8 Cisco ENCOR 350-401 Practice Questions That Mirror the Real Exam
Here are 8 multiple-choice questions designed to mirror the difficulty, style, and content distribution of the Cisco ENCOR 350-401 exam. They cover network architecture, automation, security, and emerging technologies, with plausible distractors to challenge your critical thinking.
Question 1
A network engineer is designing a new branch office connection. The requirement is to use a single physical interface to carry both the management VLAN and user data traffic, while ensuring that the management traffic is isolated from user broadcasts. Which configuration approach correctly achieves this? For more on this topic, see our guide on How Long Does It Really Take to Study for Cisco ENCOR 350-401?.
A. Configure the physical interface as an access port in the user VLAN and create a separate SVI for management.
B. Configure the physical interface as a trunk port and use subinterfaces with 802.1Q encapsulation for each VLAN.
C. Configure the physical interface as a Layer 3 port and assign an IP address from the user subnet.
D. Configure the physical interface as a trunk port and rely on VLAN 1 for management traffic.
Answer: B
Explanation: Using a trunk port with 802.1Q subinterfaces allows multiple VLANs (management and user) to traverse a single physical link while maintaining Layer 2 isolation between them. Option A is incorrect because an access port only carries one VLAN, and an SVI alone doesn't solve the physical link requirement. Option C is incorrect as it removes Layer 2 switching entirely. Option D is a security risk as VLAN 1 is the default and should not be used for management.
Question 2
Which NETCONF operation is used by a controller to replace the entire configuration of a specific data store on a network device?
A.
B.
C.
D.
Answer: D
Explanation:
Question 3
In a VXLAN deployment, which component is responsible for encapsulating and decapsulating VXLAN packets and is typically the VTEP?
A. The VNI
B. The Underlay router
C. The Overlay endpoint
D. The Network Controller
Answer: C Looking for more detail? See Cisco ENCOR 350-401 vs Cisco ENARSI 300-410: Which One Should You Take First?.
Explanation: The VXLAN Tunnel Endpoint (VTEP) is the device (often a switch) that performs the encapsulation and decapsulation of VXLAN frames. The VNI (Virtual Network Identifier) is the segment ID, not a device. The underlay router forwards the encapsulated packets but doesn't process the VXLAN header. The controller manages the fabric but doesn't forward data plane traffic.
Question 4
A network engineer is implementing QoS for a voice and video deployment. Which action correctly differentiates between marking and policing?
A. Marking reclassifies packets by changing the DSCP value, while policing drops or re-marks traffic that exceeds a rate.
B. Marking is performed in hardware, while policing is performed in software.
C. Policing buffers excess traffic, while marking drops excess traffic.
D. Policing changes the CoS value, while marking changes the DSCP value.
Answer: A
Explanation: Marking (classification) sets the QoS bits (e.g., DSCP, CoS) to identify traffic classes, while policing is a traffic conditioning action that enforces a rate limit by dropping or re-marking out-of-profile packets. Policing does not buffer (that is shaping). Both can be done in hardware on modern ASICs, and marking can apply to various fields, not just DSCP.
Question 5
Which statement accurately describes the behavior of a Layer 2 port-channel in Cisco IOS?
A. Load balancing is based on the source and destination IP addresses by default.
B. If one physical link in the bundle fails, the entire port-channel goes down.
C. The port-channel interface must have a different MAC address than the member physical ports.
D. Spanning Tree Protocol (STP) treats the port-channel as a single logical port.
Answer: D
Explanation: STP operates on the logical port-channel interface, not the individual physical members, preventing loops while allowing redundancy. Default load balancing is based on MAC addresses, not IP addresses (unless configured otherwise). A single link failure does not bring down the bundle; traffic is redistributed. The port-channel uses the MAC address of the first member port (or a configured one), not a unique one.
Question 6
A network engineer is troubleshooting a BGP peering issue between two routers. The neighbor relationships keep flapping. The output of show ip bgp neighbors shows that the state is "Active" but never reaches "Established". Which configuration mismatch is the most likely cause?
A. The update-source is set to the wrong interface on one side.
B. The ebgp-multihop command is missing on both sides.
C. The next-hop-self command is not applied. Another useful resource: Cisco SISE 300-715 Salary: The Real Numbers, Not the Marketing Ones.
D. The maximum-paths command is set to 1.
Answer: A
Explanation: An "Active" state that never establishes usually indicates a TCP connection failure, often due to a source IP address mismatch (e.g., using the wrong interface IP for the peering). ebgp-multihop is only needed for non-directly connected eBGP peers. next-hop-self affects route advertisement, not peering state. maximum-paths affects routing table installation, not peering.
Question 7
In the context of Cisco DNA Center, which function is performed by the "Assurance" component?
A. Automating the provisioning of new network devices via templates.
B. Providing intent-based policy enforcement across the fabric.
C. Monitoring network health, client experience, and application performance using telemetry and analytics.
D. Managing software images and patching for all connected devices.
Answer: C
Explanation: Cisco DNA Center's Assurance module uses streaming telemetry and analytics to provide insights into network, client, and application health, enabling proactive troubleshooting. Automation (templates) is part of "Design" and "Provision". Policy enforcement is "Policy". Image management is part of "Software Image Management" (SWIM), a separate function, though often integrated.
Question 8
Which technology allows a network device to authenticate users via an external server using a standard protocol that encrypts the entire authentication payload, including the username and password, and uses UDP port 1812 by default?
A. TACACS+
B. RADIUS
C. LDAP
D. Kerberos
Answer: B
Explanation: RADIUS encrypts the entire authentication packet (except the access-request header) and uses UDP ports 1812 (authentication) and 1813 (accounting). TACACS+ uses TCP port 49 and encrypts the entire body but leaves the header unencrypted. LDAP and Kerberos are not typically used for network device AAA (though LDAP can be a backend). RADIUS is the standard for network access.
These questions reflect the depth and breadth you'll encounter on the real exam. Remember to focus not just on memorizing facts, but on understanding the "why" behind each configuration and protocol behavior.
If you are still mapping out your final weeks, use this free ENCOR study plan to get a week-by-week schedule that balances every official exam domain.
Accelerate your last week of revision with Cisco Implementing Cisco Enterprise Network Core Technologies (ENCOR) exam questions that focus on high-weight topics.
When you want a quick signal on your weakest topic, take the free ENCOR readiness check and review the explanations for every question.