Free Cisco 350-401 Practice Questions 2026 | Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

✅ Explanation:

The goal is to print the descriptions of disabled interfaces. Based on the provided data:
GigabitEthernet 0 is disabled (enabled = 'false') and has a description ('my description')
GigabitEthernet 1 is enabled (enabled = 'true')
GigabitEthernet 2 is disabled (enabled = 'false')

Therefore, the code must filter for interfaces where enabled is 'false'. Option A correctly uses the condition if interface["enabled"] != "true": to select the disabled interfaces (where enabled is "false") and prints their descriptions.

Why the correct answer is A. Option A
(The image shows Option A with the correct syntax and indentation.)

Why other options are incorrect:

B. Option B:
Uses the condition if interface["enabled"] != "false": which selects interfaces where enabled is not "false"—meaning it selects the enabled interface (GigabitEthernet 1), not the disabled ones. This would print the description of the enabled interface, which is not the requirement.

C. Option C:
This is a duplicate of Option A in logic, but based on standard exam structure, only one option is correct. The key difference is that Option A shows proper indentation (the print is indented under the if), while Option C likely lacks proper indentation, which would cause an IndentationError in Python.

D. Option D:
Prints both enabled and description for every interface without any filtering—does not meet the requirement of printing only disabled interfaces.

🔗 References

Python Dictionaries: Accessing nested data with keys (interface["enabled"], interface["description"]).

Python Conditional Statements: Using if to filter data; != checks for inequality.

✅ Explanation:

The component of the Cisco Cyber Threat Defense (CTD) solution that provides user and flow context analysis is the Cisco Stealthwatch System, now known as Cisco Secure Network Analytics. This is explicitly stated in the official Cisco documentation. The CTD solution is designed to combine several elements to detect advanced threats. One of its core components is the network traffic analysis provided by Stealthwatch, which has a specific purpose.

Why other options are incorrect:

A. Cisco Firepower and FireSIGHT:
While the FireSIGHT Management Center (now part of Firepower) provides a feature called "Context Explorer" that displays rich, contextual information about network activity, applications, and users , its role is primarily as a management console for the Firepower NGIPS and AMP components. Its context analysis is more focused on correlating events from those specific security tools. The centralized context analysis solution integrating user identity with flow data for the broader Cyber Threat Defense solution is Stealthwatch .

C. Advanced Malware Protection:
Cisco AMP provides protection against malware across the network and endpoints, but it is focused on file analysis, sandboxing, and retrospection, not on providing user and flow context analysis . It lacks the network visibility and user correlation capabilities of Stealthwatch.

D. Cisco Web Security Appliance:
The Cisco WSA is a content security control that provides dynamic threat control for web traffic, including URL analysis and data transfer controls . It is not designed to provide broad user and flow context analysis across the entire network .

🔗 References

Cisco Cyber Threat Defense v2.0 Design Guide: "The Cisco Cyber Threat Defense version 2.0 makes use of several solutions to accomplish its objectives: ... NetFlow and the Lancope StealthWatch System - Broad visibility - User and flow context analysis - Network behavior and anomaly detection - Incident response and network forensics" .

Cisco Cyber Threat Defense 1.1 Release Notes: "Contextual information including user and device identity from the Cisco Identity Services Engine (ISE)" .

✅ Explanation:

RSSI (Received Signal Strength Indicator) is measured in dBm, where values closer to zero represent a stronger signal . Let's analyze the given values:

Location C: -65 dBm
Location B: -75 dBm
Location A: -72 dBm
Location D: -80 dBm

A difference of 3 dB represents a doubling or halving of signal power, and a difference of 10 dB represents a tenfold increase or decrease .

Statement D: The signal at B (-75 dBm) is 3 dB weaker than at A (-72 dBm), meaning it is half as strong, or 50% weaker. Correct.

Statement E: The signal at C (-65 dBm) is 10 dB stronger than at B (-75 dBm), meaning it is ten times more powerful. Correct.

Why other options are incorrect:

A: Location B (-75 dBm) is 10 dB weaker than Location C (-65 dBm), not better. A lower (more negative) dBm value signifies weaker signal strength .

B: An RSSI of -65 dBm is generally considered a strong, "Good" signal that is well within the range required for reliable web surfing and most applications .

C: The strongest RF signal is the one with the value closest to zero. Location C (-65 dBm) is the strongest, not Location D (-80 dBm) .

🔗 References

Cisco RSSI Threshold Guidelines: Defines -65 dBm as good for voice and -72 dBm as good for data, indicating a -65 dBm signal is strong .

Understanding dBm: A 10 dB increase represents a tenfold increase in signal power, and a 3 dB increase represents a doubling in power .

✅ Explanation:

To append the output of the show process cpu sorted command to a file using an Embedded Event Manager (EEM) script, the correct syntax is to use the cli command action. The EEM cli action allows the script to execute IOS CLI commands on the device and capture or redirect their output.

Option B correctly uses action 4.0 cli command "show process cpu sorted | append flash:high-cpu-file". In the context of the exhibit, actions with cli are used to execute IOS commands, and the pipe (|) operator with the append keyword is the correct IOS syntax to redirect the output of a show command to a file on flash memory.

Why other options are incorrect:

A. action 4.0 syslog command "show process cpu sorted | append flash:high-cpu-file": syslog is used to generate a syslog message, not to execute CLI commands or redirect their output to a file.

C. action 4.0 ens-event "show process cpu sorted | append flash:high-cpu-file":
ens-event is used to trigger another EEM event, not to execute CLI commands.

D. action 4.0 publish-event "show process cpu sorted | append flash:high-cpu-file": publish-event is also used to publish an event to the EEM server, not to execute CLI commands.

🔗 References

Cisco Embedded Event Manager Configuration Guide: action cli executes IOS commands; syslog sends syslog messages; ens-event and publish-event are for event triggering.

Cisco IOS Command Reference: The | append operator redirects command output to a specified file.

✅ Explanation:

Free Space Path Loss (FSPL) is the term used to describe the decline of RF signal amplitude over a given distance. It represents the theoretical loss of signal power that occurs as an electromagnetic wave travels through free space (i.e., a vacuum or open air without obstructions) and expands in a spherical pattern. The loss is proportional to the square of the distance from the transmitter and the square of the frequency . This is a fundamental concept in wireless communications, accurately described as the decline in signal amplitude over distance.

Why other options are incorrect:

A. signal-to-noise ratio:
The Signal-to-Noise Ratio (SNR) measures the strength of the desired signal relative to the background noise level . It is a ratio that indicates signal quality, not a measure of signal decline over distance. A signal can have good SNR even if it has lost amplitude, as long as the noise level is proportionally low.

B. received signal strength indicator:
The Received Signal Strength Indicator (RSSI) is a measurement of the absolute power level of the RF signal at the receiver . It does not represent the decline over a distance; rather, it is the specific value that results from the decline. While RSSI decreases with distance, the decline itself is called path loss.

D. effective isotropic radiated power:
Effective Isotropic Radiated Power (EIRP) is the total power radiated by an antenna, taking into account the transmitter power and antenna gain . It is a measure of output power, not signal decline over distance.

🔗 References

IEEE Standard Definitions of Terms for Radio Wave Propagation: Defines free-space path loss as the loss between isotropic radiators that occurs as a result of the spreading of the wave front in free space.

Cisco Wireless Design Guidelines: Discusses path loss as the reduction in power density of an electromagnetic wave as it propagates through space.

✅ Explanation:

Cisco SD-Access provides two levels of segmentation to secure a network: macro-segmentation using Virtual Networks (VNs) and micro-segmentation using Scalable Group Tags (SGTs). These serve different but complementary purposes.

Why other options are incorrect:

A. Devices are assigned to virtual networks based on their VLAN membership.
This is incorrect. In traditional networks, VLANs are used to segment traffic. However, in SD-Access, assignment to a Virtual Network (VN) is based on identity and policy, administered by Cisco Identity Services Engine (ISE) and orchestrated by Cisco Catalyst Center. SD-Access is designed to move beyond VLAN-based segmentation.

C. Virtual networks are used for microsegmentation.
This is incorrect. Virtual Networks (VNs) are used for macro-segmentation to create large, isolated groups. Micro-segmentation, the more granular control within a VN, is achieved using Scalable Group Tags (SGTs).

D. All traffic is Layer 3 within the fabric.
This is incorrect. The Cisco SD-Access fabric supports both Layer 2 and Layer 3 virtual networks. A Layer 2 Virtual Network (L2VN) is used when devices need pure Layer 2 connectivity, such as when they have existing VLAN configurations that must remain intact. Therefore, not all traffic is Layer 3.

🔗 References

Cisco SD-Access Solution Design Guide: Explains that SGTs provide micro-segmentation for groups within a virtual network.

Cisco Validated Solution Profile: Differentiates VNs (macrosegmentation) from SGTs (microsegmentation), noting VNs assign endpoints to VRFs.

✅Explanation:

To prevent basic replay attacks against a REST API, the engineer should implement a mechanism that validates the "freshness" of each request. This is achieved by having the client include a timestamp in the request header. The server then checks if this timestamp falls within an acceptable time window (e.g., ±5 minutes from its own clock) . Requests with timestamps that are too old are rejected, as they are considered potential replays.

Why other options are incorrect:

B. Use a password hash:
Sending a password hash does not prevent replay attacks. An attacker could simply intercept and resend the entire request, including the hash, to gain unauthorized access. A dynamic challenge-response mechanism (like a nonce) is required to make the authentication data a one-time use.

C. Add OAuth to the request in the API header:
OAuth is a framework for authorization, not a direct defense against replay attacks. While a properly implemented OAuth 2.0 flow uses mechanisms like the state parameter to prevent Cross-Site Request Forgery (CSRF) , it does not automatically make all API requests immune to replay. An attacker could still resend a valid OAuth token to the API if no other freshness checks are in place .

D. Use HTTPS:
HTTPS (TLS) is essential for securing the communication channel and preventing Man-in-the-Middle (MITM) attacks that could steal credentials or tamper with data . However, it does not prevent replay attacks. An attacker might not be able to read the encrypted traffic, but they can still record it and replay the entire encrypted session to a server that doesn't check for request freshness . Therefore, HTTPS is a prerequisite for security, but it does not protect against replay attacks .

🔗 References

ReqSeal Package Documentation: Describes using time-bounded requests with a replay cache to prevent simple replay attacks .

JSON Interface Security: Explains the timestamp + nonce mechanism for preventing replay attacks in APIs .

Explanation:

A Type 2 hypervisor, also known as a hosted hypervisor, is installed as a software application on top of an existing, fully functional operating system (OS) . This fundamental characteristic leads to the "quick deployment" described in the question.

Because it runs as a standard application on a host OS, the installation process is typically straightforward. An administrator can download, install, and start running virtual machines on a PC or server that already has an OS like Windows or Linux, without needing to configure a separate, specialized operating system for virtualization . This convenience makes Type 2 hypervisors ideal for tasks like software development, testing, and personal use . This contrasts with a Type 1 hypervisor, which is installed directly on the bare metal of a server, requiring more complex setup and management .

Why other options are incorrect:

B. ideal for data center:
This is incorrect. Type 1 (bare-metal) hypervisors are the standard for large-scale data centers and enterprise production environments because they offer better performance, security, and scalability . Type 2 hypervisors are more commonly used on end-user systems for development or testing .

C. complicated deployment:
This is incorrect. The deployment of a Type 2 hypervisor is considered simple because it is installed just like any other application on a pre-existing OS . The installation process for a Type 1 hypervisor is generally more complex.

D. referred to as bare-metal:
This is incorrect. The term "bare-metal" is a defining characteristic of a Type 1 hypervisor, which runs directly on the physical hardware without an underlying operating system . A Type 2 hypervisor is explicitly referred to as a hosted hypervisor because it relies on the host OS .

🔗 References

TechTarget: Defines Type 2 as a hosted hypervisor installed on an existing OS, highlighting its ease of use compared to the more complex Type 1 .

IEEE: Describes Type 2 as running as an application within a conventional OS, common in development and testing .

✅ Explanation:

YANG (Yet Another Next Generation) is a data modeling language that defines the structure, constraints, and relationships of data for NETCONF and RESTCONF. It is used to model configuration and operational state data, as well as remote procedure calls (RPCs) and notifications, and is defined in RFC 7950 . When a client interacts with a NETCONF or RESTCONF server, the server uses a YANG module to define the structure of the data that can be queried or modified, which is then encoded in formats like XML or JSON for transmission .

Why other options are incorrect:

A. JSON:
JSON (JavaScript Object Notation) is a data encoding format, not a modeling language. While NETCONF and RESTCONF can encode data in JSON (as specified in RFC 7951), JSON itself does not define the structure or modeling of that data—that role is performed by YANG.

C. XML:
XML (eXtensible Markup Language) is a data encoding format, not a modeling language. While NETCONF uses XML as its default encoding format (and RESTCONF can also use it), XML defines the syntax of the data, not its structure or modeling—that is defined by YANG.

D. YAML:
YAML (YAML Ain't Markup Language) is a human-readable data serialization format. It is not used to define data models for NETCONF or RESTCONF, nor is it a standard encoding format for these protocols.

🔗 References

RFC 7950:Defines YANG as a data modeling language for NETCONF.

RFC 8040: Specifies RESTCONF and confirms that YANG is used for data modeling and that data can be encoded in XML or JSON.

✅ Explanation:

The recommended minimum SNR for data applications on wireless networks is 20 dB.

This figure is a widely accepted standard in the wireless industry. An SNR of 20-25 dB is generally considered a "Good" signal level, providing a stable connection suitable for standard data applications . A minimum of 20 dB ensures devices can communicate using higher data rates (such as 16-QAM and above) without consuming excessive airtime, which would degrade performance for all users on the network .

Why other options are incorrect:

A. 15:
While an SNR of 15-25 dB is sometimes described as "low" and sufficient for basic tasks like email and web browsing, 20 dB is the recommended minimum to ensure reliable performance for standard data applications without significant retransmissions or instability .

C. 25:
An SNR of 25 dB is typically the recommended minimum for more demanding applications, particularly Voice over Wi-Fi (VoWiFi) and real-time applications like video conferencing . It provides an extra margin of reliability required for latency-sensitive traffic, but is not the baseline recommendation for general data.

D. 10:
An SNR of 10-15 dB is considered "very low" or "weak," leading to an extremely unstable connection. At this level, only the most basic tasks are possible, and data applications would likely suffer from slow speeds, frequent timeouts, and high latency .

🔗 References

Cisco Discussions: 20 dB for data applications, 25 dB for voice applications .

Extreme Networks: Normal recommendations include a minimum SNR of 20-30 dB for data WLANs and 25 dB for voice WLANs