Cisco CCNP 350-401 ENCOR Exam Details and Preparation

The Cisco CCNP 350-401 ENCOR exam evaluates skills in implementing core enterprise network technologies, including dual-stack architecture, virtualization, infrastructure, network assurance, security, and automation.

Certification Overview

  • Exam name: CCNP 350-401 ENCOR
  • Vendor: Cisco
  • Exam code: ccnp 350-401
  • Duration: 120 minutes
  • Total questions: 100
  • Passing score: 80%

About This Certification

The Cisco CCNP 350-401 ENCOR exam is designed to assess a candidate's proficiency in implementing core enterprise network technologies. This professional-level certification validates expertise in several key areas essential for modern networking environments. Candidates are tested on their understanding of dual-stack architecture, which includes both IPv4 and IPv6, ensuring they can manage and troubleshoot diverse network environments. The exam also covers virtualization, highlighting the importance of network virtualization technologies and their role in enhancing network efficiency and scalability. Infrastructure is another critical domain, focusing on the configuration and management of network devices and services. Network assurance is tested to ensure candidates can maintain network performance and reliability through effective monitoring and troubleshooting techniques. Security is a fundamental component of the exam, assessing the ability to implement robust security measures to protect network integrity and data confidentiality. Finally, automation is a key focus area, emphasizing the use of network automation tools and techniques to streamline operations and reduce manual interventions. This certification is essential for professionals looking to advance their careers in network engineering and administration.

Who Should Take This Exam?

Network Engineer, Network Administrator, Systems Engineer, IT Manager, Network Analyst, Security Specialist, Infrastructure Engineer, Network Consultant

Prerequisites

Valid CCNA certification or equivalent networking experience

Topics Covered

  • Topics to be announced

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • Drag and Drop

CCNP 350-401 ENCOR Practice Questions

Our question bank contains 696+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomized questions from our full question bank.

Architecture

A business intends to adopt intent-based networking in its campus setup. Which architecture aids the transition from a traditional campus design to a programmable fabric design?
  • Layer 2 access
  • three-tier
  • two-tier
  • routed access
Wireless network users experience regular disconnections, yet their devices reconnect without manual intervention. During troubleshooting, the engineer notices logs indicating downtime due to radio channel settings at specific times. What action could lessen the impact on users?
  • increase the AP heartbeat timeout
  • increase BandSelect
  • enable coverage hole detection
  • increase the dynamic channel assignment interval.
How is data policy defined within a Cisco SD-WAN environment?
  • list of ordered statements that define node configurations and authentication used within the SDWAN overlay
  • Set of statements that defines how data is forwarded based on IP packet information and specific VPNs
  • Detailed database mapping several kinds of addresses with their corresponding location
  • group of services tested to guarantee devices and links liveliness within the SD-WAN overlay

Virtualization

Examine the diagram. A network engineer needs to streamline the IPsec setup by using IPsec over GRE with IPsec profiles. What two adjustments should be made to achieve this? (Select two)
  • Apply the crypto map to the tunnel interface and change the tunnel mode to tunnel mode ipsec ipv4
  • Create an IPsec profile, associate the transform-set. and apply the profile to the tunnel interface.
  • Remove the crypto map and modify the ACL to allow traffic between 10.10.0.0/24 to 10.20.0.0/24.
  • Remove all configuration related to crypto map from R1 and R2 and eliminate the ACL
  • Create an IPsec profile, associate the transform-set ACL. and apply the profile to the tunnel interface
A Linux server supports virtual machines and offers DNS and DHCP services for a small business. What technology does this describe?
  • container
  • Type 1 hypervisor
  • hardware pass-thru
  • Type 2 hypervisor
What method should an engineer use to address a prolonged contention issue between two VMs on the same host?
  • Adjust the resource reservation limits
  • Live migrate the VM to another host
  • Reset the VM
  • Reset the host

Infrastructure

A network engineer sets up BGP between R1 and R2 using BGP peer group CORP and MD5 authentication. The following message appears on R1's console: `May 5 39:85:55.469: %TCP-6-BADAUTH` Invalid MD5 digest from 10.10.10.1 to 10.120.10.1. What two configurations should be made to enable a peering session between R1 and R2? (Select two)
  • R1(config-router)#neighbor 10.10.10.1 peer-group CORP R1(config-router)#neighbor CORP password Cisco
  • R2(config-router)#neighbor 10.120.10.1 peer-group CORP R2(config-router)#neighbor CORP password Cisco
  • R2(config-router)#neighbor 10.10.10.1 peer-group CORP R2(config-router)#neighbor PEER password Cisco
  • R1(config-router)#neighbor 10.120.10.1 peer-group CORP R1(config-router)#neighbor CORP password Cisco
  • R2(config-router)#neighbor 10.10.10.1 peer-group CORP R2(config-router)#neighbor CORP password Cisco
During the setup of an IOS router for HSRP with a virtual IP of 10.1.1.1, an engineer notices a log stating: Jan 1 12:12:12.111 : %HSRP-4-DIFFVIP1: GigabitEthernet0/0 Grp 1 active routers virtual IP address 10.1.1.1 differs from the local configuration of 10.1.1.25 What configuration adjustment is necessary?
  • Change the HSRP group configuration on the remote router to 1.
  • Change the HSRP group configuration on the local router to 1.
  • Change the HSRP virtual address on the remote router to 10.1.1.1.
  • Change the HSRP virtual address on the local router to 10.1.1.1.
What distinguishes TCAM from the MAC address table?
  • The MAC address table is contained in CAM. ACL and QoS information is stored in TCAM.
  • The MAC address table supports partial matches. TCAM requires an exact match
  • Router prefix lookups happens in CAM. MAC address table lookups happen in TCAM.
  • TCAM is used to make Layer 2 forwarding decisions CAM is used to build routing tables

Network Assurance

A business intends to adopt intent-based networking in its campus setup. Which architecture aids the transition from a traditional campus design to a programmable fabric design?
  • Layer 2 access
  • three-tier
  • two-tier
  • routed access
An engineer is setting up an application sensitive to delays between packets. Which command configures the router to measure jitter?
  • Router(config)# ip sla responder udp-connect 172.29.139.134 5000
  • Router(config)# ip sla responder tcp-connect 172.29.139.134 5000
  • Router(config)# ip sla responder udp-echo 172.29.139.134 5000
  • Router(config)# ip sla responder tcp-echo 172.29.139.134 5000
What commands configure RSPAN to isolate and capture outgoing traffic from VLAN3 on interface GigabitEthernet 0/3, while excluding traffic from other VLANs on the same interface?
  • monitor session 2 source interface gigabitethernet 0/3 tx monitor session 2 filter vlan 1 - 2 , 4 - 4094
  • monitor session 2 source interface gigabitethernet 0/3 tx monitor session 2 filter vlan 3
  • monitor session 2 source interface gigabitethernet 0/3 rx monitor session 2 filter vlan 1 - 2 , 4 - 4094
  • monitor session 2 source interface gigabitethernet 0/3 rx monitor session 2 filter vlan 3

Security

Which setup limits the SSH traffic a router can handle to 100 kbps?
  • class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! ! Interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group CoPP_SSH out duplex auto speed auto media-type rj45 service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH permit tcp any any eq 22 !
  • class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir CoPP_SSH exceed-action drop ! Interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group ... out duplex auto speed auto media-type rj45 service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH deny tcp any any eq 22 !
  • class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! Control-plane service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH deny tcp any any eq 22 !
  • class-map match-all CoPP_SSH match access-group name CoPP_SSH ! Policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! Control-plane transit service-policy input CoPP_SSH ! Ip access-list extended CoPP_SSH permit tcp any any eq 22 !
When employing TLS with syslog, what configuration ensures secure and reliable message transport to the default port?
  • logging host 10.2.3.4 vrf mgmt transport tcp port 6514
  • logging host 10.2.3.4 vrf mgmt transport udp port 6514
  • logging host 10.2.3.4 vrf mgmt transport tcp port 514
  • logging host 10.2.3.4 vrf mgmt transport udp port 514
What is a characteristic of MACsec?
  • 802.1AE provides encryption and authentication services
  • 802.1AE is built between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802.1X session
  • 802.1AE is built between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)
  • 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol

Automation and Artificial Intelegence

Identify two advantages of using YANG. (Select two)
  • It enables multiple leaf statements to exist within a leaf list
  • It collects statistical constraint analysis information.
  • It enforces configuration constraints.
  • It enforces configuration semantics.
  • It enforces the use of a specific encoding format for NETCONF
What is a key difference between SaltStack and Ansible?
  • SaltStack uses the Ansible agent on the box, whereas Ansible uses a Telnet server on the box.
  • SaltStack uses an API proxy agent to program Cisco boxes in agent mode, whereas Ansible uses a Telnet connection.
  • SaltStack uses SSH to interact with Cisco devices, whereas Ansible uses an event bus.
  • SaltStack is constructed with minion, whereas Ansible is constructed with YAML
What is a notable feature of YANG?
  • It is a Cisco proprietary language that models NETCONF data
  • It allows model developers to create custom data types
  • It structures data in an object-oriented fashion to promote model reuse
  • It provides loops and conditionals to control now within models

Frequently Asked Questions

How many questions are on the exam?

The CCNP 350-401 ENCOR exam contains 100 questions.

What is the passing score?

You need 80% to pass.

How long is the exam?

You have 120 minutes to complete the exam.

Practice with realistic mock exams to prepare for your Cisco certification.