Cisco 350-501 Practice Test 70
Question 690
For an original SPCOR service-provider engineering scenario, consider: A customer-facing router still allows SNMPv2c read access with a shared public community from arbitrary source addresses after a monitoring migration. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
- Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types.
- Change: Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately.
- Check: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox.
- Enable SNMPv2c public write access everywhere and assume the community string encrypts every management frame.
Explanation
Correct Answer
A:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Required intervention: Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately.
C:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Acceptance: Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable.
Incorrect Answers
B:This option addresses a different service provider engineering topic (YANG typed schemas and provider automation models) rather than the documented SNMPv3 authentication privacy and trap health decision.
D:Check: Check state addresses, lock contention, plan create-update-destroy actions and expected controller changes in a sandbox. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
E:For this select two assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
Question 691
A service provider network engineer is reviewing this backbone or customer-service scenario: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads. A proposed shortcut is: Enable SNMPv2c public write access everywhere and assume the community string encrypts every management frame. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior.
- Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately.
- Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration.
- Enable SNMPv2c public write access everywhere and assume the community string encrypts every management frame.
Explanation
Correct Answer
B:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
Incorrect Answers
A:Represent service intent using supported Cisco NSO models and dry-run transactional changes and validate device diffs and recovery behavior. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
C:Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
D:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Use this instead: Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately.
Question 692
A Cisco service provider design review finds: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads. The team proposes: Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
- Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes.
- Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
Explanation
Correct Answer
A:Demonstrable success requires: Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable. Applied case: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
Incorrect Answers
B:Ansible hosts and groups determine the execution scope while modules and conditions can converge device configuration without uncontrolled repeated changes. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
C:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
D:RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
Question 693
The service provider operations team has not yet approved a change. Current evidence indicates: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare NETCONF hello capabilities, target datastore, rpc-reply ok or rpc-error and device running configuration after a staged edit.
- Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
- Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
Explanation
Correct Answer
D:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. Applied case: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
Incorrect Answers
A:Compare NETCONF hello capabilities, target datastore, rpc-reply ok or rpc-error and device running configuration after a staged edit. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
B:Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
C:Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
Question 694
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported.
- Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors.
- Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable.
- Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions.
Explanation
Correct Answer
C:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
B:Read and write requests affect only approved modeled resources and invalid payloads receive specific diagnosable errors. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
D:Reviewed plans converge expected resources without conflicting state writes or unapproved destructive network actions. A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads.
Question 695
An implementation sign-off request identifies the following problem: A management station sends SNMPv3 authPriv queries but the router has mismatched user security parameters and rejects valid monitoring reads. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use documented SNMP access restrictions and authenticated encrypted SNMPv3 where supported and verify polling and notifications separately. Verify: Inspect security level, user and engine parameters, permitted managers, packet captures and a representative interface counter query and notification.
- Change: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. Verify: Verify service certificates, trust chains, SAN validation, gNMI subscription paths and telemetry timestamps over a controlled authorized and unauthorized test.
- Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. Verify: Compare NETCONF hello capabilities, target datastore, rpc-reply ok or rpc-error and device running configuration after a staged edit.
- Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. Verify: Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
Explanation
Correct Answer
A:SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages. The change is successful only when: Approved collectors can query counters securely and unauthorized requests fail while essential traps remain observable.
Incorrect Answers
B:Change: Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
C:Change: Execute NETCONF operations against the intended supported datastore and verify RPC outcomes, commit state and operational configuration. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
D:Change: Use a verified inventory and idempotent supported network modules with meaningful prechecks, task results and stable desired-state templates. SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
Question 696
A service provider network engineer is reviewing this backbone or customer-service scenario: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations. A proposed shortcut is: Merge counters from unrelated interfaces and unsynchronized collection times and call the largest number definitive proof of an outage. What should the service provider engineer recommend as the narrowly scoped correction? Select ONE best answer.
- Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply.
- Merge counters from unrelated interfaces and unsynchronized collection times and call the largest number definitive proof of an outage.
- Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident.
- Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths.
Explanation
Correct Answer
C:This targeted action addresses the observed service-provider control or forwarding gap without discarding necessary controls. Applied case: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations.
Incorrect Answers
A:Keep state in an access-controlled locked backend and review plans and drift against provider-supported network resources before apply. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
B:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. For this best change assessment, the shortcut changes or bypasses the necessary routing, service or operational boundary rather than correcting it.
D:Configure mutually authenticated TLS and supported gNMI dial-in or dial-out subscription behavior with certificate trust and stable sensor paths. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Question 697
A Cisco service provider design review finds: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations. The team proposes: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- RESTCONF maps YANG-modeled resources to HTTP semantics; a valid TCP connection cannot replace correct method, content type or schema validation.
- SNMPv3 security models can provide authenticated and private management traffic; v2c communities do not themselves encrypt or strongly authenticate messages.
- Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption.
- Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Explanation
Correct Answer
D:Relevant validation before approval: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
Incorrect Answers
A:This option addresses a different service provider engineering topic (RESTCONF HTTP methods and YANG data resources) rather than the documented Telemetry assurance correlation and data quality decision.
B:This option addresses a different service provider engineering topic (SNMPv3 authentication privacy and trap health) rather than the documented Telemetry assurance correlation and data quality decision.
C:Terraform tracks managed resource identities in state and computes provider-specific actions; reliable remote state and locking prevent accidental concurrent corruption. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Question 698
The service provider operations team has not yet approved a change. Current evidence indicates: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Run check mode or an isolated deployment twice, comparing targeted hosts, command diff, failed hosts and change counts.
- Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic.
- Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab.
- Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
Explanation
Correct Answer
D:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. Applied case: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations.
Incorrect Answers
A:This option addresses a different service provider engineering topic (Ansible inventory templates and idempotent configuration) rather than the documented Telemetry assurance correlation and data quality decision.
B:Compare exported templates, sequence counters, sampling rate, collector parsing and independently measured test-flow traffic. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
C:Inspect module revision, namespace, leaf types and schema paths and test one valid and one invalid payload in a lab. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Question 699
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations. The carrier operations owner needs positive and negative tests showing existing customer services remain available. Which acceptance result demonstrates correct service provider forwarding and control behavior without disrupting authorized workflows? Select ONE best answer.
- The collector identifies correct source and destination flows with explicit sampling limits and detects exporter or template loss.
- Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass.
- New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected.
- Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden.
Explanation
Correct Answer
D:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The collector identifies correct source and destination flows with explicit sampling limits and detects exporter or template loss. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
B:Only authenticated collectors and devices exchange model-consistent telemetry, and certificate rotation can be validated without blind trust bypass. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
C:New devices enroll only with trusted artifacts and unique approved identities, and unexpected bootstrap sources are rejected. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
Question 700
For an original SPCOR service-provider engineering scenario, consider: A provider detects customer packet loss in one dashboard but the telemetry feed mixes unsynchronized exporter clocks and stale interface labels, yielding false correlations. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types.
- Result: Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported.
- Check: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
- Change: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident.
- Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab.
- Result: Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden.
Explanation
Correct Answer
C:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. Acceptance: Multiple telemetry sources agree on the affected interface and incident time, and missing or delayed data is flagged rather than hidden.
D:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. Evidence: Trace one known link flap across device clock, gNMI update, IPFIX flow record and monitoring event with ingestion-lag checks.
F:Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident. Required intervention: Normalize model identifiers, timestamps and collector health across gNMI, flow and management telemetry before declaring a backbone service incident.
Incorrect Answers
A:Change: Use the platform's published YANG module and typed hierarchical schema to construct data operations with validated paths and leaf types. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
B:Result: Only valid transactions enter the intended configuration datastore and any commit failure is clearly reported and rolled back where supported. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
E:Check: Check bootstrap trust, certificate or signed-image verification, credential issuance, endpoint authorization and failure handling in a spare router lab. Automation assurance depends on current trusted data sources and consistent time or interface identities; a collected metric without context can produce a misleading incident.
