Practice Free 350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Exam Questions Answers With Explanation

The correct answer is A. It encapsulates IP packets from non-LISP sites with a LISP header.

In Cisco LISP, a PITR (Proxy Ingress Tunnel Router) provides connectivity between non-LISP sites and LISP sites. Cisco documentation states that a PITR performs ITR mapping database lookups and LISP encapsulation functions on behalf of non-LISP-capable sites. Cisco also explains that the PITR attracts traffic from non-LISP sites that is destined for LISP EID space, then encapsulates and forwards that traffic to LISP sites.

That is exactly what option A describes.

A PITR acts like an ingress tunnel router for non-LISP sources. When traffic comes from a non-LISP site toward a LISP destination, the PITR:

receives the traffic,

performs the mapping lookup,

adds the LISP header,

and forwards the encapsulated packet toward the correct LISP site.

B. It accepts registration requests and aggregates successfully registered EID prefixes to client ITRs. This describes the role of a Map Server (MS), not a PITR. Cisco states that the MS receives registrations from ETRs and advertises aggregates for registered EID prefixes into the mapping system.

C. It is responsible for publishing the site EID-to-RLOC mappings. This is also associated with the Map Server / mapping system, not the PITR. The PITR uses mappings for encapsulation; it does not publish them.

D. It forwards encapsulated messages to the MS to the authoritative ITR for the EID. This is incorrect terminology and mismatched function. Cisco explains that a Map Resolver (MR) accepts encapsulated Map-Request messages from ITRs and forwards them toward the appropriate Map Server or authoritative ETR, not an authoritative ITR.

ENCOR exam point:

Remember these LISP roles clearly:

ITR = encapsulates traffic toward LISP sites

ETR = decapsulates traffic arriving at LISP sites

PITR = performs ITR function for non-LISP to LISP traffic

MS/MR = mapping-system control-plane components

Agent-Based: A, C

Agentless: B

Puppet and SaltStack are generally categorized as agent-based automation tools because they normally rely on managed nodes running a local agent or minion process. Puppet uses agents on managed systems to receive catalogs from the Puppet master/server and enforce the desired state. SaltStack commonly uses a Salt master and Salt minions, where the minion runs on the managed node and receives commands or state instructions. Ansible is agentless because it does not require a resident agent on managed devices or servers. Instead, Ansible connects using standard remote access mechanisms such as SSH for Linux/Unix systems, WinRM for Windows, and network-specific connection plugins for network devices. In ENCOR automation topics, this distinction matters because agentless tools reduce endpoint installation overhead, while agent-based systems can provide persistent state enforcement and event-driven control. For Cisco network automation, Ansible is frequently tested as an agentless automation tool using playbooks and modules. References/topics: ENCOR Automation, orchestration tools, Ansible, Puppet, SaltStack, agent-based versus agentless automation.

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane ? Secure communication between controllers and edge devices

Data Plane ? Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane ? TLS / DTLS

Data Plane ? IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

In Cisco SD-Access, the fabric roles are clearly separated. The fabric edge node connects endpoints to the fabric and encapsulates user traffic into VXLAN. The control plane node runs the LISP control-plane function and maintains the endpoint ID to routing locator mapping database. That makes option C correct. The border node connects the SD-Access fabric to external networks, such as the data center, WAN, internet edge, or shared services. Therefore, the border node is required when fabric endpoints must communicate with nonfabric resources, which makes option B correct. Option A is wrong because the full endpoint mapping database belongs to the control plane node, not the border node. Option D is wrong because endpoints connect to fabric edge nodes, not normally to border nodes. Option E is also wrong because the control plane node is not in the data-forwarding path for normal user traffic; it resolves mappings. Data traffic flows through the fabric using VXLAN encapsulation after control-plane resolution. References/topics: ENCOR Architecture, Cisco SD-Access, fabric edge node, fabric border node, control plane node, LISP, VXLAN.

The correct answer is A. aaa authorization exec default group radius if-authenticated.

The key part of this question is the phrase “when all the RADIUS servers are unreachable” and “if the user has successfully authenticated.” In Cisco AAA, the if-authenticated keyword means that if the authorization server cannot be reached, the device grants authorization as long as the user has already been authenticated successfully. Cisco documentation explicitly states that with:

aaa authorization exec default group radius if-authenticated

the device contacts the RADIUS server for EXEC authorization, and if an error occurs contacting the server, the fallback is to permit the CLI to start, provided the user has been properly authenticated.

The current config already has:

aaa authentication login default group radius local

So, if RADIUS is down, login can fall back to the local user database.

Adding:

aaa authorization exec default group radius if-authenticated

ensures that once the user is authenticated, authorization is permitted even if RADIUS is unreachable. This is the Cisco-supported fallback behavior for AAA authorization.

B. aaa authorization exec default group radius none The none method means no authorization is performed if the previous method fails, but this is not the Cisco ENCOR-recommended method for allowing access after successful authentication. The question specifically targets the if-authenticated authorization fallback behavior.

C. aaa authorization exec default group radius This attempts authorization through RADIUS only. If the RADIUS servers are unreachable, authorization fails and the administrator may not be able to proceed.

D. aaa authentication login default group radius local none This is an authentication command, not an authorization command, so it does not solve the requirement to authorize commands after login.

ENCOR exam point:

Remember the difference:

Authentication = verifies identity

Authorization = determines what the user is allowed to do

For Cisco AAA fallback behavior:

local is commonly used for authentication fallback

if-authenticated is the key keyword for authorization fallback when the AAA server is unreachable

The status code shown in the exhibit is HTTP 403, which means the server understood the request but refused to authorize it. This is different from a missing resource, unreachable server, or state conflict. Option D is correct because a 403 Forbidden response indicates that access was denied due to authorization, permission, policy, or authentication-context restrictions. Option A describes a 410 Gone condition, where the resource is no longer available. Option B is not represented by a 403; unreachable resources normally produce network errors, timeouts, DNS issues, or gateway-level errors. Option C aligns more closely with HTTP 409 Conflict, which indicates the request conflicts with the current state of the resource. In API troubleshooting, reading the response code accurately matters. 401 usually means authentication is required or failed, while 403 means the client is recognized or the request is understood, but access is not allowed. The ENCOR automation focus is interpreting REST API status codes correctly during controller, network assurance, and programmability workflows. References/topics: ENCOR Automation, REST APIs, HTTP response codes, API authorization, 403 Forbidden, controller API troubleshooting.

The script uses a NETCONF filter that targets the native Cisco IOS XE model and specifically filters the running configuration under interface - > GigabitEthernet - > name 1. The command shown in the script is m.get_config( ' running ' , interface_filter), followed by print(result). get_config is a read operation; it retrieves configuration data from the selected datastore, in this case the running datastore. It does not modify the device. Therefore, the result is printed XML output corresponding to the running configuration of GigabitEthernet 1 on the connected device. Option B is wrong because the script does not call edit_config, does not submit a configuration payload, and does not configure an IP address. Option C is wrong because NETCONF does not open an interactive CLI configuration mode. Option D is too broad and uses the wrong IP/network wording; the filter narrows the request to GigabitEthernet 1 rather than retrieving the full running configuration. This is a model-driven programmability question. References/topics: ENCOR Automation, NETCONF, YANG, ncclient, get_config, XML filters, Cisco IOS XE native model.

A ? 3

B ? 1

C ? 2

D ? 4

YANG models describe configuration and operational state data in a structured tree. A leaf represents a single simple value, such as a string, integer, boolean, or enumeration, so it maps to “contains simple data like an integer or a string.” A leaf-list represents a sequence of leaf values of the same type, so it maps to the array-style definition. A container is an interior node in the YANG schema tree. It does not itself hold a scalar value; instead, it contains child nodes and organizes related data. A list represents a set of repeated entries and is used to group related child nodes into list entries, commonly identified by a key. The important distinction is that a leaf has no child nodes, while containers and lists organize structured data below them. In ENCOR automation, YANG is critical because protocols such as NETCONF and RESTCONF use YANG models to define valid configuration and operational data paths. References/topics: ENCOR Automation, YANG data models, NETCONF, RESTCONF, leaf, leaf-list, container, list, model-driven programmability.

The correct configuration is option D because Cisco AAA method lists are processed from left to right. The existing configuration uses the default login and exec authorization method lists with only the TACACS+ group. That means if the TACACS+ server is unreachable, authentication and authorization fail unless another method is explicitly listed after the TACACS+ group. Adding local after group tacacs+ creates a fallback sequence: try TACACS+ first; if no TACACS+ response is available, use the local user database. Option C is wrong because it replaces TACACS+ with local authentication only, removing centralized AAA as the preferred method. Option B creates a named method list called FALLBACK, but it does not apply to the default login or exec process shown in the running configuration. Option A is not valid Cisco IOS AAA syntax for this requirement. This is a device-management security question focused on resilient AAA design. References/topics: ENCOR Infrastructure Security, AAA, TACACS+, local fallback, device administration, authorization method lists.

The correct answer is A. client.

In Cisco 802.1X / network admission control terminology, the supplicant is the endpoint device or client software requesting access to the network. Cisco documentation describes 802.1X as a client-server access control model in which the client must be authenticated before gaining ac cess, and the network device relays authentication messages between the supplicant and the authentication server.

Client = Supplicant

SW1 = Authenticator

RADIUS server = Authentication server

R1 = transit/network infrastructure device, not the supplicant

The supplicant is the device that is trying to join the network and provide credentials. In the diagram, that is the client. Cisco also defines the three 802.1X entities as supplicant system, authentication system, and authentication server system, with the supplicant being the endpoint such as a PC.

B. SW1 SW1 functions as the authenticator, controlling access to the network port and relaying EAP messages.

C. RADIUS server The RADIUS server is the authentication server, not the supplicant.

D. R1 R1 is part of the network path in the figure, but it is not the device requesting admission to the network.

ENCOR exam point:

For 802.1X / NAC questions, remember this trio:

Supplicant = endpoint/client

Authenticator = switch or AP controlling access

Authentication server = RADIUS / Cisco ISE

Next-generation firewalls extend traditional firewall behavior by adding deeper traffic inspection and application-level intelligence. Packet filtering, stateful inspection, and VPN support existed before NGFWs and are not unique to them. Traditional firewalls can permit or deny traffic based on source IP, destination IP, protocol, port, and connection state. NGFWs add the ability to inspect application payloads more deeply, identify applications even when they use nonstandard ports, apply policy based on application identity, detect threats inside permitted sessions, and integrate IPS or malware inspection. Therefore, deep packet inspection and application awareness are the best answers. Deep packet inspection allows the firewall to examine packet contents beyond simple Layer 3 and Layer 4 headers. Application awareness allows policy to distinguish, for example, legitimate HTTPS business traffic from risky file-sharing, tunneling, or unauthorized application traffic over the same port. VPN is useful but not unique to NGFWs. Stateful inspection is also a core feature of earlier stateful firewalls. References/topics: ENCOR Security, next-generation firewall, application visibility, deep packet inspection, IPS, advanced threat protection.

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

Copy run start

Verification:

OR

Solution:

VERIFICATION: -

OR

Solution:

R2

R3

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

Copy run start

Verification:

OR

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:-

Copy run start

Solution: -

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR