350-401 practice questions 901–910

1. Question 901 · 1003 in bank

   

   Refer to the exhibit. What is the result of the NTP configuration?

   • AThe router will use the address of loppback 0 to communicate with the NTP server.
   • BThe router will advertise but not listen to NTP broadcast packets.
   • CThe router will be used as an NTP authoritative server only if it synchronized with an outside source.
   • DThe router will be used as an NTP authoritative server, even if it is not synchronized with an outside source.

   Show answer

   Answer: D

   Explanation

   https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/command/bsm-cr-book/bsm-cr-n1.html#wp1522568655 Because the Cisco implementation of NTP does not support directly attached radio or atomic clocks, the router is normally synchronized, directly or indirectly, to an external system that has such a clock. In a network without Internet connectivity, such a time source may not be available. The ntp master command is used in such cases. To configure the Cisco IOS software as a Network Time Protocol (NTP) master clock to which peers synchronize themselves when an external NTP source is not available, use the ntp master command in global configuration mode.

   Source: Adapted from community discussion — Mistwalker

   References

   • Cisco documentation

   Next question

2. Question 902 · 1003 in bank

   

   Refer to the exhibit. An engineer must create a manually triggered EEM applet to enable the R2 router interface and assign an IP address to it. What is required to complete this configuration?

   • AR2(config-apple)#action 4 cli command “ip add 172.16.1.1 0.0.0.255”
   • BR2(config)# event manager session cli username
   • CR2(config-applet)# event oir
   • DR2(config-applet)# event none sync yes

   Show answer

   Answer: D

   Explanation

   Key word: manually https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-e1.html "EEM usually schedules and runs policies on the basis of an event specification that is contained within the policy itself. The event manager run command allows policies to be run manually. The event none command must first be configured to run the policy manually."

   Source: Adapted from community discussion — Mistwalker

   References

   • Cisco documentation

   Next question

3. Question 903 · 1003 in bank

   What is stateful switchover?

   • Acluster protocol used to facilitate switch failover
   • Bmechanism to take control from a failed RP while maintaining connectivity
   • Cmechanism used to prevent routing protocol loops during an RP switchover
   • DFirst Hop Redundancy Protocol for host gateway connectivity

   Show answer

   Answer: B

   Explanation

   Stateful switchover (SSO) is a mechanism used to take control from a failed Route Processor (RP) while maintaining connectivity in a networking device, such as a router or switch. It ensures that the standby RP is ready to take over processing duties immediately in the event of an RP failure, minimizing disruption to network services.

   Source: Adapted from community discussion — slacker_at_work

   Next question

4. Question 904 · 1003 in bank

   Select 2

   Which two features are available only in next-generation firewalls? (Choose two.)

   • Aapplication awareness
   • Bpacket filtering
   • Cstateful inspection
   • Ddeep packet inspection
   • Evirtual private network

   Show answer

   Answer: AD

   Explanation

   A. Application awareness: NGFWs have the ability to identify and control applications running over the network, allowing for more granular control and security policies based on specific applications. D. Deep packet inspection (DPI): NGFWs perform DPI to analyze the contents of packets beyond their headers, allowing them to detect and block advanced threats, malware, and other suspicious activities within the network traffic. Packet filtering (B), stateful inspection (C), and virtual private network (E) capabilities are not exclusive to NGFWs and can also be found in traditional firewalls.

   Source: Adapted from community discussion — supershysherlock

   Next question

5. Question 905 · 1003 in bank

   

   Refer to the exhibit. Which result is achieved by the CoPP configuration?

   • ATraffic that matches entry 10 of ACL 100 is always dropped.
   • BClass-default is dropped.
   • CTraffic that matches entry 10 of ACL 100 is always allowed with a limited CIR.
   • DTraffic that matches entry 10 of ACL 100 is always allowed.

   Show answer

   Answer: D

   Explanation

   D is correct. In the context of CoPP, ACLs are not used to permit or deny traffic, only identify it for policing. Traffic "denied" by the ACL will simply not be considered in the Class Map, i.e. not policed. Ref: https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/copp.html This example shows how to allow full access for Telnet to the switch from a host in a specific subnet and police the rest of the subnet: Router(config)# access-list 121 deny tcp host 10.86.183.3 any eq telnet Router(config)# access-list 121 permit tcp 10.86.183.0 0.0.0.255 any eq telnet

   Source: Adapted from community discussion — Mistwalker

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 906 · 1003 in bank

   SIMULATION - Guidelines - This is a lab item in which tasks will be performed on virtual devices. • Refer to the Tasks tab to view the tasks for this lab item. • Refer to the Topology tab to access the device console(s) and perform the tasks. • Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. • All necessary preconfigurations have been applied. • Do not change the enable password or hostname for any device. • Save your configurations to NVRAM before moving to the next item. • Click Next at the bottom of the screen to submit this lab and move to the next question. • When Next is clicked, the lab closes and cannot be reopened. Topology -

   

   Tasks - Configure R2 according to the topology to achieve these results: 1. Configure eBGP using Loopback 0 for the router-id. Do not use the address-family command to accomplish this. 2. Advertise R2’s Loopback 100 and Loopback 200 networks to AS40 and AS60. R2 -

   

   

   

   R1 -

   

   

   

   

   

   

   

   

   

   

   R3 -

   

   

   

   

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   How I think it should be:[ To check current configuration: Sh run Sh ip int brief On R2: router bgp 50 bgp router-id 10.2.2.2 neighbor 209.165.200.225 remote-as 40 neighbor 209.165.200.229 remote-as 60 router bgp 50 network 209.165.201 11 mask 255.255.255.255 network 209.165.201 12 mask 255.255.255.255 To verify: Show ip bgp sum On R2: Copy running-config startup-config Not sure why in the resolution they used those neighbor IP addresses...

   Source: Adapted from community discussion — Mizuchan

   

   Next question

7. Question 907 · 1003 in bank

   An engineer must use flexible NetFlow on a group of switches. To prevent overloading of the flow connector, if the flow is idle for 20 seconds, the flow sample should be exported. Which command set should be applied?

   • Aflow record recordflow exporter flowexport record recordflow cache timeout active 120 cache timeout inactive 20 cache type immediate
   • Bflow monitor monitorflow exporter flowexport record recordflow cache timeout active 120 cache timeout inactive 20 cache type immediate
   • Cflow monitor monitorflow exporter recordflow cache timeout active 120 cache timeout inactive 20 cache type permanent
   • Dflow record recordflow match ipv6 destination ip-address match ipv6 source ip-address match ipv6 protocol-type view match interface input match interface output match transport destination-port collect counter bytes long

   Show answer

   Answer: B

   Explanation

   - Option A is incorrect because it repeats the "record recordflow" command unnecessarily. - Option C is incorrect because it does not include the "flow monitor" command to set up the flexible NetFlow monitor. - Option D is incorrect because it does not include the necessary configuration for exporting flow records based on idle timeout.

   Source: Adapted from community discussion — slacker_at_work

   References

   • Cisco documentation

   Next question

8. Question 908 · 1003 in bank

   When a branch location loses connectivity, which Cisco FlexConnect state rejects new users but allows existing users to function normally?

   • AAuthentication-Down/Switch-Local
   • BAuthentication-Down/Switching-Down
   • CAuthentication-Central/Switch-Local
   • DAuthentication-Local/Switch-Local

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

9. Question 909 · 1003 in bank

   

   Refer to the exhibit. Which action does the Python script accomplish?

   • Aconnects to the device using Telnet and exports the routing table information
   • Bconnects to the device using SSH and exports the routing table information
   • Cdisplays the output of the show command in an unformatted way
   • Ddisplays the output of the show command in a formatted way

   Show answer

   Answer: C

   Explanation

   Choosing C going by this logic: A: Obviously wrong because Telnet is not port 22 B: Although correct where it says it's using SSH, "exports" the routing table sounds wrong because the code just does a standard print(stdout) command. That just outputs to the command line. If the code was to export the file, there should be some file.open() and file.close() commands to actually pump the stdout data into a file, or at least to another object type C: Correct answer going by this logic. The output is displayed with no formatting. If it was to be displayed in a formatted way, I'd expect to see something similar to a "for" loop where it can read each line of the stdout and write it accordingly, or at least some string formatting commands. There are none to hint at that in the code. D: Wrong because there doesn't seem to be any formatting commands on the stdout before or while printing it to the command line.

   Source: Adapted from community discussion — a197cbf

   Next question

10. Question 910 · 1003 in bank

    Which component handles the orchestration plane of the Cisco SD-WAN?

    • AvBond
    • BvSmart
    • CvManage
    • DWAN Edge

    Show answer

    Answer: A

    Explanation

    vManager - is the controller and cisco considers it the management plane vSmart - is the control plane. vEdge is the data plane. vBond is the orchestrator plane, and according to cisco it authenticates the vSmart controllers and the SD-WAN routers and orchestrates connectivity between them. It is the only device that must have a public IP address so that all SD-WAN devices in the network can connect to it. A vBond orchestrator is an SD-WAN router that only performs vBond orchestrator functions.

    Source: Adapted from community discussion — Nnandes

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 901. 1003 questions available.