Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅ Explanation:

The requirement is to configure a WPA2+WPA3 policy with the Personal security type. This is known as a WPA3 Personal Transition Mode (also referred to as WPA2+WPA3-Personal mixed-mode). In this mode, the wireless LAN is configured to support both WPA2-Personal and WPA3-Personal clients to ensure broad compatibility .

The key factor for choosing the encryption cipher is compatibility across both security standards. WPA2-Personal is limited to 128-bit encryption and does not support 256-bit ciphers . The most common and compatible cipher is CCMP128 (AES), as it is the required minimum encryption algorithm for both WPA2 and WPA3-Personal modes .

Why other options are incorrect:

A. Configure the GCMP256 encryption cipher.
This is a 256-bit cipher that is not supported by WPA2. It is typically used with specific WPA3-Enterprise configurations (like WPA3-Enterprise 192-bit mode) or for Wi-Fi 7, not for a mixed WPA2+WPA3-Personal policy .

C. Configure the GCMP128 encryption cipher.
This is a 128-bit encryption cipher, but it is not part of the standard WPA2 mandatory cipher set (which is CCMP/AES). It is an option that is not commonly used or compatible for a WPA2+WPA3 mixed mode .

D. Configure the CCMP256 encryption cipher.
This is a 256-bit cipher that is not supported by WPA2-Personal. It is typically used only for specific WPA3-Enterprise configurations, not for WPA2+WPA3-Personal transition mode .

🔗 References:

Cisco WPA3 Transition Mode Documentation: A WPA2+WPA3-Personal mixed-mode configuration requires enabling AES/CCMP128 ciphers .

Cisco WPA3 Deployment Guide: CCMP128(AES) is the required cipher for WPA2+WPA3 Personal transition mode .

✅ Explanation:

The described scenario—a client roaming between two different wireless LAN controllers (WLCs) that are mobility peers—defines an inter-controller roam . The key factor is that the client moves between two separate physical controllers . The fact that both controllers have dynamic interfaces on the same client VLAN further classifies this as a Layer 2 inter-controller roam, meaning the client remains on the same IP subnet and retains its IP address . In this scenario, the new controller exchanges mobility messages with the original controller, and the client database entry is moved to the new controller to keep the session intact .

Why other options are incorrect:

A. intra-VLAN:
This describes a network condition (same subnet/VLAN) rather than the roaming event itself. While this is a Layer 2 roam, "inter-controller" is the correct term for the roaming event.

C. intra-controller:
Incorrect because this term describes a client roaming between APs connected to the same WLC. The question explicitly states the client roams between different controllers, making this option invalid .

D. inter-subnet:
Incorrect because this term describes roaming where the client moves to a different IP subnet or VLAN . The scenario specifies both controllers have interfaces on the same client VLAN .

🔗 References:
Cisco Learning Network: What are Mobility Groups?

✅ Explanation:

The root cause is how multicast audio is transmitted over Wi-Fi. Unlike unicast traffic, which uses the highest possible data rate, multicast traffic is sent at one of the basic (mandatory) data rates . In the exhibit, both 24 Mbps and 54 Mbps are set as "Mandatory" rates.

For multicast audio to be reliably received, the transmission rate must not be too high, as clients at the edge of a cell may not be able to hear it. The solution is to set the highest mandatory rate to the lowest feasible speed. By moving the 24 Mbps and 54 Mbps rates from "Mandatory" to "Supported," the highest mandatory rate is lowered (in this case, to 12 Mbps, which is already mandatory). This ensures that multicast audio is broadcast at a more robust, lower data rate that all clients can reliably receive .

Why other options are incorrect:

B. Set the RSSI Threshold to -67dBm:
While an RSSI of -67 dBm is a general guideline for good voice coverage , adjusting this threshold does not directly change the data rate at which multicast packets are transmitted. It is a coverage threshold for client roaming, not a solution for the multicast transmission rate issue.

C. Set the Fragmentation Threshold to 1250 bytes:
The fragmentation threshold (2346 bytes in the exhibit) controls the size at which packets are broken into smaller fragments to improve reliability in noisy environments . It does not affect the fundamental rate at which multicast traffic is sent and is not a primary factor in resolving multicast audio reliability .

D. Disable RSSI Low Check:
This setting generally relates to client association and roaming decisions based on signal strength, not the transmission rate of multicast packets.

🔗 References:

Multicast and Data Rates: Cisco documentation explains that multicast traffic is transmitted at the highest basic/mandatory data rate, recommending that only the lowest enabled rate be set as mandatory to ensure reliable reception .

RF Design for Voice: Sources confirm that for voice applications, maintaining specific RSSI and SNR levels is important, but the multicast data rate is a separate configuration for reliable streaming .

✅Explanation:

Cisco Catalyst SD-WAN routers can be deployed at the perimeter of a site in various forms to provide SD-WAN services. This flexibility is a key aspect of the architecture, allowing it to adapt to different deployment scenarios, from physical branch offices to virtualized and cloud environments.

Cisco's official solution overview states that the data plane of the SD-WAN fabric comprises "the data plane edge devices at branches, campuses, data centers, cloud environments, and other sites." These edge devices can be deployed in the following ways:

Hardware Instances: Physical routers like the Cisco Catalyst 8000 series, ISR 4000 series, and Meraki MX appliances can be deployed on-site to provide high-performance SD-WAN services directly at the WAN edge.

Software (Virtualized) Instances: The Cisco Catalyst 8000V Edge Software is a virtual form factor that can be launched on hypervisors (like ESXi or KVM) or cloud platforms, delivering the same SD-WAN and network services functionality without the need for dedicated hardware.

Cloud Instances: Beyond virtual machines, Cisco SD-WAN can be deployed directly as a cloud-native service. This includes connectivity to cloud service providers (like AWS, Azure, Google Cloud) via solutions like Cloud OnRamp for Multicloud, and can also be integrated into a SASE architecture via the cloud-hosted security services.

Therefore, the comprehensive list includes hardware, software, virtualized instances, and cloud-based deployment options, making Option B the most complete and accurate answer.

Why other options are incorrect:

A. virtualized instances:
Incorrect. This excludes hardware and cloud-based deployments, which are essential deployment options for Cisco Catalyst SD-WAN routers.

C. hardware, virtualized, and cloud instances:
Incorrect. This list omits the "software" category, which is a significant deployment model, as "virtualized instances" are a specific type of software deployment. The term "software" more comprehensively covers both virtualized and other software-based deployment methods.

D. hardware and virtualized instances:
Incorrect. This answer excludes cloud-based deployments, which are a fundamental part of the Cisco Catalyst SD-WAN architecture for both on-premises and multi-cloud environments.

References:

Cisco Catalyst SD-WAN Solution Overview: Describes how the data plane consists of WAN Edge devices deployed at branches, campuses, data centers, cloud environments, and other sites .

Cisco Catalyst SD-WAN Components (Cisco Press): Details the deployment options for SD-WAN Control Components: Cisco cloud-hosted, managed service provider/partner hosted, on-premises, and customer cloud-hosted .

✅ Explanation:

NETCONF YANG represents data structures in a hierarchical, tree-based format that can be encoded in XML.

The NETCONF protocol uses XML to encode the actual data and operations exchanged between clients and servers . A YANG module defines the data model, including the hierarchy of data nodes, their constraints, and how they relate to each other . This model is then translated into an XML format for transmission over the network . The NETCONF protocol defines how this XML data is structured, validated, and used in operations like or .

Why other options are incorrect:

A. as strict data structures defined by RFC 6020:
This is incorrect because YANG does not define "strict data structures" in the sense of a rigid programming language type system. YANG is a modeling language that defines hierarchical data and constraints, but the specific format of that data is determined by the encoding (XML, JSON, etc.) . The model is the structure, and the encoding is the representation .

C. In an HTML format:
This is incorrect. HTML is a markup language for web pages, not a data modeling language for network management protocols. YANG data is encoded using XML, JSON, or CBOR, not HTML .

D. as modules within a tree:
This is partially correct but incomplete. YANG modules are part of the data model, and they can be visualized as a tree, but the question asks how data is represented for NETCONF, which is in XML. While modules are hierarchical , the correct answer is the specific encoding format used for NETCONF (XML) .

References:

RFC 6020: Defines YANG as a data modeling language and specifies XML encoding.

IETF NETMOD Draft: States YANG defines a hierarchy of data as a tree and is directly mapped to XML content transmitted in NETCONF.

✅Explanation:

The technology that collects location information through data packets received by APs—rather than relying on mobile device probes—is FastLocate.

Traditional Wi-Fi location tracking relies on probe request messages from mobile devices to collect RSSI data. However, to conserve battery, devices are probing less frequently, with intervals ranging from 10 seconds to 5 minutes, resulting in inadequate data points to represent real-world movement accurately.

FastLocate solves this by using the more frequent data packets (instead of relying solely on probe requests) to collect RSSI information, enabling higher location refresh rates and more frequent location-based services updates. This provides more data points to accurately represent end-user activity.

Why other options are incorrect:

A. Detect and Locate – This is a Cisco CMX service for viewing and tracking devices in a deployment, not a specific technology for collecting location information through data packets.

C. Hyperlactation – Uses Angle-of-Arrival (AoA) of Wi-Fi signals with specialized hardware (Hyperlactation module) to achieve sub-meter accuracy, not data packet collection.

D. RF Fingerprinting – Uses RF prediction to create a grid mapped to a floor plan, correlating known RF characteristics with real-time user information, but it is not specifically the data packet-based collection method.

🔗 References:

Cisco Catalyst 9800 Fast Locate Configuration Guide: "Fast Locate enables higher location refresh rates by collecting RSSI or location information through data packets received by the APs".

Cisco CMX Fast Locate Deployment Guide: "Fast Locate adds the capability to get RSSI/Location information using data packets received by the AP for higher location refresh rates".

✅ Explanation:

The corporate policy requires a certificate-based authentication system using ISE and user credentials. This describes the 802.1X framework, which is the IEEE standard for port-based network access control . It uses a three-party architecture: the supplicant (client device), the authenticator (access point), and the authentication server (the RADIUS server, such as Cisco ISE) .

Why other options are incorrect:

A. none:
Selecting "none" for authentication key management means the WLAN would have no authentication or encryption, which does not meet the policy requirement.

B. PSK:
PSK (Pre-Shared Key) uses a shared password for authentication and does not support certificate-based authentication with ISE .

D. CCKM: Cisco Centralized Key Management (CCKM) is a fast roaming method that reduces the time required for a client to re-authenticate when roaming between access points . It is a speed-enhancing feature, not an authentication method that supports certificate-based authentication with ISE. It can be used in conjunction with 802.1X, but it is not the correct authentication key option to meet the policy requirement .

🔗 References:
[802.1X as the standard for wireless LAN security ]
[EAP-TLS requirements and flow ]
[Comparison of PSK vs. 802.1X enterprise authentication ]

✅Explanation:

To configure an SSID with a Pre-Shared Key (PSK) on a Cisco Catalyst 9800 WLC, the engineer must edit the WLAN Profile. The WLAN Profile is the specific configuration entity that defines an SSID's wireless characteristics, including its security settings. This is where authentication methods such as PSK, 802.1X, and related encryption settings are configured. The requirement is to use a PSK for authentication, which is a security setting, so the WLAN profile is the appropriate configuration target.

Why other options are incorrect:

A. RF Profile – RF profiles contain settings for radio frequency parameters like data rates, channel assignment, and transmit power, not security or authentication settings.

C. Policy Profile – A Policy Profile defines network policies for the client after authentication, including VLAN assignment, QoS, and ACLs. It does not contain the PSK authentication configuration itself.

D. Flex Profile – A FlexConnect profile configures FlexConnect-specific settings for remote site APs (like local switching and VLAN mapping), not PSK security settings.

🔗 References:

Cisco Catalyst 9800 Wireless Controller Software Configuration Guide: Defines the configuration model where the WLAN profile contains security settings including PSK.

Cisco 9800 WLC iPSK Configuration Guide: Details that PSK is configured under the WLAN profile settings on the Security tab.