Free 350-401 Practice Test Questions 2026

✅ Explanation:

The correct answer is A because it uses the track statement to monitor the IP SLA reachability and triggers when the tracked object's state goes down.

text
track 10 ip sla 10 reachability
This means the state of the track object is tied to whether the IP SLA 10 destination (192.168.10.20) is reachable or not.

To trigger an EEM applet when this tracked object changes to a down state (meaning the IP SLA destination is no longer reachable), the correct event statement is:

text
event track 10 state down
The event track statement directly monitors the tracked object's state, and the state down keyword triggers the applet when the tracked object becomes unreachable.

Why other options are incorrect:

B. event sla 10 state unreachable
– This syntax is incorrect. While IP SLA itself can be used as an event source, the exhibit uses a track statement to monitor the IP SLA. The correct EEM event syntax to monitor the track object is event track, not event sla.

C. event sla 10 state down
– This is also incorrect syntax. IP SLA states are typically represented as reachable or unreachable (or ok/failed), not down. Additionally, the EEM event syntax for IP SLA is event sla, but the correct trigger would be state unreachable, not state down.

D. event track 10 state unreachable
– This is partially correct but uses the wrong state keyword. The track object represents reachability, and its states are up (reachable) and down (unreachable), not unreachable. The correct state keyword for a track object is down, making option A correct.

🔗 References:

Cisco IP SLA Configuration Guide: IP SLA tracking uses track to monitor reachability and state down for unreachable.

Cisco EEM Command Reference: event track is used with state up or state down.

Explanation:

A Transport Location (TLOC) is a fundamental construct in the Cisco Catalyst SD-WAN architecture. It acts as a next-hop attribute for network prefixes and identifies the physical interface where a WAN Edge router connects to the WAN transport network.

Simply put, a TLOC provides the "next-hop" information used to route traffic across the SD-WAN overlay. It is uniquely identified by an IP address–color pair (e.g., {10.0.10.1, mpls}), where the system IP address provides a fixed location for the device, and the "color" identifies the type of WAN transport link (e.g., mpls, biz-internet, 3g).

When a WAN Edge router receives an OMP route, it uses the TLOC to determine which specific transport interface on the destination router to use to reach the advertised network prefix. The TLOC is advertised to the SD-WAN controllers via the Overlay Management Protocol (OMP), which allows the network to make intelligent forwarding decisions based on transport location and path availability.

Why the others are wrong:

A. component set by the administrator to differentiate similar nodes that offer a common service:
This describes a site ID or a TLOC list used in policy configuration, not a TLOC. A site ID identifies the physical location of a WAN Edge router, while a TLOC identifies a specific transport interface.

B. value that identifies a specific tunnel within the Cisco Catalyst SD-WAN overlay:
While TLOC information is used to identify tunnel endpoints and connections, it is not simply a "tunnel ID." It is a more comprehensive next-hop attribute that includes IP address, color, and encapsulation, which together define the transport location.

C. identifier that represents a specific service offered by nodes within the Cisco Catalyst SD-WAN overlay:
This describes a service TLOC, which is used to redirect traffic to a service (like a firewall or load balancer). However, a standard TLOC represents a WAN transport location, not the service itself.

References

Cisco DevNet Glossary: Defines a TLOC as "the physical interface where a vEdge router connects to the WAN transport network".

Cisco Configuration Guide:
Details TLOC as an attribute to direct traffic to a remote TLOC matching IP, color, and encapsulation.

Explanation:

In the LISP (Locator/ID Separation Protocol) architecture, the Map Resolver serves as the primary repository for EID-to-RLOC mappings. Its specific function is to accept and process registration requests from ETRs. When an ETR is configured with a specific EID prefix, it registers that prefix with the Map Resolver, creating an entry in the mapping database. This process is foundational to LISP's operation.

While the Map Resolver plays a role in the mapping lookup process, its direct responsibility is handling the registration of ETRs. Other components handle different parts of the lookup and forwarding workflow.

Why other options are incorrect:

A. forwarding user data traffic:
This is a function of the data plane (the routers themselves), not a specific LISP mapping component. Both ITRs and ETRs forward data traffic.

B. accepting map-request messages from ITRs:
This is a function of the Map Server, not the Map Resolver. The Map Server receives map-requests from ITRs and helps resolve them by querying the Map Resolver's database.

C. finding EID-to-RLOC mappings:
While this is the overall purpose of the mapping system, the Map Resolver's primary responsibility is to store these mappings (after ETR registration). The act of "finding" is more associated with the Map Server processing map-requests.

References

LISP Architecture (RFC 6830): Map Resolvers are used for registration
Cisco LISP Configuration Guide: ETRs register their EID prefixes to the Map Resolver
LISP and LISP Mapping System Overview: Map Resolver accepts registration requests from ETRs

✅ Explanation:
In Cisco SD-Access, switches are assigned specific roles within the fabric. The two fundamental device roles are the edge node and the border node .

C. Edge Node: Serves as the first-hop connection for endpoints (users, devices, servers) . It identifies and authenticates endpoints, registers their location with the control plane node, and performs VXLAN encapsulation/decapsulation of data traffic to and from all connected endpoints .

E. Border Node: Acts as the entry and exit point for traffic moving into and out of the SD-Access fabric site . It connects external Layer 2 and Layer 3 networks to the fabric, performs VXLAN encapsulation/decapsulation, and can be configured as internal (imports external routes), external (acts as default gateway), or combined .

Why other options are incorrect:

A. access switch – This is a traditional networking term. In SD-Access, an access switch becomes either an edge node (if it participates in the fabric) or an extended node (if it extends fabric VLANs) .

B. vBond controller – This is a component of the Cisco SD-WAN architecture (orchestration plane), not the SD-Access fabric for campus networks .

D. core switch – This is a traditional networking layer, not a specific SD-Access device role. In SD-Access, the core layer may be integrated with other functions, and fabric roles (edge, border, control plane) are used to describe device functions .

🔗 References:

Cisco SD-Access Design Guide: Edge nodes connect wired endpoints; border nodes connect external L3 networks .

Cisco Live Presentation: Edge nodes provide first-hop services; border nodes are entry/exit points .

Explanation:

Layer 3 inter-controller roaming allows a wireless client to roam between Access Points connected to Wireless LAN Controllers (WLCs) located in different Layer 3 IP subnets without losing session connectivity.

Mobility Group Requirement: To enable seamless inter-controller roaming, WLCs must belong to the same mobility group. This allows the controllers to exchange mobility control messages, share client context/session information, and establish a CAPWAP mobility tunnel.

IP Address Preservation: When a client roams across a Layer 3 boundary, the original WLC becomes the Anchor Controller and the new WLC becomes the Foreign Controller. All data traffic is tunneled between them, allowing the client to maintain its original IP address dynamically and invisibly.

Why Other Options Are Incorrect:

A. Clients must obtain a new IP address when they roam between APs:
Incorrect. The primary objective of Layer 3 roaming is to keep the client's original IP address intact so ongoing active sessions (e.g., VoIP calls or active TCP sessions) are not dropped.

B. It provides seamless roaming between APs that are connected to different Layer 3 networks and different mobility groups: Incorrect. Controllers must be in the same mobility group (and configured on each other's mobility list) to trust each other, share client session data, and establish the required mobility tunnels.

C. It is only supported on controllers that run SSO:
Incorrect. Stateful Switchover (SSO) is a High Availability (HA) redundancy mechanism between a active/standby pair of controllers; it is not a prerequisite for Layer 3 roaming.

References:

Cisco Wireless Controller Configuration Guide: Understanding Mobility Groups and Layer 3 Inter-Controller Roaming.

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.2 Describe Layer 2 and Layer 3 roaming principles.

Explanation:

Web Authentication (WebAuth) is a Layer 3 authentication mechanism commonly used for guest wireless access.

Requires Client Authentication: The client device is forced to open a web browser and authenticate via a captive portal (by entering credentials, accepting a terms-of-use policy, or providing registration details).

Functions Without Encryption: Unlike WPA2/WPA3 or WEP, standard WebAuth operates over an open Layer 2 connection. The wireless data payload transmitted over the air between the client device and the Access Point remains unencrypted, even though the client is required to perform authentication at the portal layer.

Why Other Options Are Incorrect

A. open: Open authentication does not require the client to supply credentials or authenticate user identity. Any device can associate freely, and no encryption is applied.

B. WEP: Wired Equivalent Privacy mandates static Layer 2 data encryption (RC4 cipher). It cannot operate as an unencrypted authentication protocol.

D. PSK: Pre-Shared Key (WPA/WPA2/WPA3 Personal) relies on encryption (TKIP/AES/CCMP). The pre-shared key is used directly to derive dynamic encryption keys for securing over-the-air data.

References:

Cisco Wireless LAN Controller Configuration Guide: Configuring Web Authentication (Layer 3 Security).

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.3 Describe 802.11 wireless security mechanisms (Open, WEP, WPA2/WPA3 Personal/Enterprise, WebAuth).

Explanation:

MAC Authentication Bypass (MAB) is a network access control feature that uses the physical address (the MAC address) of a device as the credential to grant network access . When a device connects to a port with MAB enabled, the switch learns the device's MAC address and sends it to a RADIUS server for authentication. The RADIUS server maintains a database of authorized MAC addresses; if the MAC address is found, the server returns an Access-Accept message and the switch grants network access .

MAB was designed specifically for devices that do not support IEEE 802.1X authentication, such as printers, IP phones, cash registers, and other "dumb" terminals that cannot run 802.1X supplicant software . In this context, MAB acts as a fallback or standalone authentication method to provide controlled network access to legacy or headless endpoints.

Why other options are incorrect:

A. user access based on IP address:
This is incorrect. MAB authenticates based on the MAC address (Layer 2), not the IP address (Layer 3). IP addresses are typically used for different access control mechanisms, such as ACLs.

B. allows devices to bypass authentication:
This is incorrect. MAB does not bypass authentication; it uses an alternative authentication method. The device must still be authenticated by the RADIUS server based on its MAC address; if the MAC address is unknown or unauthenticated, network access is denied.

D. simultaneous user and device authentication:
This describes multi-domain authentication or advanced 802.1X configurations, not MAB. While some MAB implementations can support multi-auth mode , the core purpose of MAB is singular—authenticating a device based on its MAC address.

References

Cisco System Security Configuration Guide: "With MAC authentication bypass (MAB) functionality, the router... uses the MAC address of the end device or the client as an authenticating parameter for providing network access" .

Cisco Authentication Authorization and Accounting Guide: "The MAC Authentication Bypass feature is a MAC-address-based authentication mechanism that allows clients... to integrate with the Cisco IBNS and NAC strategy using the client MAC address" .

Explanation:

Physical obstacles and materials in an environment can cause severe RF signal degradation and interference for Wi-Fi networks (specifically attenuation, reflection, refraction, and absorption):

Mirrored Wall (Option C):
Mirrors have a metallic backing that acts as a strong reflector of radio frequency (RF) signals. A mirrored wall creates high signal reflection and multipath distortion, degrading signal quality and performance for Wi-Fi devices.

Fish Tank (Option D):
Water absorbs 2.4 GHz and 5 GHz radio frequencies extremely well (water attenuation). A fish tank acts as a dense physical RF barrier that heavily absorbs and blocks Wi-Fi signals passing through it.

Why Other Options Are Incorrect:

A. incandescent lights:
Incandescent light bulbs emit light via heat/filament resistance and do not generate high-frequency electromagnetic fields or radio frequency radiation that interferes with 2.4 GHz or 5 GHz Wi-Fi bands.

B. DECT 6.0 cordless phone:
DECT 6.0 cordless phones operate on the 1.9 GHz frequency band (1920–1930 MHz in North America), which is completely separate from standard Wi-Fi bands (2.4 GHz and 5 GHz) and therefore does not cause RF interference.

E. 900MHz baby monitor:
900 MHz baby monitors operate in the 900 MHz ISM band, well below the standard 2.4 GHz and 5 GHz Wi-Fi frequencies, preventing them from interfering with Wi-Fi channels.

References

Cisco Wireless Network Design Guide:
RF Fundamentals and Physical Environmental Obstacles (Attenuation, Reflection, Absorption).

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.1 Describe RF power and antenna concepts (attenuation, reflection, absorption, multipath, interference).

Explanation:

Layer 2 roaming occurs when a wireless client roams between Access Points (APs) that are on the same IP subnet . In this scenario, the client does not need to obtain a new IP address, and its security context is preserved . This provides a seamless roaming experience for the user .

Why other options are incorrect:

A. Roam to a different wireless controller that is on a different subnet and maintain the same IP address:
This describes a Layer 3 roam, not a Layer 2 roam. In a Layer 3 roam, the client moves to a different subnet and a tunnel is established between controllers to preserve the original IP address . This is not a characteristic of Layer 2 roaming.

B. Associate to a new access point on a different wireless controller and change the IP address without connectivity interruption:
Changing the IP address without interruption is not a characteristic of any standard roaming type. This option is incorrect because it describes an outcome that is not possible. During roaming, the client is either on the same subnet and retains its IP address, or it is on a different subnet and experiences some form of interruption or re-authentication.

C. Associate to a new access point on the same wireless controller and change the IP address without connectivity interruption:
This is incorrect because changing the IP address is not a characteristic of roaming on the same controller or the same subnet. When a client roams within the same subnet, its IP address is preserved.

References:

Cisco Wireless Configuration Guides: Layer 2 inter-controller roaming occurs when controllers are on the same IP subnet, and the client database entry is moved to the new controller .

Huawei WLAN Configuration Guides: In Layer 2 roaming, the service VLAN and IP address of a client remain unchanged .

Explanation:

On Cisco Catalyst 9800 Series Wireless LAN Controllers (WLCs), network parameters such as AAA Overrides, VLAN assignments, and switching policies are separated into modular profiles and tags.

AAA Override & Dynamic VLANs: To enable Cisco ISE (or any RADIUS server) to dynamically assign VLANs to authenticated users via IETF RADIUS attributes (such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID), the Allow AAA Override setting must be enabled inside the Policy Profile associated with the WLAN.

Separation from WLAN Profile: Unlike legacy AireOS controllers where AAA Override was configured directly within the WLAN/SSID settings, the Catalyst 9800 IOS-XE architecture handles client policies (VLANs, ACLs, QoS, and AAA Override) specifically inside the Policy Profile.

Why Other Options Are Incorrect:

A. interface lag:
Link Aggregation Group (LAG) aggregates physical controller ports into a single logical link for redundancy and bandwidth; it has no role in 802.1X authorization or dynamic VLAN assignment.

B. site tag:
Site Tags link APs to Join Profiles and Flex Profiles to define local AP operational settings and branch configuration, not client-level authorization policies.

C. WLAN profile:
The WLAN Profile defines layer-2 wireless properties such as the SSID name, broadcast options, and 802.1X/WPA2/WPA3 security parameters, but client-enforcement settings like dynamic VLAN overrides are defined in the Policy Profile.

References:

Cisco Catalyst 9800 Wireless Controller Configuration Guide: Configure Dynamic VLAN Assignment with ISE and Catalyst 9800 WLC (Policy Profile Settings — AAA Override).

Cisco 350-401 ENCOR Exam Topics: Section 2.0 Infrastructure — Topic 2.2 Configure and verify wireless client connectivity using Cisco Catalyst 9800 WLC (Policy Profiles, WLAN Profiles, Policy Tags).

Explanation:

VXLAN provides two key benefits: multi-tenanted segmentation and utilization of all available Layer 3 paths in the underlying network . The 24-bit VXLAN Network Identifier (VNI) supports up to 16 million isolated segments, solving the scalability limitations of VLANs and enabling secure, isolated virtual networks for multiple tenants on shared infrastructure without traffic leakage . This multi-tenant isolation is essential for cloud providers, service providers, and large enterprises managing multiple customers or departments.

VXLAN also uses all available Layer 3 paths by encapsulating Ethernet frames inside UDP packets and transmitting them across the underlay network based on the outer IP header . This enables Equal-Cost Multipath (ECMP) routing and link aggregation protocols to load-balance traffic across all available network paths, improving bandwidth utilization and network efficiency. Traditional Layer 2 networks are limited by spanning tree and cannot leverage multiple parallel paths simultaneously.

Why other options are incorrect:

A. It allows for an unlimited number of segments:
VXLAN supports up to 16 million segments, which is a massive increase over VLANs but not "unlimited." The 24-bit VNI provides scalability but has a finite limit .

B. It has fewer devices to manage:
VXLAN introduces additional components such as VTEPs and potentially a new control plane, which generally increases the number of devices to manage .

E. It uses a MAC in IP/TCP encapsulation technique:
VXLAN uses MAC-in-UDP encapsulation, not TCP. The outer header is a UDP packet (destination port 4789) . TCP would introduce session state and overhead, reducing performance and scalability.

References:

IETF RFC 7348: VXLAN uses MAC-in-UDP encapsulation and supports up to 16 million VNIs .
Cisco VXLAN Solution Guide: VXLAN leverages ECMP for efficient load balancing .
VMware NSX Documentation: VXLAN provides multi-tenancy and up to 16 million segments .

✅ Explanation:

The EEM script must trigger when an administrator saves the running configuration to the startup configuration (write mem command). The event statement event cli pattern "write mem.*" sync yes matches this command and allows the EEM applet to execute synchronously .

The script must then:
Save a copy of the running configuration to the bootflash.
Generate a critical-level syslog message.

Why this is correct:
cli command "enable": Ensures the script has sufficient privileges to execute the copy command.
file prompt quiet: Suppresses file overwrite prompts, preventing the script from hanging on interactive prompts.
copy running-config bootflash:/current_config.txt: Saves a copy of the running configuration to bootflash.
no file prompt quiet: Restores the default file prompt behavior.
syslog priority critical: Generates a critical-level syslog message as required.

Why other options are incorrect:

A. Option A: Missing enable, file prompt quiet, and syslog priority critical. The syslog message is not critical-level, and the copy command may fail due to permission issues and file prompt interactions.

B. Option B: Includes unnecessary configure terminal and end commands, and uses syslog msg without the priority critical keyword. The script is overly complex and does not meet the requirement.

D. Option D: Missing enable and file prompt quiet. The copy command may fail due to lack of privileges, and the script may hang on file overwrite prompts.

🔗 References

Cisco EEM Configuration Guide: event cli triggers on CLI commands, sync yes causes the CLI to wait for the EEM script to complete.

Cisco IOS Command Reference: file prompt quiet suppresses file overwrite prompts.