Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 491:

  What is a VPN in a Cisco SD-WAN deployment?

  A. common exchange point between two different services
  B. attribute to identify a set of services offered in specific places in the SD-WAN fabric
  C. virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric
  D. virtual channel used to carry control plane information
  C. virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric

  ---

  Explanation

  Ref: Cisco SD-WAN (Viptela) Configuration Guide, Release 18.1

  "...

  Segmentation (VPN) Overview

  This article illustrates the segmentation and VPN capabilities of the Viptela overlay network solution.

  Network segmentation has existed for over a decade and has been implemented in multiple forms and shapes. At its most rudimentary level, segmentation provides traffic isolation. The most common forms of network segmentation are virtual LANs, or VLANs, for Layer 2 solutions, and virtual routing and forwarding, or VRF, for Layer 3 solutions.

  ..."

• Question 492:

  Which device, in a LISP router architecture, receives LISP map requests and determines which ETR should handle the map request?

  A. proxy ETR
  B. routing locator
  C. map resolver
  D. map server
  C. map resolver

  ---

  Explanation

  LISP Map Resolver

  Like an MS, a LISP MR connects to the ALT. The function of the LISP MR is to accept encapsulated Map-Request messages from ingress tunnel routers (ITRs), decapsulate those messages, and then forward the messages to the MS responsible for the egress tunnel routers (ETRs) that are authoritative for the requested EIDs.

• Question 493:

  Refer to the exhibit.

  

  A network engineer configures OSPF and reviews the router configuration.

  Which interface or interfaces are able to establish OSPF adjacency?

  A. GigabitEthemet0/1 and GigabitEthernet0/1.40
  B. only GigabitEthernet0/1
  C. only GigabttEthernet0/0
  D. Gigabit Ethernet0/0 and GigabitEthemet0/1
  C. only GigabttEthernet0/0

• Question 494:

  Refer to the exhibit.

  

  What is achieved by this Python script?

  A. It reads access list statements into a dictionary list.
  B. It displays access list statements on a terminal screen.
  C. It configures access list statements.
  D. It converts access list statements to a human-readable format.
  A. It reads access list statements into a dictionary list.

• Question 495:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1. Refer to the Tasks tab to view the tasks for this lab item.

  2. Refer to the Topology tab to access the device console(s) and perform the tasks.

  3. Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4. All necessary preconfigurations have been applied.

  5. Do not change the enable password or hostname for any device.

  6. Save your configurations to NVRAM before moving to the next item.

  7. Click Next at the bottom of the screen to submit this lab and move to the next question.

  8. When Next is clicked, the lab closes and cannot be reopened.

  Topology

  

  Tasks

  

  A. See the solution below in Explanation.
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. See the solution below in Explanation.

  ---

  Explanation

  Solution:

  R2

  

  R3

  

• Question 496:

  Refer to the exhibit.

  

  A company requires that all wireless users authenticate using dynamic key generation.

  Which configuration must be applied?

  A. AP(config-if-ssid)# authentication open wep wep_methods
  B. AP(config-if-ssid)# authentication dynamic wep wep_methods
  C. AP(config-if-ssid)# authentication dynamic open wep_dynamic
  D. AP(config-if-ssid)# authentication open eap eap_methods
  D. AP(config-if-ssid)# authentication open eap eap_methods

• Question 497:

  Which method does Cisco DNA Center use to allow management of non-Cisco devices through southbound protocols?

  A. It creates device packs through the use of an SDK
  B. It uses an API call to interrogate the devices and register the returned data.
  C. It obtains MIBs from each vendor that details the APIs available.
  D. It imports available APIs for the non-Cisco device in a CSV format.
  A. It creates device packs through the use of an SDK

  ---

  Explanation

  Cisco DNA Center allows customers to manage their non-Cisco devices through the use of a Software Development Kit (SDK) that can be used to create Device Packages for third-party devices.

  References:

  https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/multivendor-support-southbound

• Question 498:

  Refer to the exhibit.

  

  An engineer must create a configuration that prevents R3 from receiving the LSA about 172.16.1.4/32.

  Which configuration set achieves this goal?

  A. On R3 ip access-list standard R4_L0 deny host 172.16.1.4 permit any router ospf 200 distribute-list R4_L0 in
  B. On R3 ip prefix-list INTO-AREA1 seq 5 deny 172.16.1.4/32 ip prefix-list INTO-AREA1 seq 10 permit 0.0.0.0/0 le 32 router ospf 200 area 1 filter-list prefix INTO-AREA 1 in
  C. On R1 ip prefix-list INTO-AREA1 seq 5 deny 172.16.1.4/32 ip prefix-list INTO-AREA 1 seq 10 permit 0.0.0.0/0 le 32 router ospf 200 area 1 filter-list prefix IN TO-AREA1 in
  D. On R1 ip prefix-list INTO-AREA1 seq 5 deny 172.16.1.4/32 ip prefix-list INTO-AREA1 seq 10 permit 0.0.0.0/0 le 32 router ospf 200 area 1 filter-list prefix INTO-AREA1 out
  C. On R1 ip prefix-list INTO-AREA1 seq 5 deny 172.16.1.4/32 ip prefix-list INTO-AREA 1 seq 10 permit 0.0.0.0/0 le 32 router ospf 200 area 1 filter-list prefix IN TO-AREA1 in

  ---

  Explanation

  in - Filters networks sent TO this area out - Filters network sent FROM this area

• Question 499:

  Which two mechanisms are available to secure NTP? (Choose two.)

  A. IP prefix list-based
  B. IPsec
  C. TACACS-based authentication
  D. IP access list-based
  E. Encrypted authentication
  D. IP access list-based
  E. Encrypted authentication

  ---

  Explanation

  The time kept on a machine is a critical resource and it is strongly recommend that you use the security features of NTP to avoid the accidental or malicious setting of incorrect time. The two security features available are an access list-based restriction scheme and an encrypted authentication mechanism.

  References:

  https://www.cisco.com/c/dam/en/us/td/docs/ios-xml/ios/bsm/configuration/xe-3se/3650/bsm-xe-3se-3650-book.html

• Question 500:

  Which deployment option of Cisco NGFW provides scalability?

  A. tap
  B. inline tap
  C. high availability
  D. clustering
  D. clustering

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/asa-cluster-solution.html

  Clustering lets you group multiple Firepower Threat Defense (FTD) units together as a single logical device. Clustering is only supported for the FTD device on the Firepower 9300 and the Firepower 4100 series. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices.