Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Explanation:

The primary function of a Cisco SD-Access extended node is to extend the fabric to connect to downstream, nonfabric-enabled Layer 2 switches . It acts as a simple Layer 2 device, connecting to the fabric edge and allowing legacy devices and switches to be part of the fabric's overlay network without needing to support full fabric capabilities themselves . The extended node is typically an access switch that is not a full fabric edge node but is capable of supporting the fabric's VXLAN encapsulation to extend the fabric to downstream devices .

Why other options are incorrect:

A. in charge of establishing Layer 3 adjacencies with nonfabric unmanaged node: Extended nodes do not establish Layer 3 adjacencies. This is a function typically handled by a fabric edge node or border node when integrating with non-fabric or unmanaged devices.

B. performs tunnelling between fabric and nonfabric devices to route traffic over unknown networks:
Tunneling between fabric and nonfabric devices is not the primary purpose of an extended node. Border nodes handle traffic between the fabric and external networks.

C. provides fabric extension to nonfabric devices through remote registration and configuration:
Extended nodes extend the fabric to Layer 2 devices, but they do not handle remote registration or configuration of nonfabric devices. These functions are managed by other SD-Access components.

🔗 References:

Cisco Software-Defined Access Solution Design Guide: Extended nodes extend the fabric to downstream nonfabric enabled Layer 2 switches .

Cisco SD-Access fabric architecture: Extended nodes are part of the fabric role design principles .

✅ Explanation:

Stateful Switchover (SSO) is the feature that enables an HSRP failover from the active Route Processor (RP) to the standby RP without loss of data or a path change . This is achieved through the SSO HSRP feature, which actively synchronizes HSRP state information—including the virtual IP address and forwarding state—to the standby RP . This synchronization ensures that the standby RP is fully prepared to take over instantaneously.

If the active RP fails, no change occurs to the HSRP group itself, and traffic continues to be forwarded through the same active gateway device . This preserves the forwarding path for traffic destined to the HSRP virtual IP address without requiring the HSRP group to elect a new active router from another device in the group . Prior to this feature, a primary RP failure would have caused the device to stop participating in HSRP and trigger another router to take over as active, resulting in a loss of data or a path change .

Why other options are incorrect:

A. preemption:
Preemption allows a router with a higher priority to take over the active role from a lower-priority router. It does not preserve data forwarding during an RP failover .

B. IP SLA tracking:
IP SLA tracking monitors network conditions to adjust HSRP priority. It does not synchronize state information for RP failover .

D. HSRP tracking:
This is a general term for monitoring conditions that affect HSRP priority, not the feature that synchronizes state for zero-downtime failover .

🔗 References:

Cisco Network Services Configuration Guide: SSO enables the standby RP to take over if the active RP fails, allowing traffic to be continuously forwarded during a switchover without loss of data or path change . FHRP—SSO Aware HSRP Documentation: When active RP fails, no change occurs to the HSRP group itself and traffic continues through the current active gateway router .

Explanation:

The vBond controller (recently renamed the Cisco Catalyst SD-WAN Validator) operates at the orchestration plane of the Cisco SD-WAN architecture . This is one of the four logical planes that separate the solution's functions.

The orchestration plane's primary role is to automate the initial onboarding and authentication of all components as they join the SD-WAN fabric . The vBond acts as the first point of contact for WAN Edge routers and other controllers when they boot up and connect to the network . It authenticates each device and then provides them with the connectivity information they need to find the other controllers, effectively acting as the "glue" that brings the entire system together . Additionally, the vBond facilitates NAT traversal by operating as a STUN server, helping devices behind firewalls discover their public IP addresses .

Why other options are incorrect:

A. control plane:
This is the function of the vSmart controller (now the Cisco Catalyst SD-WAN Controller). The control plane is responsible for maintaining network topology, exchanging routing information, and distributing policies, but not for initial device onboarding .

B. data plane:
This is the role of the WAN Edge routers (cEdge/vEdge). They are responsible for forwarding user traffic, building IPsec tunnels, and enforcing data policies .

D. management plane:
This is the role of vManage (now Cisco Catalyst SD-WAN Manager). It is the centralized management system used for configuration, monitoring, and troubleshooting .

🔗 References

Cisco Press: Bond is part of the Orchestration Plane and provides initial authentication and NAT traversal .

Cisco Learning Network: Bond acts as the orchestrator, authenticating devices onto the network .

Explanation:

The solution that supports end-to-end line-rate encryption between two sites is MACsec (Media Access Control Security). MACsec is an IEEE 802.1AE standard that operates at Layer 2, encrypting every Ethernet frame directly on the hardware ASIC (Application-Specific Integrated Circuit) at the full physical speed of the link—often referred to as "line rate" or "wire speed" . This hardware-based encryption ensures that data is secured without introducing noticeable latency or reducing overall throughput, which is critical for high-speed inter-site links .

Unlike IPsec, which adds tunnel overhead and requires software processing for each packet, MACsec encrypts traffic hop-by-hop at Layer 2 with only about 32 bytes of overhead, making it ideal for point-to-point connections between two sites . It is widely used to secure data center interconnects, dark fiber, and metro-Ethernet services where full line-rate performance is required .

Why other options are incorrect:

A. TrustSec:
TrustSec is a Cisco security architecture that uses Security Group Tags (SGTs) for policy-based segmentation and access control, but it does not provide encryption on its own. It often works alongside MACsec for encryption, but it is not the primary solution for line-rate encryption .

C. IPsec:
IPsec provides secure site-to-site tunnels at Layer 3, but it is not designed for line-rate encryption. It introduces per-flow tunnel state, software processing overhead, and significant performance impact on high-speed links, making it unsuitable for line-rate requirements .

D. GRE:
GRE is a tunneling protocol that encapsulates packets, but it provides no encryption by default. It is often used in conjunction with IPsec to provide encryption, but alone it does not offer line-rate encryption .

🔗 References

IP Infusion MACsec documentation: Explains MACsec as wire-speed Layer 2 encryption with AES-GCM, no software bottleneck .

Cisco Nexus 9000 MACsec Configuration Guide: Details MACsec configuration and its use of AES-GCM cipher suites .

Explanation:

The Stealthwatch component (now Cisco Secure Network Analytics) provides real-time awareness of users, devices, and traffic on the network. It collects and analyzes network telemetry from the existing infrastructure (via NetFlow, IPFIX) to give a complete picture of "who is on the network and what they are doing". This visibility is enhanced with contextual information from sources like Cisco Identity Services Engine (ISE) to identify users and devices.

Why other options are incorrect:

A. real-time threat management to stop DDoS attacks to the core and access networks:

Incorrect. While Stealthwatch can detect DDoS attacks as a type of security event, its primary value is visibility and detection, not direct threat management or mitigation. Stopping DDoS attacks is typically handled by other solutions.

B. malware control:
Incorrect. Stealthwatch detects threats (including malware) through network behavior analysis, but it is not a malware control tool (like endpoint protection) that prevents or removes malware from systems. It identifies suspicious activity for security teams to respond.

D. dynamic threat control for web traffic:
Incorrect. This describes the function of a Cisco Web Security Appliance (WSA), which provides dynamic threat control for web traffic. Stealthwatch analyzes network traffic across the entire network, not specifically web traffic.

🔗 References:

Cisco Cyber Threat Defense Release Notes: Stealthwatch provides network traffic analysis capabilities.

Cisco Secure Network Analytics Overview: Provides comprehensive visibility and security analytics.

✅ Explanation:

The northbound Intent API is specifically designed to enable Cisco Catalyst Center to focus on an outcome rather than the individual steps required to achieve it. The official Cisco documentation describes the Intent API as providing a "policy-based abstraction of business intent, allowing you to focus on an outcome to achieve instead of struggling with the mechanisms that implement that outcome" . This is the core differentiator between traditional APIs (which require specifying every procedural step) and intent-based APIs (where you declare what you want, and the system figures out how to do it).

The Intent API is a Northbound REST API that exposes specific capabilities of the Catalyst Center platform . It uses standard REST methods (GET, POST, PUT, DELETE) and exchanges JSON-structured HTTPS messages . This approach abstracts away the underlying network complexity, allowing users to declare business intent—such as "provide connectivity for device X with policy Y"—while Catalyst Center handles the device-level configurations and provisioning steps automatically.

Why other options are incorrect:

A. southbound Multivendor Support:
Southbound APIs are used for communication from the controller to network devices (e.g., NETCONF, RESTCONF, SNMP) to push configurations and collect telemetry. They do not focus on business outcomes; they focus on device-level interactions .

B. westbound Integration:
This is not a standard API direction or recognized term in the context of Cisco Catalyst Center architecture. The platform's API orientation is defined by northbound (Intent APIs) and southbound (device communication) planes .

D. eastbound Events and Notifications:
While Catalyst Center does support events and notifications (often via the Platform bundles), this refers to asynchronous event delivery and integrations with IT systems . It is not the API type that provides policy-based abstraction of business intent or outcome-oriented functionality.

🔗 References:

Cisco DevNet: "The Intent API is a Northbound REST API that exposes specific capabilities of the Cisco DNA Center platform. The Intent API provides policy-based abstraction of business intent, allowing focus on an outcome rather than struggling with individual mechanisms steps" .

Cisco Platform User Guide: "The Intent APIs provide policy-based abstraction of business intent, allowing you to focus on an outcome to achieve instead of struggling with the mechanisms that implement that outcome" .

Explanation:

Configuring an access point (AP) in SE-Connect (Spectrum Expert Connect) mode is a specialized troubleshooting technique used to analyze the RF spectrum. An AP in this mode serves as a dedicated remote sensor for a Spectrum Expert application running on a PC, allowing an engineer to capture and analyze detailed spectrum data from the AP's environment, turning the AP into a remote spectrum analyzer .

Here are the key characteristics of how this works, which explain why Option D is the only correct purpose:

No Client Service: In this mode, the AP does not serve wireless clients or provide any Wi-Fi, RF, or spectrum data to the controller. All normal AP functions are suspended so it can focus on spectrum analysis .

Direct Connection: The AP connects directly to a PC running the Cisco Spectrum Expert application, bypassing the controller to display and analyze spectrum data .

Troubleshooting Focus: This mode is explicitly intended for remote troubleshooting and analysis of the RF environment, not as a permanent operating mode for the AP .

Why other options are incorrect:

A. to redirect WLAN traffic to an endpoint for protocol analysis: This describes the function of Sniffer mode, which captures and forwards 802.11 frames for protocol analysis and troubleshooting .

B. to monitor the VLAN traffic for rogue APs: This is a function of Monitor mode, which is used for security and monitoring, including rogue AP detection. The AP in Monitor mode scans channels to identify security threats .

C. to connect the wired LAN with the wireless infrastructure: This describes the general purpose of an AP in its normal operating modes (like Local or FlexConnect), which serve client traffic. SE-Connect is specifically designed not to serve clients .

References:

AP SE-Connect mode description in Cisco Wireless Controller Configuration Guide, which defines the mode as connecting a Spectrum Expert application to a CleanAir-enabled AP to display and analyze detailed spectrum data .

Cisco Learning Network: SE-Connect mode is categorized as a spectrum analyzer mode .

✅ Explanation:

The error message AttributeError: 'module' object has no attribute 'manager' indicates that the Python script is trying to access nccclient.manager, but the nccclient module does not have a manager attribute . The correct module is ncclient (not nccclient), and the correct import statement to access the manager object is from ncclient import manager.

Why this is correct:
The ncclient library is a popular Python library for NETCONF client functionality.
The manager object is the primary entry point for creating NETCONF connections using ncclient.
The correct import statement from ncclient import manager allows the script to reference manager.connect() without needing the ncclient. prefix.

Why other options are incorrect:

A. import manager
This would try to import a module named manager, which does not exist in the Python standard library or as a standalone module. It would not import the manager object from the ncclient library.

B. ncclient manager import
This is invalid Python syntax. Import statements in Python must follow the structure import module or from module import object. The syntax ncclient manager import is not recognized.

**C. from ncclient import ***
While this would import all objects from the ncclient module, it is generally discouraged in Python because it pollutes the namespace and makes code less readable. More importantly, the script uses nccclient instead of ncclient, so this would still fail due to the typo. The correct and recommended approach is to specifically import only what is needed: from ncclient import manager.

🔗 References:

ncclient Documentation: The official ncclient library documentation demonstrates the import statement from ncclient import manager as the standard way to use the library.

Python Import System: The from module import object syntax allows direct access to the specified object without the module prefix.

✅ Explanation:

These definitions correspond to fundamental concepts in antenna theory and wireless communications:

Beamwidth describes the angular width of the main lobe of an antenna's radiation pattern, typically measured at the half-power (3 dB) points. It determines the directional coverage of the antenna.

Polarization refers to the orientation of the electric field of the radiated electromagnetic wave relative to the Earth's surface. It affects signal propagation and antenna alignment requirements.

Radiation patterns are graphical representations (typically polar or Cartesian plots) that show how an antenna radiates energy in different directions, illustrating the relative signal strength in space.

Gain is a measure of how much the antenna concentrates radiated power in a specific direction compared to an isotropic radiator, combining both directivity and efficiency.

Why the other arrangements are incorrect:

The exhibit shows that the options initially presented were out of order. The correct matching is as follows:

Radiation patterns is the graphical plot of signal distribution, not a measure of angle.
Gain is the relative increase in signal strength in a given direction, not the 3 dB angle.
Beamwidthis the 3 dB angle measurement, not the signal distribution graph.
Polarization is the orientation of the electromagnetic field, not the relative increase in signal strength.

🔗 References

IEEE Standard Definitions of Terms for Radio Wave Propagation: Defines antenna gain, radiation pattern, and beamwidth.

Cisco Wireless Design Guides: Provides definitions for key antenna parameters including radiation patterns and polarization.