Cisco 350-401: Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1Network Infrastructure

   A wireless engineer deploys access points in a campus and wants clients to roam between APs without dropping sessions. Which capability supports fast roaming between APs managed by the same controller?

   1. AGiving every AP its own SSID so clients must reassociate on each move
   2. BFast secure roaming with 802.11r and controller-managed mobility
   3. CTurning off DHCP on the controller so clients need static IP addresses
   4. DDisabling the WLAN on every AP but one so clients remain tied to a single AP
   Show answer and explanationHide answer

   Correct answer: B

   Fast transition (802.11r) and controller-managed mobility reduce roaming delay between APs. Disabling WLANs, unique SSIDs per AP and DHCP removal do not support roaming.

2. Question 2Network Architecture

   A campus network uses a three-tier design. Which layer is responsible for aggregating access switches and applying policies such as routing and QoS between buildings?

   1. AWireless controller layer
   2. BCore layer only
   3. CAccess layer
   4. DDistribution layer
   Show answer and explanationHide answer

   Correct answer: D

   The distribution layer aggregates access switches and applies policy, filtering and routing between segments. Access switches connect end devices, and the core focuses on high-speed transport.

3. Question 3Security Fundamentals

   A switch must allow only authorized devices to connect to a port and must shut down the port if an unauthorized device connects. Which feature achieves this?

   1. ADisabling the port permanently with no err-disable recovery configured
   2. BAllowing unlimited MAC addresses on the port with no maximum limit configured per VLAN
   3. CPort security with a sticky MAC address and a violation action of shutdown
   4. DUsing a hub instead of the switch so attached hosts share one collision domain
   Show answer and explanationHide answer

   Correct answer: C

   Port security with sticky MACs and a shutdown violation action restricts access and reacts to unauthorized devices. Allowing all MACs, permanent disabling and hubs do not meet the requirement appropriately.

4. Question 4Virtualization

   A company wants to run multiple logical networks over the same physical infrastructure for different departments, with isolation at Layer 2. Which technology is most suitable?

   1. AVLANs
   2. BStatic routes only
   3. CSpanning Tree on every port
   4. DNAT overload
   Show answer and explanationHide answer

   Correct answer: A

   VLANs create logical Layer 2 segments on shared infrastructure. Static routes do not isolate Layer 2 domains, NAT addresses translation, and STP prevents loops rather than segmenting.

5. Question 5Network Assurance

   A network team wants to see which applications are consuming bandwidth on a WAN link and which hosts are the top talkers, without capturing all packets. Which technology is best suited?

   1. AA ping sweep
   2. BA printer log
   3. CNetFlow or IPFIX flow records
   4. DA packet capture on every host
   Show answer and explanationHide answer

   Correct answer: C

   NetFlow or IPFIX summarize flows, showing top talkers and application usage without full packet capture. Full captures are heavy, ping sweeps show reachability, and printer logs are unrelated.