Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 701:

  DRAG DROP

  Drag and drop the code snippets from the bottom onto the blanks in the code to construct a request that configures a deny rule on an access list.

  Select and Place:

  

  

• Question 702:

  Refer to the exhibit.

  

  An engineer must block all traffic from a router to its directly connected subnet 209.165.200.0/24. The engineer applies access control list EGRESS in the outbound direction on the GigabitEthernet0/0 interface of the router. However, the

  router can still ping hosts on the 209.165.200.0/24 subnet.

  Which explanation of this behavior is true?

  A. Access control lists that are applied outbound to a router interface do not affect traffic that is sourced from the router.
  B. Only standard access control lists can block traffic from a source IP address.
  C. After an access control list is applied to an interface, that interface must be shut and no shut for the access control list to take effect.
  D. The access control list must contain an explicit deny to block traffic from the router.
  A. Access control lists that are applied outbound to a router interface do not affect traffic that is sourced from the router.

  ---

  Explanation

  Locally (control plane) generated traffic goes from control plane directly to "tx-ring". That is different from processing/forwarding of Transit traffic. Please see the platform's "packet journey" session of Cisco Live or other documentation to see the different internal path & processing for: Transit, forus, exception, locally generated.

• Question 703:

  Which there application has the ability to make REST calls against Cisco DNA Center?

  A. API Explorer
  B. REST Explorer
  C. Postman
  D. Mozilla
  C. Postman

• Question 704:

  Refer to the exhibit.

  

  An engineer must create a configuration that executes the show run command and then terminates the session when user CCNP logs in.

  Which configuration change is required?

  A. Add the access-class keyword to the username command
  B. Add the access-class keyword to the aaa authentication command
  C. Add the autocommand keyword to the username command
  D. Add the autocommand keyword to the aaa authentication command
  C. Add the autocommand keyword to the username command

  ---

  Explanation

  The autocommand causes the specified command to be issued automatically after the user logs in. When the command is complete, the session is terminated. Because the command can be any length and can contain embedded spaces, commands using the autocommand keyword must be the last option on the line. In this specific question, we have to enter this line username CCNP autocommand show running-config.

• Question 705:

  Refer to the exhibit.

  

  An engineer must pull interface details from multiple devices in the network and print the management IP address for each device based on the JSON response. VLAN 100 is present on all switches and is used for management.

  Which line of code must be applied?

  A. print(json.dumps["TABLE_intf"]["ROW_intf"]["prefix"])
  B. print(json.dumps["TABLE_intf"]["ROW_intf"][2]["prefix"])
  C. print(json_object["TABLE_intf"]["ROW_intf"][1]["prefix"])
  D. print(json_object["TABLE_intf"]["ROW_intf"][0]["prefix"])
  D. print(json_object["TABLE_intf"]["ROW_intf"][0]["prefix"])

  ---

  Explanation

  The correct answer is Option D. print(json_object["TABLE_intf"]["ROW_intf"][0]["prefix"]).

  The command in the exhibit returns JSON output for interface information:

  cmd = "show ip int brief | json" json_reply = cli(cmd) json_object = json.loads(json_reply)

  The JSON structure contains a parent key named TABLE_intf, a child key named ROW_intf, and then a list of interface entries.

  The exhibit shows VLAN 100 first in the output. Since Python list indexes start at 0, VLAN 100 is accessed with:

  ["ROW_intf"][0]

  The management IP address is stored under the prefix field:

  print(json_object["TABLE_intf"]["ROW_intf"][0]["prefix"])

  Option A and Option B are incorrect because json.dumps is a function used to convert a Python object into a JSON string. It is not the parsed JSON object.

  Option C is incorrect because index [1] refers to the second interface entry, VLAN 200, not VLAN 100.

  Option D is correct because it uses the parsed object and selects the first interface entry, VLAN 100.

• Question 706:

  Which deployment option of Cisco NQFW provides scalability?

  A. clustering
  B. Inline tap
  C. high availability
  D. tap
  C. high availability

• Question 707:

  Which statement describes the IP and MAC allocation requirements for virtual machines on types 1 hypervisors?

  A. Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes.
  B. Each virtual machine requires a unique IP address but shares the MAC address with the physical server.
  C. Each virtual machines requires a unique IP address but shares the MAC address with the address of the physical server.
  D. Each virtual machine requires a unique MAC address but shares the IP address with the physical server.
  A. Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes.

  ---

  Explanation

  A virtual machine (VM) is a software emulation of a physical server with an operating system. From an application's point of view, the VM provides the look and feel of a real physical server, including all its components, such as CPU, memory, and network interface cards (NICs).

  The virtualization software that creates VMs and performs the hardware abstraction that allows multiple VMs to run concurrently is known as a hypervisor. There are two types of hypervisors: type 1 and type 2 hypervisor. In type 1 hypervisor (or native hypervisor), the hypervisor is installed directly on the physical server. Then instances of an operating system (OS) are installed on the hypervisor. Type 1 hypervisor has direct access to the hardware resources. Therefore they are more efficient than hosted architectures. Some examples of type 1 hypervisor are VMware vSphere/ESXi, Oracle VM Server, KVM and Microsoft Hyper-V. In contrast to type 1 hypervisor, a type 2 hypervisor (or hosted hypervisor) runs on top of an operating system and not the physical hardware directly. answer 'Each virtual machine requires a unique IP and MAC addresses to be able to reach to other nodes' big advantage of Type 2 hypervisors is that management console software is not required. Examples of type 2 hypervisor are VMware Workstation (which can run on Windows, Mac and Linux) or Microsoft Virtual PC (only runs on Windows).

  

• Question 708:

  Refer to the exhibit.

  

  A network engineer troubleshoots an issue with the port channel between SW1 and SW2.

  Which command resolves the issue?

  A. SW2(config-if)#switchport mode trunk
  B. SW1(config-if)#channel-group 10 mode active
  C. SW1(config-if)#channel-group 10 mode desirable
  D. SW2(config-if)#channel-group 10 mode on
  B. SW1(config-if)#channel-group 10 mode active

  ---

  Explanation

  B is correct for LACP.

• Question 709:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1. Refer to the Tasks tab to view the tasks for this lab item.

  2. Refer to the Topology tab to access the device console(s) and perform the tasks.

  3. Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4. All necessary preconfigurations have been applied.

  5. Do not change the enable password or hostname for any device.

  6. Save your configurations to NVRAM before moving to the next item.

  7. Click Next at the bottom of the screen to submit this lab and move to the next question.

  8. When Next is clicked, the lab closes and cannot be reopened.

  Topology

  

  Tasks

  

  A. See the solution below in Explanation.
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. See the solution below in Explanation.

  ---

  Explanation

  Solution:

  R22

  config t

  int tunn0

  vrf forwarding FINANCE

  ip add 10.11.22.2 255.255.255.0

  tunn so e0/0

  tunn dest 209.165.200.230

  no shut

  int et0/1

  vrf forward FINANCE

  ip add 10.22.22.1 255.255.255.252

  no shut

  ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

  

• Question 710:

  Which method of account authentication does OAuth 2.0 within REST APIs?

  A. username/role combination
  B. access tokens
  C. cookie authentication
  D. basic signature workflow
  B. access tokens

  ---

  Explanation

  The most common implementations of OAuth (OAuth 2.0) use one or both of these tokens:

  + access token: sent like an API key, it allows the application to access a user's data; optionally, access tokens can expire. + refresh token: optionally part of an OAuth flow, refresh tokens retrieve a new access token if they have expired.

  OAuth2 combines Authentication and Authorization to allow more sophisticated scope and validity control.

  References:

  https://www.cisco.com/c/en/us/td/docs/security/firepower/ftd-api/guide/ftd-rest-api/auth-ftd-rest-api.pdf