single QoS policy that matches VoIP DSCP markings (e.g., EF for expedited forwarding) and applies priority queuing across all WAN edge routers. This ensures consistent treatment of VoIP traffic over any transport (MPLS, Internet, LTE) by pushing the policy to all vEdge/cEdge devices via the vSmart controller, leveraging the SD-WAN overlay's ability to enforce QoS independently of the underlying physical transport.

Answer

Define a localized QoS policy on each branch router using MQC, matching the same DSCP values.

Answer

Use the vSmart controller to apply QoS policy only on the MPLS transport, leaving Internet and LTE unmanaged.

Answer

Implement QoS using RSVP across the overlay tunnels.

Question 12

An enterprise is deploying a leaf-spine architecture in its data center to support high-bandwidth east-west traffic. The design must include QoS to prioritize storage replication traffic (iSCSI) over backup traffic, while ensuring low latency for real-time applications. Where should the architect apply QoS classification and queuing policies in this topology?

Accepted Answer

Apply classification and marking on the leaf switches at ingress, and queuing policies on egress interfaces of both leaf and spine switches.. In a leaf-spine architecture, QoS classification and marking must occur at the ingress of leaf switches (where traffic enters the fabric) to identify iSCSI, backup, and real-time flows. Queuing policies must be applied on egress interfaces of both leaf and spine switches to manage congestion and prioritize latency-sensitive traffic across the entire path, ensuring end-to-end QoS for east-west traffic.

Answer

Apply all QoS policies only on the spine switches, since they handle inter-leaf traffic.

Answer

Configure QoS only on the default gateway router, which is upstream of the leaf-spine fabric.

Answer

Use a single QoS policy on all interfaces with default settings, relying on hardware buffers.

Question 13

A company is virtualizing its network functions using NFV on a KVM-based hypervisor. The design must ensure that the virtual router (CSR1000v) can handle high-throughput traffic with minimal latency. Which architectural consideration is most critical for achieving this goal?

Accepted Answer

Pin the vCPU of the CSR1000v to dedicated physical cores and ensure the VM memory is allocated from the same NUMA node.. Pinning vCPUs to dedicated physical cores and allocating memory from the same NUMA node eliminates cross-NUMA memory access and CPU scheduling contention, which are critical for reducing latency and maximizing throughput in a data-plane-intensive VNF like the CSR1000v. This ensures that the VM's memory accesses are local to the NUMA node where its vCPUs run, avoiding the performance penalty of remote memory access over the QPI/UPI interconnect.

Answer

Use a Type 2 hypervisor to allow the VNF to share resources with other VMs more efficiently.

Answer

Enable overcommitment of CPU resources to maximize the number of VNFs per host.

Answer

Place the CSR1000v on a VMware ESXi host instead of KVM for better performance.

Question 14

An architect is designing a QoS policy for a Cisco SD-Access fabric. The policy must prioritize voice traffic from wireless clients connected to fabric-enabled access points over other traffic types. The design should use the fabric's built-in capabilities to simplify deployment. Which approach should the architect take?

Accepted Answer

Use Cisco TrustSec to assign an SGT to voice traffic based on ISE authentication, then apply a QoS policy on the fabric edge node that matches the SGT and provides priority queuing.. Option A is correct because Cisco SD-Access uses TrustSec to propagate Security Group Tags (SGTs) from ISE to the fabric edge nodes. By matching the SGT assigned to voice traffic (e.g., via ISE profiling and authentication), the fabric edge node can apply a QoS policy that places that traffic into a priority queue. This leverages the fabric's built-in SGT-based policy enforcement, simplifying deployment without requiring per-device ACLs or complex marking configurations.

Answer

Configure QoS policies on the wireless LAN controller (WLC) only, marking voice traffic with DSCP EF, and rely on the fabric to preserve the marking.

Answer

Implement a centralized QoS policy on the fabric border node that matches the source IP addresses of voice devices.

Answer

Use VXLAN network identifiers (VNIs) to classify voice traffic and apply QoS on the control plane node.

Question 15

A network team is designing QoS for a multi-tenant data center using leaf-spine architecture. Each tenant requires guaranteed bandwidth for their mission-critical applications, while best-effort traffic must not interfere. The design must use hierarchical queuing to enforce per-tenant fairness. Which queuing mechanism should the architect implement on the leaf switches?

Accepted Answer

Implement hierarchical QoS (HQoS) with a parent policy shaping per-tenant traffic and a child policy applying class-based weighted fair queuing (CBWFQ) for each tenant's applications.. Hierarchical QoS (HQoS) is the correct choice because it allows the architect to enforce per-tenant bandwidth guarantees using a parent policy (shaping) while applying class-based weighted fair queuing (CBWFQ) in a child policy to prioritize each tenant's mission-critical applications. This two-level structure ensures that best-effort traffic from one tenant cannot starve another tenant's guaranteed traffic, meeting the multi-tenant fairness requirement.

Answer

Use a single level of CBWFQ on all interfaces, classifying traffic by tenant using VLANs.

Answer

Apply strict priority queuing for all mission-critical traffic across all tenants.

Answer

Configure separate physical interfaces for each tenant and apply independent QoS policies.

Question 16

An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?

Accepted Answer

Apply a shape average policy on the egress interface of the WAN edge router, setting the CIR and burst parameters to match the provider contract.. Option A is correct because 'shape average' on the egress interface allows the router to buffer excess traffic and transmit it at the contracted CIR, while the burst parameters (Bc and Be) enable short-term bursts above CIR to accommodate real-time traffic spikes without drops. This prevents the provider's policer from discarding packets, as the shaper ensures the outbound traffic rate stays within the agreed contract limits.

Answer

Use a policer on the ingress interface to drop traffic exceeding the CIR.

Answer

Configure a shaper on the provider's device instead of the customer router.

Answer

Set the interface bandwidth to the CIR and rely on FIFO queuing.

Question 17

A network architect is designing QoS for a Cisco SD-WAN deployment that uses a mix of MPLS and broadband Internet transports. The design must ensure that interactive video traffic is not delayed by large file transfers, even when the Internet link experiences congestion. Which SD-WAN policy type should the architect use to enforce this behavior?

Accepted Answer

Configure a localized QoS policy on the WAN edge routers that matches video traffic and applies a priority queue.. Option A is correct because a localized QoS policy on the WAN edge router can classify interactive video traffic and place it into a priority queue, ensuring low-latency treatment even when the Internet link is congested. This policy operates locally on the router, directly controlling queuing and scheduling behavior on the specific interface, which is essential for protecting real-time traffic from bulk file transfers.

Answer

Use a centralized data policy to steer video traffic to the MPLS link only.

Answer

Implement a centralized application-aware routing policy to prefer the MPLS link for video.

Answer

Configure a VPN membership policy to isolate video traffic in a separate VPN.

Question 18

A company is deploying a new campus network with a hierarchical design (core, distribution, access). The QoS design must ensure that voice traffic is prioritized end-to-end, and that marking is trusted only on access ports connected to IP phones. Which architectural approach should the architect take for classification and marking?

Accepted Answer

Configure the access switches to trust DSCP on ports connected to IP phones, and apply queuing policies on distribution and core switches that match the trusted markings.. Option A is correct because it aligns with the Cisco QoS trust boundary model for campus networks. IP phones are trusted endpoints that mark voice traffic with the correct DSCP values (e.g., EF for voice, AF41 for video). By configuring the access switch port to trust DSCP from the IP phone, the marking is preserved end-to-end. Distribution and core switches then apply queuing policies (e.g., LLQ) based on these trusted markings, ensuring voice traffic receives priority treatment across the entire network.

Answer

Remark all traffic to a single DSCP value at the access layer and apply priority queuing at the core.

Answer

Apply QoS policies only at the core layer, ignoring markings from the access layer.

Answer

Use the distribution layer to reclassify traffic based on source MAC addresses of IP phones.

Question 19

Consider the following configuration snippet:

policy-map QOS_POLICY
 class VOICE
  priority percent 30
 class VIDEO
  bandwidth percent 20
  queue-limit 50 packets
 class class-default
  fair-queue
  queue-limit 100 packets

What is the effect of this configuration?

Accepted Answer

The VOICE class traffic is always sent before other classes, but if it exceeds 30% of the interface bandwidth, excess traffic is dropped.. The 'priority percent 30' command under the VOICE class enables strict priority queuing, meaning VOICE traffic is always transmitted before any other class. However, the priority queue is policed at 30% of the interface bandwidth; any traffic exceeding this rate is dropped, not queued. This is a fundamental behavior of the priority command in Cisco IOS — excess priority traffic is dropped to prevent starvation of other queues.

Answer

The VOICE class traffic is always sent before other classes, and excess traffic beyond 30% is queued in the default class.

Answer

The VIDEO class traffic is treated with strict priority after the VOICE class.

Answer

The class-default uses Weighted Fair Queuing with a maximum queue size of 100 packets, and all classes share the remaining bandwidth equally.

Question 20

Given the following configuration:

interface GigabitEthernet0/1
 service-policy output QOS_POLICY

Which statement is true about applying a service-policy in the output direction?

Accepted Answer

The policy-map is applied to traffic exiting the interface, allowing queuing and scheduling decisions.. When a service-policy is applied in the output direction, the policy-map inspects and acts on packets as they leave the interface. This allows the policy to perform queuing and scheduling decisions (e.g., CBWFQ, LLQ, shaping) on outbound traffic, which is the correct behavior for managing bandwidth and latency on egress.

Answer

The policy-map is applied to traffic entering the interface, performing classification and marking.

Answer

The policy-map can only be applied if the interface is in a shutdown state.

Answer

The policy-map must contain a class-default with a shape command to be valid.