350-401 · topic practice
Practise ENCOR 350-401 Sd Access Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Sd Access Architecture questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Applied to data traffic for SLA-based path selection
Applied to enable NetFlow-like traffic monitoring
Applied to modify forwarding, NAT, or QoS on data packets
Applied to OMP routes and TLOCs for route manipulation
Applied to define which VPNs are provisioned on a device
Drag a concept onto its matching description — or click a concept then click the description.
Predictable latency and SLA, private Layer 3 VPN
Low cost, best-effort, public IP addressing
Wireless backup, variable throughput, cellular network
High latency, global coverage, limited bandwidth
High bandwidth, low latency, metro-area Layer 2 connectivity
Trap 1: 30 seconds
Incorrect. 30 seconds is the default for NBMA networks.
Trap 2: 5 seconds
A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.
Trap 3: 40 seconds
Incorrect. 40 seconds is the default dead interval for Ethernet.
10 seconds
Correct. The default hello interval for Ethernet is 10 seconds.
30 seconds
Why wrong: Incorrect. 30 seconds is the default for NBMA networks.
5 seconds
Why wrong: A 5-second hello interval is the default for OSPF on NBMA (Non-Broadcast Multi-Access) networks, not for Ethernet. On an Ethernet broadcast multi-access link, the default hello interval is 10 seconds. This option is tempting because 5 seconds is the default for OSPF point-to-point and NBMA interfaces, so it is correct for those specific network types, but the stem explicitly specifies an Ethernet link.
40 seconds
Why wrong: Incorrect. 40 seconds is the default dead interval for Ethernet.
Trap 1: The vManage controller is the primary control plane component that…
Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
Trap 2: vEdge and cEdge routers are both control plane devices that…
Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
Trap 3: The OMP protocol runs between vManage and vSmart to exchange…
Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.
The vSmart controller is responsible for distributing OMP routes and policies to all edge devices in the SD-WAN fabric.
Correct because vSmart is the centralized control plane that uses OMP to advertise routes and apply policies.
The vBond orchestrator is responsible for authenticating and onboarding vEdge and cEdge routers into the SD-WAN overlay.
Correct because vBond provides NAT traversal and initial authentication, and directs devices to vManage and vSmart.
The vManage controller is the primary control plane component that establishes OMP sessions with all edge routers.
Why wrong: Incorrect because vManage is the management plane (NMS), not a control plane; OMP sessions are between vSmart and edge devices.
vEdge and cEdge routers are both control plane devices that participate in OMP route exchange.
Why wrong: Incorrect because vEdge and cEdge are data plane devices; they do run OMP but are not control plane components.
The OMP protocol runs between vManage and vSmart to exchange routing information and policy updates.
Why wrong: Incorrect because OMP runs between vSmart and edge devices (vEdge/cEdge), not between vManage and vSmart.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The vEdge routers have not been rebooted after the policy change.
Incorrect because policy changes take effect immediately without reboot.
Trap 2: The OMP graceful restart timer has expired, causing the vEdge to…
Incorrect because OMP graceful restart affects route convergence, not policy application.
Trap 3: The BFD sessions between vEdge and vSmart are flapping.
Incorrect because BFD is for data plane failure detection, not for policy distribution.
The vEdge routers have not been rebooted after the policy change.
Why wrong: Incorrect because policy changes take effect immediately without reboot.
The control policy is not attached to the appropriate site list or VPN list.
Correct because a control policy must be associated with a list to be applied; otherwise, it is not enforced.
The OMP graceful restart timer has expired, causing the vEdge to ignore the policy.
Why wrong: Incorrect because OMP graceful restart affects route convergence, not policy application.
The BFD sessions between vEdge and vSmart are flapping.
Why wrong: Incorrect because BFD is for data plane failure detection, not for policy distribution.
Trap 1: Type 1 hypervisors require a host OS for device drivers, while Type…
Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.
Trap 2: Type 2 hypervisors are always more secure than Type 1 because of…
The additional OS layer increases attack surface, reducing security.
Trap 3: Type 1 hypervisors cannot support hardware passthrough, but Type 2…
Both types can support hardware passthrough; Type 1 typically does it more efficiently.
Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.
This is the fundamental architectural difference.
Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.
Why wrong: Type 1 hypervisors have their own drivers; Type 2 rely on the host OS.
Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.
Why wrong: The additional OS layer increases attack surface, reducing security.
Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.
Why wrong: Both types can support hardware passthrough; Type 1 typically does it more efficiently.
Trap 1: Place the firewall interface in both VRFs using the ip vrf…
Incorrect because a single interface can only belong to one VRF.
Trap 2: Create a VLAN trunk between the switch and firewall, and assign the…
Incorrect because a VLAN cannot be in two VRFs simultaneously.
Trap 3: Use policy-based routing (PBR) in VRF DEV to forward traffic to the…
Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.
Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.
Correct because route leaking allows one VRF to use a next-hop in another VRF. A static route with the appropriate VRF and route-map can achieve this.
Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.
Why wrong: Incorrect because a single interface can only belong to one VRF.
Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.
Why wrong: Incorrect because a VLAN cannot be in two VRFs simultaneously.
Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.
Why wrong: Incorrect because PBR does not solve the VRF isolation; the firewall is in a different VRF, so the switch cannot directly forward to it without route leaking.
Drag a concept onto its matching description — or click a concept then click the description.
Generates the Network LSA and maintains full adjacencies with all routers on the segment
Monitors the DR and assumes the DR role if the DR fails
Forms full adjacencies only with the DR and BDR
Connects multiple areas and advertises inter-area routes
Redistributes external routes into OSPF
A network engineer runs the following command on Router R1:
R1# show ip access-lists
Extended IP access list 120
10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
30 deny tcp any any eq 22 (2 matches)
40 permit ip any any (10 matches)Based on this output, what can be concluded?
Trap 1: SSH access from 10.0.0.0/8 is denied.
Entry 10 permits SSH from 10.0.0.0/8.
Trap 2: All SSH traffic is permitted.
Entry 30 denies SSH from sources not in the permitted ranges.
Trap 3: The ACL has an implicit deny at the end.
Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.
SSH access from 192.168.1.0/24 would be denied.
Entry 30 denies SSH from any source not matching entries 10 or 20, so 192.168.1.0/24 would be denied.
SSH access from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits SSH from 10.0.0.0/8.
All SSH traffic is permitted.
Why wrong: Entry 30 denies SSH from sources not in the permitted ranges.
The ACL has an implicit deny at the end.
Why wrong: Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.
Trap 1: RESTCONF supports only XML encoding for data.
Incorrect because RESTCONF supports both XML and JSON encoding.
Trap 2: RESTCONF uses SSH as the transport protocol.
Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
Trap 3: RESTCONF defines its own data modeling language.
Incorrect because RESTCONF uses YANG as the data modeling language.
RESTCONF uses HTTP methods like GET, PUT, POST, and DELETE to manipulate YANG data.
Correct because RESTCONF maps HTTP methods to CRUD operations on YANG data.
RESTCONF supports only XML encoding for data.
Why wrong: Incorrect because RESTCONF supports both XML and JSON encoding.
RESTCONF uses SSH as the transport protocol.
Why wrong: Incorrect because RESTCONF uses HTTP/HTTPS, not SSH; NETCONF uses SSH.
RESTCONF provides a 'data' resource as the entry point for accessing YANG data stores.
Correct because the base URI for RESTCONF includes the 'data' resource to access configuration and state data.
RESTCONF defines its own data modeling language.
Why wrong: Incorrect because RESTCONF uses YANG as the data modeling language.
Trap 1: CoS 5, DSCP AF41
AF41 is used for video, not voice.
Trap 2: CoS 5, DSCP CS3
CS3 is lower priority than EF.
Trap 3: CoS 4, DSCP EF
CoS 4 is for video conferencing.
CoS 5, DSCP AF41
Why wrong: AF41 is used for video, not voice.
CoS 5, DSCP CS3
Why wrong: CS3 is lower priority than EF.
CoS 5, DSCP EF
CoS 5 and DSCP EF are the standard marks for voice.
CoS 4, DSCP EF
Why wrong: CoS 4 is for video conferencing.
Trap 1: Check if the syslog messages are in the correct format.
Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
Trap 2: Ensure that the switch is in the Inventory and managed by DNA…
Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
Trap 3: Restart the syslog collector service on DNA Center.
Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.
Trap 1: Use the 'when' clause to check if the switch is in the 'core' group…
While this would work, it is less efficient than directly targeting the group in the 'hosts' field.
Trap 2: Use the 'limit' option when running the ansible-playbook command to…
The 'limit' option is a runtime parameter, not a design-time feature; the question asks for a feature to use in the playbook itself.
Trap 3: Define a variable in the 'core' group and use 'vars_prompt' to ask…
vars_prompt is for interactive input, not for restricting execution to a group.
Use the 'when' clause to check if the switch is in the 'core' group using the 'group_names' variable.
Why wrong: While this would work, it is less efficient than directly targeting the group in the 'hosts' field.
Set the 'hosts' field in the play to 'core' instead of 'all'.
By setting 'hosts: core', the play will only run on switches that are members of the 'core' group.
Use the 'limit' option when running the ansible-playbook command to specify the 'core' group.
Why wrong: The 'limit' option is a runtime parameter, not a design-time feature; the question asks for a feature to use in the playbook itself.
Define a variable in the 'core' group and use 'vars_prompt' to ask the engineer which group to run on.
Why wrong: vars_prompt is for interactive input, not for restricting execution to a group.
Trap 1: The switch has not been discovered by DNA Center
The switch is in 'Managed' status, so it has been discovered.
Trap 2: The switch is not in Plug and Play mode
Plug and Play is used for initial provisioning, not post-discovery.
Trap 3: The switch does not have a valid DNA license
Licensing issues would cause different symptoms.
The switch has not been discovered by DNA Center
Why wrong: The switch is in 'Managed' status, so it has been discovered.
The switch is not in Plug and Play mode
Why wrong: Plug and Play is used for initial provisioning, not post-discovery.
The switch does not have a valid DNA license
Why wrong: Licensing issues would cause different symptoms.
The switch is not assigned to a site
Site assignment is required for template application.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: Fabric border node
The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.
Trap 2: Fabric control plane node
The control plane node maintains the LISP mapping database but does not enforce SGT policies.
Trap 3: Wireless LAN controller
The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.
Fabric border node
Why wrong: The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.
Fabric control plane node
Why wrong: The control plane node maintains the LISP mapping database but does not enforce SGT policies.
Fabric edge node
The fabric edge switch enforces SGT-based policies by applying SGACLs based on the SGT assigned by ISE during authentication.
Wireless LAN controller
Why wrong: The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.
A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:
{
"response": [
{
"deviceId": "1234567890",
"hostname": "Core-Switch-1",
"score": 8,
"overallHealth": "good",
"timestamp": 1623456789
}
],
"version": "1.0"
}The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?
Trap 1: health = response['overallHealth']
This would fail because 'overallHealth' is not a top-level key.
Trap 2: health = response['response']['overallHealth']
This would fail because 'response' contains a list, not a dictionary.
Trap 3: health = response[0]['overallHealth']
This would fail because the top-level object is a dictionary, not a list.
health = response['response'][0]['overallHealth']
Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.
health = response['overallHealth']
Why wrong: This would fail because 'overallHealth' is not a top-level key.
health = response['response']['overallHealth']
Why wrong: This would fail because 'response' contains a list, not a dictionary.
health = response[0]['overallHealth']
Why wrong: This would fail because the top-level object is a dictionary, not a list.
Trap 1: RESTCONF
RESTCONF is a protocol for model-driven APIs, not for CLI-based backup.
Trap 2: Ansible
Ansible is a configuration management tool, not a Python library.
Trap 3: Netmiko
Netmiko is a high-level library built on Paramiko, but Paramiko is the underlying SSH implementation.
RESTCONF
Why wrong: RESTCONF is a protocol for model-driven APIs, not for CLI-based backup.
Ansible
Why wrong: Ansible is a configuration management tool, not a Python library.
Paramiko
Paramiko provides SSH connectivity to network devices.
Netmiko
Why wrong: Netmiko is a high-level library built on Paramiko, but Paramiko is the underlying SSH implementation.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Sd Access Architecture sessions
Every question in these sessions is drawn from the Sd Access Architecture domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Practise 350-401 questions linked to Architecture.
Practise 350-401 questions linked to Virtualization.
Practise 350-401 questions linked to Infrastructure.
Practise 350-401 questions linked to Network Assurance.
Practise 350-401 questions linked to Security.
Practise 350-401 questions linked to Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free