Free Cisco 350-401 Practice Exam with Questions & Answers | Set: 6

The correct answer is B. Template Editor.

Cisco Catalyst Center provides template-based automation to deploy configurations consistently across multiple devices.

The Template Editor is specifically used to:

Create reusable configuration templates

Use variables and parameters for different devices

Apply configurations to multiple devices with similar roles/settings

It supports Jinja2-based templates, enabling dynamic and scalable deployments.

This directly matches the requirement:

“build generic configurations that are able to be applied on devices with similar network settings”

A. Authentication Template This is not a primary Catalyst Center tool for building reusable configuration templates.

C. Application Policies Used for QoS and traffic policies, not for general configuration templating.

D. Command Runner Used to execute ad hoc CLI commands on devices, not to build reusable configurations.

Template Editor = Build reusable configs

Command Runner = Run one-time commands

Application Policies = Define traffic/QoS behavior

Automation in Catalyst Center = Template-based deployment

The correct answer is D.

To meet the requirement, the configuration must do two things:

Permit only the 10.10.10.0/24 subnet to access the VTY lines

Allow only a secure remote access protocol, which is SSH

The correct Cisco IOS configuration is:

access-list 23 permit 10.10.10.0 0.0.0.255

line vty 0 15

access-class 23 in

transport input ssh

access-list 23 permit 10.10.10.0 0.0.0.255 This correctly matches the subnet 10.10.10.0/24 using the proper wildcard mask 0.0.0.255.

line vty 0 15 This applies the restriction to all VTY lines, not only a subset.

access-class 23 in This filters incoming remote access connections to the router.

transport input ssh This allows only SSH, which is encrypted and secure, and prevents Telnet or other clear-text remote access protocols.

A is incorrect because:

access-class 23 out filters outbound connections from the VTY lines, not inbound management access.

transport input all allows insecure protocols such as Telnet.

B is incorrect because:

255.255.255.0 is a subnet mask, not a wildcard mask, so the ACL syntax is wrong for a standard ACL entry.

C is incorrect because:

It applies only to VTY 0 4, while the router also has VTY 5 15 configured.

This leaves other VTY lines unrestricted, which does not fully meet the requirement.

For secure remote management on Cisco devices:

Use transport input ssh to disable Telnet

Use access-class < ACL > in on VTY lines to restrict who can connect

Use the correct wildcard mask for the subnet

For 10.10.10.0/24, the wildcard mask is:

0.0.0.255

So the complete secure solution is:

restrict inbound VTY access + allow only SSH + apply to all VTY lines

1 and 3 – Configuration

4 and 5 – Orchestration

The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate → authentication-key → trusted-key

If any of these three are missing, authentication will not work properly.

PROCEDURAL - CHEF

DECALRATIVE – PUPPET

SALTSTACK