Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Explanation:

To protect against ransomware by blocking the execution stage and preventing file encryption, you need a solution that stops the attack before it can run its malicious payload. The correct choice is to enable the Exploit Prevention engine within Cisco AMP (Advanced Malware Protection, now known as Cisco Secure Endpoint).

Why other options are incorrect

A. Use Cisco Firepower with Intrusion Policy and snort rules blocking SMB exploitation.
While Firepower can block specific exploits like SMB-based attacks, this is a network-based, signature-driven approach. It targets a specific threat vector and may be less effective against more evasive, file-less ransomware that doesn't follow predictable patterns .

B. Use Cisco AMP deployment with the Malicious Activity Protection engine enabled.
Malicious Activity Protection (MAP) is designed to detect ransomware behavior after it begins executing, such as file encryption attempts, and then kill the process . Although it is crucial for protecting against ransomware, it acts during or after the execution stage, not by blocking the initial execution itself .

D. Use Cisco Firepower and block traffic to TOR networks.
Blocking traffic to TOR or other anonymizing networks is a network control measure that can hinder command-and-control communication, but it does not prevent the initial execution of ransomware on the endpoint .

References

Cisco AMP for Endpoints Product Literature: Explains that the Exploit Prevention engine protects against file-less and memory injection attacks by changing the memory structure of protected processes to trap and neutralize exploits .

Cisco Security Blogs: Mention that Exploit Prevention is a new capability introduced to stop file-less attacks that are commonly used to deliver ransomware .

Explanation:

EIRP (Effective Isotropic Radiated Power) is the standard measurement used to quantify the total output energy of a Wi-Fi device. It represents the actual radiated power from the antenna after accounting for the transmitter output, cable losses, and antenna gain .

The calculation is: EIRP = Transmitter Power (dBm) - Cable Loss (dB) + Antenna Gain (dBi) . This value is critical for determining coverage area and ensuring compliance with regulatory limits set by bodies like the FCC and ETSI .

Why other options are incorrect:

A. dBi:
This is the unit used to express antenna gain—how effectively an antenna focuses energy in a specific direction . It is a component of the EIRP calculation, not the total output energy measurement itself.

C. mW:
This is a basic unit of absolute power (milliwatts). It does not account for antenna gain or cable loss, which are essential factors in determining the final radiated power of a Wi-Fi device .

D. dBm:
This is a logarithmic measure of absolute power relative to 1 milliwatt. While dBm is used to express transmitter output power, it does not by itself represent the final radiated energy after the antenna system .

References:

Hak5 Documentation: "The total output power of this chain is expressed as EIRP"

Network World: "EIRP = transmit strength (dBm) + antenna gain (dBi) – cable loss (dB)"

Huawei WLAN Documentation: "EIRP (Effective Isotropic Radiated Power) refers to the signal strength emitted by the antenna terminal"

Explanation:

The question asks which Python snippet stores the data structure of the device (the Devices dictionary) in JSON format. The correct method is json.dump(), which serializes a Python object and writes it directly to a file in JSON format. Option C uses this correctly:

open("devices.json", "w") opens the file in write mode.
json.dump(Devices, OutFile) writes the JSON representation of the Devices dictionary to the file.
OutFile.close() closes the file to ensure all data is written.
This is the standard approach for exporting Python data structures to JSON files.

Why other options are incorrect:

A. Option A:
Uses json.load(), which reads a JSON file and deserializes it into a Python object. This is the opposite operation (reading, not storing) and would fail because OutFile is opened for writing, not reading.

B. Option B:
Uses str(Devices), which creates a Python string representation of the dictionary, not a valid JSON format. JSON requires double quotes around keys and strings, while Python's str() uses single quotes and may not handle data types like None correctly.

D. Option D:
Uses json.dumps(Devices), which serializes the Python object to a JSON string but does not write it to a file. The string is generated but not stored anywhere, so no JSON file would be created.

References:

Python Official Documentation – json module: json.dump(obj, fp) writes JSON to a file; json.dumps(obj) returns a JSON string

Real Python: "json.dump() takes a Python object and a file object, writing JSON to that file"

Explanation:

In a unified wireless deployment, Layer 3 roaming occurs when a client moves between Access Points (APs) connected to different controllers that are on different IP subnets/VLANs.

When this happens, the client's database entry is not moved to the new controller. Instead, it is copied, and both controllers update their databases with specific roles to maintain the client's original IP address and seamless connectivity.

Why other options are incorrect

A. An EoIP tunnel is created between the client and the anchor controller: The tunnel is created between the controllers, not between the client and the controller.

B. The client entry on the original controller is passed to the database on the new controller: This describes a Layer 2 roam where the entry is moved. In a Layer 3 roam, the entry is copied, not moved.

C. The new controller assign an IP address from the new subnet to the client: To maintain seamless connectivity, the client keeps its original IP address and does not obtain a new one from the new subnet.

References

Cisco Wireless Controller Configuration Guide (Intersubnet Roaming): This document states that for intersubnet roaming, the original controller marks the client with an anchor entry, and the database entry is copied to the new controller and marked as a foreign entry.

Cisco Enterprise Mobility Design Guide: This guide explains that a Layer 3 roam involves the anchor and foreign controllers updating their databases, with traffic tunneled between them to preserve the client's original IP address.

Explanation:

A network design that uses small and repeatable sections—often referred to as a modular or building-block design—is a fundamental best practice in campus and data center networking. This approach involves constructing the network from consistent, well-defined components that can be reused throughout the infrastructure. This design methodology delivers two primary benefits:

Scalability (C):
Small, repeatable sections allow the network to grow predictably and efficiently. When new users, devices, or sites need to be added, the administrator simply deploys another identical module (e.g., an access switch block) without redesigning the entire network. The consistency of these sections also simplifies capacity planning, as the performance characteristics of each module are well understood. This modular approach ensures that the network can scale to meet growing demands while maintaining consistent performance and operational practices.

Quick failure isolation (D):
Small, repeatable sections provide clear boundaries that simplify troubleshooting. When an issue occurs, the modular design allows network engineers to quickly isolate the fault to a specific section or device. Instead of analyzing the entire network, troubleshooting is confined to a small, contained area. This significantly reduces mean time to repair (MTTR) and minimizes the impact of failures on the rest of the network.

Why other options are incorrect:

A. Lower monitoring requirements:
A larger, more modular network often requires more monitoring points, not fewer. While the design may simplify monitoring strategies by making them more consistent across modules, it does not inherently reduce the overall monitoring burden.

B. Low latency:
Latency is determined primarily by physical distance, transmission media, and the number of hops, rather than by network design modularity. A modular design does not guarantee lower latency.

E. Improved throughput:
Throughput is influenced by bandwidth, device capabilities, and link speeds. While a well-designed modular network can scale to support more throughput, the modular design itself does not directly improve throughput performance.

References:

Cisco Campus Network Design Guide: "Modular design allows the network to scale easily and isolate failures to specific blocks"

ENCOR 350-401 Official Cert Guide, Chapter 2: "Hierarchical and modular design simplifies troubleshooting and supports growth"

Explanation:

Confidentiality ensures that data exchanged between the client and server cannot be read or intercepted by unauthorized parties. For REST APIs, the standard and most effective method to achieve confidentiality is TLS (Transport Layer Security), often implemented as HTTPS. TLS encrypts the entire HTTP session, protecting all data in transit—including the request URL, headers, and body—from eavesdropping and man-in-the-middle attacks. This is a fundamental security best practice for any API exposed over untrusted networks.

Why other options are incorrect:

B. Use the POST method instead of URL-encoded GET to pass parameters:
While using POST places parameters in the request body instead of the URL, it does not provide encryption. Without TLS, the request body is still sent as plaintext and can be intercepted. POST does not ensure confidentiality.

C. Deploy digest-based authentication to protect access to the API:
Digest authentication protects the user's credentials by using a hashed value, but it does not encrypt the entire API payload. The data exchanged after authentication—such as user records or financial transactions—remains unencrypted. Digest authentication is about authentication, not confidentiality.

D. Encode sensitive data using Base64 encoding:
Base64 is an encoding scheme, not an encryption method. It converts binary data to ASCII text for transmission but provides no security—it can be easily decoded by anyone. Base64 does not ensure confidentiality, as it is completely reversible without a key.

References:

OWASP API Security Top 10 (2023): "Always enforce HTTPS/TLS for all API endpoints"

RESTful API Security Essentials: "Use HTTPS for all communications to ensure confidentiality"

Explanation:

The Sniffer mode is the specific AP mode that allows administrators to generate packet capture (pcap) files for troubleshooting wireless network issues. When an AP is placed in this mode, it dedicates its radio to capturing all 802.11 wireless frames on a particular channel. It then forwards these captured packets, which contain information on timestamps, signal strength, and packet sizes, to a remote machine running a packet analyzer program like Wireshark or OmniPeek. Because the AP operates as a dedicated sniffer in this mode, it does not serve clients; a separate AP is required for coverage.

Why other options are incorrect:

B. Local: This is the default mode for serving wireless clients. It centralizes client traffic through the WLC. It is not used for packet capture.

C. H-REAP (or FlexConnect): This mode is designed for branch offices to switch traffic locally for resiliency when the WAN link fails. It is not a troubleshooting mode for generating packet captures.

D. Monitor: This mode turns the AP into a dedicated sensor for security and RF management tasks like rogue AP detection and IDS, but it does not capture and forward packets to a pcap file.

References:

Cisco 9800 Wireless Controller Configuration Guide: Sniffer mode is used to "capture and forward all the packets on a particular channel to a remote machine that runs packet analyzer software".

Cisco Wireless AP Modes (NetworkLessons): Sniffer mode creates a remote wireless sniffer, useful when you are not on-site to troubleshoot, and saves traffic into pcap files.

Explanation:

For a Cisco Lightweight Access Point (LAP) to discover a Wireless LAN Controller (WLC) using DNS over IPv4, the DNS server must be configured with an A record (Address record). This record maps the hostname CISCO-CAPWAP-CONTROLLER.localdomain to the management IP address of the WLC.

The discovery process works as follows: When the AP boots and receives an IP address and DNS information (typically via DHCP), it attempts to resolve the DNS name CISCO-CAPWAP-CONTROLLER.localdomain. The DNS server returns the IPv4 address(es) associated with this name via A records. The AP then sends a unicast CAPWAP Discovery Request to those resolved IP addresses, and any WLC that receives the request responds, allowing the join process to begin.

Why other options are incorrect:

A. CNAME record:
A CNAME (Canonical Name) record creates an alias for another domain name. While it could technically point CISCO-CAPWAP-CONTROLLER to an A record, the direct record type required for the AP to resolve the name to an IP address is the A record.

C. NS record:
An NS (Name Server) record identifies the authoritative DNS servers for a zone. This is used for DNS infrastructure delegation, not for resolving a specific hostname to an IP address, and is not involved in the AP discovery process.

D. SOA record:
An SOA (Start of Authority) record contains administrative information about a DNS zone, such as the primary name server and contact email. It does not provide hostname-to-IP resolution for WLC discovery.

References:

Cisco Support Documentation:"The Lightweight AP (LAP) can discover controllers through your domain name server (DNS)... you must configure your DNS to return controller IP addresses".

Cisco Troubleshooting Guide (Document ID:119286): "The AP sends discovery requests to controllers through DNS entry for cisco-capwap-controller".

Explanation:

In Python, the * operator when used with a list performs list repetition (also called list multiplication). The syntax list * 3 creates a new list containing the original list's elements repeated three times in sequence. This is a fundamental Python operation that does not perform element-wise multiplication.

The code executes as follows:
list = [1, 2] – Creates a list with two elements.
list = list * 3 – Repeats the list three times: [1, 2] + [1, 2] + [1, 2].
print(list) – Outputs [1, 2, 1, 2, 1, 2].

Why other options are incorrect:

B. [1,2] * 3: This is the expression itself, not the evaluated result. The code executes the multiplication and assigns the resulting list, so the variable contains the numeric list, not the expression string.

C. [3, 6]: This would be the result of element-wise multiplication (e.g., [x * 3 for x in list]), which is not what the * operator does with lists. The * operator performs repetition, not multiplication of individual elements.

D. [1,2]. [1,2]. [1,2]: This is syntactically invalid and uses periods instead of commas. It does not reflect Python's list repetition behavior.

References:

Python Official Documentation:"The * operator on sequences replicates the sequence, producing a new sequence with the contents repeated by the given factor"

W3Schools: "List repetition using * is used to repeat a list a specified number of times"