350-401 Sample Questions Answers

The inside user subnet is 192.168.1.0/24, which supports 254 usable host addresses. The configured NAT pool only provides addresses from 10.10.10.1 through 10.10.10.100, giving 100 usable translated addresses. Dynamic NAT without overload requires a sufficient number of inside global addresses if all users must be translated at the same time. Therefore, to support all users continuously, the NAT pool must be increased to support the 254 usable inside hosts. Option C is the best answer. Option A, match-host, is not the correct fix for the pool-size shortage; it is used for host-number matching behavior and still requires a usable pool design. Option B is wrong because NAT should translate private inside addresses to a different inside global address range, not reuse the same inside local subnet. Option D describes static one-to-one behavior and does not match the dynamic NAT route-map configuration shown. The key technical issue is address pool capacity. References/topics: ENCOR Infrastructure, NAT, dynamic NAT, inside local and inside global addresses, NAT pools, route-map-based NAT.

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

Copy run start

Verification:

OR

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

access-list-sec-rule, deny, ip, dst-any

The correct answer is A. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be honored.

The exhibit shows:

class-map match-any dscp-1

match ip dscp 1

policy-map set-dscp-63

class dscp-1

set dscp 63

interface GigabitEthernet0/0/0

mls qos trust dscp

service-policy input set-dscp-63

The class map matches packets with DSCP value 1:

match ip dscp 1

The policy map then changes the DSCP marking of those matched packets to 63:

set dscp 63

The policy is applied in the input direction on interface Gig0/0/0:

service-policy input set-dscp-63

Also, the interface is configured to trust DSCP:

mls qos trust dscp

That means incoming packets keep their DSCP markings unless a QoS policy explicitly changes them. Since the policy only matches DSCP 1, only that traffic is re-marked to 63. Traffic with other DSCP values is not matched by the policy and therefore remains trusted and unchanged.

Traffic marked with DSCP 1 is matched by the class map.

The policy re-marks that traffic to DSCP 63.

All other DSCP-marked traffic is still trusted and therefore honored.

B. DSCP 1 marked traffic will be ignored and DSCP 63 marked traffic will be honored. Incorrect, because DSCP 1 traffic is not ignored. It is specifically matched and re-marked.

C. None. The service-policy configuration must be applied in the outbound direction. Incorrect, because QoS marking policies can be applied in the input direction, and this configuration is valid.

D. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be ignored. Incorrect, because other DSCP values are not ignored. They are trusted due to mls qos trust dscp .

When you see:

mls qos trust dscp → preserve incoming DSCP markings

service-policy input with set dscp → re-mark only the traffic matched by the policy

So here the result is:

DSCP 1 → changed to 63

All other DSCP values → trusted and left unchanged

A traditional WAN does not rely on the same overlay, controller-based policy distribution, tunnel encapsulation, or centralized abstraction model used by SD-WAN. Because of that, one valid benefit is lower data plane overhead. SD-WAN commonly adds encapsulation, encryption, tunnel metadata, and policy-based forwarding logic across WAN edge devices, which creates additional processing and packet overhead compared with a more direct traditional WAN path. The second benefit is lower control plane abstraction. Traditional WAN routing is usually built directly with protocols such as OSPF, EIGRP, BGP, static routing, MPLS VPN routing, or other conventional mechanisms. That makes the control-plane operation less abstracted than SD-WAN, where controllers calculate, distribute, and enforce policies across WAN edges. Options A, C, and E are stronger SD-WAN benefits. SD-WAN is designed to standardize policy, simplify operational management through centralized control, and improve application-aware path selection or failover. Traditional WAN can be simpler in small environments, but it does not inherently provide comprehensive standardization or faster fault detection. References/topics: ENCOR Architecture, WAN design, SD-WAN overlay, control plane abstraction, data plane encapsulation overhead.

Solution:

VERIFICATION: -

OR

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

The correct answer is A. aaa authorization exec default group radius if-authenticated.

The key part of this question is the phrase “when all the RADIUS servers are unreachable” and “if the user has successfully authenticated.” In Cisco AAA, the if-authenticated keyword means that if the authorization server cannot be reached, the device grants authorization as long as the user has already been authenticated successfully. Cisco documentation explicitly states that with:

aaa authorization exec default group radius if-authenticated

the device contacts the RADIUS server for EXEC authorization, and if an error occurs contacting the server, the fallback is to permit the CLI to start, provided the user has been properly authenticated.

The current config already has:

aaa authentication login default group radius local

So, if RADIUS is down, login can fall back to the local user database.

Adding:

aaa authorization exec default group radius if-authenticated

ensures that once the user is authenticated, authorization is permitted even if RADIUS is unreachable. This is the Cisco-supported fallback behavior for AAA authorization.

B. aaa authorization exec default group radius none The none method means no authorization is performed if the previous method fails, but this is not the Cisco ENCOR-recommended method for allowing access after successful authentication. The question specifically targets the if-authenticated authorization fallback behavior.

C. aaa authorization exec default group radius This attempts authorization through RADIUS only. If the RADIUS servers are unreachable, authorization fails and the administrator may not be able to proceed.

D. aaa authentication login default group radius local none This is an authentication command, not an authorization command, so it does not solve the requirement to authorize commands after login.

ENCOR exam point:

Remember the difference:

Authentication = verifies identity

Authorization = determines what the user is allowed to do

For Cisco AAA fallback behavior:

local is commonly used for authentication fallback

if-authenticated is the key keyword for authorization fallback when the AAA server is unreachable

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

The correct answer is A. json_final = json.loads(json_data).

When using Python on Cisco devices:

The cli() function returns output as a string

To work with structured data, the string must be converted into a JSON object (Python dictionary)

The exhibit shows:

json_data = cli(cmd)

json_final = json.import(json_data)

This is incorrect because:

json.import() is not a valid Python function

The script fails to convert the JSON string into a Python object

json_final = json.loads(json_data)

json.loads() parses a JSON-formatted string

Converts it into a Python dictionary

Enables access using keys like:

json_final[ " TABLE_intf " ][ " ROW_intf " ][0] [ " prefix " ]

B. This line assumes the JSON is already converted into an object. It does not fix the conversion issue.

C. Incorrect syntax and unnecessary; json is already imported properly.

D. Just defines a command string; does not address JSON conversion.

Always remember the difference:

json.loads() → String → Python object

json.dumps() → Python object → String

Correct Automation Workflow:

Run CLI command

Capture output (string)

Convert using json.loads()

Parse using dictionary keys

This is a core concept for Cisco automation questions in the ENCOR exam.

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution: -

Solution:-

Copy run start

Solution:

Copy run start

Verification:

OR

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R2

R3

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

Solution on R1:

R1# copy run start

Verification:

OR