350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2 Questions and Answers

The correct answer is B. Template Editor.

Cisco Catalyst Center provides template-based automation to deploy configurations consistently across multiple devices.

The Template Editor is specifically used to:

Create reusable configuration templates

Use variables and parameters for different devices

Apply configurations to multiple devices with similar roles/settings

It supports Jinja2-based templates, enabling dynamic and scalable deployments.

This directly matches the requirement:

“build generic configurations that are able to be applied on devices with similar network settings”

A. Authentication Template This is not a primary Catalyst Center tool for building reusable configuration templates.

C. Application Policies Used for QoS and traffic policies, not for general configuration templating.

D. Command Runner Used to execute ad hoc CLI commands on devices, not to build reusable configurations.

Template Editor = Build reusable configs

Command Runner = Run one-time commands

Application Policies = Define traffic/QoS behavior

Automation in Catalyst Center = Template-based deployment

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

The correct answer is A. interface between the controller and the network devices.

In Cisco controller-based architectures such as Cisco DNA Center / Cisco Catalyst Center, APIs are generally described in two directions:

Northbound APIs → used by external applications, users, or orchestration systems to communicate with the controller

Southbound APIs → used by the controller to communicate with the network devices

A southbound API provides the communication path between the controller and the infrastructure devices such as switches, routers, and wireless devices. This is how the controller pushes configuration, collects operational data, and manages the network.

B. interface between the controller and the consumer This describes a northbound API, not a southbound API.

C. NETCONF API interface for orchestrator communication Orchestrator communication is generally associated with northbound integration, not the fundamental definition of Cisco DNA southbound APIs.

D. RESTful API interface for orchestrator communication This also describes northbound API behavior, where external systems communicate with the controller.

Remember this controller model clearly:

Northbound API = controller ↔ applications / orchestration / users

Southbound API = controller ↔ network devices

Southbound = toward the infrastructure

Solution:

Copy run start

Verification:

OR

The status code shown in the exhibit is HTTP 403, which means the server understood the request but refused to authorize it. This is different from a missing resource, unreachable server, or state conflict. Option D is correct because a 403 Forbidden response indicates that access was denied due to authorization, permission, policy, or authentication-context restrictions. Option A describes a 410 Gone condition, where the resource is no longer available. Option B is not represented by a 403; unreachable resources normally produce network errors, timeouts, DNS issues, or gateway-level errors. Option C aligns more closely with HTTP 409 Conflict, which indicates the request conflicts with the current state of the resource. In API troubleshooting, reading the response code accurately matters. 401 usually means authentication is required or failed, while 403 means the client is recognized or the request is understood, but access is not allowed. The ENCOR automation focus is interpreting REST API status codes correctly during controller, network assurance, and programmability workflows. References/topics: ENCOR Automation, REST APIs, HTTP response codes, API authorization, 403 Forbidden, controller API troubleshooting.

Solution:

Copy run start

Verification:

OR

In Locator/ID Separation Protocol, the ingress tunnel router is responsible for encapsulating traffic from an endpoint identifier toward the correct routing locator. When the ITR does not already have an EID-to-RLOC mapping in its local map cache, it must request that mapping through the LISP control plane. The component that receives map requests from ITRs is the Map Resolver. Therefore, option A is correct. A routing locator is not a query target; it is the routable address representing the location of an EID in the underlay or routing infrastructure. A proxy ingress tunnel router is used to connect non-LISP sites toward LISP sites by acting on behalf of non-LISP sources. A proxy egress tunnel router provides reachability in the reverse direction, helping LISP sites communicate with non-LISP destinations. Neither PITR nor PETR is the normal answer to an ITR mapping-resolution request. The core ENCOR point is the separation between endpoint identity and routing location, with map resolution handled by the LISP control plane. References/topics: ENCOR Architecture, LISP, ITR, Map Resolver, EID-to-RLOC mapping, SD-Access control plane concepts.

The correct answer is C. using BFD.

In Cisco Catalyst SD-WAN, the health of data plane tunnels is monitored using Bidirectional Forwarding Detection (BFD). Cisco documentation states that BFD runs over all data plane tunnels between Cisco IOS XE Catalyst SD-WAN devices and is used to monitor the liveness and path characteristics of those tunnels, including loss, jitter, and latency.

BFD is the protocol specifically used in Cisco SD-WAN to detect tunnel failures quickly and measure tunnel quality. These measurements are also used by SD-WAN features such as application-aware routing to make path-selection decisions.

A. with IP SLA IP SLA is a Cisco feature for measuring network performance in many environments, but Cisco SD-WAN data plane tunnel health is monitored with BFD, not IP SLA.

B. with OMP OMP (Overlay Management Protocol) is the control-plane routing protocol in Cisco SD-WAN. It distributes routes, TLOCs, and service information, but it does not monitor data plane tunnel health.

D. ARP probing ARP is used for Layer 2/neighbor resolution on local segments and is not the tunnel-health monitoring mechanism for SD-WAN data plane tunnels.

ENCOR exam point:

In Cisco Catalyst SD-WAN:

OMP = control-plane route exchange

BFD = data-plane tunnel liveliness and performance monitoring

Priority 1: D

Priority 2: E

Priority 3: C

Priority 4: F

Cisco AAA method lists are processed from left to right. The command aaa authentication login default group ACE group AAA_RADIUS local-case defines the default login authentication sequence. The first method is the named AAA server group ACE, so the first priority is the AAA servers of the ACE group. If those servers do not respond or cannot authenticate the user, IOS tries the next method, which is the named AAA server group AAA_RADIUS. If that also fails, the router uses local-case, which checks the local username database with case-sensitive username matching. This is different from the normal local method, which does not enforce case-sensitive username comparison in the same way. If none of the configured methods succeeds, authentication fails and login is denied. The TACACS-specific option is not selected because the shown command uses a named AAA server group, not the literal group tacacs+ keyword. The non-case-sensitive local method is also not selected because the command explicitly uses local-case. References/topics: ENCOR Infrastructure Security, AAA method lists, login authentication, named server groups, local-case fallback behavior.

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

VERIFICATION: -

OR

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R2

R3

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:-

Copy run start

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution: -

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr