Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 871:

  Which two mechanisms are used with OAuth 2.0 for enhanced validation? (Choose two.)

  A. authorization
  B. custom headers
  C. request management
  D. authentication
  E. accounting
  A. authorization
  D. authentication

• Question 872:

  What are two benefit of virtualizing the server with the use of VMs in data center environment? (Choose two.)

  A. Increased security
  B. reduced rack space, power, and cooling requirements
  C. reduced IP and MAC address requirements
  D. speedy deployment
  E. smaller Layer 2 domain
  B. reduced rack space, power, and cooling requirements
  D. speedy deployment

  ---

  Explanation

  Server virtualization and the use of virtual machines is profoundly changing data center dynamics. Most organizations are struggling with the cost and complexity of hosting multiple physical servers in their data centers. The expansion of the data center, a result of both scale-out server architectures and traditional "one application, one server" sprawl, has created problems in housing, powering, and cooling large numbers of underutilized servers. In addition, IT organizations continue to deal with the traditional cost and operational challenges of matching server resources to organizational needs that seem fickle and ever changing. Virtual machines can significantly mitigate many of these challenges by enabling multiple application and operating system environments to be hosted on a single physical server while maintaining complete isolation between the guest operating systems and their respective applications. Hence, server virtualization facilitates server consolidation by enabling organizations to exchange a number of underutilized servers for a single highly utilized server running multiple virtual machines.

  By consolidating multiple physical servers, organizations can gain several benefits: + Underutilized servers can be retired or redeployed.

  + Rack space can be reclaimed.

  + Power and cooling loads can be reduced.

  + New virtual servers can be rapidly deployed.

  + CapEx (higher utilization means fewer servers need to be purchased) and OpEx (few servers means a simpler environment and lower maintenance costs) can be reduced.

  References:

  https://www.cisco.com/c/en/us/solutions/collateral/data-centervirtualization/net_implementation_white_paper0900aecd806a9c05.html

• Question 873:

  Refer to the exhibit.

  

  A network engineer must be notified when a user switches to configuration mode.

  Which script should be applied to receive an SNMP trap and a critical-level log message?

  A. action 1.0 snmp-trap strdata "Configuration change alarm" action 1.0 syslog priority critical msg "Configuration change alarm"
  B. action 1.0 snmp-trap strdata "Configuration change alarm" action 2.0 syslog msg "Configuration change alarm"
  C. action 1.0 snmp-trap strdata "Configuration change alarm" action 1.1 syslog priority critical msg "Configuration change alarm"
  D. action 1.0 snmp-trap strdata "Configuration change critical alarm"
  C. action 1.0 snmp-trap strdata "Configuration change alarm" action 1.1 syslog priority critical msg "Configuration change alarm"

• Question 874:

  SIMULATION

  Guidelines

  This is a lab item in which tasks will be performed on virtual devices.

  1. Refer to the Tasks tab to view the tasks for this lab item.

  2. Refer to the Topology tab to access the device console(s) and perform the tasks.

  3. Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.

  4. All necessary preconfigurations have been applied.

  5. Do not change the enable password or hostname for any device.

  6. Save your configurations to NVRAM before moving to the next item.

  7. Click Next at the bottom of the screen to submit this lab and move to the next question.

  8. When Next is clicked, the lab closes and cannot be reopened.

  Tasks

  Implement GLBP between DISTRO-SW1 and DISTRO-SW2 on VLAN100 for hosts connected to ACCESS-SW1 to achieve these goals:

  1. Configure group 30 using the virtual IP address of 192.168.1.254.

  2. Configure DISTRO-SW1 as the AVG using a priority value of 130.

  3. If DISTRO-SW1 suffers a failure and recovers, ensure that it automatically resumes the AVG role after waiting for a minimum of 35 seconds.

  Topology

  

  A. See the solution below in Explanation.
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. See the solution below in Explanation.

  ---

  Explanation

  DISTRO-SW1

  int vlan 100

  glbp 30 ip 192.168.1.254

  glbp 30 priority 130

  glbp 30 timers 5 35

  glbp 30 preempt

  copy run start

  DISTRO-SW2

  int vlan 100

  glbp 30 ip 192.168.1.254

  glbp 30 timers 5 35

  glbp 30 preempt

  copy rum start

• Question 875:

  

  Refer to the exhibit.

  What is output by this code?

  A. -1 -2 -3 -4
  B. 8 7 6 5
  C. 4 5 6 7
  D. -4 -5 -6 -7
  B. 8 7 6 5

• Question 876:

  Refer to the exhibit.

  

  What is required to configure a second export destination for IP address 192.168.10.1?

  A. Specify a VRF.
  B. Specify a different UDP port.
  C. Specify a different flow ID
  D. Configure a version 5 flow-export to the same destination.
  E. Specify a different TCP port.
  B. Specify a different UDP port.

  ---

  Explanation

  To configure multiple NetFlow export destinations to a router, use the following commands in global configuration mode: Step 1: Router(config)# ip flow-export destination ip-address udp-port

  Step 2: Router(config)# ip flow-export destination ip-address udp-port

  The following example enables the exporting of information in NetFlow cache entries:

  ip flow-export destination 10.42.42.1 9991

  ip flow-export destination 10.0.101.254 1999

  References:

  https://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/12s_mdnf.html

• Question 877:

  Refer to the exhibit.

  

  Which configuration set implements Control plane Policing for SSH and Telnet?

  A. Router(config)#/class-map match-all class-control Router(config-cmap)#match access-group 100 Router(config-cmap)#match access-group 101 Router(config)#policy-map COPP Router(config-pmap)#class class-control Router(config-pmap-c)#police 1000000 conform-action transmit Router(config)#control-plane Router(config-cp)#service-policy output CoPP
  B. Router(config)#class-map type inspect match-all Router(config-cmap)#match access-group 100 Router(config-cmap)#match access-group 101 Router(config)#policy-map CoPP Router(config-pmap)#class class-control Router(config-pmap-c)#police 1000000 conform-action transmit Router(config)#control-plane Router(config-cp)#service-policy output CoPP
  C. Router(config)#class-map class-telnet Router(config-cmap)#match access-group 100 Router(config)#class-map class-ssh Router(config-cmap)#match access-group 101 Router(config)#policy-map CoPP Router(config-pmap)#class class-telnet-ssh Router(config-pmap-c)#police 1000000 conform-action transmit Router(config)#control-plane Router(config-cp)#service-policy input CoPP
  D. Router(config)#class-map match-any class-control Router(config-cmap)#match access-group 100 Router(config-cmap)#match access-group 101 Router(config)#policy-map CoPP Router(config-pmap)#class class-control Router(config-pmap-c)#police 1000000 conform-action transmit Router(config)#control-plane Router(config-cp)#service-policy input CoPP
  D. Router(config)#class-map match-any class-control Router(config-cmap)#match access-group 100 Router(config-cmap)#match access-group 101 Router(config)#policy-map CoPP Router(config-pmap)#class class-control Router(config-pmap-c)#police 1000000 conform-action transmit Router(config)#control-plane Router(config-cp)#service-policy input CoPP

• Question 878:

  Which nodes require VXLAN encapsulation support In a Cisco SD-Access deployment?

  A. core nodes
  B. distribution nodes
  C. border nodes
  D. aggregation nodes
  C. border nodes

• Question 879:

  Refer to the exhibit.

  

  Router A in AS 65002 and Router B in AS 65001 must establish a BGP peering relationship across the 10.0.1.0/24 network.

  Which configuration should be applied on Router B to establish the BGP neighbor relationship with Router A?

  A. router bgp 65002 neighbor 10.0.1.2 remote-as 65002 network 10.0.2.0 255.255.255.0
  B. router bgp 65001 neighbor 10.0.1.2 remote-as 65002 redistribute static
  C. router bgp 65001 neighbor 10.0.1.2 remote-as 65002 network 10.0.1.0 255.255.255.0
  D. router bgp 65001 neighbor 10.0.1.2 remote-as 65002 network 10.0.2.0 255.255.255.0
  D. router bgp 65001 neighbor 10.0.1.2 remote-as 65002 network 10.0.2.0 255.255.255.0

• Question 880:

  What is a characteristic of MACsec?

  A. 802.1AE provides encryption and authentication services
  B. 802.1AE is bult between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802 1X session
  C. 802.1AE is bult between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)
  D. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol
  B. 802.1AE is bult between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802 1X session

  ---

  Explanation

  MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out-of-band methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework.

  References:

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-9/configuration_guide/sec/b_169_sec_9300_cg/macsec_encryption.html