CCNP ENCOR 350-401 Practice Test

350-401 practice test: what's covered

• Architecture
• Virtualization
• Routing
• Switching
• SD-Access
• Security
• Automation

Free 350-401 sample questions

1. A campus design collapses the distribution and core into a single layer for a 200-user site. Which two-tier model does this describe and what is its primary trade-off?

   • A. Collapsed-core design that reduces device count and cost but limits horizontal scalability compared with a dedicated three-tier core
   • B. Spine-leaf design that guarantees equal-cost paths between every access switch in the building
   • C. Full three-tier hierarchy that keeps core, distribution and access as physically separate layers
   • D. Routed-access design that pushes Layer 3 boundaries all the way down to the endpoints
   Show answer

   Correct: A. A two-tier collapsed-core merges core and distribution, which lowers cost and complexity for smaller sites. It is not spine-leaf because that is a data-center topology, and it is not full three-tier because the core is not separate. Routed-access is incorrect because that refers to where the L3 boundary sits, not to collapsing layers.

2. An engineer is documenting the Catalyst SD-WAN control architecture before deployment. Which statements correctly describe the controller roles? (Choose TWO)

   • A. vSmart is the centralized control plane that distributes OMP routes and data/control policy to the fabric
   • B. vBond is the orchestrator that authenticates devices and facilitates initial NAT traversal during onboarding
   • C. vManage is the data-plane forwarder that encapsulates user traffic into IPsec tunnels
   • D. vEdge and cEdge devices act as the centralized policy decision point for the overlay
   • E. vSmart performs the graphical management and templating normally handled by the dashboard
   Show answer

   Correct: A and B. vSmart is the control plane running OMP, and vBond is the orchestrator handling onboarding and NAT traversal. The vManage option is wrong because vManage is the management/UI plane, not a data-plane forwarder, whereas the WAN Edge routers carry data. vEdge/cEdge are data-plane nodes, not policy decision points, and vSmart does not provide the GUI.

3. After enabling Cisco SD-Access in DNA Center, an engineer must explain how host traffic crosses the fabric between edge nodes. Which encapsulation and control plane combination is used?

   • A. VXLAN data-plane encapsulation with LISP providing the control-plane host-to-location mapping
   • B. MPLS label switching with LDP distributing labels across the underlay fabric
   • C. GRE tunnels with OSPF carrying the host routes between every edge node
   • D. IPsec transport mode with IKEv2 negotiating keys for each endpoint flow
   Show answer

   Correct: A. SD-Access uses VXLAN to carry overlay traffic and LISP as the control plane mapping endpoints to their location (RLOC). MPLS/LDP is a service-provider technology not used in the fabric overlay. GRE with OSPF is incorrect because the fabric does not flood host routes via an IGP, and IPsec is not the fabric overlay encapsulation here.

4. A service provider must keep two customers' overlapping 10.0.0.0/8 address spaces completely separate on the same PE router. Which technology provides this Layer 3 isolation?

   • A. VRF instances giving each customer an independent RIB and FIB on the shared router
   • B. Access VLANs that segment the customers at Layer 2 on the provider edge
   • C. Private VLANs isolating ports within a single broadcast domain
   • D. Standard ACLs filtering the overlapping prefixes between the customers
   Show answer

   Correct: A. VRFs create separate routing/forwarding tables so overlapping subnets coexist on one device. VLANs and private VLANs operate at Layer 2 and cannot separate overlapping Layer 3 routes, whereas ACLs only filter traffic and do not create independent routing tables, so they cannot resolve overlapping address space.

5. A branch needs to run OSPF and multicast across an encrypted WAN link to headquarters. Why is plain IPsec tunnel mode insufficient and what is the common remedy?

   • A. IPsec alone cannot carry multicast or dynamic routing, so GRE-over-IPsec is used to tunnel them with encryption
   • B. IPsec already forwards multicast natively, so no GRE wrapper is ever required for routing
   • C. GRE encrypts the payload on its own, making the IPsec layer redundant for this design
   • D. OSPF will run inside IPsec without GRE because IPsec treats it as unicast control traffic
   Show answer

   Correct: A. Classic IPsec does not transport multicast or routing-protocol traffic, so GRE encapsulates them and IPsec then encrypts the GRE packets. The claim that IPsec forwards multicast natively is wrong, GRE provides no encryption of its own, and OSPF uses multicast hellos that bare IPsec will not carry, so a GRE wrapper is required.

Last updated: 2026-10-19

350-401 practice test FAQ

Related practice tests

• 200-301 practice test
• 300-410 practice test
• 350-701 practice test
• 300-415 practice test
• 200-901 practice test
• JN0-106 practice test