Courseiva

ENCOR 350-401 (350-401) — Questions 1576–1650

1958 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 21

Page 22 of 27

Page 23
1576
Multi-Selecthard

Which three statements about encoding formats in model-driven telemetry are true? (Choose three.)

Select 3 answers
A.Google Protocol Buffers (GPB) provide a compact, binary encoding that reduces bandwidth usage.
B.JSON encoding is human-readable and supported by both gRPC and RESTCONF telemetry.
C.XML encoding is verbose but is the default for NETCONF-based telemetry subscriptions.
D.YANG defines the encoding format for telemetry data.
E.CBOR is a binary encoding format used exclusively in Cisco IOS-XE telemetry.
AnswersA, B, C

Correct because GPB is efficient and commonly used in high-performance telemetry.

Why this answer

GPB is compact and efficient, often used with gRPC. JSON is human-readable and widely supported. XML is verbose but used in NETCONF.

YANG does not define encoding; it defines data models. CBOR is not commonly used in Cisco telemetry.

Full explanation →
1577
MCQmedium

A network engineer runs the following command on Router R5: R5# show ip ospf border-routers OSPF Process 1 internal Routing Table Codes: i - Intra-area route, I - Inter-area route i 1.1.1.1 [110/10] via 192.168.1.1, GigabitEthernet0/0, ABR, Area 0, SPF 5 i 2.2.2.2 [110/20] via 192.168.1.2, GigabitEthernet0/0, ASBR, Area 0, SPF 5 Based on this output, what can be concluded?

A.Router 1.1.1.1 connects area 0 to another OSPF area.
B.Router 2.2.2.2 is an Area Border Router.
C.Router 1.1.1.1 is redistributing external routes into OSPF.
D.The route to 2.2.2.2 is an inter-area route.
AnswerA

ABR indicates it connects multiple areas.

Why this answer

The output shows an entry for 1.1.1.1 with the label 'ABR' (Area Border Router) and a route type of 'i' (intra-area). An ABR connects two or more OSPF areas, so Router 1.1.1.1 must be connecting Area 0 to another OSPF area. The metric [110/10] and next-hop 192.168.1.1 confirm it is reachable within Area 0.

Exam trap

Cisco often tests the distinction between ABR and ASBR roles in the 'show ip ospf border-routers' output, where candidates mistakenly assume any border router is an ABR or confuse the 'i' and 'I' route codes.

How to eliminate wrong answers

Option B is wrong because the output explicitly labels 2.2.2.2 as 'ASBR' (Autonomous System Boundary Router), not ABR; an ASBR redistributes external routes into OSPF, it does not connect areas. Option C is wrong because 1.1.1.1 is labeled 'ABR', not 'ASBR'; only an ASBR redistributes external routes into OSPF. Option D is wrong because the route to 2.2.2.2 is marked with 'i' (intra-area), not 'I' (inter-area); inter-area routes are denoted by a capital 'I' in the OSPF routing table.

Full explanation →
1578
Drag & Dropmedium

Drag and drop the steps of WLC high availability SSO failover steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In WLC SSO HA, the active WLC fails, triggering the standby to take over. The standby detects the failure via loss of heartbeat and link state. It then assumes the active role, reinitializing interfaces and applying the synchronized configuration.

The standby (now active) sends gratuitous ARP to update the network. Finally, client sessions and CAPWAP tunnels are re-established with the new active WLC.

Full explanation →
1579
Multi-Selectmedium

Which two statements about OSPF network types are true? (Choose two.)

Select 2 answers
A.The point-to-point network type does not require a DR/BDR election.
B.The broadcast network type uses a DR/BDR to reduce the number of adjacencies.
C.The NBMA network type automatically discovers neighbors via hello packets.
D.The point-to-multipoint network type requires a DR/BDR election.
E.The loopback interface defaults to the point-to-point network type.
AnswersA, B

Correct because in point-to-point networks, there are only two routers, so no DR/BDR is needed.

Why this answer

The point-to-point network type does not require a DR/BDR election. Option B is correct because the broadcast network type uses a DR/BDR to reduce adjacencies and LSAs. Option C is incorrect because NBMA networks require manual neighbor configuration.

Option D is incorrect because the point-to-multipoint network type does not require a DR/BDR. Option E is incorrect because the loopback interface defaults to the loopback network type, not point-to-point.

Full explanation →
1580
Drag & Dropmedium

Drag and drop the steps of IGMPv3 membership report processing into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

IGMPv3 allows hosts to specify source filtering. The host sends a Membership Report with group and source list. The switch/router receives the report and updates its multicast forwarding table.

It adds the group and includes the requested sources. It then forwards multicast traffic from those sources to the host's port. The router periodically sends General Queries to maintain membership.

Full explanation →
1581
MCQhard

A network engineer runs the following command on Switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi1/0/15 Encapsulation : Native Ingress : Disabled Based on this output, what can be concluded?

A.This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.
B.This is a local SPAN session with source VLAN 100.
C.The RSPAN VLAN 100 is used to send traffic to a remote switch.
D.Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.
AnswerA

The type 'Remote Destination Session' and source RSPAN VLAN indicate this.

Why this answer

The output shows a Remote Destination Session, meaning this switch (SW3) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 100 and forwards it out of the destination port Gi1/0/15, typically to a monitoring device. The 'Ingress: Disabled' confirms that traffic entering Gi1/0/15 is not being injected back into the switch.

Exam trap

Cisco often tests the distinction between source and destination RSPAN sessions, and the trap here is confusing the role of the RSPAN VLAN—candidates may think it is used to send traffic away from the switch rather than receive mirrored traffic for local monitoring.

How to eliminate wrong answers

Option B is wrong because the session type is 'Remote Destination Session', not 'Local SPAN', and the source is an RSPAN VLAN, not a source VLAN for local SPAN. Option C is wrong because RSPAN VLAN 100 is used to carry mirrored traffic from source switches to this destination switch, not to send traffic to a remote switch from this switch. Option D is wrong because ingress on Gi1/0/15 is disabled, meaning traffic entering that port is not forwarded to the RSPAN VLAN; the RSPAN VLAN is the source of mirrored traffic, not a destination for ingress traffic.

Full explanation →
1582
Matchingmedium

Drag and drop each SNMP operation on the left to its matching direction on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Manager requests a specific variable from agent

Manager requests the next variable in a MIB tree

Manager requests a large block of data efficiently

Manager modifies a variable on the agent

Agent sends unsolicited notification to manager

Why these pairings

GET, GETNEXT, GETBULK, and SET are initiated by the manager; TRAP and INFORM are initiated by the agent.

Full explanation →
1583
Multi-Selecthard

Which three statements about MPLS forwarding are true? (Choose three.)

Select 3 answers
A.MPLS forwarding uses the Label Forwarding Information Base (LFIB) to make forwarding decisions.
B.The LFIB is populated by label distribution protocols such as LDP.
C.The LIB stores all labels learned from LDP neighbors, but the LFIB is used for actual forwarding.
D.MPLS forwarding uses the Forwarding Information Base (FIB) for label lookups.
E.MPLS forwarding uses the Routing Information Base (RIB) to determine the next hop.
AnswersA, B, C

Correct because the LFIB is the table used for MPLS label switching.

Why this answer

MPLS forwarding is based on a label lookup in the LFIB (Label Forwarding Information Base). The LFIB is populated by label distribution protocols such as LDP or RSVP-TE. The FIB (Forwarding Information Base) is used for IP forwarding, not MPLS.

The LIB (Label Information Base) stores all labels learned from neighbors, but the LFIB is used for actual forwarding decisions. Option D is incorrect because the FIB is not used for MPLS forwarding. Option E is incorrect because the RIB (Routing Information Base) is used for IP routing, not MPLS label switching.

Full explanation →
1584
MCQmedium

Examine the following configuration on a Cisco IOS-XE switch: interface GigabitEthernet0/5 switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30 switchport nonegotiate What is the effect of the 'switchport nonegotiate' command?

A.The interface will not send DTP frames, but will still respond to incoming DTP frames.
B.The interface will not send or process DTP frames, and remains a trunk.
C.The interface will revert to an access port.
D.The interface will negotiate trunking using ISL instead of DTP.
AnswerB

Correct. DTP is completely disabled, and the static trunk configuration remains.

Why this answer

The 'switchport nonegotiate' command disables Dynamic Trunking Protocol (DTP) on the interface. When configured on a trunk port, the interface will neither send nor process any DTP frames, ensuring the port remains in trunk mode regardless of the neighbor's DTP configuration. This is commonly used when connecting to non-Cisco devices that do not support DTP, or to prevent unwanted trunk negotiation.

Exam trap

Cisco often tests the misconception that 'switchport nonegotiate' only stops sending DTP frames but still allows the interface to respond to them, when in fact it disables all DTP processing, both sending and receiving.

How to eliminate wrong answers

Option A is wrong because 'switchport nonegotiate' prevents the interface from both sending and processing DTP frames; it does not allow the interface to respond to incoming DTP frames. Option C is wrong because the interface does not revert to an access port; it remains a trunk as explicitly configured with 'switchport mode trunk'. Option D is wrong because DTP is used to negotiate either ISL or 802.1Q trunking, but 'switchport nonegotiate' disables DTP entirely, not switches to ISL negotiation.

Full explanation →
1585
MCQhard

An engineer is troubleshooting an EIGRP issue where a router is not learning a specific route from a neighbor. The engineer runs 'show ip eigrp topology all-links' and sees the route in the topology table with a feasible distance of 100 and a reported distance of 120. The neighbor's advertised distance is 80. The router's own computed distance to the network is 150. The route is not in the routing table. What is the most likely cause?

A.The route is a feasible successor, but the successor route is not present.
B.The route is not installed because the reported distance (80) from the neighbor is less than the feasible distance (100), but the router's computed distance (150) is higher.
C.The route is not installed because its metric (150) is not the best metric; the router has another route with a lower metric (100).
D.The route is not installed because EIGRP is configured for stub routing, which prevents learning routes.
AnswerC

The route in the topology table has a computed distance of 150, which is higher than the feasible distance (FD) of 100. EIGRP only installs the successor route (lowest metric) into the routing table, so this route is not installed because it is not the best path.

Why this answer

The route in the topology table has a computed distance of 150 via the neighbor, but the feasible distance (FD) for this destination is 100, which is the best metric from another neighbor. EIGRP installs only the route with the lowest metric (the successor) into the routing table. Since the computed distance of 150 is higher than the FD of 100, this route is not the best and is not installed.

Option C correctly identifies that the route is not installed because there is another route with a lower metric.

Exam trap

Candidates often confuse the feasible distance (FD) with the computed distance of a specific path. Here, the FD is 100 from a different neighbor, but the route in question has a computed distance of 150—it is not the successor. The route is not installed because it is not the best path, not because of any feasibility condition issue.

How to eliminate wrong answers

Option A is wrong because a feasible successor is a backup route that meets the feasibility condition (reported distance < feasible distance), but the route is not installed as a feasible successor if the successor route is present; the issue is that the route is not in the routing table, not that the successor is missing. Option B is wrong because the reported distance (80) from the neighbor is less than the feasible distance (100), which actually satisfies the feasibility condition, but the router's computed distance (150) being higher than the FD (100) means this route is not the best path; the route is not installed because the router has a better path (FD 100), not because of the reported distance comparison. Option D is wrong because stub routing prevents the router from learning routes from neighbors, but the router is learning the route (it appears in the topology table), so stub routing is not the cause; the issue is about route selection, not route learning.

Full explanation →
1586
Drag & Dropmedium

Drag and drop the steps of configuring LLQ (Low Latency Queuing) on a Cisco router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order for configuring LLQ (Low Latency Queuing) on a Cisco router is: first, create a class-map to define the traffic class for real-time traffic (A). Next, configure the priority command in a policy-map to assign priority queuing to that class (B). Then, set bandwidth and queue-limit parameters for the priority queue within the policy-map (C).

After the policy-map is complete, apply it to the interface using the service-policy output command (D). Finally, verify the priority queue operation using show policy-map (E). This sequence ensures proper classification, queuing, and activation.

Full explanation →
1587
Drag & Dropmedium

Drag and drop the steps of VLAN mapping on trunk interfaces into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

VLAN mapping requires first enabling the feature globally, then configuring the trunk interface, mapping the VLANs, and finally verifying the translation. The order ensures proper translation between customer and service provider VLANs.

Full explanation →
1588
Multi-Selecthard

Which three statements about OSPF area types are correct? (Choose three.)

Select 3 answers
A.A stub area blocks Type 5 AS External LSAs but allows Type 3 Summary LSAs and a default route.
B.A totally stubby area blocks both Type 5 and Type 3 LSAs, injecting only a default route into the area.
C.A not-so-stubby-area (NSSA) allows Type 5 LSAs to be imported from external networks.
D.A standard area can contain Type 1, 2, 3, 4, and 5 LSAs.
E.A totally NSSA blocks Type 3 LSAs but allows Type 5 LSAs from external sources.
AnswersA, B, D

Correct because stub areas are designed to reduce the LSDB by preventing Type 5 LSAs, while still receiving inter-area routes via Type 3 and a default route.

Why this answer

OSPF area types control the propagation of LSAs. A standard area can carry all LSA types. A stub area blocks Type 5 LSAs but allows Type 3.

A totally stubby area blocks both Type 5 and Type 3 (except a default route). A not-so-stubby-area (NSSA) blocks Type 5 but allows Type 7 for external routes. A totally NSSA further blocks Type 3.

Full explanation →
1589
Drag & Dropmedium

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Extended ACLs filter based on source/destination IP, protocol, and port; must be applied to an interface.

Full explanation →
1590
MCQmedium

A network engineer is configuring 802.1X on a Cisco switch for a voice VLAN deployment. The switchport is connected to an IP phone, which then connects to a PC. The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'switchport voice vlan 10'. The PC authenticates successfully, but the IP phone does not get an IP address from the voice VLAN. The engineer verifies that the phone is configured for 802.1X and the RADIUS server is correct. What is the most likely cause?

A.The IP phone does not support 802.1X and is not configured for MAB.
B.The switchport is missing 'switchport mode access' command.
C.The RADIUS server is not sending the voice VLAN ID in the Access-Accept.
D.The PC is using the voice VLAN instead of the data VLAN.
AnswerA

Correct because the phone must authenticate to be placed in the voice VLAN; if it fails, it may not get the voice VLAN.

Why this answer

The IP phone fails to obtain an IP address from the voice VLAN because it is configured for 802.1X but does not support it, and the switchport is not configured for MAC Authentication Bypass (MAB). Without MAB, the switch will not place the phone into the voice VLAN until it successfully authenticates. Since the phone cannot complete 802.1X, it remains in the data VLAN or an unauthorized state, preventing it from receiving a voice VLAN IP address.

Exam trap

Cisco often tests the misconception that configuring 'authentication port-control auto' and 'dot1x pae authenticator' alone is sufficient for all devices, when in fact non-802.1X-capable devices like IP phones require MAB as a fallback mechanism to be placed into the voice VLAN.

How to eliminate wrong answers

Option B is wrong because 'switchport mode access' is not required for voice VLAN deployments; the voice VLAN feature works with 'switchport mode access' implicitly set by default, and the missing command would not prevent the phone from getting a voice VLAN IP address. Option C is wrong because the RADIUS server does not need to send the voice VLAN ID in the Access-Accept; the voice VLAN is configured locally on the switchport with 'switchport voice vlan 10', and the RADIUS server only needs to authenticate the phone's credentials. Option D is wrong because the PC authenticates successfully and uses the data VLAN; the issue is that the phone itself is not authenticating, not that the PC is using the wrong VLAN.

Full explanation →
1591
Matchingmedium

Drag and drop each TACACS+ packet type on the left to its correct function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Initiates an authentication session from the client to the server

Sent by the server to the client, carrying prompts or authentication results

Sent by the client to the server with the user's response to a prompt

Used for authorization requests and responses

Used for accounting start, stop, and interim records

Why these pairings

TACACS+ uses START to initiate authentication, REPLY to respond with prompts or success/failure, CONTINUE to send user responses, and also has special types for authorization and accounting.

Full explanation →
1592
MCQmedium

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

A.The switches are not configured with NETCONF/YANG or telemetry streaming.
B.The DNA Center appliance is not licensed for the Assurance module.
C.The switches are not running the correct IOS-XE version for DNA Center compatibility.
D.The SNMP community string is incorrect on the switches.
AnswerA

Correct because Assurance requires telemetry streaming (e.g., model-driven telemetry) from devices; SNMP alone is insufficient.

Why this answer

Cisco DNA Center Assurance relies on telemetry data collected via NETCONF/YANG or gRPC, not just SNMP. If the switches are not configured for telemetry, Assurance will not receive the necessary data. SNMP is used for inventory and basic monitoring, but not for the rich telemetry required by Assurance.

Full explanation →
1593
MCQmedium

interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.0 mpls ip mpls label protocol ldp ! router ospf 1 network 10.1.1.0 0.0.0.255 area 0 ! router ldp interface GigabitEthernet0/1 ! What is the effect of this configuration?

A.MPLS forwarding is enabled on GigabitEthernet0/1, and LDP will distribute labels for all routes in the routing table.
B.Only OSPF routes are labeled; static routes are excluded from LDP label distribution.
C.The 'mpls label protocol ldp' command is redundant because LDP is the default.
D.The configuration will fail because 'router ldp' requires an LDP router-id to be set.
AnswerA

Correct. 'mpls ip' enables MPLS forwarding, and LDP with the interface configuration will distribute labels for all routes, including OSPF-learned ones.

Why this answer

The `mpls ip` command under the interface enables MPLS forwarding, and the `router ldp` configuration with the interface specified activates LDP on that interface. LDP will then distribute labels for all routes in the routing table (including OSPF, static, connected, etc.) by default, as LDP does not filter based on routing protocol. The `mpls label protocol ldp` command is indeed redundant since LDP is the default label distribution protocol in Cisco IOS, but it does not break the configuration.

Exam trap

Cisco often tests the misconception that LDP only labels OSPF or IGP routes, when in fact LDP distributes labels for all routes in the routing table by default, including static and connected routes.

How to eliminate wrong answers

Option B is wrong because LDP distributes labels for all routes in the routing table, not just OSPF routes; there is no implicit filtering by routing protocol. Option C is wrong because while `mpls label protocol ldp` is redundant (LDP is the default), the configuration still works and the statement 'redundant' does not make the option correct as the question asks for the effect, not a critique of redundancy. Option D is wrong because `router ldp` does not require an explicit LDP router-id to be set; if not configured, the router will use the highest loopback IP or the highest interface IP as the LDP router-id automatically.

Full explanation →
1594
Multi-Selecthard

Which three statements about SNMP trap and inform operations are true? (Choose three.)

Select 3 answers
A.Traps are unacknowledged notifications sent from the SNMP agent to the manager.
B.Informs are acknowledged notifications that require a response from the manager.
C.Informs use UDP port 162, the same as traps.
D.Traps are more reliable than informs because they are sent with a higher priority.
E.Informs consume less memory and processing than traps because they do not require state tracking.
AnswersA, B, C

Correct: Traps are unacknowledged; the manager does not send a response.

Why this answer

SNMP traps are unacknowledged messages sent from agent to manager. Informs are acknowledged (confirmed) notifications. Informs require a response from the manager and can be retransmitted if no response is received.

Traps are sent via UDP port 162 by default. Informs also use UDP port 162. Informs consume more memory and processing because they maintain state for acknowledgment.

Traps are less reliable because they are not acknowledged.

Full explanation →
1595
MCQmedium

R1 has an OSPF priority of 0. What is its role on the OSPF network?

A.Backup Designated Router
B.DROther
C.Regular router
D.Designated Router
AnswerB

A router with priority 0 is always a DROther, making this the correct answer.

Why this answer

In OSPF, a router with priority 0 cannot be elected as Designated Router (DR) or Backup Designated Router (BDR). Such a router is always a DROther.

Exam trap

Cisco often tests the OSPF priority 0 rule, where candidates mistakenly think a router with priority 0 can still be a BDR.

How to eliminate wrong answers

Option B (DROther) is wrong because DROther routers have a priority greater than 0 but are not elected as DR or BDR; R1 is shown as BDR, so it cannot be DROther. Option C (Regular router) is wrong because 'regular router' is not an OSPF role; OSPF roles are DR, BDR, or DROther. Option D (Designated Router) is wrong because R1 is explicitly labeled as BDR in the exhibit, not DR.

Full explanation →
1596
MCQmedium

A network engineer runs the following command on Router R7: R7# show ip ospf neighbor vrf CUSTOMER-E Neighbor ID Pri State Dead Time Address Interface 10.0.0.8 1 FULL/DR 00:00:35 10.0.1.2 GigabitEthernet0/0.500 10.0.0.9 1 FULL/BDR 00:00:31 10.0.2.2 GigabitEthernet0/0.600 Based on this output, what can be concluded?

A.OSPF is not configured for VRF CUSTOMER-E
B.There is only one OSPF neighbor in VRF CUSTOMER-E
C.OSPF is operating within VRF CUSTOMER-E with two neighbors
D.The DR is 10.0.0.9
AnswerC

Two neighbors are in FULL state, indicating OSPF adjacency.

Why this answer

The command `show ip ospf neighbor vrf CUSTOMER-E` explicitly queries OSPF neighbors within the VRF named CUSTOMER-E. The output shows two neighbors (10.0.0.8 and 10.0.0.9) with states FULL/DR and FULL/BDR, confirming that OSPF is actively operating inside that VRF. Therefore, option C is correct because it accurately states that OSPF is operating within VRF CUSTOMER-E with two neighbors.

Exam trap

Cisco often tests the misconception that the DR is always the neighbor with the highest IP address or the first listed, but the DR is explicitly indicated by the state field (FULL/DR), not by the Neighbor ID or IP address.

How to eliminate wrong answers

Option A is wrong because the command successfully returned neighbor details, which would not happen if OSPF were not configured for VRF CUSTOMER-E; a missing OSPF configuration under the VRF would produce an empty output or an error. Option B is wrong because the output clearly lists two neighbors (10.0.0.8 and 10.0.0.9), not one. Option D is wrong because the DR (Designated Router) is identified by the neighbor with state FULL/DR, which is 10.0.0.8, not 10.0.0.9 (the BDR).

Full explanation →
1597
MCQhard

A network team uses Ansible to automate VLAN configuration on Cisco IOS devices. The playbook fails with the error 'Failed to connect to the host via ssh: Permission denied (publickey)'. The control node runs Ubuntu, and the network devices are configured with SSH key authentication. Which solution should the engineer implement?

A.Set ansible_ssh_private_key_file in the inventory but omit the passphrase
B.Set ansible_user to the correct username in the inventory
C.Run ssh-add on the control node to add the private key to the SSH agent
D.Enable keyboard-interactive authentication on the IOS devices
AnswerC

The SSH agent must have the key loaded for authentication.

Why this answer

The error 'Permission denied (publickey)' indicates that the SSH key is not being presented to the IOS device. Running ssh-add on the control node loads the private key into the SSH agent, which Ansible uses by default when connecting via SSH. This resolves the authentication failure without requiring a passphrase or changing the inventory.

Exam trap

Cisco often tests the misconception that setting inventory variables like ansible_ssh_private_key_file or ansible_user alone fixes SSH key issues, when the real problem is that the key is not loaded into the SSH agent on the control node.

How to eliminate wrong answers

Option A is wrong because setting ansible_ssh_private_key_file without a passphrase does not help if the key is not loaded into the agent or if the key file is encrypted; Ansible will still fail to authenticate if the key is not accessible. Option B is wrong because setting ansible_user to the correct username addresses only the username, not the missing private key authentication; the error is about key-based authentication, not user identity. Option D is wrong because enabling keyboard-interactive authentication on IOS devices would allow password-based methods, but the issue is that the private key is not being presented; keyboard-interactive does not solve the missing key problem and may introduce security risks.

Full explanation →
1598
MCQmedium

An enterprise is deploying Cisco SD-WAN and must ensure that data plane traffic between branch sites is encrypted and authenticated. The design must also allow the use of application-aware routing to steer traffic based on real-time performance metrics. Which component is responsible for establishing and managing the IPsec tunnels between branch routers?

A.vSmart controllers
B.vEdge/cEdge routers
C.vManage
D.vBond
AnswerB

vEdge/cEdge routers are the data plane devices that establish and terminate IPsec tunnels between branches, encrypting traffic and applying application-aware routing.

Why this answer

The vEdge/cEdge routers are the correct answer because they are the SD-WAN edge devices that terminate IPsec tunnels for data plane traffic. In Cisco SD-WAN, the data plane is fully distributed: each vEdge or cEdge router establishes and manages its own IPsec tunnels (using DTLS/TLS for control and IPsec for data) directly with other branch routers. This allows the routers to apply application-aware routing by monitoring real-time performance metrics (e.g., loss, latency, jitter) and steering traffic across the encrypted tunnels accordingly.

Exam trap

Cisco often tests the misconception that vSmart controllers handle all tunnel management, but in SD-WAN, vSmart only distributes policies and OMP routes, while the actual IPsec tunnel establishment and data plane forwarding is a function of the vEdge/cEdge routers.

How to eliminate wrong answers

Option A is wrong because vSmart controllers are responsible for the control plane—they distribute routing policies, OMP routes, and TLOCs to vEdge/cEdge routers, but they do not establish or manage IPsec data plane tunnels. Option C is wrong because vManage is the management and orchestration plane; it provides a GUI for configuration, monitoring, and troubleshooting but does not participate in IPsec tunnel establishment. Option D is wrong because vBond is the orchestrator that handles initial authentication, NAT traversal, and vSmart/vManage discovery; it does not terminate or manage IPsec data plane tunnels.

Full explanation →
1599
MCQmedium

A network engineer issues the following command on Router R9: R9# show ip sla configuration 7 IP SLAs Infrastructure Engine-II Entry number: 7 Owner: Tag: Type of operation to perform: icmp-echo Target address: 192.168.9.10 Source address: 192.168.9.1 Type Of Service parameter: 0x0 Request size (ARR data portion): 28 Operation timeout (milliseconds): 5000 Frequency (seconds): 30 Next Scheduled Start Time: Start Time already passed Group Scheduled : FALSE Life (seconds): 3600 Entry Ageout (seconds): never Recurring (Starting Everyday, Starting Time: 00:00:01) Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of statistic hours kept: 2 Number of statistic distribution buckets kept: 1 Statistic distribution interval (milliseconds): 20 Enhanced History: Based on this output, how long will this IP SLA operation run?

A.Forever
B.30 seconds
C.3600 seconds
D.5000 milliseconds
AnswerC

The life is explicitly 3600 seconds.

Why this answer

The 'Life (seconds): 3600' field explicitly defines the duration for which the IP SLA operation remains active. This value overrides any other timing parameters, meaning the operation will run for 3600 seconds (1 hour) from its start time, regardless of the frequency or threshold settings.

Exam trap

Cisco often tests the distinction between 'Life', 'Frequency', and 'Timeout' in IP SLA configurations, and the trap here is that candidates confuse the 'Frequency' (30 seconds) or 'Timeout' (5000 ms) with the total operation duration, overlooking the explicit 'Life' field.

How to eliminate wrong answers

Option A is wrong because 'Forever' would require the Life field to be set to 'never' or the operation to be recurring without a life limit, but here Life is explicitly 3600 seconds. Option B is wrong because 30 seconds is the frequency (interval between probes), not the total runtime of the operation. Option D is wrong because 5000 milliseconds is the operation timeout (how long to wait for a reply) and also the threshold value, not the overall lifetime.

Full explanation →
1600
Drag & Dropmedium

Drag and drop the steps of IP addressing scheme design and subnetting steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

IP addressing design starts with gathering requirements, then choosing a private address space. Subnetting is applied to create subnets, which are assigned to specific network segments, and finally summarized to reduce routing table size.

Full explanation →
1601
Drag & Dropmedium

Drag and drop the steps of Multiple SPAN source ports with filter VLAN into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The configuration must first specify the session, then define sources and filter VLAN, and finally activate the session.

Full explanation →
1602
MCQmedium

A network engineer runs the following command on switch SW1: SW1# show authentication sessions interface GigabitEthernet1/0/1 Interface: GigabitEthernet1/0/1 MAC Address: 0011.2233.4455 IP Address: 192.168.1.100 Status: Authz Success Domain: DATA Oper host mode: multi-auth Oper control dir: both Session timeout: N/A Common Session ID: 0A1B2C3D4E5F6G7H8I9J Acct Session ID: 0x0000000A Handle: 0x00000001 Current Method List: mab Method: MAB State: Authz Success Based on this output, what can be concluded?

A.The client authenticated using 802.1X with a username and password.
B.The client was authenticated based on its MAC address via MAB.
C.The port is in multi-domain mode, allowing one data and one voice device.
D.The session is for voice traffic because the domain is DATA.
AnswerB

The method is MAB and state is Authz Success, meaning MAC authentication succeeded.

Why this answer

The output shows the current method list as 'mab' and the method as 'MAB' with a state of 'Authz Success'. This indicates that the client was authenticated using MAC Authentication Bypass (MAB), which uses the MAC address as the credentials, not 802.1X. The 'Status: Authz Success' confirms successful authorization, and the 'Domain: DATA' indicates it is a data device, not voice.

Exam trap

Cisco often tests the distinction between 'multi-auth' and 'multi-domain' host modes, where candidates mistakenly assume 'multi-auth' allows only one data and one voice device, but it actually allows multiple devices of any type.

How to eliminate wrong answers

Option A is wrong because the current method list is 'mab', not 'dot1x', and the state shows MAB success, meaning 802.1X was not used; if 802.1X had been used, the method would show 'dot1x'. Option C is wrong because the output shows 'Oper host mode: multi-auth', not 'multi-domain'; multi-auth allows multiple devices per port, while multi-domain allows one data and one voice device. Option D is wrong because the domain is 'DATA', which indicates the session is for data traffic, not voice; voice traffic would show 'VOICE' in the domain field.

Full explanation →
1603
Multi-Selecteasy

Which TWO statements are true about Cisco DNA Center automation? (Choose two.)

Select 2 answers
A.DNA Center primarily uses SNMP to manage devices.
B.DNA Center only supports greenfield deployments.
C.DNA Center uses a declarative model for network configuration.
D.DNA Center provides a single dashboard for network management.
E.DNA Center uses an imperative model for network configuration.
AnswersC, D

DNA Center is declarative.

Why this answer

Cisco DNA Center uses a declarative model for network configuration. In a declarative model, the administrator specifies the desired end-state of the network (e.g., 'VLAN 10 should exist on all access switches'), and DNA Center's automation engine determines the necessary steps to achieve that state, handling dependencies and ordering automatically. This contrasts with imperative models where each step must be explicitly scripted.

Exam trap

Cisco often tests the distinction between declarative and imperative models, and the trap here is that candidates mistakenly associate DNA Center's automation with imperative scripting (like Python or Ansible playbooks) rather than recognizing its intent-based, declarative nature.

Full explanation →
1604
MCQmedium

Examine the following configuration: policy-map QUEUE class GOLD bandwidth percent 25 queue-limit 64 packets class SILVER bandwidth percent 25 queue-limit 128 packets class class-default fair-queue interface GigabitEthernet0/2 service-policy output QUEUE Which statement about this configuration is true?

A.The GOLD class has a smaller queue limit than SILVER, which may cause more packet drops for GOLD traffic under congestion.
B.The SILVER class will always receive more bandwidth than GOLD because of its larger queue limit.
C.The configuration is invalid because 'queue-limit' cannot be used with 'bandwidth percent' in the same class.
D.The 'fair-queue' command in class-default will override the bandwidth allocation for GOLD and SILVER.
AnswerA

Correct. A smaller queue limit means fewer packets can be buffered, increasing the likelihood of drops when the queue is full.

Why this answer

The GOLD class has a queue-limit of 64 packets, while the SILVER class has a queue-limit of 128 packets. Under congestion, the smaller queue for GOLD will fill up faster, leading to more tail drops for GOLD traffic, even though both classes are allocated the same bandwidth percentage. This demonstrates that queue-limit directly affects drop probability, not bandwidth allocation.

Exam trap

Cisco often tests the misconception that a larger queue-limit implies more bandwidth, when in fact queue-limit only affects buffer depth and drop behavior, not bandwidth allocation.

How to eliminate wrong answers

Option B is wrong because queue-limit does not affect bandwidth allocation; bandwidth is controlled by the 'bandwidth percent' command, which is set to 25% for both GOLD and SILVER, so they receive equal bandwidth under congestion. Option C is wrong because 'queue-limit' can be used with 'bandwidth percent' in the same class; they are independent QoS parameters that control different aspects (bandwidth guarantee vs. queue depth). Option D is wrong because 'fair-queue' in class-default only applies to the default class and does not override the explicit bandwidth allocation for GOLD and SILVER classes, which are configured with strict bandwidth percentages.

Full explanation →
1605
MCQhard

A network engineer runs the following command on Switch SW2: SW2# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address aabb.cc00.0100 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address aabb.cc00.0200 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Gi0/3 Desg FWD 19 128.3 P2p Based on this output, what can be concluded?

A.SW2 is the root bridge for VLAN 10.
B.The root bridge for VLAN 10 has MAC address aabb.cc00.0100.
C.Port Gi0/2 is in forwarding state.
D.The STP priority for VLAN 10 is 32768.
AnswerB

The Root ID shows the root bridge's MAC address as aabb.cc00.0100.

Why this answer

The output shows that the Root ID has MAC address aabb.cc00.0100, while the Bridge ID (SW2 itself) has MAC address aabb.cc00.0200. Since SW2 is not the root bridge (its Bridge ID differs from the Root ID), the root bridge for VLAN 10 must be the switch with MAC address aabb.cc00.0100. The Root ID field always identifies the root bridge in the spanning tree.

Exam trap

Cisco often tests the distinction between the Root ID and Bridge ID fields in 'show spanning-tree' output, causing candidates to mistakenly think the local switch is the root when they see its own priority, without checking the MAC address or root port status.

How to eliminate wrong answers

Option A is wrong because SW2's Bridge ID (aabb.cc00.0200) does not match the Root ID (aabb.cc00.0100), and SW2 has a root port (Gi0/1) with a cost of 19, indicating it is not the root bridge. Option C is wrong because the output shows Gi0/2 is in the 'Altn BLK' (Alternate Blocking) role and state, not forwarding. Option D is wrong because the STP priority for VLAN 10 is 32778 (as shown in the Bridge ID line), which is the base priority 32768 plus the VLAN ID 10 (sys-id-ext), not 32768 alone.

Full explanation →
1606
Matchingmedium

Drag and drop each hypervisor type on the left to its matching characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Runs directly on physical hardware without a host OS

Runs on top of an existing operating system

Example of a Type 1 hypervisor

Example of a Type 2 hypervisor

Linux-based Type 1 hypervisor that is part of the kernel

Why these pairings

Type 1 hypervisors run directly on hardware and are common in data centers; Type 2 run on a host OS and are used for desktop virtualization.

Full explanation →
1607
Multi-Selectmedium

Which two statements about SNMPv3 security models are true? (Choose two.)

Select 2 answers
A.The authNoPriv security model provides authentication but no encryption.
B.The noAuthNoPriv security model uses both a username and a password for authentication.
C.The authPriv security model provides both authentication and encryption.
D.SNMPv3 requires the use of a separate engine ID for each SNMP manager and agent.
E.The authPriv model supports only AES-256 for encryption.
AnswersA, C

Correct: authNoPriv uses an authentication protocol (MD5 or SHA) but does not encrypt the payload.

Why this answer

SNMPv3 provides three security models: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication but no encryption), and authPriv (authentication and encryption). The authPriv model uses HMAC-MD5 or HMAC-SHA for authentication and CBC-DES or CFB128-AES for encryption. The engine ID is a unique identifier for each SNMP entity and is used to generate the localized key.

Full explanation →
1608
MCQmedium

A network architect is designing QoS for a converged network carrying voice, video, and data. The design must use the DiffServ model and ensure that voice traffic is marked with the highest priority and that video traffic is marked with a lower priority but still above data. Which DSCP markings should be assigned to voice and video traffic, respectively, to comply with the standard Per-Hop Behavior (PHB) definitions?

A.Voice: DSCP 46 (EF); Video: DSCP 34 (AF41)
B.Voice: DSCP 56 (CS7); Video: DSCP 48 (CS6)
C.Voice: DSCP 40 (AF41); Video: DSCP 46 (EF)
D.Voice: DSCP 26 (AF31); Video: DSCP 18 (AF21)
AnswerA

EF (DSCP 46) provides strict priority for voice; AF41 (DSCP 34) provides assured forwarding for video with lower priority than voice.

Why this answer

The DiffServ model defines specific Per-Hop Behaviors (PHBs) for different traffic types. Voice traffic requires low latency, jitter, and loss, which is best served by the Expedited Forwarding (EF) PHB, assigned DSCP 46. Video traffic, while still delay-sensitive, can tolerate some loss and is typically marked with Assured Forwarding (AF41, DSCP 34), which provides a lower priority queue than EF but higher than best-effort data.

Exam trap

Cisco often tests the specific DSCP values for EF (46) and AF41 (34) and the fact that voice must use EF (not AF or CS) to ensure strict priority queuing, while video uses the highest AF class (AF41) to differentiate it from data without breaking the EF queue.

How to eliminate wrong answers

Option B is wrong because DSCP 56 (CS7) and DSCP 48 (CS6) are Class Selector codepoints used for network control traffic (e.g., routing protocols), not for voice or video; they would starve other traffic and violate the standard PHB definitions. Option C is wrong because it reverses the priority: DSCP 40 (AF41) is for video, not voice, and DSCP 46 (EF) is for voice, not video; this would incorrectly prioritize video over voice. Option D is wrong because DSCP 26 (AF31) and DSCP 18 (AF21) are Assured Forwarding classes with lower drop precedence, typically used for mission-critical data or streaming video, not for real-time voice; they do not provide the strict priority queuing required for voice traffic.

Full explanation →
1609
MCQmedium

A network engineer runs the following command on a Cisco WLC: WLC# show ap stats ap-name AP-1 AP Statistics for AP-1 ---------------------- Channel Utilization: 45% Interference: 10% Noise Floor: -95 dBm Total Packets Received: 15000 Total Packets Sent: 12000 Total Errors: 200 Based on this output, what can be concluded?

A.The channel is heavily congested with utilization above 80%.
B.The noise floor is high, indicating potential interference.
C.The AP is experiencing a significant number of errors relative to packets received.
D.The channel utilization is moderate and the noise floor is low.
AnswerD

45% utilization is moderate, and -95 dBm noise floor is low, indicating a relatively clean channel.

Why this answer

The channel utilization of 45% is considered moderate (typically below 50% is acceptable), and the noise floor of -95 dBm is very low (excellent), indicating a clean RF environment. The interference value of 10% is also low, and the error count of 200 out of 15,000 received packets (1.33%) is not significant. This output shows a healthy AP with no major issues.

Exam trap

Cisco often tests the misconception that any non-zero error count or moderate utilization is automatically problematic, when in fact the absolute values and percentages must be evaluated against established thresholds (e.g., noise floor below -90 dBm is good, utilization under 50% is moderate).

How to eliminate wrong answers

Option A is wrong because 45% channel utilization is far below the 80% threshold that would indicate heavy congestion; Cisco recommends planning for utilization under 50% for good performance. Option B is wrong because a noise floor of -95 dBm is actually very low (excellent), not high; typical noise floor values above -80 dBm are considered high and problematic. Option C is wrong because 200 errors out of 15,000 received packets is only about 1.33%, which is not a significant error rate; significant errors would typically be above 5-10% or indicate physical layer issues.

Full explanation →
1610
Matchingmedium

Drag and drop each ACL type on the left to its matching capability on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Filters based on source IP address only

Filters based on source/destination IP, protocol, and port numbers

Allows alphanumeric naming for easier identification

Applies time-of-day restrictions to permit or deny traffic

Opens temporary holes for user authentication

Why these pairings

Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow alphanumeric naming; Time-based ACLs restrict based on time of day.

Full explanation →
1611
Drag & Dropmedium

Drag and drop the steps of Layer 3 EtherChannel (routed port-channel) setup into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order for Layer 3 EtherChannel (routed port-channel) setup is: first, create the port-channel interface using 'interface port-channel'. Next, configure the member ports as Layer 3 interfaces with 'no switchport' and assign them to the port-channel using 'channel-group'. Then, assign an IP address to the port-channel interface.

After that, enable the port-channel interface with 'no shutdown'. Finally, verify routing using 'show ip route' and ping.

Full explanation →
1612
Drag & Dropmedium

Drag and drop the steps of MSDP peering for inter-domain multicast into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

MSDP allows RPs in different domains to share information about active sources. When an RP learns of a new source, it sends a Source-Active (SA) message to its MSDP peers. The peer RP then creates an (S,G) state and can join the source if there are interested receivers.

Full explanation →
1613
Matchinghard

Drag and drop each ISE policy result on the left to its matching enforcement action on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Downloadable ACL applied to the port

Assigns the endpoint to a specific VLAN

Assigns a security group tag to the session

Redirects HTTP traffic to a captive portal

Sets maximum duration for the authenticated session

Why these pairings

DACL filters traffic, VLAN assigns network segment, SGT tags traffic for TrustSec, URL redirect forces web authentication.

Full explanation →
1614
MCQeasy

A network engineer is designing a campus network and needs to ensure high availability for the core layer. Which design best practice should be implemented?

A.Use a single distribution switch to simplify management.
B.Deploy two core switches configured with VSS or StackWise.
C.Configure the core layer for Layer 2 switching only.
D.Use spanning-tree PortFast on all core switch ports.
AnswerB

Dual core switches with VSS or StackWise provide redundancy and sub-second failover.

Why this answer

Deploying two core switches with VSS (Virtual Switching System) or StackWise provides both redundancy and active-active load balancing at the core layer. VSS virtualizes two physical switches into a single logical switch, eliminating the need for Spanning Tree Protocol (STP) on inter-switch links and enabling sub-second failover. This design ensures high availability by removing single points of failure and maximizing throughput between distribution and core layers.

Exam trap

Cisco often tests the misconception that the core layer should remain Layer 2 for simplicity, but in modern campus designs, the core must route at Layer 3 to avoid STP convergence delays and support ECMP load balancing.

How to eliminate wrong answers

Option A is wrong because using a single distribution switch creates a single point of failure, violating high-availability requirements for the core layer. Option C is wrong because the core layer should route traffic at Layer 3 to enable fast convergence and load balancing; restricting it to Layer 2 switching forces STP dependency and suboptimal path utilization. Option D is wrong because PortFast is an access-layer feature designed to bypass STP listening/learning on end-host ports; applying it to core switch ports (which connect to other switches) would risk bridging loops and network instability.

Full explanation →
1615
MCQhard

A network engineer checks the AAA server status: R1# show aaa servers RADIUS: id 1, priority 1, host 10.1.1.10, auth-port 1812, acct-port 1813 State: current DEAD, duration 0s, previous duration 500s Dead: total 1, retransmit 3 RADIUS: id 2, priority 2, host 10.1.1.20, auth-port 1812, acct-port 1813 State: current UP, duration 200s, previous duration 0s Dead: total 0, retransmit 0 Based on this output, what can be concluded?

A.Both RADIUS servers are operational.
B.The backup server is currently handling authentication.
C.The primary server has never failed before.
D.TACACS+ is also configured on these servers.
AnswerB

The primary is dead, so the backup (UP) is being used.

Why this answer

The output shows that the primary RADIUS server (10.1.1.10) is in a DEAD state, while the backup server (10.1.1.20) is UP and has been handling authentication for 200 seconds. This confirms that the backup server is currently processing AAA requests, making option B correct.

Exam trap

Cisco often tests the misinterpretation of 'Dead: total 1' as meaning the server is currently dead for the first time, when in fact it indicates the cumulative number of times the server has transitioned to a dead state, not the current status.

How to eliminate wrong answers

Option A is wrong because the primary server (10.1.1.10) is DEAD, so not both servers are operational. Option C is wrong because the 'Dead: total 1' counter indicates the primary server has failed at least once before, contradicting 'never failed'. Option D is wrong because the output only shows RADIUS server details; there is no evidence of TACACS+ configuration on these servers, and the command 'show aaa servers' does not display TACACS+ status unless TACACS+ servers are explicitly configured.

Full explanation →
1616
MCQmedium

A network engineer runs the following command on Switch SW1: SW1# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Based on this output, what can be concluded?

A.The local switch is the root bridge for VLAN 10
B.The local switch is not the root bridge for VLAN 10
C.Interface Gi0/2 is in a forwarding state
D.The spanning-tree mode is Rapid PVST+
AnswerB

The root ID shows a different MAC address than the bridge ID of the local switch, indicating the local switch is not the root.

Why this answer

The output shows that the local switch (Bridge ID 0011.2233.4466) has a Root ID of 0011.2233.4455, which is different from its own Bridge ID. Additionally, the Root Cost is 19, and the Root Port is Gi0/1. This confirms that the local switch is not the root bridge for VLAN 10; it is a non-root switch with a root port in the forwarding state.

Exam trap

Cisco often tests the distinction between the Root ID and Bridge ID in 'show spanning-tree' output, where candidates mistakenly assume the local switch is the root if they see a priority value without checking the MAC address.

How to eliminate wrong answers

Option A is wrong because the local switch's Bridge ID (0011.2233.4466) does not match the Root ID (0011.2233.4455), so it is not the root bridge. Option C is wrong because the Role column shows Gi0/2 as 'Altn' (Alternate) and the Status as 'BLK' (Blocking), not forwarding. Option D is wrong because the output shows 'Spanning tree enabled protocol ieee', which indicates IEEE 802.1D (classic STP), not Rapid PVST+ (which would show 'protocol ieee' with 'Rapid' or 'PVST' in the mode line).

Full explanation →
1617
MCQmedium

A network architect is designing QoS for a Cisco SD-WAN deployment that uses a mix of MPLS and broadband Internet transports. The design must ensure that interactive video traffic is not delayed by large file transfers, even when the Internet link experiences congestion. Which SD-WAN policy type should the architect use to enforce this behavior?

A.Configure a localized QoS policy on the WAN edge routers that matches video traffic and applies a priority queue.
B.Use a centralized data policy to steer video traffic to the MPLS link only.
C.Implement a centralized application-aware routing policy to prefer the MPLS link for video.
D.Configure a VPN membership policy to isolate video traffic in a separate VPN.
AnswerA

Localized policies are applied per device and can prioritize video over bulk traffic on each link.

Why this answer

A localized QoS policy on the WAN edge router can classify interactive video traffic and place it into a priority queue, ensuring low-latency treatment even when the Internet link is congested. This policy operates locally on the router, directly controlling queuing and scheduling behavior on the specific interface, which is essential for protecting real-time traffic from bulk file transfers.

Exam trap

Cisco often tests the distinction between traffic-steering policies (centralized data or app-aware routing) and local queuing mechanisms (QoS policies), leading candidates to mistakenly choose a path-selection solution when the question explicitly asks about preventing delay on a congested link.

How to eliminate wrong answers

Option B is wrong because a centralized data policy steers traffic based on routing decisions but does not provide per-hop queuing or congestion management; it cannot guarantee that video traffic is not delayed by file transfers on the same link. Option C is wrong because an application-aware routing policy selects the best path (e.g., MPLS) but does not enforce local queuing behavior; if the Internet link is the only available path or is chosen, video traffic can still be delayed without a priority queue. Option D is wrong because a VPN membership policy isolates traffic into separate logical networks but does not affect queuing or scheduling on the physical interface; congestion on the Internet link would still affect all traffic in that VPN.

Full explanation →
1618
MCQmedium

Consider the following EIGRP configuration: router eigrp 100 metric weights 0 1 0 1 0 0 What does this configuration accomplish?

A.It sets the EIGRP metric to use bandwidth and delay only, which is the default behavior.
B.It disables the use of bandwidth in the metric calculation.
C.It enables the use of load and reliability in the metric calculation.
D.It changes the metric to use only delay.
AnswerA

Correct. The default K values are k1=1, k2=0, k3=1, k4=0, k5=0, so this command explicitly sets them to the default.

Why this answer

The `metric weights` command in EIGRP allows you to modify the K values used in the composite metric calculation. The default K values are K1=1, K2=0, K3=1, K4=0, K5=0, which means only bandwidth (K1) and delay (K3) are used. The configuration `metric weights 0 1 0 1 0 0` explicitly sets K1=1, K2=0, K3=1, K4=0, K5=0, which matches the default behavior.

Therefore, option A is correct.

Exam trap

Cisco often tests the misconception that the `metric weights` command changes the metric calculation from the default, when in fact the given values exactly match the default K values (1,0,1,0,0).

How to eliminate wrong answers

Option B is wrong because the configuration sets K1=1, which enables the use of bandwidth in the metric calculation, not disables it. Option C is wrong because the configuration sets K2=0 and K4=0, which disables load and reliability, respectively; enabling them would require K2=1 and K4=1. Option D is wrong because the configuration sets K1=1, so bandwidth is still included; to use only delay, you would need K1=0 and K3=1.

Full explanation →
1619
Drag & Dropmedium

Drag and drop the steps of LACP EtherChannel negotiation and bundle formation into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

LACP first exchanges system priority to determine which side is active, then exchanges port priorities to select which ports bundle, next negotiates the operational key, then forms the bundle by synchronizing parameters, and finally the port channel interface becomes operational. This order follows the LACP state machine as defined in IEEE 802.3ad.

Full explanation →
1620
MCQhard

A company is deploying Cisco CSR1000v virtual routers in a KVM environment. The architect needs to ensure high availability by allowing VMs to move between physical hosts without service interruption. Which feature must be supported by the hypervisor and storage?

A.Live migration with shared storage (e.g., NFS or iSCSI).
B.Cold migration with local storage only.
C.Storage vMotion without shared storage.
D.Using a distributed virtual switch without shared storage.
AnswerA

This allows the VM to move while preserving memory state and disk access.

Why this answer

Live migration (also known as VM migration) allows a running virtual machine to move between physical hosts with zero downtime. For this to work in a KVM environment with Cisco CSR1000v routers, the hypervisor must support live migration, and the storage must be shared (e.g., NFS or iSCSI) so that the VM's disk image remains accessible from both source and destination hosts. Without shared storage, the VM's disk state cannot be preserved during migration, causing service interruption.

Exam trap

Cisco often tests the distinction between live migration (requires shared storage) and vMotion/Storage vMotion (VMware-specific terms), leading candidates to confuse cross-hypervisor features or assume distributed virtual switches solve storage issues.

How to eliminate wrong answers

Option B is wrong because cold migration requires the VM to be powered off, which causes service interruption, contradicting the requirement for high availability without service interruption. Option C is wrong because Storage vMotion is a VMware-specific feature that allows migration without shared storage, but the question specifies a KVM environment, and even in VMware, it requires shared storage for live migration; without shared storage, the VM's disk must be copied, causing downtime. Option D is wrong because a distributed virtual switch (DVS) is a networking abstraction that does not address storage requirements; without shared storage, the VM's disk is inaccessible on the destination host, preventing live migration.

Full explanation →
1621
Drag & Dropmedium

Drag and drop the steps of telemetry path validation using YANG DevKit into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Validation starts by loading the YANG model, parsing the path, checking it against the schema, testing it on a device, and then confirming the output.

Full explanation →
1622
Matchingeasy

Drag and drop each VNF category on the left to its matching example on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Cisco CSR 1000v

Cisco ASAv

Citrix ADC VPX

Cisco vWAAS

Cisco Nexus 1000V

Why these pairings

Virtual routers, firewalls, and load balancers are common VNF categories.

Full explanation →
1623
Drag & Dropmedium

Drag and drop the steps of a RESTCONF PUT transaction on IOS-XE into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order ensures the RESTCONF PUT request is properly authenticated, targeted, and validated before the device applies the configuration. First, the client must authenticate with the device. Then it constructs the PUT request with the target URI.

The device validates the request, applies the configuration, and finally sends a success response.

Full explanation →
1624
Drag & Dropmedium

Drag and drop the steps of DMVPN Phase 2 NHRP resolution process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In DMVPN Phase 2, the spoke sends an NHRP Resolution Request to the hub to learn the destination spoke's NBMA address. The hub forwards the request to the destination spoke, which replies with an NHRP Resolution Reply. The hub relays this reply back to the originating spoke.

Finally, the originating spoke installs the NHRP shortcut entry and can initiate a direct tunnel to the destination spoke.

Full explanation →
1625
Matchingmedium

Drag and drop each EIGRP DUAL state on the left to its matching stage on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Route is stable and no queries are pending

Router is querying neighbors for a new route

Router uses a feasible successor without querying

Router queries all neighbors for a new route

Router that first sends a query for a lost route

Why these pairings

Passive state indicates a stable route; Active state indicates the router is querying neighbors; Local Computation occurs when a feasible successor exists; Diffusing Computation occurs when no feasible successor exists; Query Origin is the router that starts the query process.

Full explanation →
1626
Multi-Selectmedium

Which two statements about Cisco FlexConnect are true? (Choose two.)

Select 2 answers
A.FlexConnect APs can locally switch client data traffic at the remote site without tunneling it to the WLC.
B.FlexConnect APs always maintain a control and data tunnel to the WLC, even in standalone mode.
C.FlexConnect supports all encryption methods including CCKM and 802.11r in local switching mode.
D.FlexConnect APs can perform rogue detection and containment even when disconnected from the WLC.
E.FlexConnect APs can authenticate clients locally using a local RADIUS server or a local user database when the WLC is unreachable.
AnswersA, E

Correct because FlexConnect local switching mode allows client traffic to be bridged locally at the AP, reducing WAN bandwidth usage.

Why this answer

FlexConnect allows APs to locally switch client traffic and to function independently when the WLC is unreachable, but it does not support all encryption methods (e.g., CCKM is not supported in FlexConnect local switching mode) and it does not support rogue detection in standalone mode.

Full explanation →
1627
MCQhard

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

A.The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.
B.The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.
C.The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.
D.The WLC is not configured with a valid management interface IP address to reach the RADIUS server.
AnswerA

Correct because the WLC typically expects RADIUS responses to come from the same IP address as the configured server; if the server uses a different source IP (e.g., a loopback or secondary IP), the WLC may not recognize the response and logs 'server not responding'.

Why this answer

The RADIUS server is receiving authentication requests and sending 'Access-Reject' responses, but the WLC logs show 'RADIUS server not responding'. This indicates the WLC is not receiving the responses. The most likely cause is a source IP mismatch: the RADIUS server sends responses from a different IP address than the one configured on the WLC.

The WLC drops these responses because they do not match the expected source IP, making it appear as if the server is not responding.

Exam trap

Cisco often tests the subtle difference between a server rejecting requests (wrong secret) versus the client not receiving responses (source IP mismatch), tempting candidates to choose the shared secret option when the logs clearly show the server is processing requests.

How to eliminate wrong answers

Option B is wrong because RADIUS officially uses UDP port 1812 for authentication per RFC 2865; port 1645 is legacy and not the standard. Option C is wrong because if the shared secret were incorrect, the RADIUS server would silently drop the request or send an 'Access-Reject' only after failing to decrypt the packet, but the server logs show it is receiving and processing requests, which requires a matching secret. Option D is wrong because the WLC is successfully sending authentication requests to the RADIUS server (as confirmed by server logs), proving the management interface IP is valid and reachable.

Full explanation →
1628
MCQmedium

An engineer is deploying a Linux virtual machine on a KVM hypervisor. The VM needs to be connected to a virtual network that provides isolation from other VMs on the same host but allows communication with the host and external networks. The engineer creates a Linux bridge and attaches the VM's tap interface to it. However, the VM cannot reach the external network. The host has a physical NIC (eth0) connected to the corporate network. What is the missing configuration step?

A.Add the physical NIC (eth0) as a port to the Linux bridge.
B.Configure a default gateway on the VM's network interface.
C.Assign an IP address to the Linux bridge interface.
D.Enable IP forwarding and configure NAT on the host.
AnswerA

Correct because the bridge must include the physical NIC to forward traffic to the external network.

Why this answer

A Linux bridge acts like a virtual switch. To allow the VM to reach the external network, the physical NIC (eth0) must be added as a port to the bridge. This bridges the VM's tap interface with the host's physical network, enabling Layer 2 connectivity to the corporate network and upstream routing.

Exam trap

The trap here is that candidates confuse bridging with NAT or routing, assuming that IP forwarding or NAT is required for external access, when in fact a bridged setup simply needs the physical NIC as a bridge port to extend Layer 2 connectivity.

How to eliminate wrong answers

Option B is wrong because a default gateway on the VM is necessary for routing beyond the local subnet, but it is not the missing step—the VM cannot even reach the host or external network without the bridge being connected to the physical NIC. Option C is wrong because assigning an IP to the bridge interface is required for the host to communicate on the bridged network, but the VM's inability to reach the external network is due to the lack of physical connectivity, not the bridge's IP. Option D is wrong because enabling IP forwarding and NAT is only needed if the host is acting as a router for the VM (e.g., in a routed or NAT-based setup), but the scenario describes a bridged network where the VM should be on the same Layer 2 segment as the host's physical network, not NAT'd.

Full explanation →
1629
Drag & Dropmedium

Drag and drop the steps of ISE RADIUS policy evaluation order into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Cisco ISE evaluates RADIUS policies in a specific order: first authentication policies, then authorization policies (based on conditions), and finally the default rule if no match is found. This ensures proper access control.

Full explanation →
1630
Multi-Selecteasy

Which three statements about NFV use cases and deployment models are true? (Choose three.)

Select 3 answers
A.Virtual CPE (vCPE) is a common NFV use case that replaces physical routers and firewalls at customer sites with software-based functions.
B.Virtual Evolved Packet Core (vEPC) virtualizes mobile core network functions such as MME, SGW, and PGW.
C.NFV can be deployed on-premises, in a private cloud, or in a public cloud infrastructure.
D.NFV requires dedicated hardware appliances for each virtualized network function.
E.NFV deployments are limited to static, non-scalable configurations.
AnswersA, B, C

Correct because vCPE is a well-known NFV application where network functions like routing and firewall run as VNFs on standard hardware at the customer premises or in the cloud.

Why this answer

NFV is used to virtualize various network functions. Virtual CPE (vCPE) replaces physical customer premises equipment with software running on standard hardware. Virtual Evolved Packet Core (vEPC) is a key use case in mobile networks.

NFV can be deployed on-premises or in the cloud. Option A is correct because vCPE is a common NFV use case. Option B is correct because vEPC virtualizes mobile core functions.

Option C is correct because NFV supports both on-prem and cloud deployment. Option D is incorrect because NFV does not require dedicated hardware; it uses standard servers. Option E is incorrect because NFV can scale dynamically, not just statically.

Full explanation →
1631
MCQhard

An engineer is configuring BGP on a router that will act as a route reflector to reduce iBGP peering requirements. The router has several iBGP peers. The engineer wants to ensure that the route reflector does not modify the next-hop attribute of routes it reflects to its clients. Which configuration command should the engineer use?

A.Configure 'neighbor next-hop-unchanged' under the BGP address family for the route reflector clients.
B.Configure 'no bgp next-hop-self' under the BGP address family for the route reflector clients.
C.Configure 'bgp route-reflector' under the BGP address family.
D.Configure 'neighbor next-hop-self' on the route reflector for its clients.
AnswerA

Correct because this command explicitly instructs the router to not modify the next-hop attribute when sending routes to the specified neighbor, preserving the original next-hop.

Why this answer

The 'neighbor next-hop-unchanged' command under the BGP address family instructs the route reflector to preserve the original next-hop attribute when reflecting routes to its clients. By default, a route reflector may modify the next-hop to its own address, but this command overrides that behavior, ensuring the next-hop remains as received from the non-client iBGP peer. This is essential in designs where clients must see the original next-hop for optimal path selection or to avoid unnecessary routing hops.

Exam trap

Cisco often tests the distinction between 'neighbor next-hop-unchanged' and 'neighbor next-hop-self', where candidates mistakenly think that disabling 'next-hop-self' (option B) is sufficient to preserve the next-hop, but the correct command is the explicit 'next-hop-unchanged' to override any default or configured modifications.

How to eliminate wrong answers

Option B is wrong because 'no bgp next-hop-self' removes the default next-hop-self behavior for eBGP-learned routes, but it does not specifically control the next-hop attribute for routes reflected by a route reflector; it is a global or address-family command that affects all iBGP peers, not just clients. Option C is wrong because 'bgp route-reflector' is not a valid Cisco IOS command; the correct command to enable route reflection is 'neighbor route-reflector-client' under the BGP address family. Option D is wrong because 'neighbor next-hop-self' on the route reflector for its clients would force the next-hop to be changed to the route reflector's own IP address, which is the opposite of what the engineer wants (to leave the next-hop unchanged).

Full explanation →
1632
MCQhard

A network engineer runs the following command on Switch SW9: SW9# show etherchannel 4 port-channel Port-channels in the group: --------------------------- Port-channel: Po4 (Primary Aggregator) Age of the Port-channel = 0d:00h:20m:10s Logical slot/port = 16/4 Number of ports = 3 HotStandby port = null Port state = Port-channel Ag-Inuse Protocol = LACP Ports in the Port-channel: Index Load Port EC state No of bits ------+------+------+----------------+---------- 0 00 Gi0/0 Active 4 1 00 Gi0/1 Active 4 2 00 Gi0/2 Standby 4 Time since last port bundled: 0d:00h:15m:00s Gi0/1 Based on this output, what can be concluded?

A.All three ports are actively forwarding traffic in the EtherChannel.
B.Gi0/2 is in standby mode because it is not receiving LACP packets from the neighbor.
C.The EtherChannel has a maximum bundle size of 2, so Gi0/2 is a hot-standby port.
D.The port-channel is not in use because the load is zero.
AnswerC

The standby state indicates that the maximum number of active ports has been reached, and Gi0/2 is ready to replace a failed port.

Why this answer

The output shows three ports in the port-channel, but only two are in the 'Active' state (Gi0/0 and Gi0/1), while Gi0/2 is in 'Standby' state. This indicates that the EtherChannel has a maximum bundle size of 2, likely configured with the 'lacp max-bundle 2' command, which limits the number of active ports to two, making Gi0/2 a hot-standby port that will become active only if one of the active ports fails.

Exam trap

The trap here is that candidates often misinterpret the 'Standby' state as a failure or misconfiguration (like not receiving LACP packets), rather than recognizing it as a deliberate feature of LACP's max-bundle configuration.

How to eliminate wrong answers

Option A is wrong because Gi0/2 is in 'Standby' state, not 'Active', so it is not forwarding traffic; only two ports are actively forwarding. Option B is wrong because standby mode in LACP is not due to a failure to receive LACP packets—if Gi0/2 were not receiving LACP packets, it would be in a 'Down' or 'Suspended' state, not 'Standby'; standby is a deliberate configuration for redundancy. Option D is wrong because the load value of '00' in the output is a placeholder for load balancing information and does not indicate that the port-channel is not in use; the port-channel is 'Ag-Inuse' (Aggregator In Use), meaning it is actively forwarding traffic on the active ports.

Full explanation →
1633
Multi-Selecthard

Which three statements about error handling and debugging in Python network automation scripts are true? (Choose three.)

Select 3 answers
A.Using 'pass' in an except block is a best practice to ignore errors in production scripts.
B.The try-except block allows a script to handle connection timeouts without crashing.
C.Using the logging module helps record errors and debug information to a file.
D.Print statements can be used to debug variable values during script development.
E.The continue statement is used to handle exceptions in Python.
AnswersB, C, D

Correct because try-except catches exceptions like timeouts, allowing the script to take alternative actions or retry.

Why this answer

Correct answers: B, C, and D. B is correct because try-except blocks allow the script to handle exceptions gracefully without crashing. C is correct because logging provides a structured way to record events and errors for later analysis.

D is correct because print statements are a simple debugging technique to output variable values during development. A is incorrect because 'pass' is a no-op statement that silently ignores exceptions, which is not recommended for production code. E is incorrect because the continue statement is used in loops to skip to the next iteration, not for error handling.

Full explanation →
1634
Drag & Dropmedium

Drag and drop the steps of the RADIUS authentication process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

RADIUS uses UDP and encrypts only the password in the Access-Request. The server checks credentials and responds with Access-Accept or Access-Reject. Accounting-Start is sent after authentication succeeds.

Full explanation →
1635
Drag & Dropmedium

Drag and drop the steps of EIGRP neighbor establishment into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

EIGRP neighbor formation begins with sending Hello packets, then exchanging full routing tables via Update packets, acknowledging with ACK packets, and finally entering the Established state where incremental updates are sent.

Full explanation →
1636
MCQmedium

A network engineer runs the following command on Switch SW6: SW6# show spanning-tree vlan 60 VLAN0060 Spanning tree enabled protocol ieee Root ID Priority 24636 Address aabb.cc00.0a00 Cost 8 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 (priority 32768 sys-id-ext 60) Address aabb.cc00.0b00 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- ------------------------------ Gi0/1 Root FWD 8 128.1 P2p Gi0/2 Desg FWD 4 128.2 P2p Gi0/3 Altn BLK 4 128.3 P2p Gi0/4 Desg FWD 4 128.4 P2p Based on this output, what is the bridge priority of the root bridge for VLAN 60?

A.24576
B.24636
C.32768
D.32828
AnswerB

Correct. The Root ID priority is 24636.

Why this answer

The root bridge's priority is shown in the 'Root ID' section as 'Priority 24636'. This value includes the system ID extension (VLAN 60), so the actual bridge priority is 24636 - 60 = 24576. However, the question asks for the bridge priority as displayed in the output, which is 24636.

Option B is correct because the output explicitly lists the root bridge priority as 24636.

Exam trap

Cisco often tests whether candidates understand that the 'Priority' field in the 'Root ID' section includes the system ID extension (VLAN ID), so the displayed value is not the base priority but the combined value, leading many to incorrectly subtract the VLAN ID when the question simply asks for the value as shown.

How to eliminate wrong answers

Option A is wrong because 24576 is the base priority (24636 minus the VLAN 60 sys-id-ext), but the question asks for the bridge priority as shown in the output, which includes the system ID extension. Option C is wrong because 32768 is the bridge priority of the local switch (SW6), not the root bridge. Option D is wrong because 32828 is not a valid priority value in this context; it might be a distractor combining the local bridge priority (32768) with the VLAN ID (60) incorrectly.

Full explanation →
1637
Drag & Dropmedium

Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The sFlow agent samples packets, encapsulates them with headers, sends to collector, which decodes and analyzes, and the agent maintains counters for periodic export.

Full explanation →
1638
Matchingmedium

Drag and drop each DNA Center package on the left to its matching function on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Provides network analytics, health scores, and troubleshooting insights

Automates device onboarding, configuration templates, and software image management

Creates hierarchical network designs, sites, and global network settings

Defines and enforces access control, segmentation, and QoS policies

Orchestrates workflows for device replacement and network changes

Why these pairings

Cisco DNA Center packages: Assurance provides analytics and troubleshooting; Provision automates device configuration; Design creates network hierarchy and settings; Policy manages access and segmentation.

Full explanation →
1639
Drag & Dropmedium

Drag and drop the steps of Netmiko multi-threaded device polling workflow into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The workflow begins by importing necessary modules (threading and Netmiko), then defining a function that connects and sends a show command. After that, a list of devices is created, threads are started for each device, and finally all threads are joined to collect results.

Full explanation →
1640
MCQmedium

A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS at 192.168.1.100 with community 'monitor'. The engineer also configures 'snmp-server enable traps snmp linkdown linkup'. The NMS receives link traps but not authentication failure traps. The engineer has not configured any access control. What is the most likely reason?

A.Authentication failure traps are disabled by default and must be explicitly enabled.
B.The NMS is not configured to receive authentication failure traps.
C.The community string 'monitor' has read-write access, which suppresses authentication traps.
D.The switch must be configured with 'snmp-server trap-source' to send authentication traps.
AnswerA

Correct because 'snmp-server enable traps snmp authentication' is needed to send authentication failure traps.

Why this answer

On Cisco IOS, authentication failure traps are not enabled by default even when 'snmp-server enable traps snmp' is configured. The engineer explicitly enabled 'linkdown' and 'linkup' traps, but authentication failure traps require the additional keyword 'authentication' in the 'snmp-server enable traps snmp' command. Without this, the switch will not generate SNMP authenticationFailure notifications (RFC 1157) when an SNMP request uses an invalid community string.

Exam trap

Cisco often tests the fact that authentication failure traps are a separate sub-option under 'snmp-server enable traps snmp' and are not enabled by default, leading candidates to assume that enabling 'snmp-server enable traps snmp' covers all SNMP-related traps.

How to eliminate wrong answers

Option B is wrong because the NMS receiving traps is a receiver-side configuration; the issue is that the switch is not generating the authentication failure traps at all, regardless of NMS configuration. Option C is wrong because the community string 'monitor' with read-write access does not suppress authentication traps; authentication failure traps are triggered by invalid community strings, not by the access level of a valid community. Option D is wrong because 'snmp-server trap-source' specifies the source interface for all traps, but it does not enable or disable specific trap types; authentication failure traps are still subject to the explicit enable requirement.

Full explanation →
1641
Multi-Selectmedium

Which two statements about SNMP MIB objects and OIDs are true? (Choose two.)

Select 2 answers
A.The MIB defines the structure of managed objects and their OIDs.
B.OIDs are always numeric and follow a hierarchical tree structure.
C.The GetBulk operation is supported in SNMPv1.
D.The sysDescr OID (1.3.6.1.2.1.1.1.0) is a read-write object.
E.A single MIB object can have multiple OIDs.
AnswersA, B

Correct: The MIB is a database that defines the structure and OIDs of managed objects.

Why this answer

MIB (Management Information Base) is a hierarchical database of managed objects. Each object is identified by an OID (Object Identifier). OIDs are structured as a tree; for example, 1.3.6.1.2.1.1.1.0 is the sysDescr OID.

The MIB defines the structure and allowed operations (get, set, etc.) for each object. SNMPv2c and SNMPv3 support GetBulk, which retrieves large tables efficiently. SNMPv1 does not support GetBulk.

Full explanation →
1642
MCQhard

A financial company runs a critical trading application in a virtualized environment on VMware vSphere. The application consists of two VMs: App-1 (web server) and App-2 (database server). Both VMs are on the same ESXi host. Recently, users report intermittent slowness during peak trading hours. Monitoring shows that App-1 experiences high CPU ready time (up to 15%) and App-2 has high disk latency (average 50 ms). The ESXi host has 16 vCPUs total (2 sockets, 8 cores each) and 128 GB RAM. The host runs 10 VMs total. App-1 has 4 vCPUs and 16 GB RAM; App-2 has 8 vCPUs and 32 GB RAM. The storage is a shared NFS datastore connected via 1 Gbps Ethernet. The network is 10 Gbps. What is the MOST effective course of action to resolve the performance issues?

A.Enable vNUMA for both VMs to improve memory access, and set CPU affinity to dedicate specific cores.
B.Increase the RAM for both VMs to reduce disk swapping, and enable Hyperthreading on the ESXi host.
C.Reduce the number of vCPUs assigned to App-2 from 8 to 4, and configure Storage I/O Control on the datastore.
D.Migrate the VMs to another ESXi host with faster CPUs, and upgrade the storage network to 10 Gbps.
AnswerC

Correct. Reducing vCPUs decreases CPU ready time; Storage I/O Control manages disk latency.

Why this answer

App-2's 8 vCPUs exceed the number of physical cores per socket (8), causing CPU scheduling contention and high ready time on App-1, while reducing vCPUs to 4 aligns with the host's core-per-socket count and reduces co-scheduling overhead. Additionally, Storage I/O Control (SIOC) on the NFS datastore can prioritize disk access and mitigate the high disk latency (50 ms) by enforcing shares and limits during congestion, addressing both performance issues without requiring hardware upgrades.

Exam trap

Cisco often tests the misconception that adding more vCPUs always improves performance, but the trap here is that over-provisioning vCPUs beyond the physical core count per socket increases CPU ready time and co-scheduling overhead, degrading performance instead of improving it.

How to eliminate wrong answers

Option A is wrong because enabling vNUMA is beneficial for VMs with many vCPUs to optimize memory locality, but it does not address CPU ready time caused by over-provisioning vCPUs, and setting CPU affinity can reduce scheduler flexibility and cause imbalance on a host with 10 VMs. Option B is wrong because increasing RAM does not reduce disk swapping if the VMs already have sufficient memory (App-1 has 16 GB, App-2 has 32 GB), and enabling Hyperthreading on the ESXi host would increase logical CPUs but not resolve the root cause of vCPU over-provisioning or high disk latency. Option D is wrong because migrating to another host with faster CPUs does not fix the vCPU over-provisioning issue (App-2 still has 8 vCPUs), and upgrading the storage network to 10 Gbps does not address the high disk latency if the bottleneck is at the NFS datastore or storage array, not the network link.

Full explanation →
1643
Matchingmedium

Drag and drop each telemetry model on the left to its matching push type (dial-in or dial-out) on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Collector connects to device, device listens

Collector initiates SSH session to device

Device connects to collector, collector listens

Device pushes data to collector

Collector requests data from device

Why these pairings

Dial-in: collector initiates connection to the network device (e.g., gRPC dial-in, NETCONF). Dial-out: device initiates connection to the collector (e.g., gRPC dial-out, model-driven telemetry).

Full explanation →
1644
Drag & Dropmedium

Drag and drop the steps of PIM-SM join and source registration into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

In PIM-SM, a receiver's DR sends a (*,G) Join toward the RP. The RP then sends a (S,G) Join toward the source. The source's DR registers the source with the RP via a unicast Register message.

The RP de-encapsulates the Register and sends a Register-Stop back to the source's DR to stop the registration process.

Full explanation →
1645
Multi-Selectmedium

Which two statements about telemetry subscription modes are true? (Choose two.)

Select 2 answers
A.In dial-out mode, the network device initiates a connection to the telemetry collector.
B.In dial-in mode, the collector subscribes to data by connecting to the network device.
C.gRPC supports only dial-out telemetry subscriptions.
D.NETCONF is exclusively used for dial-in telemetry subscriptions.
E.SNMP traps are a form of dial-out telemetry.
AnswersA, B

Correct because dial-out telemetry pushes data from the device to the collector.

Why this answer

Dial-out mode pushes data from the network device to a collector, while dial-in mode requires the collector to initiate the connection. gRPC supports both modes. NETCONF can also support both but is not limited to dial-in. SNMP is a polling-based protocol, not a telemetry subscription mode.

Full explanation →
1646
Drag & Dropmedium

Drag and drop the steps of DNA Center assurance issue detection and root cause into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with collecting telemetry from devices, then analyzing the data to detect anomalies, then generating an issue, then identifying the root cause via guided remediation, and finally presenting the resolution steps. This aligns with Cisco's assurance workflow.

Full explanation →
1647
Multi-Selectmedium

Which three statements about RSPAN configuration and behavior are true? (Choose three.)

Select 3 answers
A.The RSPAN VLAN must be created on all switches that participate in the RSPAN session.
B.The RSPAN destination port must be configured in access mode and assigned to the RSPAN VLAN.
C.Trunk ports between switches must allow the RSPAN VLAN and should not prune it.
D.The RSPAN source switch encapsulates the mirrored frames with the RSPAN VLAN ID.
E.RSPAN can only monitor source ports on the same switch as the destination port.
AnswersA, C, D

Correct because every switch in the path needs the RSPAN VLAN to forward the mirrored traffic.

Why this answer

RSPAN requires a dedicated VLAN that is not used for user traffic. The RSPAN VLAN must be created on all switches in the path, and the destination switch must have a destination port configured. The RSPAN VLAN should not be pruned from trunks.

The source switch sends mirrored frames into the RSPAN VLAN, and the destination switch extracts them.

Full explanation →
1648
Drag & Dropmedium

Drag and drop the steps of BFD session establishment for path liveliness into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

BFD session establishment starts with the edge device detecting a new transport tunnel, then sending a BFD hello packet, the remote device responds with a BFD echo, the two devices negotiate parameters, and finally the session becomes Up and is used for liveliness monitoring.

Full explanation →
1649
MCQeasy

What is the purpose of the 'aaa authorization exec default local' command?

A.It authenticates users for exec access using the local database.
B.It authorizes exec sessions using the local database, determining if a user can start a shell and their privilege level.
C.It enables accounting for exec commands to the local database.
D.It sets the privilege level for all users to 15.
AnswerB

Correct. Authorization controls what a user is allowed to do after authentication.

Why this answer

The 'aaa authorization exec default local' command is used to authorize EXEC sessions (user shell access) by checking the local database on the device. It determines whether a user is permitted to start a shell and what privilege level they should receive, based on the local user account configuration. This is distinct from authentication, which verifies identity, and accounting, which logs actions.

Exam trap

Cisco often tests the distinction between authentication, authorization, and accounting; the trap here is confusing 'authorization' with 'authentication', leading candidates to pick Option A because they think the command is about verifying who the user is, rather than what they are allowed to do.

How to eliminate wrong answers

Option A is wrong because it describes authentication (verifying user identity), not authorization (determining allowed actions and privilege level); the command uses 'authorization', not 'authentication'. Option C is wrong because it refers to accounting (logging commands), which is configured with 'aaa accounting exec' commands, not authorization. Option D is wrong because the command does not set a privilege level of 15 for all users; it authorizes based on the local database, where privilege levels are defined per user account (e.g., via 'username privilege 15').

Full explanation →
1650
MCQhard

A network engineer runs the following command on Router R2: R2# show class-map Class Map match-any VOICE (id 1) Match ip dscp ef (46) Class Map match-any DATA (id 2) Match ip dscp af31 (26) Class Map match-any class-default (id 0) Match any R2# show policy-map Policy Map QOS_POLICY Class VOICE priority level 1 police cir 1000000 bc 15625 be 15625 Class DATA bandwidth remaining percent 50 Class class-default bandwidth remaining percent 50 R2# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 (0 kbps) Class-map: class-default (match-any) 100 packets, 10000 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 bandwidth remaining percent 50 (0 kbps) Based on this output, what can be concluded?

A.Voice traffic is being prioritized with strict priority queuing and policed at 1 Mbps.
B.Data traffic is being guaranteed 50% of the remaining bandwidth.
C.All traffic is being handled by class-default, which gets 100% of the bandwidth.
D.The police command on VOICE is causing drops for voice traffic.
AnswerC

Only class-default has traffic (100 packets), and since it is the only class with traffic, it uses all bandwidth.

Why this answer

The output shows that only class-default has processed any packets (100 packets, 10000 bytes), while the VOICE and DATA classes have zero packets. This indicates that no traffic matching DSCP EF or AF31 has been offered, so all traffic falls into class-default, which is allocated 50% of the remaining bandwidth. However, since the VOICE class is empty, the priority queue is unused, and class-default effectively receives all available bandwidth.

Exam trap

Cisco often tests the misconception that simply configuring a QoS policy means it is actively shaping or prioritizing traffic, but the key is to check the actual packet counters to see which classes are receiving traffic.

How to eliminate wrong answers

Option A is wrong because although the VOICE class is configured with strict priority queuing and a police rate of 1 Mbps, the output shows zero packets matched for VOICE, so no voice traffic is being prioritized or policed. Option B is wrong because the DATA class is configured with bandwidth remaining percent 50, but again zero packets have been matched for DATA, so no data traffic is being guaranteed that bandwidth. Option D is wrong because the police command on VOICE is not causing drops for voice traffic; the output shows zero packets in the VOICE class, so no policing actions have been triggered.

Full explanation →
Page 21

Page 22 of 27

Page 23

All pages

123456789101112131415161718192021222324252627

Practice 350-401 by domain

Target a specific domain to shore up weak areas.

ArchitectureVirtualizationInfrastructureNetwork AssuranceSecurityAutomation
See all domains with question counts →

Study 350-401 by topic

Focused topic pages — one weak area at a time.

BGP QuestionsOSPF QuestionsEIGRP QuestionsSD-Access QuestionsSD-WAN QuestionsACLs and CoPP QuestionsQoS QuestionsVPN QuestionsWireless QuestionsAnsible QuestionsPython Automation QuestionsREST API and YANG QuestionsMPLS QuestionsAAA QuestionsSTP QuestionsVLANs and Trunking Questions