Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Explanation:

YANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls (RPCs), and notifications for network management protocols . It defines a hierarchical data structure that provides a complete description of all data exchanged between a client and server , enabling network programmability and is transported over protocols such as NETCONF and RESTCONF .

YANG's purpose is to describe the structure, syntax, and semantics of data, not the transport mechanism itself. This allows network devices from different vendors to be managed using a standardized, machine-readable format.

Why other options are incorrect:

A. scraping data via CLI:
YANG is a structured, machine-to-machine interface. It is designed to provide programmatic access to data via protocols like NETCONF, not for screen scraping or parsing command-line output.



B. processing SNMP read-only polls:
YANG is independent of and not reliant on SNMP. It uses its own transport protocols (NETCONF, RESTCONF) and is a separate management framework.

D. providing a transport for network configuration data between client and server:
YANG defines the data model (the structure and meaning of the data), while protocols like NETCONF and RESTCONF provide the transport mechanism . The transport layer is separate from the data modeling language.

🔗 References:

YANG Definition: "YANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls, and notifications for network management protocols" .

YANG and NETCONF: YANG provides the data model; NETCONF is the protocol that transports the operations .

Explanation:

FlexConnect (formerly known as H-REAP or Hybrid Remote Edge Access Point) is a Cisco wireless deployment mode specifically designed for branch offices or remote locations.

Local Switching:In FlexConnect local switching mode, the Access Point drops off (egresses) client data traffic locally directly onto the access point's switch port, bypassing the Wireless LAN Controller (WLC).

Control vs. Data Traffic: While CAPWAP control traffic is maintained back to the centralized WLC, user data plane traffic is processed and switched locally at the AP interface.

Why Other Options Are Incorrect:

A. Bridge:
Used primarily for wireless point-to-point or point-to-multipoint mesh bridging between buildings, rather than standard client access egress at a switch port.

B. Sniffer:
Dedicated mode where the AP acts as a remote packet capture device, capturing over-the-air wireless traffic on a specific channel and forwarding it to a network analyzer (like Wireshark). It does not service or switch wireless client traffic.

D. Monitor:
Dedicated mode where the AP does not process or transmit client traffic; instead, it acts as a sensor for Rogue AP Detection, Location Tracking, and Wireless Intrusion Prevention System (WIPS).

References:

Cisco FlexConnect Configuration Guide: FlexConnect Local Switching vs. Central Switching Architecture.

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.2 Describe wireless deployment modes (Centralized, FlexConnect, Mesh).

✅ Explanation:

JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format that is widely used for API requests, particularly for RESTful web services . It represents data as key-value pairs and supports arrays, making it both human-readable and machine-parseable . JSON's simplicity, compactness, and language-independent nature make it the preferred choice for API requests, especially in modern web and mobile applications .

Why other options are incorrect:

A. HTML
– HTML (HyperText Markup Language) is a markup language used for structuring and displaying content in web browsers. It is not a data format designed for API requests. APIs typically send and receive data in JSON or XML, not HTML.

B. PERL
– Perl is a programming language, not a data format. APIs use data formats (JSON, XML, etc.) for structuring information, not programming languages.

D. Python
– Python is a programming language, not a data format. APIs are language-agnostic and use standard data formats for request and response payloads.

🔗 References:

JSON is the standard data format for REST APIs.
HTML is for web page display; JSON is for data exchange.
APIs support JSON, XML, and other formats—not programming languages like Python or Perl.

Explanation:

The Intent API provides a policy-based abstraction of business intent, allowing you to focus on the desired outcome rather than the individual steps required to achieve it. It is a Northbound REST API that uses standard HTTPS methods (GET, POST, PUT, DELETE) with JSON data structures. This abstraction hides the underlying complexity of device-level configurations, allowing you to declare business goals—such as "provide connectivity for device X with policy Y"—while Catalyst Center handles the device-level implementations automatically.

Why other options are incorrect:

B. southbound consumer-facing RESTful API
– Southbound APIs are used for communication from the controller to network devices (e.g., NETCONF, RESTCONF, SNMP) to push configurations and collect telemetry. They are not consumer-facing nor do they focus on business outcomes .

C. interface between the controller and the network devices – This describes the southbound interface, which handles device-level communication, not the intent-based northbound API.

D. westbound interface
– While Catalyst Center may support integrations with external systems like ITSM or IPAM, these are not classified as "westbound." East/westbound interfaces typically facilitate communication between peer controllers or external IT systems .

References:

Cisco DevNet: Intent APIs provide policy-based abstraction of business intent
Cisco Platform User Guide:Intent APIs are Northbound REST APIs that exchange JSON

✅ Explanation:

The correct answer is A because it uses the track statement to monitor the IP SLA reachability and triggers when the tracked object's state goes down.

text
track 10 ip sla 10 reachability
This means the state of the track object is tied to whether the IP SLA 10 destination (192.168.10.20) is reachable or not.

To trigger an EEM applet when this tracked object changes to a down state (meaning the IP SLA destination is no longer reachable), the correct event statement is:

text
event track 10 state down
The event track statement directly monitors the tracked object's state, and the state down keyword triggers the applet when the tracked object becomes unreachable.

Why other options are incorrect:

B. event sla 10 state unreachable
– This syntax is incorrect. While IP SLA itself can be used as an event source, the exhibit uses a track statement to monitor the IP SLA. The correct EEM event syntax to monitor the track object is event track, not event sla.

C. event sla 10 state down
– This is also incorrect syntax. IP SLA states are typically represented as reachable or unreachable (or ok/failed), not down. Additionally, the EEM event syntax for IP SLA is event sla, but the correct trigger would be state unreachable, not state down.

D. event track 10 state unreachable
– This is partially correct but uses the wrong state keyword. The track object represents reachability, and its states are up (reachable) and down (unreachable), not unreachable. The correct state keyword for a track object is down, making option A correct.

🔗 References:

Cisco IP SLA Configuration Guide: IP SLA tracking uses track to monitor reachability and state down for unreachable.

Cisco EEM Command Reference: event track is used with state up or state down.

Explanation:

A Transport Location (TLOC) is a fundamental construct in the Cisco Catalyst SD-WAN architecture. It acts as a next-hop attribute for network prefixes and identifies the physical interface where a WAN Edge router connects to the WAN transport network.

Simply put, a TLOC provides the "next-hop" information used to route traffic across the SD-WAN overlay. It is uniquely identified by an IP address–color pair (e.g., {10.0.10.1, mpls}), where the system IP address provides a fixed location for the device, and the "color" identifies the type of WAN transport link (e.g., mpls, biz-internet, 3g).

When a WAN Edge router receives an OMP route, it uses the TLOC to determine which specific transport interface on the destination router to use to reach the advertised network prefix. The TLOC is advertised to the SD-WAN controllers via the Overlay Management Protocol (OMP), which allows the network to make intelligent forwarding decisions based on transport location and path availability.

Why the others are wrong:

A. component set by the administrator to differentiate similar nodes that offer a common service:
This describes a site ID or a TLOC list used in policy configuration, not a TLOC. A site ID identifies the physical location of a WAN Edge router, while a TLOC identifies a specific transport interface.

B. value that identifies a specific tunnel within the Cisco Catalyst SD-WAN overlay:
While TLOC information is used to identify tunnel endpoints and connections, it is not simply a "tunnel ID." It is a more comprehensive next-hop attribute that includes IP address, color, and encapsulation, which together define the transport location.

C. identifier that represents a specific service offered by nodes within the Cisco Catalyst SD-WAN overlay:
This describes a service TLOC, which is used to redirect traffic to a service (like a firewall or load balancer). However, a standard TLOC represents a WAN transport location, not the service itself.

References

Cisco DevNet Glossary: Defines a TLOC as "the physical interface where a vEdge router connects to the WAN transport network".

Cisco Configuration Guide:
Details TLOC as an attribute to direct traffic to a remote TLOC matching IP, color, and encapsulation.

Explanation:

In the LISP (Locator/ID Separation Protocol) architecture, the Map Resolver serves as the primary repository for EID-to-RLOC mappings. Its specific function is to accept and process registration requests from ETRs. When an ETR is configured with a specific EID prefix, it registers that prefix with the Map Resolver, creating an entry in the mapping database. This process is foundational to LISP's operation.

While the Map Resolver plays a role in the mapping lookup process, its direct responsibility is handling the registration of ETRs. Other components handle different parts of the lookup and forwarding workflow.

Why other options are incorrect:

A. forwarding user data traffic:
This is a function of the data plane (the routers themselves), not a specific LISP mapping component. Both ITRs and ETRs forward data traffic.

B. accepting map-request messages from ITRs:
This is a function of the Map Server, not the Map Resolver. The Map Server receives map-requests from ITRs and helps resolve them by querying the Map Resolver's database.

C. finding EID-to-RLOC mappings:
While this is the overall purpose of the mapping system, the Map Resolver's primary responsibility is to store these mappings (after ETR registration). The act of "finding" is more associated with the Map Server processing map-requests.

References

LISP Architecture (RFC 6830): Map Resolvers are used for registration
Cisco LISP Configuration Guide: ETRs register their EID prefixes to the Map Resolver
LISP and LISP Mapping System Overview: Map Resolver accepts registration requests from ETRs

✅ Explanation:
In Cisco SD-Access, switches are assigned specific roles within the fabric. The two fundamental device roles are the edge node and the border node .

C. Edge Node: Serves as the first-hop connection for endpoints (users, devices, servers) . It identifies and authenticates endpoints, registers their location with the control plane node, and performs VXLAN encapsulation/decapsulation of data traffic to and from all connected endpoints .

E. Border Node: Acts as the entry and exit point for traffic moving into and out of the SD-Access fabric site . It connects external Layer 2 and Layer 3 networks to the fabric, performs VXLAN encapsulation/decapsulation, and can be configured as internal (imports external routes), external (acts as default gateway), or combined .

Why other options are incorrect:

A. access switch – This is a traditional networking term. In SD-Access, an access switch becomes either an edge node (if it participates in the fabric) or an extended node (if it extends fabric VLANs) .

B. vBond controller – This is a component of the Cisco SD-WAN architecture (orchestration plane), not the SD-Access fabric for campus networks .

D. core switch – This is a traditional networking layer, not a specific SD-Access device role. In SD-Access, the core layer may be integrated with other functions, and fabric roles (edge, border, control plane) are used to describe device functions .

🔗 References:

Cisco SD-Access Design Guide: Edge nodes connect wired endpoints; border nodes connect external L3 networks .

Cisco Live Presentation: Edge nodes provide first-hop services; border nodes are entry/exit points .

Explanation:

Layer 3 inter-controller roaming allows a wireless client to roam between Access Points connected to Wireless LAN Controllers (WLCs) located in different Layer 3 IP subnets without losing session connectivity.

Mobility Group Requirement: To enable seamless inter-controller roaming, WLCs must belong to the same mobility group. This allows the controllers to exchange mobility control messages, share client context/session information, and establish a CAPWAP mobility tunnel.

IP Address Preservation: When a client roams across a Layer 3 boundary, the original WLC becomes the Anchor Controller and the new WLC becomes the Foreign Controller. All data traffic is tunneled between them, allowing the client to maintain its original IP address dynamically and invisibly.

Why Other Options Are Incorrect:

A. Clients must obtain a new IP address when they roam between APs:
Incorrect. The primary objective of Layer 3 roaming is to keep the client's original IP address intact so ongoing active sessions (e.g., VoIP calls or active TCP sessions) are not dropped.

B. It provides seamless roaming between APs that are connected to different Layer 3 networks and different mobility groups: Incorrect. Controllers must be in the same mobility group (and configured on each other's mobility list) to trust each other, share client session data, and establish the required mobility tunnels.

C. It is only supported on controllers that run SSO:
Incorrect. Stateful Switchover (SSO) is a High Availability (HA) redundancy mechanism between a active/standby pair of controllers; it is not a prerequisite for Layer 3 roaming.

References:

Cisco Wireless Controller Configuration Guide: Understanding Mobility Groups and Layer 3 Inter-Controller Roaming.

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.2 Describe Layer 2 and Layer 3 roaming principles.

Explanation:

Web Authentication (WebAuth) is a Layer 3 authentication mechanism commonly used for guest wireless access.

Requires Client Authentication: The client device is forced to open a web browser and authenticate via a captive portal (by entering credentials, accepting a terms-of-use policy, or providing registration details).

Functions Without Encryption: Unlike WPA2/WPA3 or WEP, standard WebAuth operates over an open Layer 2 connection. The wireless data payload transmitted over the air between the client device and the Access Point remains unencrypted, even though the client is required to perform authentication at the portal layer.

Why Other Options Are Incorrect

A. open: Open authentication does not require the client to supply credentials or authenticate user identity. Any device can associate freely, and no encryption is applied.

B. WEP: Wired Equivalent Privacy mandates static Layer 2 data encryption (RC4 cipher). It cannot operate as an unencrypted authentication protocol.

D. PSK: Pre-Shared Key (WPA/WPA2/WPA3 Personal) relies on encryption (TKIP/AES/CCMP). The pre-shared key is used directly to derive dynamic encryption keys for securing over-the-air data.

References:

Cisco Wireless LAN Controller Configuration Guide: Configuring Web Authentication (Layer 3 Security).

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.3 Describe 802.11 wireless security mechanisms (Open, WEP, WPA2/WPA3 Personal/Enterprise, WebAuth).