Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Explanation:

OAuth (specifically OAuth 2.0) is an open standard framework designed specifically for third-party delegation and authorization. It allows a third-party application to obtain limited access to a HTTP service on behalf of a resource owner without sharing the user's login credentials.

Delegated Access: OAuth enables users to grant third-party applications access to their resources (such as APIs) using access tokens rather than revealing sensitive passwords.

Token-Based Framework: The authorization server authenticates the user and issues an access token to the third-party application, granting defined permissions (scopes) for a specific time period.

Why Other Options Are Incorrect

A. API keys:
API keys are primarily used for client identification, project identification, and API usage tracking/rate limiting. They authenticate the requesting application itself, not individual third-party users or delegated authorization.

B. custom tokens:
Custom tokens are proprietary implementations designed for specific application workflows rather than a standardized framework for third-party authorization.

D. SOAP:
Simple Object Access Protocol (SOAP) is a messaging protocol standard for exchanging structured information in web services (using XML), not an authorization framework.

References:

RFC 6749: The OAuth 2.0 Authorization Framework

Cisco 350-401 ENCOR Exam Topics: Section 6.0 Automation — Topic 6.1 Describe REST API security (authentication and authorization mechanisms including OAuth, API keys, basic authentication).

Explanation:

In the Cisco SD-WAN (Catalyst SD-WAN) architecture, WAN Edge routers—which include cEdge (Cisco IOS-XE SD-WAN routers) and vEdge (Viptela OS routers)—make up the Data Plane.

edge: Operates as the physical or virtual WAN Edge device responsible for terminating IPsec data tunnels and forwarding actual data plane traffic (user, application, and server packets) across the overlay network.

IPsec Tunnels: cEdge routers form secure data plane tunnels directly with each other to transport end-user data securely across WAN transports.

Why Other Options Are Incorrect:

A. vSmart:
Represents the Control Plane. It handles overlay routing information via OMP (Overlay Management Protocol), enforces control policies, and distributes encryption keys, but it never processes or transports actual user data plane traffic.

B. vManage:
Represents the Management Plane. It provides a centralized GUI dashboard for configuration, policy creation, reporting, and network operations across the fabric.

C. vBond: Represents the Orchestration Plane. It orchestrates initial device discovery, performs mutual authentication of all controllers and edge routers, and facilitates NAT traversal.

References:

Cisco SD-WAN Architecture Guide:Separation of Planes (Management, Control, Orchestration, and Data Plane).

Cisco 350-401 ENCOR Exam Topics: Section 1.0 Architecture — Topic 1.5 Describe Cisco SD-WAN architecture components (vManage, vSmart, vBond, cEdge/vEdge).

Explanation:

The 4-way handshake in WPA2 Enterprise consists of four EAPOL-Key frames that establish encryption keys after successful 802.1X authentication. The Group Temporal Key (GTK) is generated by the access point to encrypt broadcast and multicast traffic and is securely delivered to the client in the M3-Message (the third frame of the handshake) . However, the message that validates and confirms that the client has successfully installed the GTK is the M4-Message. This final message serves as an acknowledgment from the client to the access point, completing the handshake and confirming that the temporal keys, including the GTK, have been installed .

Why other options are incorrect:

B. M3-Message: The M3-Message is sent by the AP to the client and contains the encrypted GTK. It transmits the key but does not confirm its installation .

C. M2-Message: The M2-Message is the client's response to the ANonce, containing the SNonce and a MIC. It does not involve the GTK .

D. M1-Message: The M1-Message is the initial message containing the ANonce that initiates the handshake . It has no role in GTK confirmation.

🔗 References:

IEEE 802.11 Standard: 4-way handshake defines M4 as the acknowledgment for GTK installation.

NetBeez Blog: "Message 4 is sent by the client... This final message notifies the access point of whether the temporal keys were installed successfully" .

✅ Explanation:

The Receiver Start of Packet (RX-SOP) Detection Threshold feature is specifically designed to manage RF cell size in high-density wireless environments like stadiums and large auditoriums. RX-SOP determines the Wi-Fi signal level (in dBm) at which an access point's radio will demodulate and decode a packet. By configuring a higher threshold, the AP's radio becomes less sensitive and ignores weaker signals, treating them as noise.

This effectively reduces the RF cell size by preventing the AP from demodulating packets above a given threshold, ensuring clients connect to the nearest AP with the strongest signal. It is a fine-tuning tool used alongside other Wi-Fi best practices to optimize network performance in high-density deployments.

Why other options are incorrect:

B. FRA (Forensic and Remedial Analysis):
FRA is a security feature used for threat detection and mitigation, such as identifying rogue APs or wireless attacks. It is not designed to control RF cell size or packet demodulation thresholds.

C. 802.11k:
802.11k is a standard that enables clients to request neighbor reports to make better roaming decisions. It does not directly control the physical size of the RF cell or the AP's demodulation threshold.

D. RRM (Radio Resource Management):
RRM is a broader framework that automates channel and power assignments to optimize the RF environment. While RRM indirectly affects cell size via transmit power control, RX-SOP is a specific, fine-grained tool that directly controls packet demodulation thresholds, making it the correct answer for this scenario.

🔗 References:

Cisco HDX Deployment Guide: "The higher the RX-SOP level, the less sensitive the radio is and the smaller the receiver cell size will be" .

Cisco Meraki Documentation: RX-SOP "enables a configuration parameter that helps a radio determine if it should demodulate and decode a frame...effectively lowering receiver cell size" .

✅ Explanation:

In the Cisco SD-WAN architecture, the vBond orchestrator is the first point of contact for all other components joining the fabric. Its core function is to authenticate and authorize WAN Edge routers, vSmart controllers, and vManage instances before they are admitted to the network. By orchestrating the initial connections, it eliminates the need for manual processes.

As the orchestrator, vBond's role is broader than simple validation. It also serves as a NAT traversal facilitator (acting as a STUN server), requiring a public IP address to help devices behind NAT locate each other. It provides the list of vSmart and vManage controllers to the WAN Edge routers and maintains control plane connections to synchronize the network topology.

Why other options are incorrect:

A. to provide centralized management and provisioning of all elements into the network
This is the primary responsibility of vManage (the management plane), not vBond. vManage is the centralized network management system that provides a GUI for configuration and monitoring.

B. to configure NAT communication on WAN Edge routers
While vBond does facilitate NAT traversal, it does not configure NAT communication on the routers. It acts as a STUN server to help devices behind NAT discover their public IP addresses.

C. to provide configuration synchronization of all WAN Edge devices
Configuration synchronization is handled by vManage, which pushes configurations to network devices. vBond is not involved in this synchronization process.

🔗 References:

Cisco SD-WAN Architecture Overview:vBond orchestrates connectivity, serves as the first point of authentication, and authorizes control connections.

CBT Nuggets: vBond provides authentication of new devices and connects them to the vSmart Controller.

✅ Explanation:

Adopting a data modeling language like YANG abstracts away the complexities of vendor-specific Command-Line Interfaces (CLIs) and configurations. By defining network capabilities in a standardized, machine-readable format, it allows for the creation of applications that can manage multi-vendor networks using widely compatible configurations, effectively refactoring the process . This shifts network management from manual, error-prone CLI commands to a programmatic, software-driven approach .

Why other options are incorrect:

A. deploying machine-friendly codes to manage a high number of devices: While data models do enable automation and the management of large-scale networks, their primary benefit is not simply deploying "machine-friendly codes" but rather providing a structured, vendor-neutral contract that defines the data and constraints of a network device .

B. augmenting the use of management protocols like SNMP for status subscriptions:
YANG is typically used with modern, transactional protocols like NETCONF and RESTCONF to provide a programmable interface for configuration and state data, rather than augmenting legacy protocols like SNMP .

C. augmenting management process using vendor centric actions around models:
Data modeling languages like YANG are designed to be vendor-neutral. They aim to create a common, interoperable language for defining device capabilities and configurations across different vendors, moving away from vendor-centric actions .

🔗 References:

Cisco DevNet: Data models provide a clear, structured definition of device capabilities and enable programmatic interfaces, abstracting the need to code protocol specifics .

Puppet Blog: YANG and NETCONF provide a transactional, programmable, and standardized approach to network device management .

✅ Explanation:

In 802.1X authentication, EAP-MSCHAPv2 is an inner authentication method that transmits the client's credentials, such as a username and password, to the RADIUS server. For these credentials to be protected, they must be sent through a secure, encrypted outer tunnel. Among the options provided, Protected EAP (PEAP) is the correct outer method protocol for ISE to support this configuration.

PEAP is a tunneled EAP method that establishes an encrypted TLS tunnel between the client and the RADIUS server. Once this secure outer tunnel is established, the actual authentication credentials are transmitted via the inner method, which is EAP-MSCHAPv2 in this scenario. This two-step process ensures that the user's password is not sent in clear text over the network.

Why other options are incorrect:

A. EAP-TLS: EAP-TLS is a native, non-tunneled EAP method that uses certificate-based authentication for both the client and server. It does not use an inner method like EAP-MSCHAPv2. While it is highly secure, it is not the correct protocol for this specific requirement.

B. EAP-FAST:
Like PEAP, EAP-FAST is also a tunneled EAP method that can use EAP-MSCHAPv2 as an inner method. However, it is not the correct answer because the most common and widely deployed outer method for EAP-MSCHAPv2 is PEAP. In an exam context, when a client device is configured with EAP-MSCHAPv2 as the inner method, the standard corresponding outer method to configure on ISE is PEAP. PEAP is the default outer method for this scenario.

C. LDAP:
This is not an EAP outer method protocol. LDAP (Lightweight Directory Access Protocol) is an identity source protocol used by ISE to query a directory, such as Active Directory, for user credentials, but it is not part of the EAP authentication framework itself.

✅Explanation:

The Python code print(format(0.8, '0%')) uses the format() function to format the number 0.8 as a percentage. The format specifier '0%' works as follows:

The % character multiplies the number by 100 and appends a percent sign (%) to the output. So 0.8 * 100 = 80 and the output becomes 80%.

The 0 before the % is a zero-padding specifier. It pads the result with leading zeros to reach a minimum width. Since 80 already has two digits, no padding is added, and the output remains 80%.

Why other options are incorrect:

B. 8.8% – Incorrect. This would result from misinterpreting the format specifier as adding a decimal point, which it does not.

C. .08% – Incorrect. This would result from treating 0.8 as a percentage without multiplying by 100 and formatting with decimal places.

D. 8% – Incorrect. This would be the output of format(0.08, '0%'), not 0.8.

🔗 References:

Python Documentation: The format() function with the % type converts a float to a percentage, multiplying by 100.

Python String Formatting: The '%' format specifier multiplies by 100 and appends %.

✅ Explanation:

In a Cisco SD-Access architecture, the underlay network is the physical infrastructure of switches and routers that provides basic IP connectivity. Its primary role is to forward traffic from one fabric node to another. When VXLAN-encapsulated traffic is sent from a source edge node to a destination edge node, the intermediate switches in the underlay do not look inside the VXLAN packet. Instead, they route the packet based on the outer IP header, which contains the destination IP address of the target fabric node. This ensures that data is forwarded efficiently across the physical network. The functions of encapsulating packets (Option C) are handled by the fabric edge and border nodes, not the intermediate switches that form the underlay.

Why other options are incorrect:

B. to provide an entry and exit point between the fabric and external resources:
This is the specific role of a Border Node in the fabric architecture, not a function of intermediate nodes in the underlay.

C. to encapsulate and de-encapsulate packets with a VXLAN header:
VXLAN encapsulation and de-encapsulation are the responsibility of Edge Nodes (for endpoint traffic) and Border Nodes (for traffic entering or leaving the fabric). Intermediate underlay switches simply route the already-encapsulated packets.

D. to provide reachability between fabric clients and nonfabric clients on the same subnet:
Reachability between fabric and non-fabric devices is handled by the overall fabric control and data planes, often through a Border Node that provides the gateway function. It is not a function of intermediate nodes.

🔗 References:

Cisco SD-Access Solution Design Guide: Explains that the underlay network is responsible for routing packets between fabric nodes based on IP headers, and that encapsulation is handled by edge and border nodes.

Cisco Validated Profile: Describes the underlay as the physical network for basic connectivity, while the overlay (including VXLAN and encapsulation) is built on top of it.