350-401 Practice Questions

Question 1

Drag and drop the steps of deploying a CoPP policy on a Cisco IOS-XE router into the correct order, from first to last.

Accepted Answer

Create access-lists for traffic classification. Deploying CoPP requires first defining ACLs to classify traffic, then creating class maps, then a policy map, then applying it to the control plane, and finally verifying the policy.

Question 2

Drag and drop the steps of OSPF summarization at ABR configuration steps into the correct order, from first to last.

Accepted Answer

Identify subnets to summarize. First, identify the subnets to summarize into a single prefix. Then, configure the area range command on the ABR under the OSPF process, specifying the area and the summary prefix. Optionally, set the 'not-advertise' keyword to suppress the summary. Verify the summary route in the OSPF database using 'show ip ospf summary-address'. Finally, check that the summary route appears in the routing table of other routers.

Question 3

Drag and drop the steps of DHCP snooping operation on a Cisco switch into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping globally. DHCP snooping begins by enabling the feature globally with 'ip dhcp snooping'. Then, the feature is enabled on specific VLANs. Trusted interfaces (typically uplinks to DHCP servers) are configured with 'ip dhcp snooping trust'. The switch then intercepts DHCP messages, building the DHCP snooping binding database from valid server responses. Finally, any DHCP server messages received on untrusted interfaces are dropped to prevent rogue server attacks.

Question 4

Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.

Accepted Answer

Identify YANG module for interface statistics. The process starts with identifying the YANG module, then navigating the tree to the interface container, retrieving statistics, and optionally filtering or using NETCONF/RESTCONF.

Question 5

Drag and drop the steps of using a Python REST API call to retrieve device configuration via Cisco DNA Center into the correct order, from first to last.

Accepted Answer

Authenticate to DNA Center API and get token. The process begins with authenticating to the DNA Center API to obtain a token. Then, the device UUID is retrieved using a GET request to the device list endpoint. Next, a GET request is sent to fetch the running configuration for that device. The JSON response is parsed to extract the configuration text. Finally, the configuration is saved to a local file.

Question 6

Drag and drop the steps of NAPALM get_facts() retrieval from IOS-XE device into the correct order, from first to last.

Accepted Answer

Import napalm and get_network_driver. The correct order starts with importing the NAPALM library and driver, then creating a driver object with device credentials, calling the open() method to establish the connection, invoking get_facts() to retrieve device facts, and finally closing the connection.

Question 7

Drag and drop each Netmiko device type on the left to its matching operating system on the right.

Accepted Answer

cisco_ios: Cisco IOS (classic). cisco_ios is for classic IOS; cisco_nxos is for NX-OS; cisco_xr is for IOS-XR; cisco_xe is for IOS-XE.

Question 8

Drag and drop each Python library on the left to its matching network use case on the right.

Accepted Answer

Netmiko: Simplifies SSH connections to network devices. Netmiko simplifies SSH to network devices; NAPALM provides multi-vendor abstraction; Nornir is task-based and parallel; Scrapli is async-focused; Paramiko is low-level SSH.

Question 9

Drag and drop each NAPALM getter on the left to its matching returned data on the right.

Accepted Answer

get_facts: Device hostname, vendor, model, OS version, serial number. get_facts returns device facts like hostname and OS version, get_interfaces returns interface details, get_bgp_neighbors returns BGP neighbor information, get_lldp_neighbors returns LLDP neighbor data, and get_environment returns power and fan status.

Question 10

Drag and drop the steps of named ACL modification using sequence numbers into the correct order, from first to last.

Accepted Answer

View current ACL with 'show access-list'. Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.

Question 11

Drag and drop the steps of Ansible Tower (AWX) job template execution steps into the correct order, from first to last.

Accepted Answer

Create job template with playbook and inventory. In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

Question 12

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has two active member links.. The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Answer

The EtherChannel is using PAgP.

Answer

Port Gi0/3 is bundled in the channel.

Answer

The port-channel is a Layer 3 interface.

Question 13

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?

Accepted Answer

The CE router does not have a default route pointing to the PE's VRF interface.. The PE can ping remote site IP addresses from within the VRF, confirming that the VRF has the correct route-target import/export configuration and that VPNv4 routes are being received and installed in the VRF routing table. However, the CE router cannot ping remote sites, which indicates that the CE does not have a route pointing to the PE’s VRF interface as its next hop. Without a default route or a specific route pointing to the PE’s VRF-facing interface, the CE has no path to forward traffic to remote VPN destinations, even though the PE can reach them.

Answer

The VRF is missing the route-target export command.

Answer

The PE router is not running a routing protocol with the CE router.

Answer

The MPLS LDP is not enabled on the PE-CE link.

Question 14

Drag and drop the steps of service function chaining (SFC) path setup into the correct order, from first to last.

Accepted Answer

Classifier identifies traffic and maps to service chain. SFC path setup begins with classifying traffic to determine which service chain to apply. Next, the classifier encapsulates packets with an NSH header. Then the SFC path is computed by the controller using the service function path identifier. After path computation, the controller installs forwarding entries in each service function forwarder. Finally, traffic traverses the chain as SFFs forward packets between VNFs.

Question 15

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Accepted Answer

Restarting router sends OPEN with graceful restart capability. Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

ENCOR 350-401 practice test

Three ways to study

Study 350-401 by domain

Study 350-401 by topic

Architecture practice questions

Virtualization practice questions

Infrastructure practice questions

Network Assurance practice questions

Security practice questions

Automation practice questions

ENCOR BGP practice questions

ENCOR OSPF practice questions

ENCOR EIGRP practice questions

ENCOR VLANs and trunking practice questions

ENCOR STP practice questions

ENCOR ACLs and CoPP practice questions

Top 350-401 questions

ENCOR 350-401 practice questions