Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅ Explanation:

In the script import actions, the function of this statement is to import a Python module named actions. This is a standard Python import statement.

When Python executes import actions, it:
Searches for a module named actions in the Python search path
Loads the module if found
Makes the module's contents available through the actions namespace
This allows the script to use functions defined in that module, such as actions.http(site) later in the code.

Why other options are incorrect:

A. It imports the functions that are not available natively in Python – While import can bring in functions not natively available, this is not a specific description of what import actions does. It simply imports the actions module regardless of whether its functions are natively available or not.

B. It imports the functions of a third-party module – The statement does not specify whether actions is a third-party module, a standard library module, or a custom user-defined module. The import statement does not know or care about the origin of the module; it simply imports whatever module is named.

D. It imports an external reference – This is not a standard Python term. Python uses modules, packages, and objects. "External reference" is not the correct terminology for what import does.

🔗 References

Python Documentation: The import statement is the standard mechanism for importing modules into a Python script.

Python Module System: Modules are files containing Python definitions and statements, which can be standard library modules, third-party modules, or user-created modules.

✅ Explanation:

When the script runs, it prints a dictionary containing key-value pairs. Let's trace through the logic:

vlan() function:
Reads the multi-line string vlan_list
Splits each line on the delimiter " => "
Uses k, v = [word.strip() for word in line.split("=>")] to extract the key (e.g., vlan10) and value (e.g., 192.168.10.1)
Adds each key-value pair to vlan_list_dict[k] = v

main() function:
Calls vlan(), which returns the completed vlan_list_dict
Passes the dictionary to print_vlan(vlans)

print_vlan() function:
Simply prints the entire dictionary object passed to it

Why other options are incorrect:

B. list of lists – The script does not create or print any lists. It only creates a dictionary and prints it.

C. list of strings – While the original vlan_list variable is a multi-line string, the script converts that data into a dictionary before printing. It does not print the original string directly.

D. tuple list – This is not a valid Python data type, and the script never creates tuples. The data structure created is a dictionary.

🔗 References:

Python Data Types: Dictionaries are unordered collections of key-value pairs, created with curly braces {}.

Python String Methods: The .split() method divides a string into a list, and .strip() removes whitespace.

✅ Explanation:

Sticky clients occur when a wireless client remains connected to an AP with a weak signal instead of roaming to a better AP, often due to asymmetric transmit power or mismatched data rate settings. By increasing the mandatory minimum data rates, you prevent clients from using the lowest, most robust data rates (like 1, 2, 5.5, and 6 Mbps) for management and data frames. This effectively shrinks the usable range of each AP, encouraging clients to roam to a stronger AP sooner.

This is a fundamental RF design principle:
Lower mandatory data rates extend the physical coverage cell of an AP.
Higher mandatory data rates reduce the coverage cell size, improving the overall spectral efficiency .
By forcing clients to only associate if they can support higher data rates, you reduce the incidence of sticky clients and improve the overall performance of dense RF environments.

Why other options are incorrect:

A. Decrease radio channel widths to 40 MHz:
Reducing channel width improves signal quality and reduces interference at the cost of throughput; it does not directly address sticky clients, which are caused by clients choosing not to roam to better APs, not by channel width.

C. Decrease the mandatory minimum data rates:
This would extend the cell range, encouraging clients to associate with the AP from a greater distance and reducing their likelihood of roaming to a better AP. This would worsen the sticky client problem.

D. Increase radio channel widths to 160 MHz:
Wider channels increase throughput but reduce the received signal strength at the client and make the network more susceptible to interference . This does not address the root cause of sticky clients and can actually degrade the client experience.

🔗 References

Cisco Wi-Fi Design Guide: Sticky clients can be minimized by tuning data rates, specifically by setting mandatory data rates appropriately .

Cisco Community Discussion:
Explains that setting 12 Mbps as the minimum mandatory rate can help prevent sticky clients .

✅ Explanation:

Data models facilitate a unified approach to configuration and management in a multivendor environment. They provide a vendor-neutral way to define network configurations, enabling organizations to manage diverse devices with consistent tools and processes. This reduces complexity and promotes interoperability. For instance, protocols like NETCONF and RESTCONF use data models (e.g., YANG) to enable a single management platform to configure devices from different vendors using a standardized, programmatic interface . This approach reduces network faults caused by manual configuration errors . As a result, management systems can discover capabilities of devices from different vendors and adjust their behavior accordingly .

Why other options are incorrect:

B. improving communication security with binary-encoded protocols:
This is incorrect. Data models standardize the structure of data, not how it is communicated. Communication security (confidentiality and integrity) is handled by transport protocols like SSH or TLS, which are used by NETCONF and RESTCONF . Data models themselves do not rely on binary encoding for security.
C. lowering CPU load incurred to managed devices:
This is incorrect. Data models do not directly lower CPU load. They describe what data is available and its format. While structured data may enable more efficient interactions, the primary benefit is interoperability and standardized management, not CPU load reduction.

D. removing the distinction between configuration and runtime state data:
This is incorrect. Data models define the structure and constraints for configuration data as well as state data, but they do not remove the distinction between them. Both types of data coexist in a device's data model, representing "desired" vs. "actual" states .

🔗 References:

NETCONF Overview: NETCONF uses XML and RPC mechanisms to manage devices .

Benefits of NETCONF: Facilitates configuration data management and interoperability between different vendors' devices .

✅ Explanation:

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object . This information can be verified and trusted because it is digitally signed.

JWTs are encoded, not encrypted by default. The token consists of three parts: a header, a payload, and a signature, each separated by a dot .. The header and payload are Base64Url-encoded JSON objects . This encoding makes the token compact and URL-safe for transmission in HTTP headers.

The purpose of a JWT is to securely exchange information between the client and server. The signature (created using a secret or private key) allows the receiver to validate that the content has not been tampered with . This makes JWTs suitable for both authentication (proving who the user is) and information exchange (securely sharing claims between parties) .

Why other options are incorrect:

A. an encrypted JSON token that is used for authentication
– JWTs are encoded and signed, but not necessarily encrypted. The payload is Base64Url-encoded, which is not encryption (it can be easily decoded). While JWT can be encrypted (using JWE), the standard format is signed, not encrypted . Additionally, JWTs can be used for both authentication and information exchange.

B. an encrypted JSON token that is used for authorization
– Same encryption inaccuracy as Option A, and authorization is a separate process from authentication. JWTs primarily facilitate authentication (verifying identity) or secure information exchange, not directly authorization (granting permissions) .

D. an encoded JSON token that is used for authentication
– This option is partially correct (JWTs are encoded) but incomplete. The full definition of a JWT is a token for securely exchanging information, which includes but is not limited to authentication. JWTs can carry any claims, not just authentication credentials.

🔗 References:

RFC 7519 (JSON Web Token): Defines JWT as a compact, URL-safe means of representing claims to be transferred between two parties .

Visa Acceptance Solutions JWT Guide: "JWTs provide a compact, self-contained method for securely transmitting information between parties" .

✅ Explanation:

The XML response shown is:
This is a standard NETCONF that contains an empty element. When a NETCONF operation (such as or ) returns an empty element, it indicates that the request was syntactically valid and the server processed it, but the requested data was not available or the request yielded no content.

This typically occurs when:
The requested YANG data model path does not exist on the device (the request was valid but the model is unsupported)
The requested configuration or state data is empty (not configured)
The request was well-formed but the device had no data to return

Therefore, the message indicates a valid NETCONF message with valid content based on the YANG data models was made, but the request failed to return the expected data.

Why other options are incorrect:

A. A NETCONF request was made for a data model that does not exist.
– This is a possible scenario, but the response does not specifically indicate a non-existent model. The XML shows a valid reply with an empty data tag, which is the standard NETCONF response for a valid request that returns no data.

B. The device received a valid NETCONF request and serviced it without error.
– While the request was valid and the device serviced it, the presence of an empty tag suggests the request failed to retrieve the expected data. The response indicates no data was found.

D. The NETCONF running datastore is currently locked.
– A locked datastore would return an with an error-tag of "lock-denied" or similar, not an empty element. The response shows no error tags.

🔗 References

RFC 6241 (NETCONF Protocol): Defines the element as the container for configuration or state data in messages.

NETCONF Error Handling: Locked datastore errors are returned as elements, not empty containers.

✅ Explanation:

The response shows a status code of 202 (Accepted), which indicates that the POST request was accepted for processing, but the processing was not completed at the time of the original request. This is expected for asynchronous tasks in Cisco DNA Center.

When querying for more information about the task, the response body reveals:
"isError": false – This explicitly indicates that no error occurred.
"progress": "1" – This represents 100% completion (1 means "completed" in the context of Cisco DNA Center APIs).
"version": 1630851541514 – This timestamp suggests the task has been processed and finalized.
The absence of any error indicators, along with the "progress": "1" field, confirms that the discovery task was completed successfully.

Why other options are incorrect:

A. restarted
– There is no indication in the response that the task was restarted. The isError field is false, and the progress field shows "1", indicating successful completion rather than a restarted state.

B. failed
– The isError field is explicitly set to false, which directly rules out a failure. If the task had failed, this field would be true, and additional error details would likely be included.

C. stopped
– There is no evidence of the task being stopped or interrupted. A stopped task would typically show an error state or incomplete progress (e.g., "0" for progress), neither of which is present in the response.

🔗 References:

Cisco DNA Center Platform API Guide: Defines the response structure for asynchronous tasks, including the isError and progress fields.

HTTP Status Codes: A 202 status code indicates the request was accepted for processing, and subsequent queries should check the task progress.

Explanation:

A key characteristic of an AP operating in FlexConnect mode is that FlexConnect groups are required to support 802.11r fast roaming. FlexConnect groups are logical groupings of FlexConnect APs that share the same VLAN and controller configuration, enabling local authentication and fast roaming features. For 802.11r (Fast Transition) to function, FlexConnect APs must belong to a FlexConnect group. This ensures client information (such as security keys) is shared between the APs in the group, allowing for a seamless transition when a client roams between them.

Why other options are incorrect:

A. Configuration is done directly on the AP rather than on a controller.
Incorrect. FlexConnect APs are lightweight APs that are configured and managed centrally by the WLC. Configuration is pushed from the controller, not applied directly to the AP.

B. Dot1x authentication is not supported for AP clients in this mode.
Incorrect. Dot1x authentication is supported for clients in FlexConnect mode. Authentication can be handled centrally by the controller or locally by the AP (when in standalone mode with a RADIUS server).

C. Client authentication is always performed on the AP.
Incorrect. Client authentication depends on the mode: in connected mode, the controller handles authentication; in standalone mode, the AP can perform local authentication, but this is not the default.

🔗 References:

Cisco FlexConnect Configuration Guide: FlexConnect groups are required for Fast Transition (802.11r) support.

Cisco FlexConnect Overview: FlexConnect APs are centrally managed by a WLC; groups enable fast roaming features like CCKM and 802.11r.

✅ Explanation:

A virtual link is used when an area cannot be physically connected to the backbone area (Area 0), which is a requirement in OSPF . It creates a logical link between two Area Border Routers (ABRs) through a transit area, enabling the disconnected area to reach Area 0 . The transit area must be a non-backbone area and cannot be a stub or NSSA .

Why other options are incorrect:

A. to allow a stub area to transit another stub area: A transit area cannot be a stub area, as stub areas don't carry external routes . Virtual links also don't allow stub areas to transit traffic.

B. to merge two existing Area 0s through a nonbackbone: This is not a recommended use case. OSPF requires a single backbone area, and virtual links cannot merge two separate Area 0s.

C. to connect two networks that have overlapping private IP address space: Virtual links do not address overlapping IP address spaces. This is typically resolved through NAT or VRF technologies.

🔗 References:

Huawei CloudEngine Configuration Guide: Virtual links connect non-backbone areas to Area 0

Extreme Networks Documentation: Virtual links connect ABRs through a transit area to the backbone