Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1021:

  Which design principle slates that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied?

  A. least privilege
  B. fail-safe defaults
  C. economy of mechanism
  D. complete mediation
  B. fail-safe defaults

  ---

  Explanation

  The Principle of Fail-Safe Defaults states that, unless a subject is given explicit access to an object, it should be denied access to that object

• Question 1022:

  Which OSPF networks types are compatible and allow communication through the two peering devices?

  A. broadcast to nonbroadcast
  B. point-to-multipoint to nonbroadcast
  C. broadcast to point-to-point
  D. point-to-multipoint to broadcast
  A. broadcast to nonbroadcast

  ---

  Explanation

  The following different OSPF types are compatible with each other:

  + Broadcast and Non-Broadcast (adjust hello/dead timers) + Point-to-Point and Point-to-Multipoint (adjust hello/dead timers) Broadcast and Non-Broadcast networks elect DR/BDR so they are compatible. Point-topoint/ multipoint do not elect DR/BDR so they are compatible.

  https://www.freeccnaworkbook.com/workbooks/ccna/configuring-ospf-network-types

• Question 1023:

  Which two features does the Cisco SD-Access architecture add to a traditional campus network? (Choose two.)

  A. software-defined segmentation
  B. private VLANs
  C. SD-WAN
  D. modular QoS
  E. identity services
  A. software-defined segmentation
  E. identity services

  ---

  Explanation

  https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Software-Defined-Access-Segmentation-Design-Guide-2018MAY.pdf

• Question 1024:

  An administrator must enable Telnet access to Router X using the router username and password database for authentication. Which configuration should be applied?

  A. RouterX(config)# line aux 0RouterX(config line)# password ciscoRouterX(config-line)# login
  B. RouterX(config)# aaa new-modelRouterX(config)# aaa authentication login auth-list local
  C. RouterX(config)# line vty 0 4RouterX(config-line)# login localRouterX(config-line)# end
  D. RouterX(config)# line vty 0 4RouterX(config-line)# loginRouterX(config-line)# end
  C. RouterX(config)# line vty 0 4RouterX(config-line)# login localRouterX(config-line)# end

• Question 1025:

  How do FHRPs differ from SSO?

  A. FHRPs provide gateway redundancy, and SSO provides failover within a single device
  B. FHRPs maintain state information within a single device, and SSO manages state information across multiple devices.
  C. FHRPs use OTV for redundancy, and SSO uses VXLAN for state synchronization.
  D. FHRPs influence bandwidth allocation, and SSO influences routing decisions.
  A. FHRPs provide gateway redundancy, and SSO provides failover within a single device

• Question 1026:

  Which collection contains the resources to obtain a list of fabric nodes through the vManage API?

  A. device management
  B. administration
  C. device inventory
  D. monitoring
  C. device inventory

  ---

  Explanation

  The collection that contains the resources to obtain a list of fabric nodes through the vManage API is the device inventory collection. This collection can be accessed through the Cisco Encor Documents and provides resources such as the Fabric Visualization, Device List, and Fabric Node Inventory APIs. These APIs can be used to obtain information about the fabric nodes, such as the device inventory, status, and version.

• Question 1027:

  An engineer is troubleshooting the Ap join process using DNS. Which FQDN must be resolvable on the network for the access points to successfully register to the WLC?

  A. wlcbostname.domain.com
  B. cisco-capwap-controller.domain.com
  C. ap-manager.domain.com
  D. primary-wlc.domain.com
  B. cisco-capwap-controller.domain.com

  ---

  Explanation

  DNS: If you have configured your DHCP server to provide both option 006 (DNS server address) and option 015 (domain name) information, the AP can obtain WLC addresses from the DNS server. The process works as follows:

  1. The AP gets its IP address from DHCP with options 6 and 15 configured.

  2. The AP can obtain the IP address of the DNS server from the DHCP option.

  3. The AP uses this information to perform a hostname lookup using CISCO-CAPWAP-CONTROLLER., which resolves to available WLC management interface IP addresses (IPv4 or IPv6, or both).

  4. The AP can then perform a directed message to associate to responsive WLCs.

  To prevent all APs from joining a single controller based on a DNS name resolution, the domain name may vary; this is what is done to dispatch APs to different controllers across the enterprise network, based on different domain names that are configured in their respective DNS scopes.

• Question 1028:

  Which feature is supported by EIGRP but is not supported by OSPF?

  A. equal-cost load balancing
  B. route filtering
  C. unequal-cost load balancing
  D. route summarization
  C. unequal-cost load balancing

  ---

  Explanation

  EIGRP support unequal-cost load balancing via the "variance ..." while OSPF only supports equalcost load balancing.

• Question 1029:

  Refer to the exhibit.

  

  What can be determined from the output?

  A. Flow record CC is configured with two separate exporters.
  B. Flow record CC is configured with a single exporter.
  C. Flow monitor FLOW-CC is configured with two separate flow records to a single exporter.
  D. Flow monitor FLOW-CC is configured to two separate exporters.
  D. Flow monitor FLOW-CC is configured to two separate exporters.

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-3se/fnf-xe-3e-book/fnf-export-ipv4.html

• Question 1030:

  An engineer must configure an EXEC authorization list that first checks a AAA server then a local username. If both methods fail, the user is denied. Which configuration should be applied?

  A. aaa authorization exec default local group tacacs+
  B. aaa authorization exec default local group radius none
  C. aaa authorization exec default group radius local none
  D. aaa authorization exec default group radius local
  D. aaa authorization exec default group radius local