Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1321:

  Which two threats does AMP4E have the ability to block? (Choose two.)

  A. DDoS
  B. ransomware
  C. Microsoft Word macro attack
  D. SQL injection
  E. email phishing
  B. ransomware
  C. Microsoft Word macro attack

  ---

  Explanation

  https://www.cisco.com/c/dam/en/us/products/collateral/security/amp-for-endpoints/c11-742008-00-cisco-amp-for-endpoints-wp-v2a.pdf

• Question 1322:

  Which policy feature is used with TrustSec to provide endpoint entitlement in an enterprise network?

  A. security group tags
  B. access control lists
  C. virtual local area network
  D. virtual routing and forwarding
  A. security group tags

• Question 1323:

  A large campus network has deployed two wireless LAN controllers to manage the wireless network. WLC1 and WLC2 have been configured as mobility peers. A client device roams from AP1 on WLC1 to AP2 on WLC2, but the controller's client interfaces are on different VLANs.

  How do the wireless LAN controllers handle the inter-subnet roaming?

  A. WLC1 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC2.
  B. WLC2 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC1.
  C. WLC1 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC2.
  D. WLC2 marks the client with a foreign entry in its own database. The database entry is copied to the new controller and marked with an anchor entry on WLC1.
  A. WLC1 marks the client with an anchor entry in its own database. The database entry is copied to the new controller and marked with a foreign entry on WLC2.

  ---

  Explanation

  Inter-subnet roaming is similar to inter-controller roaming in that the controllers exchange mobility messages on the client roam. However, instead of moving the client database entry to the new controller, the original controller marks the client with an "Anchor" entry in its own client database. The database entry is copied to the new controller client database and marked with a "Foreign" entry in the new controller. The roam remains transparent to the wireless client, and the client maintains its original IP address.

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-3/configuration/guide/b_cg73/b_wlc-cg_chapter_01111.html

• Question 1324:

  Refer to the exhibit.

  

  An engineer must deny Telnet traffic from the loopback interface of router R3 to the loopback interface of router R2 during the weekend hours. All other traffic between the loopback interfaces of routers R3 and R2 must be allowed at all times.

  Which command set accomplishes this task?

  A. R3(config)#time-range WEEKENDR3(config-time-range)#periodic Saturday Sunday 00:00 to 23:59R3(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKENDR3(config)#access-list 150 permit ip any any time-range WEEKENDR3(config)#interface G0/1R3(config-if)#ip access-group 150 out
  B. R1(config)#time-range WEEKENDR1(config-time-range)#periodic weekend 00:00 to 23:59R1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKENDR1(config)#access-list 150 permit ip any anyR1(config)#interface G0/1R1(config-if)#ip access-group 150 in
  C. R3(config)#time-range WEEKENDR3(config-time-range)#periodic weekend 00:00 to 23:59R3(config)#access-list 150 permit tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKENDR3(config)#access-list 150 permit ip any any time-range WEEKENDR3(config)#interface G0/1R3(config-if)#ip access-group 150 out
  D. R1(config)#time-range WEEKENDR1(config-time-range)#periodic Friday Sunday 00:00 to 00:00R1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKENDR1(config)#access-list 150 permit ip any anyR1(config)#interface G0/1R1(config-if)#ip access-group 150 in
  B. R1(config)#time-range WEEKENDR1(config-time-range)#periodic weekend 00:00 to 23:59R1(config)#access-list 150 deny tcp host 10.3.3.3 host 10.2.2.2 eq 23 time-range WEEKENDR1(config)#access-list 150 permit ip any anyR1(config)#interface G0/1R1(config-if)#ip access-group 150 in

  ---

  Explanation

  We cannot filter traffic that is originated from the local router (R3 in this case) so we can only configure the ACL on R1 or R2. "Weekend hours" means from Saturday morning through Sunday night so we have to configure: "periodic weekend 00:00 to 23:59".

  Note: The time is specified in 24-hour time (hh:mm), where the hours range from 0 to 23 and the minutes range from 0 to 59.

• Question 1325:

  What is the base unit of definition in YANG?

  A. module
  B. include statement
  C. stanza
  D. node
  D. node

• Question 1326:

  Which of the following are the two components of the two-tier modern data center design? (Choose two.)

  A. Distribution
  B. Core
  C. Access
  D. Leaf
  E. Spine
  D. Leaf
  E. Spine

  ---

  Explanation

  the question is in modern data center not a classical networkd design

• Question 1327:

  When using BFD in a network design, which consideration must be made?

  A. BFD is used with first hop routing protocols to provide subsecond convergence.
  B. BFD is more CPU-intensive than using reduced hold timers with routing protocols.
  C. BFD is used with dynamic routing protocols to provide subsecond convergence.
  D. BFD is used with NSF and graceful to provide subsecond convergence.
  C. BFD is used with dynamic routing protocols to provide subsecond convergence.

  ---

  Explanation

  https://www.cisco.com/en/US/docs/ios/12_4t/ip_route/configuration/guide/t_bfd.html

• Question 1328:

  Which method does the enable secret password option use to encrypt device passwords?

  A. AES
  B. CHAP
  C. PAP
  D. MD5
  D. MD5

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/107614-64.html

• Question 1329:

  Which device, in a LISP router architecture, receives LISP map requests and determines which ETR should handle the map request?

  A. proxy ETR
  B. routing locator
  C. map resolver
  D. map server
  C. map resolver

  ---

  Explanation

  LISP Map Resolver Like an MS, a LISP MR connects to the ALT. The function of the LISP MR is to accept encapsulated Map-Request messages from ingress tunnel routers (ITRs), decapsulate those messages, and then forward the messages to the MS responsible for the egress tunnel routers (ETRs) that are authoritative for the requested EIDs.

• Question 1330:

  Refer to the exhibit. Which commands are required to allow SSH connection to the router?

  

  A. Router(config)#access-list 100 permit udp any any eq 22Router(config)#access-list 101 permit top any any eq 22Router(config)#class-map class-ssh ONURouter(config-cmap)#match access-group 101Router(config)#policy-map COPPRouter(config-pmap)#police 100000 conform-action transmit
  B. Router(config)#access-list 100 permit top any eq 22 anyRouter(config)#class-map class-sshRouter(config-cmap)#match access-group 10Router(config)#policy-map COPPRouter(config-pmap)#class class-sshRouter(config-pmap-c)#police 100000 conform-action transmit
  C. Router(config)#access-list 10 permit top any eq 22 anyRouter(config)#class-map class-sshRouter(config-cmap)#match access-group 10Router(config)#policy-map COPPRouter(config-pmap)#class class-sshRouter(config-pmap-c)#police 100000 conform-action transmit
  D. Router(config)#access-list 100 permit tcp any any eq 22Router(config)#access-list 101 permit tcp any any eq 22Router(config)#class-map class-sshRouter(config-cmap)#match access-group 101Router(config)#policy-map COPPRouter(config-pmap)#class class-sshRouter(config-pmap-c)#police 100000 conform-action transmit
  D. Router(config)#access-list 100 permit tcp any any eq 22Router(config)#access-list 101 permit tcp any any eq 22Router(config)#class-map class-sshRouter(config-cmap)#match access-group 101Router(config)#policy-map COPPRouter(config-pmap)#class class-sshRouter(config-pmap-c)#police 100000 conform-action transmit

  ---

  Explanation

  the ACL itself is wrong, the eq keyword should be placed at the end because we want to match incoming ssh requests so the destination "ssh server" will use port 22, and the source "ssh client" will use a random port number.