Cisco CCNP ENCOR 350-401 Practice Exam

What the Cisco CCNP ENCOR 350-401 exam covers

• Architecture99 questions
• Virtualization87 questions
• Infrastructure117 questions
• Network Assurance123 questions
• Security97 questions
• Automation and Artificial Intelligence131 questions

Free Cisco CCNP ENCOR 350-401 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 654.

1. Question 1Architecture

   A network architect is designing a new SD-WAN deployment for a company with 50 branch offices. The company requires centralized policy management, dynamic path selection based on application SLA requirements, and secure overlay tunnels between sites. Which component in the Cisco SD-WAN architecture is responsible for distributing data plane and application-aware routing policies to the edge routers?

   • AvBond orchestrator
   • BvSmart controllerCorrect
   • CvManage
   • DvEdge router
   ✓ Correct answer: B

   In Cisco SD-WAN, the vSmart controller is the centralized policy brain. It establishes OMP (Overlay Management Protocol) sessions with all vEdge/cEdge routers and pushes data plane forwarding policies, application-aware routing (AAR) policies, and security policies down to every edge device. The vSmart acts as a route reflector for OMP, ensuring every edge router has the topology and policy information it needs for dynamic path selection.

   Why the other options are wrong

   • AvBond orchestrator handles initial authentication and NAT traversal for devices joining the SD-WAN fabric, but it does not distribute ongoing routing or data plane policies.
   • CvManage is the centralized GUI and NMS platform used by administrators to define and push configurations, but the actual policy distribution to edge routers is performed by the vSmart controller.
   • DvEdge routers are the data plane devices at branch sites that receive and enforce policies; they do not distribute policies to other edge routers.
2. Question 2Architecture

   Vertex Financial is implementing an enterprise wireless network using Cisco Catalyst 9800 WLCs. What is the maximum number of APs a single Cisco Catalyst 9800-80 WLC can support?

   • A2,000 APs
   • B3,000 APs
   • C1,000 APs
   • D6,000 APsCorrect
   ✓ Correct answer: D

   The Cisco Catalyst 9800-80 is the high-end appliance-based wireless controller in the 9800 series, supporting up to 6,000 APs and 64,000 wireless clients. This scale makes it suitable for very large enterprise deployments. Knowing the scale numbers for the 9800 series is a relevant detail for the CCNP ENCOR exam.

   Why the other options are wrong

   • A2,000 APs corresponds to the scale of a smaller 9800 series model such as the 9800-40, not the flagship 9800-80.
   • B3,000 APs does not match the supported scale of the 9800-80 - this figure does not correspond to a standard Cisco 9800 series SKU capacity.
   • C1,000 APs is the approximate scale of the 9800-L (the lower-end appliance), not the 9800-80 which is designed for large enterprises.
3. Question 3Virtualization

   SkyVirt Technologies is deploying network function virtualization (NFV). Which component in the NFV architecture provides the virtualized computing, storage, and networking resources?

   • ANFV Orchestrator (NFVO)
   • BVirtual Network Function (VNF)
   • CNFV Infrastructure (NFVI)Correct
   • DElement Management System (EMS)
   ✓ Correct answer: C

   In the ETSI NFV architectural framework, the NFV Infrastructure (NFVI) encompasses all physical and virtualized hardware resources - compute (servers/CPUs), storage, and networking - along with the virtualization layer (hypervisor) that abstracts these physical resources into virtual resources. NFVI is the foundation on which Virtual Network Functions (VNFs) run. Without NFVI, there would be no virtualized environment in which to instantiate software-based network functions.

   Why the other options are wrong

   • ANFV Orchestrator (NFVO) is responsible for orchestrating NFVI resources across multiple VIMs and managing the lifecycle of network services composed of multiple VNFs - it does not itself provide the physical compute, storage, or networking resources.
   • BVirtual Network Function (VNF) is the software implementation of a network function (such as a virtual firewall or virtual router) that runs on top of NFVI - it consumes virtualized resources but does not provide them.
   • DElement Management System (EMS) is responsible for managing the configuration, fault, and performance of individual VNF instances - it is a management-plane component, not a resource provider.
4. Question 4InfrastructureSelect all that apply

   AquaNet Corp is designing a Layer 3 routed access campus network. Which two advantages does a routed access design provide over a traditional Layer 2 access design? (Choose 2)

   • AFaster convergence using Layer 3 equal-cost multipathCorrect
   • BReduces the number of required IP subnets
   • CSimplifies VLAN trunking configuration
   • DEliminates STP dependency at the access layerCorrect
   • EEnables larger Layer 2 broadcast domains
   ✓ Correct answer: A, D

   A routed access design terminates VLANs at the access layer switches and runs Layer 3 routing (typically OSPF or EIGRP) all the way to the access tier. This provides two key advantages: first, Layer 3 equal-cost multipath (ECMP) enables fast, deterministic load sharing and sub-second convergence using routing protocols rather than STP timers. Second, since there are no Layer 2 trunk links between access and distribution layers, STP is not needed to prevent loops, eliminating the complexity and potential instability of spanning tree at the access layer.

   Why the other options are wrong

   • BRouted access actually increases the number of required IP subnets - each access layer link becomes a routed point-to-point subnet, requiring more address space than a traditional Layer 2 design.
   • CRouted access does not simplify VLAN trunking - instead it eliminates VLAN trunks between access and distribution layers, replacing them with routed interfaces, which is a fundamental architectural change rather than a simplification of trunking.
   • ERouted access reduces Layer 2 broadcast domains - each VLAN is confined to a single access switch, making broadcast domains smaller, not larger.
5. Question 5Network AssuranceSelect all that apply

   Which two ThousandEyes test types help diagnose application delivery issues? (Choose two.)

   • ANetwork path trace testsCorrect
   • BDHCP server tests
   • CHTTP server testsCorrect
   • DBGP route monitoring
   ✓ Correct answer: A, C

   ThousandEyes provides multiple test types for diagnosing where in the delivery chain an application performance problem originates. Network path trace tests use traceroute-like probes to visualize every hop between the agent and the target, identifying routing anomalies and latency spikes at specific network nodes. HTTP server tests simulate a client requesting a web resource and measure DNS resolution, TCP connect, SSL handshake, and content download times, directly reflecting the end-user experience for web-based applications.

   Why the other options are wrong

   • BDHCP server tests in ThousandEyes measure DHCP response time and availability for IP address assignment, which is relevant to client onboarding diagnostics but not specifically to diagnosing application delivery path issues.
   • DBGP route monitoring in ThousandEyes tracks Internet routing changes and AS-path visibility, which is valuable for diagnosing routing-level reachability issues but is not an application delivery test type.
6. Question 6Security

   Which Cisco security solution provides endpoint detection and response (EDR) capabilities?

   • ACisco Secure Endpoint (formerly AMP for Endpoints)Correct
   • BCisco ISE (Identity Services Engine NAC platform)
   • CCisco Firepower (next-generation firewall and IPS)
   • DCisco Umbrella (cloud DNS-layer security service)
   ✓ Correct answer: A

   Cisco Secure Endpoint (previously known as Advanced Malware Protection for Endpoints) is Cisco's dedicated endpoint detection and response (EDR) solution. It provides continuous file analysis, behavioral monitoring, exploit prevention, retrospective security (re-evaluating past file activity when new threat intelligence emerges), and threat hunting capabilities directly on the endpoint, allowing security teams to detect, investigate, and remediate advanced threats.

   Why the other options are wrong

   • BCisco ISE (Identity Services Engine) is a network access control (NAC) and policy management platform that handles authentication, authorization, and accounting - it does not provide EDR capabilities on endpoints.
   • CCisco Firepower is a next-generation firewall and IPS platform focused on network-level threat detection and prevention; while it integrates with Secure Endpoint, Firepower itself does not run as an agent on individual endpoints.
   • DCisco Umbrella is a cloud-delivered DNS-layer security service that blocks malicious domains and IPs at the DNS resolution stage - it is a network security service, not an endpoint agent providing EDR.
7. Question 7Automation and Artificial Intelligence

   How does RESTCONF interact with YANG-modeled data on a network device?

   • AThrough SNMP get and set operations over UDP port 161
   • BThrough HTTP methods like GET, POST, PUT, and DELETECorrect
   • CThrough NETCONF RPCs carried inside an SSH session
   • DThrough CLI commands wrapped in a Tcl script payload
   ✓ Correct answer: B

   RESTCONF (RFC 8040) exposes the same YANG data models as NETCONF over a RESTful HTTP interface. It uses GET to read, POST to create, PUT to replace, PATCH to merge, and DELETE to remove configuration or operational data, with JSON or XML encoding, which makes it simple to consume from web tooling.

   Why the other options are wrong

   • ASNMP over UDP 161 is a separate management protocol and does not use YANG models the way RESTCONF does.
   • CNETCONF RPCs over SSH describe NETCONF, not RESTCONF, even though both use YANG.
   • DRESTCONF uses HTTP methods, not CLI commands wrapped in Tcl scripts.
8. Question 8Infrastructure

   A network engineer is configuring OSPF and wants two routers on a broadcast multi-access segment to never become the DR or BDR, forcing a third router to take both roles. Which interface command accomplishes this on the two routers?

   • Aip ospf network point-to-point
   • Bip ospf priority 0Correct
   • Cip ospf priority 255
   • Dip ospf cost 65535
   ✓ Correct answer: B

   On broadcast networks the DR/BDR election uses interface priority; a priority of 0 removes the router from the election entirely, so it remains a DROTHER. Configuring priority 0 on two routers leaves only the third router eligible to become DR (and there would be no BDR). This directly forces the desired roles.

   Why the other options are wrong

   • AChanging the network type to point-to-point eliminates DR/BDR election altogether rather than steering it to a specific router.
   • CPriority 255 makes a router the most likely to win the election, the opposite of the requirement.
   • DOSPF cost influences path selection, not DR/BDR eligibility.
9. Question 9Network Assurance

   A network engineer reviews Flexible NetFlow output and wants to track the number of bytes and packets per flow. In which type of flow-record field are byte and packet counters classified?

   • AKey fields
   • BNon-key (collect) fieldsCorrect
   • CExporter fields
   • DSampler fields
   ✓ Correct answer: B

   In Flexible NetFlow, key fields (defined with 'match') uniquely identify a flow, while non-key fields (defined with 'collect') gather additional measured data such as byte counts, packet counts, and timestamps for each identified flow.

   Why the other options are wrong

   • AKey fields uniquely identify the flow (e.g., source/destination IP and ports), not the measured counters.
   • CExporter fields are not a flow-record field category; the exporter defines the collector destination.
   • DSampler defines packet sampling rate and is not a field category in the flow record.
10. Question 10Automation and Artificial Intelligence

    A Python developer using the ncclient library wants to send a custom NETCONF RPC defined by a vendor YANG model. Which ncclient method allows sending an arbitrary RPC payload to the device?

    • Amanager.dispatch()Correct
    • Bmanager.get_schema()
    • Cmanager.discard_changes()
    • Dmanager.close_session()
    ✓ Correct answer: A

    ncclient's manager.dispatch() accepts a custom XML RPC element, allowing engineers to invoke vendor-specific or non-standard operations that are not wrapped by built-in helper methods. This is the standard way to call custom YANG-modeled RPCs.

    Why the other options are wrong

    • Bget_schema() downloads a YANG schema from the device, not invokes a custom RPC.
    • Cdiscard_changes() reverts uncommitted edits in the candidate datastore.
    • Dclose_session() gracefully terminates the NETCONF session.

Related Cisco resources

• Cisco CCNP ENCOR 350-401 study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCNP Security SCOR (350-701) practice examRelated
• Cisco CCST Cybersecurity (100-160) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated

Cisco CCNP ENCOR 350-401 practice exam FAQ