Cisco 350-501 Practice Test 68
Question 670
For an original SPCOR service-provider engineering scenario, consider: A core telemetry collector accepts unauthenticated gNMI streams from any network peer and inserts spoofed interface counters into its assurance dashboard. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths.
- Set insecure transport for every telemetry stream and treat any client-supplied device name as trusted authentication.
- Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
- Check: Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
Explanation
Correct Answer
A:Acceptance: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Applied case: A core telemetry collector accepts unauthenticated gNMI streams from any network peer and inserts spoofed interface counters into its assurance dashboard.
E:Acceptance: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Required intervention: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths.
Incorrect Answers
B:That option would set insecure transport for every telemetry stream and treat any client-supplied device name as trusted authentication, but it addresses a different concern. This is a required part of the case-specific plan. gRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
C:Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
D:Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Question 671
A service provider network engineer is reviewing this backbone or customer-service scenario: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA. A proposed shortcut is: Set insecure transport for every telemetry stream and treat any client-supplied device name as trusted authentication. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Select supported RESTCONF data paths and HTTP operations, preserve YANG schema types and handle documented status and error bodies.
- Set insecure transport for every telemetry stream and treat any client-supplied device name as trusted authentication.
- Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths.
- Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
Explanation
Correct Answer
C:The required acceptance condition is: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Applied case: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
Incorrect Answers
A:Select supported RESTCONF data paths and HTTP operations, preserve YANG schema types and handle documented status and error bodies. A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
B:That option would set insecure transport for every telemetry stream and treat any client-supplied device name as trusted authentication, but it addresses a different concern. The required acceptance condition is: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Applied case: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
D:Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Question 672
A Cisco service provider design review finds: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA. The team proposes: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- YANG defines containers lists keys and typed leaves, allowing supported protocol clients to validate configuration independently of arbitrary CLI text layouts.
- Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
- Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets.
- gRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Explanation
Correct Answer
D:Demonstrable success requires: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Applied case: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
Incorrect Answers
A:This option addresses a different service provider engineering topic (YANG typed schemas and provider automation models) rather than the documented gNMI gRPC dial-out streaming and mutual TLS decision.
B:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
C:Secure ZTP reduces manual first-boot work while requiring device identity, image integrity and confidentiality for configuration and enrollment secrets. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Question 673
The service provider operations team has not yet approved a change. Current evidence indicates: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
- Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
- Inspect capabilities, URL module prefix, requested HTTP method, Content-Type and returned status with a nonproduction test interface.
- Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
Explanation
Correct Answer
A:Confirm afterward that: Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Applied case: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
Incorrect Answers
B:Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
C:Inspect capabilities, URL module prefix, requested HTTP method, Content-Type and returned status with a nonproduction test interface. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
D:This option addresses a different service provider engineering topic (SNMPv3 authentication privacy and trap health) rather than the documented gNMI gRPC dial-out streaming and mutual TLS decision.
Question 674
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- The service converges consistently or exposes a recoverable failure without silent partial configuration across customers.
- Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden.
- Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported.
- Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass.
Explanation
Correct Answer
D:The approved implementation step was: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. Applied case: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA.
Incorrect Answers
A:The service converges consistently or exposes a recoverable failure without silent partial configuration across customers. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
B:Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
C:Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Question 675
An implementation sign-off request identifies the following problem: A provider rotates a telemetry certificate and all gRPC dial-out sessions fail because endpoints do not trust the new issuing CA. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. Verify: Compare NETCONF hello capabilities, target datastore, rpc-reply ok or rpc-error and device running configuration after a staged edit.
- Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. Verify: Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
- Change: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields. Verify: Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
- Change: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. Verify: Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
Explanation
Correct Answer
D:This pair links the appropriate technical correction with evidence of the actual cause. gRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Incorrect Answers
A:Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
B:Change: Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
C:Change: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields. GRPC carries typed RPC streams, while gNMI supports model-based telemetry and configuration; TLS and mTLS protect and authenticate session peers.
Question 676
A service provider network engineer is reviewing this backbone or customer-service scenario: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields. A proposed shortcut is: Assume a sampled flow report includes every packet payload and needs no template decoding to interpret counters. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types.
- Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields.
- Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths.
- Assume a sampled flow report includes every packet payload and needs no template decoding to interpret counters.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields.
Incorrect Answers
A:Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
C:Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
D:NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
Question 677
A Cisco service provider design review finds: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields. The team proposes: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- YANG defines containers lists keys and typed leaves, allowing supported protocol clients to validate configuration independently of arbitrary CLI text layouts.
- NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
Explanation
Correct Answer
B:Demonstrable success requires: The collector identifies correct source and destination flows with explicit sampling limits and detects exporter or template loss. Applied case: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields.
Incorrect Answers
A:YANG defines containers lists keys and typed leaves, allowing supported protocol clients to validate configuration independently of arbitrary CLI text layouts. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
C:RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
D:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
Question 678
The service provider operations team has not yet approved a change. Current evidence indicates: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
- Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
- Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision.
Explanation
Correct Answer
B:NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct. Applied case: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields.
Incorrect Answers
A:Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
C:Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
D:Inspect modeled service inputs, dry-run target diffs, device transaction outcomes and an injected failure during a lab provision. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
Question 679
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- The collector identifies correct source and destination flows with explicit sampling limits and detects exporter or template loss.
- Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported.
- Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass.
- Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors.
Explanation
Correct Answer
A:NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Only authorized PEs are targeted, repeated runs become stable and skipped or unreachable devices are explicitly reported. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
C:Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
D:Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
Question 680
For an original SPCOR service-provider engineering scenario, consider: A carrier observes unexplained flow gaps because the collector receives data records but never processes the IPFIX template defining their fields. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Assume a sampled flow report includes every packet payload and needs no template decoding to interpret counters.
- Check: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates.
- Change: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields.
- Check: Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
Explanation
Correct Answer
D:NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct. Acceptance: The collector identifies correct source and destination flows with explicit sampling limits and detects exporter or template loss.
E:NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct. Required intervention: Align exporter and collector template handling, source interface, sampling and timeout settings, then validate interpreted flow fields.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
B:Check: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
C:Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. NetFlow and IPFIX export summarized flow records whose field templates and sampling rules determine what collectors can reconstruct.
