Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Explanation:

MACsec provides Layer 2 encryption for Ethernet frames, securing traffic between directly connected devices on a LAN. In a multilayered network design, this makes it ideal for protecting critical infrastructure links, including Layer 2 trunk links between switches .

Why Other Options Are Incorrect

A. There is no requirement to run IEEE 802.1X when MACsec is enabled on a switch port.
While MACsec can use pre-shared keys, the IEEE 802.1AE standard typically uses 802.1X for authentication and the MACsec Key Agreement (MKA) protocol for key management . MACsec and 802.1X are complementary; MACsec doesn't remove the need for it.

C. Application flows between hosts on the LAN to remote destinations can be encrypted.
MACsec is a hop-by-hop security protocol securing a specific link between two directly connected devices, not an end-to-end encryption solution for application flows . Encryption is terminated and re-established at each hop. Remote destinations across a WAN require different security protocols like IPsec.

D. Layer 3 links between switches can be secured.
While MACsec can be applied to Layer 3 subinterfaces to secure communications between subnets, its fundamental operation is at Layer 2 of the OSI model . The primary benefit in a multilayered LAN network design is securing the physical infrastructure links, which are often Layer 2 trunks.

🔗 References

Cisco MACsec Configuration Guide: Defines MACsec as a Layer 2 security technology that encrypts and authenticates traffic on Ethernet links .

IEEE 802.1AE Standard: Confirms MACsec provides hop-by-hop Layer 2 security for LAN connections, protecting each physical or logical link

✅Explanation:

A primary design justification for a distributed WLC deployment is to contain CAPWAP tunnels within the local building, thereby avoiding latency concerns that can arise when these tunnels traverse the campus core network . In a distributed model, the WLC is placed at the building distribution layer, keeping AP-to-WLC communication local .

Why other options are incorrect

A. It reduces the number of WLCs that network administrators must support by locating them in a common location.
This describes a centralized deployment model, which reduces the number of locations for WLCs but does not reduce the number of WLCs required .

B. It more evenly distributes MAC ARP and ND processing over multiple switches which helps with scalability.
While distributed WLCs can help distribute processing, the primary scalability concern addressed is scaling the number of wireless clients beyond 25,000, not distributing MAC/ARP/ND processing . The distributed model keeps these tables local to the building, reducing the load on the core network.

C. The number of wireless clients is low and the size of the physical campus is small.
This describes a scenario where a centralized deployment model would be sufficient. Distributed models are typically justified for larger campuses (more than 25,000 clients) . For small campuses, centralized WLCs are recommended .

🔗 References
Cisco Enterprise Mobility Design Guide: WLC Location section details centralized vs. distributed deployment models and their justifications .

Cisco Wireless Design Best Practices: Distributed WLC architecture for large campuses to keep CAPWAP tunnels local .

✅ Explanation:

Clustering is the Cisco NGFW deployment option that provides scalability. Clustering allows you to group multiple firewall units (physical or virtual) together into a single logical device . This configuration offers key advantages for scalability:

Increased Throughput: By combining the processing power of multiple nodes, the cluster's total throughput scales. For example, a cluster of four Firepower 3140 units can achieve a combined NGFW throughput of 144 Gbps .

Elastic Scalability: The number of nodes in a cluster can be expanded to meet growing demands. Secure Firewall Threat Defense Virtual (FTDv) supports dynamic scaling (autoscale) in cloud environments, where nodes can be automatically added or removed based on traffic metrics like CPU and memory utilization .

Virtualization Support: Clustering is supported on physical platforms (e.g., Firepower 4100/9300 series) and virtual platforms (e.g., FTDv) , providing flexibility for various deployment scenarios.

High Performance: The architecture is designed to handle high-throughput environments, with support for up to 16 nodes in a cluster .

Why other options are incorrect:

A. tap:
A "tap" deployment mode (or passive/inline tap) is used for monitoring traffic, not for scalability .

B. inline tap:
This is a monitoring mode used for traffic inspection without blocking . It does not scale throughput or add capacity.

C. high availability:
HA provides redundancy (failover protection) using an active/standby or active/active model, but it generally does not combine throughput for increased capacity. Clustering provides both scalability and redundancy .

🔗 References

Cisco DevNet: "Clustering lets you group multiple threat defense units together as a single logical device... achieving the increased throughput and redundancy of multiple devices" . Cisco Secure Firewall Clustering sizing guide: "cluster of 4x 3140 has NGFW maximum throughput of 144Gbps" .

✅ Explanation:

The correct answer is A. RF tag .
In Cisco wireless deployments, tags are used to define and organize APs based on specific operational characteristics. The RF tag (Radio Frequency tag) is specifically designed to define the roaming domain and RF properties of an AP deployment . This tag is critical for managing how APs operate within the wireless network and how clients roam between them .

Why other options are incorrect:

B. policy tag:
A policy tag is used to define and apply security and access policies to APs, such as 802.1X authentication, guest access policies, or VLAN assignments. It does not define the roaming domain or RF properties of an AP deployment.

C. site tag:
A site tag is used in web development and content management systems to identify a specific website or site context for targeting operations. It is not used in Cisco wireless deployments to define AP roaming domains .

D. AP tag:
In broader IT contexts, "AP tag" can refer to any general-purpose label assigned to an AP for identification or grouping purposes, but it is not the specific tag type that defines roaming domains and RF properties in Cisco wireless deployments.

🔗 References

Cisco Wireless 9177 Series Access Points Data Sheet: Mentions RF tags in the context of AP management and deployment properties .

Cisco Wireless Solution Design Guide: Defines RF tags as the mechanism for assigning RF profiles and roaming policies to APs.

Explanation:

In the Cisco SD-WAN architecture, vManage (recently rebranded as Cisco Catalyst SD-WAN Manager) serves as the centralized management plane . It is the "single pane of glass" that provides a unified dashboard for all Day 0, Day 1, and Day 2 operations , including device onboarding, provisioning, policy creation, monitoring, and troubleshooting .

Why other options are incorrect:

A. vBond:
This is the orchestration plane component. It is responsible for the initial authentication of devices and facilitating their discovery of the other controllers (vManage and vSmart) .

B. vEdge:
This represents the data plane. These are the edge routers that forward user traffic, build secure IPsec tunnels, and apply policies like QoS and firewall . They do not provide centralized management.

C. vSmart:
This is the control plane component. It acts as the "brain" of the SD-WAN routing, exchanging routes and policy information with edge devices using the Overlay Management Protocol (OMP), but it does not carry user data or serve as a management interface .

🔗 References

Cisco Press Article: Describes SD-WAN Manager (vManage) as a network management system that provides a "single pane of glass" to manage Catalyst SD-WAN .

Cisco Documentation: States that "vManage is the management plane for the overall SDWAN solution" .

Explanation :

Here's why this meets all the requirements for the new 6 GHz-only SSID:

802.11ax Support: The 6 GHz band is exclusively for Wi-Fi 6E and Wi-Fi 7 devices, which are based on the 802.11ax standard .

Certificate Authentication: WPA3 Enterprise uses 802.1X authentication, which supports certificate-based authentication via protocols like EAP-TLS .

6 GHz Requirement: The 6 GHz band mandates WPA3 and does not support WPA2 for security and management frame protection (PMF) reasons .

Why other options are incorrect:

A. WPA2 Enterprise:
This is incorrect because the 6 GHz band does not support WPA2. It requires WPA3. The security settings for a 6 GHz SSID must be WPA3 only; mixed WPA2/WPA3 modes are not permitted .

B. WPA3 Personal:
While this provides the required WPA3 security for 6 GHz, it uses SAE (Simultaneous Authentication of Equals) with a pre-shared key (password) for authentication . This does not meet the requirement of authenticating all users using a certificate.

C. WPA2 Personal:
This is incorrect. WPA2 is not supported on the 6 GHz band, and it also does not provide the certificate-based authentication required by the scenario.

🔗 References

Cisco Documentation: States that WPA3 and OWE are mandatory for Wi-Fi 6E (6 GHz) and that WPA2 is not supported on this band .

Cisco Wireless Best Practices: Confirms that 6 GHz operation requires enabling WPA3 and disabling WPA2 .

✅Explanation:

This command enables Fast Transition (FT, also known as 802.11r) on a WLAN configured with a Pre-Shared Key (PSK). Fast Transition is a feature that reduces roaming latency for clients moving between access points, creating a seamless experience for voice and video applications.

The command format is specific: the ft element must be inserted directly into the security wpa akm command to enable FT for PSK-based authentication. The full configuration on a Cisco Catalyst 9800 would also include the security ft command and setting the PSK key, but the command that specifically enables AKM for FT with PSK is security wpa akm ft psk.

Why other options are incorrect:

A. security ft adaptive:
This command enables Adaptive 802.11r, a mode for mixed environments, but does not by itself configure the necessary authentication key management (AKM) for Fast Transition. The question asks for the command to enable FT on a corporate WLAN, implying a full configuration including AKM.

B. security wpa akm dot1x:
This configures the WLAN to use 802.1X authentication (Enterprise), not Pre-Shared Key (PSK). It does not enable Fast Transition.

C. security wpa akm psk:
This enables PSK authentication for the WLAN, but it does not enable Fast Transition. Without the ft keyword, Fast Transition is not active.

🔗 References:

Cisco Vulnerability Advisory: Provides configuration examples for PSK with Adaptive 11r (security ft adaptive & security wpa akm psk) and 11r-PSK (security ft & security wpa akm ft psk).

Cisco Catalyst 9800 Configuration Guide:Details the CLI steps for setting up 802.11r Fast Transition on a PSK WLAN, including the command security wpa akm ft psk.

Explanation:

The standard that provides the capability to permit or deny network connectivity based on the user or device identity is IEEE 802.1X. This standard defines port-based network access control (PNAC), which restricts access to the network until a client device or user successfully authenticates.

How 802.1X Works
When a device connects to a port that is secured with 802.1X, the port is in an unauthorized state. This allows only Extensible Authentication Protocol over LAN (EAPOL) traffic to pass through while blocking all other data, effectively denying network connectivity. The switch (acting as the authenticator) then requests the client's identity and relays this information to a central authentication server, typically a RADIUS server. If the server verifies the client's credentials (such as a username/password, a certificate, or a device MAC address), it sends an "accept" message, and the switch transitions the port to an authorized state, granting the device full network access.

Why Other Options Are Incorrect:

A. 802.1d
– This is the standard for the original Spanning Tree Protocol (STP), which prevents loops in a network by creating a loop-free logical topology. It does not involve authentication or access control.

C. 802.1q
– This is the standard for VLAN tagging and defines how VLAN membership information is inserted into Ethernet frames. It segments network traffic but does not authenticate users or devices.

D. 802.1w
– This is the standard for Rapid Spanning Tree Protocol (RSTP), which provides faster convergence than the original STP in case of network topology changes. It does not provide access control or authentication functions.

References
IEEE 802.1X-2020 standard abstract
Cisco configuration guides on 802.1X port-based authentication
Glossary definitions of IEEE 802.1 standards

✅ Explanation:

The correct answer is B. WPA3 Enterprise. This is the only wireless Layer 2 security method that meets both requirements for the new SSID: broadcasting on 6 GHz radios and authenticating users with EAP-TLS.

Why other options are incorrect:

A. WPA2 Enterprise:
This is incorrect because WPA2 is not permitted on the 6 GHz band. The 6 GHz band requires WPA3 security to be operational.

C. WPA3 Personal:
While this provides the required WPA3 security for 6 GHz, it uses Simultaneous Authentication of Equals (SAE) with a pre-shared key. This does not support the certificate-based authentication required by EAP-TLS.

D. WPA2 Personal:
This is incorrect for the same reasons as option A. WPA2 is not supported on the 6 GHz band, and a PSK would not support EAP-TLS authentication.

🔗 References
Cisco Official Documentation: Confirms that WPA2 is not supported on the 6 GHz band and WPA3 must be enabled.

Wi-Fi 6E Glossary Definitions: States that the Wi-Fi Alliance mandates WPA3-only security for certified Wi-Fi 6E networks and devices.

✅ Explanation:

In a high-density wireless environment, the primary goal is to increase capacity by creating smaller, more numerous coverage cells. The most direct action to control the maximum cell size is to decrease the transmit (TX) power on the access points. By lowering the TX power, the RF signal does not travel as far, reducing the physical coverage area of the cell. This allows more access points to be deployed in a given physical space, increasing the overall capacity of the network to handle more concurrent users. This approach is the most direct and effective method for controlling cell size.

Why other options are incorrect:

A. Statically set TX power on access points to max.
This would create very large cells, increasing overlap and co-channel interference, which degrades performance in high-density environments. This is the opposite of what should be done.

B. Disable low data rates.
Disabling low data rates prevents clients from operating at the edge of the cell, effectively shrinking the usable area of each AP's coverage. While this does help reduce cell size, it is a secondary strategy. Adjusting TX power is the primary and most direct physical method to control the actual RF cell boundary.

C. Set mandatory data rates.
Setting mandatory data rates is a configuration that controls which data rates clients must support to associate. Similar to disabling low rates, this helps manage client behavior and can shrink the usable cell edge, but it does not directly change the physical RF signal strength. The cell boundaries are still determined by TX power and the physical environment.

🔗 References

Cisco Wireless Design Best Practices:In high-density environments, reducing the power level of the APs is the primary method to decrease cell size and increase network capacity.

CWNA Official Study Guide: Defines cell size and explains how TX power directly controls the radius of a basic service set (BSS) coverage area.