Cisco Updated 350-401 Exam Questions and Answers by damir

The correct answer is C. no username and only the password " cisco123 " .

aaa authentication login group1 group radius line

This means:

Try RADIUS authentication first

If RADIUS fails/unreachable → fallback to line authentication

line con 0

password 0 cisco123

login authentication group1

Because RADIUS servers are not reachable, the router falls back to: → line authentication

When using line authentication, the router uses:

The configured line password

No username is required

Thus, login will prompt only for a password:

Password: cisco123

A. username " cisco " password " cisco " This uses the local user database, but local is NOT configured as fallback in group1.

B. password " test123 " This password is configured under VTY lines, not the console.

D. username " cisco " password " cisco123 " Combines local username with console password, but AAA fallback is to line, not local.

AAA authentication order matters:

group radius line → fallback is line password

group radius local → fallback is local username/password

Console + RADIUS down → uses line password only

The correct answer is A. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be honored.

The exhibit shows:

class-map match-any dscp-1

match ip dscp 1

policy-map set-dscp-63

class dscp-1

set dscp 63

interface GigabitEthernet0/0/0

mls qos trust dscp

service-policy input set-dscp-63

The class map matches packets with DSCP value 1:

match ip dscp 1

The policy map then changes the DSCP marking of those matched packets to 63:

set dscp 63

The policy is applied in the input direction on interface Gig0/0/0:

service-policy input set-dscp-63

Also, the interface is configured to trust DSCP:

mls qos trust dscp

That means incoming packets keep their DSCP markings unless a QoS policy explicitly changes them. Since the policy only matches DSCP 1, only that traffic is re-marked to 63. Traffic with other DSCP values is not matched by the policy and therefore remains trusted and unchanged.

Traffic marked with DSCP 1 is matched by the class map.

The policy re-marks that traffic to DSCP 63.

All other DSCP-marked traffic is still trusted and therefore honored.

B. DSCP 1 marked traffic will be ignored and DSCP 63 marked traffic will be honored. Incorrect, because DSCP 1 traffic is not ignored. It is specifically matched and re-marked.

C. None. The service-policy configuration must be applied in the outbound direction. Incorrect, because QoS marking policies can be applied in the input direction, and this configuration is valid.

D. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be ignored. Incorrect, because other DSCP values are not ignored. They are trusted due to mls qos trust dscp .

When you see:

mls qos trust dscp → preserve incoming DSCP markings

service-policy input with set dscp → re-mark only the traffic matched by the policy

So here the result is:

DSCP 1 → changed to 63

All other DSCP values → trusted and left unchanged