1175 questions total · 16pages · All types, answers revealed
Data quality score: 85/100 — Review before indexing
1 error found across 75 questions. This page is set to noindex until issues are resolved.
Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop the steps of EIGRP neighbor establishment into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
EIGRP neighbor formation begins with sending Hello packets, then exchanging full routing tables via Update packets, acknowledging with ACK packets, and finally entering the Established state where incremental updates are sent.
Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The sFlow agent samples packets, encapsulates them with headers, sends to collector, which decodes and analyzes, and the agent maintains counters for periodic export.
Drag and drop each DNA Center package on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Provides network analytics, health scores, and troubleshooting insights
Automates device onboarding, configuration templates, and software image management
Creates hierarchical network designs, sites, and global network settings
Defines and enforces access control, segmentation, and QoS policies
Orchestrates workflows for device replacement and network changes
Why these pairings
Cisco DNA Center packages: Assurance provides analytics and troubleshooting; Provision automates device configuration; Design creates network hierarchy and settings; Policy manages access and segmentation.
Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The workflow begins by importing necessary modules (threading and Netmiko), then defining a function that connects and sends a show command. After that, a list of devices is created, threads are started for each device, and finally all threads are joined to collect results.
A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS at 192.168.1.100 with community 'monitor'. The engineer also configures 'snmp-server enable traps snmp linkdown linkup'. The NMS receives link traps but not authentication failure traps. The engineer has not configured any access control. What is the most likely reason?
Correct because 'snmp-server enable traps snmp authentication' is needed to send authentication failure traps.
Why this answer
On Cisco IOS, authentication failure traps are not enabled by default even when 'snmp-server enable traps snmp' is configured. The engineer explicitly enabled 'linkdown' and 'linkup' traps, but authentication failure traps require the additional keyword 'authentication' in the 'snmp-server enable traps snmp' command. Without this, the switch will not generate SNMP authenticationFailure notifications (RFC 1157) when an SNMP request uses an invalid community string.
Exam trap
Cisco often tests the fact that authentication failure traps are a separate sub-option under 'snmp-server enable traps snmp' and are not enabled by default, leading candidates to assume that enabling 'snmp-server enable traps snmp' covers all SNMP-related traps.
How to eliminate wrong answers
Option B is wrong because the NMS receiving traps is a receiver-side configuration; the issue is that the switch is not generating the authentication failure traps at all, regardless of NMS configuration. Option C is wrong because the community string 'monitor' with read-write access does not suppress authentication traps; authentication failure traps are triggered by invalid community strings, not by the access level of a valid community. Option D is wrong because 'snmp-server trap-source' specifies the source interface for all traps, but it does not enable or disable specific trap types; authentication failure traps are still subject to the explicit enable requirement.
Which two statements about SNMP MIB objects and OIDs are true? (Choose two.)
Correct: The MIB is a database that defines the structure and OIDs of managed objects.
Why this answer
MIB (Management Information Base) is a hierarchical database of managed objects. Each object is identified by an OID (Object Identifier). OIDs are structured as a tree; for example, 1.3.6.1.2.1.1.1.0 is the sysDescr OID.
The MIB defines the structure and allowed operations (get, set, etc.) for each object. SNMPv2c and SNMPv3 support GetBulk, which retrieves large tables efficiently. SNMPv1 does not support GetBulk.
Drag and drop each telemetry model on the left to its matching push type (dial-in or dial-out) on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Collector connects to device, device listens
Collector initiates SSH session to device
Device connects to collector, collector listens
Device pushes data to collector
Collector requests data from device
Why these pairings
Dial-in: collector initiates connection to the network device (e.g., gRPC dial-in, NETCONF). Dial-out: device initiates connection to the collector (e.g., gRPC dial-out, model-driven telemetry).
Drag and drop the steps of PIM-SM join and source registration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In PIM-SM, a receiver's DR sends a (*,G) Join toward the RP. The RP then sends a (S,G) Join toward the source. The source's DR registers the source with the RP via a unicast Register message.
The RP de-encapsulates the Register and sends a Register-Stop back to the source's DR to stop the registration process.
Which two statements about telemetry subscription modes are true? (Choose two.)
Correct because dial-out telemetry pushes data from the device to the collector.
Why this answer
Dial-out mode pushes data from the network device to a collector, while dial-in mode requires the collector to initiate the connection. gRPC supports both modes. NETCONF can also support both but is not limited to dial-in. SNMP is a polling-based protocol, not a telemetry subscription mode.
Drag and drop the steps of DNA Center assurance issue detection and root cause into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order starts with collecting telemetry from devices, then analyzing the data to detect anomalies, then generating an issue, then identifying the root cause via guided remediation, and finally presenting the resolution steps. This aligns with Cisco's assurance workflow.
Which three statements about RSPAN configuration and behavior are true? (Choose three.)
Correct because every switch in the path needs the RSPAN VLAN to forward the mirrored traffic.
Why this answer
RSPAN requires a dedicated VLAN that is not used for user traffic. The RSPAN VLAN must be created on all switches in the path, and the destination switch must have a destination port configured. The RSPAN VLAN should not be pruned from trunks.
The source switch sends mirrored frames into the RSPAN VLAN, and the destination switch extracts them.
Drag and drop the steps of BFD session establishment for path liveliness into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
BFD session establishment starts with the edge device detecting a new transport tunnel, then sending a BFD hello packet, the remote device responds with a BFD echo, the two devices negotiate parameters, and finally the session becomes Up and is used for liveliness monitoring.
Drag and drop the steps of MAB (MAC Authentication Bypass) fallback flow into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop each STP timer on the left to its matching default value on the right.
Drag a concept onto its matching description — or click a concept then click the description.
2 seconds
15 seconds
20 seconds
32768
4
Why these pairings
Hello time default is 2 seconds; Forward delay default is 15 seconds; Max age default is 20 seconds.
Drag and drop each VM network mode on the left to its matching behavior on the right.
Drag a concept onto its matching description — or click a concept then click the description.
VM appears as a separate device on the physical network
VM uses host IP address for outbound traffic
VM can communicate only with the host and other VMs on the same host
VM can communicate only with other VMs on the same host
VM connects to a specific virtual switch
Drag and drop the steps of iBGP route reflection configuration steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Route reflection requires first enabling BGP, then configuring the cluster ID, designating the route reflector client, and finally verifying the reflection behavior.
Which two statements about EIGRP feasible successors are true? (Choose two.)
Correct because the feasibility condition requires RD < FD for a route to be considered a feasible successor.
Why this answer
A feasible successor is a backup route that meets the feasibility condition (reported distance < feasible distance). It is stored in the topology table, not the routing table, and is used immediately if the successor fails.
Which three statements about IP SLA threshold configuration and reaction are true? (Choose three.)
Correct because this command configures the threshold values and the action (e.g., trap) when the threshold is crossed.
Why this answer
IP SLA allows configuring rising and falling thresholds to trigger events. The 'reaction-configuration' command sets the threshold values and the action to take when a threshold is crossed. The 'reaction-trigger' command is used to associate the reaction with a specific action, such as enabling a backup route.
The threshold violation can be used to trigger an SNMP trap, which is a common method for network management systems to receive alerts. The threshold is not based on the number of probes sent, but on the measured values like delay or jitter. The reaction does not automatically change the probe schedule; it triggers an external action.
Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order begins with implementing the core layer to establish high-speed backbone switching. Next, connect WAN edge routers for remote site access, followed by verifying end-to-end connectivity and redundancy to ensure the infrastructure works before adding edge services. Then, design the access layer with VLANs and port security, and finally configure the distribution layer for inter-VLAN routing.
This sequence ensures the foundational transport is in place before adding user-facing and aggregation services.
What is the default OSPF hello interval on an Ethernet link?
Correct. OSPF default hello interval on Ethernet is 10 seconds.
Why this answer
The default OSPF hello interval on an Ethernet (broadcast multi-access) link is 10 seconds, as defined in RFC 2328. This interval determines how often a router sends Hello packets to discover and maintain neighbor relationships. The correct answer is A because Ethernet is a broadcast network type, which uses a 10-second hello interval by default.
Exam trap
Cisco often tests the distinction between broadcast and NBMA network types, where candidates confuse the 30-second hello interval of NBMA with the 10-second default for Ethernet.
How to eliminate wrong answers
Option B (30 seconds) is wrong because 30 seconds is the default hello interval for OSPF on non-broadcast multi-access (NBMA) networks, such as Frame Relay, not Ethernet. Option C (40 seconds) is wrong because 40 seconds is the default dead interval (4 times the hello interval) on broadcast networks, not the hello interval itself. Option D (5 seconds) is wrong because 5 seconds is the default hello interval for OSPF on point-to-point links, not Ethernet broadcast links.
Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
An architect is designing an SD-Access fabric for a campus with multiple buildings. The design must support wireless clients seamlessly roaming across fabric edge nodes. Which technology is used in the fabric to provide mobility for wireless endpoints?
LISP handles endpoint mobility by updating the EID-to-RLOC mapping when a client roams.
Why this answer
LISP (Locator/ID Separation Protocol) is the correct technology because it decouples the endpoint identifier (EID) from its routing locator (RLOC), enabling seamless roaming across fabric edge nodes. In SD-Access, LISP maintains a mapping database that tracks wireless endpoint locations, allowing traffic to be forwarded to the correct fabric edge without re-anchoring or tunneling changes as clients move between access points.
Exam trap
Cisco often tests the misconception that VXLAN alone handles mobility, but the trap here is that VXLAN is only the data-plane encapsulation; LISP is the control-plane protocol that actually enables endpoint tracking and seamless roaming in SD-Access.
How to eliminate wrong answers
Option B (VXLAN) is wrong because VXLAN is used for network virtualization and overlay encapsulation in SD-Access, but it does not provide endpoint mobility or location tracking; LISP handles the control plane for mobility. Option C (OTV) is wrong because OTV is a Layer 2 extension technology for connecting data centers over Layer 3 networks, not designed for endpoint mobility within a campus fabric. Option D (MPLS) is wrong because MPLS is a label-switching transport technology used for traffic engineering and VPNs, lacking the endpoint identity-to-location mapping required for wireless roaming in SD-Access.
Drag and drop each IPv6 ACL feature on the left to its matching IPv4 ACL equivalent on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Equivalent to ip access-list extended in IPv4
Equivalent to deny ip in IPv4 extended ACL
Equivalent to permit tcp in IPv4 extended ACL
Equivalent to sequence number in IPv4 named ACL
Equivalent to implicit deny ip in IPv4 ACL
Why these pairings
IPv6 ACLs use similar logic but with IPv6-specific syntax: deny/ipv6, permit/ipv6, sequence numbers, and implicit deny.
A network engineer writes the following Python script to retrieve the list of devices from Cisco DNA Center using the REST API: import requests import json url = "https://dna-center.local/dna/intent/api/v1/network-device" headers = { "Content-Type": "application/json", "X-Auth-Token": "valid-token-here" } response = requests.get(url, headers=headers, verify=False) if response.status_code == 200: devices = response.json() for device in devices["response"]: print(device["hostname"]) else: print("Error:", response.status_code) What is the issue with this code?
Correct. The API may return multiple pages, but the code only retrieves the first page. It should check for a 'lastIndex' field and loop to fetch all pages.
Why this answer
The code does not handle pagination. Cisco DNA Center API returns a maximum of 500 devices by default, and if more exist, the response includes a 'lastIndex' or similar field. The code only processes the first page.
Drag a concept onto its matching description — or click a concept then click the description.
Describes a router's directly attached links and interfaces
Generated by the DR to list all routers on a multiaccess segment
Advertises inter-area prefixes between areas
Advertises the location of an ASBR to other areas
Advertises external routes redistributed into OSPF
Why these pairings
LSA Type 1 (Router LSA) describes a router's own interfaces and links. Type 2 (Network LSA) is generated by the DR to describe all routers on a multiaccess network. Type 3 (Summary LSA) advertises networks from one area to another.
Type 4 (ASBR Summary LSA) advertises the location of an ASBR. Type 5 (AS External LSA) advertises external routes redistributed into OSPF.
Drag and drop the steps of the 802.11 client association process into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The 802.11 client association process begins with the client sending a Probe Request to discover networks, followed by a Probe Response from the AP. Then the client sends an Authentication Request, the AP replies with an Authentication Response, and finally the client sends an Association Request, which the AP confirms with an Association Response.
Drag and drop the steps of Syslog severity filtering and rate-limiting configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First enable logging, then set severity, apply rate-limit, specify destination, and finally verify the configuration.
Which two statements about VLAN configuration and verification are true? (Choose two.)
True. The 'vlan vlan-id' command in global configuration mode creates a VLAN.
Why this answer
The correct statements are A and B. Statement A is true because the 'vlan vlan-id' command in global configuration mode creates a VLAN. Statement B is true because 'show vlan brief' displays all VLANs, including reserved VLANs 1002-1005 (though they are not user-created).
Statement C is false because VLAN 1 is a default VLAN and cannot be deleted. Statement D is false because the 'switchport access vlan' command does not automatically create the VLAN; the VLAN must already exist. Statement E is false because 'show interfaces trunk' displays trunking interfaces along with their allowed VLAN list and native VLAN, not solely the native VLAN.
Drag and drop each Python library on the left to its matching network use case on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Multi-vendor SSH connection and command execution
Network automation and configuration management with vendor-agnostic API
Parallel task execution for network automation
Screen-scraping network devices with structured output
Low-level SSH protocol implementation for Python
Why these pairings
Netmiko is used for multi-vendor SSH connections, NAPALM for network automation and configuration management, Nornir for parallel task execution, Scrapli for screen-scraping network devices, and Paramiko for low-level SSH connections.
Drag and drop each WAN topology type on the left to its matching characteristic on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Simple dedicated link between two sites
Central site connects to multiple remote sites
Every site directly connected to every other site
Some sites directly connected, others through intermediate
Service provider network providing any-to-any Layer 3 connectivity
Why these pairings
Point-to-point is simple and dedicated; hub-and-spoke centralizes traffic; full mesh provides high redundancy; partial mesh balances cost and redundancy; MPLS VPN offers any-to-any connectivity.
Examine the following configuration for a Cisco IOS-XE device: interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 ipv6 address 2001:db8::1/64 ipv6 ospf 1 area 0 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ipv6 address 2001:db8:1::1/64 ipv6 ospf 1 area 0 ! ipv6 router ospf 1 router-id 2.2.2.2 Which statement is true about OSPFv3 operation?
Correct. OSPFv3 always uses link-local addresses for neighbor communication. The global addresses are used for routing.
Why this answer
OSPFv3 runs per interface and uses link-local addresses for neighbor discovery. The router-id is required and must be unique. Both interfaces are in area 0.
Which three statements about EIGRP route summarization are true? (Choose three.)
Correct because this is the standard command to configure a manual summary route on a specific interface.
Which BGP attribute is preferred when it has the lowest value?
Correct. MED is a metric that is preferred with the lowest value.
Why this answer
BGP uses multiple attributes in its path selection algorithm. The weight attribute is Cisco-specific and is preferred with the highest value. The local preference is also preferred with the highest value.
The MED (Multi-Exit Discriminator) is preferred with the lowest value.
Drag and drop each WAN encapsulation on the left to its matching use case on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Default serial encapsulation on Cisco routers
Supports PAP/CHAP authentication and multilink
Used for DSL broadband connections
Legacy Layer 2 VPN using DLCIs
Bonding multiple PPP links for higher bandwidth
Why these pairings
HDLC is default synchronous serial encapsulation. PPP supports authentication and multilink. PPPoE is used over DSL.
Frame Relay is legacy L2 VPN. MLPPP bonds multiple links.
An engineer is using a Python script to configure a new VLAN on a Cisco Nexus 9000 switch using the NX-API REST API. The script sends a POST request to 'https://switch/api/mo/org.json' with a JSON payload containing the VLAN configuration. The switch responds with a 403 Forbidden error. What is the most likely cause?
Correct because 403 indicates authorization failure; the user needs appropriate privileges.
Why this answer
A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. In NX-API, this often occurs when the user does not have sufficient privileges to perform the operation. The engineer should check that the user account used for authentication has the necessary RBAC roles to configure VLANs.
Drag and drop each EIGRP state on the left to its matching DUAL stage on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Route is stable and no DUAL computation is in progress
DUAL is actively querying neighbors for an alternate path
Query has not been replied to within the active timer
Router sends queries to all neighbors for a lost route
Router has received all replies to its queries
Why these pairings
Passive is the stable state; Active is when DUAL is actively searching for a new route; Stuck in Active occurs when a query is not answered within the active timer.
Drag and drop each Control plane protection feature on the left to its matching threat on the right.
Drag a concept onto its matching description — or click a concept then click the description.
DoS attack on control plane
IP spoofing attack
Rogue DHCP server attack
ARP cache poisoning attack
IP spoofing on access ports
Why these pairings
CoPP protects against DoS attacks on the control plane, uRPF against IP spoofing, DHCP snooping against rogue DHCP servers, DAI against ARP cache poisoning, and IP Source Guard against IP spoofing at Layer 2.
A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?
Inconsistent mapping breaks VXLAN bridging.
Why this answer
VXLAN EVPN requires consistent VLAN-to-VNI mapping across all VTEPs in the fabric. If VLAN 100 is mapped to VNI 10100 on some switches but not others, traffic for that VNI will not be forwarded correctly, as the mapping is used to associate local VLANs with the VXLAN segment. Option D is correct because the VNI must be explicitly enabled under the NVE interface to participate in VXLAN tunnel termination; without it, the VTEP will not encapsulate or decapsulate traffic for VNI 10100.
Exam trap
Cisco often tests the distinction between control-plane (BGP EVPN) and data-plane (multicast) VXLAN, leading candidates to incorrectly check multicast reachability (Option B) when the issue is a missing or inconsistent VNI configuration.
Drag and drop each LACP port mode on the left to its matching negotiation behavior on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Sends LACP packets and responds to LACP packets
Responds to LACP packets but does not initiate
Both sides send LACP packets, forms channel
One side initiates, other responds, forms channel
Neither side initiates, no channel formed
Why these pairings
Active initiates negotiation; passive waits for partner. Both must have at least one active side to form EtherChannel.
Drag and drop each Cisco security feature on the left to its matching OSI layer on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Layer 2
Layer 3
Layer 3/4
Layer 4-7
Layer 2
Why these pairings
Port security operates at Layer 2; ACL at Layer 3; zone-based firewall at Layer 3/4; IPS at Layer 4-7; MACsec at Layer 2.
Match each QoS feature to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Identifying traffic based on specific fields
Setting the DSCP or CoS value in a packet
Dropping packets that exceed a configured rate
Buffering packets to maintain a configured rate
Managing packet order during congestion
Why these pairings
Correct matches: Classification (A), Marking (B), Policing (C), Queuing (F). Common confusions: Shaping vs. Congestion Avoidance (WRED), where Shaping buffers and WRED drops early.
Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
ERSPAN configuration requires first defining the source, then the destination with encapsulation, optionally filtering VLANs, and finally activating the session.
Drag and drop each EIGRP packet type on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Discovers and maintains neighbors
Carries routing information
Asks for successor information
Responds to a query
Acknowledges receipt of a reliable packet
Why these pairings
Hello packets discover and maintain neighbors; Update packets carry routing information; Query packets ask for successor information; Reply packets respond to queries; ACK packets acknowledge reliable packets.
Drag and drop the steps of EtherChannel load-balancing hash configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order begins with choosing the global load-balancing method (A) such as src-dst-ip. Next, apply the method using the 'port-channel load-balance' command (B). Optionally, override the method on a per-interface basis using the 'load-balance' command (D).
Then verify the configuration with 'show etherchannel load-balance' (C). Finally, test the hash distribution by sending traffic across the bundle (E) to confirm proper load balancing.
Which two statements about Ansible automation in a Cisco environment are true? (Choose two.)
Correct: Ansible pushes configurations from the control node to managed nodes using SSH or APIs.
Why this answer
Ansible uses a push-based model where the control node pushes modules to managed nodes. It is agentless, relying on SSH or API connections. Ansible Tower provides a web UI and RBAC, while the default inventory is INI-based.
Playbooks are written in YAML, not Python. Ansible Galaxy is a community hub for roles.
Drag and drop the steps of SD-Access fabric border node configuration steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Configuration starts with enabling LISP on the border node, then configuring the EID-to-RLOC mapping and border services. Next, the border is connected to external networks (e.g., WAN), followed by applying VRF and SGT policies, and finally verifying the border operation.
What is the default update interval for a Cisco IOS-XE telemetry subscription when using update-policy periodic without specifying a value?
The default periodic interval is 10 seconds (10000 ms).
Why this answer
The default periodic interval is 10000 milliseconds (10 seconds) if not explicitly configured.
Drag and drop the steps of SNMPv3 secure agent configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order for SNMPv3 secure agent configuration is: First, define the SNMPv3 group with security model (B). Then, enable the SNMP agent with snmp-server command (A). Next, create the SNMPv3 user with authentication and privacy keys (C).
Then, assign the user to the group (D). Finally, configure SNMPv3 view and ACL for access restriction (E). This order ensures that the group and user are defined before enabling the agent, and access control is applied last.
Exam trap
A common mistake is to enable the SNMP agent first, but the group and security model must be configured before enabling the agent to ensure the agent starts with the correct security configuration.
Which three statements about using Python for device inventory and data serialization in network automation are true? (Choose three.)
Correct because this is a common pattern: use PyYAML to load a YAML inventory file, iterate over devices, and use Netmiko or NAPALM to collect facts.
Why this answer
The correct answers describe practical uses of Python for inventory management and data handling. The incorrect options either misattribute YAML's features (it does not support comments natively in all parsers) or incorrectly state that JSON is always more human-readable than YAML (YAML is often considered more readable).
Drag and drop each HTTP status code on the left to its meaning on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Request succeeded
Resource created
Malformed request syntax
Authentication required or failed
Requested resource not found
Why these pairings
Correct pairings: 200 OK for success; 201 Created for resource creation; 400 Bad Request for client error; 401 Unauthorized for missing/invalid credentials; 404 Not Found for missing resource; 500 Internal Server Error for server-side failure.
Drag and drop each IP SLA operation type on the left to its measured metric on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Round-trip time and packet loss
Delay, jitter, and packet loss
Connection establishment time
Page load time and success
DNS resolution time
Drag and drop each IGMP version on the left to its matching feature on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Uses a query/response model with no leave group message
Adds leave group messages and querier election; Supports fast leave by sending a leave group message
Adds source filtering (include/exclude lists); Allows hosts to specify which sources to receive or block
Why these pairings
IGMPv1 uses a query/response model; IGMPv2 adds leave group messages and querier election; IGMPv3 adds source filtering (include/exclude).
Drag and drop the steps of MPLS FRR (Fast Reroute) backup tunnel activation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
MPLS FRR begins with configuring the backup tunnel on the PLR. The PLR then merges the backup tunnel with the protected LSP. When a link or node failure is detected, the PLR immediately switches traffic to the backup tunnel.
After the failure is repaired, traffic reverts to the primary LSP via make-before-break.
Drag and drop the steps of OSPFv3 IPv6 neighbor adjacency formation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
OSPFv3 neighbor formation follows the same state machine as OSPFv2: Down, Init, 2-Way, ExStart, Exchange, Loading, Full. The steps reflect the key actions at each state.
A network engineer is implementing model-driven telemetry on a Cisco Nexus 9000 switch to monitor VLAN and STP changes. The engineer wants to use the native telemetry protocol with UDP as the transport. After configuring the telemetry subscription with the 'destination-group' and 'sensor-group', the engineer notices that the collector is not receiving any data. The collector is reachable and the UDP port is open. What is the most likely missing configuration?
On Nexus, a telemetry policy is required to link the sensor and destination groups; without it, no data is streamed.
Why this answer
That the engineer must configure a 'policy' that associates the sensor-group with the destination-group and commits the configuration. On Nexus switches, model-driven telemetry requires a policy to bind the sensor and destination groups. The other options are incorrect because the source-interface is optional; the YANG models are correct; and the encoding is not the issue.
Drag and drop the steps of BGP confederations setup between sub-ASes into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Confederation setup requires enabling BGP, configuring the confederation identifier and sub-AS list, then peering between sub-ASes, and finally verifying the confederation membership.
Which two statements about the 'ip access-group' command are true? (Choose two.)
Correct because the command syntax is 'ip access-group {acl-name} {in|out}'.
Why this answer
The 'ip access-group' command is used to apply an ACL to an interface in a specific direction (in or out). It can be applied to both Layer 3 interfaces (routed ports) and SVIs. The ACL must already exist in the configuration.
The command does not create the ACL; it only applies it. The 'in' direction filters traffic entering the interface, and 'out' filters traffic leaving.
Drag and drop each OSPF router role on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Generates Type 2 Network LSA and maintains full adjacencies with all routers on the segment
Becomes DR if the current DR fails; also maintains full adjacencies
Forms adjacencies only with DR and BDR; does not form full adjacencies with other DROTHERs
Redistributes routes from other routing protocols into OSPF
Connects two or more OSPF areas and advertises inter-area routes
Why these pairings
DR (Designated Router) generates Network LSAs and manages adjacencies on multi-access networks; BDR (Backup DR) takes over if the DR fails; DROTHER routers form full adjacencies only with DR and BDR; ASBR redistributes routes from other protocols; ABR connects multiple areas.
Drag and drop the steps of PIM DM (Dense Mode) flood and prune steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
PIM DM initially floods multicast traffic to all PIM-enabled interfaces; downstream routers that have no interested receivers send Prune messages upstream to stop unwanted traffic.
Which two statements about EIGRP stub routing are true? (Choose two.)
Correct because the default stub setting (without keywords) advertises connected and summary routes.
Why this answer
EIGRP stub routing limits the routes a stub router advertises, preventing it from being used as a transit router. Common stub types include connected, static, summary, and receive-only.
Which two statements about NetFlow are true? (Choose two.)
NetFlow v9 uses a template-based architecture that allows flexible and extensible flow record formats. This is a key feature of v9.
Why this answer
Three statements are true: B (NetFlow v9 is template-based), C (Sampled NetFlow reduces CPU impact), and E (NetFlow can be used for IPv4 and IPv6 monitoring). The question asks for two, but three are factually correct; the original marking of E as wrong is inaccurate. A uses TCP instead of UDP, and D incorrectly claims full payload inclusion.
Which two statements about local AAA and fallback methods are true? (Choose two.)
Correct because local authentication relies on the username/password stored on the device.
Why this answer
Local AAA uses the device's local database for authentication. Fallback methods define the order of servers to try. If all servers are unreachable, the local database can be used as a backup.
The 'aaa authentication login default local' command uses the local database only. The 'aaa new-model' command enables AAA globally.
Drag and drop each NetFlow version on the left to its matching feature on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Fixed-format records with no templates; Supports only key fields and a limited set of non-key fields
Template-based flow records with user-defined fields; Introduces the concept of flow templates
Standardized version of NetFlow with variable-length fields
Why these pairings
NetFlow v5 sends fixed-format records with no user-defined fields. v9 supports templates and flexible field definitions. IPFIX is the standardized version of v9 with additional fields and variable-length support.
Drag and drop the steps of Cisco DNA Center device onboarding via PnP into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The PnP onboarding process begins with the device obtaining an IP address via DHCP and receiving the PnP server address from DHCP options. The device then discovers the Cisco DNA Center PnP server and authenticates using a certificate or credentials. After authentication, the device downloads its Day 0 configuration and image from DNA Center.
Finally, the device applies the configuration and joins the fabric or network.
Which two statements about NetFlow flow records and export are correct? (Choose two.)
Correct because v9 introduces templates that define which fields are exported, allowing flexibility.
Drag and drop the steps of disaster recovery failover process into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Failover begins with detecting the primary failure, then activating the backup path. Traffic is redirected to the secondary site, and after the primary is restored, operations are switched back in a controlled manner.
Drag and drop the steps of streaming telemetry sensor path subscription flow into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop the steps of OSPF SPF calculation steps (Dijkstra) into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The Dijkstra SPF algorithm first initializes the candidate list with the root router itself. It then examines the root's neighbors, adding them to the candidate list. The router with the lowest cost is moved from candidate to the SPF tree.
The process repeats by examining the newly added router's neighbors and updating the candidate list. Finally, when all routers are in the SPF tree, the algorithm terminates and the routing table is populated.
Drag and drop each SPAN type on the left to its correct scope description on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Mirrors traffic only on the source switch
Uses a dedicated VLAN to carry mirrored traffic between switches
Encapsulates mirrored traffic in GRE and routes over IP
Receives a copy of monitored traffic
The interface being monitored
Why these pairings
Local SPAN mirrors traffic on the same switch; RSPAN uses a dedicated VLAN to transport mirrored traffic across switches; ERSPAN encapsulates mirrored packets in GRE and routes them over Layer 3.
Which three statements about virtual machine (VM) resource allocation and overcommitment are true? (Choose three.)
Correct because hypervisors use techniques like ballooning to reclaim memory from idle VMs.
Why this answer
Resource overcommitment allows a hypervisor to allocate more virtual resources than physical resources, but careful monitoring is required to avoid performance issues. Option A is correct because memory overcommitment uses techniques like ballooning or swapping. Option B is correct because CPU overcommitment can lead to contention if many VMs compete for CPU time.
Option D is correct because storage overcommitment can cause performance degradation if thin provisioning leads to oversubscription. Option C is incorrect because overcommitment does not guarantee isolation; it can actually reduce isolation. Option E is incorrect because overcommitment is not limited to memory; it applies to CPU and storage as well.
Drag and drop the steps of configuring a Layer 2 EtherChannel using PAgP into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, create the port-channel interface globally. Then set the channel-group mode to desirable on the first interface. Next, set the same mode on the second interface.
After that, verify the bundle forms using show commands. Finally, assign the port-channel to a VLAN to enable data forwarding. This sequence ensures PAgP negotiation completes before the bundle is used.
A network engineer issues the following command on Router R4: R4# show ip ospf database OSPF Router with ID (4.4.4.4) (Process ID 1) Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 1.1.1.1 1.1.1.1 123 0x80000002 0x00A1B2 2 2.2.2.2 2.2.2.2 456 0x80000003 0x00B2C3 3 4.4.4.4 4.4.4.4 789 0x80000001 0x00C3D4 1 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 192.168.1.2 2.2.2.2 234 0x80000001 0x00D4E5 Based on this output, what can be concluded?
The Net Link State is originated by the DR, and the ADV Router is 2.2.2.2, so it is the DR.
Why this answer
The Net Link States entry shows the link ID 192.168.1.2 (the DR's interface IP) and ADV Router 2.2.2.2, which indicates that router 2.2.2.2 is the Designated Router (DR) on the 192.168.1.0/24 segment. In OSPF, only the DR originates the Type 2 (Network LSA) for a broadcast segment, so the advertising router in the Net Link States is always the DR.
Exam trap
Cisco often tests the misconception that the ADV Router in a Net Link State is the router that owns the IP address in the Link ID field, when in fact it is always the DR on that segment.
How to eliminate wrong answers
Option B is wrong because the Router Link States show a link count of 2 for router 1.1.1.1, meaning it has exactly two OSPF-enabled interfaces, not three. Option C is wrong because the output does not include any information about the BDR; the Net Link States only identifies the DR (2.2.2.2), and there is no separate BDR field in the OSPF database output. Option D is wrong because only one Net Link State entry is present (for 192.168.1.0/24), which indicates a single broadcast segment in area 0; multiple broadcast segments would produce multiple Type 2 LSAs.
Which of the following are requirements of an RSPAN VLAN? (Select all that apply.)
Why this answer
The RSPAN VLAN must not be the native VLAN; it must be allowed on all trunk ports between source and destination; no other traffic should use it; it must exist on all intermediate switches; it must be configured as an RSPAN VLAN.
Examine the following HSRP configuration on a Cisco IOS-XE switch: interface Vlan10 ip address 10.0.0.2 255.255.255.0 standby 10 ip 10.0.0.1 standby 10 priority 150 standby 10 preempt What is the effect of the 'standby 10 preempt' command?
Preempt enables the router to take over the active role when it has a higher priority.
Why this answer
The preempt command allows this router to become the active HSRP router if it has a higher priority than the current active router. Without preempt, the router with higher priority would not take over unless the current active fails.
Practice 350-401 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →Study 350-401 by topic
Focused topic pages — one weak area at a time.