350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) Questions and Answers

The Python library commonly used for NETCONF automation is ncclient. NETCONF is an XML-based network management protocol that uses YANG data models to structure configuration and operational state. The ncclient library provides Python functions for connecting to NETCONF-capable devices, opening a manager session, issuing get, get-config, edit-config, and other NETCONF operations, and processing XML responses. Option A is correct. The requests library is commonly used for REST API calls over HTTP or HTTPS, such as RESTCONF or controller northbound APIs, but it is not the standard NETCONF client library. Postman is an API testing application, not a Python library. cURL is a command-line tool for sending HTTP and other protocol requests, not a Python library for NETCONF/YANG workflows. In ENCOR automation, the distinction matters: REST-based APIs often use JSON and HTTP methods, while NETCONF uses XML-based RPC operations over SSH and is commonly automated in Python with ncclient. References/topics: ENCOR Automation, NETCONF, YANG, Python automation, ncclient, model-driven programmability.

A REST API request that lacks required authentication information is rejected by the server before the requested operation is executed. REST APIs commonly use HTTP status codes to communicate request success or failure. When authentication credentials, API tokens, session cookies, or authorization headers are missing or invalid, the server normally returns a client-error response in the 4xx range. Common examples include 401 Unauthorized, meaning authentication is required or failed, and 403 Forbidden, meaning the server understood the request but refuses access because the requester lacks permission. The server does not authenticate based only on source IP unless a separate IP-based access-control mechanism has been deliberately configured, so option A is not generally correct. The server also does not normally keep the HTTP transaction open indefinitely waiting for credentials, so option B is wrong. Option C is dangerous and wrong: APIs should not downgrade unauthenticated requests into guest execution unless an endpoint is intentionally public. In ENCOR automation, REST API security requires explicit authentication and authorization, usually over HTTPS/TLS. References/topics: ENCOR Automation, REST APIs, HTTP status codes, API authentication, tokens, Cisco Catalyst Center API behavior.

Agent-Based: A, C

Agentless: B

Puppet and SaltStack are generally categorized as agent-based automation tools because they normally rely on managed nodes running a local agent or minion process. Puppet uses agents on managed systems to receive catalogs from the Puppet master/server and enforce the desired state. SaltStack commonly uses a Salt master and Salt minions, where the minion runs on the managed node and receives commands or state instructions. Ansible is agentless because it does not require a resident agent on managed devices or servers. Instead, Ansible connects using standard remote access mechanisms such as SSH for Linux/Unix systems, WinRM for Windows, and network-specific connection plugins for network devices. In ENCOR automation topics, this distinction matters because agentless tools reduce endpoint installation overhead, while agent-based systems can provide persistent state enforcement and event-driven control. For Cisco network automation, Ansible is frequently tested as an agentless automation tool using playbooks and modules. References/topics: ENCOR Automation, orchestration tools, Ansible, Puppet, SaltStack, agent-based versus agentless automation.

The correct answer is D.

Cisco campus design guidance explains that a nonlooped topology with unique VLANs per access switch improves stability and convergence compared with looped Layer 2 designs. Cisco states that in a multilayer campus design, each access switch should have unique VLANs, with no Layer 2 loops and no blocked links, which improves convergence behavior. Cisco also notes that VLANs spanning multiple access switches increase flooding impact, while a nonlooped topology with localized VLANs reduces that impact.

A traditional nonlooped design reduces reliance on spanning-tree reconvergence across shared Layer 2 domains. With unique/local VLANs, failures affect a smaller fault domain and convergence is faster than in a looped design with common VLANs stretched across switches. Cisco’s campus design material specifically recommends no Layer 2 loops and unique VLANs per access switch for better operational behavior.

A. Traditional looped design that has common VLANs extended between separate access switches This increases Layer 2 complexity and spanning-tree dependency, which slows convergence compared to a nonlooped design. Cisco documents that VLANs spanning multiple access switches increase flooding impact.

B. Cisco SD-Access configuration between aggregation intermediate nodes and access layers This is not the standard way the question is framed for classic aggregation-to-Layer 2 access convergence in a traditional enterprise campus design. The question is targeting the design principle of looped vs nonlooped Layer 2 access.

C. Cisco SD-Access configuration between aggregation and access-layer edge nodes SD-Access is a different fabric architecture. The question is about reducing convergence time between aggregation and a Layer 2 access layer, which maps to the traditional campus design choice rather than SD-Access node roles.

For enterprise campus design, remember:

Looped Layer 2 + stretched/common VLANs = slower convergence and larger fault domains

Nonlooped Layer 2 + unique/local VLANs per access switch = faster convergence and better stability

The correct answer is A. by providing the external application a token that authorizes access to the account.

In REST APIs, OAuth is used as an authorization framework. Instead of giving the external application the user’s actual username and password, the user or authorization server provides the application with an access token. That token allows the application to access specific resources based on the permissions granted.

This is the main purpose of OAuth:

Authorize access

Use tokens instead of exposing credentials

Allow controlled, limited access to resources

B. as a framework to hide the security information in the REST URL OAuth does not work by hiding information in the URL. It is an authorization framework based on tokens.

C. as a framework to hash the security information in the REST URL OAuth is not a URL-hashing mechanism. Hashing and OAuth are different concepts.

D. by providing the user credentials to the external application This is the opposite of OAuth’s purpose. OAuth is designed so that the external application does not need the user’s credentials.

Remember this difference:

Basic Authentication → sends username/password

OAuth → uses token-based authorization

OAuth = token-based delegated access

1 and 3 – Configuration

4 and 5 – Orchestration

The correct answer is A. Interface FastEthernet0/0 is configured in VRF CUST-A, so the ARP entry is also in that VRF.

In Cisco VRF implementations, ARP entries are maintained separately per VRF, not in the global routing table. Cisco documentation states that with Multi-VRF CE, ARP entries are learned in separate VRFs, and the user can display them for a specific VRF. Cisco also documents the command show ip arp vrf < vrf-name > to display the ARP table for a specified VRF.

That means if the interface belongs to VRF CUST-A, a normal global show ip arp 192.168.12.2 may not display the entry, even though ping vrf CUST-A 192.168.12.2 succeeds. The ARP entry exists, but it is stored under the CUST-A VRF ARP table, not the global ARP table.

B. When VRFs are used, ARP protocol is disabled in the global routing table. This is incorrect. ARP is not disabled; it is simply VRF-aware and tracked separately per VRF.

C. When VRFs are used, ARP protocol must be enabled in each VRF. This is incorrect. There is no separate requirement to manually enable ARP in each VRF for normal operation in this context.

D. The ping command must be executed in the global routing table. This is incorrect because Cisco supports pinging within a specific VRF, and the exhibit already shows the use of ping vrf CUST-A .

ENCOR exam point:

With VRF-aware services, always remember:

Routing table = per VRF

ARP table = per VRF

Verification commands often require the VRF keyword

Solution: -

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

VERIFICATION: -

OR

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:-

Copy run start

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

Copy run start

Verification:

OR

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

Copy run start

Verification:

OR

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr