Courseiva

ENCOR 350-401 (350-401) — Questions 1126–1175

1175 questions total · 16pages · All types, answers revealed

Take a mock examExam hub
Page 15

Page 16 of 16

1126
Multi-Selecthard

Which three statements about RPF check in IP multicast are true? (Choose three.)

Select 3 answers
A.The RPF check ensures that multicast packets are forwarded only if they arrive on the interface that the router would use to send unicast traffic back to the source.
B.If the RPF check fails, the multicast packet is dropped by the router.
C.The RPF check is performed only on the first packet of a multicast stream to determine the forwarding path.
D.The RPF check relies solely on the multicast routing table (MRIB) to determine the incoming interface.
E.A multicast packet can fail the RPF check even if the unicast route to the source exists, if the packet arrives on a different interface than the one used for unicast return traffic.
AnswersA, B, E

Correct because the RPF check uses the unicast routing table to determine the expected incoming interface for the source.

Why this answer

The RPF check is a fundamental multicast forwarding mechanism that verifies the source address of incoming multicast packets against the unicast routing table. A packet passes RPF if it arrives on the interface that the router would use to reach the source. If the RPF check fails, the packet is dropped to prevent loops.

RPF is performed on every multicast packet, not just the first one. The RPF check is independent of the multicast routing protocol; it uses the unicast routing table. RPF failure can occur even with a correct unicast route if the packet arrives on a different interface.

Full explanation →
1127
Drag & Dropmedium

Drag and drop the steps of OpenAPI schema validation for DNA Center REST call into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Validation begins with retrieving the OpenAPI spec, then parsing the endpoint, validating the request against the schema, checking the response, and finally handling any validation errors.

Full explanation →
1128
Drag & Dropmedium

Drag and drop the steps of 4G/LTE WAN failover with IP SLA tracking into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, configure the primary WAN interface and the LTE backup interface. Then, create an IP SLA probe to monitor the primary link. Track the SLA with a tracking object.

Set a static route with a higher metric for the LTE interface, tied to the track. When the primary fails, the track goes down, and the LTE route becomes active.

Full explanation →
1129
Matchingmedium

Drag and drop each DNA Center ISE integration component on the left to its matching role on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Enables real-time context sharing between DNA Center and ISE

Defines and enforces security group access policies across the network

Provides authentication, authorization, and accounting for network access

Carries security group tag information in data packets for policy enforcement

Allows manual configuration of ISE policies and user identity stores

Why these pairings

ISE integration: pxGrid shares context data; TrustSec enforces segmentation; RADIUS provides authentication; SGT carries security group tags.

Full explanation →
1130
Multi-Selectmedium

Which two statements about NFV architecture and components are true? (Choose two.)

Select 2 answers
A.The NFV Infrastructure (NFVI) includes compute, storage, and networking resources that host VNFs.
B.Virtual Network Functions (VNFs) are software implementations of network functions that run on virtualized infrastructure.
C.Each VNF must be deployed on its own dedicated physical server to ensure performance isolation.
D.The Virtualized Infrastructure Manager (VIM) is responsible for managing the lifecycle of VNFs.
E.The NFV Orchestrator is primarily responsible for allocating virtual resources to VNFs.
AnswersA, B

Correct because the NFVI provides the virtualized resources (compute, storage, network) upon which VNFs are deployed.

Why this answer

NFV decouples network functions from dedicated hardware. The NFV Infrastructure includes compute, storage, and networking resources. VNFs run on top of the NFVI.

The NFV MANO framework orchestrates and manages these components. Option A is correct because NFVI provides the virtualized resources. Option B is correct because VNFs are software implementations of network functions.

Option C is incorrect because NFV does not require dedicated hardware per VNF; it relies on shared infrastructure. Option D is incorrect because VNFs are managed by the VNFM, not the VIM. Option E is incorrect because the NFV Orchestrator handles lifecycle management, not just resource allocation.

Full explanation →
1131
Drag & Dropmedium

Drag and drop the steps of Rapid PVST+ topology change notification process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In Rapid PVST+, a topology change is triggered when a non-edge port transitions to forwarding. The switch then sets the proposal bit on its designated ports, sends a proposal message, and expects an agreement from the downstream switch. After receiving the agreement, the port moves to forwarding and the switch propagates the change by setting the TC flag in BPDUs sent on all designated ports.

This ensures rapid convergence.

Full explanation →
1132
Drag & Drophard

Drag and drop the steps of gNMI Subscribe RPC using Python gRPC library into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with importing the gNMI protobuf modules and gRPC, creating a secure channel with credentials, instantiating the gNMI stub, building a SubscribeRequest with paths and mode, and finally calling the Subscribe RPC and iterating over responses.

Full explanation →
1133
MCQhard

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

A.The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
B.The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
C.The internal routers have a route to the default network with a better metric from another source.
D.The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
AnswerB

Correct. The static default route must be correctly configured with a next-hop IP address. If the static route is missing or uses an interface instead of a next-hop, it may not be valid, and the redistribution will not propagate the route to internal routers, despite appearing in the topology table with a metric.

Why this answer

The engineer's configuration includes both 'ip default-network 0.0.0.0' (which is an IGRP command, not EIGRP) and redistribution of a static default route. The appearance of the default route in the EIGRP topology table with metric 1 indicates that redistribution occurred, but the route is not being advertised to internal routers. The most likely reason is that the static default route itself is not correctly configured.

For EIGRP redistribution to succeed, the static route must point to a valid next-hop IP address using the syntax 'ip route 0.0.0.0 0.0.0.0 <next-hop>'. If the engineer used an interface instead of a next-hop, or the next-hop is unreachable, the static route may be invalid or not installed in the routing table, preventing its advertisement to EIGRP neighbors.

Exam trap

Cisco often tests the misconception that 'ip default-network' works with EIGRP, when in fact it is an IGRP-specific command, and candidates may confuse it with the correct 'default-information originate' command used in EIGRP and OSPF.

How to eliminate wrong answers

Option B is wrong because the static route syntax 'ip route 0.0.0.0 0.0.0.0 <next-hop>' is correct and commonly used; the issue is not with the static route configuration but with the EIGRP advertisement method. Option C is wrong because the topology table shows the default route with a metric of 1, and if internal routers had a better metric from another source, the route would still be present in the topology table but not selected as best; the problem is that the route is not being advertised at all. Option D is wrong because configuring 'eigrp stub' restricts the router from advertising routes learned from other EIGRP neighbors, but it does not prevent the advertisement of a locally originated default route via 'default-information originate'; the stub feature is used to limit route propagation, not to enable default route advertisement.

Full explanation →
1134
Multi-Selectmedium

Which two statements about IP Source Guard are true? (Choose two.)

Select 2 answers
A.IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.
B.IP Source Guard filters traffic based on the source MAC address.
C.IP Source Guard is applied on Layer 3 interfaces of a switch.
D.IP Source Guard can be configured with a static IP source binding for hosts with static IP addresses.
E.IP Source Guard requires 802.1X authentication to function.
AnswersA, D

Correct because IPSG relies on the DHCP snooping binding database to determine which source IP addresses are allowed on a given port.

Why this answer

IP Source Guard (IPSG) filters IP traffic on a per-port basis using the DHCP snooping binding database. Option A is correct because IPSG uses the binding database to validate source IP addresses. Option D is correct because IPSG can be configured with a static IP source binding for hosts with static IP addresses.

Option B is incorrect because IPSG does not filter MAC addresses; that is the role of port security. Option C is incorrect because IPSG is applied on Layer 2 switch ports, not on Layer 3 interfaces. Option E is incorrect because IPSG does not require 802.1X; it can work with DHCP snooping alone.

Full explanation →
1135
Multi-Selectmedium

Which two statements about YANG data models in model-driven telemetry are true? (Choose two.)

Select 2 answers
A.YANG models are used to define the data structures streamed in telemetry subscriptions.
B.OpenConfig YANG models are vendor-neutral and supported across multiple network operating systems.
C.Native YANG models are standardized by the IETF and used universally.
D.NETCONF is a YANG data model used for telemetry configuration.
E.RESTCONF provides a YANG-based data model for streaming telemetry.
AnswersA, B

Correct because YANG provides the schema for telemetry data, ensuring consistent encoding.

Why this answer

YANG models define the structure and constraints of telemetry data. Native models are vendor-specific, while OpenConfig models are standardized. IETF models are also standards-based but not vendor-specific.

NETCONF uses YANG but is not a data model. RESTCONF is a protocol, not a model.

Full explanation →
1136
Matchingmedium

Drag and drop each NFV component on the left to its matching role on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Virtualized network function software (e.g., virtual router)

Physical and virtual resources (compute, storage, networking)

Orchestration and lifecycle management framework

Manages NFVI resources (e.g., OpenStack)

Manages lifecycle of individual VNFs

Why these pairings

VNF is the virtualized network function software; NFVI is the infrastructure of compute, storage, and networking; MANO handles orchestration and lifecycle management.

Full explanation →
1137
Multi-Selecthard

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Select 3 answers
A.The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
B.The authenticator is typically a network switch or wireless access point.
C.The supplicant is the device that provides authentication services, such as a RADIUS server.
D.The authentication server is usually a RADIUS server that validates credentials.
E.802.1X is only supported on wireless networks and cannot be used on wired switches.
AnswersA, B, D

Correct; EAPoL is the encapsulation used for 802.1X on wired LANs.

Why this answer

802.1X uses EAP over LAN (EAPoL) for communication between supplicant and authenticator, the authenticator is typically a switch, and the authentication server is usually a RADIUS server. Option A is correct because EAPoL is the protocol used. Option B is correct because the switch acts as the authenticator.

Option D is correct because the authentication server is typically RADIUS. Option C is incorrect because the supplicant is the client, not the switch. Option E is incorrect because 802.1X can be used with both wired and wireless networks.

Full explanation →
1138
Multi-Selectmedium

Which four statements about LACP (Link Aggregation Control Protocol) are true? (Choose four.)

Select 4 answers
A.LACP uses multicast destination address 01-80-c2-00-00-02 for its frames.
B.The LACP system priority is used to determine which switch is the controlling switch in the aggregation.
C.LACP port priority is used to select which ports become active when the number of ports exceeds the maximum allowed.
D.LACP can negotiate EtherChannels with devices that run PAgP.
E.The default LACP system priority on Cisco switches is 32768.
AnswersA, B, C, E

Correct because LACP uses the IEEE 802.3 Slow Protocols multicast address 01-80-c2-00-00-02.

Why this answer

Options A, B, C, and E are correct. LACP uses multicast address 01-80-c2-00-00-02 (A). The system priority determines the controlling switch (B).

Port priority selects active ports when the number of ports exceeds the maximum allowed (C). On Cisco switches, the default LACP system priority is 32768 (E). Option D is incorrect because LACP and PAgP are incompatible protocols.

Full explanation →
1139
Matchingmedium

Drag and drop each queuing mechanism on the left to its matching use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Strict priority for delay-sensitive traffic

Guaranteed bandwidth for defined classes; Bandwidth guarantee for data traffic

Strict priority queue with CBWFQ for voice/video

Fair queuing for all flows

Why these pairings

PQ provides strict priority for delay-sensitive traffic, CBWFQ guarantees bandwidth for defined classes, LLQ combines strict priority with CBWFQ for real-time traffic, WFQ provides fair queuing for all flows, CBWFQ is used for data traffic requiring bandwidth guarantees.

Full explanation →
1140
Multi-Selectmedium

Which two statements about OSPF network types are true? (Choose two.)

Select 2 answers
A.On a broadcast multiaccess network, OSPF elects a DR and BDR to reduce LSA flooding.
B.The OSPF point-to-point network type requires a DR/BDR election.
C.On a non-broadcast multiaccess (NBMA) network, OSPF can use the neighbor command to manually discover neighbors.
D.The OSPF point-to-multipoint network type always elects a DR.
E.The default OSPF network type for a loopback interface is point-to-point.
AnswersA, C

Correct because on broadcast networks (e.g., Ethernet), a Designated Router (DR) and Backup DR are elected to minimize the number of adjacencies and flooding.

Why this answer

OSPF network types control how adjacencies are formed and how LSAs are flooded. Broadcast and non-broadcast types require a DR/BDR election, while point-to-point and point-to-multipoint do not. The loopback interface defaults to loopback network type, not point-to-point.

Full explanation →
1141
Drag & Dropmedium

Drag and drop the steps of Cisco DHCP snooping binding table population into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

DHCP snooping builds the binding table by first enabling snooping globally, then on specific VLANs, and designating trusted ports. The switch intercepts DHCP messages, extracts client info from ACK packets, and populates the binding table with the lease information.

Full explanation →
1142
Matchingmedium

Drag and drop each VTP mode on the left to its matching capability on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Can create, modify, and delete VLANs; advertises VTP updates

Cannot create VLANs; synchronizes from VTP servers

Forwards VTP advertisements but does not process them

Disables VTP; does not forward advertisements

Why these pairings

VTP server mode can create, modify, and delete VLANs, advertises VTP updates, and stores the VLAN database in NVRAM. Client mode synchronizes from servers and cannot create VLANs. Transparent mode forwards VTP advertisements but does not process them.

Off mode disables VTP entirely.

Full explanation →
1143
MCQmedium

A network engineer is troubleshooting a model-driven telemetry deployment on a Cisco IOS-XE router. The telemetry subscription is configured to stream interface statistics using gRPC dial-out to a collector at 10.1.1.100:50051. The engineer verifies that the collector is listening on the port and the router can reach it. However, the collector shows no data received. The engineer checks the router's telemetry logs and sees 'Connection refused' errors. What is the most likely cause?

A.The collector's firewall is blocking the connection from the router
B.The gRPC server on the collector is not running or is listening on a different port
C.The telemetry subscription is missing the 'encoding' configuration
D.The router's source-interface is not configured, causing the router to use an unreachable IP
AnswerB

'Connection refused' occurs when the TCP SYN reaches the host but no application is listening on the specified port.

Why this answer

That the collector is not configured to accept gRPC connections, or the gRPC server on the collector is not running. The 'Connection refused' error indicates that the TCP connection is being rejected, typically because the collector's gRPC server is not listening on that port. The other options are incorrect because the router can reach the collector, so firewall is not blocking; the subscription is configured correctly; and the encoding is not the cause of connection refusal.

Full explanation →
1144
Multi-Selecthard

Which three statements about MPLS Layer 3 VPNs are true? (Choose three.)

Select 3 answers
A.MP-BGP is used to exchange VPNv4 routes between PE routers.
B.Each customer site requires a separate VRF on the PE router.
C.The P router maintains a full routing table for all VPN customers.
D.A single MPLS label is used for both transport and VPN identification.
E.The PE router performs the routing between the CE device and the MPLS core.
AnswersA, B, E

Correct because MP-BGP carries VPNv4 prefixes with route distinguishers and route targets.

Why this answer

MPLS L3VPNs use MP-BGP to exchange VPNv4 routes, require a VRF per customer, and use two labels (IGP label for transport, VPN label for VRF lookup). The PE router performs the routing between CE and the MPLS core.

Full explanation →
1145
Drag & Dropmedium

Drag and drop the steps of SNMP trap generation and forwarding into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The SNMP agent monitors the device for a defined event, then builds a trap message including the OID and value, encapsulates it in a UDP packet, looks up the trap destination in the SNMP configuration, and finally forwards the packet to the NMS.

Full explanation →
1146
Matchingmedium

Match each EIGRP term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Best metric to a destination

Metric advertised by neighbor

Backup route without loops

Primary route with lowest metric

Ensures loop-free backup routes

Why these pairings

EIGRP uses Feasible Distance (FD) as the best metric to a destination, Reported Distance (RD) as a neighbor's metric, and the Feasible Condition (RD < FD) to ensure loop-free paths. Successor is the next-hop router with the lowest FD.

Full explanation →
1147
Drag & Dropmedium

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject.

The switch then opens or blocks the port accordingly.

Full explanation →
1148
Drag & Dropmedium

Drag and drop the steps of DHCP failover configuration between primary and standby into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

DHCP failover uses a primary-standby relationship. Configure the primary server first with a failover peer, then the standby with the same peer name and IP, and finally enable the pool on both. The servers negotiate roles and start lease synchronization.

Full explanation →
1149
Matchingmedium

Drag and drop each OSPF LSA type on the left to its matching description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Describes the router's own directly connected links and neighbors

Generated by the Designated Router to describe all routers attached to a multi-access segment

Advertises networks from one area into another area (inter-area routes)

Advertises the location of an Autonomous System Boundary Router (ASBR)

Advertises routes redistributed from another routing domain (external routes)

Why these pairings

LSA Type 1 (Router LSA) describes a router's own links; Type 2 (Network LSA) is generated by the DR; Type 3 (Summary LSA) advertises inter-area routes; Type 4 (ASBR Summary LSA) advertises the location of an ASBR; Type 5 (AS External LSA) advertises external routes.

Full explanation →
1150
Drag & Dropmedium

Drag and drop the steps of BGP graceful restart negotiation steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, both peers advertise the graceful restart capability in the OPEN message. Then they exchange the restart time and stale-path timer via capabilities. Next, the helper router marks routes as stale upon session failure.

After that, the restarting router re-establishes the session. Finally, the helper removes stale routes if not refreshed.

Full explanation →
1151
Matchingmedium

Drag and drop each VRF component on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Makes an IPv4 prefix globally unique across the MPLS VPN network

Controls which routes are imported into or exported from a VRF

Stores routing information for the VRF instance

Contains the IP routing table and forwarding table for the VRF

Used for MPLS label switching to forward traffic within the VPN

Why these pairings

The Route Distinguisher (RD) makes a customer prefix globally unique; the Route Target (RT) controls import/export of routes between VRFs; the RIB stores routing information for the VRF; the VRF table holds the IP routing table for the VRF; the VRF label is used for MPLS forwarding.

Full explanation →
1152
Drag & Dropmedium

Drag and drop the steps of STP root bridge election and port state transitions into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

STP first elects a root bridge based on lowest bridge ID. Then each non-root bridge selects one root port (lowest path cost to root). Next, each segment elects a designated port (lowest root path cost, then lowest bridge ID).

All other ports become alternate (blocking). Finally, ports transition through blocking, listening, learning, and forwarding states.

Full explanation →
1153
Matchingmedium

Drag and drop each IKEv2 exchange on the left to its matching phase on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Phase 1 key agreement

Phase 2 authentication and policy

Rekey or additional SA

Error and status exchange

Phase 1 response with DH public value

Why these pairings

IKE_SA_INIT is phase 1 for key agreement; IKE_AUTH is phase 2 for authentication and policy; CREATE_CHILD_SA is used for rekeying or additional SAs.

Full explanation →
1154
Drag & Dropmedium

Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, the crypto map is configured with QoS pre-classify (A) to enable the feature. Next, the service-policy is applied to the tunnel interface (B) to enforce QoS. When a packet arrives, the original packet enters the router before encryption (C).

Classification and policing are performed based on the original marking (E). Afterwards, the original DSCP is copied to the encrypted packet header (D) to preserve QoS markings. This sequence ensures correct QoS treatment for VPN traffic.

Full explanation →
1155
Drag & Dropmedium

Drag and drop the steps of 802.11r Fast BSS Transition (FT) roaming steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

802.11r FT roaming uses a fast handshake. The client sends an FT Authentication request to the new AP, which replies with an FT Authentication response. Then the client sends an FT Reassociation Request, the new AP confirms, and finally the client installs the PMK keys.

Full explanation →
1156
Matchingmedium

Drag and drop each Control plane protection feature on the left to its matching threat on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

CPU overload from excessive control plane traffic

IP spoofing attacks

Rogue DHCP server

ARP cache poisoning

IP spoofing on access ports

Why these pairings

CoPP protects against CPU overload; uRPF against IP spoofing; DHCP snooping against rogue DHCP server; DAI against ARP cache poisoning; IP Source Guard against IP spoofing on access ports.

Full explanation →
1157
Multi-Selectmedium

Which two statements about IP SLA with object tracking are true? (Choose two.)

Select 2 answers
A.A tracking object can monitor the state of an IP SLA operation and change state when the operation fails.
B.The 'track' command is used to create a tracking object that references an IP SLA operation by its operation number.
C.Object tracking can only be used with static routes, not with dynamic routing protocols like EIGRP or OSPF.
D.The tracking object automatically modifies the routing table when the IP SLA operation fails.
E.An IP SLA operation can be configured after the tracking object that references it.
AnswersA, B

Correct because the tracking object uses the IP SLA operation's success/failure to determine its own state (up/down).

Why this answer

Object tracking allows IP SLA operations to influence routing decisions. The 'track' command is used to create a tracking object that monitors the state of an IP SLA operation. When the IP SLA operation fails, the tracked object changes state, which can then be used to adjust routing, such as floating static routes.

The tracking object can be referenced by multiple routing protocols or static routes. The tracking object does not directly modify the routing table; it provides a state that other features use. The IP SLA operation must be configured before the tracking object can reference it.

Full explanation →
1158
Matchingmedium

Drag and drop each NAT type on the left to its matching description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Maps a single inside local address to a single inside global address

Maps inside local addresses to a pool of inside global addresses

Maps multiple inside local addresses to a single inside global address using port numbers

Another term for NAT overload

Translates private IP addresses to public IP addresses

Why these pairings

Static NAT maps a private IP to a fixed public IP; dynamic NAT uses a pool of public IPs; overload (PAT) maps multiple private IPs to a single public IP using port numbers; PAT is synonymous with overload.

Full explanation →
1159
Matchingmedium

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

shutdown

banner login

ip ssh version 2

access-class

security passwords min-length

Why these pairings

Disable unused ports with 'shutdown', set a login banner with 'banner login', enable SSH with 'ip ssh version 2', restrict VTY access with 'access-class', and set a minimum password length with 'security passwords min-length'.

Full explanation →
1160
Drag & Dropmedium

Drag and drop the steps of Metro Ethernet E-Line service provisioning into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Metro Ethernet E-Line provisioning begins with defining the service requirements, then the provider assigns VLAN IDs and configures the UNI ports, sets up the EVC between the two sites, applies QoS policies, and finally tests the circuit for connectivity. The correct order is: define service requirements and bandwidth, assign VLAN IDs and configure UNI ports, set up EVC between two sites, apply QoS policies, test circuit for connectivity.

Full explanation →
1161
MCQhard

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

A.The IKEv2 proposal is not configured correctly.
B.The IKEv2 profile is not attached to the crypto map or interface.
C.The IPsec transform set is missing.
D.The pre-shared key is not defined in the keyring.
AnswerB

Correct because the profile must be applied to activate the configuration.

Why this answer

The IKEv2 profile must be attached to a crypto map or directly to an interface (using 'crypto ikev2 profile' under the crypto map or 'tunnel protection ipsec profile') to be used during IKEv2 negotiation. Without this attachment, the router does not know which profile (and thus which keyring and pre-shared key) to apply, so the IKEv2 SA never forms.

Exam trap

Cisco often tests the subtle distinction between configuring the IKEv2 components (proposal, keyring, profile) and actually applying the profile to an interface or crypto map, leading candidates to overlook the final attachment step.

How to eliminate wrong answers

Option A is wrong because the IKEv2 proposal 'default' with aes-cbc-256, sha256, and group 14 is a valid and correctly configured proposal; the issue is not with the proposal itself. Option C is wrong because the IPsec transform set is used for the IPsec SA (Phase 2), not for establishing the IKEv2 SA (Phase 1); the problem is that Phase 1 fails. Option D is wrong because the pre-shared key is defined in the keyring, but without attaching the profile (which references the keyring) to the crypto map or interface, the keyring is never consulted.

Full explanation →
1162
Drag & Dropmedium

Drag and drop the steps of iBGP route reflection configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, you enable the BGP process and define the local AS. Then you configure the router as a route reflector using the neighbor route-reflector-client command. Next, you specify the cluster ID if needed, then adjust the next-hop behavior with next-hop-self.

Finally, you verify the configuration with show ip bgp neighbors.

Full explanation →
1163
Drag & Dropmedium

Drag and drop the steps of SD-Access fabric endpoint registration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order begins with the endpoint sending an ARP or DHCP request, the edge node detecting the new endpoint, registering it with the control plane (LISP), the control plane updating the map server, and finally the edge node installing the necessary forwarding entries. This sequence ensures the endpoint is properly discovered and integrated into the fabric.

Full explanation →
1164
Drag & Dropmedium

Drag and drop the steps of EIGRP variance-based unequal-cost load balancing into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First, the EIGRP process must be configured. Then, the variance multiplier is set to allow feasible successors with higher metrics. Optionally, the maximum-paths command can increase the number of paths.

Finally, verification confirms multiple routes in the routing table.

Full explanation →
1165
MCQeasy

A network engineer runs the following command on a Cisco WLC: WLC# show wlan summary WLAN ID SSID Status Security Interface 1 Guest Enabled Open guest-vlan 2 Corporate Enabled WPA2 corp-vlan 3 IoT Disabled WPA2 iot-vlan 4 Management Enabled WPA2 mgmt-vlan Based on this output, what can be concluded?

A.All WLANs are currently active and serving clients.
B.WLAN 3 is not operational because it is disabled.
C.The Guest WLAN uses WPA2 security.
D.The Management WLAN is on the guest-vlan interface.
AnswerB

The Status column shows Disabled for WLAN 3.

Why this answer

The 'show wlan summary' output clearly shows that WLAN 3 (IoT) has a Status of 'Disabled', meaning it is not operational and cannot serve clients. Only enabled WLANs can transmit beacons and accept client associations. Therefore, option B is correct because a disabled WLAN is effectively non-functional.

Exam trap

Cisco often tests the ability to read the 'Status' column accurately, as candidates may mistakenly assume all listed WLANs are active or confuse the 'Security' column with the 'Status' column.

How to eliminate wrong answers

Option A is wrong because WLAN 3 is disabled, so not all WLANs are active and serving clients. Option C is wrong because the Guest WLAN (ID 1) shows 'Open' security, not WPA2. Option D is wrong because the Management WLAN (ID 4) is on the 'mgmt-vlan' interface, not 'guest-vlan'.

Full explanation →
1166
MCQhard

A network engineer runs the following command on Router R1: R1# show ip access-lists Extended IP access list 150 10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches) 20 deny tcp any any eq 23 (8 matches) 30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches) 40 deny tcp any any eq 22 (1 match) 50 permit ip any any (15 matches) Based on this output, what can be concluded?

A.Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
B.Telnet from 10.0.0.0/8 is denied.
C.SSH from 172.16.0.0/16 is denied.
D.All traffic is permitted.
AnswerA

Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).

Why this answer

The ACL 150 processes entries sequentially. Telnet (TCP port 23) from 192.168.1.0/24 is not explicitly permitted by the first permit statement (which only allows source 10.0.0.0/8) and is denied by the subsequent deny statement (line 20). SSH (TCP port 22) from 10.0.0.0/8 is permitted by line 10 only for Telnet, not SSH; line 30 permits SSH only from 172.16.0.0/16, so SSH from 10.0.0.0/8 hits line 40 (deny) and is denied.

The implicit deny at the end would also block unmatched traffic, but here explicit denies apply.

Exam trap

Cisco often tests the misconception that a permit statement for one protocol (e.g., Telnet) also permits another protocol (e.g., SSH) from the same source, when in fact each ACE applies only to the specified protocol and port.

How to eliminate wrong answers

Option B is wrong because Telnet from 10.0.0.0/8 is explicitly permitted by line 10 (permit tcp 10.0.0.0 0.255.255.255 any eq 23), as shown by the 2 matches. Option C is wrong because SSH from 172.16.0.0/16 is explicitly permitted by line 30 (permit tcp 172.16.0.0 0.0.255.255 any eq 22), as shown by the 4 matches. Option D is wrong because not all traffic is permitted; line 50 (permit ip any any) only matches traffic that hasn't been denied earlier, but Telnet from non-10.0.0.0/8 sources and SSH from non-172.16.0.0/16 sources are explicitly denied by lines 20 and 40, respectively, and the implicit deny at the end would block any other unmatched traffic.

Full explanation →
1167
MCQhard

A network engineer is using the Cisco DNA Center REST API to retrieve the list of devices. The API call returns the following JSON response: ```json { "response": [ { "id": "device-123", "hostname": "Router1", "managementIpAddress": "10.10.20.1", "softwareVersion": "17.3.3", "platformId": "ISR4451-X/K9" }, { "id": "device-456", "hostname": "Switch1", "managementIpAddress": "10.10.20.2", "softwareVersion": "16.12.5", "platformId": "C9300-24P" } ], "version": "1.0" } ``` The engineer wants to filter the results to only show devices with software version 17.3.3. Which of the following API query parameters should be used?

A./dna/intent/api/v1/network-device?softwareVersion=17.3.3
B./dna/intent/api/v1/network-device?version=17.3.3
C./dna/intent/api/v1/network-device?osVersion=17.3.3
D./dna/intent/api/v1/network-device?filter=softwareVersion:17.3.3
AnswerA

The DNA Center API allows filtering by softwareVersion directly in the query string.

Why this answer

DNA Center API supports filtering using query parameters. The correct parameter to filter by software version is 'softwareVersion'.

Full explanation →
1168
Multi-Selecthard

Which three statements about DMVPN phase 2 are true? (Choose three.)

Select 3 answers
A.Spokes can dynamically establish direct tunnels with each other after learning the destination spoke's public address via NHRP.
B.The hub router must be configured with a static crypto map for each spoke.
C.Data traffic between spokes is forwarded through the hub by default.
D.Routing protocols such as EIGRP or OSPF can be run over the DMVPN tunnel interfaces.
E.NHRP redirect and shortcut features are used to enable spoke-to-spoke communication.
AnswersA, D, E

Correct because in phase 2, NHRP allows spokes to resolve the public IP of other spokes and build direct mGRE tunnels.

Why this answer

DMVPN phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses NHRP to resolve spoke addresses, and supports spoke-to-spoke direct communication without hub forwarding of data traffic. The hub still participates in routing updates. Phase 2 does not support spoke-to-spoke without NHRP resolution, and the spoke does not need a static crypto map for each peer.

Full explanation →
1169
Matchingeasy

Drag and drop each broadband type on the left to its matching technology on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Uses telephone line with ADSL or VDSL

Uses coaxial cable with DOCSIS

Uses optical fiber with GPON

Uses cellular radio with OFDMA

Uses geostationary satellite with high latency

Why these pairings

DSL uses telephone lines with frequencies above voice. Cable uses coaxial cable with DOCSIS. Fiber uses optical fiber with GPON or active Ethernet. 4G LTE uses cellular radio.

Satellite uses geostationary or LEO satellites.

Full explanation →
1170
Multi-Selectmedium

Which three statements about IGMP snooping are true? (Choose three.)

Select 3 answers
A.IGMP snooping reduces multicast flooding on a VLAN by forwarding traffic only to ports that have joined the group.
B.IGMP snooping builds a Layer 2 forwarding table that maps multicast MAC addresses to switch ports.
C.IGMP snooping forwards IGMP membership reports only toward the multicast router (querier).
D.IGMP snooping suppresses all IGMP general queries from the multicast router.
E.IGMP snooping requires PIM to be enabled on the switch.
AnswersA, B, C

Correct because IGMP snooping examines IGMP join messages and builds a forwarding table so multicast frames are sent only to interested receivers.

Why this answer

IGMP snooping optimizes multicast forwarding at Layer 2 by monitoring IGMP messages. It builds a snooping table, forwards reports only to the querier, and can be configured with static entries. It does not suppress queries or require PIM.

Full explanation →
1171
Multi-Selectmedium

Which THREE attributes are typically included in a YANG module for interface configuration? (Choose three.)

Select 3 answers
A.switchport mode
B.description
C.mtu
D.ip address
E.mac address
AnswersB, C, D

Description is a common attribute.

Why this answer

The 'description' leaf is a standard attribute in YANG models for interface configuration, providing a human-readable text string to document the interface's purpose. It is defined in the IETF interface model (RFC 8343) and is widely supported across Cisco IOS-XE and NX-OS YANG models.

Exam trap

Cisco often tests the distinction between configurable YANG leaves (like 'description', 'mtu', 'ip address') and operational state leaves (like 'mac address') or platform-specific extensions (like 'switchport mode') to see if candidates understand the standard IETF interface model versus proprietary additions.

Full explanation →
1172
Drag & Dropmedium

Drag and drop the steps of Private VLAN (PVLAN) configuration steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

First create the primary VLAN, then the secondary VLANs (community or isolated), then associate them. Finally configure host and promiscuous ports.

Full explanation →
1173
Drag & Drophard

Drag and drop the steps of OSPF virtual link configuration across area 0 into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Virtual links require area 0 transit area, and must be configured on both ABRs. The steps ensure proper connectivity: identify endpoints, configure on each router, and verify.

Full explanation →
1174
Drag & Dropmedium

Drag and drop the steps of STP portfast and BPDU guard configuration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

PortFast is enabled globally or per interface to bypass listening/learning. BPDU guard is then configured to disable the port if a BPDU is received. The configuration is applied to the interface, and the port transitions to forwarding immediately.

Finally, errdisable recovery can be set.

Full explanation →
1175
Matchingmedium

Drag and drop each MP-BGP address family on the left to its matching use case on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Carries IPv4 VPN routes with MPLS labels across the provider core

Carries IPv6 VPN routes with MPLS labels across the provider core

Carries global IPv4 unicast routes (non-VPN)

Carries global IPv6 unicast routes (non-VPN)

Carries Layer 2 VPN information such as pseudowires and VPLS

Why these pairings

VPNv4 address family carries IPv4 VPN routes; VPNv6 carries IPv6 VPN routes; IPv4 unicast carries global IPv4 routes; IPv6 unicast carries global IPv6 routes; L2VPN address family carries Layer 2 VPN information.

Full explanation →
Page 15

Page 16 of 16

All pages

12345678910111213141516

Practice 350-401 by domain

Target a specific domain to shore up weak areas.

ArchitectureVirtualizationInfrastructureNetwork AssuranceSecurityAutomation
See all domains with question counts →

Study 350-401 by topic

Focused topic pages — one weak area at a time.

BGP QuestionsOSPF QuestionsEIGRP QuestionsSD-Access QuestionsSD-WAN QuestionsACLs and CoPP QuestionsQoS QuestionsVPN QuestionsWireless QuestionsAnsible QuestionsPython Automation QuestionsREST API and YANG QuestionsMPLS QuestionsAAA QuestionsSTP QuestionsVLANs and Trunking Questions