Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 21:

  Which feature does Cisco TrustSec use to provide scalable, secure communication throughout a network?

  A. security group tag ACL assigned to each port on a switch
  B. security group tag number assigned to each port on a network
  C. security group tag number assigned to each user on a switch
  D. security group tag ACL assigned to each router on a network
  C. security group tag number assigned to each user on a switch

  ---

  Explanation

  Cisco TrustSec uses tags to represent logical group privilege. This tag, called a Security Group Tag (SGT), is used in access policies. The SGT is understood and is used to enforce traffic by Cisco switches, routers and firewalls . Cisco TrustSec is defined in three phases: classification, propagation and enforcement.

  When users and devices connect to a network, the network assigns a specific security group. This process is called classification. Classification can be based on the results of the authentication or by associating the SGT with an IP, VLAN, or port-profile (-> Answer 'security group tag ACL assigned to each port on a switch' and answer 'security group tag number assigned to each user on a switch' are not correct as they say "assigned ... on a switch" only. Answer 'security group tag ACL assigned to each router on a network' is not correct either as it says "assigned to each router").

  References:

  https://www.cisco.com/c/dam/en/us/solutions/collateral/borderless-networks/trustsec/C07-730151-00_overview_of_trustSec_og.pdf

• Question 22:

  Refer to the exhibit.

  

  The existing configuration must be updated to terminate EXEC sessions after 20 minutes of idle time.

  Which command set should be applied?

  A. line vty 015 session-timeout 20
  B. line vty 015 session-limit 20
  C. line vty 015 exec-timeout 20
  D. line vty 015 absolute-timeout 20
  C. line vty 015 exec-timeout 20

• Question 23:

  Refer to this content:

  Router# show runing-config

  ! lines omitted for brevity

  username cisco passsword 0 cisco

  aaa authentication login group1 group radius line line con 0 password 0 cisco123 login authentication group1 line vty 0 4 password 0 cisco111

  Authentication for users must first use RADIUS, and fall back to the local database on the router if the RADIUS server is unavailable

  Which two configuration sets are needed to achieve this result? (Choose two.)

  A. aaa authentication login group2 group radius none
  B. line vty 0 4 login authentication group2
  C. aaa authentication login group2 group radius enable
  D. aaa authentication login group2 group radius local
  E. line con 0 login authentication group2
  B. line vty 0 4 login authentication group2
  D. aaa authentication login group2 group radius local

• Question 24:

  Which feature allows HSRP to failover from the active route processor to the standby route processor without loss of data or path change?

  A. preemption
  B. IP SLA tracking
  C. stateful switchover
  D. HSRP tracking
  C. stateful switchover

• Question 25:

  Refer to the exhibit.

  

  Configure R3 according to the topology to achieve these results:

  1. Configure eBGP using Loopback0 for the router ID. Do not use the address-family command to accomplish this.

  2. Advertise R3's Loopback100 and Loopback200 networks to AS800 and AS900.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  R3

  enable

  configure terminal

  router bgp 900

  bgp router-id 10.3.3.3

  bgp log-neighbor-changes

  network 209.165.201.4 mask 255.255.255.255 network 209.165.201.5 mask 255.255.255.255 neighbor 209.165.200.230 remote-as 800 neighbor 209.165.202.130 remote-as 700 end copy running-config startup-config

  The BGP configuration matches the exhibit output: local AS 900, router ID 10.3.3.3, Loopback100 and Loopback200 advertised as /32 networks, and eBGP neighbors in AS800 and AS700.

  Verification show running-config | section bgp

  Expected output:

  router bgp 900

  bgp router-id 10.3.3.3

  bgp log-neighbor-changes

  network 209.165.201.4 mask 255.255.255.255

  network 209.165.201.5 mask 255.255.255.255

  neighbor 209.165.200.230 remote-as 800

  neighbor 209.165.202.130 remote-as 700

  show ip bgp summary

  Expected verification details:

  BGP router identifier 10.3.3.3, local AS number 900

  Neighbor Remote AS

  209.165.200.230 800

  209.165.202.130 700

  The verification exhibit confirms BGP router identifier 10.3.3.3, local AS 900, and both neighbors: 209.165.200.230 and 209.165.202.130.

• Question 26:

  Which function is performed by vSmart in the Cisco SD-WAN architecture?

  A. distribution of centralized policies
  B. execution of localized policies
  C. redistribution between OMP and other routing protocols
  D. facilitation of NAT detection and traversal
  A. distribution of centralized policies

• Question 27:

  Refer to the exhibit.

  

  What is the effect of these commands on the BR and HQ tunnel interfaces?

  

  A. The tunnel line protocol goes down when the keepalive counter reaches 6
  B. The keepalives are sent every 5 seconds and 3 retries
  C. The keepalives are sent every 3 seconds and 5 retries.
  D. The tunnel line protocol goes down when the keepalive counter reaches 5
  B. The keepalives are sent every 5 seconds and 3 retries

• Question 28:

  Which resource must the hypervisor make available to the virtual machines?

  A. bandwidth
  B. IP address
  C. processor
  D. secure access
  C. processor

• Question 29:

  Which cisco DNA center application is responsible for group-based access control permissions?

  A. Design
  B. Provision
  C. Assurance
  D. Policy
  D. Policy

  ---

  Explanation

  References:

  https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-3-1-0/user_guide/b_cisco_dna_center_ug_1_3_1_0/b_cisco_dna_center_ug_1_3_1_0_chapter_01011.html

• Question 30:

  A vulnerability assessment highlighted that remote access to the switches is permitted using unsecure and unencrypted protocols.

  Which configuration must be applied to allow only secure and reliable remote access for device administration?

  A. line vty 0 15 login local transport input none
  B. line vty 0 15 login local transport input telnet ssh
  C. line vty 0 15 login local transport input ssh
  D. line vty 0 15 login local transport input all
  C. line vty 0 15 login local transport input ssh