350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Questions and Answers

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

Copy run start

Verification:

OR

Solution: -

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R2

R3

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

VERIFICATION: -

OR

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

The Python library commonly used for NETCONF automation is ncclient. NETCONF is an XML-based network management protocol that uses YANG data models to structure configuration and operational state. The ncclient library provides Python functions for connecting to NETCONF-capable devices, opening a manager session, issuing get, get-config, edit-config, and other NETCONF operations, and processing XML responses. Option A is correct. The requests library is commonly used for REST API calls over HTTP or HTTPS, such as RESTCONF or controller northbound APIs, but it is not the standard NETCONF client library. Postman is an API testing application, not a Python library. cURL is a command-line tool for sending HTTP and other protocol requests, not a Python library for NETCONF/YANG workflows. In ENCOR automation, the distinction matters: REST-based APIs often use JSON and HTTP methods, while NETCONF uses XML-based RPC operations over SSH and is commonly automated in Python with ncclient. References/topics: ENCOR Automation, NETCONF, YANG, Python automation, ncclient, model-driven programmability.

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

Copy run start

Verification:

OR

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

The correct answer is A. json_final = json.loads(json_data).

When using Python on Cisco devices:

The cli() function returns output as a string

To work with structured data, the string must be converted into a JSON object (Python dictionary)

The exhibit shows:

json_data = cli(cmd)

json_final = json.import(json_data)

This is incorrect because:

json.import() is not a valid Python function

The script fails to convert the JSON string into a Python object

json_final = json.loads(json_data)

json.loads() parses a JSON-formatted string

Converts it into a Python dictionary

Enables access using keys like:

json_final[ " TABLE_intf " ][ " ROW_intf " ][0] [ " prefix " ]

B. This line assumes the JSON is already converted into an object. It does not fix the conversion issue.

C. Incorrect syntax and unnecessary; json is already imported properly.

D. Just defines a command string; does not address JSON conversion.

Always remember the difference:

json.loads() → String → Python object

json.dumps() → Python object → String

Correct Automation Workflow:

Run CLI command

Capture output (string)

Convert using json.loads()

Parse using dictionary keys

This is a core concept for Cisco automation questions in the ENCOR exam.

The correct snippet is option B because json.dump(Devices, OutFile) serializes the Python data structure and writes the resulting JSON directly to the open file object. The file is opened in write mode with open( " devices.json " , " w " ), and OutFile.close() closes the file after writing. Option A is wrong because json.load() reads JSON from a file and converts it into a Python object; it does not write a Python object to disk. It is also being used on a file opened in write mode, which is logically incorrect. Option C writes str(Devices), which produces a Python string representation of the dictionary, not standards-compliant JSON. That output may use single quotes and Python-specific formatting, which is not proper JSON. Option D uses json.dumps(Devices), which returns a JSON-formatted string, but it does not write that string to the file because the return value is ignored. ENCOR automation questions often test the difference between dump, dumps, load, and loads. References/topics: ENCOR Automation, Python, JSON, json.dump(), json.dumps(), file output, API data formatting.

The correct answer is C. using BFD.

In Cisco Catalyst SD-WAN, the health of data plane tunnels is monitored using Bidirectional Forwarding Detection (BFD). Cisco documentation states that BFD runs over all data plane tunnels between Cisco IOS XE Catalyst SD-WAN devices and is used to monitor the liveness and path characteristics of those tunnels, including loss, jitter, and latency.

BFD is the protocol specifically used in Cisco SD-WAN to detect tunnel failures quickly and measure tunnel quality. These measurements are also used by SD-WAN features such as application-aware routing to make path-selection decisions.

A. with IP SLA IP SLA is a Cisco feature for measuring network performance in many environments, but Cisco SD-WAN data plane tunnel health is monitored with BFD, not IP SLA.

B. with OMP OMP (Overlay Management Protocol) is the control-plane routing protocol in Cisco SD-WAN. It distributes routes, TLOCs, and service information, but it does not monitor data plane tunnel health.

D. ARP probing ARP is used for Layer 2/neighbor resolution on local segments and is not the tunnel-health monitoring mechanism for SD-WAN data plane tunnels.

ENCOR exam point:

In Cisco Catalyst SD-WAN:

OMP = control-plane route exchange

BFD = data-plane tunnel liveliness and performance monitoring

The correct answer is A. client.

In Cisco 802.1X / network admission control terminology, the supplicant is the endpoint device or client software requesting access to the network. Cisco documentation describes 802.1X as a client-server access control model in which the client must be authenticated before gaining ac cess, and the network device relays authentication messages between the supplicant and the authentication server.

Client = Supplicant

SW1 = Authenticator

RADIUS server = Authentication server

R1 = transit/network infrastructure device, not the supplicant

The supplicant is the device that is trying to join the network and provide credentials. In the diagram, that is the client. Cisco also defines the three 802.1X entities as supplicant system, authentication system, and authentication server system, with the supplicant being the endpoint such as a PC.

B. SW1 SW1 functions as the authenticator, controlling access to the network port and relaying EAP messages.

C. RADIUS server The RADIUS server is the authentication server, not the supplicant.

D. R1 R1 is part of the network path in the figure, but it is not the device requesting admission to the network.

ENCOR exam point:

For 802.1X / NAC questions, remember this trio:

Supplicant = endpoint/client

Authenticator = switch or AP controlling access

Authentication server = RADIUS / Cisco ISE

The correct configuration is option D because Cisco AAA method lists are processed from left to right. The existing configuration uses the default login and exec authorization method lists with only the TACACS+ group. That means if the TACACS+ server is unreachable, authentication and authorization fail unless another method is explicitly listed after the TACACS+ group. Adding local after group tacacs+ creates a fallback sequence: try TACACS+ first; if no TACACS+ response is available, use the local user database. Option C is wrong because it replaces TACACS+ with local authentication only, removing centralized AAA as the preferred method. Option B creates a named method list called FALLBACK, but it does not apply to the default login or exec process shown in the running configuration. Option A is not valid Cisco IOS AAA syntax for this requirement. This is a device-management security question focused on resilient AAA design. References/topics: ENCOR Infrastructure Security, AAA, TACACS+, local fallback, device administration, authorization method lists.

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

The inside user subnet is 192.168.1.0/24, which supports 254 usable host addresses. The configured NAT pool only provides addresses from 10.10.10.1 through 10.10.10.100, giving 100 usable translated addresses. Dynamic NAT without overload requires a sufficient number of inside global addresses if all users must be translated at the same time. Therefore, to support all users continuously, the NAT pool must be increased to support the 254 usable inside hosts. Option C is the best answer. Option A, match-host, is not the correct fix for the pool-size shortage; it is used for host-number matching behavior and still requires a usable pool design. Option B is wrong because NAT should translate private inside addresses to a different inside global address range, not reuse the same inside local subnet. Option D describes static one-to-one behavior and does not match the dynamic NAT route-map configuration shown. The key technical issue is address pool capacity. References/topics: ENCOR Infrastructure, NAT, dynamic NAT, inside local and inside global addresses, NAT pools, route-map-based NAT.

Next-generation firewalls extend traditional firewall behavior by adding deeper traffic inspection and application-level intelligence. Packet filtering, stateful inspection, and VPN support existed before NGFWs and are not unique to them. Traditional firewalls can permit or deny traffic based on source IP, destination IP, protocol, port, and connection state. NGFWs add the ability to inspect application payloads more deeply, identify applications even when they use nonstandard ports, apply policy based on application identity, detect threats inside permitted sessions, and integrate IPS or malware inspection. Therefore, deep packet inspection and application awareness are the best answers. Deep packet inspection allows the firewall to examine packet contents beyond simple Layer 3 and Layer 4 headers. Application awareness allows policy to distinguish, for example, legitimate HTTPS business traffic from risky file-sharing, tunneling, or unauthorized application traffic over the same port. VPN is useful but not unique to NGFWs. Stateful inspection is also a core feature of earlier stateful firewalls. References/topics: ENCOR Security, next-generation firewall, application visibility, deep packet inspection, IPS, advanced threat protection.

The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate → authentication-key → trusted-key

If any of these three are missing, authentication will not work properly.

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

The correct answer is D.

Cisco campus design guidance explains that a nonlooped topology with unique VLANs per access switch improves stability and convergence compared with looped Layer 2 designs. Cisco states that in a multilayer campus design, each access switch should have unique VLANs, with no Layer 2 loops and no blocked links, which improves convergence behavior. Cisco also notes that VLANs spanning multiple access switches increase flooding impact, while a nonlooped topology with localized VLANs reduces that impact.

A traditional nonlooped design reduces reliance on spanning-tree reconvergence across shared Layer 2 domains. With unique/local VLANs, failures affect a smaller fault domain and convergence is faster than in a looped design with common VLANs stretched across switches. Cisco’s campus design material specifically recommends no Layer 2 loops and unique VLANs per access switch for better operational behavior.

A. Traditional looped design that has common VLANs extended between separate access switches This increases Layer 2 complexity and spanning-tree dependency, which slows convergence compared to a nonlooped design. Cisco documents that VLANs spanning multiple access switches increase flooding impact.

B. Cisco SD-Access configuration between aggregation intermediate nodes and access layers This is not the standard way the question is framed for classic aggregation-to-Layer 2 access convergence in a traditional enterprise campus design. The question is targeting the design principle of looped vs nonlooped Layer 2 access.

C. Cisco SD-Access configuration between aggregation and access-layer edge nodes SD-Access is a different fabric architecture. The question is about reducing convergence time between aggregation and a Layer 2 access layer, which maps to the traditional campus design choice rather than SD-Access node roles.

For enterprise campus design, remember:

Looped Layer 2 + stretched/common VLANs = slower convergence and larger fault domains

Nonlooped Layer 2 + unique/local VLANs per access switch = faster convergence and better stability

In Cisco SD-Access, the fabric roles are clearly separated. The fabric edge node connects endpoints to the fabric and encapsulates user traffic into VXLAN. The control plane node runs the LISP control-plane function and maintains the endpoint ID to routing locator mapping database. That makes option C correct. The border node connects the SD-Access fabric to external networks, such as the data center, WAN, internet edge, or shared services. Therefore, the border node is required when fabric endpoints must communicate with nonfabric resources, which makes option B correct. Option A is wrong because the full endpoint mapping database belongs to the control plane node, not the border node. Option D is wrong because endpoints connect to fabric edge nodes, not normally to border nodes. Option E is also wrong because the control plane node is not in the data-forwarding path for normal user traffic; it resolves mappings. Data traffic flows through the fabric using VXLAN encapsulation after control-plane resolution. References/topics: ENCOR Architecture, Cisco SD-Access, fabric edge node, fabric border node, control plane node, LISP, VXLAN.

The correct answer is B. To route video traffic through a dedicated link.

Policy-Based Routing (PBR) allows the router to make forwarding decisions based on policies such as source, destination, application, or other match criteria, instead of relying only on the routing table. Cisco documentation explains that PBR gives more control over routing by reducing reliance on routes learned from routing protocols, and that it can route traffic according to a defined policy.

This means an engineer can identify video traffic and force it to use a specific dedicated path or link, even if that path is not the normal best path chosen by the routing table. Cisco also notes that set ip next-hop makes the system use policy routing first and then the routing table, which confirms that PBR can override normal routing behavior to send selected traffic to a chosen next hop.

Video traffic is often sensitive to delay, jitter, and packet loss. With PBR, the engineer can match that traffic and send it over a dedicated WAN link or preferred path that better supports real-time applications. This is a classic use case for PBR.

A. To route video traffic using the shortest path to the destination This is normally the job of the routing table and routing protocols, not PBR. PBR is used when the engineer wants to override normal path selection.

C. To use multicast for video traffic transmission Multicast is a separate forwarding technology and is not the purpose of PBR.

D. To perform traffic shaping to avoid video traffic delay Traffic shaping is a QoS function, not a routing decision function. PBR selects paths; it does not shape traffic.

ENCOR exam point:

Use PBR when traffic must follow a policy-defined path rather than the path chosen by standard routing protocol metrics.