Free and Premium Cisco 350-401 Dumps Questions Answers

Solution:

Copy run start

Verification:

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution: -

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

VERIFICATION: -

OR

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R2

R3

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:-

Copy run start

Solution:

Copy run start

Verification:

OR

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Without AAA, the router can still use the local username database for authentication. To place a user directly into privileged EXEC mode after successful login, the local username can be created with privilege level 15, for example username admin privilege 15 secret < password > , and the console line can use local login. This causes the user to receive privilege level 15 after authentication rather than starting in user EXEC mode and then entering the enable password. Option D is therefore the best answer because it ties the privilege level to the authenticated local user. Option A is wrong because it explicitly uses RADIUS or TACACS+, which contradicts the requirement to avoid AAA. Option B is not valid IOS syntax for achieving this behavior. Option C can set the privilege level for a console line, but it is line-based rather than credential-based and does not specifically satisfy the requirement that the privilege be granted after the user provides the correct login credentials. The ENCOR security concept is local device administration without centralized AAA. References/topics: ENCOR Infrastructure Security, local authentication, console access, privilege levels, username privilege 15, device management.

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

A REST API request that lacks required authentication information is rejected by the server before the requested operation is executed. REST APIs commonly use HTTP status codes to communicate request success or failure. When authentication credentials, API tokens, session cookies, or authorization headers are missing or invalid, the server normally returns a client-error response in the 4xx range. Common examples include 401 Unauthorized, meaning authentication is required or failed, and 403 Forbidden, meaning the server understood the request but refuses access because the requester lacks permission. The server does not authenticate based only on source IP unless a separate IP-based access-control mechanism has been deliberately configured, so option A is not generally correct. The server also does not normally keep the HTTP transaction open indefinitely waiting for credentials, so option B is wrong. Option C is dangerous and wrong: APIs should not downgrade unauthenticated requests into guest execution unless an endpoint is intentionally public. In ENCOR automation, REST API security requires explicit authentication and authorization, usually over HTTPS/TLS. References/topics: ENCOR Automation, REST APIs, HTTP status codes, API authentication, tokens, Cisco Catalyst Center API behavior.

Auto-RP is used in Protocol Independent Multicast sparse-mode environments to distribute rendezvous point information automatically. In PIM sparse mode, multicast routers must know which RP is responsible for specific multicast group ranges. Without a dynamic RP-discovery mechanism, administrators would have to configure RP information manually across routers. Auto-RP solves that by allowing candidate RPs to announce themselves and mapping agents to advertise group-to-RP mappings throughout the multicast domain. Therefore, option B is correct. Option A is incorrect because Auto-RP does not distribute IGMP traffic; IGMP operates between hosts and local multicast routers to manage group membership. Option C is wrong because Auto-RP does not automate leaf-router configuration generally; it specifically distributes RP mapping information. Option D is also inaccurate because Auto-RP does not perform an election in the same way as BSR. It advertises candidate RP and mapping-agent information so routers can learn RP mappings. The key ENCOR concept is multicast control-plane discovery for PIM sparse-mode RP selection. References/topics: ENCOR multicast, PIM sparse mode, Auto-RP, rendezvous point discovery, multicast group-to-RP mapping.