Cisco 350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2 Exam Practice Test

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution: -

Solution:-

Copy run start

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

R2

R3

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

Copy run start

Verification:

OR

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

Copy run start

Verification:

OR

Solution:

VERIFICATION: -

OR

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate → authentication-key → trusted-key

If any of these three are missing, authentication will not work properly.

The correct snippet is option B because json.dump(Devices, OutFile) serializes the Python data structure and writes the resulting JSON directly to the open file object. The file is opened in write mode with open( " devices.json " , " w " ), and OutFile.close() closes the file after writing. Option A is wrong because json.load() reads JSON from a file and converts it into a Python object; it does not write a Python object to disk. It is also being used on a file opened in write mode, which is logically incorrect. Option C writes str(Devices), which produces a Python string representation of the dictionary, not standards-compliant JSON. That output may use single quotes and Python-specific formatting, which is not proper JSON. Option D uses json.dumps(Devices), which returns a JSON-formatted string, but it does not write that string to the file because the return value is ignored. ENCOR automation questions often test the difference between dump, dumps, load, and loads. References/topics: ENCOR Automation, Python, JSON, json.dump(), json.dumps(), file output, API data formatting.

The correct answer is A.

Block HTTP traffic (TCP port 80)

Source: 10.10.10.1

Destination: any

Permit all other traffic

ip access-list extended 100

deny tcp host 10.10.10.1 any eq 80

permit ip any any

deny tcp host 10.10.10.1 any eq 80 → Blocks HTTP traffic from 10.10.10.1 to any destination

permit ip any any → Allows all other traffic

This perfectly matches the requirement.

B. ip access-list extended 10 ❌ Invalid — extended ACLs use ranges 100–199 or named ACLs, not 10

C. ip access-list extended NO_HTTP ❌ Missing permit ip any any → implicit deny all at the end blocks everything

D. deny tcp host 10.10.10.1 eq 80 any ❌ Incorrect syntax/order

eq 80 is applied to destination port, not source

This line is malformed and does not match HTTP filtering correctly

ACL evaluation rules:

Top-down processing

First match wins

Implicit deny all at the end

Correct pattern for “block one thing, allow rest”:

deny < specific traffic >

permit ip any any

Auto-RP is used in Protocol Independent Multicast sparse-mode environments to distribute rendezvous point information automatically. In PIM sparse mode, multicast routers must know which RP is responsible for specific multicast group ranges. Without a dynamic RP-discovery mechanism, administrators would have to configure RP information manually across routers. Auto-RP solves that by allowing candidate RPs to announce themselves and mapping agents to advertise group-to-RP mappings throughout the multicast domain. Therefore, option B is correct. Option A is incorrect because Auto-RP does not distribute IGMP traffic; IGMP operates between hosts and local multicast routers to manage group membership. Option C is wrong because Auto-RP does not automate leaf-router configuration generally; it specifically distributes RP mapping information. Option D is also inaccurate because Auto-RP does not perform an election in the same way as BSR. It advertises candidate RP and mapping-agent information so routers can learn RP mappings. The key ENCOR concept is multicast control-plane discovery for PIM sparse-mode RP selection. References/topics: ENCOR multicast, PIM sparse mode, Auto-RP, rendezvous point discovery, multicast group-to-RP mapping.

The correct answer is D. fabric edge node.

In Cisco SD-Access, the Anycast Gateway provides a consistent default gateway for endpoints across the fabric. This allows endpoints to keep the same gateway behavior regardless of where they attach within the fabric.

The fabric edge node provides the Anycast Gateway service for connected endpoints. It is the node where endpoints attach to the fabric, and it performs the first-hop gateway function using the distributed Anycast Gateway model.

This design provides:

Consistent default gateway addressing

Simplified endpoint mobility

Optimal forwarding within the fabric

Distributed first-hop gateway services

A. fabric border node The border node connects the SD-Access fabric to external networks. It does not provide the endpoint Anycast Gateway service.

B. control plane node The control plane node maintains host tracking and endpoint-to-location mappings using LISP. It is not the default gateway for endpoints.

C. intermediate node An intermediate node only forwards traffic inside the fabric underlay/overlay path and does not provide gateway services to endpoints.

Remember these SD-Access roles:

Fabric edge node = endpoint connectivity + Anycast Gateway

Control plane node = endpoint mapping database

Border node = external connectivity

Intermediate node = transit forwarding

Anycast Gateway in SD-Access = Fabric Edge Node

The correct answer is D.

Cisco campus design guidance explains that a nonlooped topology with unique VLANs per access switch improves stability and convergence compared with looped Layer 2 designs. Cisco states that in a multilayer campus design, each access switch should have unique VLANs, with no Layer 2 loops and no blocked links, which improves convergence behavior. Cisco also notes that VLANs spanning multiple access switches increase flooding impact, while a nonlooped topology with localized VLANs reduces that impact.

A traditional nonlooped design reduces reliance on spanning-tree reconvergence across shared Layer 2 domains. With unique/local VLANs, failures affect a smaller fault domain and convergence is faster than in a looped design with common VLANs stretched across switches. Cisco’s campus design material specifically recommends no Layer 2 loops and unique VLANs per access switch for better operational behavior.

A. Traditional looped design that has common VLANs extended between separate access switches This increases Layer 2 complexity and spanning-tree dependency, which slows convergence compared to a nonlooped design. Cisco documents that VLANs spanning multiple access switches increase flooding impact.

B. Cisco SD-Access configuration between aggregation intermediate nodes and access layers This is not the standard way the question is framed for classic aggregation-to-Layer 2 access convergence in a traditional enterprise campus design. The question is targeting the design principle of looped vs nonlooped Layer 2 access.

C. Cisco SD-Access configuration between aggregation and access-layer edge nodes SD-Access is a different fabric architecture. The question is about reducing convergence time between aggregation and a Layer 2 access layer, which maps to the traditional campus design choice rather than SD-Access node roles.

For enterprise campus design, remember:

Looped Layer 2 + stretched/common VLANs = slower convergence and larger fault domains

Nonlooped Layer 2 + unique/local VLANs per access switch = faster convergence and better stability

Cisco TrustSec classifies traffic using Security Group Tags, commonly called SGTs. An SGT represents the security group identity assigned to a user, device, or endpoint session. Instead of relying only on VLANs, IP subnets, or ACLs tied to topology, TrustSec allows policy to follow the identity of the endpoint. That makes option B correct. VLAN-based classification is less flexible because VLANs are tied to Layer 2 segmentation and network placement. MAC addresses can identify devices but are not the TrustSec policy classification mechanism. IP addresses are commonly used in traditional ACLs, but TrustSec’s purpose is to reduce dependence on IP-based segmentation by using group-based policy. Once traffic is tagged with an SGT, network devices can enforce Security Group ACLs, also called SGACLs, based on source and destination security groups. This supports scalable segmentation across campus and enterprise networks. The ENCOR concept is identity-based segmentation and policy abstraction. References/topics: ENCOR Security, Cisco TrustSec, Security Group Tag, SGACL, identity-based access control, scalable group-based segmentation.

The correct answer is B. to connect wired endpoints to the SD-Access fabric.

In Cisco SD-Access, the fabric edge node is the device that provides access for endpoints into the fabric. It is the point where user devices such as PCs, phones, printers, and access points attach to the SD-Access network. The edge node handles endpoint onboarding into the fabric and applies the appropriate segmentation and policy.

A fabric edge node is specifically responsible for:

Connecting wired endpoints to the fabric

Serving as the access-layer entry point into the SD-Access fabric

Enforcing policy and segmentation for connected endpoints

Extending the fabric to end hosts

This is the main role of the edge node in the SD-Access architecture.

A. to connect the fusion router to the SD-Access fabric This is not the role of the fabric edge node. The fusion router is used outside the fabric to provide connectivity between the fabric and external networks.

C. to advertise fabric IP address space to external networks This function is associated with the border node, not the edge node. The border node connects the fabric to external domains and exchanges reachability information.

D. to connect external Layer 3 networks to the SD-Access fabric This is also the function of the border node, not the edge node.

Remember these SD-Access node roles clearly:

Edge node = connects endpoints

Border node = connects to external networks

Control-plane node = maintains endpoint-to-location mappings

Fusion router = external routing/services outside the fabric

Edge node = endpoint access into the fabric

The correct answer is B. Router A.

VRRP elects the Master (primary virtual router) based on:

Highest priority (default = 100)

If priorities are equal → highest IP address wins

Router A

IP: 192.168.0.100

Priority: default (100)

Router B

IP: 192.168.0.2

Priority: default (100)

Router C

IP: 192.168.0.3

Priority: 80

Router D

IP: 192.168.0.4

Priority: 70

Compare priorities:

A = 100

B = 100

C = 80

D = 70

→ Highest priority = 100 (A and B tie)

Tie-breaker → Highest IP address:

Router A = 192.168.0.100

Router B = 192.168.0.2

→ 192.168.0.100 is higher

Router A becomes the VRRP Master (primary virtual router).

Router B Same priority as A but lower IP address

Router C Lower priority (80)

Router D Lowest priority (70)

VRRP Election Rule:

Highest Priority → Highest IP (tie-breaker)

Default priority = 100, so always check:

Who changed priority?

If equal → compare interface IPs