[Feb-2025] Latest Cisco 350-401 exam dumps and online Test Engine
Cisco 350-401: Selling CCNP Enterprise Products and Solutions
To pass the Cisco 350-401 exam, candidates need to have a solid understanding of the exam topics, which include network infrastructure, network security, automation, and virtualization. Additionally, candidates need to be familiar with the Cisco IOS XE operating system and the Cisco DNA Center. 350-401 exam consists of 90-110 questions, and candidates have 120 minutes to complete it. 350-401 exam can be taken in-person or online, and the passing score is 825 out of 1000 points.
NEW QUESTION # 276
Which JSON script is properly formatted?
- A.
- B.
- C.
- D.
Answer: C
NEW QUESTION # 277
Refer to the exhibit. PC-1 must access the web server on port 8080. To allow this traffic, which statement must be added to an access control list that is applied on SW2 port G0/0 in the inbound direction?
- A. permit host 192.168.0.5 eq 8080 host 172.16.0.2
- B. permit host 192.168.0.5 it 8080 host 172.16.0.2
- C. permit host 192.168.0.5 host 172.16.0.2 eq 8080
- D. permit host 172.16.0.2 host 192.168.0.5 eq 8080
Answer: A
Explanation:
Reference:
The inbound direction of G0/0 of SW2 only filter traffic from Web Server to PC-1 so the source IP address and port is of the Web Server.
NEW QUESTION # 278
Refer to me exhibit.
Refer to the exhibit. Rapid PVST+ is enabled on all switches. Which command set must be configured on switch1 to achieve the following results on port fa0/1?
A)
B)
C)
D)
- A. Option D
- B. Option C
- C. Option B
- D. Option A
Answer: A
NEW QUESTION # 279
A network engineer must configure a switch to allow remote access for all feasible protocols. Only a password must be requested for device authentication and all idle sessions must be terminated in 30 minutes. Which configuration must be applied?
- A. Option D
- B. Option C
- C. Option B
- D. Option A
Answer: B
NEW QUESTION # 280
Which two characteristics define the Intent API provided by Cisco DNA Center? (Choose two.)
- A. business outcome oriented
- B. device-oriented
- C. procedural
- D. southbound API
- E. northbound API
Answer: A,E
Explanation:
The Intent API is a Northbound REST API that exposes specific capabilities of the Cisco DNA Center platform. The Intent API provides policy-based abstraction of business intent, allowing focus on an outcome rather than struggling with individual mechanisms steps.
NEW QUESTION # 281
Which method creates an EEM applet policy that is registered with EEM and runs on demand or manually?
- A. event manager applet ondemand
event manual
action 1.0 syslog priority critical msg 'This is a message from ondemand' - B. event manager applet ondemand
event register
action 1.0 syslog priority critical msg 'This is a message from ondemand' - C. event manager applet ondemand
event none
action 1.0 syslog priority critical msg 'This is a message from ondemand' - D. event manager applet ondemand
action 1.0 syslog priority critical msg 'This is a message from ondemand'
Answer: C
Explanation:
Explanation
An EEM policy is an entity that defines an event and the actions to be taken when that event occurs. There are two types of EEM policies: an applet or a script. An applet is a simple form of policy that is defined within the CLI configuration. answer 'event manager applet ondemand event register action 1.0 syslog priority critical msg 'This is a message from ondemand'
<="" p="" style="box-sizing: border-box;">
There are two ways to manually run an EEM policy. EEM usually schedules and runs policies on the basis of an event specification that is contained within the policy itself. The event none command allows EEM to identify an EEM policy that can be manually triggered. To run the policy, use either the action policy command in applet configuration mode or the event manager run command in privileged EXEC mode.
Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3s/eem-xe-
3s-book/eem-policy-cli.html
NEW QUESTION # 282
An engineer measures the Wi-Fi coverage at a customer site. The RSSI values are recorded as follows:
Which two statements does the engineer use to explain these values to the customer? (Choose two)
- A. The RF signal strength at location B is 50% weaker than location A
- B. The RF signal strength at location C is 10 times stronger than location B
- C. Location D has the strongest RF signal strength
- D. The signal strength at location B is 10 dB better than location C
- E. The signal strength at location C is too weak to support web surfing
Answer: B,E
Explanation:
Reference:
Understanding Signal Strength
The most accurate way to express it is with milliwatts (mW), but you end up with tons of decimal places due to WiFi's super-low transmit power, making it difficult to read. For example, -40 dBm is 0.0001 mW, and the zeros just get more intense the more the signal strength drops.
Ultimately, the easiest and most consistent way to express signal strength is with dBm, which stands for decibels relative to a milliwatt.
You can convert between mW and dBm using the following formulas:
P(dBm) = 10 * log10(P(mW))
For example, a power of 2.5 mW in dBm is:
dBm = 10log2.5 = 3.979
dBm is that we're working in negatives. -30 is a higher (stronger) signal than -80.
Signal Strength
Rating
Required for
-30 dBm
Amazing
Max achievable signal strength. The client can only be a few feet from the AP to achieve this. Not typical or desirable in the real world.
N/A
-67 dBm
Very Good
Minimum signal strength for applications that require very reliable, timely delivery of data packets.
VoIP/VoWiFi, streaming video
-70 dBm
Okay
Minimum signal strength for reliable packet delivery.
Email, web
-80 dBm
Not Good
Minimum signal strength for basic connectivity. Packet delivery may be unreliable.
N/A
-90 dBm
Unusable
Approaching or drowning in the noise floor. Any functionality is highly unlikely.
N/A
3 dB of gain = +3 dB = doubles signal strength (Let's say, the base is P. So 10*log10(P/P)= 0 dB and 10*log10(2P/P) = 10*log10(2) = 3dB -> double signal)
3 dB of loss = -3 dB = halves signal strength strength (10*log(1/2) = -3.0103)
10 dB of loss = -10 dB = 10 times less signal strength (0.1 mW = -10 dBm, 0.01 mW = -20 dBm, etc.)
10 dB of gain = +10 dB = 10 times more signal strength (0.00001 mW = -50 dBm, 0.0001 mW = -40 dBm, etc.)
Simple rule of thumb:
When working with power, 3 dB means double (twice) the factor and 10 dB means 10-fold.
NEW QUESTION # 283
Drag and drop the virtual components from the left onto their deceptions on the right.
Answer:
Explanation:
Explanation
Diagram, line chart Description automatically generated
NEW QUESTION # 284
Which technology provides a secure communication channel for all traffic at Layer 2 of the OSI model?
- A. IPsec
- B. SSL
- C. MACsec
- D. Cisco Trustsec
Answer: C
Explanation:
MACsec (Media Access Control Security) is a security technology that provides secure communication for all traffic on Ethernet links. MACsec provides Layer 2 hop-by-hop encryption, which enables data confidentiality and integrity to be maintained between nodes in the network. It operates at Layer 2 of the OSI model and encrypts packets before they are transmitted across the network cables and devices.
References: Implementing and Operating Cisco Service Provider Network Core Technologies
NEW QUESTION # 285
An engineer creates the configuration below. Drag and drop the authentication methods from the left into the order of priority on the right. Not all options are used.
Answer:
Explanation:
NEW QUESTION # 286
Drag and drop the REST API authentication methods from the left onto their descriptions on the right.
Answer:
Explanation:
NEW QUESTION # 287
What is a characteristic of MACsec?
- A. 802.1AE provides encryption and authentication services
- B. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol
- C. 802.1AE is bult between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802 1X session
- D. 802.1AE is bult between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)
Answer: A
NEW QUESTION # 288
Refer to the exhibit.
What does the output confirm about the switch's spanning tree configuration?
- A. The spanning-tree operation mode for this switch is PVST+.
- B. The spanning-tree operation mode for this switch is IEEE
- C. The spanning-tree operation mode for this switch is PVST.
- D. The spanning-tree mode stp ieee command was entered on this switch
Answer: A
Explanation:
Explanation
The default spanning-tree mode in Cisco switch is PVST+. This spanning-tree mode is based on the IEEE
802.1D standard and Cisco proprietary extensions. PVST+ is same as standard IEEE 802.1D but it runs on each VLAN. In the output we see the line "Spanning tree enabled protocol ieee" under "VLAN 20" so it can say the switch is running in PVST+ mode.
NEW QUESTION # 289
By default, which virtual MAC address does HSRP group 15 use?
- A. 05:5e:ac:07:0c:0f
- B. c0:42:34:03:73:0f
- C. 00:00:0c:07:ac:0f
- D. 05:af:1c:0f:ac:15
Answer: C
Explanation:
interface Ethernet0/0.100
encapsulation dot1Q 100
ip address 10.0.111.1 255.255.255.0
standby 15 ip 10.0.111.254
!
cisco(config-subif)#do s stand
Ethernet0/0.100 - Group 15
State is Speak
Virtual IP address is 10.0.111.254
Active virtual MAC address is unknown
Local virtual MAC address is 0000.0c07.ac0f (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.200 secs
Preemption disabled
Active router is unknown
Standby router is unknown
NEW QUESTION # 290
Which outbound access list, applied to the WAN interface of a router, permits all traffic except for http traffic sourced from the workstation with IP address 10.10.10.1?
A)
B)
C)
D)
- A. Option C
- B. Option D
- C. Option B
- D. Option A
Answer: D
NEW QUESTION # 291
Refer to the exhibit.
Based on the configuration in this WLAN security setting, Which method can a client use to authenticate to the network?
- A. username and password
- B. certificate
- C. text string
- D. RADIUS token
Answer: C
NEW QUESTION # 292
Refer to the exhibit.
A network engineer must permit administrators to automatically authenticate if there is no response from cither of the AAA servers. Which configuration achieves these results?
- A. aaa authentication login default group tacacs+ line
- B. aaa authentication login default group radius none
- C. aaa authentication login default group radius
- D. aaa authentication enable default group radius local
Answer: C
NEW QUESTION # 293
What are two benefits of virtualizing the server with the use of VMs in data center environment? (Choose two.)
- A. reduced IP and MAC address requirements
- B. smaller Layer 2 domain
- C. Increased security
- D. speedy deployment
- E. reduced rack space, power, and cooling requirements
Answer: D,E
NEW QUESTION # 294
Refer to the exhibit.
An engineer configures monitoring on SW1 and enters the show command to verify operation. What does the output confirm?
- A. SPAN session 2 monitors all traffic entering and exiting port FastEthernet 0/15.
- B. RSPAN session 1 is incompletely configured for monitoring
- C. SPAN session 1 monitors activity on VLAN 50 of a remote switch
- D. SPAN session 2 only monitors egress traffic exiting port FastEthernet 0/14.
Answer: B
Explanation:
Explanation
SW1 has been configured with the following commands:
SW1(config)#monitor session 1 source remote vlan 50 SW1(config)#monitor session 2 source interface fa0/14 SW1(config)#monitor session 2 destination interface fa0/15 The session 1 on SW1 was configured for Remote SPAN (RSPAN) while session 2 was configured for local SPAN. For RSPAN we need to configure the destination port to complete the configuration.
Note: In fact we cannot create such a session like session 1 because if we only configure Source RSPAN VLAN 50 (with the command monitor session 1 source remote vlan 50) then we will receive a Type: Remote Source Session (not Remote Destination Session).
NEW QUESTION # 295
Which line must be added in the Python function to return the JSON object {"cat_9k":
"FXS1932Q2SE")?
- A. return (json.dumps({d['hostname']: d['serialNumber'] for d in json.loads(test_json)['response']}))
- B. return (json.loads({d['hostname']: d['serialNumber'] for d in json.dumps(test_json)['response'}))
- C. return (json.loads({for d in json.dumps(test_json)['response']: d['hostname']: d['serialNumber']}))
- D. return (json.dumps({for d in json.loads(test_json)['response']: d['hostname']: d['serialNumber']}))
Answer: A
NEW QUESTION # 296
......
Security: The areas covered in this objective are as follows:
- Configuring and verifying the features of infrastructure security;
- Explaining REST API security;
- Configuring and verifying the features of wireless security;
- Explaining the elements of network security design.
- Configuring and verifying device access control, including the protection of lines and password as well as authorization and authentication with the use of AAA;
New 2025 350-401 Test Tutorial (Updated 1282 Questions): https://braindumps.actual4exams.com/350-401-real-braindumps.html