Cisco 350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Exam Practice Test

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:-

Copy run start

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

Copy run start

Verification:

OR

Solution:

VERIFICATION: -

OR

Solution:

Copy run start

Verification:

OR

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution: -

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

R2

R3

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

The correct answers are B. rpc statements and E. container statements.

YANG is a data modeling language used to model configuration and operational data for protocols such as NETCONF and RESTCONF. In YANG, the model is built using defined language statements such as container, list, leaf, and rpc. Cisco documentation explains that actions are defined in YANG models using RPC statements, and the YANG language definition identifies container as a standard statement used to define an interior data node in the schema tree.

Cisco documentation states that YANG models can define operational actions using RPC statements. These are used to trigger operations such as commands or actions on the device.

A container is one of the fundamental building blocks of a YANG model. It represents an interior node in the hierarchical data tree and is commonly used to group related configuration or state data.

A. HTTP return codes These belong to HTTP-based protocol behavior, not to the YANG model language itself.

C. JSON schema YANG is not a JSON schema language. Although YANG data may be encoded in JSON for some APIs, JSON schema is not a YANG model element. Cisco notes that protocols may use JSON formatting, but that does not make JSON schema part of YANG.

D. XML schema YANG is its own modeling language. NETCONF commonly uses XML encoding, but XML schema itself is not one of the YANG language statements.

ENCOR exam point:

Know the difference between:

YANG model elements → container, list, leaf, rpc

Data encodings / transport formats → XML, JSON

Protocol behaviors → HTTP status codes, NETCONF operations

The correct answers are B. Southbound API is based on NETCONF and XML and E. Northbound API is RESTful, using JSON.

In Cisco Catalyst SD-WAN, vManage interacts in two directions:

Northbound APIs are used by external applications to communicate with vManage. These APIs are RESTful and commonly use JSON payloads.

Southbound communication from vManage toward the SD-WAN devices uses NETCONF with XML encoding for configuration exchange.

The southbound API between vManage and managed devices is based on NETCONF/XML, which is used for device configuration and management communication.

The northbound API exposed by vManage is RESTful and uses JSON, which is the standard method for external tools and applications to integrate with Cisco SD-WAN Manager.

A. Southbound API is based on OMP and DTLS. OMP and DTLS are used in the SD-WAN control plane, not as the vManage southbound API format.

C. Northbound API is based on RESTCONF and JSON. vManage northbound integration is typically described as RESTful API using JSON, not specifically RESTCONF.

D. Southbound API is based on RESTCONF and JSON. This is incorrect because the southbound side is NETCONF/XML, not RESTCONF/JSON.

ENCOR exam point:

For Cisco SD-WAN Manager APIs, remember:

Northbound = RESTful + JSON

Southbound = NETCONF + XML

Blank 1: A

Blank 2: D

Blank 3: C

Blank 4: B

The EEM applet monitors an interface parameter and triggers when the receive load crosses the configured threshold. The first missing value must be rxload because the applet is watching receive utilization on GigabitEthernet1/0. The second blank is entry-val 70, which defines the trigger threshold used with entry-op ge, meaning the event is triggered when the monitored value is greater than or equal to 70. After the event triggers, the CLI actions move into privileged mode, enter global configuration mode, and then must enter the target interface. Therefore, the next blank is int gig1/0. Once inside the interface, the script applies the access list with ip access-group important_traffic_ACL in, so the final snippet is ip access-group. This EEM workflow is an event-driven operational control: when utilization exceeds a threshold, the device applies a restrictive inbound ACL to preserve important traffic. The ENCOR concept is automation-based incident response using EEM, interface event detectors, and CLI actions. References/topics: ENCOR Automation and Infrastructure, Embedded Event Manager, interface event detection, rxload, CLI applets, access-group enforcement.

The correct answer is A. The script retrieves device information by sending HTTP requests to the device ' s API endpoints.

The script uses the Python requests library:

response = requests . get( url )

This sends an HTTP GET request to:

http:// < device_ip > /api/device/info

This indicates communication with a REST API endpoint exposed by the network device.

Builds a URL using the device IP

Sends an HTTP GET request to the API

Checks if the response status code is 200 (OK)

If successful:

return response . json()

→ Converts the API response into a Python dictionary

Prints the retrieved device information

The script is clearly performing a read operation (GET)

It interacts with a REST API

It retrieves device information, not configuring anything

B. Configures device settings via secure connection ❌ No POST/PUT/PATCH methods are used ❌ No HTTPS or authentication shown

C. Establishes SSH connection ❌ No SSH libraries (like Paramiko or Netmiko) are used

D. Parses JSON into tabular structure ❌ It only returns and prints JSON ❌ No formatting (like pandas/table conversion) is performed

requests.get() → Retrieve data (READ)

requests.post() / put() → Modify or create data

.json() → Converts API response into Python dictionary

Key takeaway:

REST API + GET request = data retrieval from device

The input service policy shown in the exhibit matches traffic with DSCP value 1 and applies a QoS set action to rewrite that marking to DSCP 63. Therefore, packets entering interface Fa7/0/2 with DSCP 1 are remarked to DSCP 63, making option B correct. The second part of the configuration defines a class map matching DSCP 63 and a policy map using bandwidth percent 50. That behavior belongs to class-based queuing/scheduling, where DSCP63-marked traffic is placed into a class that receives a bandwidth allocation. In the given option set, option C best represents this queuing behavior. Option D is wrong because the service policy explicitly changes the DSCP value. Option E is not accurate because classification is not triggered by reaching 50 percent bandwidth; classification occurs by matching packet fields such as DSCP. Option A is less precise than C because the shown policy behavior is class-based queuing with a bandwidth allocation. The important ENCOR concept is the separation between marking on ingress and queuing/scheduling on egress. References/topics: ENCOR Infrastructure, QoS, MQC, class maps, policy maps, DSCP marking, CBWFQ, bandwidth percent.

The correct answer is B. To route video traffic through a dedicated link.

Policy-Based Routing (PBR) allows the router to make forwarding decisions based on policies such as source, destination, application, or other match criteria, instead of relying only on the routing table. Cisco documentation explains that PBR gives more control over routing by reducing reliance on routes learned from routing protocols, and that it can route traffic according to a defined policy.

This means an engineer can identify video traffic and force it to use a specific dedicated path or link, even if that path is not the normal best path chosen by the routing table. Cisco also notes that set ip next-hop makes the system use policy routing first and then the routing table, which confirms that PBR can override normal routing behavior to send selected traffic to a chosen next hop.

Video traffic is often sensitive to delay, jitter, and packet loss. With PBR, the engineer can match that traffic and send it over a dedicated WAN link or preferred path that better supports real-time applications. This is a classic use case for PBR.

A. To route video traffic using the shortest path to the destination This is normally the job of the routing table and routing protocols, not PBR. PBR is used when the engineer wants to override normal path selection.

C. To use multicast for video traffic transmission Multicast is a separate forwarding technology and is not the purpose of PBR.

D. To perform traffic shaping to avoid video traffic delay Traffic shaping is a QoS function, not a routing decision function. PBR selects paths; it does not shape traffic.

ENCOR exam point:

Use PBR when traffic must follow a policy-defined path rather than the path chosen by standard routing protocol metrics.

A next-generation firewall protects against more than basic IP, port, and protocol violations. Its key value is application visibility and control. In a data center, an NGFW can identify applications regardless of port, inspect application behavior, enforce policy based on application identity, and block malicious or risky applications that traditional firewalls may allow if they use permitted ports such as TCP 80 or 443. Therefore, option D is the best answer. DDoS protection is usually handled by dedicated DDoS mitigation systems, upstream scrubbing services, rate limiting, or cloud-based DDoS protection rather than being the defining function of a data center NGFW. Unauthorized analyzers and rogue APs are not the primary threat categories addressed by a data center NGFW; rogue AP detection is more aligned with wireless security and WIPS/WIDS. The key ENCOR concept is that NGFWs add application awareness, user/context-based policy, intrusion prevention, malware inspection, and advanced threat defense to traditional stateful firewalling. References/topics: ENCOR Security, Cisco Threat Defense, next-generation firewall, application control, malware prevention, data center security.

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.