Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅ Explanation:

In wireless networking, SNR is the measurement that directly compares the received signal strength to the background noise level. It is a fundamental metric for assessing the quality of a wireless link. SNR is calculated by dividing the received signal power by the noise power (typically expressed in decibels, dB). A higher SNR indicates that the signal is much stronger than the noise, leading to better performance, higher data throughput, and more stable connections. Conversely, a low SNR means the signal is weak relative to the noise, which can cause packet loss, retransmissions, and degraded performance.

Why other options are incorrect:

A. free space path loss:
This is a measure of the theoretical loss in signal strength that occurs as an electromagnetic wave travels through free space (a vacuum) over a given distance. It does not compare the received signal to background noise.

B. link power budget:
This is a total, planned calculation that accounts for all gains and losses in a link to ensure the receiver gets a strong enough signal. It typically includes factors like transmitter power, cable losses, antenna gains, and path loss, but it is not a measurement that compares the received signal to background noise. It is a planning tool, not a post-deployment measurement.

C. fading:
Fading is a variation in signal strength caused by changes in the propagation path, such as multipath interference or shadowing. It is a phenomenon that affects the signal, but it is not the measurement that compares the signal to noise.

🔗 References:

Cisco TAC Technical Documents: SNR defined as "the difference between the received signal and the noise floor."

CWNP (Certified Wireless Network Professional) Glossary: SNR is the direct ratio of the received signal power to the noise power, used to measure link quality.

✅ Explanation:

The Primary/Secondary/Tertiary controllers are configured and saved directly at the AP level in its nonvolatile memory (NVRAM). This method is known as priming the access point. When an AP is primed, the IP addresses of up to three controllers are stored in its NVRAM so it can remember them after a reboot or power failure. If the AP's current primary controller fails, it will attempt to join controllers from its list in this order: primary, secondary, then tertiary. This primed list is distinct from backup controllers configured at the WLC level.

Why other options are incorrect:

B. stored WLC information:
This describes the AP's cached list of up to 8 WLC addresses from its previous controller's mobility group. It is stored in NVRAM but is not manually configured like the Primary/Secondary/Tertiary list. This is a different, automatically populated memory.

C. DNS:
DNS is used to resolve CISCO-CAPWAP-CONTROLLER.localdomain for controller discovery, but this method is not configured in and stored by NVRAM; it relies on DNS server configuration.

D. IP Helper Addresses:
This is a router configuration used to forward broadcast traffic (like DHCP requests), not a method stored on the AP itself. It helps APs find DHCP servers, not directly join HA controllers.

🔗 References

Cisco Catalyst AP Installation Guide: "If the access point was previously joined to a controller, the IP addresses of the primary, secondary, and tertiary controllers are stored in the access point's nonvolatile memory"

Cisco Learning Network Discussion: Details how Primary/Secondary/Tertiary controllers are manually configured and saved at the AP level in NVRAM

✅ Explanation:

AP mode that allows an engineer to scan configured channels for rogue access points is monitor mode.

In this mode, the access point's radios are dedicated to monitoring the Wi-Fi channel for activities like rogue detection and Intrusion Detection Systems (IDS), and it does not serve client traffic.

Why other options are incorrect:

A. sniffer:
In this mode, the AP captures all Wi-Fi traffic on a channel and forwards it to a packet analyzer for troubleshooting and analysis. It is used for capturing wireless frames, not for scanning configured channels for rogue access points.

C. bridge:
This mode establishes a point-to-point or point-to-multipoint wireless link between network segments, often used for mesh networks. It is not dedicated to scanning for rogue APs.

D. local:
This is the default operating mode where the AP provides wireless client access and tunnels traffic back to the controller. While a local mode AP can be configured to perform rogue detection, it is not a dedicated scanning mode.

🔗 References

Cisco Wireless Controller Configuration Guide, Release 8.8 - Managing APs

✅ Explanation:

Traditional security architecture focuses on a strong perimeter at the Internet edge, protecting against threats entering or leaving the network (north-south traffic). This "castle-and-moat" approach assumes that once inside, traffic is trustworthy.

However, this assumption is no longer valid. Threats that breach the perimeter can now move laterally (east-west) across the internal network for extended periods, searching for valuable data. An NGFW at the data center core is placed in the internal traffic path to inspect and control this communication between trusted systems, preventing the spread of an attack from a compromised server to other critical assets. This is a fundamental security enhancement driven by the modern threat landscape.

Why other options are incorrect:

A. virtual private network for remote access:
This is incorrect. Remote access VPNs are a standard feature of edge firewalls and are not a new security enhancement added solely by deploying an NGFW at the data center.

B. DDoS protection:
While an NGFW can offer some DDoS protection, this is traditionally a primary function of Internet edge devices and is not the new benefit gained from a data center NGFW, which is focused on internal traffic.

D. firewall protection of the south-north traffic at the data center:
This is incorrect. South-north (or north-south) traffic is the traditional edge traffic that the firewall at the Internet edge already protects. The new and crucial enhancement is the protection of east-west internal traffic, which had previously been left unscrutinized.

🔗 References

Fortinet White Paper: Notes that "hackers penetrating the perimeter now roam the network for days or weeks," meaning the threat has expanded to the data center core where data moves between trusted systems.

Expert Insights: Explains that perimeter firewalls alone fall short because east-west traffic gets a free pass, allowing attackers to move laterally.

✅ Explanation:

A Type 1 hypervisor, also known as a bare-metal hypervisor, is installed directly onto a server's physical hardware without requiring an underlying operating system . This architecture is distinct from a Type 2 hypervisor, which runs as a software layer on top of a host OS .

Why other options are incorrect:

A. It runs on top of the host operating system.
This describes a Type 2 hypervisor, not a Type 1. A Type 1 hypervisor bypasses the host OS entirely and runs directly on hardware .

B. It is preferred for supporting nonproduction workloads.
Type 2 hypervisors are generally preferred for nonproduction tasks like development and testing due to their ease of installation on existing systems . Type 1 hypervisors are the standard for enterprise production workloads due to their superior performance and isolation.

C. It has greater latency than a Type 2 hypervisor.
This is incorrect. Because a Type 1 hypervisor runs directly on hardware without the extra OS layer, it experiences lower latency and provides higher performance than Type 2 hypervisors .

🔗 References

PhoenixNAP Bare Metal Hypervisor Explanation: Details that Type 1 hypervisors run directly on physical hardware, offering near-native performance and a smaller attack surface without an intermediary OS .

DigitalOcean Conceptual Article: Defines a bare-metal hypervisor as virtualization software installed directly on a server’s physical hardware, contrasting it with hosted hypervisors that run on top of an existing OS .

✅ Explanation:

SSO (Stateful Switchover) is a high-availability feature that works with HSRP to minimize network disruptions, but the key to this question is understanding what SSO does and how it interacts with HSRP.

SSO provides Route Processor (RP) redundancy by establishing one RP as the active processor and another as the standby processor, synchronizing critical state information between them. When the active RP fails, the standby RP takes over control of the same device.

Why other options are incorrect:

A. It enables HSRP to elect another switch in the group as the active HSRP switch.
This describes what happens without SSO. With SSO, the standby RP takes over on the same device, and the HSRP active router does not change.

B. It ensures fast failover in the case of link failure.
Link failure is not the primary scenario addressed by SSO with HSRP. SSO protects against RP failure on the device itself, not link failures.

C. It enables data forwarding along known routes following a switchover, while the routing protocol reconverges.
This describes Nonstop Forwarding (NSF), which often works alongside SSO but is not the function of SSO with HSRP. NSF ensures data forwarding continues during routing protocol reconvergence; SSO with HSRP preserves the HSRP virtual gateway state during an RP switchover.

🔗 References:

Cisco Documentation - SSO HSRP: "When an RP is active and the other RP is standby, SSO enables the standby RP to take over if the active RP fails... HSRP SSO information is synchronized to the standby RP, allowing traffic that is sent using the HSRP virtual IP address to be continuously forwarded during a switchover without a loss of data or a path change"

Cisco FHRP-SSO Aware HSRP: "If the active RP fails, no change occurs to the HSRP group itself and traffic continues to be forwarded through the current active gateway router"

✅ Explanation:

The language used to model configuration and state data is YANG (Yet Another Next Generation). YANG is a data modeling language originally designed to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), as well as Remote Procedure Calls and notifications . Since its inception, YANG has also been adopted for use with other protocols like RESTCONF, cementing its role as the standard language for network data modeling .

Why other options are incorrect

A. JSON:
JSON (JavaScript Object Notation) is a data encoding format, not a data modeling language. While YANG-modeled data can be encoded in JSON for transmission , JSON itself does not define the structure or constraints of the data—it is the representation, not the model.

B. XML:
XML (Extensible Markup Language) is also a data encoding format, not a modeling language. Similar to JSON, YANG data can be encoded in XML , but XML only defines the syntax of the data instance, not the underlying data model, which is defined by YANG.

C. XDR:
XDR (External Data Representation) is a standard for data serialization, commonly used in systems like Sun RPC (Remote Procedure Call). It is not a data modeling language used for network configuration protocols like NETCONF or RESTCONF, nor is it the standard for modeling configuration and state data in modern network management.

🔗 References

RFC 7950: Defines YANG as a data modeling language for configuration and state data .

IETF YANG 2.0 Draft: States YANG is used to model configuration data, state data, Remote Procedure Calls, and notifications .

✅ Explanation:

A Type 1 hypervisor, also known as a "bare-metal" hypervisor, runs directly on a physical server and includes its own lightweight operating system. This operating system is not a general-purpose OS like Windows or Linux but a hypervisor-specific kernel optimized for virtualization . Because it replaces the traditional OS, it has direct, low-level access to the server's hardware resources (CPU, memory, storage, networking) without the overhead of an intermediary layer. This architecture results in superior performance, lower latency, and enhanced security, making Type 1 hypervisors the standard choice for enterprise data centers and production server virtualization.

Why other options are incorrect:

A. runs directly on a physical server and depends on a previously installed operating system This is incorrect. A hypervisor that depends on a previously installed host OS describes a Type 2 hypervisor. A Type 1 hypervisor does not rely on a general-purpose OS but includes its own.

C. runs on a virtual server and depends on an already installed operating system This is incorrect. A Type 1 hypervisor runs on physical hardware, not on a virtual server.

D. run on a virtual server and includes its own operating system. This is incorrect. Type 1 hypervisors run on physical servers, not virtuaservers.

🔗 References

VMware Virtualization Basics:
Defines a Type 1 hypervisor as "running directly on the physical server’s hardware," with VMware ESXi being a prime example.

Red Hat Glossary: "A Type 1 hypervisor runs directly on the host's physical hardware and is often referred to as a 'bare-metal' hypervisor."

✅ Explanation:

When a wireless client performs an inter-controller Layer 3 roam between two controllers in different mobility groups, the controllers cannot directly share client context. To maintain the client's original IP address, the auto-anchor feature is used. It enables the foreign controller to automatically establish an anchor tunnel to the client's original controller . All traffic for that client is then tunneled back through the anchor controller, preserving the original IP address .

Why other options are incorrect:

A. interface groups:
This is a configuration used to group multiple switch ports or VLAN interfaces together for management or policy purposes. It does not provide a mechanism to anchor a client's IP address during a Layer 3 roam between different mobility groups.

B. RF groups:
An RF group, or RF domain, is a dynamic cluster of controllers that work together to coordinate Radio Resource Management (RRM) algorithms and rogue AP detection . It does not support client IP preservation across mobility groups.

C. AAA override:
This feature allows a RADIUS server to override WLAN or VLAN assignments when a client authenticates. It does not establish anchor tunnels for IP preservation.

🔗 References:

Cisco Learning Network:Defines inter-controller Layer 3 roaming, auto-anchor mobility, and how the anchor controller preserves the client's original IP address .

Cisco Wireless Controller Configuration Guide: Explains Layer 3 roaming and the anchor-foreign relationship between controllers .