Free 350-401 sample questions

Correct answer: A debug condition has been met on the Serial 0/1 interface.

Based on the image showing debug output, the debug condition has been met on the Serial 0/1 interface. The debug output displays PPP authentication messages specifically from the Serial 0/1 connection to RouterC, indicating that this interface condition triggered the debug display. The other options are incorrect because the output specifically shows Serial 0/1 interface activity, not Serial 0/0, username-based conditions, or all/no conditions being met.

Correct answer: Issue the command with a lower size parameter value.

Keep the DF bit set and repeat the ping with a smaller size value. The 1,501-byte ping failed because the packet is larger than the maximum transmission unit (MTU) of the path, and the DF bit stops routers from fragmenting it. Lower the size step by step, or use the sweep range of sizes option of extended ping. The largest size that still succeeds with DF set is the largest datagram that the path carries without fragmentation. If you remove df-bit, routers fragment the packet, the ping succeeds, and you learn nothing about the MTU. If you remove size, the ping uses the default 100-byte datagram, which fits any path. Source: Cisco IOS Configuration Fundamentals Command Reference, ping (df-bit; size default 100 bytes; sweep range of sizes).

Correct answer: debug condition interface serial 0/1

You should issue the debug condition interface serial 0/1 command on RouterA to receive Point-to-Point Protocol (PPP) authentication debug output from both RouterB and RouterC with the least administrative effort. The debug condition interface command filters debug output to show only messages from the specified interface. Since both routers connect through different serial interfaces, adding the Serial 0/1 condition will enable debug output from both connections. The other options either disable debugging entirely or use incorrect syntax for interface conditions.

Correct answer: The pings were sent to the destination in a fragmented fashion.

The pings were sent to the destination in a fragmented fashion. Since the default system MTU on Cisco devices is typically 1500 bytes and the ping size is 1600 bytes, the packets exceed the MTU and must be fragmented to succeed. Without the DF bit set, fragmentation is allowed and the pings succeed. The other options are incorrect: MTU of 1600 is not default, DF bit prevents fragmentation (would cause failure), and 1600 bytes exceeds default MTU values.

Correct answer: The GRE tunnel MTU is 1,476.

Generic Routing Encapsulation (GRE) adds 24 bytes to each packet: a 4-byte GRE header and a 20-byte outer IPv4 header. With the default 1,500-byte MTU on the physical links, the IP MTU of the tunnel is 1,476 bytes (1,500 - 24). The ping sends 1,500-byte packets with the DF bit set. These packets are larger than 1,476 bytes and must not be fragmented. So the router drops them and returns an ICMP 'fragmentation needed' message, and the ping fails. The default MTU is 1,500 bytes, not 1,400. The command already sets the DF bit with df-bit. GRE can carry fragmented packets; here the DF bit is what blocks fragmentation. Sources: Cisco TAC 25885, Resolve IPv4 Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPsec; RFC 2784 section 2.1.

Correct answer: 10.1.1.1; R1 operates at stratum 3

NTP uses the stratum to show how many NTP hops a device is from an authoritative time source. A stratum 1 server has a radio or atomic clock directly attached, and a stratum 2 server receives its time over NTP from a stratum 1 server, and so on, so each hop adds 1. A device that runs NTP automatically chooses as its time source the device with the lowest stratum number that it communicates with. R1 therefore selects 10.1.1.1 at stratum 2 and itself operates at stratum 3. R1 cannot operate at stratum 2, the stratum of its server, because it is one NTP hop further from the reference clock. The stratum 4 server is not selected while the stratum 2 server is reachable. Source: Cisco Catalyst 9300 IOS XE 17.18 System Management Configuration Guide (Network Time Protocol: stratum).

Correct answer: Down/up

Down/up is not a valid GRE tunnel state on Cisco devices. The valid GRE tunnel states are: Up/up (tunnel is operational), Up/down (tunnel interface is up but line protocol is down), Administratively down/down (tunnel is shutdown), and Reset/down (tunnel is being reset). The Down/up state does not exist because if the interface is down, the line protocol cannot be up. The other options are all legitimate tunnel states that can occur during tunnel operations.

Correct answer: Traffic is encapsulated and decapsulated by tunnel endpoints.

A Generic Routing Encapsulation (GRE) tunnel encapsulates traffic. The tunnel source router wraps each packet in a GRE header and a new outer IP header, and the tunnel destination router removes them. This happens to all traffic routed into the tunnel: OSPF hellos and updates as well as user data. The extra headers add 24 bytes of overhead (a 4-byte GRE header plus a 20-byte IPv4 header), so tunnel headers do create overhead. A GRE tunnel needs only IP reachability between its endpoints, so the area that it crosses can be a stub area. The rule that the transit area cannot be a stub area applies to OSPF virtual links. Tunneling only the routing updates also describes a virtual link, not a GRE tunnel. Sources: RFC 2784; Cisco TAC 25885 (GRE adds 24 bytes); RFC 2328 section 3.6 (virtual links cannot be configured through stub areas).

Correct answer: The tunnel source is a loopback interface.

A loopback interface as the tunnel source does not put the tunnel in the up/down state. A loopback stays up/up, which is why it is a common choice for the tunnel source. Cisco lists three normal reasons for a point-to-point GRE tunnel to be up/down. First, there is no route, including a default route, to the tunnel destination. Second, the interface that anchors the tunnel source is down. Third, the route to the tunnel destination goes through the tunnel itself (recursive routing). A valid tunnel source must also be an up/up interface with an IP address. So a tunnel-source interface without an IP address also leaves the tunnel up/down. Source: Cisco TAC 118361, Determine What Impacts GRE Tunnel Interface States.

Correct answer: to the default fabric border node

SD-Access uses the Locator/ID Separation Protocol (LISP) as its control plane. Fabric devices do not make a traditional routing decision. Instead, they ask the control plane node for the EID-to-RLOC mapping of the destination. The endpoint identifier (EID) is the endpoint address, and the RLOC is the address of the fabric node behind which the endpoint sits. The device stores the reply in its LISP map cache and uses the RLOC as the destination of the encapsulated packet. If the destination RLOC cannot be resolved, the traffic is sent to the default fabric border node, which connects the fabric to networks outside it. Catalyst Center is the management and automation system and does not forward data traffic. The edge node does not flood the traffic, and it does not drop it only because the lookup failed. Source: Cisco SD-Access Solution Design Guide (Cisco Validated Design), LISP control plane overview.