Free Practice Questions for Cisco 350-401 Exam

The correct answer is B. Router A.

VRRP elects the Master (primary virtual router) based on:

Highest priority (default = 100)

If priorities are equal → highest IP address wins

Router A

IP: 192.168.0.100

Priority: default (100)

Router B

IP: 192.168.0.2

Priority: default (100)

Router C

IP: 192.168.0.3

Priority: 80

Router D

IP: 192.168.0.4

Priority: 70

Compare priorities:

A = 100

B = 100

C = 80

D = 70

→ Highest priority = 100 (A and B tie)

Tie-breaker → Highest IP address:

Router A = 192.168.0.100

Router B = 192.168.0.2

→ 192.168.0.100 is higher

Router A becomes the VRRP Master (primary virtual router).

Router B Same priority as A but lower IP address

Router C Lower priority (80)

Router D Lowest priority (70)

VRRP Election Rule:

Highest Priority → Highest IP (tie-breaker)

Default priority = 100, so always check:

Who changed priority?

If equal → compare interface IPs

The status code shown in the exhibit is HTTP 403, which means the server understood the request but refused to authorize it. This is different from a missing resource, unreachable server, or state conflict. Option D is correct because a 403 Forbidden response indicates that access was denied due to authorization, permission, policy, or authentication-context restrictions. Option A describes a 410 Gone condition, where the resource is no longer available. Option B is not represented by a 403; unreachable resources normally produce network errors, timeouts, DNS issues, or gateway-level errors. Option C aligns more closely with HTTP 409 Conflict, which indicates the request conflicts with the current state of the resource. In API troubleshooting, reading the response code accurately matters. 401 usually means authentication is required or failed, while 403 means the client is recognized or the request is understood, but access is not allowed. The ENCOR automation focus is interpreting REST API status codes correctly during controller, network assurance, and programmability workflows. References/topics: ENCOR Automation, REST APIs, HTTP response codes, API authorization, 403 Forbidden, controller API troubleshooting.

The correct answer is C. Data.

Cisco SD-WAN architecture is divided into three main planes:

Management Plane

Handled by vManage

Used for configuration and monitoring

Control Plane

Handled by vSmart (OMP protocol)

Responsible for routing information exchange and policy distribution

Data Plane

Built using IPsec tunnels between WAN Edge devices

Responsible for forwarding actual user/application traffic between sites

The data plane is the plane that:

Carries user traffic

Transports data between SD-WAN sites

Uses secure tunnels (IPsec) for communication

A. IPsec IPsec is a technology used within the data plane, not a plane itself.

B. Management Used for configuration and orchestration, not traffic forwarding.

D. Control Used for routing and policy decisions, not actual traffic transport.

Memorize SD-WAN planes:

Management Plane → vManage (configuration)

Control Plane → vSmart (routing/policy via OMP)

Data Plane → IPsec tunnels (user traffic transport)

User traffic = Data Plane

The correct answer is A. client.

In Cisco 802.1X / network admission control terminology, the supplicant is the endpoint device or client software requesting access to the network. Cisco documentation describes 802.1X as a client-server access control model in which the client must be authenticated before gaining ac cess, and the network device relays authentication messages between the supplicant and the authentication server.

Client = Supplicant

SW1 = Authenticator

RADIUS server = Authentication server

R1 = transit/network infrastructure device, not the supplicant

The supplicant is the device that is trying to join the network and provide credentials. In the diagram, that is the client. Cisco also defines the three 802.1X entities as supplicant system, authentication system, and authentication server system, with the supplicant being the endpoint such as a PC.

B. SW1 SW1 functions as the authenticator, controlling access to the network port and relaying EAP messages.

C. RADIUS server The RADIUS server is the authentication server, not the supplicant.

D. R1 R1 is part of the network path in the figure, but it is not the device requesting admission to the network.

ENCOR exam point:

For 802.1X / NAC questions, remember this trio:

Supplicant = endpoint/client

Authenticator = switch or AP controlling access

Authentication server = RADIUS / Cisco ISE

The correct answer is C. The data plane is based on VXLAN.

In Cisco SD-Access, the fabric uses:

LISP for the control plane

VXLAN for the data plane

Cisco TrustSec / SGT-based policy for the policy plane

Cisco documentation explicitly states that SD-Access uses a LISP-based control plane and a VXLAN-based data plane.

VXLAN is the encapsulation technology used to transport user traffic across the SD-Access fabric overlay. This is why the data plane in Cisco SD-Access is based on VXLAN.

A. Dynamic routing is used to discover and provision border and edge switches. Dynamic routing may exist in the underlay, but it is not what “discovers and provisions” border and edge nodes in SD-Access. Provisioning is handled through Cisco DNA Center / Cisco Catalyst Center, not by dynamic routing itself.

B. The control plane is based on VXLAN. This is incorrect because the control plane in SD-Access is based on LISP, not VXLAN.

D. GRE is used as the policy plane. This is incorrect because the policy plane in SD-Access is based on TrustSec/SGT-based policy, not GRE.

ENCOR exam point:

Memorize this SD-Access mapping:

Control plane = LISP

Data plane = VXLAN

Policy plane = Cisco TrustSec / SGT