2025 Valid 350-401 Exam Updates - 2025 Study Guide [Q470-Q494]

2025 Valid 350-401 Exam Updates - 2025 Study Guide

350-401 Certification - The Ultimate Guide [Updated 2025]

Cisco 350-401 (Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)) certification exam is designed to test the knowledge and skills of IT professionals who plan, implement, and manage enterprise networks. 350-401 exam measures the candidate's proficiency in implementing core enterprise network technologies, including dual stack (IPv4 and IPv6) architecture, virtualization, infrastructure, network assurance, security, and automation.

NEW QUESTION # 470
Drag and drop the characteristics from the left onto the infrastructure deployment models on the right.

Answer:

Explanation:

NEW QUESTION # 471
An engineer is describing QoS to a client. Which two facts apply to traffic policing? (Choose two.)

A. Policing drops traffic that exceeds the defined rate
B. Policing adapts to network congestion by queuing excess traffic
C. Policing typically delays the traffic, rather than drops it
D. Policing should be performed as close to the source as possible
E. Policing should be performed as close to the destination as possible

Answer: A,D

Explanation:
Traffic policing propagates bursts. When the traffic rate reaches the configured
maximum rate (or committed information rate), excess traffic is dropped (or
remarked). The result is an output rate that appears as a saw-tooth with crests and
troughs.
Unlike traffic shaping, traffic policing does not cause delay.
Classification (which includes traffic policing, traffic shaping and queuing
techniques) should take place at the network edge. It is recommended that
classification occur as close to the source of the traffic as possible.
Also according to this Cisco link, "policing traffic as close to the source as possible".

NEW QUESTION # 472
Refer to the exhibit. Which action does the Python script accomplish?

A. connects to the device using Telnet and exports the routing table information
B. displays the output of the show command in an unformatted way
C. connects to the device using SSH and exports the routing table information
D. displays the output of the show command in a formatted way

Answer: C

NEW QUESTION # 473
Which requirement for an Ansible-managed node is true?

A. It must have an Ansible Tower installed
B. It must have an SSH server running
C. It must be a Linux server or a Cisco device
D. It must support ad hoc commands.

Answer: C

NEW QUESTION # 474
Reter to the exhibit.

Refer to the exhibit. Which python code parses the response and prints "18:32:21.474 UTC sun Mar 10 2019?

A. print(response[result']['body']['simple_time']}
B. print(response['resut'][0||'simple_time']}
C. print(response['body']['simple_time']}
D. print(response[jresult']['body']['simple_time']}

Answer: A

NEW QUESTION # 475
Which line must be added in the Python function to return the JSON object {"cat_9k": "FXS193202SE")?

A. Option B
B. Option A
C. Option C
D. Option D

Answer: D

NEW QUESTION # 476
Drag and Drop Question
Drag and drop the definitions in the left to their respective Terminology in the right.

Answer:

Explanation:

NEW QUESTION # 477

Refer to the exhibit. Which configuration must be applied to R to enable R to reach the server at 172.16.0.1?
A)

B)

C)

D)

A. Option B
B. Option A
C. Option C
D. Option D

Answer: D

NEW QUESTION # 478
Refer to the exhibit. An engineer is configuring an EtherChannel between Switch1 and Switch2 and notices the console message on switch2. Based on the output, which action resolves this issue?

A. Configure the same port channel interface number on both switches
B. Configure the same EtherChannel protocol on both switches
C. Configure less member ports on Switch2.
D. Configure more member ports on Switch1.

Answer: B

Explanation:
Reference:
In this case, we are using your EtherChannel without a negotiation protocol on Switch2. As a result, if the opposite switch is not also configured for EtherChannel operation on the respective ports, there is a danger of a switching loop. The EtherChannel Misconfiguration Guard tries to prevent that loop from occuring by disabling all the ports bundled in the EtherChannel.

NEW QUESTION # 479
Which two threats does AMP4E have the ability to block? (Choose two.)

A. DDoS
B. ransomware
C. SQL injection
D. Microsoft Word macro attack
E. email phishing

Answer: B,E

NEW QUESTION # 480
Refer to the exhibit.

What is the effect of introducing the sampler feature into the Flexible NetFlow configuration on the router?

A. The resolution of sampling data increases, but it requires more performance from the router.
B. CPU and memory utilization are reduced when compared with what is required for full NetFlow.
C. Every second IPv4 packet is forwarded to the collector for inspection.
D. NetFlow updates to the collector are sent 50% less frequently.

Answer: B

NEW QUESTION # 481
Refer to the exhibit.

Which command must be applied to R2 for an OSPF neighborship to form?

A. network 20.1.1.2 255.255.255 area 0
B. network 20.1.1.2.0.0.0.0 area 0
C. network 20.1.1.2.0.0.255.255 area 0
D. network 20.1.1.2 255.255.0.0. area 0

Answer: B

Explanation:
Explanation
The network 20.0.0.0 0.0.0.255 area 0 command on R2 did not cover the IP address of Fa1/1 interface of R2 so OSPF did not run on this interface. Therefore we have to use the command network 20.1.1.2 0.0.255.255 area 0 to turn on OSPF on this interface.
Note: The command network 20.1.1.2 0.0.255.255 area 0 can be used too so this answer is also correct but answer C is the best answer here.
The network 0.0.0.0 255.255.255.255 area 0 command on R1 will run OSPF on all active

NEW QUESTION # 482
In a Cisco SD-WAN solution, which two functions are performed by OMP? (Choose two.)

A. segmentation and differentiation of traffic
B. configuration of control and data policies
C. advertisement of network prefixes and their attributes
D. gathering of underlay infrastructure data
E. delivery of crypto keys

Answer: B,C

Explanation:
Explanation
OMP is the control protocol that is used to exchange routing, policy, and management information between Cisco vSmart Controllers and Cisco IOS XE SD-WAN devices in the overlay network. These devices automatically initiate OMP peering sessions between themselves, and the two IP end points of the OMP session are the system IP addresses of the two devices.

NEW QUESTION # 483
What is one role of the VTEP in a VXLAN environment?

A. to encapsulate the tunnel
B. to provide EID-to-RLOC mapping
C. to forward packets to non-LISP sites
D. to maintain VLAN configuration consistency

Answer: A

Explanation:
The VTEP, or VXLAN Tunnel Endpoint, plays a crucial role in a VXLAN environment by encapsulating Ethernet frames into VXLAN packets. This encapsulation process allows for the creation of a tunnel over the IP network, enabling the extension of Layer 2 networks over Layer 3 infrastructures2.
References := IP With Ease - Understanding VTEPs and VNIs in VXLAN Environment

NEW QUESTION # 484
Drag and drop the threat defense solutions from the left onto their descriptions on the right.

Answer:

Explanation:

NEW QUESTION # 485

Refer to the exhibit. R1 and R2 are directly connected, but the BGP session does not establish. Which action must be taken to build an eBGP session?

A. Configure ip route 1.1.1.1 0.0.0.0 192.168.12.1 on R2.
B. Configure no neighbor 192.168.12.1 shutdown under R2 BGP process.
C. Configure neighbor 192.168.12.1 activate under R2 BGP process.
D. Configure neighbor 2.2.2.2 remote-as 65002 under R1 BGP process.

Answer: D

Explanation:
To establish an eBGP session between R1 and R2, the correct action is to configure R1 with the neighbor statement that specifies R2's IP address and its autonomous system (AS) number. This is done by using the command neighbor 2.2.2.2 remote-as 65002 under the BGP process on R1. This configuration tells R1 that it should establish a BGP session with a neighbor at IP address 2.2.2.2 which is in AS 65002. References: The Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course provides detailed instructions on configuring BGP sessions in a service provider environment

NEW QUESTION # 486
Drag and Drop Question
Drag and drop the code snippets from the bottom onto the blanks in the script to convert a Python object into a JSON string. Not all options are used.

Answer:

Explanation:

NEW QUESTION # 487
What is the intent API in Cisco Catalyst Center (formerly DNA Center)?

A. westbound interface, which allows the exchange of data such as ITSM. IPAM, and reporting information
B. southbound consumer-facing RESTful API. which enables network discovery and configuration management
C. interface between the controller and the network devices, which enables network discovery and configuration management
D. northbound consumer-facing RESTful API, which enables network discovery and configuration management

Answer: D

NEW QUESTION # 488
How does Cisco Trustsec enable more access controls for dynamic networking environments and data centers?

A. uses flexible NetFlow
B. classifies traffic based on advanced application recognition
C. classifies traffic bused an the contextual identity of the endpoint rather than its IP address
D. assigns a VLAN to the endpoint

Answer: C

Explanation:
The Cisco TrustSec solution simplifies the provisioning and management of network access control through the use of software-defined segmentation to classify network traffic and enforce policies for more flexible access controls. Traffic classification is based on endpoint identity, not IP address, enabling policy change without net-work redesign.
Reference: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Apr2016/User-to- DC_Access_Control_Using_TrustSec_Deployment_April2016.pdf

NEW QUESTION # 489
A network administrator applies the following configuration to an IOS device.

What is the process of password checks when a login attempt is made to the device?

A. A local database is checked first. If that fails, a TACACS+server is checked, if that check fails, a RADUIS server is checked.
B. A local database is checked first. If that check fails, a TACACS+server is checked.
C. A TACACS+server is checked first. If that check fail, a RADIUS server is checked. If that check fail. a local database is checked.
D. A TACACS+server is checked first. If that check fail, a database is checked?

Answer: B

Explanation:
Explanation
The "aaa authentication login default local group tacacs+" command is broken down as follows:
+ The 'aaa authentication' part is simply saying we want to configure authentication settings.
+ The 'login' is stating that we want to prompt for a username/password when a connection is made to the device.
+ The 'default' means we want to apply for all login connections (such as tty, vty, console and aux). If we use this keyword, we don't need to configure anything else under tty, vty and aux lines. If we don't use this keyword then we have to specify which line(s) we want to apply the authentication feature.
+ The 'local group tacacs+" means all users are authenticated using router's local database (the first method). If the credentials are not found on the local database, then the TACACS+ server is used (the second method).

NEW QUESTION # 490
An engineer must construct an access list for a Cisco Catalyst 9800 Series WLC that will redirect wireless guest users to a splash page that is hosted on a Cisco ISE server. The Cisco ISE servers are hosted at 10.9.11.144 and 10.1.11.141. Which access list meets the requirements?

Answer: B

Explanation:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless- controllers/213920-central-web-authentication-cwa-on-cata.html#toc-hId-881505252

NEW QUESTION # 491
An engineer is troubleshooting the Ap join process using DNS. Which FQDN must be resolvable on the network for the access points to successfully register to the WLC?

A. cisco-capwap-controller.domain.com
B. ap-manager.domain.com
C. primary-wlc.domain.com
D. wlcbostname.domain.com

Answer: A

Explanation:
Explanation
DNS: If you have configured your DHCP server to provide both option 006 (DNS server address) and option
015 (domain name) information, the AP can obtain WLC addresses from the DNS server. The process works as follows:
1. The AP gets its IP address from DHCP with options 6 and 15 configured.
2. The AP can obtain the IP address of the DNS server from the DHCP option.
3. The AP uses this information to perform a hostname lookup using
CISCO-CAPWAP-CONTROLLER.<localdomain>, which resolves to available WLC management interface IP addresses (IPv4 or IPv6, or both).
4. The AP can then perform a directed message to associate to responsive WLCs.
To prevent all APs from joining a single controller based on a DNS name resolution, the domain name may vary; this is what is done to dispatch APs to different controllers across the enterprise network, based on different domain names that are configured in their respective DNS scopes.

NEW QUESTION # 492
Which action is the vSmart controller responsible for in a Cisco SO-WAN deployment?

A. manage, maintain, and gather configuration and status for nodes within me SD-WAN fabric
B. onboard WAN Edge nodes into the SD-WAN fabric
C. distribute security information for tunnel establishment between WAN Edge routers
D. gather telemetry data from WAN Edge routes

Answer: C

NEW QUESTION # 493
Refer to the exhibit. Which command set must be applied on R1 to establish a BGP neighborship with R2 and to allow communication from R1 to reach the networks?