Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1441:

  Which AP mode allows an engineer to scan configured channels for rogue access points?

  A. sniffer
  B. monitor
  C. bridge
  D. local
  B. monitor

  ---

  Explanation

  The local and FlexConnect mode access points are designed to serve associated clients. These access points spend relatively less time performing off-channel scanning: about 50 milliseconds on each channel. If you want to perform high rogue detection, a monitor mode access point must be used. Alternatively, you can reduce the scan intervals from 180 seconds to a lesser value, for example, 120 or 60 seconds, ensuring that the radio goes off-channel more frequently, which improves the chances of rogue detection. However, the access point continues to spend about 50 milliseconds on each channel.

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010111000.html#:~:text=The%20local%20and%20FlexConnect%20mode%20access%20points,spend%20about%2050%20milliseconds%20on%20each%20channel.

• Question 1442:

  DRAG DROP

  Drag and drop the characteristics from the left onto the switching architectures on the right.

  Select and Place:

  

  

• Question 1443:

  A customer has 20 stores located throughout a city. Each store has a single Cisco AP managed by a central WLC. The customer wants to gather analytics for users in each store.

  Which technique supports these requirements?

  A. angle of arrival
  B. presence
  C. hyperlocation
  D. trilateration
  B. presence

• Question 1444:

  Which function is performed by vSmart in the Cisco SD-WAN architecture'?

  A. distribution of IPsec keys
  B. execution of localized policies
  C. redistribution between OMP and other routing protocols
  D. facilitation of NAT detection and traversal
  A. distribution of IPsec keys

  ---

  Explanation

  Authentication: As mentioned, the Cisco SD-WAN control plane contributes the underlying infrastructure for data plane security. In addition, authentication is enforced by two other mechanisms:

  In the traditional key exchange model, the Cisco vSmart Controller sends IPsec encryption keys to each edge device

  https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge-20-x/security-book/security-overview.html

• Question 1445:

  Refer to the exhibit.

  

  An engineer must ensure that all traffic entering AS 200 form AS 100 chooses link 2 as an entry point. Assume that all BGP neighbor relationship have been formed and that attributes have not been changed on any of the router.

  Which configuration accomplishes this task?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

• Question 1446:

  How does Cisco Trustsec enable more access controls for dynamic networking environments and data centers?

  A. uses flexible NetFlow
  B. assigns a VLAN to the endpoint
  C. classifies traffic based an the contextual identity of the endpoint rather than its IP address
  D. classifies traffic based on advanced application recognition
  C. classifies traffic based an the contextual identity of the endpoint rather than its IP address

  ---

  Explanation

  The Cisco TrustSec solution simplifies the provisioning and management of network access control through the use of software-defined segmentation to classify network traffic and enforce policies for more flexible access controls. Traffic classification is based on endpoint identity, not IP address, enabling policy change without net-work redesign.

• Question 1447:

  What Is the process for moving a virtual machine from one host machine to another with no downtime?

  A. high availability
  B. disaster recovery
  C. live migration
  D. multisite replication
  C. live migration

• Question 1448:

  When should the MAC authentication bypass feature be used on a switch port?

  A. when authentication is required, but the attached host does not support 802.1X
  B. when the attached host supports limited 802.1X
  C. when authentication should be bypassed for select hosts based on their MAC address
  D. when the attached host supports 802.1X and must authenticate itself based on its MAC address instead of user credentials
  A. when authentication is required, but the attached host does not support 802.1X

• Question 1449:

  In a Cisco SD-WAN network, which VPN Identifier is reserved for carrying out-of-band network management traffic?

  A. VPN 0
  B. VPN 1
  C. VPN 512
  D. VPN 514
  C. VPN 512

  ---

  Explanation

  VPN 0--Transport VPN, which carries control traffic via the configured WAN transport interfaces. Initially, VPN 0 contains all of a device's interfaces except for the management interface, and all interfaces are disabled. VPN 512--Management 512. By default, VPN 512 is configured and enabled on all vEdge routers except for vEdge

  100. For controller devices, by default, VPN 512 is not configured.

  VPNs 1 through 511, and 513 through 65530--VPNs on vEdge routers for service-side data traffic.

  https://www.cisco.com/c/en/us/support/docs/routers/12000-series-routers/47321-ciscoef.html

• Question 1450:

  DRAG DROP

  Drag and drop the description of the VSS technology from the left to the right. NOT all options are used.

  Select and Place: