Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1211:

  Which function is performed by vSmart in the Cisco SD-WAN architecture'?

  A. distribution of IPsec keys
  B. execution of localized policies
  C. redistribution between OMP and other routing protocols
  D. facilitation of NAT detection and traversal
  A. distribution of IPsec keys

  ---

  Explanation

  Authentication: As mentioned, the Cisco SD-WAN control plane contributes the underlying infrastructure for data plane security. In addition, authentication is enforced by two other mechanisms:

  In the traditional key exchange model, the Cisco vSmart Controller sends IPsec encryption keys to each edge device

  https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge-20-x/security-book/security-overview.html

• Question 1212:

  Refer to the exhibit.

  flow monitor FLOW-MONITOR-1 record netflow ipv6 original-input exit !

  sampler SAMPLER-1 mode deterministic 1 out-of 2 exit !

  ip cef ipv6 cef !

  interface GigabieEthernet 0/0/0 ipv6 address 2001:DB8:2ABCD::2/48 ipv6 flow monitro FLOW-MONITOR-1 sampler SAMPLER-1 input

  What is the effect of introducing the sampler feature into the Flexible NetFlow configuration on the router?

  A. NetFlow updates to the collector are sent 50% less frequently.
  B. Every second IPv4 packet is forwarded to the collector for inspection.
  C. CPU and memory utilization are reduced when compared with what is required for full NetFlow.
  D. The resolution of sampling data increases, but it requires more performance from the router.
  C. CPU and memory utilization are reduced when compared with what is required for full NetFlow.

  ---

  Explanation

  it's about what record the router is analyzing and not about what is been sent to the collector.

• Question 1213:

  Which two benefits result from a network design mat uses small and repeatable sections? (Choose two.)

  A. lower monitoring requirements
  B. low latency
  C. scalability
  D. quick failure isolation
  E. improved throughput
  C. scalability
  D. quick failure isolation

• Question 1214:

  What are two benefits of implementing a Cisco SD-WAN architecture? (Choose two)

  A. It provides resilient and effective traffic flow using MPLS.
  B. It improves endpoint protection by integrating embedded and cloud security features.
  C. It allows configuration of application-aware policies with real time enforcement.
  D. It simplifies endpoint provisioning through standalone router management
  E. It enforces a single. scalable. hub-and-spoke topology.
  C. It allows configuration of application-aware policies with real time enforcement.
  D. It simplifies endpoint provisioning through standalone router management

  ---

  Explanation

  The top SD-WAN benefits are:

  + Increased bandwidth at a lower cost + Centralized management across branch networks + Full visibility into the network + Providing organizations with more connection type options and vendor selection when building a network.

  https://www.sdxcentral.com/networking/sd-wan/definitions/sd-wan-technology/

  -> We can provision endpoints (vEdges) through a centralized router vManage -> Answer D is correct.

  Answer A is not correct as we can use different kind of connections on SD-WAN: MPLS, LTE, 4G, xDSL, Internet connections...

  Application-Aware Routing policy is configured in vManage as a centralized data policy that maps the serviceside application(s) to specific SLA requirements. The centralized policies provisioned in vSmart controller is pushed to relevant WAN Edge devices for enforcement. The defined policy consists of matchaction pairs, where the match statement defines the application-list or the type of traffic to match, and the action statement defines the SLA action the WAN Edge devices must enforce for the specified traffic.

  https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwanapplication-awarerouting-deploy-guide.html

• Question 1215:

  "HTTP/1.1 204 content" is returned when cur -I -x DELETE command is issued. Which situation has occurred?

  A. The object could not be located at the URI path
  B. The command succeeded in deleting the object
  C. The object was located at the URI, but it could not be deleted.
  D. The URI was invalid
  B. The command succeeded in deleting the object

• Question 1216:

  Which mobility role is assigned to a client in the client table of the new controller after a Layer 3 roam?

  A. anchor
  B. foreign
  C. mobility
  D. transparent
  D. transparent

• Question 1217:

  Refer to the exhibit.

  

  What are two results of the NAT configuration? (Choose two.)

  A. Packets with a destination of 200.1.1.1 are translated to 10.1.1.1 or .2. respectively.
  B. A packet that is sent to 200.1.1.1 from 10.1.1.1 is translated to 209.165.201.1 on R1.
  C. R1 looks at the destination IP address of packets entering S0/0 and destined for inside hosts.
  D. R1 processes packets entering E0/0 and S0/0 by examining the source IP address.
  E. R1 is performing NAT for inside addresses and outside address.
  B. A packet that is sent to 200.1.1.1 from 10.1.1.1 is translated to 209.165.201.1 on R1.
  C. R1 looks at the destination IP address of packets entering S0/0 and destined for inside hosts.

• Question 1218:

  Select the devices from the below options that can be fart of Cisco SDWAN Solution. (Choose two.)

  A. ISR 2900
  B. ASR 1000
  C. IR8300
  D. FTD 1120
  E. ASR 9000
  B. ASR 1000
  C. IR8300

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/compatibility/sdwan-device-compatibility.html#device-compat-ir8300rugged

• Question 1219:

  Which NGFW mode blocks flows crossing the firewall?

  A. tap
  B. inline
  C. passive
  D. inline tap
  B. inline

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html

• Question 1220:

  A company has an existing Cisco 5520 HA cluster using SSO. An engineer deploys a new single Cisco Catalyst 9800 WLC to test new features. The engineer successfully configures a mobility tunnel between the 5520 cluster and 9800 WLC. Clients connected to the corporate WLAN roam seamlessly between access points on the 5520 and 9800 WLC. After a failure on the primary 5520 WLC, all WLAN services remain functional; however clients cannot roam between the 5520 and 9800 controllers without dropping their connection. Which feature must be configured to remedy the issue?

  A. mobility MAC on the 5520 cluster
  B. mobility MAC on the 9800 WLC
  C. new mobility on the 5520 cluster
  D. new mobility on the 9800 WLC
  B. mobility MAC on the 9800 WLC

  ---

  Explanation

  You have 2 5k devices with SSO, and a 1 9k device.

  If cluster and primary works fine, then everything is fine.

  However when Primary 5k device fails, secondary should take over. Now Secondary with 9k doesnt talk to each other as it should.

  Ensure that you configure the mobility MAC address using the wireless mobility mac-address command for HighAvailability to work.

  Therefore you should enable this on the 9k device so it knows about the other devices.

  Doing it on the cluster with already established SSO wont do anything. Given answer (B) should be the correct one.