Cisco 350-401 Online Practice Questions and Exam Preparation

Cisco 350-401 Online Questions & Answers

• Question 911:

  An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available. Which configuration must be applied?

  A. aaa authorization exec default radius local
  B. aaa authorization exec default radius
  C. aaa authentication exec default radius local
  D. aaa authentication exec default radius
  A. aaa authorization exec default radius local

• Question 912:

  Refer to the exhibit

  

  Remote users cannot access the Internet but can upload files to the storage server.

  Which configuration must be applied to allow Internet access?

  A. ciscoasa(config)# access-list MAIL_AUTH extended permit udp any any eq httpciscoasa(config)# aaa authentication listener http outside redirect
  B. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq wwwciscoasa(config)# aaa authentication listener http inside redirect
  C. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq httpciscoasa(config)# aaa authentication listener http inside port 43
  D. ciscoasa(config)# access-list HTTP_AUTH extended permit udp any any eq httpciscoasa(config)# aaa authentication listener http outside port 43
  B. ciscoasa(config)# access-list MAIL_AUTH extended permit tcp any any eq wwwciscoasa(config)# aaa authentication listener http inside redirect

• Question 913:

  An engineer connects two switches together and notices that the connected interface on one of the switches is in an err-disabled state.

  The engineer then notices that BPDUGuard is enabled on the interface. How would you correct this?

  A. Switch(config)# interface x/xSwitch(config-if)# no spanning-tree bpduguard enableSwitch(config-if)# shutSwitch(config-if)# no shut
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. Switch(config)# interface x/xSwitch(config-if)# no spanning-tree bpduguard enableSwitch(config-if)# shutSwitch(config-if)# no shut

• Question 914:

  What is required for a VXLAN tunnel endpoint to operate?

  A. a VXLAN tunnel endpoint identifier
  B. at least one Layer 2 interface and one Layer 3 interlace
  C. at least one IP for the transit network and one IP for endpoint connectivity
  D. a VXLAN network identifier
  D. a VXLAN network identifier

• Question 915:

  Which router is elected the IGMP Querier when more than one router is in the same LAN segment?

  A. The router with the shortest uptime
  B. The router with the lowest IP address
  C. The router with the highest IP address
  D. The router with the longest uptime
  B. The router with the lowest IP address

  ---

  Explanation

  Query messages are used to elect the IGMP querier as follows: 1. When IGMPv2 devices start, they each multicast a general query message to the all-systems group address of 224.0.0.1 with their interface address in the source IP address field of the message. 2. When an IGMPv2 device receives a general query message, the device compares the source IP address in the message with its own interface address. The device with the lowest IP address on the subnet is elected the IGMP querier. 3. All devices (excluding the querier) start the query timer, which is reset whenever a general query message is received from the IGMP querier. If the query timer expires, it is assumed that the IGMP querier has gone down, and the election process is performed again to elect a new IGMP querier.

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-2_2_e/multicast/configuration_guide/b_mc_1522e_3750x_3560x_cg/b_ipmc_3750x_3560x_chapte r_01000.html

• Question 916:

  Refer to the exhibit.

  

  After configurating an IPsec VPN, an engineer enters the show command to verify the ISAKMP SA status. What does the status show?

  A. ISAKMP SA is authenticated and can be used for Quick Mode.
  B. Peers have exchanged keys, but ISAKMP SA remains unauthenticated.
  C. VPN peers agreed on parameters for the ISAKMP SA
  D. ISAKMP SA has been created, but it has not continued to form.
  A. ISAKMP SA is authenticated and can be used for Quick Mode.

  ---

  Explanation

  The ISAKMP SA has been authenticated. If the router initiated this exchange, this state transitions immediately to QM_IDLE, and a Quick Mode exchange begins.

  https://www.ciscopress.com/articles/article.asp?p=606584

• Question 917:

  Refer to the exhibit.

  

  An engineer is troubleshooting a connectivity issue and executes a traceoute. What does the result confirm?

  A. The destination server reported it is too busy
  B. The protocol is unreachable
  C. The destination port is unreachable
  D. The probe timed out
  D. The probe timed out

  ---

  Explanation

  In Cisco routers, the codes for a traceroute command reply are:

  ! -- success

  * -- time out N -- network unreachable H -- host unreachable P -- protocol unreachable A -- admin denied Q -- source quench received (congestion) ? -- unknown (any other ICMP message)

• Question 918:

  Refer to exhibit.

  

  VLANs 50 and 60 exist on the trunk links between all switches All access ports on SW3 are configured for VLAN 50 and SW1 is the VTP server.

  Which command ensures that SW3 receives frames only from VLAN 50?

  A. SW1 (config)#vtp pruning
  B. SW3(config)#vtp mode transparent
  C. SW2(config)=vtp pruning
  D. SW1 (config >tp mode transparent
  A. SW1 (config)#vtp pruning

  ---

  Explanation

  SW3 does not have VLAN 60 so it should not receive traffic for this VLAN (sent from SW2). Therefore we should configure VTP Pruning on SW3 so that SW2 does not forward VLAN 60 traffic to SW3. Also notice that we need to configure pruning on SW1 (the VTP Server), not SW2.

  https://www.orbit-computer-solutions.com/vtp-pruning/

• Question 919:

  By default, which virtual MAC address does HSRP group 22 use?

  A. c0:42:01:67:05:16
  B. c0:07:0c:ac:00:22
  C. 00:00:0c:07:ac:16
  D. 00:00:0c:07:ac:22
  C. 00:00:0c:07:ac:16

  ---

  Explanation

  hex 16 == (16x1) + 6 == 22

• Question 920:

  What is used to perform OoS packet classification?

  A. the Options field in the Layer 3 header
  B. the Type field in the Layer 2 frame
  C. the Flags field in the Layer 3 header
  D. the TOS field in the Layer 3 header
  D. the TOS field in the Layer 3 header

  ---

  Explanation

  Type of service, when we talk about PACKET, means layer 3