How should I approach 350-401 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ENCOR 350-401 questions

Scenario-based practice

Which Command Should the Administrator Use Practice Questions

Q: How many Which Command Should the Administrator Use Practice Questions questions are on this page?

This page has 15 Which Command Should the Administrator Use Practice Questions scenario questions for the 350-401 exam, each with detailed explanations and wrong-answer analysis.

Practise ENCOR 350-401 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-401

exam code

Cisco

vendor

Scenario guide

How to approach which command should the administrator use practice questions

Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.

Quick answer

Which Command Should the Administrator Use Practice Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Read the full MPLS explanation →

An enterprise is migrating from a traditional MPLS WAN to Cisco SD-WAN. The network team has deployed vEdge routers at all branch offices and a vSmart controller in the data center. The engineer configures a centralized control policy to influence path selection based on cost and latency. After the policy is activated, the engineer notices that some branches are not receiving the updated policy and are still using the default best-path selection. The vSmart is reachable from all branches, and the vEdge routers show that they are connected to the vSmart. What is the most likely reason for this issue?

A
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
B
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
C
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
D
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.

Full breakdown with real-world context →

Question 2mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status
This is the correct order because VTP mode must be set first to define the switch's role, followed by the domain name to group switches, then trunk ports to propagate advertisements, and finally verification to confirm operation.
B
Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why wrong: This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.
C
Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status
Why wrong: This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.
D
Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why wrong: This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.

Full breakdown with real-world context →

Question 3hardmultiple choice

Study the full EIGRP explanation →

A network engineer is configuring EIGRP on a router that connects to a service provider network. The engineer wants to advertise a default route to internal routers. The engineer configures 'ip default-network 0.0.0.0' and redistributes a static default route into EIGRP. However, internal routers are not receiving the default route. The engineer checks the EIGRP topology table and sees the default route with a metric of 1. What is the most likely reason?

A
The engineer used 'ip default-network' which is not supported in EIGRP; instead, 'default-information originate' should be used.
Why wrong: Ly states that 'default-information originate' should be used for EIGRP. That command is for OSPF, not EIGRP. While 'ip default-network' is indeed not supported in EIGRP, the correct method is to redistribute a properly configured static default route, not to use 'default-information originate'. Therefore, this is not the most likely reason.
B
The static default route is not configured correctly; the engineer should use 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
Correct. The static default route must be correctly configured with a next-hop IP address. If the static route is missing or uses an interface instead of a next-hop, it may not be valid, and the redistribution will not propagate the route to internal routers, despite appearing in the topology table with a metric.
C
The internal routers have a route to the default network with a better metric from another source.
Why wrong: Internal routers are not receiving the default route at all, so they cannot have a route with a better metric from another source. This option describes a scenario where the route is received but not preferred, which does not match the problem.
D
The engineer needs to configure 'eigrp stub' on the router to allow default route advertisement.
Why wrong: Configuring 'eigrp stub' on the router would restrict route advertisement, not allow it. To advertise a default route from a stub router, you would need the 'summary' keyword, but the router is not necessarily a stub. This would not be the most likely reason for the failure.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Ansible explanation →

An engineer uses the following Ansible playbook to configure an interface on a Cisco IOS-XE device using the cisco.ios.ios_interfaces module:

```yaml --- - name: Configure interface hosts: cisco-routers gather_facts: no tasks: - name: Set interface description cisco.ios.ios_interfaces: config: - name: GigabitEthernet0/1 description: "Uplink to Core"

enabled: true

state: replaced ```

What is the result of running this playbook?

A
The interface will have the description set and all other parameters remain unchanged.
Why wrong: The 'replaced' state replaces the entire interface configuration, not just the provided parameters.
B
The playbook will fail because 'enabled' is not a valid parameter for ios_interfaces.
Why wrong: 'enabled' is a valid parameter in the cisco.ios.ios_interfaces module.
C
The interface will be configured with only the description and enabled state, removing any other existing configuration.
The 'replaced' state replaces the whole interface configuration with the provided values.
D
The playbook will fail because 'state: replaced' requires a 'before' and 'after' state.
Why wrong: 'replaced' is a valid state that replaces the configuration with the provided one.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full BGP breakdown →

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

A
The AS-path contains the local AS number.
Why wrong: This is incorrect. While an AS-path containing the local AS number can cause routes to be rejected due to loop prevention, the typical symptom is routes not being received at all or being marked as invalid, not the specific 'received but not valid' status. The most common cause for 'not valid' is next-hop unreachability.
B
The next-hop IP address is not reachable.
Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.
C
BGP synchronization is enabled.
Why wrong: This is incorrect. BGP synchronization is a legacy feature that requires the route to be in the IGP before it is advertised. In modern networks, synchronization is disabled by default. Even if enabled, it affects advertisement, not the validity of received routes in the BGP table.
D
The maximum-prefix limit has been exceeded.
Why wrong: This is incorrect. Exceeding the maximum-prefix limit typically causes the BGP session to reset or routes to be withdrawn, not to be marked as 'not valid' in the BGP table. Routes would likely be removed entirely, not just marked invalid.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

A
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
B
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
C
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
D
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a model-driven telemetry deployment on a Cisco IOS-XE router. The telemetry subscription is configured to stream interface statistics using gRPC dial-out to a collector at 10.1.1.100:50051. The engineer verifies that the collector is listening on the port and the router can reach it. However, the collector shows no data received. The engineer checks the router's telemetry logs and sees 'Connection refused' errors. What is the most likely cause?

A
The collector's firewall is blocking the connection from the router
Why wrong: If the firewall were blocking, the error would likely be 'No route to host' or timeout, not 'Connection refused'.
B
The gRPC server on the collector is not running or is listening on a different port
'Connection refused' occurs when the TCP SYN reaches the host but no application is listening on the specified port.
C
The telemetry subscription is missing the 'encoding' configuration
Why wrong: Missing encoding would not cause a connection refusal; the router would still attempt to connect.
D
The router's source-interface is not configured, causing the router to use an unreachable IP
Why wrong: If the source IP were unreachable, the error would be 'No route to host' or timeout, not 'Connection refused'.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

A
34
The Catalyst 9300 supports a maximum of 34 SPAN sessions.
B
16
Why wrong: 16 is the maximum for some older platforms, but not the 9300.
C
64
Why wrong: 64 is not the correct maximum for the 9300.
D
8
Why wrong: 8 is too low for the 9300.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full VPN explanation →

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

A
The IKEv2 proposal is not configured correctly.
Why wrong: The proposal is configured with valid parameters.
B
The IKEv2 profile is not attached to the crypto map or interface.
Correct because the profile must be applied to activate the configuration.
C
The IPsec transform set is missing.
Why wrong: The transform set is for Phase 2, not Phase 1.
D
The pre-shared key is not defined in the keyring.
Why wrong: The keyring is configured, but not applied.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full network assurance explanation →

Drag and drop the steps of troubleshooting NetFlow export issues into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11easymultiple choice

Read the full Ansible explanation →

An Ansible playbook uses the cisco.ios.ios_telemetry module to configure a telemetry subscription:

```yaml --- - name: Configure telemetry subscription hosts: ios_xe gather_facts: no tasks: - name: Create telemetry subscription cisco.ios.ios_telemetry: state: present subscription_id: 300 receiver: ip: 10.1.1.100 port: 50051 protocol: grpc-tcp source_ip: 10.1.1.1 encoding: kvgpb filter: xpath: /interfaces/interface/state/counters update_policy: period: 10000 ```

What is the purpose of the 'state: present' parameter?

A
It ensures the subscription is present in the running configuration.
state: present creates or updates the subscription to match the desired state.
B
It checks if the subscription is currently active.
Why wrong: state: present does not check activity; it ensures configuration exists.
C
It removes the subscription if it exists.
Why wrong: That would be state: absent.
D
It displays the current subscription configuration.
Why wrong: state: present modifies configuration, not displays it.

Full breakdown with real-world context →

Question 12easymultiple choice

Study the full Python automation breakdown →

An engineer is using the Cisco DNA Center GUI to create a new site hierarchy. They add a building under an existing area. After saving, they run a Python script to verify the site via API:

import requests

url = "https://dna-center.local/dna/intent/api/v1/site" headers = {"X-Auth-Token": "token"} response = requests.get(url, headers=headers, verify=False) sites = response.json()['response']

for site in sites:
    if site['name'] == 'Building-A':
        print(site['id'])

What is the output if the building was created successfully?

A
A UUID string such as '123e4567-e89b-12d3-a456-426614174000'
Correct. The API returns a UUID for each site, and the script prints it.
B
The script will print 'Building-A'
Why wrong: The script prints site['id'], not site['name'].
C
The script will print the entire site dictionary
Why wrong: It only prints the id field.
D
The script will raise an error because the API returns paginated results
Why wrong: The script assumes all sites are returned in one response, which may be true for small hierarchies, but the output would still be the ID if found.

Full breakdown with real-world context →

Question 13easymultiple choice

Open the full VLAN trunking answer →

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

A
Configure the port as a dynamic desirable port.
Why wrong: Dynamic desirable is a DTP mode, not a trunk.
B
Configure the port as a trunk port.
Trunk ports carry multiple VLANs.
C
Configure the port as a routed port.
Why wrong: Routed ports are Layer 3 interfaces.
D
Configure the port as an access port.
Why wrong: Access ports carry only one VLAN.

Full breakdown with real-world context →

Question 14easymultiple choice

Open the full BGP breakdown →

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

A
The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.
Correct because the ip vrf forwarding command clears the IP address on the interface, requiring it to be re-entered.
B
The BGP neighbor is not configured with the password command.
Why wrong: Incorrect because a password is not required for BGP to come up.
C
The route-target import/export values are incorrect for the customer.
Why wrong: Incorrect because route-targets affect VPNv4 route distribution, not the BGP session directly.
D
The engineer forgot to configure the VRF under the BGP router-id.
Why wrong: Incorrect because the router-id is global and not VRF-specific.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full Python automation breakdown →

A Python script using Netmiko to configure telemetry on a Cisco IOS-XE device:

```python

from netmiko import ConnectHandler

device = { 'device_type': 'cisco_ios', 'host': '192.168.1.1', 'username': 'admin', 'password': 'cisco',

connection = ConnectHandler(**device) config_commands = [ 'telemetry ietf subscription 200', 'receiver ip address 10.1.1.100 port 50051 protocol grpc-tcp', 'source-address 10.1.1.1', 'encoding encode-kvgpb', 'filter xpath /interfaces/interface/state/counters', 'update-policy periodic 10000'

output = connection.send_config_set(config_commands)

print(output)

connection.disconnect() ```

What is the expected outcome of this script?

A
The script will configure the telemetry subscription and print the configuration output.
The script uses correct Netmiko syntax and valid IOS-XE commands.
B
The script will fail because 'telemetry ietf subscription' is not a valid command.
Why wrong: This is a valid command on IOS-XE 16.6+.
C
The script will fail because 'send_config_set' requires a list of strings.
Why wrong: The commands are already in a list, which is correct.
D
The script will fail because the device_type should be 'cisco_xe'.
Why wrong: Both 'cisco_ios' and 'cisco_xe' are accepted for IOS-XE devices.

Full breakdown with real-world context →

These 350-401 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-401 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Which Command Should the Administrator Use Practice Questions

How to approach which command should the administrator use practice questions

Quick answer

Related 350-401 topic practice pages

Architecture practice questions

Virtualization practice questions

Infrastructure practice questions

Network Assurance practice questions

Security practice questions

Automation practice questions

ENCOR BGP practice questions

ENCOR OSPF practice questions

ENCOR EIGRP practice questions

ENCOR VLANs and trunking practice questions

ENCOR STP practice questions

ENCOR ACLs and CoPP practice questions

Practice scenarios

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

What is the maximum number of SPAN sessions that can be configured on a Cisco Catalyst 9300 switch?

Drag and drop the steps of troubleshooting NetFlow export issues into the correct order, from first to last.

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?