Free 350-401 Practice Test Questions 2026

✅ Explanation:

A 404 response code indicates that the client made a request for a resource that does not exist on the server. The 404 status code is part of the 4xx class of HTTP status codes, which specifically denote client errors, meaning the request cannot be fulfilled due to an apparent issue on the client's side.

In the context of the Cisco DNA Center REST API, receiving a 404 error when sending a POST request to /dna/intent/api/v1/template-programmer/project typically indicates that the URL endpoint is incorrect, the API path has changed, or the resource you are trying to interact with does not exist at that specific path.

Why other options are incorrect:

B. The server has not implemented the functionality that is needed to fulfill the request:
This is incorrect. A 501 (Not Implemented) status code indicates this scenario, where the server does not support the functionality required to fulfill the request. The 404 error specifically relates to a missing resource, not missing server functionality.

C. The request accepted for processing, but the processing was not completed:
This is incorrect. A 202 (Accepted) status code indicates that the request has been accepted for processing, but the processing has not been completed. The 404 error is a final response indicating the resource was not found.

D. The POST/PUT request was fulfilled and a new resource was created:
This is incorrect. A 201 (Created) status code indicates that the request was fulfilled and a new resource was created. The 404 error is a client error response, not a success response.

🔗 References

Cisco DNA Center API Documentation: Confirms the endpoint structure for template programmer uses /dna/intent/api/v1/template-programmer/project.

HTTP Status Codes (RFC 7231): Defines 404 as "Not Found" indicating the server cannot find the requested resource.

✅ Explanation:

A defining characteristic of an AP operating in Mobility Express mode is that it requires an AP to act as a Wireless LAN Controller (WLC). The Cisco Mobility Express solution is designed to eliminate the need for a separate, dedicated hardware controller . Instead, the WLC functionality is built into the software of a supported 802.11ac Wave 2 or newer Cisco Aironet access point .

This primary AP, also called the master AP, runs the software-based controller and manages all other subordinate APs in the network, while simultaneously serving clients . This makes it a cost-effective and simplified solution specifically tailored for small to medium-sized deployments .

Why other options are incorrect:

A. It is recommended for large scale deployments.
Incorrect. Cisco explicitly designed Mobility Express for small to mid-sized environments, with a recommended limit of up to 25 access points per controller, though later versions support up to 100 . It is not intended for large-scale enterprise deployments.

B. It requires a centralized WLC.
Incorrect. The core value proposition of Mobility Express is that it does not require a centralized, dedicated WLC appliance, as the controller function is embedded in one of the APs .

C. At least three APs are needed for WLC redundancy.
Incorrect. While the solution does support high availability through an automatic failover process, only two master-capable APs are required for redundancy . The election process, based on VRRP, can designate a backup master AP when the primary one fails .

🔗 References

Cisco Mobility Express Overview: The solution comprises at least one access point with an in-built software-based wireless controller .

Mobility Express Solution Introduction: The solution is designed for small to mid-sized businesses and does not require a dedicated controller appliance .

Explanation:

The weighted load-balancing method is specifically designed to support environments where members of a GLBP group have different throughput capabilities, as it allows you to assign different weights to each router . The Active Virtual Gateway (AVG) uses these configured weight values to determine how much traffic to direct to each router , ensuring that higher-capacity routers handle a proportionally larger share of the load. For example, if one router has double the forwarding capacity of another, its weighting value should be configured to be double that of the other router .

Why other options are incorrect:

A. host dependent:
This method ensures that a particular host always uses the same virtual forwarder (router) for the duration of its session . It is useful for applications like stateful Network Address Translation (NAT) that require a consistent path , but it does not support unequal load balancing based on different capacities.

C. least connection:
This is a load-balancing algorithm commonly used by application load balancers (like NGINX or HAProxy) to distribute traffic based on the fewest active connections. It is not a supported load-balancing method in GLBP.

D. round robin:
This is the default GLBP method where the AVG cycles through the available routers, assigning a new virtual MAC address to each new ARP request in turn . It assumes equal capacity across all routers and does not account for different throughput capabilities .

🔗 References

Cisco GLBP Command Reference: The weighted method is explicitly for unequal load balancing when devices in the GLBP group have different forwarding capacities .

Cisco GLBP Load Balancing Options: Confirms that the Weighted method is used when there are disparities in gateway capabilities .

✅ Explanation:

The Reverse Path Forwarding (RPF) check is a fundamental mechanism in multicast routing used to prevent loops . When a router receives a multicast packet, it performs an RPF check on the packet's source IP address. The router looks up the path to that source in its routing table and verifies that the packet arrived on the interface that is on the optimal return path. If it did, the packet passes the RPF check and is forwarded; if not, the packet is dropped .

Implementing static mroutes (E):
A static mroute (multicast route) is a special static route that influences only the RPF check, not the unicast forwarding table . It tells the router, "For RPF purposes, consider this specific interface as the return path to that source" . This overrides the unicast routing table for the RPF check, allowing the packet to pass without changing how unicast traffic is routed.

Implementing MBGP (C):
Multiprotocol BGP (MBGP) is an extension of BGP that can carry separate routing information for unicast and multicast topologies . When MBGP is configured, it can populate a dedicated multicast RPF table with routes that may differ from the unicast routing table . The router then uses this separate table for RPF checks, ensuring the check passes without modifying the unicast routing table.

Why other options are incorrect:

A. disabling the interface of the router back to the multicast source:
This would remove the path to the source entirely, likely breaking connectivity and routing, which is not a valid or recommended solution to address an RPF check failure.

B. disabling BGP routing protocol:
Disabling BGP would affect both unicast and multicast routing, significantly altering the network's routing behavior. This is not a targeted solution for the RPF check and would change the unicast routing table.

D. implementing OSPF routing protocol:
OSPF is a unicast routing protocol that contributes to the unicast routing table. It is already part of the standard routing environment. While OSPF could be used to change the unicast routing table, this would violate the question's premise of not changing the unicast routing table. It does not provide a separate RPF table.

🔗 References

Cisco Learning Network Discussion: Explains that static mroutes are an acceptable method to override RPF check results without affecting unicast routing, while MBGP is a more advanced solution for Service Provider environments .

✅ Explanation:

The code snippet establishes an SSH connection to a Cisco Nexus device using the netmiko Python library. Here's a breakdown of each component:

manager.connect(): This is the netmiko method used to initiate a connection to a network device.
host=192.168.0.1, port=22: Specifies the device IP address and SSH port (default 22).
username='admin', password='password1': Provides the credentials for authentication.
hostkey_verify=True: Enables SSH host key verification for security.
device_params={'name':'nexus'}: Specifies the device type as Cisco Nexus, which tells netmiko which device driver to use.

with manager.connect(...) as m: This is a context manager. It ensures that the SSH connection is automatically closed when the code block exits, even if an exception occurs.

This code does not retrieve an API token or open a tunnel; it simply creates a direct SSH session using standard username/password authentication. The host key verification is enabled (hostkey_verify=True), so it will verify the host key against the known_hosts file; it does not use an SSH key for authentication.

Why other options are incorrect:

A. It creates a temporary connection to a Cisco Nexus device and retrieves a token to be used for API calls:
Incorrect. Netmiko is used for SSH CLI-based management, not for retrieving API tokens. Token-based authentication is typically used with REST APIs, not netmiko.

B. It opens a tunnel and encapsulates the login information, if the host key is correct:
Incorrect. While SSH does encrypt the session (providing a secure tunnel), the code specifically creates a standard SSH connection for CLI access. The hostkey_verify=True parameter verifies the host key, but this is not the primary function of the code.

D. It creates an SSH connection using the SSH key that is stored, and the password is ignored:
Incorrect. The code explicitly provides a password (password='password1') as the authentication method. It does not reference or use an SSH key.

🔗 References

Netmiko Documentation:
Netmiko is a multi-vendor Python library that simplifies SSH connections to network devices and is used for sending CLI commands.

Context Manager (with statement):
In Python, the with statement creates a context that ensures the connection is properly closed after use.

✅Explanation:

The correct answer is A. on the first-hop fabric edge switch.

The AP acts as a fabric endpoint; it encapsulates client traffic into a VXLAN tunnel, but the tunnel's termination point is the adjacent fabric edge switch . This is called an "access tunnel" and is a key enabler of distributed wireless forwarding in SD-Access .

The AP performs initial VXLAN encapsulation, and the first-hop edge node performs decapsulation and policy enforcement. This design enables consistent wired and wireless policy and improved scalability .

Why other options are incorrect:

B. on the WLC node:
The WLC handles management plane traffic (image, licensing, RRM) via CAPWAP, not the data plane. In "fabric mode," the AP uses CAPWAP only for control, not for data encapsulation .

C. on the fabric border node switch:
The border node handles traffic exiting the fabric, but the first-hop edge switch receives and processes the VXLAN traffic from the AP.

D. directly on the fabric APs:
The AP originates the VXLAN tunnel but does not terminate it. It encapsulates client traffic, not decapsulate.

🔗 References
Cisco Live: "Fabric APs ... encapsulate wireless user traffic into the VXLAN-based overlay to their adjacent fabric edge node where it is decapsulated" .

Cisco Support Docs: "An access-tunnel ... is a VXLAN tunnel established between fabric edge nodes and Access Points (APs)" .

Explanation:

MACsec provides Layer 2 encryption for Ethernet frames, securing traffic between directly connected devices on a LAN. In a multilayered network design, this makes it ideal for protecting critical infrastructure links, including Layer 2 trunk links between switches .

Why Other Options Are Incorrect

A. There is no requirement to run IEEE 802.1X when MACsec is enabled on a switch port.
While MACsec can use pre-shared keys, the IEEE 802.1AE standard typically uses 802.1X for authentication and the MACsec Key Agreement (MKA) protocol for key management . MACsec and 802.1X are complementary; MACsec doesn't remove the need for it.

C. Application flows between hosts on the LAN to remote destinations can be encrypted.
MACsec is a hop-by-hop security protocol securing a specific link between two directly connected devices, not an end-to-end encryption solution for application flows . Encryption is terminated and re-established at each hop. Remote destinations across a WAN require different security protocols like IPsec.

D. Layer 3 links between switches can be secured.
While MACsec can be applied to Layer 3 subinterfaces to secure communications between subnets, its fundamental operation is at Layer 2 of the OSI model . The primary benefit in a multilayered LAN network design is securing the physical infrastructure links, which are often Layer 2 trunks.

🔗 References

Cisco MACsec Configuration Guide: Defines MACsec as a Layer 2 security technology that encrypts and authenticates traffic on Ethernet links .

IEEE 802.1AE Standard: Confirms MACsec provides hop-by-hop Layer 2 security for LAN connections, protecting each physical or logical link

✅Explanation:

A primary design justification for a distributed WLC deployment is to contain CAPWAP tunnels within the local building, thereby avoiding latency concerns that can arise when these tunnels traverse the campus core network . In a distributed model, the WLC is placed at the building distribution layer, keeping AP-to-WLC communication local .

Why other options are incorrect

A. It reduces the number of WLCs that network administrators must support by locating them in a common location.
This describes a centralized deployment model, which reduces the number of locations for WLCs but does not reduce the number of WLCs required .

B. It more evenly distributes MAC ARP and ND processing over multiple switches which helps with scalability.
While distributed WLCs can help distribute processing, the primary scalability concern addressed is scaling the number of wireless clients beyond 25,000, not distributing MAC/ARP/ND processing . The distributed model keeps these tables local to the building, reducing the load on the core network.

C. The number of wireless clients is low and the size of the physical campus is small.
This describes a scenario where a centralized deployment model would be sufficient. Distributed models are typically justified for larger campuses (more than 25,000 clients) . For small campuses, centralized WLCs are recommended .

🔗 References
Cisco Enterprise Mobility Design Guide: WLC Location section details centralized vs. distributed deployment models and their justifications .

Cisco Wireless Design Best Practices: Distributed WLC architecture for large campuses to keep CAPWAP tunnels local .

✅ Explanation:

Clustering is the Cisco NGFW deployment option that provides scalability. Clustering allows you to group multiple firewall units (physical or virtual) together into a single logical device . This configuration offers key advantages for scalability:

Increased Throughput: By combining the processing power of multiple nodes, the cluster's total throughput scales. For example, a cluster of four Firepower 3140 units can achieve a combined NGFW throughput of 144 Gbps .

Elastic Scalability: The number of nodes in a cluster can be expanded to meet growing demands. Secure Firewall Threat Defense Virtual (FTDv) supports dynamic scaling (autoscale) in cloud environments, where nodes can be automatically added or removed based on traffic metrics like CPU and memory utilization .

Virtualization Support: Clustering is supported on physical platforms (e.g., Firepower 4100/9300 series) and virtual platforms (e.g., FTDv) , providing flexibility for various deployment scenarios.

High Performance: The architecture is designed to handle high-throughput environments, with support for up to 16 nodes in a cluster .

Why other options are incorrect:

A. tap:
A "tap" deployment mode (or passive/inline tap) is used for monitoring traffic, not for scalability .

B. inline tap:
This is a monitoring mode used for traffic inspection without blocking . It does not scale throughput or add capacity.

C. high availability:
HA provides redundancy (failover protection) using an active/standby or active/active model, but it generally does not combine throughput for increased capacity. Clustering provides both scalability and redundancy .

🔗 References

Cisco DevNet: "Clustering lets you group multiple threat defense units together as a single logical device... achieving the increased throughput and redundancy of multiple devices" . Cisco Secure Firewall Clustering sizing guide: "cluster of 4x 3140 has NGFW maximum throughput of 144Gbps" .

✅ Explanation:

The correct answer is A. RF tag .
In Cisco wireless deployments, tags are used to define and organize APs based on specific operational characteristics. The RF tag (Radio Frequency tag) is specifically designed to define the roaming domain and RF properties of an AP deployment . This tag is critical for managing how APs operate within the wireless network and how clients roam between them .

Why other options are incorrect:

B. policy tag:
A policy tag is used to define and apply security and access policies to APs, such as 802.1X authentication, guest access policies, or VLAN assignments. It does not define the roaming domain or RF properties of an AP deployment.

C. site tag:
A site tag is used in web development and content management systems to identify a specific website or site context for targeting operations. It is not used in Cisco wireless deployments to define AP roaming domains .

D. AP tag:
In broader IT contexts, "AP tag" can refer to any general-purpose label assigned to an AP for identification or grouping purposes, but it is not the specific tag type that defines roaming domains and RF properties in Cisco wireless deployments.

🔗 References

Cisco Wireless 9177 Series Access Points Data Sheet: Mentions RF tags in the context of AP management and deployment properties .

Cisco Wireless Solution Design Guide: Defines RF tags as the mechanism for assigning RF profiles and roaming policies to APs.

Explanation:

In the Cisco SD-WAN architecture, vManage (recently rebranded as Cisco Catalyst SD-WAN Manager) serves as the centralized management plane . It is the "single pane of glass" that provides a unified dashboard for all Day 0, Day 1, and Day 2 operations , including device onboarding, provisioning, policy creation, monitoring, and troubleshooting .

Why other options are incorrect:

A. vBond:
This is the orchestration plane component. It is responsible for the initial authentication of devices and facilitating their discovery of the other controllers (vManage and vSmart) .

B. vEdge:
This represents the data plane. These are the edge routers that forward user traffic, build secure IPsec tunnels, and apply policies like QoS and firewall . They do not provide centralized management.

C. vSmart:
This is the control plane component. It acts as the "brain" of the SD-WAN routing, exchanging routes and policy information with edge devices using the Overlay Management Protocol (OMP), but it does not carry user data or serve as a management interface .

🔗 References

Cisco Press Article: Describes SD-WAN Manager (vManage) as a network management system that provides a "single pane of glass" to manage Catalyst SD-WAN .

Cisco Documentation: States that "vManage is the management plane for the overall SDWAN solution" .

Explanation :

Here's why this meets all the requirements for the new 6 GHz-only SSID:

802.11ax Support: The 6 GHz band is exclusively for Wi-Fi 6E and Wi-Fi 7 devices, which are based on the 802.11ax standard .

Certificate Authentication: WPA3 Enterprise uses 802.1X authentication, which supports certificate-based authentication via protocols like EAP-TLS .

6 GHz Requirement: The 6 GHz band mandates WPA3 and does not support WPA2 for security and management frame protection (PMF) reasons .

Why other options are incorrect:

A. WPA2 Enterprise:
This is incorrect because the 6 GHz band does not support WPA2. It requires WPA3. The security settings for a 6 GHz SSID must be WPA3 only; mixed WPA2/WPA3 modes are not permitted .

B. WPA3 Personal:
While this provides the required WPA3 security for 6 GHz, it uses SAE (Simultaneous Authentication of Equals) with a pre-shared key (password) for authentication . This does not meet the requirement of authenticating all users using a certificate.

C. WPA2 Personal:
This is incorrect. WPA2 is not supported on the 6 GHz band, and it also does not provide the certificate-based authentication required by the scenario.

🔗 References

Cisco Documentation: States that WPA3 and OWE are mandatory for Wi-Fi 6E (6 GHz) and that WPA2 is not supported on this band .

Cisco Wireless Best Practices: Confirms that 6 GHz operation requires enabling WPA3 and disabling WPA2 .