Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅ Explanation:

In this architecture, the wireless controller retains responsibility for all wireless control plane functions. This includes AP image management, configuration, client session management, and Radio Resource Management (RRM) .

The controller manages the RF group based on dynamic measurements between every AP and its neighbors. RRM draws on collected data to optimize the network based on current conditions . The controller also maintains the control connection with APs and passes any configuration changes to them .

While Cisco DNA Center can coordinate AI-Enhanced RRM as a service and provide a dashboard for RF health visibility, the actual RRM processing and execution occurs on the wireless controller. DNA Center passes recommendations to the controller, which then pushes individual AP configuration changes . The control plane node handles LISP-based host tracking for client MAC address registration, not RRM .

Why other options are incorrect:

A. DNA Center
– DNA Center provides the management interface for AI-Enhanced RRM and coordinates the service, but the actual RRM processing runs on the wireless controller .

C. Cisco CMX – Cisco CMX is a location analytics and engagement platform that provides location-based services. It does not perform RRM or manage radio resources .

D. control plane node – The control plane node integrates with the WLC for client MAC address registration but does not perform RRM functions. It tracks endpoint IDs and RLOC information for the fabric, not RF management .

🔗 References

Cisco SD-Access Design Guide: "Fabric wireless controllers manage and control the fabric-mode APs using the same general model as the traditional local-mode controllers which offers the same operational advantages such as mobility control and radio resource management"

Explanation:

The vSmart controller (now called the Cisco Catalyst SD-WAN Controller) is the component responsible for distributing data plane traffic policies . Policies are configured on vManage (the management plane) but pushed to vSmart controllers, which then distribute centralized data policies to WAN Edge routers via OMP (Overlay Management Protocol) updates . The vSmart acts as the "brain" of the SD-WAN routing—it makes policy decisions but does not forward user traffic itself . WAN Edge routers receive and enforce these policies on the data plane . This separation ensures consistent policy enforcement across the entire SD-WAN fabric.

Why other options are incorrect:

A. vBond – vBond is the orchestrator responsible for device authentication, initial onboarding, and NAT traversal, not policy distribution .

B. vManage – vManage is the management plane used to define policies, but it does not distribute them to the data plane. Policies are pushed from vManage to vSmart, which handles the actual distribution .

D. WAN edge – WAN Edge routers (cEdge/vEdge) form the data plane. They receive and enforce policies but do not distribute them across the network .

🔗 References:

Cisco SD-WAN Policy Framework: "Centralized policy refers to policy provisioned on Cisco vSmart Controllers... Data policy affects the data traffic flow throughout the VPN segments"

CBT Nuggets: "vSmart exists in the control plane and distributes routing and security information to vEdge or cEdge routers"

✅ Explanation:

The VXLAN header is an 8‑byte field prepended to the original Ethernet frame during encapsulation. Its primary purpose is to carry the 24‑bit VXLAN Network Identifier (VNI), which uniquely identifies each VXLAN segment or overlay network. The VNI provides isolation, ensuring that traffic from different virtual networks remains separated, and enables VXLAN to scale beyond the 4,096‑VLAN limit to support up to 16 million segments.

The VXLAN header structure (per RFC 7348) consists of:

Flags (8 bits): The I flag is set to 1 to indicate a valid VNI.
Reserved (24 bits): Must be set to zero.
VXLAN Network Identifier (VNI) (24 bits): Identifies the VXLAN segment.
Reserved (8 bits): Must be set to zero.

The VNI is critical for VTEPs to determine which overlay network the packet belongs to and make proper forwarding decisions.

Why other options are incorrect:

A. original Layer 2 VLAN ID: The original Ethernet frame, including any VLAN tag, is carried as the payload of the VXLAN packet. The VXLAN header contains the VNI, not the original VLAN ID. The VNI is typically mapped to the overlay segment, while the underlay VLAN may be different.

B. Endpoint ID:
Endpoint identifiers (EIDs) are managed by the LISP control plane and mapping system, not the VXLAN header. The VXLAN header contains the VNI to identify the segment, not the endpoint.

D. source and destination RLOC ID:
RLOC IDs are part of the LISP mapping system and are carried in the outer IP header (source and destination VTEP IP addresses), not in the VXLAN header. The VXLAN header is an inner encapsulation field.

🔗 References

RFC 7348 (VXLAN): Defines the VXLAN header format and the 24‑bit VNI field.

Huawei VXLAN Packet Format: Identifies the VXLAN header fields including VNI and reserved fields.

Explanation:

The security principle being violated in this scenario is complete mediation. This principle requires that every access to every resource must be validated against the authorization mechanism, without relying on cached permissions or previous checks .

If a permission matrix is cached and not updated when an access level is revoked, the system continues to grant access based on stale information. This creates a security gap, as the revoked permissions are not enforced on subsequent requests. Complete mediation ensures that access rights are validated on each request, preventing the system from trusting an outdated permission matrix .

Why other options are incorrect:

A. economy of mechanism
– This principle states that security mechanisms should be as simple as possible to reduce the risk of errors and vulnerabilities . It does not address validating access rights on each request.

C. separation of privilege
– This principle requires that multiple independent conditions be met before granting access to a resource . It is about requiring more than one condition (e.g., requiring both a valid token and a specific role), not about re-validating permissions on every access attempt.

D. least common mechanism
– This principle minimizes the sharing of mechanisms between different users or processes to reduce the risk of unintended information flow . It does not address the validation of access rights on each request.

🔗 References

Saltzer and Schroeder's Secure Design Principles: "Complete mediation" is one of the eight original principles, defined as validating every access to every object to ensure access is allowed .

CWE-638 (Not Using Complete Mediation):This vulnerability occurs when software fails to verify access permissions every time a user tries to use a resource, instead relying on a single, outdated check .

✅ Explanation:

A Yagi antenna is the correct choice for a site-to-site wireless connection because it is a highly directional antenna designed specifically for point-to-point (PtP) links . It focuses the RF signal into a narrow beam, providing high gain and long-range connectivity, making it ideal for bridging two fixed locations . An omnidirectional antenna radiates power in all directions, which is inefficient for a focused link. Yagis are commonly used to extend networks across distances where a broader coverage antenna would not be effective .

Why other options are incorrect:

A. omnidirectional
– Radiates signal in a 360-degree pattern, dispersing power in all directions. This is inefficient for a point-to-point link, as it does not focus the signal toward the target .

B. patch
– A patch antenna is directional but is generally considered a medium-gain, semi-directional antenna suitable for short to medium-range bridging . For a dedicated site-to-site link, a Yagi offers higher directivity and gain .

C. dipole
– A dipole is the fundamental building block of many antennas and typically radiates in an omnidirectional pattern . It is not a high-gain directional antenna and is unsuitable for focused, long-distance links .

🔗 References:

Cisco Wireless Design Guide: Yagi antennas are recommended for point-to-point bridging .

HPE Aruba Antenna Catalog: Yagi antennas are high-gain, directional for long-range links .

Explanation:

Valid JSON syntax strictly adheres to specific structural rules defined by the ECMA-404 / RFC 8259 standards:

Double Quotes Required: In JSON, all keys (strings) and string values must be enclosed in double quotes ("). Single quotes (') are invalid syntax.

Objects enclosed in Curly Braces: JSON objects (key-value pairs) must be enclosed in curly braces ({}).

Arrays enclosed in Square Brackets: JSON arrays (ordered lists) must be enclosed in square brackets ([]).

Option A correctly opens a main JSON object {...}, defines a key "switch" whose value is a nested object {"name": "dist1", "interfaces": [...]} using valid double quotes throughout, and properly closes all braces and brackets.

Why Other Options Are Incorrect

B. Option B: Uses slashes (/"switch"/, /"name"/, /"interfaces"/) around key names instead of standard double-quoted strings.

C. Option C: Uses single quotes ('switch') instead of double quotes, and uses parentheses ( ) instead of curly braces {} to enclose the nested object.

D. Option D: Has a structural syntax error where "switch": is directly followed by "name": without an opening curly brace { to mark the start of a nested JSON object.

References

RFC 8259 Standard: The JavaScript Object Notation (JSON) Data Interchange Format (Section 4: Objects, Section 7: Strings).

Cisco 350-401 ENCOR Exam Topics: Section 6.0 Automation — Topic 6.2 Construct valid Python scripts and interpret common data formats (JSON, XML, YAML).

✅ Explanation:

The northbound APIs for both Cisco Catalyst Center (formerly DNA Center) and vManage share a key characteristic: they implement the RESTCONF protocol. This means they are built on HTTP-based, RESTful principles, providing a programmatic way to interact with the network controller's management and configuration capabilities .

Why other options are incorrect:

A. They push configuration changes down to devices.
This function is performed by the controller's Southbound APIs (like NETCONF, RESTCONF, SNMP, or SSH), which are used to configure network devices. The northbound APIs are for applications to interact with the controller, not directly push configs to the devices .

B. They exchange XML-formatted content.
While REST APIs can technically exchange XML, the industry standard and Cisco's specific implementation for these controllers focus almost exclusively on JSON for their northbound APIs . JSON is chosen for its simplicity and ease of use in modern applications . Despite some outdated references, multiple sources and practical implementations confirm JSON is the primary format.

C. They implement the RESTCONF protocol.
This is a common point of confusion. RESTCONF is a standard protocol typically used as a southbound API for a controller to manage network devices, often utilizing YANG data models . The northbound APIs of Catalyst Center and vManage are RESTful in style but are not the same as the RESTCONF protocol.

🔗 References:

Cisco DevNet: Describes Catalyst Center's Northbound REST Intent API using HTTPS verbs and JSON .

Cisco Platform User Guide: Defines Catalyst Center's "Intent APIs" as Northbound REST APIs that exchange JSON .

✅ Explanation:

In a Cisco SD-WAN deployment, a data policy is a set of statements that defines how data traffic is forwarded based on fields in the IP header of packets and on network segmentation through VPN membership . It operates on the data plane and influences the flow of traffic across the overlay network .

Data policies can be categorized into two types:

Centralized data policy: Provisioned on the vSmart controller and affects traffic flow across the entire network. It controls access based on a 6-tuple match (source/destination IP addresses, source/destination ports, DSCP, and protocol) or VPN membership, and is pushed to edge devices via OMP updates .

Localized data policy: Provisioned locally on the edge device using access lists (ACLs) and applied to specific interfaces to control traffic flow, enabling QoS, policing, and class of service .

Why other options are incorrect:

A. list of ordered statements that define node configurations and authentication used within the SD-WAN overlay – This is incorrect because it conflates data policies with control policies or device provisioning. Data policies do not define node configurations or authentication mechanisms; those are handled by device templates, control policies, and security configurations.

C. detailed database mapping several kinds of addresses with their corresponding location – This describes the functionality of the LISP (Locator/ID Separation Protocol) mapping system used in the control plane, not a data policy. Data policies are traffic forwarding rules, not address mapping databases.

D. group of services tested to guarantee devices and links liveliness within the SD-WAN overlay – This describes the functionality of OMP (Overlay Management Protocol) or BFD (Bidirectional Forwarding Detection), which are used for reachability and link liveliness detection. Data policies do not test device liveliness; they control traffic forwarding.

🔗 References

Cisco SD-WAN Policies Configuration Guide: "Data policy influences the flow of data traffic traversing the network based either on fields in the IP header of packets or the router interface on which the traffic is being transmitted or received" .

Policy Overview: "Centralized data policy applies to the flow of data traffic throughout the VPNs in the overlay network. These policies can permit and restrict access based either on a 6-tuple match... or on VPN membership" .

✅ Explanation:

The request is a JSON payload used to configure an extended access list rule via the Cisco IOS XE RESTCONF API. The structure follows the YANG data model for access lists.

ios-acl:extended: Defines an extended access list.
ios-acl:name: Specifies the name of the access list ("ato").
ios-acl:access-list-seq-rule: Contains a sequence rule within the access list.
ios-acl:sequence: The sequence number ("111111").
ios-acl:ace-rule: Defines the actual Access Control Entry (ACE).
ios-acl:action: The action to take ("deny").
ios-acl:protocol: The protocol to match ("ip").
ios-acl:any: Source match condition ("" indicates any source).
ios-acl:dst-any: Destination match condition ("" indicates any destination).

Why other options are incorrect:

The other snippets in the exhibit are:
deny: This is the action value, placed in the ios-acl:action field.
access-list-seq-rule: This is the correct key name for the sequence rule container.
dst-any: This is the destination any key, placed in the ios-acl:dst-any field.
ip: This is the protocol value, placed in the ios-acl:protocol field.

The correct JSON structure must use ios-acl:access-list-seq-rule as the container for the sequence and ACE, not ios-acl. The provided invalid snippet used ios-acl incorrectly as an object key, which does not match the YANG model.

🔗 References:

Cisco IOS XE RESTCONF API: Uses YANG data models for configuration and state data.

ietf-access-control-list YANG Model: Defines the structure for ACLs, including sequence rules and ACEs.

Explanation:

Identity PSK (also known as iPSK or RADIUS-less iPSK) is the Layer 2 security type that allows a single SSID to authenticate IoT devices using different passwords, in conjunction with Cisco ISE . This feature enables network administrators to assign unique pre-shared keys to individual devices or groups of devices without requiring a full 802.1X supplicant . In this configuration, the Wireless LAN Controller (WLC) uses the client's MAC address to query the RADIUS server (ISE), which responds with the specific PSK and any associated policies, such as VLAN assignments or group policies .

This approach is ideal for IoT and headless devices that cannot support the complex authentication typically required by 802.1X . It also provides the security benefit of revoking access for a single compromised device without affecting other users on the same SSID, which is a major advantage over a standard single PSK .

Why other options are incorrect:

B. Fast Transition (802.11r) is a feature designed to reduce roaming latency between access points for voice and video applications, not to provide differentiated authentication .

C. Central Web Authentication is a captive portal method typically used for guest or BYOD networks, not for authenticating headless IoT devices with unique passwords .

D. Cisco Centralized Key Management (CCKM) is a fast roaming mechanism, not an authentication method for supporting multiple passwords on a single SSID .

🔗 References:

Cisco Identity PSK Feature Deployment Guide: Describes iPSK as unique pre-shared keys for individuals or groups on the same SSID, managed via a AAA server .

Meraki Documentation: Explains RADIUS-less iPSK as a solution for devices that do not support 802.1X .