Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅Explanation:

In REST API design, security is not a single mechanism but a layered approach. Separation of privilege is fundamental because it protects against the exploitation of one single security control. A common application of this principle is the mandatory segregation of duties between API requesters and approvers for critical actions . This means a user who requests access to a critical API must have their request approved by a separate, authorized individual or group, preventing any single actor from executing a sensitive operation in isolation . This design practice directly reduces the risk of unauthorized, accidental, or malicious access to critical systems .

Why other options are incorrect:

B. password hashing:
While password hashing (e.g., SHA-256) is an essential practice for securely storing user credentials, it is considered a lower-level implementation detail rather than a core architectural design principle. It protects against credential exposure in storage, but it does not dictate how access to resources is granted or enforced.

C. Confidential algorithms:
"Confidential algorithms" are not a recognized security design principle. Relying on the secrecy of an algorithm for security is widely considered a weak approach, often summarized as "security through obscurity" . The recommended practice is to use open, industry-standard algorithms (like AES-256) and to keep only the encryption keys secret, not the algorithm itself.

D. OAuth:
OAuth (specifically OAuth 2.0) is a standardized authorization framework and a specific technical protocol for delegating access . While it is a critically important tool for implementing REST API security, it is not a high-level design principle like separation of privilege. OAuth is a means to enforce authentication and authorization, whereas separation of privilege is a broader security philosophy.

🔗 References:

OWASP API Security Top 10: Lists Broken Object Level Authorization (BOLA) as the most common API vulnerability, highlighting the need for proper separation of privileges at every level .

NIST Guidelines: Define the principle of separation of duties as a core security control to prevent fraud and mitigate errors .

✅Explanation:

When a switch using dual Route Processors (RPs) with Stateful Switchover (SSO) experiences a primary RP failure, the following occurs:

The standby RP is fully initialized and state information is maintained. This is the defining feature of SSO. The standby RP is in a "hot standby" state, meaning it is fully booted and has a complete, synchronized copy of all active state information (such as routing tables, forwarding tables, and session data) from the primary RP. This allows for a seamless transition [citation:74355].

Data forwarding can continue along known paths until routing protocol information is restored. Because the standby RP has the forwarding state, data plane traffic can continue to be forwarded along known paths immediately after the switchover. The control plane (routing protocols like OSPF, EIGRP) may need to reconverge, but data forwarding is not interrupted.

Why other options are incorrect:

A. Data forwarding is stopped until the routing protocols reconverge after the switchover.
This is incorrect. A key benefit of SSO is that data forwarding continues uninterrupted during the switchover. The standby RP has the necessary forwarding information to keep traffic flowing.

B. The standby route processor initialization is started when the primary route processor fails.
This is incorrect. In an SSO system, the standby RP is already fully initialized and synchronized before a failure occurs. It does not need to boot up or initialize upon failure. This is what distinguishes SSO from less advanced redundancy mechanisms.

D. User sessions are immediately recreated on the new active route processor.
This is incorrect. User sessions are maintained and continue to exist on the new active RP because their state information was synchronized. The sessions are not "recreated" from scratch; they are already present and preserved.

🔗 References:

Cisco High Availability (SSO/NSF) Documentation: Explains that SSO synchronizes state information between RPs so the standby can take over without interrupting data forwarding.

Cisco "Understanding Stateful Switchover" White Paper: Details that the standby RP is fully initialized and running in a "hot" state, and that data forwarding continues during an SSO switchover.

✅ Explanation:

Stateless REST API calls are fundamental to cloud-native applications because each request from a client to the server must contain all the information needed to understand and process it. The server does not retain any client session state. This design is critical for cloud environments because it makes the application highly scalable and resilient.
V In a stateless architecture, any server instance can handle any request from any client. This enables horizontal scaling—if traffic spikes, you simply spin up more instances to handle the load, and because there is no client affinity (no "sticky sessions"), a load balancer can distribute requests evenly across all instances . Similarly, when demand drops, instances can be removed without disrupting active users.

This statelessness also makes redeployment easier. If a server instance fails or needs to be updated, a new instance can be brought online to handle requests seamlessly. This is a core requirement for achieving high availability and resilience in distributed systems.

Why other options are incorrect:

A. They use HTTPS to implement all calls.
HTTPS (HTTP Secure) is a transport protocol that provides encryption and security (TLS/SSL) for API calls, but it is not the reason they are useful for scaling. An API can be stateless regardless of whether it uses HTTP or HTTPS.

B. They control URL decoding.
URL decoding is a standard function performed by an API gateway or web server to interpret the request's path and query parameters. It is not a factor in the stateless design for scalability.

D. They rely on data stored on the server for calls.
This describes a stateful application, which is the opposite of stateless. In a stateful system, the server must remember client context (e.g., session IDs), making it harder to scale because requests must be routed to the specific server that holds that client's state.

🔗 References:

REST API Constraints: Statelessness is a core constraint of REST API design, requiring that each request contains all needed information.

Cloud Architecture Best Practices: Stateless services enable horizontal scaling and support rapid deployment in cloud environments.

✅ Explanation:

VRRP is an open-standard redundancy protocol designed to eliminate the single point of failure that exists when a network uses a single default gateway . It works by combining multiple physical routers into a single logical Virtual Router. This virtual router is the entity that end hosts use as their default gateway .

The key to this operation is the use of both a Virtual IP address and a Virtual MAC address. The Virtual IP address (VIP) is the IP address configured on the hosts as their gateway . Within the VRRP group, the physical router that is elected as the Active Router (or Master) assumes responsibility for the Virtual Router . This Active Router takes ownership of the Virtual IP address and, critically, it responds to ARP requests with the Virtual MAC address . This ensures a seamless failover. If the Active Router fails, a Backup Router with the highest priority takes over the Virtual Router, using the same Virtual IP and Virtual MAC. Hosts continue to send traffic to the same addresses without needing to reconfigure, making the redundancy transparent .

Why other options are incorrect:

A. It inherently balances load amongst the available gateways.
In its standard form, VRRP operates on an Active/Backup model where only the Active Router forwards traffic, meaning it does not inherently perform load balancing across all members . While advanced configurations like creating multiple VRRP groups can achieve load sharing , this is not a built-in characteristic of the protocol itself.

B. It ensures symmetric traffic flow upstream and downstream.
VRRP provides redundancy for the default gateway but does not inherently ensure that all traffic, especially in complex topologies, will take the exact same path both upstream and downstream. As one search result notes, preserving symmetric routing is a separate problem that can require additional mechanisms to ensure that return traffic from a server farm uses the same firewall as the forward path . This is not a primary function of VRRP itself.

C. It is a Cisco proprietary protocol.
This is false. VRRP is an open, non-proprietary standard defined by the IETF in RFC 5798 and RFC 9568 . The proprietary Cisco equivalent protocol is Hot Standby Router Protocol (HSRP) .

🔗 References

RFC 9568 (VRRPv3 for IPv4 and IPv6): Defines VRRP, the virtual router, and the election of an Active Router .

Huawei Configuration Guide: Details how a virtual router uses a Virtual IP address and Virtual MAC address

✅ Explanation:

The Received Signal Strength Indicator (RSSI) is the measurement used to depict the cell edge of access points during a post-deployment wireless survey . The cell edge is fundamentally defined by the boundaries where the signal strength from an access point falls below a predetermined, usable threshold .

RSSI is a direct measurement of the power level of the signal received from an access point. By walking the site and recording RSSI values, a survey tool creates a visual map of coverage areas, marking the boundaries where RSSI drops to the design's minimum acceptable level (e.g., -67 dBm for data or -72 dBm for voice). This defines the cell edge for validation and comparing to the predictive model . Other measurements (SNR, Noise, CCI) are important but are not the primary metric for defining a cell edge.

Why other options are incorrect:

B. SNR – Signal-to-Noise Ratio measures the strength of the signal relative to background noise. While a good SNR is essential for high performance, it is the RSSI value that is used as the threshold to define the cell edge .

C. Noise – This measures the background interference level. While important for calculating SNR and for overall link quality, it does not define the coverage boundary .

D. CCI – Co-Channel Interference measures interference from other access points operating on the same channel. It is a factor affecting performance but does not determine the cell edge boundary .

🔗 References:
"Your usable edge is at -67 dBm" using RSSI measurements from an AP to determine coverage boundaries .

A post-deployment survey validates the network by using a survey tool to measure cell size and validate power levels .

✅ Explanation:

The script fails because it attempts to connect to the NETCONF-capable Cisco IOS XE device using the default SSH port 22. However, NETCONF operates over a dedicated port, which is port 830, as defined in RFC 6242. By default, NETCONF servers listen on TCP port 830 for secure NETCONF-over-SSH connections. Although some devices may support NETCONF over port 22, this is not the standard and is often disabled by default. The correct configuration is to specify port=830 in the connection parameters.

Why other options are incorrect:

A. print (netconf_host.get_config('show running'))
This is incorrect. The get_config() method in the ncclient library expects a datastore argument (e.g., 'running', 'candidate', or 'startup'), not a CLI command like 'show running'. Using a CLI command would result in a syntax error.

B. device_params={'name':'ios-xe'}
This is incorrect. The script already uses the correct device parameter {'name':'iosxe'}. Changing it to 'ios-xe' would not resolve the connection failure, as the failure is due to the port being incorrect.

D. hostkey_verify=True
This is incorrect. The script already has hostkey_verify=False. Setting it to True would require the host key to be validated, which could cause additional errors if the host key is not in the known_hosts file. This does not address the connection failure.

🔗 References:

RFC 6242: Defines the NETCONF protocol over SSH, specifying port 830 as the default port.

ncclient Documentation: The connect() method requires the port parameter to specify the NETCONF server's port; if omitted, the default SSH port 22 is used.

✅ Explanation:

Signal-to-Noise Ratio (SNR) is measured in dB (decibels). SNR is a ratio that compares the power of a received signal to the power of the background noise. Because it is a ratio of two power levels, it is expressed in decibels (dB), which is a logarithmic unit used to express the relative difference between two values.

This is a fundamental concept in wireless networking: SNR is always reported as a positive value in dB, representing the margin (or "delta") between the signal strength (RSSI) and the noise floor. For example, if the RSSI is -65 dBm and the noise floor is -95 dBm, the SNR would be 30 dB. This value indicates how much stronger the signal is than the noise, which directly impacts the achievable data rate and connection reliability.

Why other options are incorrect:

A. mW (milliwatts):
This is a unit of absolute power, not a ratio. While signal strength can be expressed in mW, SNR is a comparison between two power levels, making it a dimensionless ratio expressed in dB.

B. dBm (decibel-milliwatts):
This is a unit of absolute power relative to 1 milliwatt. It is used to measure the absolute power level of a signal (RSSI) or noise floor, not the ratio between them. SNR is the difference between two dBm values, yielding dB.

D. dBi (decibels relative to isotropic):
This is a unit of antenna gain, indicating how much an antenna focuses power relative to an ideal isotropic radiator. It is not used to measure SNR.

🔗 References:

IEEE 802.11 Standards: Define RSSI in dBm and SNR in dB as the key metrics for radio link quality.

Cisco Wireless Design Guides: Express SNR as a decibel (dB) value representing the difference between the signal and noise floor.

✅ Explanation

VXLAN (Virtual Extensible LAN) is a network virtualization technology that uses a MAC-in-UDP encapsulation scheme. It encapsulates the original Layer 2 Ethernet frame within a UDP packet, allowing Layer 2 networks to be extended over a Layer 3 IP infrastructure.

The encapsulation process works as follows:
The original Ethernet frame from the VM is encapsulated with a VXLAN header (8 bytes, containing the 24-bit VNI)
This is then wrapped in a UDP header (destination port 4789 by default)
Finally, it is encapsulated in an outer IP packet for transport across the underlay network
This MAC-in-UDP approach provides key benefits:
Scalability: 24-bit VNI supports up to 16 million segments (vs 4096 VLANs)
Layer 2 extension: Enables VM migration across Layer 3 boundaries
Load balancing: UDP source port hash enables ECMP

Why other options are incorrect:

A. It extends Layers 2 and Layer 3 overlay network over a Layer 2 underlay.
This is the opposite of how VXLAN works. VXLAN specifically extends Layer 2 networks over a Layer 3 IP underlay, not a Layer 2 underlay. The underlay network is typically a routed IP network that provides connectivity between VTEPs.

B. It has a 12-byte packet header.
The VXLAN header is actually 8 bytes, consisting of flags (8 bits), a 24-bit VNI, and reserved fields. Some sources may refer to the full encapsulation overhead (VXLAN header + UDP header + outer IP header), but the VXLAN header itself is 8 bytes.

D. It uses TCP for transport.
VXLAN uses UDP as its transport protocol, not TCP. It uses UDP port 4789 by default (IANA assigned). UDP is used because it enables stateless tunneling and allows for ECMP load balancing through source port entropy.

🔗 References

RFC 7348/VXLAN IETF Draft: Defines VXLAN as a MAC-in-UDP encapsulation scheme over Layer 3 networks

Cisco Nexus Configuration Guide: "VXLAN is a MAC in IP/UDP (MAC-in-UDP) encapsulation technique"

✅ Explanation:

A next-generation firewall (NGFW) deployed at the data center is primarily designed to protect against zero-day attacks—threats that exploit previously unknown vulnerabilities for which no signature or patch yet exists. This is a key differentiator from legacy firewalls, which rely on signature-based detection and are ineffective against novel threats .

NGFWs incorporate advanced detection technologies to address this critical gap:

AI and Machine Learning: NGFWs embed machine learning capabilities inline to prevent unknown, zero-day threats without requiring signatures . This reduces threat reaction time to seconds and achieves high detection rates for unknown variants .

Deep Packet Inspection (DPI): By examining packet content, headers, and behavior, NGFWs can detect anomalies and identify malicious patterns that signature-based systems miss .

Inline Sandboxing and Real-Time Analysis: Some NGFWs integrate AI-powered inline sandboxes that analyze unknown files in real-time and block them before they enter the network .

Why other options are incorrect:

A. signature-based malware
Signature-based malware detection is a baseline capability of traditional firewalls and NGFWs, but it is not their defining feature. Signature-based detection is reactive and cannot protect against malware that has not yet been identified and cataloged .

B. DMZ web server vulnerabilities
While NGFWs can protect web servers through application-layer inspection and IPS capabilities, this is a specific use case rather than a defining characteristic of data center NGFWs.

D. DDoS
Distributed Denial of Service (DDoS) protection is primarily a network-layer (Layer 3/4) function. While NGFWs may incorporate basic anti-DDoS capabilities, large-scale DDoS protection is typically handled by dedicated appliances or cloud-based scrubbing services, not by NGFWs .

🔗 References

Palo Alto Networks PAN-OS Nova: "Stops 26% more zero-day malware than traditional sandboxes; detects 60% more injection attacks"

Huawei AI Firewalls: "AI detection algorithms deployed at local gateways enable rapid identification of unknown virus variants, achieving a 95% detection rate for unknown threats"

✅ Explanation:

A Type 1 hypervisor, also known as a "bare-metal" hypervisor, is a fundamental component of modern data center and cloud infrastructure. Its key characteristics are defined by its unique architecture.

B. They provide a platform for running bare metal operating systems.
This is accurate in the sense that the hypervisor replaces the traditional host operating system on the physical server. It runs directly on the hardware to create and manage virtual machines, which can then run a variety of operating systems.

E. They provide a platform for running guest operating systems.
This is the core function of any hypervisor. A Type 1 hypervisor creates isolated virtual machines, each of which can run its own guest operating system. These guest OSes (e.g., Windows, Linux) operate independently, believing they have direct access to the hardware, while the hypervisor manages the underlying physical resources.

Why other options are incorrect:
A. They are widely available to license for free.
While some Type 1 hypervisors are free (e.g., VMware Esi Free, Hyper-V included with Windows Server), enterprise-grade versions and fully featured editions often require a paid license. The cost is a significant factor, but "widely available to license for free" is not a defining characteristic of the technology itself.

C. They can be used to create and manage virtual storage.
While hypervisors manage storage resources for VMs, creating and managing virtual storage is a function typically handled by the management console or storage virtualization layer, not a core characteristic of the hypervisor itself.

D. They are a software layer that runs on top of a virtual server.
This describes a Type 2 (hosted) hypervisor, which runs as an application on top of a pre-existing host operating system. Type 1 hypervisors run directly on physical hardware without an underlying OS.

🔗 References

Phoenix NAP Bare Metal Hypervisor Blog: Defines a bare metal hypervisor as software installed directly on physical hardware, managing guest OSes without an underlying OS.

Microsoft Learn Hypervisors: States Type 1 hypervisors run directly on host hardware to control hardware and monitor guest OSes