Free 350-401 practice test: 30 questions with answers

Fast transition (802.11r) and controller-managed mobility reduce roaming delay between APs. Disabling WLANs, unique SSIDs per AP and DHCP removal do not support roaming.

Careful channel planning and width tuning reduce interference and improve capacity. Maximum power increases interference, a single data rate reduces efficiency, and one channel causes co-channel contention.

RADIUS can return VLAN attributes after 802.1X authentication, dynamically placing users into the right segment. Static per-SSID VLANs ignore identity, manual changes do not scale, and DHCP scope alone does not assign VLANs.

WPA2 or WPA3 Enterprise with 802.1X uses individual authentication and strong encryption. WEP is broken, open networks are unencrypted, and shared posted passwords do not identify users.

PoE delivers power over Ethernet cabling to devices such as phones and APs. The other options do not power network devices over data cabling.

The distribution layer aggregates access switches and applies policy, filtering and routing between segments. Access switches connect end devices, and the core focuses on high-speed transport.

Layer 3 designs with equal-cost multipath give fast convergence and load sharing. Flat Layer 2 domains and single active paths increase failure impact.

An SVI on a multilayer switch provides a Layer 3 gateway for each VLAN, enabling inter-VLAN routing. Trunks carry VLANs, console ports manage the device, and access ports alone do not route.

A trunk with 802.1Q carries tagged traffic for multiple VLANs. Access ports carry one VLAN, routed ports do not carry VLAN tags, and disabling the port stops traffic.

PortFast allows an access port to forward immediately, which suits end-device connections. BPDU forwarding, root guard on access ports and disabling STP do not provide the same benefit safely.

Port security with sticky MACs and a shutdown violation action restricts access and reacts to unauthorized devices. Allowing all MACs, permanent disabling and hubs do not meet the requirement appropriately.

Access lists use an implicit deny at the end, so only explicitly allowed traffic passes. An implicit allow would permit everything else, and the other options do not implement the rule.

TACACS+ supports authentication, authorization and accounting separately for device administration. DHCP assigns addresses, NTP synchronizes time, and SNMPv1 is a monitoring protocol with weak security.

802.1X provides port-based network access control using an authentication server. 802.11ac is a wireless standard, 802.3ad is link aggregation, and 802.1D is spanning tree.

SSHv2 encrypts management sessions, and disabling Telnet removes plain-text access. Telnet, HTTP without certificates and SNMPv1 with a public community expose credentials and configuration.

VLANs create logical Layer 2 segments on shared infrastructure. Static routes do not isolate Layer 2 domains, NAT addresses translation, and STP prevents loops rather than segmenting.

VXLAN uses a 24-bit segment ID for millions of logical networks, far beyond the 4096 VLAN limit. It does not remove routing, guarantee zero latency or encrypt traffic automatically.

VLAN configuration must match between the virtual port group and the physical switch. Wallpapers, time zones and hostnames do not affect L2 forwarding.

HSRP and VRRP provide a virtual default gateway shared by multiple routers, which gives first-hop redundancy. OSPF is a routing protocol, SNMP is management, and NTP is time synchronization.

The router with the highest HSRP priority becomes active, with preemption controlling takeover behaviour. Serial numbers, boot order and missing addresses do not select the active router.

NetFlow or IPFIX summarize flows, showing top talkers and application usage without full packet capture. Full captures are heavy, ping sweeps show reachability, and printer logs are unrelated.

SNMP traps and syslog messages are generated when link state changes, enabling real-time alerts. Weekly reports and manual checks are delayed, and disabling logs removes visibility.

IP SLA probes measure latency, jitter and packet loss between points, which suits voice monitoring. DNS caching, port security and PortFast do not measure performance.

Sending syslog to a central collector with a severity threshold enables centralized review. Local-only storage limits visibility, removing timestamps breaks correlation, and public lists expose internal data.

Templates applied through automation with compliance checks maintain consistency and detect drift. Manual configuration, unreviewed copies and no backups increase inconsistency and risk.

A script or playbook with variables applies the same changes repeatedly and consistently. Manual typing is error-prone, unreviewed copies risk errors, and wireless controllers do not configure wired VLANs.

Validating responses and handling errors with logging and rollback makes automation safe. Ignoring errors, assuming correctness and restarting controllers on errors are risky.

Version control gives an audit trail and enables rollback. Hiding changes, deleting history and personal-only storage weaken governance.

Templates with variables produce consistent configurations and reduce manual errors. Slowing deployments is not the goal, and templates should not remove security or testing.

Automation makes changes repeatable, speeds compliance checks and reduces manual errors. Removing change records and eliminating testing weaken control.