Free Cisco 350-401 ENCOR practice questions

10 free Cisco 350-401 ENCOR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 1,066 questions. Work through them, then open each answer to check your reasoning.

Get all 1,066 questions (US$39) · Download these 10 as a PDF

Question 1

What is the difference between a RIB and a FIB?

  1. The FIB is populated based on RIB content.
  2. The RIB maintains a mirror image of the FIB.
  3. The RIB is used to make IP source prefix-based switching decisions.
  4. The FIB is where all IP routing information is stored.
Show answer and explanation

Correct answer: A. The FIB is populated based on RIB content.

The RIB (Routing Information Base) is the control plane routing table that stores all routing information learned from routing protocols. The FIB (Forwarding Information Base) is derived from the RIB and is used by the data plane for actual packet forwarding decisions. The FIB is populated based on the best routes selected from the RIB, making A the correct answer.

Why the other options are wrong

  • B. The FIB does not maintain a mirror image of the RIB; rather, the RIB contains more routing information than what appears in the FIB, which only holds the best routes.
  • C. The RIB is not used for switching decisions; the FIB performs the actual forwarding based on IP prefix lookups.
  • D. The RIB, not the FIB, is where all routing information is stored; the FIB only contains selected best routes for forwarding.

Question 2

Which QoS component alters a packet to change the way that traffic is treated in the network?

  1. policing
  2. classification
  3. marking
  4. shaping ✅Correct Answer: C, marking Marking is the QoS component that alters packets by setting fields such as DSCP, IP Precedence, or CoS to indicate how the traffic should be treated. This change is written into the packet itself so that downstream devices can classify and handle the traffic according to the marked priority.
Show answer and explanation

Answer and explanation for question 2

Question 3

Which statement about Cisco Express Forwarding is true?

  1. The CPU of a router becomes directly involved with packet-switching decisions.
  2. It uses a fast cache that is maintained in a router data plane.
  3. It maintains two tables in the data plane: the FIB and adjacency table.
  4. It makes forwarding decisions by a process that is scheduled through the IOS scheduler.
Show answer and explanation

Correct answer: C. It maintains two tables in the data plane: the FIB and adjacency table.

adjacency table. CEF operates in the data plane and maintains two key tables: the FIB (Forwarding Information Base) for IP lookups and the adjacency table for next-hop information. These tables enable fast, hardware-based forwarding decisions without CPU involvement, which is the core benefit of CEF.

Why the other options are wrong

  • A. CEF is designed to remove CPU involvement in packet switching; forwarding decisions are made in the data plane without CPU intervention.
  • B. CEF does not use a cache; it uses the FIB and adjacency tables, which are deterministic lookup structures rather than cache-based.
  • D. CEF makes forwarding decisions through distributed, hardware-based lookups in the data plane, not through IOS scheduler-based processes.

Question 4

What is a benefit of deploying an on-premises infrastructure versus a cloud infrastructure deployment?

  1. ability to quickly increase compute power without the need to install additional hardware
  2. less power and cooling resources needed to run infrastructure on-premises
  3. faster deployment times because additional infrastructure does not need to be purchased
  4. lower latency between systems that are physically located near each other
Show answer and explanation

Correct answer: D. lower latency between systems that are physically located near each other

located near each other Lower latency between physically co-located systems is a key benefit of on-premises infrastructure. When systems are located near each other in the same data center, network latency is minimized compared to cloud deployments where resources may be geographically distributed or remotely hosted.

Why the other options are wrong

  • A. This is a benefit of cloud infrastructure, not on-premises; cloud allows rapid scaling without physical hardware installation.
  • B. On-premises deployments typically require more power and cooling resources than cloud, as you maintain all hardware yourself.
  • C. Cloud deployments enable faster deployment times; on-premises requires purchasing and installing physical hardware first.

Question 5

How does QoS traffic shaping alleviate network congestion?

  1. It drops packets when traffic exceeds a certain bitrate.
  2. It buffers and queues packets above the committed rate.
  3. It fragments large packets and queues them for delivery.
  4. It drops packets randomly from lower priority queues.
Show answer and explanation

Correct answer: B. It buffers and queues packets above the committed rate.

rate. Traffic shaping alleviates congestion by buffering and queuing packets that exceed the committed rate, delaying them rather than dropping them immediately. This smooths traffic flow and prevents sudden bursts from overwhelming network links, allowing congestion to be managed gracefully.

Why the other options are wrong

  • A. Dropping packets that exceed a rate is a characteristic of policing, not shaping; shaping buffers excess traffic instead.
  • C. Traffic shaping does not fragment packets; it queues whole packets to regulate their transmission rate.
  • D. Randomly dropping packets based on priority describes WRED congestion avoidance, not shaping.

Question 6

An engineer is describing QoS to a client.

Which two facts apply to traffic policing? (Choose two.)

  1. Policing should be performed as close to the source as possible.
  2. Policing adapts to network congestion by queuing excess traffic.
  3. Policing should be performed as close to the destination as possible.
  4. Policing drops traffic that exceeds the defined rate.
  5. Policing typically delays the traffic, rather than drops it.
Show answer and explanation

Correct answer: A, D

A. Policing should be performed as close to the source as possible. D. Policing drops traffic that exceeds the defined rate. Policing should be applied as close to the traffic source as possible to prevent non- compliant traffic from entering the network early. Policing also drops traffic that exceeds the defined rate limit, unlike shaping which buffers excess traffic. These are fundamental characteristics of rate enforcement in QoS.

Why the other options are wrong

  • B. Policing does not queue excess traffic; that is the function of shaping. Policing enforces hard rate limits by dropping traffic.
  • C. Policing should be performed at the source, not the destination, to prevent unwanted traffic from traversing the network.
  • E. Policing drops excess traffic rather than delaying it; delaying traffic is the function of shaping, not policing.

Question 7

Which component handles the orchestration plane of the Cisco SD-WAN?

  1. vBond
  2. vSmart
  3. vManage
  4. WAN Edge
Show answer and explanation

Correct answer: A. vBond

The vBond controller handles the orchestration plane in Cisco SD-WAN. It is responsible for device authentication, certificate management, and orchestrating the control connections between vSmart controllers and WAN edge devices. The vBond enables the overlay network to function properly.

Why the other options are wrong

  • B. vSmart is the control plane component that maintains routing policies and establishes control connections with edge devices.
  • C. vManage is the management and analytics plane component for monitoring and configuring the SD-WAN deployment.
  • D. WAN Edge represents the data plane devices that forward traffic according to policies learned from the control plane.

Question 8

What are two device roles in Cisco SD-Access fabric? (Choose two.)

  1. edge node
  2. vBond controller
  3. access switch
  4. core switch
  5. border node
Show answer and explanation

Correct answer: A, E

A. edge node E. border node In Cisco SD-Access, edge nodes and border nodes are defined fabric roles. Edge nodes connect endpoints to the fabric; border nodes connect the fabric to external networks. Other roles include control plane nodes, intermediate nodes, and fabric wireless controllers and APs. Access and core switch are traditional campus terms.

Why the other options are wrong

  • B. vBond is an SD-WAN orchestration component, not an SD-Access fabric role.
  • C. Access switch is a traditional campus term; the edge node connects endpoints.
  • D. Core switch is a traditional campus term; in the fabric, transit devices are intermediate nodes.

Question 9

What is the role of the vSmart controller in a Cisco SD-WAN environment?

  1. It performs authentication and authorization.
  2. It manages the control plane.
  3. It is the centralized network management system.
  4. It manages the data plane.
Show answer and explanation

Correct answer: B. It manages the control plane.

The vSmart controller is the centralized control plane component in Cisco SD-WAN that manages all control plane functions, including policy distribution, routing decisions, and network intelligence. It communicates with WAN Edge nodes to direct how they should forward traffic and handle network operations.

Why the other options are wrong

  • A. Authentication and authorization are handled by other components like vManage and ISE, not vSmart.
  • C. While vSmart is centralized, it specifically manages the control plane, not the overall network management system (that role belongs to vManage).
  • D. The data plane is managed by WAN Edge nodes; vSmart manages the control plane.

Question 10

When a wired client connects to an edge switch in a Cisco SD-Access fabric, which component decides whether the client has access to the network?

  1. edge node
  2. Identity Services Engine
  3. RADIUS server
  4. control-plane node
Show answer and explanation

Correct answer: B. Identity Services Engine

In Cisco SD-Access, the Identity Services Engine (ISE) is the policy decision point that performs authentication, authorization, and accounting for all devices connecting to the fabric, including wired clients connecting through edge switches. ISE evaluates the client's identity and applies appropriate network access policies.

Why the other options are wrong

  • A. The edge node forwards traffic but does not make access control decisions.
  • C. RADIUS is an authentication protocol that ISE may use, but ISE itself is the decision- making component.
  • D. The control-plane node manages fabric control functions but does not directly authorize individual client access.

That was 10 of 1,066.

The full Cisco 350-401 ENCOR pack has all 1,066 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack