Free 350-401 Practice Test Questions 2026

✅ Explanation:

Cisco's official documentation explicitly lists Cisco Express Forwarding (CEF) and IP routing as a prerequisite for deploying BFD on all participating routers and switches . BFD relies on CEF to efficiently forward the rapid detection packets and IP routing to establish the necessary forwarding path context. Without these enabled, BFD cannot operate. CEF provides the forwarding infrastructure, while IP routing establishes the foundation for the routing protocols that BFD supports.

Why other options are incorrect:

A. BFD requires a FHRP to provide subsecond host failover.
Incorrect. BFD can operate independently to detect forwarding path failures for routing protocols like OSPF, EIGRP, or BGP without any FHRP configured . While BFD can be integrated with HSRP to accelerate failover, this is an optional application, not a prerequisite .

B. BFD can be deployed without any IP routing protocols being configured.
Incorrect. The prerequisites require that "one of the IP routing protocols supported by BFD must be configured on the routers before BFD is deployed" . BFD is designed to complement routing protocols by providing fast failure detection; it is not typically deployed in isolation.

C. NSF and graceful restart must be enabled on all participating routers.
Incorrect. NSF and graceful restart are optional high-availability features that can work with BFD but are not prerequisites . In fact, Cisco warns that configuring both BFD and BGP graceful restart may result in suboptimal routing, indicating these features can be conflicting rather than required .

🔗 References:

Cisco IOS IP Routing Configuration Guide: "Cisco Express Forwarding and IP routing must be enabled on all participating routers" .

Cisco Catalyst Switch Configuration Guide: "All participating switches must enable Cisco Express Forwarding and IP routing" .

✅ Explanation:

A collision domain in Wi-Fi defines the set of devices that must contend for the same wireless medium (airtime). All devices operating on the same channel and within range of each other share this domain . Because Wi-Fi is a shared, half-duplex medium, they must compete to transmit using CSMA/CA, and cannot detect collisions directly—they rely on acknowledgements to confirm successful reception . By contrast, devices on non-overlapping channels operate in separate collision domains, enabling spatial reuse and increased capacity .

Why other options are incorrect:

A. The 2.4-GHz band has 24 non-overlapping channels: The 2.4 GHz band has only 3 non-overlapping channels (1, 6, and 11) in North America due to severe spectral overlap .

C. Wi-Fi channels are spaced 30 MHz apart: Wi-Fi channels in both 2.4 GHz and 5 GHz bands are spaced 5 MHz apart . The 20/22 MHz channel width causes adjacent-channel overlap .

D. The 5-GHz band offers 11 different channels for Wi-Fi clients: The 5 GHz band offers up to 25 non-overlapping 20 MHz channels, far more than 11 .

🔗 References

HPE Aruba Theory Guide: Defines collision domains and medium contention in 802.11 networks .
Aerohive High-Density Wi-Fi Design Guide: Explains channel planning, non-overlapping channels, and collision domains .

✅ Explanation:

This classification is a fundamental distinction in configuration management:

Procedural (Imperative) Tools – You write scripts or code that describe the exact steps to execute in order to reach a desired state. Chef is a procedural tool where you define recipes that instruct the system on how to install, configure, and manage services, step-by-step, using an imperative programming style.

Declarative Tools – You define the desired configuration (the "what"), and the tool determines the necessary steps (the "how") to achieve that state. Puppet uses a declarative language where you specify the desired resources and attributes. SaltStack is also declarative, using state files to define the desired configuration, though it also supports some imperative execution.

References

Red Hat White Paper: "Puppet and SaltStack are declarative, while Chef is procedural"

Puppet and Chef Documentation: Contrasts declarative vs procedural configuration management

IAC Tools Cheat Sheet: Lists Chef as procedural, Puppet and SaltStack as declarative

✅ Explanation:

HTTPS (Hypertext Transfer Protocol Secure) uses TLS (Transport Layer Security) to encrypt the entire communication channel between the client and the server. This ensures that sensitive data, such as authentication credentials and API keys, are protected from interception and tampering while in transit, providing privacy and integrity.

Encryption in transit is a foundational and widely recognized security practice for any web API. It is often complemented by other security measures like authentication and authorization.

Why other options are incorrect:

A. using an MD5 hash to verify the integrity
MD5 is a broken, cryptographically insecure hashing algorithm. It should not be used for any security-sensitive purpose, including verifying API integrity.

B. using built-in protocols known as Web Services Security
Web Services Security (WS-Security) is a standard associated with SOAP web services, not REST APIs. REST APIs typically rely on simpler mechanisms like OAuth, API keys, and JWT.

D. using a combination of XML encryption and XML signatures
XML encryption and XML signatures are also part of the WS-Security standard for SOAP, not REST. REST APIs typically use JSON as their primary data format and rely on HTTPS for transport security.

🔗 References

Microsoft Learn: Highlights "HTTPS by default" as a key feature, emphasizing end-to-end encryption to ensure privacy and prevent interception.

TechTarget: Lists "Secure" as a benefit of REST APIs, mentioning OAuth and SSL/TLS encryption.

Explanation:

OAuth (specifically OAuth 2.0) is an open standard framework designed specifically for third-party delegation and authorization. It allows a third-party application to obtain limited access to a HTTP service on behalf of a resource owner without sharing the user's login credentials.

Delegated Access: OAuth enables users to grant third-party applications access to their resources (such as APIs) using access tokens rather than revealing sensitive passwords.

Token-Based Framework: The authorization server authenticates the user and issues an access token to the third-party application, granting defined permissions (scopes) for a specific time period.

Why Other Options Are Incorrect

A. API keys:
API keys are primarily used for client identification, project identification, and API usage tracking/rate limiting. They authenticate the requesting application itself, not individual third-party users or delegated authorization.

B. custom tokens:
Custom tokens are proprietary implementations designed for specific application workflows rather than a standardized framework for third-party authorization.

D. SOAP:
Simple Object Access Protocol (SOAP) is a messaging protocol standard for exchanging structured information in web services (using XML), not an authorization framework.

References:

RFC 6749: The OAuth 2.0 Authorization Framework

Cisco 350-401 ENCOR Exam Topics: Section 6.0 Automation — Topic 6.1 Describe REST API security (authentication and authorization mechanisms including OAuth, API keys, basic authentication).

Explanation:

In the Cisco SD-WAN (Catalyst SD-WAN) architecture, WAN Edge routers—which include cEdge (Cisco IOS-XE SD-WAN routers) and vEdge (Viptela OS routers)—make up the Data Plane.

edge: Operates as the physical or virtual WAN Edge device responsible for terminating IPsec data tunnels and forwarding actual data plane traffic (user, application, and server packets) across the overlay network.

IPsec Tunnels: cEdge routers form secure data plane tunnels directly with each other to transport end-user data securely across WAN transports.

Why Other Options Are Incorrect:

A. vSmart:
Represents the Control Plane. It handles overlay routing information via OMP (Overlay Management Protocol), enforces control policies, and distributes encryption keys, but it never processes or transports actual user data plane traffic.

B. vManage:
Represents the Management Plane. It provides a centralized GUI dashboard for configuration, policy creation, reporting, and network operations across the fabric.

C. vBond: Represents the Orchestration Plane. It orchestrates initial device discovery, performs mutual authentication of all controllers and edge routers, and facilitates NAT traversal.

References:

Cisco SD-WAN Architecture Guide:Separation of Planes (Management, Control, Orchestration, and Data Plane).

Cisco 350-401 ENCOR Exam Topics: Section 1.0 Architecture — Topic 1.5 Describe Cisco SD-WAN architecture components (vManage, vSmart, vBond, cEdge/vEdge).

Explanation:

The 4-way handshake in WPA2 Enterprise consists of four EAPOL-Key frames that establish encryption keys after successful 802.1X authentication. The Group Temporal Key (GTK) is generated by the access point to encrypt broadcast and multicast traffic and is securely delivered to the client in the M3-Message (the third frame of the handshake) . However, the message that validates and confirms that the client has successfully installed the GTK is the M4-Message. This final message serves as an acknowledgment from the client to the access point, completing the handshake and confirming that the temporal keys, including the GTK, have been installed .

Why other options are incorrect:

B. M3-Message: The M3-Message is sent by the AP to the client and contains the encrypted GTK. It transmits the key but does not confirm its installation .

C. M2-Message: The M2-Message is the client's response to the ANonce, containing the SNonce and a MIC. It does not involve the GTK .

D. M1-Message: The M1-Message is the initial message containing the ANonce that initiates the handshake . It has no role in GTK confirmation.

🔗 References:

IEEE 802.11 Standard: 4-way handshake defines M4 as the acknowledgment for GTK installation.

NetBeez Blog: "Message 4 is sent by the client... This final message notifies the access point of whether the temporal keys were installed successfully" .

✅ Explanation:

The Receiver Start of Packet (RX-SOP) Detection Threshold feature is specifically designed to manage RF cell size in high-density wireless environments like stadiums and large auditoriums. RX-SOP determines the Wi-Fi signal level (in dBm) at which an access point's radio will demodulate and decode a packet. By configuring a higher threshold, the AP's radio becomes less sensitive and ignores weaker signals, treating them as noise.

This effectively reduces the RF cell size by preventing the AP from demodulating packets above a given threshold, ensuring clients connect to the nearest AP with the strongest signal. It is a fine-tuning tool used alongside other Wi-Fi best practices to optimize network performance in high-density deployments.

Why other options are incorrect:

B. FRA (Forensic and Remedial Analysis):
FRA is a security feature used for threat detection and mitigation, such as identifying rogue APs or wireless attacks. It is not designed to control RF cell size or packet demodulation thresholds.

C. 802.11k:
802.11k is a standard that enables clients to request neighbor reports to make better roaming decisions. It does not directly control the physical size of the RF cell or the AP's demodulation threshold.

D. RRM (Radio Resource Management):
RRM is a broader framework that automates channel and power assignments to optimize the RF environment. While RRM indirectly affects cell size via transmit power control, RX-SOP is a specific, fine-grained tool that directly controls packet demodulation thresholds, making it the correct answer for this scenario.

🔗 References:

Cisco HDX Deployment Guide: "The higher the RX-SOP level, the less sensitive the radio is and the smaller the receiver cell size will be" .

Cisco Meraki Documentation: RX-SOP "enables a configuration parameter that helps a radio determine if it should demodulate and decode a frame...effectively lowering receiver cell size" .

✅ Explanation:

In the Cisco SD-WAN architecture, the vBond orchestrator is the first point of contact for all other components joining the fabric. Its core function is to authenticate and authorize WAN Edge routers, vSmart controllers, and vManage instances before they are admitted to the network. By orchestrating the initial connections, it eliminates the need for manual processes.

As the orchestrator, vBond's role is broader than simple validation. It also serves as a NAT traversal facilitator (acting as a STUN server), requiring a public IP address to help devices behind NAT locate each other. It provides the list of vSmart and vManage controllers to the WAN Edge routers and maintains control plane connections to synchronize the network topology.

Why other options are incorrect:

A. to provide centralized management and provisioning of all elements into the network
This is the primary responsibility of vManage (the management plane), not vBond. vManage is the centralized network management system that provides a GUI for configuration and monitoring.

B. to configure NAT communication on WAN Edge routers
While vBond does facilitate NAT traversal, it does not configure NAT communication on the routers. It acts as a STUN server to help devices behind NAT discover their public IP addresses.

C. to provide configuration synchronization of all WAN Edge devices
Configuration synchronization is handled by vManage, which pushes configurations to network devices. vBond is not involved in this synchronization process.

🔗 References:

Cisco SD-WAN Architecture Overview:vBond orchestrates connectivity, serves as the first point of authentication, and authorizes control connections.

CBT Nuggets: vBond provides authentication of new devices and connects them to the vSmart Controller.

✅ Explanation:

Adopting a data modeling language like YANG abstracts away the complexities of vendor-specific Command-Line Interfaces (CLIs) and configurations. By defining network capabilities in a standardized, machine-readable format, it allows for the creation of applications that can manage multi-vendor networks using widely compatible configurations, effectively refactoring the process . This shifts network management from manual, error-prone CLI commands to a programmatic, software-driven approach .

Why other options are incorrect:

A. deploying machine-friendly codes to manage a high number of devices: While data models do enable automation and the management of large-scale networks, their primary benefit is not simply deploying "machine-friendly codes" but rather providing a structured, vendor-neutral contract that defines the data and constraints of a network device .

B. augmenting the use of management protocols like SNMP for status subscriptions:
YANG is typically used with modern, transactional protocols like NETCONF and RESTCONF to provide a programmable interface for configuration and state data, rather than augmenting legacy protocols like SNMP .

C. augmenting management process using vendor centric actions around models:
Data modeling languages like YANG are designed to be vendor-neutral. They aim to create a common, interoperable language for defining device capabilities and configurations across different vendors, moving away from vendor-centric actions .

🔗 References:

Cisco DevNet: Data models provide a clear, structured definition of device capabilities and enable programmatic interfaces, abstracting the need to code protocol specifics .

Puppet Blog: YANG and NETCONF provide a transactional, programmable, and standardized approach to network device management .

✅ Explanation:

In 802.1X authentication, EAP-MSCHAPv2 is an inner authentication method that transmits the client's credentials, such as a username and password, to the RADIUS server. For these credentials to be protected, they must be sent through a secure, encrypted outer tunnel. Among the options provided, Protected EAP (PEAP) is the correct outer method protocol for ISE to support this configuration.

PEAP is a tunneled EAP method that establishes an encrypted TLS tunnel between the client and the RADIUS server. Once this secure outer tunnel is established, the actual authentication credentials are transmitted via the inner method, which is EAP-MSCHAPv2 in this scenario. This two-step process ensures that the user's password is not sent in clear text over the network.

Why other options are incorrect:

A. EAP-TLS: EAP-TLS is a native, non-tunneled EAP method that uses certificate-based authentication for both the client and server. It does not use an inner method like EAP-MSCHAPv2. While it is highly secure, it is not the correct protocol for this specific requirement.

B. EAP-FAST:
Like PEAP, EAP-FAST is also a tunneled EAP method that can use EAP-MSCHAPv2 as an inner method. However, it is not the correct answer because the most common and widely deployed outer method for EAP-MSCHAPv2 is PEAP. In an exam context, when a client device is configured with EAP-MSCHAPv2 as the inner method, the standard corresponding outer method to configure on ISE is PEAP. PEAP is the default outer method for this scenario.

C. LDAP:
This is not an EAP outer method protocol. LDAP (Lightweight Directory Access Protocol) is an identity source protocol used by ISE to query a directory, such as Active Directory, for user credentials, but it is not part of the EAP authentication framework itself.