Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 91:

  DRAG DROP

  An engineer creates the configuration below. Drag and drop the authentication methods from the left into the order of priority on the right. Not all options are used.

  R1#sh run | i aaa

  aaa new-model

  aaa authentication login default group ACE group AAA_RADIUS local-case

  aaa session-id common

  R1#

  Select and Place:

  

  

• Question 92:

  Refer to the exhibit.

  

  An engineer deployed a wireless QoS setting for a new building within a campus. All network devices support 802.1p priority tags.

  What can be determined from the WLC settings?

  A. The WLC configuration prioritizes traffic based on access group assignment.
  B. The WLC uses the Platinum, Gold, Silver, and Bronze levels for traffic classification based on priority.
  C. The WLC configuration inherits DSCP values from an upstream AP.
  D. The WLC configuration maps 802.1p User Priority values to DSCP values.
  D. The WLC configuration maps 802.1p User Priority values to DSCP values.

  ---

  Explanation

  The correct answer is Option D. The WLC configuration maps 802.1p User Priority values to DSCP values.

  The exhibit shows that the QoS Map feature is enabled on the WLC. Under the upstream settings, UP to DSCP Map is selected.

  This means the WLC maps Layer 2 802.1p User Priority values to Layer 3 DSCP values.

  Key mapping concept:

  802.1p / CoS / UP = Layer 2 priority marking DSCP / IP precedence = Layer 3 QoS marking

  Because the WLC is configured for UP to DSCP mapping, it converts Layer 2 priority markings into Layer 3 QoS markings for upstream traffic.

  Option A is incorrect because the exhibit is not based on access group assignment.

  Option B is incorrect because Platinum, Gold, Silver, and Bronze are WLAN QoS profile levels, but the exhibit specifically shows UP-to-DSCP mapping.

  Option C is incorrect because the WLC is not configured to inherit upstream DSCP markings; the selected option is UP-to-DSCP mapping.

• Question 93:

  Which configuration restricts the amount of SSH that a router accepts 100 kbps?

  A. class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! ! Interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group CoPP_SSH out duplex auto speed auto media-type rj45 service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH permit tcp any any eq 22 !
  B. class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir CoPP_SSH exceed-action drop ! Interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group ... out duplex auto speed auto media-type rj45 service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH deny tcp any any eq 22 !
  C. class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! Control-plane service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH deny tcp any any eq 22 !
  D. class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! Control-plane transit service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH permit tcp any any eq 22 !
  C. class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! Control-plane service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH deny tcp any any eq 22 !

  ---

  Explanation

  CoPP protects the route processor on network devices by treating route processor resources as a separate entity with its own ingress interface (and in some implementations, egress also). CoPP is used to police traffic that is destined to the route processor of the router such as:

  + routing protocols like OSPF, EIGRP, or BGP.

  + Gateway redundancy protocols like HSRP, VRRP, or GLBP. + Network management protocols like telnet, SSH, SNMP, or RADIUS.

  

  Therefore we must apply the CoPP to deal with SSH because it is in the management plane. CoPP must be put under "control-plane" command.

• Question 94:

  Refer to the exhibit.

  

  What are two effect of this configuration? (Choose two.)

  A. Inside source addresses are translated to the 209.165.201.0/27 subnet.
  B. It establishes a one-to-one NAT translation.
  C. The 10.1.1.0/27 subnet is assigned as the inside global address range.
  D. The 209.165.201.0/27 subnet is assigned as the outside local address range.
  E. The 10.1.1.0/27 subnet is assigned as the inside local addresses.
  A. Inside source addresses are translated to the 209.165.201.0/27 subnet.
  E. The 10.1.1.0/27 subnet is assigned as the inside local addresses.

• Question 95:

  Which two southbound interfaces originate from Cisco DMA Center and terminate at fabric underlay switches? (Choose two)

  A. ICMP: Discovery
  B. UDP 67: DHCP
  C. TCP 23: Telnet
  D. UDP 6007: NetFlow
  E. UDP 162: SNMP
  A. ICMP: Discovery
  C. TCP 23: Telnet

  ---

  Explanation

  In the figure below, we can see ICMP & SNMP can reach to underlay switches.

  

• Question 96:

  What are the two protocols redistributed into OMP?

  A. OSPF
  B. RIP
  C. LDP
  D. RSVP
  E. EIGRP
  A. OSPF
  E. EIGRP

• Question 97:

  Which NGFW mode blocks flows crossing the firewall?

  A. tap
  B. inline
  C. passive
  D. inline tap
  B. inline

  ---

  Explanation

  References:

  https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html

• Question 98:

  Refer to the exhibit.

  

  An SSID is configured and both clients can reach their gateways on the Layer 3 switch, but they cannot communicate with each other.

  Which action resolves this issue?

  A. Set the WMM Policy to Allowed
  B. Set the P2P Blocking Action to Disabled
  C. Set the WMM Policy to Required
  D. Set the P2P Blocking Action to Forward-UpStream
  B. Set the P2P Blocking Action to Disabled

• Question 99:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1. Refer to the Tasks tab to view the tasks for this lab item.

  2. Refer to the Topology tab to access the device console(s) and perform the tasks.

  3. Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4. All necessary preconfigurations have been applied.

  5. Do not change the enable password or hostname for any device.

  6. Save your configurations to NVRAM before moving to the next item.

  7. Click Next at the bottom of the screen to submit this lab and move to the next question.

  8. When Next is clicked, the lab closes and cannot be reopened.

  Topology

  

  Tasks

  

  A. See the solution below in Explanation.
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. See the solution below in Explanation.

  ---

  Explanation

  Solution:

  R2

  config t username NetworkAdmin privilege 15 password CiscoENCOR

  line vty 0 4

  login local

  transport input telnet rlogin

  exec-timepit 20

• Question 100:

  Refer to the exhibit.

  What happens to access interfaces where VLAN 222 is assigned?

  

  A. STP BPDU guard is enabled
  B. A description "RSPAN" is added
  C. They are placed into an inactive state
  D. They cannot provide PoE
  C. They are placed into an inactive state

  ---

  Explanation

  This is because the exhibit shows the configuration of a remote SPAN (RSPAN) VLAN, which is a special VLAN that is used to transport mirrored traffic from one switch to another switch over a trunk link. The RSPAN VLAN is configured with the remote-span option, which indicates that the VLAN is dedicated for RSPAN use only. The access interfaces where the RSPAN VLAN is assigned are placed into an inactive state, which means that they cannot forward any traffic other than the mirrored traffic. The source of this answer is the Cisco ENCOR v1.1 course, module 6, lesson 6.2: Implementing SPAN, RSPAN, and ERSPAN.