1175 questions total · 16pages · All types, answers revealed
Drag and drop each EtherChannel protocol on the left to its matching vendor on the right.
Drag a concept onto its matching description — or click a concept then click the description.
IEEE standard (multi-vendor); Open standard; 802.3ad
Cisco proprietary; Cisco only
Consider the following SD-WAN device configuration on a Cisco IOS-XE router: sdwan interface GigabitEthernet0/0/1 tunnel-interface encapsulation ipsec color public-internet allow-service all ! interface GigabitEthernet0/0/2 tunnel-interface encapsulation ipsec color 3g allow-service all ! Which statement about this configuration is true?
Each tunnel-interface with a different color creates a separate transport tunnel. SD-WAN can use multiple transports for load balancing and redundancy.
Why this answer
In Cisco SD-WAN, each WAN interface configured under the `sdwan` configuration with a unique `color` creates a separate SD-WAN transport tunnel (TLOC). The router will establish two distinct IPsec tunnels—one for `public-internet` and one for `3g`—and can load balance traffic across them using ECMP or policy-based steering. This is the standard behavior for multi-homed SD-WAN edge routers.
Exam trap
Cisco often tests the misconception that `color` values are limited to a small set or that duplicate encapsulation causes a conflict, when in fact `3g` is a valid color and multiple IPsec tunnels are expected for multi-homed SD-WAN designs.
How to eliminate wrong answers
Option B is wrong because `3g` is a valid, predefined color in Cisco SD-WAN (colors include `3g`, `public-internet`, `biz-internet`, `mpls`, `lte`, `metro-ethernet`, etc.), so the second interface is not invalid. Option C is wrong because `allow-service all` is a valid command on a tunnel-interface that permits all SD-WAN control-plane services (e.g., OMP, BFD, STUN) over that tunnel; it does not refer to data-plane service ACLs. Option D is wrong because using the same encapsulation (`ipsec`) on multiple interfaces is not a conflict—it is standard; each tunnel is uniquely identified by its color and interface, and IPsec is the only supported encapsulation for SD-WAN tunnels.
An engineer creates an Ansible playbook to configure model-driven telemetry on a Cisco IOS-XE device: ```yaml --- - name: Configure MDT subscription hosts: ios_xe gather_facts: no tasks: - name: Configure telemetry receiver cisco.ios.ios_config: lines: - telemetry ietf subscription 101 - receiver ip address 10.10.10.10 port 57500 protocol grpc-tcp - encoding encode-kvgpb - filter xpath /interfaces/interface/state/counters - update-policy periodic 5000 ``` What is the problem with this playbook?
The receiver must include a source-address to specify the IP address from which telemetry data is sent.
Why this answer
The telemetry subscription configuration is missing the 'source-address' command under the receiver. Without specifying a source IP, the device may not send telemetry data if the management interface is not the correct source. Additionally, the 'update-policy' command should be 'update-policy periodic 5000' but the correct syntax is 'update-policy periodic 5000' under the subscription, not under the receiver.
However, the most critical issue is that the 'telemetry ietf subscription' configuration requires a 'source-address' to specify the source IP for the telemetry stream.
Which three statements about Ansible playbooks are true? (Choose three.)
Correct because a playbook is composed of one or more plays, and each play requires the 'hosts' directive to define the target group.
Why this answer
Playbooks are YAML files containing plays, each mapped to a host group. They support variables, conditionals, and loops. The 'hosts' key defines target groups, and 'tasks' lists modules to execute.
Playbooks can include other playbooks or roles.
Drag and drop each DHCP option on the left to its matching purpose on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Carries vendor-specific suboptions for device provisioning
Identifies the vendor class of the DHCP client
Adds relay agent information (e.g., circuit ID, remote ID)
Provides TFTP server IP address for IP phones
Supplies a single TFTP server hostname or IP address
Why these pairings
Option 43 provides vendor-specific info (e.g., for APs). Option 60 identifies the vendor class. Option 82 is the relay agent information option.
Option 150 gives TFTP server address for phones. Option 66 provides a single TFTP server hostname.
Drag and drop the steps of DNA Center assurance issue detection and root cause analysis into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Assurance starts with collecting telemetry, detecting an anomaly, raising an issue, correlating data for root cause, and then recommending a remediation action.
Drag and drop the steps of Cisco TrustSec inline tagging across fabric into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Inline tagging embeds SGT in the Ethernet frame header; the ingress switch classifies the endpoint, adds the SGT tag, forwards the frame across the fabric, and the egress switch enforces policy based on the tag.
Drag and drop each IP SLA reaction on the left to its action on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Generates a log message
Sends an SNMP trap
Starts another IP SLA operation or event
Why these pairings
Standard IP SLA reaction actions are syslog, snmp trap, trigger, none, and timeout. 'syslog' generates a log message; 'snmp trap' sends an SNMP trap; 'trigger' starts another IP SLA operation or event; 'none' takes no action; 'timeout' triggers a reaction upon operation timeout. The options 'react' and 'action-type' are not reaction actions; 'react' is a command used to define a reaction condition, and 'action-type' is a sub-command within the reaction configuration that specifies the action type.
Drag and drop the steps of DHCP failover configuration between primary and standby into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
DHCP failover requires both servers to be configured with the same scope and failover parameters. First, configure the primary server with the failover peer name and IP address of the standby. Then, configure the standby server with the same peer name and the primary's IP.
Enable the failover on the primary, which starts the negotiation. The standby then enters partner-down state until it synchronizes. Finally, both servers become active and share lease information.
Drag and drop the steps of the QoS shaping and policing configuration sequence into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Shaping and policing require first defining traffic classes, then configuring the shaping/policing actions in a policy map, applying the policy to an interface, and finally adjusting parameters based on monitoring. This order ensures proper traffic control.
Which two statements about BGP neighbor states are true? (Choose two.)
Correct: Idle is the initial state; BGP does not initiate a TCP connection until a start event (e.g., neighbor configuration) occurs.
Why this answer
The BGP neighbor state machine includes Idle, Connect, Active, OpenSent, OpenConfirm, and Established. In the Idle state, BGP does not initiate any connection and may be waiting for a start event. In the Active state, BGP is actively trying to establish a TCP connection.
In the Established state, BGP has successfully formed a peering session and is exchanging routing updates. The OpenSent state is when BGP has sent an OPEN message and is waiting for an OPEN message from the peer. The Connect state is when BGP is waiting for the TCP connection to complete.
Which two statements about VRF configuration in Cisco IOS-XE are true? (Choose two.)
Correct because each VRF has independent forwarding and routing tables.
Why this answer
Correct: VRF instances use separate routing tables and can be used with OSPF. Incorrect: VRFs do not require MPLS; VLANs are not automatically associated; VRF-lite does not support MPLS; VRF is not a Layer 2 concept.
Which two statements about IGMP snooping are true? (Choose two.)
Correct because IGMP snooping allows the switch to forward multicast frames only to ports that have joined the group, reducing flooding.
Why this answer
IGMP snooping operates on Layer 2 switches to constrain multicast traffic to only those ports that have interested receivers. It listens to IGMP messages between hosts and routers to build a forwarding table. It does not replace IGMP; it is complementary.
The querier is elected based on the lowest IP address, not the highest. IGMP snooping does not modify IP multicast headers.
Drag and drop each LDP message type on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Discovers LDP neighbors on a link
Establishes an LDP session between peers
Maintains the LDP session and detects failures
Advertises interface addresses to LDP peers
Distributes label bindings for FECs
Why these pairings
Hello discovers neighbors, Initialization sets up the session, Keepalive maintains it, Address advertises interface addresses, and Label Mapping distributes label bindings.
Drag and drop the steps of LACP active/passive mode negotiation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop each DNA Center ISE integration component on the left to its matching role on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Shares context and session data between DNA Center and ISE
Enforces security group tags (SGTs) for micro-segmentation
Provides authentication, authorization, and accounting for network access
Manages guest user portal, sponsor workflows, and captive portal
Identifies endpoint device type and attributes for policy enforcement
Drag and drop each Ansible task return value on the left to its matching meaning on the right.
Drag a concept onto its matching description — or click a concept then click the description.
The task made a modification to the managed node
The task executed successfully with no changes
The task encountered an error and did not complete
The task was not executed because a condition was not met
The managed node could not be contacted via the connection
Why these pairings
changed means the task modified the system; ok means the task ran without changes; failed means the task encountered an error; skipped means the task was not executed due to a condition; unreachable means the host could not be contacted.
Drag and drop the steps of OMP route advertisement between vSmart and vEdge into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
OMP route advertisement begins with the vEdge learning a local route, then advertising it via OMP to vSmart, vSmart processes the route and may apply policies, then vSmart advertises the route to other vEdges, and finally the receiving vEdge installs the route into its forwarding table.
What is the maximum hop count for EIGRP?
Correct. EIGRP supports up to 255 hops.
Consider the following SPAN configuration on a Cisco IOS-XE switch: monitor session 2 source interface GigabitEthernet1/0/3 rx monitor session 2 destination interface GigabitEthernet1/0/4 What is the effect of this configuration?
The 'rx' keyword specifies ingress traffic only.
Why this answer
The configuration explicitly specifies the `rx` keyword for the source interface, which limits SPAN to copying only received (ingress) traffic on GigabitEthernet1/0/3 to the destination interface GigabitEthernet1/0/4. Without the `rx` or `tx` keyword, the default behavior would copy both directions, but here the explicit `rx` overrides that default.
Exam trap
The trap here is that candidates often assume SPAN always copies both ingress and egress traffic by default, but the explicit `rx` keyword changes the behavior to only ingress, and Cisco tests whether you notice that keyword in the configuration.
How to eliminate wrong answers
Option B is wrong because the `rx` keyword restricts the SPAN session to only ingress traffic; both ingress and egress traffic would only be copied if no direction keyword or the `both` keyword were used. Option C is wrong because SPAN is unidirectional from source to destination; the destination interface receives a copy of traffic, it does not mirror traffic back to the source. Option D is wrong because the destination interface does not need to be in trunk mode; it can be an access port, and the configuration is valid as long as the destination interface is not already used in another SPAN session or as a source.
Drag and drop the steps of PAgP EtherChannel negotiation steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct sequence is: first, the partner port in desirable mode receives PAgP packets (B). Then, both ports exchange PAgP capabilities and parameters (C). Next, the ports agree on the operational key and port parameters (D).
Finally, the ports form a single logical EtherChannel bundle (E). This order reflects the negotiation process where parameters are exchanged and agreed before the bundle is formed.
An engineer is using the Cisco IOS-XE RESTCONF API to create a new loopback interface. The following JSON payload is sent in a POST request to '/restconf/data/ietf-interfaces:interfaces': ```json { "ietf-interfaces:interface": [ { "name": "Loopback100", "description": "Management Loopback", "type": "iana-if-type:softwareLoopback", "enabled": true, "ietf-ip:ipv4": { "address": [ { "ip": "192.168.1.1", "netmask": "255.255.255.0" } ] } } ] } ``` What is the correct HTTP method and URL for this operation?
POST is used to create a new resource under the interfaces collection.
Why this answer
To create a new resource, the POST method is used. The URL should point to the collection of interfaces. The payload includes the 'ietf-interfaces:interface' list.
The correct URL is '/restconf/data/ietf-interfaces:interfaces'.
Drag and drop the steps of IP SLA tracking with static route failover into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, the IP SLA operation is defined to monitor reachability. Then a track object is created that references the IP SLA operation. The track object is configured with a threshold for up/down state.
A static route is configured with the track object for failover. Finally, the static route is verified to use the track.
Drag and drop the steps of IP SLA tracking with static route failover into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, configure the IP SLA operation to monitor reachability. Then create a track object that references the IP SLA operation. Next, define a static route with the track option.
After that, configure the backup static route (with higher metric). Finally, verify failover by simulating a failure.
Drag and drop each DHCPv6 mode on the left to its matching address assignment method on the right.
Drag a concept onto its matching description — or click a concept then click the description.
DHCPv6 server assigns IPv6 addresses and other parameters
DHCPv6 server provides only options (e.g., DNS), addresses via SLAAC
Host generates its own IPv6 address using router advertisements
DHCPv6 prefix delegation for assigning subnets
Router Advertisement used in SLAAC to convey prefix and other info
Why these pairings
Stateful DHCPv6 assigns addresses from a server; stateless DHCPv6 provides other config info but uses SLAAC for addressing; SLAAC uses router advertisements for address autoconfiguration.
Drag and drop the steps of 4G/LTE WAN failover with IP SLA tracking into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
For 4G/LTE WAN failover using IP SLA, first an IP SLA probe is configured to monitor the primary WAN link, then the probe is associated with a tracking object, a backup static route with a higher metric is configured for the LTE interface, the primary route is removed when the tracking object goes down, and finally traffic is rerouted through the LTE interface. The correct order is: configure IP SLA probe to monitor primary WAN, associate probe with tracking object, configure backup static route with higher metric for LTE, remove primary route when tracking object goes down, reroute traffic through LTE interface.
Drag and drop the steps of ERSPAN (Encapsulated RSPAN) session configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
ERSPAN configuration requires first defining the source and destination, then enabling the session. The order ensures the session references exist before activation.
Which two statements about OSPF neighbor states are true? (Choose two.)
Correct because 2-Way state confirms bidirectional communication: each router sees its own Router ID in the other's Hello packet.
Why this answer
OSPF neighbor state machine progresses through several states. The 2-Way state indicates bidirectional communication has been established. The Full state means the routers have exchanged complete LSDB information.
The ExStart state is where the master/slave relationship is determined. The Loading state occurs after the Database Description (DBD) exchange.
A network architect is designing a campus network for a large university with 10,000+ users. The design must provide high availability, minimize failure domains, and allow for easy scaling of the access layer. The core layer should be resilient and support fast convergence. Which hierarchical design model best meets these requirements?
This design separates failure domains, provides high availability via redundancy, and scales by adding distribution or access switches.
Why this answer
The three-tier hierarchical design (access, distribution, core) is the correct choice because it provides clear separation of failure domains, allows easy scaling by adding access switches, and supports high availability through redundant links and VRRP (or HSRP/GLBP) for first-hop gateway redundancy. The core layer can be designed with fast-converging protocols like ECMP and BFD to meet the resilience and convergence requirements for a large campus with 10,000+ users.
Exam trap
Cisco often tests the misconception that a collapsed core design is always more efficient for small-to-medium networks, but for a large campus with 10,000+ users, the three-tier model is required to minimize failure domains and allow independent scaling of the access layer.
How to eliminate wrong answers
Option B is wrong because a collapsed core design combines the core and distribution layers, which reduces the number of devices but creates a larger failure domain and limits scalability at the access layer, making it unsuitable for a large university campus. Option C is wrong because a flat Layer 2 design with all switches in a single VLAN creates a massive broadcast domain, leading to poor convergence, security risks, and no fault isolation, which violates the requirement to minimize failure domains. Option D is wrong because leaf-spine design is optimized for data center east-west traffic patterns and does not align with the north-south traffic flow typical of a campus network; it also does not provide the same level of gateway redundancy and access-layer scaling as a three-tier design.
Drag a concept onto its matching description — or click a concept then click the description.
K1
K2
K3
K4
Why these pairings
Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order for TrustSec SGT classification and enforcement begins with the switch classifying the endpoint and assigning an SGT (A). The ingress switch then tags the packet with that SGT (B). The packet is forwarded with the SGT in the header (C).
On the egress switch, the SGT is looked up in the SGACL (D), and finally the switch permits or denies the traffic based on the SGACL (E).
Drag and drop each telemetry encoding on the left to its matching format on the right.
Drag a concept onto its matching description — or click a concept then click the description.
JSON encoding per IETF draft
Google Protocol Buffers binary encoding
Key-value pairs in GPB format
Extensible Markup Language encoding
Standard JSON encoding (non-IETF)
Why these pairings
JSON_IETF is a specific JSON profile, protobuf is binary, kvGPB is key-value GPB, XML is used in NETCONF, and JSON is generic.
Drag and drop each SGT value range on the left to its matching policy type on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Reserved for system use (e.g., unknown SGT)
User-defined scalable groups
Default SGTs assigned by Cisco DNA Center
Static SGTs configured manually
Dynamic SGTs assigned by ISE
Why these pairings
SGTs 0-1 are reserved, 2-9999 are user-defined, 10000-19999 are default, 20000-29999 are static, and 30000-65535 are dynamic.
Drag and drop the steps of EIGRP variance-based unequal-cost load balancing into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
To enable unequal-cost load balancing, first ensure feasible successors exist, then set the variance multiplier, optionally adjust the metric offset, and finally verify the load sharing across multiple paths.
Drag and drop the steps of REST API call using Requests library to DNA Center into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order starts with importing the requests library, then obtaining an authentication token via POST to the login endpoint. Next, the token is used as a header in a GET request to retrieve network devices, the response is parsed as JSON, and finally the token is used for subsequent API calls.
Drag and drop each NAT terminology on the left to its matching definition on the right.
Drag a concept onto its matching description — or click a concept then click the description.
The IP address of the host as seen from inside the network
The translated IP address of the host as seen from outside the network
The IP address of the remote host as seen from inside the network
The IP address of the remote host as seen from outside the network
A range of public IP addresses used for dynamic translation
Why these pairings
Inside local is the private IP of the host; inside global is the public IP after translation; outside local is the private IP of the remote host; outside global is the public IP of the remote host.
Drag and drop the steps of FlexVPN spoke-to-spoke dynamic tunnel creation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In FlexVPN, a spoke sends an IKEv2 authentication request to the hub. The hub authenticates the spoke and sends back the IKEv2 configuration payload with the remote spoke's address. The originating spoke then initiates a direct IKEv2 session to the remote spoke.
Both spokes complete IKEv2 authentication and IPsec SA setup. Finally, traffic flows directly between the spokes without going through the hub.
Drag and drop the steps of VNF scaling up and scaling out into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Scaling begins with the VNFM monitoring performance metrics against thresholds. When a threshold is exceeded, the VNFM triggers a scaling action. For scale-up, additional resources are allocated to the existing VNF instance.
For scale-out, a new VNF instance is instantiated. Finally, load balancing is updated to distribute traffic across all instances.
Drag and drop each DNA Center API category on the left to its matching endpoint group on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Endpoints for network discovery, inventory, and topology
Endpoints for site creation, building floors, and maps
Endpoints for device configuration, templates, and software images
Endpoints for command runner, tasks, and events
Endpoints for group-based access control and application policy
Why these pairings
DNA Center API categories: Know Your Network includes discovery and inventory; Site Management handles sites and maps; Connectivity manages network devices; Operational Tasks covers tasks and events.
Which two statements about Ansible inventory files are true? (Choose two.)
Correct because dynamic inventory scripts allow Ansible to retrieve host information from external sources like cloud providers.
Why this answer
Ansible inventory files can be static (INI/YAML) or dynamic (script or plugin). The default location is /etc/ansible/hosts. INI format uses [group] headers and YAML uses a structured hierarchy.
Dynamic inventories pull from external sources like cloud APIs.
Drag and drop each DMVPN phase on the left to its matching NHRP operation type on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Spoke-to-hub only via NHRP registration
Spoke-to-spoke via NHRP redirect
Spoke-to-spoke via NHRP shortcut
Why these pairings
DMVPN has three phases: Phase 1 uses NHRP registration for spoke-to-hub communication only, Phase 2 uses NHRP redirect to enable spoke-to-spoke tunnels, and Phase 3 uses NHRP shortcut for direct spoke-to-spoke communication.
Drag and drop the steps of Hierarchical QoS (H-QoS) parent/child policy steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In Hierarchical QoS (H-QoS), the first step is to define class-maps for traffic classification (B). Then create the child policy-map that defines per-class queuing (A). Next, create the parent policy-map that applies shaping and references the child policy (C).
Apply the parent service-policy to the interface (D). Finally, verify the hierarchical policy using show policy-map (E).
Exam trap
A common trap is to create the child policy-map before defining the class-maps. Remember that class-maps must exist before they can be referenced in a policy-map.
Drag and drop the steps of IP Source Guard binding and enforcement into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
IP Source Guard relies on the DHCP snooping binding table. It is enabled on an interface, and then the switch creates a PVACL based on the binding. When a packet arrives, the source IP is checked against the binding; if it matches, the packet is forwarded; otherwise, it is dropped.
Which two statements about NFV performance considerations are true? (Choose two.)
Correct because SR-IOV enables direct assignment of PCIe functions to VMs, bypassing the hypervisor virtual switch and reducing latency.
Why this answer
NFV performance can be improved using various acceleration techniques. Single Root I/O Virtualization (SR-IOV) allows a physical NIC to be directly assigned to a VM, bypassing the hypervisor's virtual switch for better performance. Data Plane Development Kit (DPDK) provides a set of libraries for fast packet processing in user space.
Option A is correct because SR-IOV provides near-native performance. Option C is correct because DPDK accelerates packet processing. Option B is incorrect because NUMA awareness helps but is not the primary technique.
Option D is incorrect because vSwitch bonding does not eliminate the vSwitch overhead. Option E is incorrect because NFV performance can be optimized with software techniques.
Drag and drop each OSPF router role on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Generates the Network LSA and maintains full adjacencies with all routers on the segment
Monitors the DR and assumes the DR role if the DR fails
Forms full adjacencies only with the DR and BDR
Connects multiple areas and advertises inter-area routes
Redistributes external routes into OSPF
Why these pairings
The DR (Designated Router) generates the Network LSA and manages LSDB synchronization on multiaccess networks. The BDR (Backup Designated Router) monitors the DR and takes over if the DR fails. DROTHERs form full adjacencies only with the DR and BDR, not with each other.
Which three statements about Ansible modules for Cisco IOS-XE are true? (Choose three.)
Correct: ios_config uses the 'lines' parameter and compares with running config to avoid unnecessary changes.
Why this answer
The ios_config module manages configuration snippets and supports idempotency via the 'lines' parameter. The ios_command module sends show commands and returns output. The ios_facts module gathers device facts.
The ios_vlan module is a dedicated resource module for VLANs. The ios_lldp module manages LLDP settings. Idempotency means applying the same config multiple times yields the same result.
Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In DHCP bridging, the AP bridges the client's DHCP request to the wired network. The client first associates and sends a DHCP Discover broadcast. The AP bridges this frame to the wired VLAN.
The DHCP server responds with a DHCP Offer, which the AP bridges back to the client. The client then sends a DHCP Request, and the server sends a DHCP Ack to complete the assignment.
Which two statements about Cisco SD-Access fabric wireless integration are true? (Choose two.)
Correct because SD-Access unifies wired and wireless policy by placing both types of endpoints into the same VN.
Why this answer
In Cisco SD-Access fabric wireless integration, wireless clients are assigned to the same virtual network (VN) as wired clients, ensuring consistent policy enforcement. Option A is correct because VN membership is shared across wired and wireless. Option E is correct because when the WLC is fabric-enabled, the access point (AP) encapsulates wireless client traffic directly into VXLAN and forwards it to the fabric edge, bypassing the need for a separate wireless overlay.
The WLC can be deployed as a fabric edge or border, not a dedicated role, so option B is false. CAPWAP is used only for control between the AP and WLC, not for data traffic to the fabric edge (option C is false). The fabric does not use a separate wireless overlay; it reuses the same VXLAN data plane (option D is false).
Drag and drop the steps of ACL reflexive access list (dynamic inspection) flow into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Reflexive ACLs work by evaluating outbound traffic to create dynamic entries that allow return traffic. The order is: define extended ACL, apply outbound, define reflexive ACL, apply inbound, then the reflexive entry is created dynamically.
Drag and drop each OSPF network type on the left to its matching DR election behavior on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Elects DR and BDR; uses multicast Hello to 224.0.0.5
Elects DR and BDR; uses unicast Hello to configured neighbors
No DR/BDR election; uses multicast 224.0.0.5
No DR/BDR election; uses multicast 224.0.0.5
Always advertised as a /32 host route; no DR election
Why these pairings
Broadcast network type elects DR/BDR and uses multicast 224.0.0.5/6; Non-broadcast (NBMA) also elects DR/BDR but uses unicast; Point-to-point does not elect DR/BDR; Point-to-multipoint does not elect DR/BDR and uses multicast; Loopback interface is always advertised as a /32 host route regardless of configured mask.
Drag and drop each authentication mode on the left to its matching behavior on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Allows traffic before authentication completes
Blocks all traffic until authentication succeeds
Permits traffic but logs authentication failures
Allows traffic when RADIUS server is unreachable
Supports one voice and one data device per port
Why these pairings
Open mode allows traffic before authentication, closed mode blocks until success, monitor mode logs but does not enforce.
Consider the following partial configuration for QoS on a Cisco IOS-XE router: class-map match-all VOICE match ip dscp ef ! policy-map QOS_POLICY class VOICE priority 1000 class class-default fair-queue ! interface GigabitEthernet0/0 service-policy output QOS_POLICY What is the effect of the 'priority 1000' command under class VOICE?
The priority command creates a low-latency queue with a rate limit.
Why this answer
The 'priority' command under the class VOICE in the policy-map QOS_POLICY enables strict priority queuing (low-latency queue) for voice traffic matching DSCP EF. The 'priority 1000' sets a bandwidth limit of 1000 kbps for this queue, meaning voice traffic can use up to 1000 kbps in the strict priority queue; if it exceeds this rate, excess traffic is dropped (or reclassified, depending on configuration). This ensures voice traffic is serviced before other traffic but is limited to 1000 kbps.
Drag and drop the steps of EIGRP DUAL route computation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Which two statements about DTP (Dynamic Trunking Protocol) are true? (Choose two.)
DTP is indeed Cisco proprietary and is not standardized in IEEE 802.1Q.
Why this answer
DTP is a Cisco proprietary protocol used to negotiate trunking between switches. The default mode on Cisco switches is dynamic desirable, which will actively try to form a trunk. DTP frames are sent only over access ports when trunking is being negotiated, but not over trunk ports once the trunk is established.
The 'switchport nonegotiate' command disables DTP, and trunk formation then relies on manual configuration.
Drag and drop the steps of DMVPN Phase 3 spoke-to-spoke shortcut creation into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In DMVPN Phase 3, when a spoke needs to reach another spoke, it first sends traffic to the hub. The hub forwards the packet with an NHRP redirect. The source spoke then sends an NHRP resolution request to the hub to get the destination spoke's NBMA address.
The hub replies with the mapping, and the source spoke dynamically builds a direct mGRE tunnel to the destination spoke.
Which three statements about RSPAN are true? (Choose three.)
Correct because the RSPAN VLAN carries mirrored traffic across the network and must be permitted on all intermediate trunks.
Why this answer
RSPAN uses a dedicated VLAN that must be allowed on trunk links between switches. The RSPAN VLAN should not be used for any other traffic. The destination port on the remote switch is placed in the RSPAN VLAN.
RSPAN does not support egress mirroring on the source switch (only ingress). The RSPAN VLAN does not participate in STP normally, but it can be configured to do so.
Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
In DHCP bridging, the client first associates and authenticates. The AP then bridges the DHCP Discover from the client to the wired network. The DHCP server replies with Offer, the client sends Request, and the server sends Ack, completing the process.
spanning-tree portfast on an access port causes immediate forwarding, as intended for host ports.
Why this answer
The configuration enables PortFast on an access port, allowing it to transition directly to forwarding state, bypassing the listening and learning phases. This is commonly used for end-host ports to avoid delays caused by spanning-tree convergence.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag and drop each congestion avoidance mechanism on the left to its method on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Drops all packets when queue is full
Random early detection based on average queue depth
Weighted random early detection using IP precedence or DSCP
No selective drop before congestion
Drops packets with lower priority more aggressively
Why these pairings
Tail-drop drops all packets when queue is full. RED randomly drops packets before congestion. WRED uses IP precedence or DSCP to vary drop probability.
Drag and drop each SPAN type on the left to its correct scope description on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Mirrors traffic on the same switch where the source and destination ports reside.
Mirrors traffic to a destination on a different switch using a dedicated VLAN.
Mirrors traffic to a destination reachable via Layer 3 using GRE encapsulation.
Receives the mirrored traffic and should be configured as a monitor session port.
The port whose traffic is being copied for monitoring.
Why these pairings
Local SPAN mirrors traffic on the same switch; RSPAN extends mirroring across switches using a dedicated VLAN; ERSPAN encapsulates mirrored packets in GRE for routing over Layer 3 networks.
Drag and drop the steps of IP SLA with threshold and reaction configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, define the IP SLA operation with a type and target. Then set the threshold values for the monitored metric. Next, configure the reaction to trigger on threshold violation.
After that, schedule the operation to start. Finally, verify the configuration to ensure it works.
In BGP best path selection, which of the following is compared first?
Correct. Weight is the first attribute compared in BGP best path selection.
Why this answer
BGP best path selection begins by comparing the weight attribute, which is Cisco-proprietary and local to the router. The path with the highest weight is preferred first, making option A correct. Weight is evaluated before any other BGP attribute, including local preference, AS-path length, and MED.
Exam trap
Cisco often tests the exact order of BGP path selection attributes, and the trap here is that candidates mistakenly think local preference or AS-path length is the first comparison, because those are more commonly discussed in multi-AS designs, but weight always comes first in Cisco's implementation.
How to eliminate wrong answers
Option B is wrong because highest local preference is compared after weight, not first. Option C is wrong because shortest AS-path is the third attribute compared, after weight and local preference. Option D is wrong because lowest MED is compared after AS-path length (and other attributes like origin type) in the BGP decision process.
Which three statements about Cisco TrustSec SGT propagation and enforcement are true? (Choose three.)
Correct because SXP (SGT Exchange Protocol) uses TCP (port 64999) to exchange SGT-to-IP mappings between devices that do not support inline tagging.
Why this answer
SGTs can be propagated via SXP (a TCP-based protocol) or inline tagging. SXP uses a TCP connection to exchange SGT-to-IP mappings. Inline tagging inserts the SGT into the Ethernet frame.
The enforcement device (e.g., a firewall or switch) uses the SGT to apply policy, not to rewrite the tag. SGTs are not used for routing decisions.
Drag and drop each YANG module on the left to its matching data category on the right.
Drag a concept onto its matching description — or click a concept then click the description.
OpenConfig interface model
Cisco native device configuration
IETF standard interface model
OpenConfig BGP model
Cisco native BGP configuration
Why these pairings
OpenConfig modules provide vendor-neutral models, Cisco-IOS-XE-native provides Cisco-specific native config, and ietf-interfaces is an IETF standard.
Drag and drop each container technology on the left to its matching orchestration tool on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Kubernetes
OpenShift
Multi-container local orchestration
HashiCorp orchestrator
Container runtime used by Kubernetes
Why these pairings
Docker containers are orchestrated by Docker Swarm or Kubernetes (Kubernetes is the most common). Kubernetes is itself an orchestration tool for containers (including Docker). OpenShift is Red Hat’s Kubernetes-based platform.
Docker Compose is used for multi-container local development. Nomad is HashiCorp’s orchestrator for containers and other workloads.
Which two statements about EtherChannel load balancing are true? (Choose two.)
Correct because many Cisco switches default to src-mac for Layer 2 EtherChannels.
Why this answer
EtherChannel load balancing can use source and/or destination MAC or IP addresses to determine which physical link to use for a given frame. The default method varies by platform but often uses source MAC. The hash is computed per frame, not per packet, and the algorithm is deterministic for a given flow to prevent reordering.
Drag and drop each RESTCONF method on the left to its equivalent NETCONF operation on the right.
Drag a concept onto its matching description — or click a concept then click the description.
get-config (retrieves data)
edit-config with operation create
edit-config with operation replace
edit-config with operation merge
edit-config with operation delete
Why these pairings
Correct pairings: GET retrieves data (like get-config); POST creates a resource (like edit-config with operation create); PUT replaces a resource (like edit-config with operation replace); PATCH partially updates (like edit-config with operation merge); DELETE removes a resource (like edit-config with operation delete).
Drag and drop the steps of STP portfast and BPDU guard configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
PortFast is configured on an access port to immediately transition to forwarding. BPDU guard is then enabled to protect against rogue BPDUs. The configuration is applied at the interface level, and verification ensures the port is in forwarding state.
If a BPDU is received, BPDU guard errdisables the port.
Drag and drop the steps of Syslog severity filtering and rate-limiting configuration into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
First, enable logging on the device (A). Second, set the logging severity level (B). Third, configure rate-limit messages (C).
Fourth, specify the logging buffer size (D). Finally, display logging statistics to verify (E).
Drag and drop each IP SLA operation type on the left to its measured metric on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Round-trip time
Delay, jitter, and packet loss
Connection setup time
Page load time
Resolution time
Drag and drop the steps of Ansible Vault encryption and decryption steps into the correct order, from first to last.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
To use Ansible Vault, you first create a password file, then encrypt a plaintext file, optionally edit it while encrypted, and finally decrypt it when needed, with the playbook referencing the vault password at runtime.
Which two statements about the Cisco QoS trust boundary are true? (Choose two.)
Correct because the trust boundary is typically configured at the access layer, and can be extended to the IP phone to mark traffic from the PC.
Why this answer
The trust boundary defines where the device accepts or overwrites Layer 2 CoS or Layer 3 DSCP markings. By default, Cisco switches trust the CoS value on trunk ports and set DSCP to 0 on access ports. The 'mls qos trust cos' command forces the switch to trust CoS, and 'mls qos trust dscp' forces trust of DSCP.
The trust boundary can be extended to an IP phone, which then re-marks traffic from the PC. Option C is incorrect because trust is not automatically applied to all interfaces; it must be configured. Option D is incorrect because the trust boundary is at the access layer, not the core.
Option E is incorrect because the switch does not automatically trust DSCP from a PC; it typically sets it to 0 unless configured otherwise.
Drag and drop each STP port state on the left to its matching function on the right.
Drag a concept onto its matching description — or click a concept then click the description.
Discards frames and listens for BPDUs
Listens for BPDUs only, no MAC learning
Learns MAC addresses but does not forward frames
Forwards frames and learns MAC addresses
Administratively shut down, no participation
Why these pairings
Blocking discards frames and listens for BPDUs; Listening listens for BPDUs only; Learning learns MAC addresses but does not forward; Forwarding sends and receives frames; Disabled is administratively down.
Practice 350-401 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →Study 350-401 by topic
Focused topic pages — one weak area at a time.