hardMultiple Select
350-401 Practice Question: Which three statements about IP SLA probe types…
Which three statements about IP SLA probe types and their characteristics are true? (Choose three.)
⚠ Common exam trap
350-401 often tests the specific metrics and responder requirements of IP SLA probe types; candidates may incorrectly assume ICMP echo requires a responder or that HTTP measures DNS resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The UDP jitter operation measures one-way delay, jitter, and packet loss in both directions.
Option A is correct because the UDP jitter operation sends a stream of UDP packets and, with an IP SLA responder on the far end, reports one-way delay (both directions), positive and negative jitter (inter-packet delay variation), and packet loss in each direction. Option B is correct because the ICMP echo operation measures round-trip time by sending ICMP Echo Requests, and the resulting per-probe RTT samples can be used to derive jitter statistics. Option C is correct because the TCP connect operation times how long it takes to complete the TCP three-way handshake (SYN, SYN-ACK, ACK) with a target host and port, which is useful for verifying application reachability. Option D is not correct because DNS resolution timing is provided by the DNS operation, not the HTTP operation, which measures transaction time such as connect, request, and response. Option E is not correct because ICMP echo works without an IP SLA responder on the target; the responder is required for operations like UDP jitter that need timestamping and packet generation support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The UDP jitter operation measures one-way delay, jitter, and packet loss in both directions.
Why this is correct
UDP jitter probes send timestamped packets at scheduled intervals, letting the responder compute per-direction delay, jitter and loss, satisfying the stem's requirement for bidirectional measurement. Unlike ICMP echo, which reports only round-trip statistics, this operation distinguishes each direction's performance.
- ✓
The ICMP echo operation measures round-trip time and can also provide jitter calculations.
Why this is correct
ICMP echo probes measure round-trip time by timestamping request and reply packets, satisfying the stem's requirement for a true characteristic. Jitter derives from consecutive RTT samples, so the operation can report delay variation alongside reachability. This matches IP SLA's ICMP echo behaviour, where per-probe latency and jitter statistics are both collected.
- ✓
The TCP connect operation measures the time to establish a TCP three-way handshake.
Why this is correct
TCP connect probes time the three-way handshake (SYN, SYN-ACK, ACK) to a target port, confirming reachability and reporting round-trip latency for session establishment. This satisfies the stem's requirement for a true characteristic of an IP SLA probe type, distinguishing it from UDP jitter or ICMP echo operations, which measure different metrics.
- ✗
The HTTP operation measures the time to resolve the DNS name of the target web server.
Why it's wrong here
Incorrect because HTTP probes measure the time to retrieve a web page (including TCP connect and HTTP GET), but DNS resolution time is not part of the HTTP probe; it can be measured separately with a DNS probe.
- ✗
The ICMP echo operation requires the IP SLA responder to be enabled on the target device.
Why it's wrong here
ICMP echo probes are generated by the source and answered by the target's IP stack, so no IP SLA responder is needed; only operations such as UDP jitter require a responder. The statement is tempting because responder-enabled operations do demand configuration on the target device.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.