How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Which Command Should the Administrator Use Practice Questions

Q: How many Which Command Should the Administrator Use Practice Questions questions are on this page?

This page has 15 Which Command Should the Administrator Use Practice Questions scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

Practise ENCOR 350-401 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach which command should the administrator use practice questions

Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.

Quick answer

Which Command Should the Administrator Use Practice Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Study the full ACL explanation →

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 4mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 5mediumdrag order

Full question →

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 6hardmultiple choice

Study the full EIGRP explanation →

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Exhibit

Refer to the exhibit.
```
router# show ip route 10.0.0.0
Routing entry for 10.0.0.0/8
  Known via "eigrp 100", distance 170, metric 2560512, type internal
  Redistributing via eigrp 100
  Last update from 192.168.1.1 on GigabitEthernet0/0, 00:00:05 ago
  Routing Descriptor Blocks:
  * 192.168.1.1, from 192.168.1.1, 00:00:05 ago, via GigabitEthernet0/0
      Route metric is 2560512, traffic share count is 1
      Total delay is 2000 microseconds, minimum bandwidth is 10000 Kbit
      Reliability 255/255, minimum MTU 1500 bytes
      Loading 1/255, Hops 3
```

A
Increase the bandwidth on GigabitEthernet0/0.
Why wrong: Incorrect; increasing bandwidth decreases metric.
B
Add a redistribute static command under EIGRP.
Why wrong: Incorrect; redistributing static does not affect this route's metric.
C
Change the administrative distance to 90.
Why wrong: Incorrect; AD does not affect metric.
D
Increase the delay on GigabitEthernet0/0.
Correct.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full VRF explanation →

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Exhibit

Refer to the exhibit.

! Output from 'show vrf' on a router
VRF-Name       Interfaces
Mgmt-intf      Gi0/0/0
CUSTOMER-A     Gi0/1/0, Gi0/1/1.10
CUSTOMER-B     Gi0/2/0, Gi0/2/1.20

! Output from 'show ip interface brief' for Gi0/1/0
Interface      IP-Address      OK? Method Status      Protocol
Gi0/1/0        10.1.1.1        YES manual up          up

! Output from 'show ip interface brief' for Gi0/1/1.10
Interface      IP-Address      OK? Method Status      Protocol
Gi0/1/1.10     10.1.1.2        YES manual up          up

A
Global routing table
Why wrong: Incorrect. The interface Gi0/1/0 is in VRF CUSTOMER-A, so the global routing table is not used.
B
Mgmt-intf
Why wrong: Incorrect. Mgmt-intf VRF is only for interface Gi0/0/0.
C
CUSTOMER-B
Why wrong: Incorrect. CUSTOMER-B VRF includes different interfaces.
D
CUSTOMER-A
Correct. The packet arrives on Gi0/1/0 which belongs to VRF CUSTOMER-A, so routing occurs within that VRF.

Full breakdown with real-world context →

Question 8easymultiple choice

Open the full VLAN trunking answer →

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

A
Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.
Why wrong: Incorrect; policing voice may cause call quality degradation.
B
Disable QoS entirely on all switches to eliminate any potential QoS-related drops.
Why wrong: Incorrect; disabling QoS may cause voice quality issues.
C
Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.
Correct.
D
Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.
Why wrong: Incorrect; endpoints may not set DSCP appropriately.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

A
Manually shut down the access ports that have unknown MAC addresses in the binding table.
Why wrong: This does not address the DHCP server response being dropped.
B
Disable Dynamic ARP Inspection on VLAN 10.
Why wrong: DAI validates ARP packets, not DHCP messages.
C
Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.
DHCP snooping drops DHCP server responses on untrusted ports.
D
Disable IP Source Guard on all access ports in VLAN 10.
Why wrong: IPSG filters IP traffic based on binding table, not DHCP messages.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

A
MTU size is set to 1500 on one switch and 9000 on the other.
Why wrong: MTU mismatch can cause fragmentation but not intermittent loss on a port-channel.
B
Auto-negotiation is disabled on both ends.
Why wrong: 10GE fiber links typically do not use auto-negotiation; this is normal.
C
Spanning-tree BPDU guard is enabled on the port-channel.
Why wrong: BPDU guard would shut down the port if BPDUs are received, not cause intermittent loss.
D
One switch is configured with active LACP and the other with passive LACP.
Active-passive LACP is a valid combination; but if one is passive and the other is also passive (or off), the channel fails. This question assumes the misconfiguration is passive-passive, leading to no LACP negotiation.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full VRF explanation →

A network engineer is troubleshooting connectivity issues in a multi-tenant environment where each tenant's traffic is isolated using VRF-Lite. The engineer notices that tenants in the same VRF cannot communicate with each other across different access switches. Which design change should be implemented to enable inter-switch VRF communication?

A
Use the same VLAN for all tenants and rely on VLAN ACLs.
Why wrong: VLAN ACLs do not provide routing isolation between VRFs.
B
Create trunk links with 802.1Q subinterfaces on each switch and assign each subinterface to the appropriate VRF.
This allows per-VRF routing across switches.
C
Configure static routes on each switch pointing to the next-hop IP in the global routing table.
Why wrong: Static routes in the global table do not provide VRF awareness.
D
Enable OSPF with a single area on all switches and redistribute between VRFs.
Why wrong: OSPF cannot differentiate VRFs without VRF-aware routing protocols.

Full breakdown with real-world context →

Question 12easymultiple choice

Study the full AAA explanation →

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

A
dot1x pae authenticator
Why wrong: This command is needed but only enables the PAE role; 'authentication port-control auto' is also required.
B
authentication port-control auto
Correct: this command enables 802.1X authentication on the interface.
C
authentication port-control force-authorized
Why wrong: This command disables 802.1X and sets the port to authorized state.
D
authentication port-control force-unauthorized
Why wrong: This command forces the port to unauthorized state, blocking all traffic.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full VRF explanation →

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Exhibit

Refer to the exhibit.

CEF table snippet:
Prefix          Next Hop     Interface
10.1.1.0/24     192.168.1.2  Ethernet0/0
10.2.2.0/24     192.168.2.2  Ethernet0/1

CEF table after VRF configuration:
VRF: TENANT_A
Prefix          Next Hop     Interface
10.1.1.0/24     192.168.1.2  Ethernet0/0.100
10.2.2.0/24     192.168.2.2  Ethernet0/1.200

A
LISP is not configured to map the virtual network.
Why wrong: Not relevant to this scenario.
B
The next-hop IP addresses are in the global routing table, not in the VRF.
Next-hops must be in the same VRF to be reachable.
C
OSPF is not redistributing the routes into the VRF.
Why wrong: Redistribution is not the issue; the next-hop is unreachable.
D
The physical interface is not configured as a trunk.
Why wrong: Subinterfaces work on access ports as well.

Full breakdown with real-world context →

Question 14mediummultiple choice

Open the full BGP breakdown →

A service provider uses a Cisco ASR 1000 router to provide MPLS L3VPN services to multiple customers. Each customer has their own VRF. Recently, a new customer was added with VRF CUSTOMER_C. After configuration, the customer reports that they can reach some remote sites but not others. The network engineer checks the VRF configuration and finds that the route targets for CUSTOMER_C are correctly configured. The engineer also verifies that BGP sessions to the PE routers are up. The missing routes are from a site that uses a different PE router. Which action should the engineer take to resolve the issue?

A
Increase the MTU on the link between the PE routers.
Why wrong: MTU issues would cause packet drops, not route absence.
B
Reconfigure LDP on the PE routers to establish a targeted session.
Why wrong: LDP is not directly related to VRF route import.
C
Check the MPLS label stack on the local PE to ensure labels are being swapped correctly.
Why wrong: Label issues would affect all destinations, not just one.
D
Verify that the route target import/export values on the remote PE match those on the local PE for VRF CUSTOMER_C.
Correct: Mismatched route targets cause routes to not be imported into the VRF.

Full breakdown with real-world context →

Question 15easymultiple choice

Open the full VLAN trunking answer →

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

A
Configure the port as a dynamic desirable port.
Why wrong: Dynamic desirable is a DTP mode, not a trunk.
B
Configure the port as a trunk port.
Trunk ports carry multiple VLANs.
C
Configure the port as a routed port.
Why wrong: Routed ports are Layer 3 interfaces.
D
Configure the port as an access port.
Why wrong: Access ports carry only one VLAN.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Which Command Should the Administrator Use Practice Questions

How to approach which command should the administrator use practice questions

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Practice scenarios

Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

Exhibit

Refer to the exhibit. A network engineer has configured VRFs on a router. A packet arrives on Gi0/1/0 with destination IP 10.1.1.2. Which VRF is used for routing this packet?

Exhibit

An engineer is troubleshooting intermittent connectivity issues between two data center switches. The link is a 10GE LACP port-channel. Which misconfiguration could cause packet loss?

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Exhibit

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?