350-401 WAN Technologies — 30 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

Accepted Answer

The hub router is configured with 'ip next-hop-self eigrp' under the tunnel interface.. In DMVPN Phase 3, spoke-to-spoke tunnels require NHRP redirect and routing protocol next-hop-self behavior to be disabled on the hub so that spokes learn the remote spoke's next-hop IP and install a direct NHRP shortcut. If the hub still sets next-hop-self in EIGRP updates, spokes will see the hub as the next hop and forward traffic through it.

Answer

The hub router is configured with 'no ip next-hop-self eigrp' under the tunnel interface.

Answer

The spoke routers have 'ip nhrp shortcut' configured but the hub does not have 'ip nhrp redirect'.

Answer

The spoke routers are using static NHRP mappings to the hub only, without dynamic NHRP registration.

Question 2

An enterprise is replacing its legacy Frame Relay WAN with MPLS L3VPN. The new MPLS provider assigns a single VRF to the customer. The customer's CE routers are running BGP with the provider's PE routers. The engineer notices that the CE routers can ping the PE loopback addresses but cannot reach remote CE loopbacks. The BGP sessions are established and routes are received. What is the most likely cause?

Accepted Answer

The PE router is not disabling BGP next-hop-self for the VRF, so the routes advertised to the CE have the remote CE's IP as the next-hop, which is not reachable from the local CE.. In MPLS L3VPN, the PE router must advertise the customer routes with the correct next-hop (usually the PE's own address) and the MPLS labels must be properly distributed. However, the most common issue when CE can ping PE but not remote CE is that the PE is not advertising the customer routes back to the remote CE because of BGP next-hop processing or route-target filtering.

Answer

The CE router is not configured with 'no bgp default ipv4-unicast'.

Answer

The PE router is not sending the customer routes to the remote CE because the next-hop is set to the local PE's loopback, which is reachable, but the remote PE is not advertising the routes due to route-target mismatch.

Answer

The CE router is not advertising its own loopback into BGP, so the remote CE does not have a route to it.

Question 3

A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between two Cisco routers. The tunnel is established and IKEv2 Phase 1 is up, but no traffic passes. The engineer checks the crypto map and sees that the ACL is configured to permit traffic between the two LAN subnets. However, 'show crypto ipsec sa' shows that the number of packets encapsulated and decapsulated is zero. What is the most likely cause?

Accepted Answer

The IPsec transform set uses ESP with SHA-1, but the remote router expects AES-GCM.. When IKEv2 Phase 1 is up but Phase 2 (IPsec SA) is not established, the most common cause is a mismatch in the proxy identities (the interesting traffic ACL) or a mismatch in the IPsec transform set parameters. Since the ACL is configured correctly, the issue is likely a mismatch in the transform set or the IKEv2 proposal.

Answer

The crypto map is not applied to the correct interface.

Answer

The ACL on the crypto map is missing the 'permit ip' statement for the return traffic.

Answer

The tunnel interface is down due to a routing issue.

Question 4

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

Accepted Answer

The spoke is configured with a static IP address on the tunnel interface that is not in the hub's IP pool.. In FlexVPN, the hub assigns an IP address to the spoke from a pool. The spoke's tunnel interface should receive this IP address dynamically. If the spoke is configured with a static IP address that is not in the hub's pool, the hub will not route traffic back to the spoke correctly, or the spoke may have a mismatched subnet. The hub can ping the spoke because the spoke's tunnel IP is reachable, but the spoke cannot ping the hub because the spoke's routing table may not have a route to the hub's tunnel IP, or the hub's reverse route injection is not working.

Answer

The hub is missing the 'tunnel protection ipsec' command on the tunnel interface.

Answer

The spoke's crypto map is not using the correct pre-shared key.

Answer

The hub's IKEv2 profile is not configured with 'authentication remote rsa-sig'.

Question 5

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

Accepted Answer

Use AS path prepending on routes advertised to ISP B and set a higher local preference for routes learned from ISP A.. To influence inbound traffic, the engineer can use AS path prepending to make one path less preferred. For outbound traffic, local preference can be used to prefer one ISP. Since the company wants outbound traffic to prefer ISP A, they should set a higher local preference for routes learned from ISP A. For inbound traffic, they can prepend AS path to ISP B to make that path less attractive.

Answer

Set a lower MED for routes advertised to ISP A and a higher MED for routes advertised to ISP B.

Answer

Advertise a more specific prefix (e.g., /25) to ISP A and a less specific prefix (/24) to ISP B.

Answer

Configure the CE router to use BGP multipath with both ISPs.

Question 6

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

Accepted Answer

The policy is not attached to the correct VPN or site list.. In Cisco SD-WAN, policy is applied in a specific order: centralized data policy, centralized app-route policy, and then local policy. The preferred color is set in the centralized data policy, but if there is also a centralized app-route policy that does not consider the preferred color, or if the policy is not properly attached to the correct VPN or site, it may not take effect. Additionally, the policy must be applied to the correct direction (service-side vs. transport-side).

Answer

The voice traffic is using a different DSCP value than the one defined in the policy.

Answer

The MPLS link is not in the 'up' state in the vManage overlay.

Answer

The policy is configured as a local policy instead of a centralized policy.

Question 7

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. PPPoE sessions often require the use of PPPoE client configuration on the physical interface and the dialer interface. A common issue is that the physical interface (e.g., Ethernet) is not configured with the 'pppoe enable' command, or the dialer interface is not bound to the correct dialer pool. However, the session is established, so the PPPoE negotiation succeeded. The inability to ping the gateway is often due to a missing or incorrect 'ip route' or a firewall issue, but the most common cause is that the ISP requires the use of PPP IPCP to negotiate the IP address, and the router may not have an IP address assigned.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.

Question 8

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

Accepted Answer

The traffic is taking multiple paths, causing packets to arrive out of order.. Anti-replay is a security feature in IPsec that uses sequence numbers to prevent replay attacks. If packets arrive out of order (e.g., due to different paths or latency), the anti-replay window may drop them. This is common when there are multiple paths or when the IPsec SA is used for traffic that is load-balanced across different links.

Answer

The IPsec SA is using a weak encryption algorithm.

Answer

The IPsec SA is using ESP in tunnel mode with authentication only.

Answer

The IPsec SA lifetime is too short, causing frequent rekeying.

Question 9

A company is implementing a WAN optimization solution using Cisco WAAS. The engineer configures WAAS devices at the data center and remote branch. The WAAS devices are configured to use inline mode. However, the engineer notices that optimized traffic is not being intercepted. The WAAS devices are directly connected to the WAN router and the LAN switch. What is the most likely cause?

Accepted Answer

The WAN router is not configured with WCCP or PBR to redirect traffic to the WAAS device.. In inline mode, WAAS devices must be physically placed in the traffic path. The WAAS device must be configured with the correct WAN and LAN interfaces, and the WAN router must be configured to redirect traffic to the WAAS device using WCCP or Policy Based Routing (PBR). If the WAN router is not configured to redirect traffic, the WAAS device will not see the traffic.

Answer

The WAAS device is not configured with the correct WAN and LAN interfaces.

Answer

The WAAS device is not licensed for optimization.

Answer

The WAAS device is using a different subnet than the LAN and WAN.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip route 10.1.1.0
Routing entry for 10.1.1.0/24
  Known via "bgp 65001", distance 200, metric 0
  Tag 65002, type external
  Last update from 192.168.1.2 00:00:15 ago
  Routing Descriptor Blocks:
  * 192.168.1.2, from 192.168.1.2, 00:00:15 ago
      Route metric is 0, traffic share count is 1
      AS Hops 1
      Route tag 65002
      MPLS label: 18

Based on this output, what can be concluded?

Accepted Answer

The route is learned via BGP and has an MPLS label assigned, indicating MPLS forwarding.. The output shows a BGP route with an MPLS label, indicating that MPLS VPN or MPLS forwarding is in use. The presence of the MPLS label (18) in the routing table is the key clue.

Answer

The route is learned via OSPF and tagged with an MPLS label.

Answer

The route is a directly connected interface with an MPLS label.

Answer

The route is a static route with an MPLS label.

Question 11

A network engineer executes the following command on Router R2:

R2# show mpls ldp neighbor
    Peer LDP Ident: 192.168.1.1:0; Local LDP Ident 192.168.1.2:0
	TCP connection: 192.168.1.1.646 - 192.168.1.2.54321
	State: Oper; Msgs sent/rcvd: 1234/1234; Downstream
	Up time: 2d04h
	LDP discovery sources:
	  GigabitEthernet0/0, Src IP addr: 192.168.1.1
	        holdtime: 15000 ms, hello interval: 5000 ms
	Addresses bound to peer LDP Ident:
	  192.168.1.1        10.0.0.1

Based on this output, what is true about the LDP session?

Accepted Answer

The LDP session is operational and the holdtime is 15000 ms.. The output shows an LDP neighbor with state 'Oper' (operational) and a TCP connection using well-known port 646. The holdtime and hello interval are displayed.

Answer

The LDP session is down because the state is 'Oper'.

Answer

The LDP session is using UDP port 646 for the TCP connection.

Answer

The LDP session is using the default hello interval of 5000 ms.

Question 12

A network engineer issues the following command on Router R3:

R3# show ip bgp summary
BGP router identifier 10.0.0.3, local AS number 65003
BGP table version is 12345, main routing table version 12345
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65001   12345   12345    12345    0    0 1w2d        150
192.168.1.2     4        65002   12345   12345    12345    0    0 2w0d        200

Based on this output, what can be concluded?

Accepted Answer

Router R3 has received a total of 350 prefixes from its BGP neighbors.. The BGP summary shows two neighbors, both in established state with prefixes received. The number of prefixes received (150 and 200) indicates the BGP table size.

Answer

Both BGP neighbors are in the 'Idle' state.

Answer

The BGP session with 192.168.1.1 is down.

Answer

Router R3 is in AS 65001.

Question 13

A network engineer runs the following command on Router R4:

R4# show interfaces tunnel 0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 10.0.0.4/30
  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel source 192.168.1.4, destination 192.168.2.4
  Tunnel protocol/transport GRE/IP
    Key disabled, sequencing disabled
    Checksumming of packets disabled
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Based on this output, what is true about this tunnel?

Accepted Answer

The tunnel is a GRE tunnel that is up and operational.. The tunnel is up/up, uses GRE/IP encapsulation, and has a source and destination IP. The lack of traffic is indicated by zero packets input/output.

Answer

The tunnel is using IPsec encryption.

Answer

The tunnel is using MPLS over GRE.

Answer

The tunnel is down because there are no packets.

Question 14

A network engineer executes the following command on Router R5:

R5# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.6         1   FULL/DR         00:00:35    192.168.1.6    GigabitEthernet0/0
10.0.0.7         1   FULL/BDR        00:00:32    192.168.1.7    GigabitEthernet0/0
10.0.0.8         1   2WAY/DROTHER    00:00:38    192.168.1.8    GigabitEthernet0/0

Based on this output, what can be concluded about the OSPF network?

Accepted Answer

The OSPF network type is broadcast.. The output shows multiple OSPF neighbors on the same interface with different states: DR, BDR, and DROTHER. This indicates a broadcast multiaccess network (e.g., Ethernet) with OSPF DR/BDR election.

Answer

The OSPF network type is point-to-point.

Answer

Router R5 is the DR on this segment.

Answer

All neighbors are in the FULL state.

Question 15

A network engineer issues the following command on Router R6:

R6# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.1.100      10.0.0.10          ---                ---
--- 192.168.1.101      10.0.0.11          ---                ---
udp 192.168.1.100:1234 10.0.0.10:1234     203.0.113.5:53     203.0.113.5:53
tcp 192.168.1.101:80   10.0.0.11:80       198.51.100.2:443   198.51.100.2:443

Based on this output, what is true about the NAT translations?

Accepted Answer

The translation for 10.0.0.10 to 192.168.1.100 is a dynamic NAT without PAT.. The output shows dynamic NAT translations with inside local and inside global addresses. The presence of protocol-specific translations (udp, tcp) indicates PAT (NAT overload) is in use for some traffic.

Answer

All translations are static NAT entries.

Answer

The router is performing only PAT (overload).

Answer

The outside global address is the same for all translations.

Question 16

A network engineer runs the following command on Router R7:

R7# show vrf brief
  Name                             Default RD            Protocols   Interfaces
  Mgmt-intf                        <not set>             ipv4,ipv6    GigabitEthernet0/0
  CUSTOMER-A                       65001:100             ipv4         GigabitEthernet0/1.10
  CUSTOMER-B                       65001:200             ipv4         GigabitEthernet0/1.20

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-B is associated with subinterface GigabitEthernet0/1.20.. The output shows VRFs with route distinguishers and associated interfaces. VRF CUSTOMER-A and CUSTOMER-B are configured with specific RDs and interfaces.

Answer

VRF CUSTOMER-A is using IPv6.

Answer

VRF Mgmt-intf has a route distinguisher set.

Answer

All VRFs are using the same route distinguisher.

Question 17

A network engineer issues the following command on Router R8:

R8# show policy-map interface gigabitethernet 0/1
 GigabitEthernet0/1

Service-policy output: SHAPE-1M
    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      queue limit 64 packets
      (queue depth 0)
      (congestion occurrences)
      shape (average) cir 1000000, bc 10000, be 10000
      target shape rate 1000000

Based on this output, what is true about the traffic shaping policy?

Accepted Answer

The policy is shaping traffic to an average rate of 1 Mbps.. The output shows a shaping policy applied in the output direction with a CIR of 1 Mbps. The class-default is used, meaning all traffic is shaped.

Answer

The policy is policing traffic to 1 Mbps.

Answer

The policy is dropping all traffic because the queue is full.

Answer

The policy is applied in the input direction.

Question 18

A network engineer runs the following command on Router R9:

R9# show ip pim neighbor
PIM Neighbor Table
Neighbor Address     Interface          Uptime    Expires    Mode
192.168.1.10         GigabitEthernet0/0 1w2d      00:01:30   Dense
192.168.1.11         GigabitEthernet0/0 2w0d      00:01:25   Sparse
192.168.1.12         GigabitEthernet0/1 3d04h     00:01:28   Sparse

Based on this output, what can be concluded?

Accepted Answer

Router R9 has three PIM neighbors, one in Dense mode and two in Sparse mode.. The output shows PIM neighbors with different modes (Dense and Sparse). The mode indicates the PIM mode configured on the interface.

Answer

All PIM neighbors are operating in Sparse mode.

Answer

The PIM neighbor 192.168.1.12 is on the same interface as the others.

Answer

All PIM neighbors are in the 'Expires' state.

Question 19

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf hello-interval 10
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

What is the effect of this configuration?

Accepted Answer

OSPF will use a 10-second hello interval and suppress DR/BDR election.. The configuration sets the OSPF network type to point-to-point and overrides the default hello interval (which for point-to-point is 10 seconds) to 10 seconds, which is actually the default for point-to-point. However, the key point is that the 'ip ospf network point-to-point' command changes the OSPF network type from broadcast to point-to-point, which disables DR/BDR election and uses a 10-second hello interval by default. The explicit hello-interval command is redundant but not harmful.

Answer

OSPF will use a 30-second hello interval and elect a DR/BDR.

Answer

OSPF will use a 10-second hello interval but still elect a DR/BDR.

Answer

OSPF will use a 30-second hello interval and suppress DR/BDR election.

Question 20

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode ipsec ipv4
!
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 hash sha
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 203.0.113.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TSET
 match address 100
!
interface GigabitEthernet0/0
 crypto map CMAP
!
access-list 100 permit ip 10.0.0.0 0.0.0.3 10.0.0.4 0.0.0.3

What is the effect of this configuration?

Accepted Answer

The configuration creates an IPsec VTI that encrypts traffic between the two tunnel endpoints.. The configuration sets up a site-to-site IPsec VPN using a tunnel interface with IPsec protection. The crypto map is applied to the physical interface, and the access list defines interesting traffic between the two /30 subnets (10.0.0.0/30 and 10.0.0.4/30). This is a valid configuration for a DMVPN or static VTI, but note that the tunnel mode is 'ipsec ipv4' which is used for IPsec VTI (Virtual Tunnel Interface) and requires a crypto map on the physical interface to protect the tunnel. The access list correctly matches the tunnel networks.

Answer

The configuration will fail because the crypto map must be applied to the tunnel interface, not the physical interface.

Answer

The configuration will only encrypt traffic from 10.0.0.0/30 to 10.0.0.4/30, but not the reverse.

Answer

The configuration uses IKEv2 because of the transform-set and crypto map.