How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 13 Refer to the Exhibit Practice Questions scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise ENCOR 350-401 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Study the full EIGRP explanation →

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Exhibit

Refer to the exhibit.
```
router# show ip route 10.0.0.0
Routing entry for 10.0.0.0/8
  Known via "eigrp 100", distance 170, metric 2560512, type internal
  Redistributing via eigrp 100
  Last update from 192.168.1.1 on GigabitEthernet0/0, 00:00:05 ago
  Routing Descriptor Blocks:
  * 192.168.1.1, from 192.168.1.1, 00:00:05 ago, via GigabitEthernet0/0
      Route metric is 2560512, traffic share count is 1
      Total delay is 2000 microseconds, minimum bandwidth is 10000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 3
```

A
Increase the bandwidth on GigabitEthernet0/0.
Why wrong: Incorrect; increasing bandwidth decreases metric.
B
Add a redistribute static command under EIGRP.
Why wrong: Incorrect; redistributing static does not affect this route's metric.
C
Change the administrative distance to 90.
Why wrong: Incorrect; AD does not affect metric.
D
Increase the delay on GigabitEthernet0/0.
Correct.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full VRF explanation →

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Exhibit

Refer to the exhibit.

! Output from 'show vrf' on a router
VRF-Name       Interfaces
Mgmt-intf      Gi0/0/0
CUSTOMER-A     Gi0/1/0, Gi0/1/1.10
CUSTOMER-B     Gi0/2/0, Gi0/2/1.20

! Output from 'show ip interface brief' for Gi0/1/0
Interface      IP-Address      OK? Method Status      Protocol
Gi0/1/0        10.1.1.1        YES manual up          up

! Output from 'show ip interface brief' for Gi0/1/1.10
Interface      IP-Address      OK? Method Status      Protocol
Gi0/1/1.10     10.1.1.2        YES manual up          up

A
Global routing table
Why wrong: Incorrect. The interface Gi0/1/0 is in VRF CUSTOMER-A, so the global routing table is not used.
B
Mgmt-intf
Why wrong: Incorrect. Mgmt-intf VRF is only for interface Gi0/0/0.
C
CUSTOMER-B
Why wrong: Incorrect. CUSTOMER-B VRF includes different interfaces.
D
CUSTOMER-A
Correct. The packet arrives on Gi0/1/0 which belongs to VRF CUSTOMER-A, so routing occurs within that VRF.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full OSPF breakdown →

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

Exhibit

Refer to the exhibit.
R1# show ip route | include 10.1.1.0
O E2 10.1.1.0/24 [110/20] via 10.0.1.2, 00:00:34, GigabitEthernet0/0
O E2 10.1.1.0/24 [110/20] via 10.0.2.2, 00:00:34, GigabitEthernet0/1
R1# show ip ospf interface GigabitEthernet0/0 | include Cost
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
R1# show ip ospf interface GigabitEthernet0/1 | include Cost
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 100
R1# traceroute 10.1.1.1 source Loopback0
Type escape sequence to abort.
Tracing the route to 10.1.1.1
  1 10.0.1.2 4 msec 4 msec 4 msec
  2 10.0.3.2 8 msec 8 msec 8 msec

A
One route has a higher administrative distance.
Why wrong: Incorrect: Both routes have AD 110.
B
A default route is overriding the specific route.
Why wrong: Incorrect: No default route is shown.
C
The route via 10.0.2.2 is an E1 route.
Why wrong: Incorrect: Both are E2 as shown.
D
OSPF E2 routes do not factor interface cost; but the router uses the interface cost as a tie-breaker for equal-cost routes.
Correct: When E2 metrics are equal, some implementations prefer the path with lower interface cost.

Full breakdown with real-world context →

Question 4easymultiple choice

Open the full VLAN trunking answer →

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

A
Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.
Why wrong: Incorrect; policing voice may cause call quality degradation.
B
Disable QoS entirely on all switches to eliminate any potential QoS-related drops.
Why wrong: Incorrect; disabling QoS may cause voice quality issues.
C
Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.
Correct.
D
Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.
Why wrong: Incorrect; endpoints may not set DSCP appropriately.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full REST/YANG explanation →

Refer to the exhibit. A network engineer sends a RESTCONF PATCH request with the above JSON payload to the URL https://192.168.1.100/restconf/data/ietf-interfaces:interface=GigabitEthernet0/0/0. What is the expected outcome?

Exhibit

Refer to the exhibit.
{
  "ietf-interfaces:interface": {
    "name": "GigabitEthernet0/0/0",
    "description": "Link to Core",
    "enabled": true,
    "ietf-ip:ipv4": {
      "address": [
        {
          "ip": "192.168.1.1",
          "netmask": "255.255.255.0"
        }
      ]
    }
  }
}

A
A new interface GigabitEthernet0/0/0 is created with the specified IP address.
Why wrong: PATCH modifies an existing resource; it does not create one.
B
The description and IP address of the existing interface are updated, and the interface remains enabled.
PATCH merges the provided fields with the existing configuration.
C
The request fails because a GET request must be sent first to retrieve the current configuration.
Why wrong: No prior GET is required for PATCH.
D
The entire interface configuration is replaced with only the fields in the payload.
Why wrong: PATCH merges; PUT replaces the entire resource.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Refer to the exhibit.

! Running-config on R1
ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq www
 permit tcp 192.168.1.0 0.0.0.255 any eq https
!
interface GigabitEthernet0/0
 ip access-group FILTER out
!

A
HTTP and HTTPS traffic from 192.168.1.0/24
The ACL permits www and https.
B
ICMP traffic from any source
Why wrong: ICMP is not permitted.
C
FTP traffic from 192.168.1.0/24
Why wrong: FTP is not permitted.
D
SSH traffic from 192.168.1.0/24
Why wrong: SSH is not permitted.

Full breakdown with real-world context →

Question 7mediummulti select

Open the full STP breakdown →

Which TWO STP features are used to improve convergence time after a topology change?

A
UplinkFast
UplinkFast accelerates convergence after a direct link failure.
B
BackboneFast
BackboneFast reduces convergence time after an indirect link failure.
C
Root Guard
Why wrong: Root Guard prevents a switch from becoming root, but does not improve convergence.
D
BPDU Guard
Why wrong: BPDU Guard is a security feature to prevent rogue switches.
E
PortFast
Why wrong: PortFast is for immediate transition to forwarding on access ports, not for convergence after topology change.

Full breakdown with real-world context →

Question 8easymultiple choice

Review the full OSPF breakdown →

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

Exhibit

Refer to the exhibit.

R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 10.0.0.2 to network 0.0.0.0

O E2     192.168.1.0/24 [110/20] via 10.0.0.2, 00:00:34, GigabitEthernet0/0
O E2     192.168.2.0/24 [110/20] via 10.0.0.2, 00:00:34, GigabitEthernet0/0
S*       0.0.0.0/0 [1/0] via 10.0.0.1

A
Configure policy-based routing to match 192.168.1.0/24 and set the next hop to 10.0.0.1.
Why wrong: This is more complex and not the simplest solution; a static route is easier.
B
Add a static route for 192.168.1.0/24 with a lower administrative distance than OSPF.
A static route with AD 1 would override the OSPF route (AD 110) for that prefix.
C
Use the 'distance ospf' command to change the OSPF administrative distance for all routes.
Why wrong: This would affect all OSPF routes, not just the specific prefix.
D
Adjust the OSPF cost on the interface to 10.0.0.2.
Why wrong: This would not differentiate between the two routes if they are both received via the same neighbor.

Full breakdown with real-world context →

Question 9hardmultiple choice

Study the full EIGRP explanation →

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

A
The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
Correct. EIGRP does not support the 'ip default-network' command. To advertise a default route, the engineer should use 'redistribute static' and optionally 'default-information originate' to inject the default route.
B
The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Why wrong: Incorrect. The static route may be configured correctly, but the issue is the method of advertising it into EIGRP.
C
The internal routers have a route to the default network with a better metric from another source.
Why wrong: Incorrect. The scenario does not mention other sources. The metric of 1 in the topology table indicates the route is present but not installed, likely due to administrative distance or other reasons.
D
The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
Why wrong: Incorrect. Stub configuration does not affect default route advertisement; it only limits query propagation.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full EIGRP explanation →

A network engineer is designing an EIGRP network with multiple routers in a hub-and-spoke topology. The engineer wants to ensure that the spoke routers do not become transit routers for traffic between other spokes. The engineer configures 'eigrp stub' on the spoke routers. However, after configuration, the spoke routers stop learning some routes from the hub. What is the most likely reason?

A
The spoke routers are configured with 'eigrp stub receive-only', which prevents them from advertising any routes, so the hub does not have routes to the spoke's networks.
Correct. The 'receive-only' keyword prevents the spoke from advertising any routes, including its connected networks. The hub then cannot reach the spoke's networks, and the spoke may not learn routes that depend on those advertisements.
B
The 'eigrp stub' command prevents the spoke from learning routes from the hub.
Why wrong: Incorrect. The stub command affects what the spoke advertises, not what it learns. Spoke routers can still learn routes from the hub.
C
The hub router is also configured as stub, which prevents route propagation.
Why wrong: Incorrect. If the hub is stub, it would not advertise routes to spokes, but the scenario implies the hub was working before.
D
The spoke routers have a different EIGRP autonomous system number than the hub.
Why wrong: Incorrect. If AS numbers differ, no adjacency would form, but the scenario says they were learning routes before.

Full breakdown with real-world context →

Question 11hardmultiple choice

Full question →

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip access-group ACL-IN in
 ip verify source port-security
!
ip access-list extended ACL-IN
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any

A
The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.
Why wrong: IPSG can work with static bindings; not necessarily blocked.
B
The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.
Why wrong: ACL permits to any destination.
C
The traffic is blocked because IP Source Guard requires a static binding for the host.
Why wrong: IPSG uses DHCP snooping bindings; static not required.
D
The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.
Correct: IP source guard checks that the source IP is in the binding table; if valid, traffic passes ACL.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full DHCP explanation →

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit

Refer to the exhibit.

Switch# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1A:2B:3C:4D:5E  192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
00:1A:2B:3C:4D:5F  192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/2

Switch# show ip dhcp snooping statistics
Packets Processed by DHCP Snooping   = 100
Packets Dropped Because               = 5
  MAC Address Mismatch                 = 3
  Invalid Server Replies               = 2

A
The DHCP server is sending packets with an incorrect server identifier option.
Why wrong: Server identifier mismatch would be an invalid server reply.
B
The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.
MAC address mismatch occurs when the chaddr field does not match the source MAC.
C
The DHCP client is sending a request with an incorrect transaction ID.
Why wrong: Transaction ID mismatch is not a DHCP snooping drop reason.
D
The DHCP offer packet is arriving on an untrusted port.
Why wrong: That would cause 'Invalid Server Replies' drop.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full VPN explanation →

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

A
The spoke is configured with a static IP address on the tunnel interface that is not in the hub's IP pool.
Correct. In FlexVPN, the hub assigns IP addresses from a pool. If the spoke statically configures an IP address, the hub may not have a route back to that address, causing asymmetric routing or unreachability.
B
The hub is missing the 'tunnel protection ipsec' command on the tunnel interface.
Why wrong: Incorrect. If tunnel protection were missing, the tunnel would not come up at all. The tunnel is up, so protection is configured.
C
The spoke's crypto map is not using the correct pre-shared key.
Why wrong: Incorrect. If the pre-shared key were incorrect, Phase 1 would fail, and the tunnel would not come up.
D
The hub's IKEv2 profile is not configured with 'authentication remote rsa-sig'.
Why wrong: Incorrect. The authentication method must match between peers. If it didn't match, the tunnel would not establish. The tunnel is up, so authentication is successful.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Practice scenarios

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Exhibit

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Exhibit

Refer to the exhibit. R1 has two equal-cost OSPF E2 routes to 10.1.1.0/24 via two different next hops. However, when tracing to 10.1.1.1, all traffic uses the path through 10.0.1.2. What is the most likely reason?

Exhibit

Refer to the exhibit. A network engineer sends a RESTCONF PATCH request with the above JSON payload to the URL https://192.168.1.100/restconf/data/ietf-interfaces:interface=GigabitEthernet0/0/0. What is the expected outcome?

Exhibit

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

Exhibit

Which TWO STP features are used to improve convergence time after a topology change?

Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?

Exhibit

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Exhibit

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit