350-401 · domain
Network Assurance
Network Assurance is 10% of ENCOR 350-401 and covers the tools Cisco expects you to use to verify a live network rather than configure it. Expect questions on syslog severity levels, SNMPv2c versus SNMPv3, NetFlow and Flexible NetFlow exports, SPAN and RSPAN sessions, IP SLA probes, and DNA Center assurance and device health dashboards.
Focused practice
Practice Network Assurance questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Network Assurance
Configure and verify Cisco IOS tools like SNMPv3, NetFlow, SPAN/RSPAN, and IP SLA probes to monitor live traffic. The critical skill is reading syslog severity levels and IP SLA tracking output correctly.
Configuring syslog logging levels, hosts, and interpreting severity 0-7 messages
Comparing SNMPv2c community strings with SNMPv3 authPriv users and views
Building Flexible NetFlow records, exporters, and monitors for traffic analysis
Configuring local SPAN, RSPAN, and ERSPAN source/destination sessions on switches
Watch out for
Common Network Assurance exam traps
- ▸Confusing syslog severity numbers: lower numbers are more severe, so level 0 is emergencies and level 7 is debugging.
- ▸Assuming SNMPv3 encryption is mandatory; authNoPriv provides authentication but no privacy, unlike authPriv.
- ▸Forgetting that a SPAN destination port stops normal switching and cannot source traffic while monitoring.
Question index
All Network Assurance questions (87)
Click any question to see the full explanation, or start a practice session above.
A network engineer is deploying Cisco SD-Access and needs to ensure that fabric edge nodes can register with the fabric control plane node. Which protocol is used for this registration and for endpoint location mapping?
Medium2A network administrator is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to a SaaS application. The administrator suspects that the issue is related to the application-aware routing policy not correctly identifying the application. Which component of Cisco SD-WAN is responsible for identifying applications in the data plane?
Hard3A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when a switch's health score drops below a threshold. Which Assurance feature should be configured to generate these alerts?
Easy4A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?
Hard5A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?
Hard6A network technician is troubleshooting a switch that is experiencing high CPU utilization. The technician runs the command 'show processes cpu sorted' and notices that the process 'ARP Input' is consuming a large percentage of CPU. Which action should the technician take to mitigate this issue?
Easy7A network administrator is analyzing syslog messages from a Cisco Catalyst switch and notices the message %SW_MATM-4-MACFLAP_NOTIF: Host 0000.1111.2222 in vlan 10 is flapping between port Gi1/0/1 and port Gi1/0/2. What is the most likely cause of this message?
Medium8A network administrator is troubleshooting a network performance issue and suspects a duplex mismatch on a switch port. Which command should be used to verify the duplex settings on a Cisco switch interface?
Medium9Refer to the exhibit. Which OSPF route type is the default route?
Medium10A network engineer is implementing QoS on a WAN link to prioritize voice traffic. Which queuing mechanism provides the lowest latency for real-time traffic?
Easy11A network engineer is troubleshooting a Cisco SD-WAN deployment where some branches experience intermittent packet loss. The engineer suspects that the issue is related to the control plane connections between vEdge routers and the vSmart controller. Which command should be used on a vEdge router to verify the status of the control connections?
Hard12A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?
Medium13Refer to the exhibit. An administrator needs to ensure that traffic to 192.168.1.0/24 is forwarded via a different path than traffic to 192.168.2.0/24, even though both routes are learned via OSPF with the same metric. Which action should the administrator take?
Easy14A network engineer is troubleshooting a Connectivity issue between two data center switches. The engineer suspects a physical layer problem and wants to verify the cable and interface status. Which command should be used to check the status of all interfaces, including the link state and speed?
Easy15A network administrator is using the Cisco DNA Center Assurance application to troubleshoot a user's slow wireless experience. The administrator notices that the client's onboarding time is high and wants to see a detailed timeline of the client's onboarding process, including association, authentication, and DHCP phases. Which Cisco DNA Center Assurance feature provides this information?
Medium16A network engineer is troubleshooting intermittent packet loss on a WAN circuit connecting a branch office to headquarters. The engineer suspects the provider is not honoring the committed rate. Which tool should be used to measure one-way delay, jitter, and packet loss between the two sites and generate threshold-based alerts?
Medium17A network administrator is troubleshooting a network issue using Cisco DNA Center Assurance. The administrator wants to identify which network devices are experiencing the highest number of errors, such as CRC errors and interface flaps. Which Assurance dashboard should the administrator use?
Medium18A network engineer is troubleshooting a Cisco Catalyst 9300 switch that is experiencing intermittent packet drops. The engineer suspects a hardware forwarding issue and needs to verify the status of the switch's forwarding ASIC and its associated resources. Which command should the engineer use to display the current ASIC and forwarding resource utilization?
Medium19A network administrator is using Cisco DNA Center to monitor the health of network devices. The administrator wants to see a summary of the overall network health and any issues that need attention. Which Cisco DNA Center feature provides this information?
Easy20Which TWO STP features are used to improve convergence time after a topology change?
Medium21A network engineer is using Cisco DNA Center Assurance to monitor the health of a wireless network. The engineer notices that a particular access point is reporting a high number of client disconnects. Which feature in DNA Center Assurance would best help identify the root cause of these disconnects?
Medium22A network administrator is examining the output of the show interfaces command on a switch and notices a high number of CRC errors on a Gigabit Ethernet port. What is the most likely cause of these errors?
Easy23A network administrator is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The administrator wants to identify whether the issue is related to the network or the application. Which two Assurance features should be used to gather relevant data? (Choose two.)
Hard24A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing intermittent connectivity drops. The administrator wants to view the historical trend of the client's connectivity and identify the root cause. Which Cisco DNA Center Assurance feature should the administrator use?
Hard25A network engineer is troubleshooting a Cisco SD-WAN deployment where a branch site is experiencing intermittent connectivity to the data center. The engineer suspects that the issue is related to the Bidirectional Forwarding Detection (BFD) configuration on the WAN Edge routers. Which Cisco SD-WAN component is responsible for establishing BFD sessions between WAN Edge routers?
Hard26A network engineer is configuring a Switched Port Analyzer (SPAN) session on a Cisco Catalyst switch to capture traffic from a specific VLAN. Which configuration command is required to monitor all traffic on VLAN 10 and send it to a destination port?
Medium27A network engineer has configured a Cisco IOS IP SLA operation with an ICMP echo probe to monitor reachability of a remote branch router. The engineer wants to automatically remove a static route from the routing table when the probe fails. Which feature should be configured to achieve this?
Medium28Which THREE are common causes of high CPU utilization on a Cisco Catalyst switch? (Choose three.)
Hard29A network administrator is configuring a Cisco IOS XE device to send syslog messages to a remote server. The administrator wants to ensure that only messages with severity level 4 and higher (i.e., more severe) are sent. Which command should be used?
Hard30A network administrator is troubleshooting a connectivity issue between two switches connected via a trunk link. The trunk is configured with 802.1Q encapsulation. The administrator suspects that the native VLAN is mismatched. Which command displays the native VLAN configuration on a Cisco Catalyst switch?
Hard31Drag and drop the steps for the DHCP DORA process in the correct order.
Medium32A network engineer is troubleshooting a connectivity issue and wants to verify the path that packets take from a Cisco IOS XE router to a remote destination. Which command provides a hop-by-hop listing of the path, including latency information for each hop?
Easy33A network engineer is configuring a Cisco IOS router to export NetFlow data to a collector. The engineer wants to ensure that only ingress traffic on GigabitEthernet0/0 is monitored and that the NetFlow cache is optimized for high traffic volumes. Which configuration step is required to enable NetFlow on the interface?
Medium34A network administrator is using Cisco DNA Center Assurance to monitor the health of wireless clients. The administrator notices that some clients are experiencing poor performance, but the Assurance dashboard shows them as 'Good'. Which action should the administrator take to troubleshoot the issue?
Hard35A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator wants to receive alerts when the onboarding time for wireless clients exceeds a defined threshold. Which Cisco DNA Center Assurance feature should be configured to accomplish this?
Medium36A network engineer is analyzing network traffic using Cisco IOS Embedded Packet Capture (EPC) on a Cisco ISR router. The engineer wants to capture only TCP packets with a source port of 80 and a destination IP address of 10.1.1.1. Which EPC configuration is required to achieve this?
Hard37Which TWO statements are true about IP SLA? (Choose two.)
Medium38A network engineer is analyzing traffic flows on a Cisco Nexus switch and needs to collect NetFlow data. The engineer wants to export flow records to an external collector at 192.168.100.50 on port 2055. Which configuration step is required to enable NetFlow export?
Hard39A network administrator is troubleshooting high CPU utilization on a Catalyst 9300 switch. The output of 'show processes cpu sorted' shows the 'IP Input' process consuming 45% CPU. Which tool should be used to identify the specific packets causing the issue?
Hard40A network administrator is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The client is associated to a wireless controller but cannot reach the default gateway. The administrator notices that the client's onboarding status shows 'DHCP failed'. Which Assurance feature should the administrator use to trace the client's path and identify where DHCP packets are being dropped?
Hard41A network engineer is using Cisco DNA Center Assurance to monitor and troubleshoot a network. The engineer wants to use the Assurance features to proactively detect issues and receive recommendations. Which two statements are true about Cisco DNA Center Assurance capabilities? (Choose two.)
Medium42A network engineer is deploying Cisco DNA Center Assurance to monitor a campus fabric. The engineer needs to verify that the fabric underlay and overlay health scores are being calculated correctly. Which data source does Cisco DNA Center Assurance primarily use to compute the fabric health score?
Medium43A network engineer is using NetFlow to monitor traffic on a Cisco router. The engineer wants to export NetFlow data to a collector for analysis. Which two commands are required to configure NetFlow export on the router? (Choose two.)
Hard44A network engineer is troubleshooting why a newly added Cisco Catalyst 9300 switch is not appearing in Cisco DNA Center's topology view, even though it is reachable via SSH from the management network. The switch has been configured with the correct SNMP community string. Which protocol must be enabled on the switch for Cisco DNA Center to discover and monitor it?
Medium45A network engineer is troubleshooting why a Cisco Catalyst 9300 switch is not exporting flow data to a NetFlow collector. The engineer verified that the flow record and exporter are correctly configured and that the collector is reachable. Which additional configuration is required on the switch to enable Flexible NetFlow?
Hard46A network engineer has configured an IP SLA operation on a Cisco router to monitor the reachability of a remote server. The engineer wants to ensure that the operation sends ICMP echo requests every 30 seconds and that the router tracks the operation's state to influence a static route. Which command is required to associate the IP SLA operation with the static route?
Medium47Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?
Medium48A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?
Medium49A network engineer is configuring a Cisco Catalyst switch to send flow data to a NetFlow collector for traffic analysis. The engineer wants to ensure that only ingress traffic on a specific interface is exported. Which command is required to enable NetFlow on that interface?
Easy50A network administrator needs to validate that the path taken by packets from a branch router to a remote server matches the expected primary path. The administrator wants to collect per-hop latency and packet loss statistics along that path. Which tool should be used?
Medium51A network administrator is implementing NetFlow on a Cisco IOS XE router to monitor traffic. Which two statements about NetFlow are true? (Choose two.)
Medium52A network administrator is analyzing the output of 'show ip sla statistics' on a Cisco router. Which two statements correctly describe the information provided by this command? (Choose two.)
Hard53A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a specific client device is experiencing poor performance. Which feature in DNA Center Assurance provides a detailed timeline of events, including onboarding, authentication, and application usage for a specific client?
Hard54A network engineer has configured a Cisco IOS IP SLA operation using ICMP echo to monitor reachability to a remote branch router. The engineer wants to correlate the results with syslog messages and SNMP traps to detect when the branch becomes unreachable. Which IP SLA configuration step is required to generate these notifications?
Medium55A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?
Hard56A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that the health score for a particular building has dropped significantly. Which feature of Cisco DNA Center Assurance should the administrator use to identify the root cause of the issue by analyzing network events and device performance metrics over time?
Hard57A network engineer is using Cisco DNA Center Assurance to monitor a network with Cisco SD-Access fabric. The engineer notices that the fabric health score is consistently low, but individual device health scores are high. Which component of the fabric should the engineer investigate first?
Hard58A network engineer is deploying Cisco DNA Center Assurance to monitor a campus network. The engineer wants to leverage machine learning to baseline normal behavior and detect anomalies without manually defining thresholds. Which capability should be enabled?
Medium59A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device is experiencing frequent disconnects. Which Assurance feature should be used to view a chronological list of events related to that specific client, including association, authentication, and roaming events?
Hard60A network administrator is troubleshooting a Cisco Catalyst switch and suspects a Layer 2 loop. The administrator wants to verify the Spanning Tree Protocol (STP) topology and identify the root bridge. Which command should be used?
Easy61A network administrator is using Cisco DNA Center to monitor a campus network. The administrator wants to receive an alert when a switch's CPU utilization exceeds 80% for more than 5 minutes. Which feature should be configured?
Easy62Refer to the exhibit. An engineer notices that interface resets have occurred. What is the most likely cause of the interface resets?
Easy63A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator wants to identify the root cause of poor wireless client experience. Which two actions can be taken within Cisco DNA Center Assurance to troubleshoot this issue? (Choose two.)
Medium64A network engineer is configuring an IP SLA operation to monitor the reachability of a critical server at 10.1.1.1. The engineer wants to generate a syslog message and trigger a track object if the response time exceeds 100 ms. Which IP SLA operation type should be used?
Hard65A network engineer is troubleshooting a connectivity problem between two hosts on the same VLAN. The engineer suspects a duplex mismatch on the switch port. Which command should be used to verify the duplex settings on a Cisco Catalyst switch interface?
Medium66A network engineer is analyzing the output of the show processes cpu sorted command on a Cisco Catalyst 9300 switch and notices that the CPU utilization is consistently high. Which two methods can help identify the cause of high CPU utilization? (Choose two.)
Medium67A network engineer is using Cisco DNA Center Assurance to troubleshoot a wireless client that frequently disconnects. The engineer wants to identify the root cause by examining relevant assurance data. Which two types of information are available in the Client 360 view to help diagnose the issue? (Choose two.)
Hard68A network engineer is deploying Cisco DNA Center Assurance and wants to ensure that the system can accurately monitor and troubleshoot network issues. Which two statements about Cisco DNA Center Assurance are true? (Choose two.)
Hard69A network engineer is deploying IP SLA to monitor network performance. The engineer needs to configure an IP SLA operation that measures jitter and packet loss between two Cisco routers. Which two statements are true about configuring IP SLA for this purpose? (Choose two.)
Medium70A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor performance. The administrator wants to see detailed information about the client's connectivity, including the path taken through the network and any issues encountered. Which Cisco DNA Center Assurance feature should the administrator use?
Hard71A network engineer is troubleshooting a routing loop between two OSPF areas. To verify the path that packets are taking, the engineer decides to use the Cisco IOS Embedded Event Manager (EEM) to generate a syslog message when the OSPF neighbor state changes. Which EEM applet configuration is required to trigger on the OSPF neighbor state change?
Medium72A network engineer is analyzing traffic patterns using Cisco IOS IP Service Level Agreements (IP SLA). The engineer wants to measure the round-trip time (RTT) for HTTP traffic to a web server at 10.1.1.1. Which IP SLA operation type should be configured?
Easy73A network engineer is analyzing the output of 'show ip sla statistics' on a Cisco IOS router. The engineer notices that the SLA operation is returning 'Timeout' for several probes. Which two statements are true about the potential causes of this issue? (Choose two.)
Medium74A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular client device shows a poor health score. Which Cisco DNA Center Assurance feature should the administrator use to determine the root cause of the poor health score?
Hard75A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?
Easy76A network administrator is using Cisco DNA Center Assurance to monitor a campus network. The administrator notices that a particular client device is experiencing poor voice quality. Which Cisco DNA Center Assurance feature should be used to analyze the issue and determine the root cause?
Hard77A network engineer is analyzing traffic flows using Cisco IOS NetFlow on a router. The engineer notices that the NetFlow cache is filling up rapidly, causing older entries to be exported prematurely before they can be properly aggregated. Which NetFlow configuration parameter should the engineer adjust to control the maximum number of entries in the cache?
Hard78A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator notices that a particular client device shows a health score of 'Poor' but the switch port statistics indicate no errors or drops. Which Cisco DNA Center Assurance feature should the administrator use to identify the root cause of the poor health score?
Medium79A network engineer is using Cisco DNA Center's Assurance to troubleshoot a performance issue reported by users on a specific floor. The engineer wants to analyze the path that traffic takes from a client to a server in the data center, including details of each hop such as device, interface, and any ACLs applied. Which Cisco DNA Center Assurance feature provides this information?
Hard80A network administrator is analyzing NetFlow data on a Cisco IOS router to identify top talkers. The administrator notices that a large amount of traffic is being exported but the NetFlow cache is filling up quickly. Which action should the administrator take to reduce the cache size while maintaining visibility into the most significant flows?
Hard81A network administrator is using Cisco DNA Center Assurance to monitor the health of a campus network. The administrator wants to receive alerts when the number of clients on a specific wireless controller exceeds a threshold. Which feature in Cisco DNA Center Assurance should be used to configure this?
Hard82A network engineer needs to verify the performance of a WAN link between two Cisco routers. The engineer configures an IP SLA operation on Router A that sends ICMP echo requests to Router B every 60 seconds and stores the results. After a week, the engineer checks the results and finds that the operation has been running successfully, but no history data is available. What is the most likely reason for the lack of history data?
Medium83A network engineer is using Cisco DNA Center Assurance to troubleshoot a user's poor voice quality. The engineer wants to view detailed hop-by-hop performance metrics for the path between the user's endpoint and the voice gateway over the last 24 hours. Which Assurance feature should the engineer use?
Medium84A network engineer is using Cisco DNA Center Assurance to troubleshoot a client connectivity issue. The engineer notices that the client's health score is low due to onboarding failures. Which component of Cisco DNA Center Assurance should be examined first to identify the root cause?
Hard85A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular access point is reporting a high number of client association failures. Which Cisco DNA Center Assurance feature should be used to correlate these failures with client device types and identify the root cause?
Medium86A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)
Medium87A network administrator is analyzing traffic flows using Cisco DNA Center Assurance. The administrator wants to see which applications are consuming the most bandwidth on a specific interface of a Catalyst 9500 switch. Which feature should be enabled on the switch to provide this level of granularity?
HardOther domains
All 350-401 exam domains
Frequently asked questions
- What does the Network Assurance domain cover on the 350-401 exam?
- Configure and verify Cisco IOS tools like SNMPv3, NetFlow, SPAN/RSPAN, and IP SLA probes to monitor live traffic. The critical skill is reading syslog severity levels and IP SLA tracking output correctly.
- How many questions are in this domain?
- This page lists all 87 Network Assurance questions in the 350-401 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Network Assurance questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.