350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Question and Answers

A next-generation firewall protects against more than basic IP, port, and protocol violations. Its key value is application visibility and control. In a data center, an NGFW can identify applications regardless of port, inspect application behavior, enforce policy based on application identity, and block malicious or risky applications that traditional firewalls may allow if they use permitted ports such as TCP 80 or 443. Therefore, option D is the best answer. DDoS protection is usually handled by dedicated DDoS mitigation systems, upstream scrubbing services, rate limiting, or cloud-based DDoS protection rather than being the defining function of a data center NGFW. Unauthorized analyzers and rogue APs are not the primary threat categories addressed by a data center NGFW; rogue AP detection is more aligned with wireless security and WIPS/WIDS. The key ENCOR concept is that NGFWs add application awareness, user/context-based policy, intrusion prevention, malware inspection, and advanced threat defense to traditional stateful firewalling. References/topics: ENCOR Security, Cisco Threat Defense, next-generation firewall, application control, malware prevention, data center security.

The correct answer is C. no username and only the password " cisco123 " .

aaa authentication login group1 group radius line

This means:

Try RADIUS authentication first

If RADIUS fails/unreachable → fallback to line authentication

line con 0

password 0 cisco123

login authentication group1

Because RADIUS servers are not reachable, the router falls back to: → line authentication

When using line authentication, the router uses:

The configured line password

No username is required

Thus, login will prompt only for a password:

Password: cisco123

A. username " cisco " password " cisco " This uses the local user database, but local is NOT configured as fallback in group1.

B. password " test123 " This password is configured under VTY lines, not the console.

D. username " cisco " password " cisco123 " Combines local username with console password, but AAA fallback is to line, not local.

AAA authentication order matters:

group radius line → fallback is line password

group radius local → fallback is local username/password

Console + RADIUS down → uses line password only

access-list-sec-rule, deny, ip, dst-any

Priority 1: D

Priority 2: E

Priority 3: C

Priority 4: F

Cisco AAA method lists are processed from left to right. The command aaa authentication login default group ACE group AAA_RADIUS local-case defines the default login authentication sequence. The first method is the named AAA server group ACE, so the first priority is the AAA servers of the ACE group. If those servers do not respond or cannot authenticate the user, IOS tries the next method, which is the named AAA server group AAA_RADIUS. If that also fails, the router uses local-case, which checks the local username database with case-sensitive username matching. This is different from the normal local method, which does not enforce case-sensitive username comparison in the same way. If none of the configured methods succeeds, authentication fails and login is denied. The TACACS-specific option is not selected because the shown command uses a named AAA server group, not the literal group tacacs+ keyword. The non-case-sensitive local method is also not selected because the command explicitly uses local-case. References/topics: ENCOR Infrastructure Security, AAA method lists, login authentication, named server groups, local-case fallback behavior.

The correct answer is C. aaa authentication login default group tacacs+ none.

Cisco AAA authentication uses a method list, where methods are tried in order. The keyword none is critical here.

group tacacs+ → First attempt authentication using TACACS+ servers

none → If TACACS+ servers are unreachable, no authentication is required (access is granted)

aaa authentication login default group tacacs+ none

This configuration:

Tries TACACS+ authentication first

If TACACS+ is unavailable → falls back to no authentication, allowing login without credentials

This exactly satisfies the requirement.

A. aaa authentication login telnet group tacacs+ none ❌ Uses a named method list ( telnet ) ❌ Not applied to VTY lines unless explicitly configured ( login authentication telnet )

B. aaa authentication login default group tacacs+ ❌ No fallback method ❌ If TACACS fails → login is denied

D. aaa authentication login VTY group tacacs+ none ❌ Named method list ( VTY ) ❌ Must be explicitly applied under VTY lines ( login authentication VTY )

AAA fallback keywords:

local → fallback to local username/password

none → no authentication required (open access)

Important Pattern:

aaa authentication login default group tacacs+ none

= TACACS first → allow access if server is unreachable

The correct command is login under line con 0. In classic Cisco IOS line authentication, setting a line password alone is not enough; the login command tells IOS to prompt for and validate the configured line password. The exhibit shows console line configuration with a password configured, and AAA is not enabled. Therefore, line con 0 followed by login enables console password checking using only the line password. Option A only disables console session timeout by setting the exec timeout to zero; it does not enable authentication. Option C, login local, tells IOS to authenticate against the local username database, which requires a username and password, not only the line password. Option D applies the setting to VTY lines, which control remote Telnet/SSH access, not the physical console line. This is a fundamental device-hardening and management-plane access-control concept. For ENCOR, candidates must distinguish line passwords, local username authentication, AAA authentication, console lines, and VTY lines. References/topics: ENCOR Infrastructure Security, console access, line password, login, login local, local authentication, device administration.

The correct answers are B. Southbound API is based on NETCONF and XML and E. Northbound API is RESTful, using JSON.

In Cisco Catalyst SD-WAN, vManage interacts in two directions:

Northbound APIs are used by external applications to communicate with vManage. These APIs are RESTful and commonly use JSON payloads.

Southbound communication from vManage toward the SD-WAN devices uses NETCONF with XML encoding for configuration exchange.

The southbound API between vManage and managed devices is based on NETCONF/XML, which is used for device configuration and management communication.

The northbound API exposed by vManage is RESTful and uses JSON, which is the standard method for external tools and applications to integrate with Cisco SD-WAN Manager.

A. Southbound API is based on OMP and DTLS. OMP and DTLS are used in the SD-WAN control plane, not as the vManage southbound API format.

C. Northbound API is based on RESTCONF and JSON. vManage northbound integration is typically described as RESTful API using JSON, not specifically RESTCONF.

D. Southbound API is based on RESTCONF and JSON. This is incorrect because the southbound side is NETCONF/XML, not RESTCONF/JSON.

ENCOR exam point:

For Cisco SD-WAN Manager APIs, remember:

Northbound = RESTful + JSON

Southbound = NETCONF + XML

The correct answer is D. The WLC configuration maps user data ToS level priorities to IP precedence levels.

The exhibit shows the QoS Map feature enabled on the WLC and, under Up Stream, the option UP to DSCP Map is selected.

This means the controller is taking 802.1p User Priority (UP) values and mapping them to DSCP values for upstream traffic. Since 802.1p is a Layer 2 priority marking and DSCP/IP precedence are Layer 3 QoS markings in the IP header, the WLC is performing a priority-marking translation from user priority into IP QoS markings.

In ENCOR terms:

802.1p UP = Layer 2 Class of Service marking

DSCP / IP precedence = Layer 3 QoS marking

The WLC is configured to map UP values to DSCP values

A. The WLC configuration prioritizes traffic based on access group assignment. This is unrelated to the exhibit. QoS mapping here is based on 802.1p UP values, not access group assignment.

B. The WLC uses the Platinum, Gold, Silver, and Bronze levels for traffic classification based on priority. Those are older WLAN QoS profile names, but the exhibit is specifically showing UP-to-DSCP mapping, not profile-based classification.

C. The WLC configuration inherits DSCP values from an upstream AP. This would align with Trust DSCP Upstream, but that option is not selected in the exhibit.

For wireless QoS questions, remember these mappings:

802.1p / CoS / UP = Layer 2 priority

DSCP / IP precedence = Layer 3 priority

If UP to DSCP Map is selected, the controller is converting Layer 2 priority markings into Layer 3 QoS markings.

The correct answer is D. It provides isolation among the virtual networks and independence from the physical network.

Cisco SD-Access is based on two main layers:

Underlay network → Physical infrastructure (routers, switches, IP connectivity)

Overlay network → Virtualized logical network built on top of the underlay

According to Cisco ENCOR architecture principles, the overlay network:

Uses technologies like LISP (control plane) and VXLAN (data plane)

Creates virtual networks (VNs) for segmentation

Provides end-to-end logical separation (macro-segmentation)

Is independent of the physical topology

Enables scalable and flexible network design

Thus, the overlay abstracts the complexity of the underlay and ensures isolation between different user groups, departments, or tenants.

Directly describes virtual network segmentation

Matches Cisco’s definition of overlay abstraction and independence

Core principle of SD-Access fabric design

A. Multicast and Layer 2 flooding relate more to underlay or legacy designs, not overlay behavior.

B. Describes the underlay network (physical devices), not overlay.

C. Refers to traditional network design, which SD-Access replaces.

Underlay = Physical IP network (reachability)

Overlay = Virtual segmentation & policy (VXLAN + LISP)

Overlay = Abstraction + Segmentation + Independence

The correct answer is C. The data plane is based on VXLAN.

In Cisco SD-Access, the fabric uses:

LISP for the control plane

VXLAN for the data plane

Cisco TrustSec / SGT-based policy for the policy plane

Cisco documentation explicitly states that SD-Access uses a LISP-based control plane and a VXLAN-based data plane.

VXLAN is the encapsulation technology used to transport user traffic across the SD-Access fabric overlay. This is why the data plane in Cisco SD-Access is based on VXLAN.

A. Dynamic routing is used to discover and provision border and edge switches. Dynamic routing may exist in the underlay, but it is not what “discovers and provisions” border and edge nodes in SD-Access. Provisioning is handled through Cisco DNA Center / Cisco Catalyst Center, not by dynamic routing itself.

B. The control plane is based on VXLAN. This is incorrect because the control plane in SD-Access is based on LISP, not VXLAN.

D. GRE is used as the policy plane. This is incorrect because the policy plane in SD-Access is based on TrustSec/SGT-based policy, not GRE.

ENCOR exam point:

Memorize this SD-Access mapping:

Control plane = LISP

Data plane = VXLAN

Policy plane = Cisco TrustSec / SGT

Chef: A, B

SaltStack: C, D

Chef is commonly associated with Ruby-based configuration management. Chef recipes and cookbooks are written using a Ruby-based domain-specific language, and the tool describes desired infrastructure state in a declarative manner. Therefore, “declarative” and “uses Ruby” map to Chef. SaltStack is written primarily in Python and is commonly described as more procedural and execution-oriented than purely declarative tools. Salt states can define desired configuration, but Salt is also known for remote execution, event-driven automation, and procedural orchestration workflows. Therefore, “uses Python” and “procedural” map to SaltStack. In ENCOR automation, the objective is not to become a Chef or SaltStack developer, but to recognize major automation/orchestration tools and their characteristics. Cisco exams commonly compare Ansible, Puppet, Chef, and SaltStack by language, agent model, execution method, and configuration style. Chef is Ruby/cookbook/recipe oriented; SaltStack is Python/minion/remote-execution oriented. References/topics: ENCOR Automation, orchestration platforms, Chef, SaltStack, declarative versus procedural automation, Ruby, Python.

The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate → authentication-key → trusted-key

If any of these three are missing, authentication will not work properly.

In Locator/ID Separation Protocol, the ingress tunnel router is responsible for encapsulating traffic from an endpoint identifier toward the correct routing locator. When the ITR does not already have an EID-to-RLOC mapping in its local map cache, it must request that mapping through the LISP control plane. The component that receives map requests from ITRs is the Map Resolver. Therefore, option A is correct. A routing locator is not a query target; it is the routable address representing the location of an EID in the underlay or routing infrastructure. A proxy ingress tunnel router is used to connect non-LISP sites toward LISP sites by acting on behalf of non-LISP sources. A proxy egress tunnel router provides reachability in the reverse direction, helping LISP sites communicate with non-LISP destinations. Neither PITR nor PETR is the normal answer to an ITR mapping-resolution request. The core ENCOR point is the separation between endpoint identity and routing location, with map resolution handled by the LISP control plane. References/topics: ENCOR Architecture, LISP, ITR, Map Resolver, EID-to-RLOC mapping, SD-Access control plane concepts.

Solution: -

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

Copy run start

Verification:

OR

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

Copy run start

Verification:

OR

Solution:

R2

R3

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:-

Copy run start

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

VERIFICATION: -

OR

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0