Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1291:

  In a virtual environment, what is a VMDK file?

  A. A file containing information about snapshots of a virtual machine.
  B. A zip file connecting a virtual machine configuration file and a virtual disk.
  C. A configuration file containing settings for a virtual machine such as a guest OS.
  D. A file containing a virtual machine disk drive.
  A. A file containing information about snapshots of a virtual machine.

• Question 1292:

  Refer to the exhibit. An engineer attempts to establish BGP peering between router CORP and two ISP routers. What is the root cause for the failure between CORP and ISP#2?

  

  A. Router ISP#2 is configured to use SHA-1 authentication.
  B. There is a password mismatch between router CORP and router ISP#2.
  C. Router CORP is configured with an extended access control list.
  D. MD5 authorization is configured incorrectly on router ISP#2.
  B. There is a password mismatch between router CORP and router ISP#2.

• Question 1293:

  Which tool functions in a push model, supports languages like Python or Ruby, and does not require an agent to be installed per host?

  A. Puppet
  B. Ansible
  C. Saltstack
  D. Chef
  B. Ansible

• Question 1294:

  An engineer failed to run diagnostic commands on devices using Cisco DNA center, which action in Cisco DNA center resolves the issue?

  A. Enable Secure Shell.
  B. Enable Command Runner.
  C. Enable APIs
  D. Enable CDP.
  A. Enable Secure Shell.

• Question 1295:

  In a wireless Cisco SD-Access deployment, which roaming method is used when a user moves from one access point to another on a different access switch using a single WLC?

  A. Layer 3
  B. inter-xTR
  C. auto anchor
  D. fast roam
  B. inter-xTR

  ---

  Explanation

  SDA RoamingSDA supports two additional types of roaming, which are Intra-xTR and Inter-xTR. In SDA, xTR stands for an access-switch that is a fabric edge node. It serves both as an ingress tunnel router as well as an egress tunnel router.

  Intra-xTR When a client on a fabric enabled WLAN, roams from an access point to another access point on the same access-switch, it is called Intra-xTR. Here, the local client database and client history table are updated with the information of the newly associated access point.

  Inter-xTR.

  When a client on a fabric enabled WLAN, roams from an access point to another access point on a different access-switch, it is called Inter-xTR.

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/mobility.html

• Question 1296:

  An engineer must configure Interface and sensor monitoring on a router. The NMS server is located in a trusted zone with IP address 10.15.2.19. Communication between the router and the NMS server must be encrypted and password- protected using the most secure algorithms. Access must be allowed only for the NMS server and with the minimum permission levels needed.

  Which configuration must the engineer apply?

  A. ip access-list extended nmspermit 1 host 10.15.2.19 anysnmp-server view ro internet includedsnmp-server view ro ifEntry includedsnmp-server group nms v3 priv notify ro access nmssnmp-server user user1 nms v3 encrypted auth md5 Password1 pri 3des Password123
  B. ip access-list standard nmspermit 10.15.2.19 0.0.0.0snmp-server view ro iso includedsnmp-server view ro ifEntry includedsnmp-server group nms v3 priv read ro access nmssnmp-server user user1 nms v3 auth sha Password1 pri aes 256 Password123
  C. ip access-list standard nmspermit 10.15.2.19 0.0.0.0snmp-server view rw iso includedsnmp-server view rw ifEntry includedsnmp-server group nms v3 auth write rw access nmssnmp-server user user1 nms v3 auth des Password1 pri des Password123
  D. ip access-list standard nmspermit 10.15.2.19 255.255.255.255snmp-server view ro iso includedsnmp-server view ro ifEntry includedsnmp-server group nms v3 priv read ro access nmssnmp-server user user1 nms v3 auth 3des Password1 pri aes 192 Password123
  B. ip access-list standard nmspermit 10.15.2.19 0.0.0.0snmp-server view ro iso includedsnmp-server view ro ifEntry includedsnmp-server group nms v3 priv read ro access nmssnmp-server user user1 nms v3 auth sha Password1 pri aes 256 Password123

• Question 1297:

  Which component of the Cisco Cyber Threat Defense solution provides user and flow context analysis?

  A. Cisco Firepower and FireSIGHT
  B. Cisco Stealthwatch system
  C. Advanced Malware Protection
  D. Cisco Web Security Appliance
  B. Cisco Stealthwatch system

  ---

  Explanation

  The goal of the Cyber Threat Defense solution is to introduce a design and architecture that can help facilitate the discovery, containment, and remediation of threats once they have penetrated into the network interior. Cisco Cyber Threat Defense version 2.0 makes use of several solutions to accomplish its objectives:

  * NetFlow and the Lancope StealthWatch System 1. Broad visibility 2. User and flow context analysis 3. Network behavior and anomaly detection 4. Incident response and network forensics

  * Cisco FirePOWER and FireSIGHT 1. Real-time threat management 2. Deeper contextual visibility for threats bypassing the perimeters ?URL control

  * Advanced Malware Protection (AMP) 1. Endpoint control with AMP for Endpoints 2. Malware control with AMP for networks and content

  * Content Security Appliances and Services 1. Cisco Web Security Appliance (WSA) and Cloud Web Security (CWS) 2. Dynamic threat control for web traffic 3. Outbound URL analysis and data transfer controls 4. Detection of suspicious web activity 5. Cisco Email Security Appliance (ESA) 6. Dynamic threat control for email traffic 7. Detection of suspicious email activity

  * Cisco Identity Services Engine (ISE) 1. User and device identity integration with Lancope StealthWatch 2. Remediation policy actions using pxGrid

  https://www.cisco.com/c/dam/en/us/td/docs/security/network_security/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf

• Question 1298:

  In a fabric-enabled wireless network, which device is responsible for maintaining the endpoint ID database?

  A. fabric border node
  B. fabric edge node
  C. fabric wireless controller
  D. control plane node
  D. control plane node

• Question 1299:

  In a Cisco Mobility Express wireless deployment, which AP takes over if the primary AP fails?

  A. AP with highest IP address
  B. AP with the lowest IP address
  C. AP with highest MAC address
  D. AP with highest controller up time
  C. AP with highest MAC address

• Question 1300:

  Refer to the exhibit.

  

  Assuming that R1 is a CE router, which VRF is assigned to Gi0/0 on R1?

  A. VRF VPN_B
  B. Default VRF
  C. Management VRF
  D. VRF VPN_A
  B. Default VRF

  ---

  Explanation

  There is nothing special with the configuration of Gi0/0 on R1. Only Gi0/0 interface on R2 is assigned to VRF VPN_A. The default VRF here is similar to the global routing table concept in Cisco IOS