Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1071:

  DRAG DROP

  Drag and drop the snippets onto the blanks within the code to construct a script that adds a prefix list to a route map and sets the local preference. Not all options are used

  Select and Place:

  

  

• Question 1072:

  Which two Cisco SD-WAN components exchange OMP information?

  A. vAnaiytlcs
  B. vSmart
  C. WAN Edge
  D. vBond
  E. vManage
  B. vSmart
  C. WAN Edge

  ---

  Explanation

  OMP is the control protocol that is used to exchange routing, policy, and management information between the vSmart controllers and vEdge routers in the overlay network.

• Question 1073:

  Refer to the exhibit.

  

  The trunk does not work over the back-to-back link between Switch1 interface Giq1/0/20 and Switch2 interface Gig1/0/20.

  Which configuration fixes the problem?

  A. Switch 1(config)#interface gig1/0/20 Switch 1(config-if)#switchport mode dynamic auto
  B. Switch(config)#interface gig1/0/20 Switch(config-if)#switchport mode dynamic desirable
  C. Switch 1(config)#interface gig1/0/20 Switch1(config-if)#switchport trunk native vlan 1 Switch2(config)#interface gig1/0/20 Switch2(config-if)#switchport trunk native vlan 1
  D. Switch(config)#interface gig1/0/20 Switch2(config-if)#switchport mode dynamic auto
  B. Switch(config)#interface gig1/0/20 Switch(config-if)#switchport mode dynamic desirable

• Question 1074:

  In a Cisco SD-Access solution, which protocol is used by an extended node to connect to a single edge node?

  A. VXLAN
  B. IS-IS
  C. 802 1Q
  D. CTS
  C. 802 1Q

  ---

  Explanation

  SD-Access Extended Nodes provide the ability to extend the enterprise network by providing connectivity to non-carpeted spaces of an enterprise ?commonly called the Extended Enterprise. This allows network connectivity and management of IoT devices and the deployment of traditional enterprise end devices in outdoor and non-carpeted environments such as distribution centers, warehouses, or Campus parking lots. This feature extends consistent, policy-based automation to Cisco Industrial Ethernet, Catalyst 3560-CX Compact, and Digital Building Series switches and enables segmentation for user endpoints and IoT devices connected to these nodes. Using Cisco DNA Center automation, switches in the extended node role are onboarded to their connected edge node using an 802.1Q trunk over an EtherChannel with one or multiple physical link members. Extended nodes are discovered using zero-touch Plug-and-Play.

  References:

  https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html#Network_Components

• Question 1075:

  Refer to the exhibit.

  

  You have just created a new VRF on PE3. You have enabled debug ip bgp vpnv4 unicast updates on PE1, and you can see the route in the debug, but not in the BGP VPNv4 table.

  Which two statements are true? (Choose two)

  A. After you configure route-target import 999:999 for a VRF on PE1, the route will be accepted
  B. VPNv4 is not configured between PE1 and PE3
  C. address-family ipv4 vrf is not configured on PE3
  D. PE1 will reject the route due to automatic route filtering
  E. After you configure route-target import 999:999 for a VRF on PE3, the route will be accepted
  A. After you configure route-target import 999:999 for a VRF on PE1, the route will be accepted
  D. PE1 will reject the route due to automatic route filtering

  ---

  Explanation

  Because some PE routers might receive routing information they do not require, a basic requirement is to be able to filter the MP-iBGP updates at the ingress to the PE router so that the router does not need to keep this information in memory. The Automatic Route Filtering feature fulfills this filtering requirement. This feature is available by default on all PE routers, and no additional configuration is necessary to enable it. Its function is to filter automatically VPN-IPv4 routes that contain a route target extended community that does not match any of the PE's configured VRFs. This effectively discards any unwanted VPN-IPv4 routes silently, thus reducing the amount of information that the PE has to store in memory -> Answer 'PE1 will reject the route due to automatic route filtering' is correct.

  References:

  MPLS and VPN Architectures Book, Volume 1

  The reason that PE1 dropped the route is there is no "route-target import 999:999" command on PE1 (so we see the "DENIED due to: extended community not supported" in the debug) so we need to type this command to accept this route ->

  Answer 'After you configure route-target import 999:999 for a VRF on PE1, the route will be accepted' is correct.

• Question 1076:

  Which access control feature does MAB provide?

  A. user access based on IP address
  B. allows devices to bypass authenticate
  C. network access based on the physical address of a device
  D. simultaneous user and device authentication
  C. network access based on the physical address of a device

• Question 1077:

  A customer wants to use a single SSID to authenticate loT devices using different passwords.

  Which Layer 2 security type must be configured in conjunction with Cisco ISE to achieve this requirement?

  A. Fast Transition
  B. Central Web Authentication
  C. Cisco Centralized Key Management
  D. Identity PSK
  D. Identity PSK

  ---

  Explanation

  With the advent of internet of things, the number of devices that connect to the internet is increased multifold. Not all of these devices support 802.1x supplicant and need an alternate mechanism to connect to the internet. One of the security mechanisms, WPA-PSK could be considered as an alternative. With the current configuration, the pre-shared-key is the same for all clients that connect to the same WLAN. In certain deployments such as Educational Institutions, this results in the key being shared to unauthorized users resulting in security breach. Therefore, above mentioned and other requirements lead to the need for provisioning unique pre-shared keys for different clients on a large scale.

  Identity PSKs are unique pre-shared keys created for individuals or groups of users on the same SSID.

  No complex configuration required for clients. The same simplicity of PSK, making it ideal for IoT, BYOD, and guest deployments.

  Supported on most devices, where 802.1X may not, enabling stronger security for IoT.

  Easily revoke access, for a single device or individual, without affecting everyone else.

  Thousands of keys can easily be managed and distributed via the AAA server.

• Question 1078:

  Refer to the exhibit.

  

  Which configuration must be added to enable remote access only using SSHv1 or SSHv2 to this router?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

• Question 1079:

  Which two steps are required for a complete Cisco DNA Center upgrade? (Choose two.)

  A. golden image selection
  B. automation backup
  C. proxy configuration
  D. application updates
  E. system update
  D. application updates
  E. system update

  ---

  Explanation

  A complete Cisco DNA Center upgrade includes "System Update" and "Appplication Updates"

  References:

  https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/upgrade/b_cisco_dna_center_upgrade_guide/m_upgrade_to_cisco_dna_center_2_2_2_x.html

• Question 1080:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1. Refer to the Tasks tab to view the tasks for this lab item.

  2. Refer to the Topology tab to access the device console(s) and perform the tasks.

  3. Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4. All necessary preconfigurations have been applied.

  5. Do not change the enable password or hostname for any device.

  6. Save your configurations to NVRAM before moving to the next item.

  7. Click Next at the bottom of the screen to submit this lab and move to the next question.

  8. When Next is clicked, the lab closes and cannot be reopened.

  Topology

  

  Tasks

  Configure the devices according to the topology to achieve these goals:

  1. Configure a SPAN session on SW01 using these parameters:

  Session Number: 20

  Source Interface: VLAN 99

  Traffic Direction: Transmitted Traffic

  Destination Interface: Ethernet0/1

  2. Configure the NetFlow Top Talkers feature for outbound traffic on interface E0/2 of R01 with these parameters:

  Number of Top Talkers: 50

  Sort Type: Packets

  Cache Timeout: 30 seconds

  3. Configure an IP SLA operation on SW02 and start the ICMP probe with these parameters:

  Entry Number: 10

  Target IP: 1.1.1.1

  Source IP: 172.16.2.2

  Frequency: 5 seconds

  Threshold: 250 milliseconds

  Timeout: 3000 milliseconds

  Lifetime: Forever

  A. See the solution below in Explanation.
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. See the solution below in Explanation.

  ---

  Explanation

  SW1

  Config t

  Monitor session 20 source vlan 99 tx

  Monitor session 20 destination interface ethernet 0/1

  Copy run start

  R1

  Config t

  Ip flow-top-talkers

  Top 50

  Sort-by packets

  Cache time-out 30

  Eth 0/2

  Ip flow egress

  Copy run start

  SW02

  Config t

  Ip sla 10

  Icmp-echo 1.1.1.1 source-ip 172.16.2.2

  Frequency 5

  Threshold 250

  Timeout 3000

  Ip sla schedule 10 start-time now life forever

  Copy run start