Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 871:

  Refer to the exhibit.

  

  Link1 is a copper connection and Link2 is a fiber connection. The fiber port must be the primary port for all forwarding. The output of the show spanning-tree command on SW2 shows that the fiber port is blocked by spanning tree. An engineer enters the spanning-tree port-priority 32 command on G0/1 on SW2, but the port remains blocked.

  Which command should be entered on the ports that are connected to Link2 to resolve the issue?

  A. Enter spanning-tree port-priority 32 on SW1.
  B. Enter spanning-tree port-priority 224 on SW1.
  C. Enter spanning-tree port-priority 4 on SW2.
  D. Enter spanning-tree port-priority 64 on SW2.
  A. Enter spanning-tree port-priority 32 on SW1.

  ---

  Explanation

  SW1 needs to block one of its ports to SW2 to avoid a bridging loop between the two switches. Unfortunately, it blocked the fiber port Link2. But how does SW2 select its blocked port? Well, the answer is based on the BPDUs it receives from SW1. answer 'Enter spanning-tree port-priority 32 on SW1' BPDU is superior than another if it has:

  1. answer 'Enter spanning-tree port-priority 32 on SW1' lower Root Bridge ID 2. answer 'Enter spanning-tree port-priority 32 on SW1' lower path cost to the Root 3. answer 'Enter spanning-tree port-priority 32 on SW1' lower Sending Bridge ID 4. answer 'Enter spanning-tree port-priority 32 on SW1' lower Sending Port ID These four parameters are examined in order. In this specific case, all the BPDUs sent by SW1 have the same Root Bridge ID, the same path cost to the Root and the same Sending Bridge ID. The only parameter left to select the best one is the Sending Port ID (Port ID = port priority + port index). And the port index of Gi0/0 is lower than the port index of Gi0/1 so Link 1 has been chosen as the primary link.

  Therefore we must change the port priority to change the primary link. The lower numerical value of port priority, the higher priority that port has. In other words, we must change the port-priority on Gi0/1 of SW1 (not on Gi0/1 of SW2) to a lower value than that of Gi0/0.

• Question 872:

  Refer to the exhibit.

  

  An engineer reconfigures the port-channel between SW1 and SW2 from an access port to a trunk and immediately notices this error in SW1's log:

  *Mar 1 09:47:22.245: %PM-4-ERR_DISABLE: bpduguard error detected on Gi0/0, putting Gi0/0 in err-disable state

  Which command set resolves this error?

  A. SW1(config-if)#interface G0/0SW1(config-if)#no spanning-tree bpdufilterSW1(config-if)#shutSW1(config-if)#no shut
  B. SW1(config-if)#interface G0/0SW1(config-if)#no spanning-tree bpduguard enableSW1(config-if)#shutSW1(config-if)#no shut
  C. SW1(config-if)#interface G0/0SW1(config-if)#spanning-tree bpduguard enableSW1(config-if)#shutSW1(config-if)#no shut
  D. SW1(config-if)#interface G0/1SW1(config-if)#spanning-tree bpduguard enableSW1(config-if)#shutSW1(config-if)#no shut
  B. SW1(config-if)#interface G0/0SW1(config-if)#no spanning-tree bpduguard enableSW1(config-if)#shutSW1(config-if)#no shut

• Question 873:

  What is a fact about Cisco EAP-FAST?

  A. It does not require a RADIUS server certificate.
  B. It requires a client certificate.
  C. It is an IETF standard.
  D. It operates in transparent mode.
  A. It does not require a RADIUS server certificate.

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99791-eapfast-wlc-rad-config.html

• Question 874:

  DRAG DROP

  Drag and drop the QoS mechanisms from the left onto their descriptions on the right.

  Select and Place:

  

  

• Question 875:

  Refer to the exhibit. An engineer must advertise routes into IPv6 MP-BGP and failed. Which configuration resolves the issue on R1?

  

  A. router bgp 65000no bgp default ipv4-unicastaddress-family ipv6 multicastnetwork 2001:DB8::/64
  B. router bgp 65000no bgp default ipv4-unicastaddress-family ipv6 unicastnetwork 2001:DB8::/64
  C. router bgp 64900no bgp default ipv4-unicastaddress-family ipv6 multicastneighbor 2001:DB8:7000::2 translate-update ipv6 multicast
  D. router bgp 64900no bgp default ipv4-unicastaddress-family ipv6 unicastredistribute ospfnetwork 2001:DB9::/64
  A. router bgp 65000no bgp default ipv4-unicastaddress-family ipv6 multicastnetwork 2001:DB8::/64

• Question 876:

  Refer to the exhibit

  

  An engineer is troubleshooting a newly configured BGP peering that does not establish

  What is the reason for the failure?

  A. BGP peer 10 255 255 3 is not configured for peenng wth R1
  B. Mandatory BOP parameters between R1 and 10 255 255 3 are mismatched
  C. A firewall is blocking access to TCP port 179 on the BGP peer 10 255 255.3
  D. Both BGP pern are configured for passive TCP transport
  A. BGP peer 10 255 255 3 is not configured for peenng wth R1

• Question 877:

  Which JSON script is properly formatted?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

• Question 878:

  Which two mechanisms are used with OAuth 2.0 for enhanced validation? (Choose two.)

  A. authorization
  B. custom headers
  C. request management
  D. authentication
  E. accounting
  A. authorization
  D. authentication

• Question 879:

  What is provided by the Stealthwatch component of the Cisco Cyber Threat Defense solution?

  A. real-time threat management to stop DDoS attacks to the core and access networks
  B. real-time awareness of users, devices and traffic on the network
  C. malware control
  D. dynamic threat control for web traffic
  B. real-time awareness of users, devices and traffic on the network

  ---

  Explanation

  Cisco Stealthwatch is a comprehensive, network telemetry-based, security monitoring and analytics solution that streamlines incident response through behavioral analysis; detecting denial of service attacks, anomalous behaviour, malicious activity and insider threats. Based on a scalable enterprise architecture, Stealthwatch provides near real-time situational awareness of all users and devices on the network.

  https://www.endace.com/cisco-stealthwatch-solution-brief.pdf

  Note: Although answer A seems to be correct but in fact, Stealthwatch does not provide real-time protection for DDoS attack. It just helps detect DDoS attack only.

  Stealthwatch aggregates observed network activity and performs behavioral and policy driven analytics against what it sees in order to surface problematic activities. While we don't position our self as a DDOS solution, we're going to leverage our analytical capabilities to identify a DDoS attack against an internal host using the WebUI.

  https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2016/pdf/LTRSEC-8421-LG.pdf

• Question 880:

  Refer to the exhibit. An engineer has configured Cisco ISE to assign VLANs to clients based on their method of authentication, but this is not working as expected.

  Which action will resolve this issue?

  

  A. enable AAA override
  B. utilize RADIUS profiling
  C. require a DHCP address assignment
  D. set a NAC state
  B. utilize RADIUS profiling

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010110111.html