Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 1461:

  Which benefit is offered by a cloud infrastructure deployment but is lacking in an on-premises deployment?

  A. efficient scalability
  B. virtualization
  C. storage capacity
  D. supported systems
  A. efficient scalability

• Question 1462:

  In a Cisco Software Defined Networking (SDN) architecture, what is used to describe the API communication between the SDN controller and the network elements (routers and switches) that it manages?

  A. Southbound API
  B. Northbound API
  C. Westbound API
  D. Eastbound API.
  A. Southbound API

• Question 1463:

  Refer to the exhibit.

  

  When this Python script, which uses the requests module to communicate with a network device, is executed, what is the anticipated result?

  A. The script retrieves device information by sending HTTP requests to the device's API endpoints.
  B. The script configures network device settings by establishing a secure connection with the device.
  C. The script establishes an SSH connection with the network device.
  D. The script parses JSON data received from the network device and formats it into a table.
  A. The script retrieves device information by sending HTTP requests to the device's API endpoints.

  ---

  Explanation

  The correct answer is Option A. The script retrieves device information by sending HTTP requests to the device's API endpoints.

  The script uses the Python requests library and sends an HTTP GET request:

  response = requests.get(url)

  The URL points to an API endpoint on the network device:

  http://<device_ip>/api/device/info

  This means the script:

  Builds a URL using the device IP address Sends an HTTP GET request to the device API Checks whether the response status code is 200 Returns the response as JSON if the request succeeds Prints the retrieved device information

  The script performs a read operation. It retrieves information from the device; it does not configure the device.

  Option B is incorrect because no POST, PUT, or PATCH request is used, and no secure connection or authentication is shown.

  Option C is incorrect because the script does not use SSH or SSH libraries such as Paramiko or Netmiko.

  Option D is incorrect because the script returns and prints JSON data, but it does not format the data into a table.

• Question 1464:

  What does the number in an NTP stratum level represent?

  A. The number of hops it takes to reach the master time server.
  B. The number of hops it takes to reach the authoritative time source.
  C. The amount of offset between the device clock and true time.
  D. The amount of drift between the device clock and true time.
  B. The number of hops it takes to reach the authoritative time source.

  ---

  Explanation

  NTP uses the concept of a stratum to describe how many hops (routers) away a machine is from an authoritative time source, usually a reference clock. A reference clock is a stratum 0 device that is assumed to be accurate and has little or no delay associated with it. Stratum 0 servers cannot be used on the network but they are directly connected to computers which then operate as stratum-1 servers. A stratum 1 time server acts as a primary network time standard.

  

• Question 1465:

  You need to implement a First Hop Redundancy Protocol (FHRP) in a dual stack (IPv4 and IPV6) environment that utilizes devices from multiple different vendors.

  Which protocol best meets these needs?

  A. HSRP
  B. GLBP
  C. VRRPv1
  D. VRRPv2
  D. VRRPv2

  ---

  Explanation

  You have to go with VRRP as the protocol must be vendor agnostic.

• Question 1466:

  Which WLC discovery method uses Cisco CAPWAP controller as an identifier?

  A. static configuration
  B. DHCP
  C. L3 broadcast
  D. DNS
  D. DNS

• Question 1467:

  DRAG DROP

  Drag and drop the LISP components from the left onto the function they perform on the right. Not all options are used.

  Select and Place:

  

  

  ---

  + accepts LISP encapsulated map requests: LISP map resolver + learns of EID prefix mapping entries from an ETR: LISP map server + receives traffic from LISP sites and sends it to non-LISP sites: LISP proxy ETR

  + receives packets from site-facing interfaces: LISP ITR ITR is the function that maps the destination EID to a destination RLOC and then encapsulates the original packet with an additional header that has the source IP address of the ITR RLOC and the destination IP address of the RLOC of an Egress Tunnel Router (ETR). After the encapsulation, the original packet become a LISP packet. ETR is the function that receives LISP encapsulated packets, decapsulates them and forwards to its local EIDs. This function also requires EID-to-RLOC mappings so we need to point out an "map-server" IP address and the key (password) for authentication. A LISP proxy ETR (PETR) implements ETR functions on behalf of non-LISP sites. A PETR is typically used when a LISP site needs to send traffic to non-LISP sites but the LISP site is connected through a service provider that does not accept no routable EIDs as packet sources. PETRs act just like ETRs but for EIDs that send traffic to destinations at non-LISP sites.

  Map Server (MS) processes the registration of authentication keys and EID-to-RLOC mappings. ETRs sends periodic Map-Register messages to all its configured

  Map Servers. Map Resolver (MR): a LISP component which accepts LISP Encapsulated Map Requests, typically from an ITR, quickly determines whether or not the destination IP address is part of the EID namespace

  References:

  https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Data_Center/DCI/5-0/LISPmobility/DCI_LISP_Host_Mobility/LISPmobile_2.html#:~:text=%E2%80%93%20Proxy%20ITR%20(PITR)%3A%20A,devices%20deployed%20at%20LISP%20sites.

• Question 1468:

  Which design principle slates that a user has no access by default to any resource, and unless a resource is explicitly granted, it should be denied?

  A. least privilege
  B. fail-safe defaults
  C. economy of mechanism
  D. complete mediation
  B. fail-safe defaults

  ---

  Explanation

  The Principle of Fail-Safe Defaults states that, unless a subject is given explicit access to an object, it should be denied access to that object

• Question 1469:

  What is a characteristic of a next-generation firewall?

  A. only required at the network perimeter
  B. required in each layer of the network
  C. filters traffic using Layer 3 and Layer 4 information only
  D. provides intrusion prevention
  D. provides intrusion prevention

  ---

  Explanation

  The feature set for NGFWs build upon traditional firewall features by including critical security functions like intrusion prevention, VPN, and anti-virus, and even encrypted web traffic inspection to help prevent packets containing malicious content from entering the network

• Question 1470:

  A newly installed spoke router is configured for DMVPN with the ip mtu 1400 command.

  Which configuration allows the spoke to use fragmentation with the maximum negotiated TCP MTU over GRE?

  A. ip tcp adjust-mss 1360 crypto ipsec fragmentation after-encryption
  B. ip tcp adjust-mss 1360 crypto ipsec fragmentation mtu-discovery
  C. ip tcp payload-mtu 1360 crypto ipsec fragmentation mtu-discovery
  D. ip tcp payload-mtu 1360 crypto ipsec fragmentation after-encryption
  A. ip tcp adjust-mss 1360 crypto ipsec fragmentation after-encryption

  ---

  Explanation

  There is no "ip tcp payload-mtu" command so the correct answer should be "ip tcp adjust-mss".

  Note: The "ip tcp adjust-mss 1360" command will signal the source and destination device during the three-way handshake to use the TCP MSS size of 1360 bytes so that if they create the full size packet there will still not be any drop/ fragmentation on the router.

  We tested with Cisco IOSv15.4 but could not find the "crypto ipsec fragmentation mtu-discovery" command.