Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 221:

  Refer to the exhibit.

  

  A network engineer must simplify the IPsec configuration by enabling IPsec over GRE using IPsec profiles.

  Which two configuration changes accomplish this? (Choose two).

  A. Create an IPsec profile, associate the transform-set ACL, and apply the profile to the tunnel interface.
  B. Apply the crypto map to the tunnel interface and change the tunnel mode to tunnel mode ipsec ipv4.
  C. Remove all configuration related to crypto map from R1 and R2 and eliminate the ACL.
  D. Create an IPsec profile, associate the transform-set, and apply the profile to the tunnel interface.
  E. Remove the crypto map and modify the ACL to allow traffic between 10.10.0.0/24 to 10.20.0.0/24.
  C. Remove all configuration related to crypto map from R1 and R2 and eliminate the ACL.
  D. Create an IPsec profile, associate the transform-set, and apply the profile to the tunnel interface.

  ---

  Explanation

  A is wrong, you don't use a "transform-set ACL"

  B is wrong. question states use IPsec profiles. Crypto maps was the old way of doing ipsec tunnels before profiles.

  C is correct, need to remove crypto map config or it will cause some confusion if the tunnel profile is applied. Didn't lab it up, but book references this. D is correct, all you need to do is create a profile and associate the transform-set to this profile, then apply it to the tunnel. If no transform set was created you would have to create one. E is wrong, i believe removing crypto map would cause the traffic to flow unencrypted over the tunnel. acl in this case is to match the interesting traffic to be encrypted. it's denying it.

• Question 222:

  What are three valid HSRP states? (Choose three)

  A. INIT
  B. listen
  C. full
  D. learning
  E. speak
  F. established
  A. INIT
  B. listen
  E. speak

  ---

  Explanation

  HSRP StatesWhen in operation, HSRP devices are configured into one of many states: Active ?This is the state of the device that is actively forwarding traffic.

  Init or Disabled ?This is the state of a device that is not yet ready or able to participate in HSRP.

  Learn ?This is the state of a device that has not yet determined the virtual IP address and has not yet seen a hello message from an active device.

  Listen ?This is the state of a device that is receiving hello messages.

  Speak ?This is the state of a device that is sending and receiving hello messages.

  Standby ?This is the state of a device that is prepared to take over the traffic forwarding duties from the active device.

• Question 223:

  DRAG DROP

  An engineer plans to use Python to convert text files that contain device information to JSON Drag and drop the code snippets from the bottom onto the blanks in the code to construct the request. Not all options are used.

  Select and Place:

  

  

• Question 224:

  Refer to the exhibit.

  

  What are two effects of this configuration? (Choose two.)

  A. R1 becomes the active router.
  B. If R1 goes down, R2 becomes active but reverts to standby when R1 comes back online.
  C. R1 becomes the standby router
  D. If R2 goes down, R1 becomes active but reverts to standby when R2 comes back online.
  E. If R1 goes down, R2 becomes active and remains the active device when R1 comes back online.
  A. R1 becomes the active router.
  E. If R1 goes down, R2 becomes active and remains the active device when R1 comes back online.

  ---

  Explanation

  router with higher priority will become active, without preempt r1 will not become active after come online. preempt is not a default command with hsrp

• Question 225:

  Refer to the exhibit.

  

  The inside and outside interfaces in the NAT configuration of this device have been correctly identified.

  What is the effect of this configuration?

  A. dynamic NAT
  B. NAT64
  C. PAT
  D. static NAT
  C. PAT

  ---

  Explanation

  The command "ip nat inside source list 1 interface gigabitethernet0/0 overload" translates all source addresses that pass access list 1, which means 172.16.1.0/24 subnet, into an address assigned to gigabitethernet0/0 interface. Overload keyword allows to map multiple IP addresses to a single registered IP address (many-to-one) by using different ports so it is called Port Address Translation (PAT).

• Question 226:

  What is the primary responsibility of the vBond orchestrator?

  A. to provide centralized management and provisioning of all elements into the network
  B. to configure NAT communication on WAN Edge routers
  C. to provide configuration synchronization of an WAN Edge devices
  D. to facilitate start-up by performing authentication and authorization of all elements into the network
  D. to facilitate start-up by performing authentication and authorization of all elements into the network

• Question 227:

  What are two benefits of implementing a traditional WAN instead of an SD-WAN solution? (Choose two.)

  A. comprehensive configuration standardization
  B. lower control plane abstraction
  C. simplify troubleshooting
  D. faster fault detection
  E. lower data plane overhead
  B. lower control plane abstraction
  E. lower data plane overhead

  ---

  Explanation

  The provided answers are for the benefits of SD-WAN compared to traditional WAN

• Question 228:

  What is the function of vBond in a Cisco SDWAN deployment?

  A. initiating connections with SD-WAN routers automatically
  B. pushing of configuration toward SD-WAN routers
  C. onboarding of SD-WAN routers into the SD-WAN overlay
  D. gathering telemetry data from SD-WAN routers
  C. onboarding of SD-WAN routers into the SD-WAN overlay

  ---

  Explanation

  Orchestration plane (vBond) assists in securely onboarding the SD-WAN WAN Edge routers into the SD-WAN overlay.

  References:

  https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-wan-edge-onboarding-deploy-guide-2020nov.pdf

• Question 229:

  A network monitoring system uses SNMP polling to record the statistics of router interfaces. The SNMP queries work as expected until an engineer installs a new interface and reloads the router. After this action, all SNMP queries for the

  router fail.

  What is the cause of this issue?

  A. The SNMP community is configured incorrectly
  B. The SNMP interface index changed after reboot.
  C. The SNMP server traps are disabled for the interface index
  D. The SNMP server traps are disabled for the link state.
  B. The SNMP interface index changed after reboot.

  ---

  Explanation

  In order to tell IOS to keep ifindex value unchanged even after reboot, use the "snmp-server ifindex persist" command

• Question 230:

  On which protocol or technology is the fabric data plane based in Cisco SD-Access fabric?

  A. LISP
  B. IS-IS
  C. Cisco TrustSec
  D. VXLAN
  D. VXLAN

  ---

  Explanation

  The tunneling technology used for the fabric data plane is based on Virtual Extensible LAN (VXLAN). VXLAN encapsulation is UDP based, meaning that it can be forwarded by any IP-based network (legacy or third party) and creates the overlay network for the SD-Access fabric. Although LISP is the control plane for the SD-Access fabric, it does not use LISP data encapsulation for the data plane; instead, it uses VXLAN encapsulation because it is capable of encapsulating the original Ethernet header to perform MAC-in-IP encapsulation, while LISP does not. Using VXLAN allows the SD-Access fabric to support Layer 2 and Layer 3 virtual topologies (overlays) and the ability to operate over any IP-based network with built-in network segmentation (VRF instance/VN) and built-in group-based policy.

  References:

  CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide