350-401 Sample Questions Answers

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

Copy run start

Verification:

OR

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

Copy run start

Verification:

OR

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:-

Copy run start

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution: -

Solution:

R2

R3

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Agent-Based: A, C

Agentless: B

Puppet and SaltStack are generally categorized as agent-based automation tools because they normally rely on managed nodes running a local agent or minion process. Puppet uses agents on managed systems to receive catalogs from the Puppet master/server and enforce the desired state. SaltStack commonly uses a Salt master and Salt minions, where the minion runs on the managed node and receives commands or state instructions. Ansible is agentless because it does not require a resident agent on managed devices or servers. Instead, Ansible connects using standard remote access mechanisms such as SSH for Linux/Unix systems, WinRM for Windows, and network-specific connection plugins for network devices. In ENCOR automation topics, this distinction matters because agentless tools reduce endpoint installation overhead, while agent-based systems can provide persistent state enforcement and event-driven control. For Cisco network automation, Ansible is frequently tested as an agentless automation tool using playbooks and modules. References/topics: ENCOR Automation, orchestration tools, Ansible, Puppet, SaltStack, agent-based versus agentless automation.

Solution:

VERIFICATION: -

OR

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

The correct answer is A. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be honored.

The exhibit shows:

class-map match-any dscp-1

match ip dscp 1

policy-map set-dscp-63

class dscp-1

set dscp 63

interface GigabitEthernet0/0/0

mls qos trust dscp

service-policy input set-dscp-63

The class map matches packets with DSCP value 1:

match ip dscp 1

The policy map then changes the DSCP marking of those matched packets to 63:

set dscp 63

The policy is applied in the input direction on interface Gig0/0/0:

service-policy input set-dscp-63

Also, the interface is configured to trust DSCP:

mls qos trust dscp

That means incoming packets keep their DSCP markings unless a QoS policy explicitly changes them. Since the policy only matches DSCP 1, only that traffic is re-marked to 63. Traffic with other DSCP values is not matched by the policy and therefore remains trusted and unchanged.

Traffic marked with DSCP 1 is matched by the class map.

The policy re-marks that traffic to DSCP 63.

All other DSCP-marked traffic is still trusted and therefore honored.

B. DSCP 1 marked traffic will be ignored and DSCP 63 marked traffic will be honored. Incorrect, because DSCP 1 traffic is not ignored. It is specifically matched and re-marked.

C. None. The service-policy configuration must be applied in the outbound direction. Incorrect, because QoS marking policies can be applied in the input direction, and this configuration is valid.

D. DSCP 1 marked traffic will be re-marked to 63 and all other DSCP values will be ignored. Incorrect, because other DSCP values are not ignored. They are trusted due to mls qos trust dscp .

When you see:

mls qos trust dscp → preserve incoming DSCP markings

service-policy input with set dscp → re-mark only the traffic matched by the policy

So here the result is:

DSCP 1 → changed to 63

All other DSCP values → trusted and left unchanged

The input service policy shown in the exhibit matches traffic with DSCP value 1 and applies a QoS set action to rewrite that marking to DSCP 63. Therefore, packets entering interface Fa7/0/2 with DSCP 1 are remarked to DSCP 63, making option B correct. The second part of the configuration defines a class map matching DSCP 63 and a policy map using bandwidth percent 50. That behavior belongs to class-based queuing/scheduling, where DSCP63-marked traffic is placed into a class that receives a bandwidth allocation. In the given option set, option C best represents this queuing behavior. Option D is wrong because the service policy explicitly changes the DSCP value. Option E is not accurate because classification is not triggered by reaching 50 percent bandwidth; classification occurs by matching packet fields such as DSCP. Option A is less precise than C because the shown policy behavior is class-based queuing with a bandwidth allocation. The important ENCOR concept is the separation between marking on ingress and queuing/scheduling on egress. References/topics: ENCOR Infrastructure, QoS, MQC, class maps, policy maps, DSCP marking, CBWFQ, bandwidth percent.

The status code shown in the exhibit is HTTP 403, which means the server understood the request but refused to authorize it. This is different from a missing resource, unreachable server, or state conflict. Option D is correct because a 403 Forbidden response indicates that access was denied due to authorization, permission, policy, or authentication-context restrictions. Option A describes a 410 Gone condition, where the resource is no longer available. Option B is not represented by a 403; unreachable resources normally produce network errors, timeouts, DNS issues, or gateway-level errors. Option C aligns more closely with HTTP 409 Conflict, which indicates the request conflicts with the current state of the resource. In API troubleshooting, reading the response code accurately matters. 401 usually means authentication is required or failed, while 403 means the client is recognized or the request is understood, but access is not allowed. The ENCOR automation focus is interpreting REST API status codes correctly during controller, network assurance, and programmability workflows. References/topics: ENCOR Automation, REST APIs, HTTP response codes, API authorization, 403 Forbidden, controller API troubleshooting.

The correct command is login under line con 0. In classic Cisco IOS line authentication, setting a line password alone is not enough; the login command tells IOS to prompt for and validate the configured line password. The exhibit shows console line configuration with a password configured, and AAA is not enabled. Therefore, line con 0 followed by login enables console password checking using only the line password. Option A only disables console session timeout by setting the exec timeout to zero; it does not enable authentication. Option C, login local, tells IOS to authenticate against the local username database, which requires a username and password, not only the line password. Option D applies the setting to VTY lines, which control remote Telnet/SSH access, not the physical console line. This is a fundamental device-hardening and management-plane access-control concept. For ENCOR, candidates must distinguish line passwords, local username authentication, AAA authentication, console lines, and VTY lines. References/topics: ENCOR Infrastructure Security, console access, line password, login, login local, local authentication, device administration.

The correct answer is A. aaa authorization exec default group radius if-authenticated.

The key part of this question is the phrase “when all the RADIUS servers are unreachable” and “if the user has successfully authenticated.” In Cisco AAA, the if-authenticated keyword means that if the authorization server cannot be reached, the device grants authorization as long as the user has already been authenticated successfully. Cisco documentation explicitly states that with:

aaa authorization exec default group radius if-authenticated

the device contacts the RADIUS server for EXEC authorization, and if an error occurs contacting the server, the fallback is to permit the CLI to start, provided the user has been properly authenticated.

The current config already has:

aaa authentication login default group radius local

So, if RADIUS is down, login can fall back to the local user database.

Adding:

aaa authorization exec default group radius if-authenticated

ensures that once the user is authenticated, authorization is permitted even if RADIUS is unreachable. This is the Cisco-supported fallback behavior for AAA authorization.

B. aaa authorization exec default group radius none The none method means no authorization is performed if the previous method fails, but this is not the Cisco ENCOR-recommended method for allowing access after successful authentication. The question specifically targets the if-authenticated authorization fallback behavior.

C. aaa authorization exec default group radius This attempts authorization through RADIUS only. If the RADIUS servers are unreachable, authorization fails and the administrator may not be able to proceed.

D. aaa authentication login default group radius local none This is an authentication command, not an authorization command, so it does not solve the requirement to authorize commands after login.

ENCOR exam point:

Remember the difference:

Authentication = verifies identity

Authorization = determines what the user is allowed to do

For Cisco AAA fallback behavior:

local is commonly used for authentication fallback

if-authenticated is the key keyword for authorization fallback when the AAA server is unreachable

A REST API request that lacks required authentication information is rejected by the server before the requested operation is executed. REST APIs commonly use HTTP status codes to communicate request success or failure. When authentication credentials, API tokens, session cookies, or authorization headers are missing or invalid, the server normally returns a client-error response in the 4xx range. Common examples include 401 Unauthorized, meaning authentication is required or failed, and 403 Forbidden, meaning the server understood the request but refuses access because the requester lacks permission. The server does not authenticate based only on source IP unless a separate IP-based access-control mechanism has been deliberately configured, so option A is not generally correct. The server also does not normally keep the HTTP transaction open indefinitely waiting for credentials, so option B is wrong. Option C is dangerous and wrong: APIs should not downgrade unauthenticated requests into guest execution unless an endpoint is intentionally public. In ENCOR automation, REST API security requires explicit authentication and authorization, usually over HTTPS/TLS. References/topics: ENCOR Automation, REST APIs, HTTP status codes, API authentication, tokens, Cisco Catalyst Center API behavior.

The correct configuration is option D because Cisco AAA method lists are processed from left to right. The existing configuration uses the default login and exec authorization method lists with only the TACACS+ group. That means if the TACACS+ server is unreachable, authentication and authorization fail unless another method is explicitly listed after the TACACS+ group. Adding local after group tacacs+ creates a fallback sequence: try TACACS+ first; if no TACACS+ response is available, use the local user database. Option C is wrong because it replaces TACACS+ with local authentication only, removing centralized AAA as the preferred method. Option B creates a named method list called FALLBACK, but it does not apply to the default login or exec process shown in the running configuration. Option A is not valid Cisco IOS AAA syntax for this requirement. This is a device-management security question focused on resilient AAA design. References/topics: ENCOR Infrastructure Security, AAA, TACACS+, local fallback, device administration, authorization method lists.

Blank 1: event manager

Blank 2: applet

Blank 3: event syslog

Blank 4: pattern

Blank 5: mail server

The correct EEM structure begins with event manager applet Enable_Interface_And_Alert. This creates the Embedded Event Manager policy and names the applet. The trigger must detect a syslog message indicating that GigabitEthernet0/1 changed state to administratively down, so the event line must use event syslog pattern " Interface GigabitEthernet0/1, changed state to administratively down " . After the trigger occurs, the configured CLI actions enter enable mode, move into configuration mode, select the interface, issue no shutdown, and exit configuration mode. The final action sends an email alert. Cisco EEM mail syntax uses mail server followed by the SMTP server and mail parameters such as recipient, sender, subject, and body. The snippets must therefore form valid IOS EEM syntax, not just logical statements. This is an automation and operational-notification task: EEM reacts to a device event and performs corrective action while also communicating the incident. References/topics: ENCOR Automation, Embedded Event Manager, syslog event triggers, CLI action applets, operational alerting, SMTP notification.

top down - while true, file.open(), except, file = open, file.close()

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

The script uses a NETCONF filter that targets the native Cisco IOS XE model and specifically filters the running configuration under interface - > GigabitEthernet - > name 1. The command shown in the script is m.get_config( ' running ' , interface_filter), followed by print(result). get_config is a read operation; it retrieves configuration data from the selected datastore, in this case the running datastore. It does not modify the device. Therefore, the result is printed XML output corresponding to the running configuration of GigabitEthernet 1 on the connected device. Option B is wrong because the script does not call edit_config, does not submit a configuration payload, and does not configure an IP address. Option C is wrong because NETCONF does not open an interactive CLI configuration mode. Option D is too broad and uses the wrong IP/network wording; the filter narrows the request to GigabitEthernet 1 rather than retrieving the full running configuration. This is a model-driven programmability question. References/topics: ENCOR Automation, NETCONF, YANG, ncclient, get_config, XML filters, Cisco IOS XE native model.