Medium — 350-401 Practice Quiz

Question 1

Two Catalyst switches, DSW1 and ASW1, are connected by a manually configured 802.1q trunk. Users in VLAN 1 on ASW1 can reach the network, but the switches log repeated '%CDP-4-NATIVE_VLAN_MISMATCH' messages every 60 seconds. On DSW1 the trunk port shows 'switchport trunk native vlan 99'; on ASW1 the same port shows 'switchport trunk native vlan 1'. Tagged VLANs 10 and 20 pass traffic correctly. What is the effect of this condition, and how should you resolve it?

Accepted Answer

Untagged frames can be leaked between VLAN 99 and VLAN 1, creating a potential VLAN-hopping risk; configure the same native VLAN on both trunk ends.

Answer

The trunk will go down; set both ends to 'switchport mode dynamic auto' so DTP renegotiates the native VLAN automatically.

Answer

Tagged VLANs 10 and 20 will be pruned; enable VTP pruning on both switches to restore connectivity.

Answer

The mismatch only affects CDP and is purely cosmetic; disable CDP on the trunk ports to stop the log messages with no other action needed.

Question 2

A network engineer configures AAA on a Catalyst switch to authenticate administrative logins against a RADIUS server. During a maintenance window the RADIUS server becomes unreachable, and the engineer is now completely locked out of the console and VTY lines even though a local username exists. The relevant configuration is: 'aaa authentication login default group radius'. Which change ensures the engineer can still log in with the local database when RADIUS is unreachable?

Accepted Answer

aaa authentication login default group radius local

Answer

aaa authentication login default local group radius

Answer

aaa authentication login default group radius none

Answer

aaa authentication login default enable group radius

Question 3

A network administrator wants junior technicians to log into a Catalyst switch and be able to run all show commands and clear counters, but NOT enter global configuration mode or reload the device. The administrator prefers a solution local to the device that avoids assigning each command an individual privilege level. Which approach best meets this requirement?

Accepted Answer

Configure a CLI parser view with 'parser view TECH' and associate only the permitted commands, then require Role-Based CLI access at login

Answer

Set 'privilege exec level 15 show' so technicians receive privilege level 15 automatically on login

Answer

Create a local user with 'username tech privilege 1' and rely on the default privilege 1 restrictions

Answer

Enable 'aaa authorization exec default none' so all commands are permitted without restriction

Question 4

A network automation team must choose an orchestration tool for a fleet of 400 Cisco IOS-XE routers. The security team has a strict policy prohibiting the installation of any persistent third-party software daemons on the network devices, and the devices already have SSH enabled for management. Which characteristic of an agentless orchestration tool best satisfies these requirements?

Accepted Answer

It connects to devices over existing protocols such as SSH or NETCONF without installing software on the managed nodes.

Answer

It requires a client process to be installed on each managed device to pull configuration from a central master.

Answer

It relies on a compiled binary agent that periodically checks in with a policy server every 30 minutes.

Answer

It mandates a dedicated management VLAN and a proprietary transport protocol on every managed router.

Question 5

A network engineer wants to proactively identify recurring client connectivity issues across a large campus without manually parsing individual device logs. Management asks for a solution that uses machine learning to establish baselines and flag anomalies against normal behavior. Which Cisco Catalyst Center (formerly Cisco DNA Center) capability specifically provides this AI-driven baseline comparison and anomaly detection?

Accepted Answer

AI Network Analytics with dynamic baselining and anomaly detection in Assurance

Answer

The Command Runner tool to push show commands to devices in bulk

Answer

Template Editor with day-N configuration provisioning

Answer

Plug and Play (PnP) for zero-touch device onboarding

Question 6

A network engineer is writing a Python script that calls the Cisco Catalyst Center Intent API endpoint GET /dna/intent/api/v1/network-device to retrieve the full inventory. The lab has 850 managed devices, but each API response only returns the first 500 devices. The engineer must retrieve all devices without changing the endpoint. What is the most appropriate way to obtain the remaining records?

Accepted Answer

Add the query parameters limit and offset to page through the results, incrementing offset on each subsequent request until all devices are returned

Answer

Change the Accept header to application/yang-data+json so the server returns the complete dataset in one response

Answer

Re-issue the request with an X-Auth-Token that has administrator privileges to remove the record cap

Answer

Switch the HTTP verb from GET to POST so the body can request more than 500 devices at once

Question 7

A network engineer is troubleshooting intermittent PPP authentication failures on a router that terminates hundreds of dialer sessions. Enabling 'debug ppp authentication' globally would overwhelm the console with output from all sessions. The engineer wants to capture debug output only for traffic related to interface Dialer1 without impacting other sessions. Which set of commands correctly restricts the debug output to only that interface?

Accepted Answer

Configure 'debug condition interface Dialer1' first, then enable 'debug ppp authentication'

Answer

Enable 'debug ppp authentication' first, then apply 'logging filter interface Dialer1'

Answer

Apply an access list matching Dialer1 traffic and reference it with 'debug ip packet detail'

Answer

Configure 'debug interface Dialer1 all' which automatically limits all debugs to that interface

Question 8

A network engineer notices that a Catalyst switch experiences high CPU utilization during a burst of ARP and routing protocol traffic directed at the device itself, causing management sessions to time out. The engineer wants to rate-limit traffic destined to the router's control plane without affecting transit data traffic. Which feature should be implemented to accomplish this?

Accepted Answer

Control Plane Policing (CoPP) applied to the control-plane interface

Answer

A port-based ACL applied inbound on all physical data interfaces

Answer

Storm control configured on the switch's access ports

Answer

QoS shaping applied to the WAN uplink egress queue

Question 9

A network engineer is hardening a Catalyst 9300 switch. Corporate policy requires that only the management subnet 10.50.10.0/24 be permitted to reach the device management plane, and that any denied management attempt be recorded for the SOC. The engineer has already configured SSHv2. Which additional configuration correctly restricts and logs remote management access to the VTY lines?

Accepted Answer

Create a standard ACL permitting 10.50.10.0/24 with a trailing 'deny any log' entry, then apply it under line vty 0 15 using 'access-class' inbound

Answer

Create an extended ACL permitting TCP from 10.50.10.0/24 to the device with a final 'deny ip any any log' entry, then apply it to a physical interface with 'ip access-group' inbound

Answer

Apply the standard ACL to line vty 0 15 using 'access-class' outbound so only the management subnet can be reached from the switch

Answer

Configure 'management-interface' under the VTY lines and reference the management subnet with 'permit 10.50.10.0 0.0.0.255' without any logging keyword

Question 10

During a security audit of a new Catalyst 9300 switch, you are asked to reduce the device's attack surface before it is placed into production. The switch currently has its factory-default configuration for management services. Which action most directly hardens the management plane by removing a plaintext, legacy remote-access protocol that transmits credentials in clear text?

Accepted Answer

Configure 'transport input ssh' on the VTY lines to disable Telnet access

Answer

Enable 'service password-encryption' globally to obscure passwords in the running config

Answer

Apply an access-class ACL to the VTY lines to restrict source IP ranges

Answer

Configure 'login block-for' to throttle repeated failed login attempts

Question 11

A network engineer connects two Catalyst switches with a single link and expects an 802.1Q trunk to form dynamically. On both switches the interface is configured with 'switchport mode dynamic auto' and no other switchport commands. After the link comes up, VLAN traffic from non-native VLANs is not passing between the switches. 'show interfaces switchport' on both sides shows the operational mode as 'static access'. What is the cause of this behavior?

Accepted Answer

Both interfaces are in dynamic auto mode, so neither actively initiates DTP negotiation and the link defaults to access mode.

Answer

DTP frames are being blocked because the native VLAN does not match on the two switches.

Answer

Dynamic auto requires 'switchport nonegotiate' on at least one side before a trunk can form.

Answer

The link formed an access port because dynamic auto always overrides dynamic desirable when both are configured.

Question 12

You are configuring eBGP between two directly connected routers, R1 and R2. R1 uses 'neighbor 10.1.1.2 remote-as 65002' pointing at R2's directly connected interface IP, and R2 uses 'neighbor 10.1.1.1 remote-as 65001'. However, an engineer changed R1 to peer with R2's Loopback0 address (192.168.2.2) instead, using 'neighbor 192.168.2.2 remote-as 65002' with a static route to reach the loopback. The session fails to establish. What is the MOST likely cause, and what corrects it?

Accepted Answer

eBGP packets are sent with a TTL of 1; peering to a loopback adds a hop, so 'neighbor 192.168.2.2 ebgp-multihop 2' (and matching update-source) is required

Answer

eBGP requires both peers to be in the same AS; change R2 to remote-as 65001 to match R1

Answer

eBGP does not support loopback peering under any circumstances; the only fix is to revert to the directly connected interface IPs

Answer

The loopback must be advertised via an IGP first; adding 'network 192.168.2.2' under BGP will restore the adjacency

Question 13

A network engineer manages an eBGP edge router (AS 65010) that advertises the 203.0.113.0/24 prefix to two directly connected upstream ISPs: ISP-A (AS 64500) via GigabitEthernet0/0 and ISP-B (AS 64501) via GigabitEthernet0/1. The company wants ISP-A to be the primary path for all INBOUND traffic to 203.0.113.0/24, using ISP-B only if the ISP-A link fails. The engineer cannot influence the ISPs' local policies. Which action taken on the edge router will best achieve this goal?

Accepted Answer

Apply an outbound route-map to the ISP-B neighbor that prepends the local AS multiple times to the AS-path of 203.0.113.0/24

Answer

Apply an outbound route-map to the ISP-A neighbor that sets a higher local-preference for 203.0.113.0/24

Answer

Apply an inbound route-map to the ISP-A neighbor that sets a higher weight for received routes

Answer

Apply an outbound route-map to the ISP-B neighbor that sets a lower MED for 203.0.113.0/24

Question 14

A network engineer writes an EEM applet named GATHER-STATE that should collect 'show tech-support' output and write it to flash whenever the engineer manually invokes it during a troubleshooting session, rather than being triggered automatically by any system event. Which event detector configuration statement should be used in the applet?

Accepted Answer

event none

Answer

event timer watchdog time 60

Answer

event syslog pattern ".*UPDOWN.*"

Answer

event cli pattern "show tech-support" sync yes

Question 15

A network engineer needs an EEM applet on a core switch that automatically bounces GigabitEthernet1/0/24 whenever the interface goes into an err-disabled state. The engineer wants the applet to trigger off the syslog message that is generated at that moment and then issue a shutdown followed by a no shutdown on the interface. Which EEM configuration correctly accomplishes this?

Accepted Answer

event manager applet RECOVER / event syslog pattern "%PM-4-ERR_DISABLE.*Gi1/0/24" / action 1.0 cli command "enable" / action 2.0 cli command "configure terminal" / action 3.0 cli command "interface Gi1/0/24" / action 4.0 cli command "shutdown" / action 5.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event timer watchdog time 60 / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "shutdown" / action 3.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event snmp oid 1.3.6.1.2.1.2.2.1.7 get-type exact entry-op eq entry-val 2 / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event cli pattern "shutdown" sync yes / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "no shutdown"

Question 16

A network engineer wants an IOS device to automatically archive its running configuration to a TFTP server every day at 2:00 AM without any manual intervention or external scheduler. Which EEM applet configuration correctly accomplishes this?

Accepted Answer

event manager applet DAILY-BACKUP with 'event timer cron cron-entry "0 2 * * *"' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Answer

event manager applet DAILY-BACKUP with 'event syslog pattern "CONFIG"' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Answer

event manager applet DAILY-BACKUP with 'event timer watchdog time 7200' followed by 'action 1.0 cli command "write memory"'

Answer

event manager applet DAILY-BACKUP with 'event none' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Question 17

A network engineer notices that a route in the EIGRP topology table shows no feasible successor after the primary path failed. The router sends queries to its neighbors and waits for replies before installing a new path. Which statement best explains why this behavior occurs and its consequence?

Accepted Answer

No neighbor met the feasibility condition, so DUAL places the route into the active state and queries neighbors, risking a stuck-in-active (SIA) condition if replies are delayed.

Answer

The router lost its adjacency, so it must rebuild the neighbor table using hello packets before any route can be reused.

Answer

The successor's reported distance was lower than the feasible distance, which caused DUAL to immediately promote the backup path without querying.

Answer

EIGRP summarization at the boundary removed the backup route, forcing the router to rely on a floating static route instead.

Question 18

A network engineer is documenting the differences between EIGRP and OSPF for a design review. Both protocols are being evaluated for a campus WAN with links of varying bandwidth. Which statement correctly describes a fundamental difference in how these two protocols select the best path?

Accepted Answer

EIGRP calculates its metric using bandwidth and delay by default, while OSPF uses a cost derived from a reference bandwidth divided by interface bandwidth.

Answer

OSPF uses a composite metric based on bandwidth and delay by default, while EIGRP uses cumulative cost derived only from interface bandwidth.

Answer

Both EIGRP and OSPF use hop count as the primary metric, but EIGRP allows a maximum of 255 hops while OSPF allows unlimited hops.

Answer

OSPF supports unequal-cost load balancing natively with the variance command, while EIGRP only supports equal-cost load balancing.

Question 19

A network engineer is evaluating whether to deploy EIGRP or OSPF in an enterprise campus. A key requirement is the fastest possible reconvergence after a primary path failure WITHOUT any recomputation delay, provided a precomputed loop-free backup path already exists in the topology. Which statement correctly compares how each protocol meets this requirement?

Accepted Answer

EIGRP can install a feasible successor immediately from its topology table, avoiding recomputation, whereas OSPF must run the SPF algorithm to recalculate the shortest-path tree.

Answer

OSPF installs a precomputed backup automatically from its link-state database, while EIGRP must rerun the DUAL algorithm for every failure.

Answer

Both protocols use precomputed backup paths identically, so convergence behavior is the same regardless of which is chosen.

Answer

EIGRP must flood a full topology update and rerun DUAL on all routers before installing any backup, making OSPF's SPF faster in this case.

Question 20

A network engineer is documenting the differences between EIGRP and OSPF for a design review. A senior architect asks how each protocol determines the best path and reacts to topology changes. Which statement accurately compares the two protocols?

Accepted Answer

EIGRP uses a composite metric (bandwidth and delay by default) and can use feasible successors for immediate failover, while OSPF calculates a cost based on interface bandwidth and runs the SPF algorithm to build its tree.

Answer

Both EIGRP and OSPF use the Dijkstra SPF algorithm, but EIGRP applies a composite metric while OSPF uses hop count as its metric.

Answer

OSPF maintains feasible successors as precomputed backup routes, whereas EIGRP must recompute the entire topology on every link failure.

Answer

EIGRP requires a hierarchical area design with a backbone area, while OSPF is a flat distance-vector protocol with no area concept.

Question 21

A network engineer is comparing routing protocol behavior on two identical routers. On Router-A running EIGRP and Router-B running OSPF, both connect the campus to remote branch networks. The engineer needs route summarization applied close to the source networks to minimize routing table size. Which statement correctly describes a fundamental difference between where these two protocols allow summarization to be configured?

Accepted Answer

EIGRP supports summarization on any interface of any router, while OSPF only supports summarization on ABRs (inter-area) and ASBRs (external routes).

Answer

OSPF supports summarization on any interface of any router, while EIGRP only allows summarization at area boundaries.

Answer

Both protocols only allow summarization on backbone-connected routers and cannot summarize on access-layer interfaces.

Answer

EIGRP can only summarize on the router originating the network, while OSPF summarizes automatically on every router by default.

Question 22

A network engineer is hardening a Catalyst switch and wants to protect privileged EXEC mode. The running configuration currently contains both 'enable password Cisco123' and 'enable secret Str0ngP@ss'. When the engineer types 'enable' at the user EXEC prompt, which behavior occurs, and why?

Accepted Answer

The switch accepts only 'Str0ngP@ss' because 'enable secret' takes precedence and is stored as an MD5 hash, overriding the weaker 'enable password'.

Answer

The switch accepts either 'Cisco123' or 'Str0ngP@ss' because both credentials remain valid for privileged access.

Answer

The switch accepts only 'Cisco123' because 'enable password' is checked first in the configuration order.

Answer

The switch rejects all access to privileged mode until one of the two conflicting commands is removed.

Question 23

A regional office is being redesigned. It currently has 3 access switches connecting to a pair of distribution switches, which in turn connect to a separate pair of core switches. The network team notes that the entire site fits in a single building with fewer than 400 users, and they want to reduce cost, cabling complexity, and the number of managed devices while maintaining redundancy. Which enterprise campus design change best satisfies these requirements?

Accepted Answer

Migrate to a collapsed core design by merging the core and distribution functions into a single redundant layer

Answer

Add a second set of core switches to build a full three-tier hierarchy with dedicated aggregation

Answer

Convert all access switches to Layer 3 routed ports connecting directly to the core, removing the distribution layer

Answer

Replace the distribution switches with a single non-redundant core switch to reduce device count

Question 24

A network engineer needs to capture traffic from a distribution switch in Building A and forward that mirrored traffic to a packet analyzer that resides on a subnet reachable only through a routed Layer 3 path in the data center. The source and destination are in different IP subnets separated by multiple router hops. Which monitoring feature must the engineer configure to accomplish this?

Accepted Answer

ERSPAN, which encapsulates the mirrored traffic in GRE and routes it to the destination IP

Answer

Local SPAN with the source and destination ports on the same switch

Answer

RSPAN using a dedicated reflector VLAN trunked across the Layer 2 domain

Answer

Flexible NetFlow exporting flow records to the analyzer via UDP

Question 25

A network engineer is configuring ERSPAN on a Catalyst switch to send a copy of traffic from GigabitEthernet1/0/10 to a monitoring appliance located across a routed Layer 3 network at IP address 10.50.50.100. The engineer has entered the following on the source switch:

monitor session 1 type erspan-source
 source interface Gi1/0/10
 destination
  erspan-id 100
  ip address 10.50.50.100

After committing the configuration, no traffic is arriving at the monitoring appliance. Which additional configuration step under the destination sub-mode is required for the ERSPAN session to become operational?

Accepted Answer

Configure the 'origin ip address' with a local routable source IP for the GRE-encapsulated ERSPAN packets

Answer

Configure a 'filter vlan' statement to restrict which VLANs are captured on the source interface

Answer

Change the session type to 'erspan-destination' so the switch can forward the mirrored frames

Answer

Add a 'source remote ip address 10.50.50.100' command so the switch learns the appliance route