Free 350-801 Practice Test Questions 2026

SUBSCRIBE

NOTIFY

Explanation:
When troubleshooting Dual-Tone Multi-Frequency (DTMF) negotiation in a SIP call, the administrator must identify how the endpoints negotiate and transport keypad digits. Some Cisco collaboration devices support Key Press Markup Language (KPML), which uses SIP event subscriptions to communicate DTMF events outside the audio stream. The SIP SUBSCRIBE and NOTIFY messages are therefore important when investigating whether this DTMF signaling method is negotiated and functioning correctly.

Correct Option:

C. SUBSCRIBE
The SIP SUBSCRIBE method establishes a subscription to an event package, such as KPML for DTMF digit collection. In Cisco Unified Communications Manager environments, a device can subscribe to receive notifications about telephone keypad events. When troubleshooting DTMF, inspect the SUBSCRIBE message to verify the event package, request headers, and subscription details, and determine whether the subscription was accepted successfully.

D. NOTIFY
The SIP NOTIFY method delivers event information to a subscriber after a subscription has been established. For KPML-based DTMF signaling, the notifying device sends keypad-event information in NOTIFY messages. Examining these messages helps confirm whether DTMF digits are being reported correctly, whether the event payload is valid, and whether the subscription remains active during the call.

Incorrect Option:

A. PRACK
PRACK (Provisional Response Acknowledgment) acknowledges reliable provisional SIP responses, such as 183 Session Progress, when the reliable provisional response mechanism is used. It supports SIP call signaling but is not the primary message used to transport KPML-based DTMF digit events. For this troubleshooting scenario, SUBSCRIBE and NOTIFY are more relevant.

B. UPDATE
The SIP UPDATE method modifies session parameters during an early or established SIP dialog, such as updating session descriptions or media parameters. Although session changes can affect media behavior, UPDATE is not the message pair used for KPML event subscription and DTMF notification. Inspecting SUBSCRIBE and NOTIFY is the appropriate approach for this DTMF signaling method.

E. REGISTER
The SIP REGISTER method allows a user agent to register its address with a SIP registrar. Registration establishes or refreshes the device's registration binding, but it does not carry KPML keypad-event notifications. A device can be successfully registered and still experience DTMF signaling issues, so the relevant event messages must be examined separately.

Reference:
1. Cisco — SIP Configuration Guide: DTMF Events Through SIP Signaling. Explains how SIP SUBSCRIBE and NOTIFY messages support out-of-band DTMF signaling.

partitions and calling search spaces

Explanation:
Cisco Unified Communications Manager (Unified CM) uses partitions and Calling Search Spaces (CSSs) to control call access and enforce an organization's communication policies. Partitions group directory numbers and route patterns into logical categories, while CSSs determine which partitions a phone or calling entity can access. By assigning appropriate CSSs to devices and restricting access to sensitive partitions or international route patterns, administrators can control which destinations different phones are permitted to call.

Correct Option:

A. Partitions and Calling Search Spaces
Partitions and CSSs work together to implement call-routing permissions in Cisco Unified CM. A partition contains directory numbers or route patterns, while a CSS specifies the partitions that a calling device can search. For example, a public phone can use a restricted CSS that excludes international route patterns, and departments with confidential numbers can be protected by limiting which devices have access to their partitions.

Incorrect Option:

B. Calling patterns and route patterns
Route patterns define how dialed numbers are matched and routed to destinations such as gateways or trunks. Although route patterns are essential to call routing, the term “calling patterns” does not identify the primary access-control mechanism in Unified CM. Partitions and CSSs determine whether a phone can access a particular route pattern or directory number.

C. Regions and device pools
Regions control codec selection and bandwidth usage for audio and video calls, while device pools group common device configuration settings, including locations, date/time groups, and regions. These features help manage system configuration and media resources, but they do not directly determine which phones are permitted to call specific directory numbers or international destinations.

D. Links and pipes
Links and pipes are not the standard Unified CM call-access control functions described in this question. Unified CM uses partitions and Calling Search Spaces to organize destinations and enforce calling privileges. These controls allow administrators to create different classes of service for departments, employees, management, and public phones.

Reference:
1. Cisco — System Configuration Guide for Unified CM, Release 14: Explains partitions, Calling Search Spaces, and how they restrict access to call destinations. Official Cisco documentation

Cisco Unified Communications Manager

Explanation:
Cisco Mobile and Remote Access (MRA) allows supported collaboration endpoints to securely access enterprise collaboration services from outside the corporate network without requiring a traditional VPN. The solution uses Expressway-C and Expressway-E to provide secure traversal through the organization's network perimeter. Although these Expressway servers facilitate discovery, signaling traversal, and connectivity, the phone's actual registration and call-control services remain hosted by Cisco Unified Communications Manager (Unified CM).

Correct Option:

B. Cisco Unified Communications Manager
When a phone connects through Mobile and Remote Access, it registers with Cisco Unified Communications Manager, which provides call control, device configuration, and telephony services. Expressway-E acts as the external access point, while Expressway-C provides the internal traversal and signaling connection toward Unified CM. These components allow the phone to register securely without being directly exposed to the public internet.

Incorrect Option:

A. Expressway-C
Expressway-C is the internal traversal server in an MRA deployment. It communicates with Expressway-E across the traversal zone and provides access toward internal collaboration services, including Unified CM. However, Expressway-C does not serve as the phone's call-control registration destination. The phone registers with Unified CM through the MRA infrastructure.

C. Cisco Unified Presence Server
Cisco Unified Presence Server provides presence and instant messaging capabilities in supported Cisco Unified Communications deployments. It can support features that display users' availability, but it is not the registration destination for MRA-enabled phones. Phone registration and call control are handled by Unified CM.

D. Expressway-E
Expressway-E is the externally facing server that enables remote endpoints to discover and securely access enterprise collaboration services. It provides the external side of the MRA connection and helps establish secure signaling traversal. However, it does not register the phone as its call-control server; registration occurs with Unified CM.

Reference:
1. Cisco — Mobile and Remote Access Through Cisco Expressway Deployment Guide: Explains the MRA architecture, Expressway traversal, and Unified CM registration.

Sequence number

Explanation:
Real-Time Transport Protocol (RTP) carries real-time audio and video across IP networks. Its header contains several fields that help receiving devices process media correctly and identify transmission problems. The sequence number increases by one for each RTP packet sent, allowing the receiver to detect missing packets by identifying gaps in the sequence. This information is particularly important in Cisco collaboration environments, where packet loss can degrade voice quality, video playback, and synchronization.

Correct Option:

C. Sequence number
The RTP sequence number is a 16-bit field that increments for each packet transmitted. The receiving endpoint examines successive sequence numbers to identify gaps that indicate potentially lost or missing packets. For example, if packets numbered 100, 101, and 103 arrive, the receiver can infer that packet 102 is missing. Sequence numbers also help reorder packets that arrive out of order, supporting more reliable media processing.

Incorrect Option:

A. CSRC (Contributing Source ID)
The CSRC field identifies contributing sources in an RTP stream, particularly when a mixer combines media from multiple sources. It helps the receiver identify the sources contributing to the payload. However, it does not track packet ordering or detect packet loss. That function is performed by the RTP sequence number.

B. Timestamp
The RTP timestamp indicates the sampling instant of the media data in a packet. It helps the receiver reconstruct media timing, support synchronized playback, and manage variations in packet arrival times. Although timestamps are essential for smooth audio and video playback, they do not directly identify missing packets. The sequence number is used for that purpose.

D. SSRC (Synchronization Source Identifier)
The SSRC field identifies the synchronization source of an RTP stream. It allows receivers to distinguish between different media streams, such as audio streams from separate participants in a conference. Although SSRC is important for stream identification and synchronization, it does not indicate whether individual packets have been lost. The RTP sequence number provides that information.

Reference:
1. RFC 3550 — RTP: A Transport Protocol for Real-Time Applications. Section 5.1 defines the RTP sequence number and explains that it supports packet-loss detection and packet sequence reconstruction.

the one with the longest match

Explanation:
Cisco Unified Communications Manager (CUCM) selects a route pattern based on the most specific match for the dialed digits. When multiple route patterns could match a number, CUCM uses digit-pattern specificity, favoring the pattern that matches the greatest number of dialed digits with the fewest wildcards or variable characters. This allows more specific routing rules to take precedence over broader patterns and helps administrators control call routing predictably.

Correct Option:

B. The one with the longest match
CUCM uses closest-match routing, selecting the pattern that matches the dialed number while matching the fewest other possible numbers. This generally favors the most specific pattern, often described in exam questions as the longest match. For example, if 8XXX, 89XX, and 8912 all match the dialed number 8912, the exact pattern 8912 is the closest match and is selected.

Incorrect Option:

A. The one that discards everything PreDot
The PreDot (.) character is a digit-manipulation instruction, not a route-pattern selection rule. It tells CUCM to discard the digits preceding the dot before sending the remaining digits to the next system. Although this setting can affect how a number is transmitted, it does not determine which pattern wins when multiple route patterns match the dialed number.

C. The one that comes first in numerical order
CUCM does not generally select a route pattern simply because it comes first numerically. Instead, it uses closest-match logic to select the most specific matching pattern. If equally matching patterns exist in different partitions, the calling search space determines which partition is searched first. Therefore, numerical ordering is not the general rule for selecting a route pattern.

D. The one with the closed match
“Closed match” is not the standard CUCM term for this routing behavior. Cisco describes the mechanism as closest-match routing. CUCM selects the matching pattern that encompasses the fewest other possible numbers, favoring a more specific match over a broader wildcard pattern. The correct technical concept is closest-match routing, making option B the intended answer among the choices.

Reference:
1. Cisco Unified Communications SRND — Dial Plan and Closest-Match Routing

disconnects all users that had been failed over, and the users must log in again

Explanation:
Cisco Unified Communications Manager IM and Presence Service uses presence redundancy groups to maintain service availability when a node fails. A Manager fallback operation returns users from a secondary node to their designated primary node when the primary node is available again. Cisco Server Recovery Manager coordinates recovery actions during this process. The key distinction is that fallback can interrupt existing user sessions, requiring affected users to sign in again.

Correct Option:

D. Disconnects all users that had been failed over, and the users must log in again
During a manual fallback, Cisco Server Recovery Manager restarts critical services on the primary IM and Presence node. It then disconnects users who had previously failed over to the backup node. Those users must log in again to reconnect to their assigned node. This behavior is explicitly documented by Cisco for manual fallback in a presence redundancy group.

Incorrect Option:

A. Restart the Cisco Presence Engine
This is incorrect because restarting the Cisco Presence Engine alone does not describe the documented behavior of a manual fallback operation. Server Recovery Manager manages the transition between the primary and backup IM and Presence nodes, including restarting critical services on the primary node and disconnecting affected users. The option focuses on one service rather than the complete fallback behavior.

B. Disconnects all users that had been failed over
This is partially correct but incomplete. Cisco documents that manual fallback disconnects users who had failed over, but it also requires those users to log in again to their assigned node. Because option D includes both the disconnection and re-login requirement, it is the most accurate answer.

C. Restarts critical services on the secondary node
This is incorrect because, during manual fallback, Server Recovery Manager restarts critical services on the primary node, not the secondary node. The purpose is to restore normal operation on the recovered primary node and return users to their assigned node. Restarting services on the secondary node is not the action described in Cisco’s manual-fallback procedure.

Cisco Expressway-C and Expressway-E

Explanation:
Organizations can extend Cisco Unified Communications to remote and mobile users through Mobile and Remote Access (MRA). MRA allows supported Cisco collaboration clients and devices to connect securely from outside the corporate network without requiring users to establish a traditional VPN connection. The Cisco Expressway-C and Expressway-E pair provides the traversal and secure access infrastructure for this capability, simplifying the connection process for users working over the internet.

Correct Option:

A. Cisco Expressway-C and Expressway-E
Cisco Expressway-C is deployed inside the enterprise network, while Expressway-E is placed at the network edge, typically in a DMZ. Together, they provide secure traversal for Mobile and Remote Access (MRA), allowing supported Cisco collaboration clients to access corporate calling, messaging, and presence services over the internet without a separate VPN client. This supports bring-your-own-device (BYOD) use while simplifying the end-user experience.

Incorrect Option:

B. Cisco Unified Instant Messaging and Presence
Cisco Unified IM and Presence provides instant messaging, presence information, and availability features. It does not, by itself, provide the secure edge traversal infrastructure needed for remote clients to access corporate collaboration services from the internet. IM and Presence can integrate with an Expressway MRA deployment, but Expressway-C and Expressway-E provide the remote-access path.

C. Cisco Unified Border Element
Cisco Unified Border Element (CUBE) is primarily a session border controller used to connect voice networks, such as an enterprise VoIP system and a service-provider SIP trunk. It provides functions such as SIP interworking, security, and media handling. Although CUBE is important in voice-network connectivity, it is not the standard solution for Cisco Jabber mobile and remote access without a VPN.

D. Cisco Express Mobility
Cisco Extension Mobility allows users to access their phone profiles on supported Cisco IP phones, typically by logging in to a device. It is not the infrastructure that securely connects internet-based mobile clients to corporate Unified Communications services. The question's requirements—remote access over the internet and a simple user experience—identify Cisco Expressway-C and Expressway-E for MRA.

Reference:
1. Cisco Expressway Series — Features and Benefits

The end user may incorrectly tag their traffic to be prioritized over other network traffic

Explanation:
A QoS trust boundary defines where the network begins trusting packet markings, such as Differentiated Services Code Point (DSCP) or Layer 2 Class of Service (CoS), to determine traffic priority. End-user PCs are generally considered untrusted because users or applications may mark traffic with an unnecessarily high priority. If network switches trust these markings without validation, ordinary data traffic could receive preferential treatment over latency-sensitive voice and video traffic.

Correct Option:

C. The end user may incorrectly tag their traffic to be prioritized over other network traffic
An end user can configure a PC or application to mark packets with high-priority DSCP or CoS values, potentially causing ordinary data traffic to receive preferential network treatment. If the access switch trusts those markings, the user could consume priority queue resources intended for voice and video. Cisco therefore recommends treating unmanaged PCs as untrusted and validating or remarking their traffic at the network edge.

Incorrect Option:

A. The end user could incorrectly tag their traffic to bypass firewalls.
QoS markings identify traffic priority; they do not inherently bypass firewall rules. Firewalls enforce security policies based on factors such as addresses, ports, protocols, and configured inspection rules. While QoS and security policies can interact in network design, the primary reason for not trusting PC-generated markings is to prevent users from improperly claiming network priority, not to bypass firewalls.

B. There is no reason not to include an end user’s PC device in a QoS trust boundary.
This is incorrect because unmanaged PCs may generate arbitrary QoS markings, intentionally or accidentally. Trusting those markings without validation can allow non-real-time traffic to compete with latency-sensitive voice and video. Centrally managed and secured PCs may be trusted under an appropriate policy, but ordinary unmanaged endpoints should generally be treated as untrusted.

D. The end user could incorrectly tag their traffic to advertise their PC as a default gateway.
QoS markings do not advertise a device as a default gateway. Default gateway information is typically configured manually or learned through network mechanisms such as DHCP. DSCP and CoS markings influence how network devices classify and prioritize traffic; they do not establish gateway roles or routing advertisements. Therefore, this is unrelated to the QoS trust-boundary concern.

Reference:
1. Cisco — Borderless Campus Design Guide: QoS Classification and Marking

Cisco Expressway

Explanation:
Cisco Jabber clients located outside the corporate network need a secure method to access internal Cisco Unified Communications Manager (CUCM) services. Cisco Expressway Mobile and Remote Access (MRA) provides this connectivity by enabling supported Jabber clients to discover and connect to enterprise collaboration services over the internet, without requiring a traditional VPN. Expressway provides secure traversal between the external client and the internal collaboration infrastructure.

Correct Option:

A. Cisco Expressway
Cisco Expressway enables Jabber clients outside the corporate network to access CUCM for services such as call control and, when configured, other collaboration features. In an MRA deployment, Expressway-E provides the external-facing connection, while Expressway-C communicates with internal collaboration servers. This architecture simplifies remote access and helps protect internal systems without requiring users to establish a VPN connection.

Incorrect Option:

B. Cisco Prime Collaboration Provisioning Server
Cisco Prime Collaboration Provisioning is a management and provisioning solution used to automate and manage collaboration services, users, and devices. It does not provide the secure traversal path that remote Jabber clients require to access CUCM over the internet. Provisioning tools support administration; Expressway provides the remote-access infrastructure.

C. Cisco Unified Border Element
Cisco Unified Border Element (CUBE) is a session border controller primarily used to connect enterprise voice networks with service-provider SIP trunks or other SIP-based systems. It provides signaling and media interworking and security functions, but it is not the standard MRA component for allowing Jabber clients to connect remotely to CUCM.

D. Cisco IM and Presence node
The Cisco IM and Presence node provides instant messaging, availability, and presence services. It can participate in the services accessed by Jabber, but it does not independently provide the secure internet-facing traversal needed for remote clients. Expressway supplies the MRA connectivity, while IM and Presence provides its specific collaboration services.

Reference:
1. Cisco Expressway Series — Product Overview

Each type of traffic flow has equal bandwidth

Explanation:
Flow-based Weighted Fair Queuing (WFQ) is a congestion-management mechanism that schedules packets from multiple flows fairly, rather than allowing one flow to consume all available bandwidth. In classic flow-based WFQ, flows are identified and given fair access to the available bandwidth, generally based on their classification and configured weights. Unlike strict priority queuing, WFQ does not inherently give voice traffic absolute priority over every other flow.

Correct Option:

A. Each type of traffic flow has equal bandwidth
Cisco's standard flow-based WFQ allocates an equal share of bandwidth to each active flow during congestion, rather than giving every application type a fixed allocation. A flow is identified using packet-header information, such as source and destination IP addresses and TCP/UDP ports. One important nuance: classic Cisco WFQ can account for IP precedence, so higher-precedence traffic may receive preferential scheduling; option A reflects the basic equal-flow principle.

Incorrect Option:

B. Bandwidth is divided among traffic flows. Voice has priority.
This is incorrect because flow-based WFQ does not inherently place all voice traffic into a strict-priority queue. Instead, it fairly schedules individual flows and can favor low-volume, interactive traffic. Strict priority for voice is typically achieved using Low Latency Queuing (LLQ), which adds a priority queue to class-based WFQ. This option confuses flow-based WFQ with a priority-queuing mechanism.

C. Voice has priority and the other types of traffic share the remaining bandwidth.
This describes a priority-queuing design more closely than standard flow-based WFQ. In a configuration using LLQ, voice traffic can receive strict-priority treatment while other classes share the remaining bandwidth according to their policies. Standard flow-based WFQ instead schedules flows fairly, with possible preferential treatment based on traffic characteristics and IP precedence. Therefore, this is not the best answer.

D. All the bandwidth is divided based on the QoS marking of the packets.
This is incorrect because standard flow-based WFQ does not allocate all bandwidth solely according to QoS markings. It primarily separates traffic into flows and shares bandwidth fairly. Cisco WFQ can consider IP precedence when determining scheduling weights, but that is different from dividing bandwidth exclusively according to QoS markings. Class-based WFQ allows administrators to define traffic classes and configure bandwidth allocations more explicitly.

Reference:
1. Cisco — Configuring Weighted Fair Queueing

Configure a universal device template that has speed dials in the phone button
configuration field, then specify 1111 as a speed dial by editing the speed dial within the
universal device template.

Explanation:
Cisco Unified Communications Manager (CUCM) Self-Provisioning allows users to provision supported phones using predefined configuration templates, reducing the need to configure each device individually. A Universal Device Template (UDT) can define common phone settings, including speed-dial button configuration and speed-dial entries. To apply the same speed dial across multiple phones efficiently, an administrator can configure the speed-dial entry in the template used for provisioning, rather than manually editing each phone.

Correct Option:

D. Configure a universal device template that has speed dials in the phone button configuration field, then specify 1111 by editing the speed dial within the universal device template
The Universal Device Template (UDT) is the appropriate place to define common device settings for phones provisioned through CUCM Self-Provisioning. Configure a phone button template that includes speed-dial buttons, then add 1111 as a speed-dial entry in the UDT. This applies the intended configuration consistently to phones provisioned using that template, reducing repetitive manual work.

Incorrect Option:

A. Configure each phone with the same DN and then configure a speed dial on one phone manually.
This is incorrect because configuring a speed dial on one phone does not automatically replicate that entry to other phones merely because they share the same directory number. Device-level speed-dial settings are not automatically synchronized across separate phone configurations. A shared provisioning template is more efficient when the same speed dial must be deployed to multiple phones.

B. Configure a phone button template and use BAT to specify 1111 after the phone is in CUCM.
Bulk Administration Tool (BAT) can add or update speed dials for multiple phones, provided their phone button template supports speed-dial buttons. However, this approach involves a separate bulk-update workflow after the phones are configured. The question specifically asks about using Self-Provisioning, for which configuring the UDT is the more direct template-based approach.

C. Configure a universal device template, then allow the user to specify 1111 through the Self Care Portal.
This is incorrect because the question asks for an administrator-controlled, consistent speed dial across multiple provisioned phones. Having each user specify the number through the Self Care Portal adds user interaction and does not centrally define the required entry in the provisioning template. Configuring the speed dial in the UDT is the intended method for standardizing the setting.

Reference:
1. Cisco — Configure Self-Provisioning Feature on CUCM

G.729A

Explanation:
When a remote office has a constrained or unreliable WAN connection with packet loss, delay, and jitter, selecting a codec with low bandwidth requirements is important. A codec that uses less bandwidth reduces congestion and leaves more capacity for other traffic. G.729A is a compressed voice codec that provides intelligible speech at a low bit rate, making it a common choice for bandwidth-constrained VoIP links. However, codec choice alone does not eliminate packet loss, delay, or jitter.

Correct Option:

D. G.729A — with an important technical caveat
G.729A compresses voice to an 8 kbps payload rate, compared with G.711’s 64 kbps, making it useful when WAN bandwidth is limited. This can reduce congestion-related packet drops. However, G.729A is not specifically the most resilient codec for packet loss: its speech coding can be affected by lost packets, while iLBC is designed to handle packet loss more robustly. If the question emphasizes packet loss, delay, and jitter, option C (iLBC) may be technically better; if it emphasizes low bandwidth, D is the usual choice.

Incorrect Option:

A. G.722.1
G.722.1 is a wideband audio codec designed to provide higher-quality audio at compressed bit rates. Although it can be efficient compared with G.711, it is not the typical answer for a constrained WAN where bandwidth conservation is the main priority. It also does not provide the same specific packet-loss resilience associated with iLBC.

B. G.711 A-law
G.711 A-law uses a 64 kbps voice payload, which consumes significantly more bandwidth than G.729A. On a constrained WAN, that higher bandwidth demand can worsen congestion and contribute to packet loss. G.711 can provide good voice quality when the network is well provisioned, but it is generally less suitable when bandwidth is scarce.

C. iLBC
iLBC is not necessarily incorrect for the conditions described. In fact, Cisco documentation notes that iLBC includes error-correction functionality and is designed to perform better in networks with higher packet loss. Its bit rate is approximately 13.33 or 15.2 kbps, higher than G.729A’s 8 kbps payload rate. Therefore, C is a strong technical choice when packet-loss resilience is the primary concern, even though D may be the intended answer if the exam is testing bandwidth conservation.

Reference:
1. Cisco — iLBC Support for SIP and H.323