How should I use these Cisco DNA Center practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Cisco DNA Center questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cisco DNA Center domain.

350-401 · topic practice

Cisco DNA Center practice questions

Practise ENCOR 350-401 Cisco DNA Center practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cisco DNA Center

Practice 10 questions Browse domain →

What the exam tests

What to know about Cisco DNA Center

Cisco DNA Center questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Cisco DNA Center exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Cisco DNA Center questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full network assurance explanation →

A network engineer is deploying Cisco DNA Center in a large campus network with 5000+ devices. After initial setup, the engineer notices that the Assurance module is not receiving telemetry data from many access switches. The switches are running IOS-XE 16.12 and are reachable via SNMP. What is the most likely cause of this issue?

Trap 1: The DNA Center appliance is not licensed for the Assurance module.

Incorrect because licensing affects feature availability, but the scenario describes the module not receiving data, not being unavailable.

Trap 2: The switches are not running the correct IOS-XE version for DNA…

Incorrect because IOS-XE 16.12 is supported for DNA Center, and the issue is specific to telemetry, not compatibility.

Trap 3: The SNMP community string is incorrect on the switches.

Incorrect because the engineer states the switches are reachable via SNMP, so SNMP is working; the issue is lack of telemetry.

Study all Cisco DNA Center common traps →

A
The switches are not configured with NETCONF/YANG or telemetry streaming.
Correct because Assurance requires telemetry streaming (e.g., model-driven telemetry) from devices; SNMP alone is insufficient.
B
The DNA Center appliance is not licensed for the Assurance module.
Why wrong: Incorrect because licensing affects feature availability, but the scenario describes the module not receiving data, not being unavailable.
C
The switches are not running the correct IOS-XE version for DNA Center compatibility.
Why wrong: Incorrect because IOS-XE 16.12 is supported for DNA Center, and the issue is specific to telemetry, not compatibility.
D
The SNMP community string is incorrect on the switches.
Why wrong: Incorrect because the engineer states the switches are reachable via SNMP, so SNMP is working; the issue is lack of telemetry.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is using Cisco DNA Center to automate the deployment of a new VLAN across multiple access switches. The engineer creates a new network profile with the VLAN definition and assigns it to a site. However, after provisioning, the VLAN is not created on any of the switches. The engineer verifies that the devices are in the Inventory and are reachable. What is the most likely cause?

Trap 1: The VLAN ID conflicts with an existing VLAN on the switches.

Incorrect because DNA Center would report a conflict during provisioning, but the VLAN was never created, indicating the configuration was not pushed.

Trap 2: The switches do not support the VLAN ID range.

Incorrect because most switches support standard VLAN IDs (1-4094); the issue is the lack of provisioning, not a hardware limitation.

Trap 3: The DNA Center appliance is not licensed for the Automation module.

Incorrect because licensing affects feature availability, but the engineer was able to create a profile and assign it to a site, indicating Automation is available.

Study all Cisco DNA Center common traps →

A
The engineer did not run the Provision workflow to push the configuration to the devices.
Correct because creating a profile and assigning it to a site only defines the intent; the actual configuration is pushed only when the Provision workflow is executed.
B
The VLAN ID conflicts with an existing VLAN on the switches.
Why wrong: Incorrect because DNA Center would report a conflict during provisioning, but the VLAN was never created, indicating the configuration was not pushed.
C
The switches do not support the VLAN ID range.
Why wrong: Incorrect because most switches support standard VLAN IDs (1-4094); the issue is the lack of provisioning, not a hardware limitation.
D
The DNA Center appliance is not licensed for the Automation module.
Why wrong: Incorrect because licensing affects feature availability, but the engineer was able to create a profile and assign it to a site, indicating Automation is available.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full wireless explanation →

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Trap 1: The APs are not running the recommended firmware version.

Incorrect while firmware can cause issues, the APs are registered and functional; association failures are more likely RF-related.

Trap 2: The wireless controller has reached its maximum number of APs.

Incorrect because if the controller were full, APs would not register; the scenario states APs are registered and functional.

Trap 3: The DNA Center Assurance module is not properly configured to…

Incorrect because the engineer is already seeing association failure data in Assurance, so monitoring is working.

Study all Cisco DNA Center common traps →

A
RF interference or poor signal-to-noise ratio on the affected APs.
Correct because high association failures are often due to RF issues, which DNA Center Assurance can detect and report.
B
The APs are not running the recommended firmware version.
Why wrong: Incorrect while firmware can cause issues, the APs are registered and functional; association failures are more likely RF-related.
C
The wireless controller has reached its maximum number of APs.
Why wrong: Incorrect because if the controller were full, APs would not register; the scenario states APs are registered and functional.
D
The DNA Center Assurance module is not properly configured to monitor wireless events.
Why wrong: Incorrect because the engineer is already seeing association failure data in Assurance, so monitoring is working.

Full breakdown with real-world context →

Question 4hardmultiple choice

Study the full QoS explanation →

A network engineer is deploying Cisco DNA Center in a brownfield network. The engineer wants to use DNA Center to automate the configuration of QoS policies across all access switches. After discovering the devices and adding them to Inventory, the engineer creates a QoS policy and assigns it to a site. However, when attempting to provision, DNA Center reports that the devices are in 'Compliance Error' state. What is the most likely reason?

Trap 1: The devices are not running a supported IOS-XE version for QoS…

Incorrect while version support is important, the scenario mentions devices are discovered and in Inventory, so they are supported; the error is compliance-related.

Trap 2: The DNA Center appliance does not have enough storage to process…

Incorrect because storage issues would cause operational failures, not compliance errors specific to configuration conflicts.

Trap 3: The QoS policy was created with an invalid DSCP value.

Incorrect because DNA Center would validate the policy during creation; a compliance error indicates a mismatch with the device, not an invalid policy.

Study all Cisco DNA Center common traps →

A
The devices have existing QoS configurations that conflict with the new policy.
Correct because DNA Center's compliance check compares the intended configuration with the actual device configuration. Conflicts cause compliance errors.
B
The devices are not running a supported IOS-XE version for QoS automation.
Why wrong: Incorrect while version support is important, the scenario mentions devices are discovered and in Inventory, so they are supported; the error is compliance-related.
C
The DNA Center appliance does not have enough storage to process the QoS policy.
Why wrong: Incorrect because storage issues would cause operational failures, not compliance errors specific to configuration conflicts.
D
The QoS policy was created with an invalid DSCP value.
Why wrong: Incorrect because DNA Center would validate the policy during creation; a compliance error indicates a mismatch with the device, not an invalid policy.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full DNA Center explanation →

A network engineer is using Cisco DNA Center to manage a network with multiple sites. The engineer wants to ensure that all devices at a remote site have the same NTP server configuration. The engineer creates a network profile with the NTP settings and assigns it to the site. After provisioning, the engineer checks one of the switches and finds that the NTP configuration is missing. What should the engineer check first?

Trap 1: Check if the NTP server is reachable from the device.

Incorrect because the configuration is missing entirely, not just failing to sync; the issue is with provisioning, not reachability.

Trap 2: Ensure that the device is running a supported IOS version.

Incorrect because the device is already in Inventory and managed, so it is supported; the issue is site assignment.

Trap 3: Recreate the network profile with the correct NTP settings.

Incorrect because the profile may be correct; the issue is likely that the device is not in the correct site to receive the profile.

Study all Cisco DNA Center common traps →

A
Verify that the device is assigned to the correct site in DNA Center.
Correct because if the device is not in the site where the profile is applied, it will not receive the configuration.
B
Check if the NTP server is reachable from the device.
Why wrong: Incorrect because the configuration is missing entirely, not just failing to sync; the issue is with provisioning, not reachability.
C
Ensure that the device is running a supported IOS version.
Why wrong: Incorrect because the device is already in Inventory and managed, so it is supported; the issue is site assignment.
D
Recreate the network profile with the correct NTP settings.
Why wrong: Incorrect because the profile may be correct; the issue is likely that the device is not in the correct site to receive the profile.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full DNA Center explanation →

A network engineer is troubleshooting an issue where Cisco DNA Center is not sending configuration changes to a group of switches. The engineer checks the Provisioning dashboard and sees that the devices are in 'Pending' state. The engineer has already created the intent (network profile) and assigned it to the site. What is the most likely cause?

Trap 1: The devices are not reachable from DNA Center.

Incorrect because if devices were unreachable, they would show as 'Unreachable' or 'Error', not 'Pending'.

Trap 2: The DNA Center appliance is out of disk space.

Incorrect because disk space issues would cause system-wide failures, not a specific 'Pending' state for provisioning.

Trap 3: The network profile contains an invalid configuration.

Incorrect because DNA Center validates profiles during creation; an invalid profile would cause an error, not a 'Pending' state.

Study all Cisco DNA Center common traps →

A
The engineer has not executed the Provision workflow to deploy the configuration.
Correct because 'Pending' means the configuration is ready but not yet deployed; the engineer must run the Provision workflow.
B
The devices are not reachable from DNA Center.
Why wrong: Incorrect because if devices were unreachable, they would show as 'Unreachable' or 'Error', not 'Pending'.
C
The DNA Center appliance is out of disk space.
Why wrong: Incorrect because disk space issues would cause system-wide failures, not a specific 'Pending' state for provisioning.
D
The network profile contains an invalid configuration.
Why wrong: Incorrect because DNA Center validates profiles during creation; an invalid profile would cause an error, not a 'Pending' state.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full DNA Center explanation →

A network engineer is using Cisco DNA Center to monitor network health. The Assurance dashboard shows that a particular access switch has a high CPU utilization issue. The engineer wants to investigate the root cause using DNA Center's built-in tools. Which feature should the engineer use to analyze the switch's CPU utilization over time?

Trap 1: Use the 'Command Runner' to execute 'show process cpu' on the…

Incorrect while Command Runner can show real-time CPU, it does not provide historical trends; Trends is the appropriate tool for analysis over time.

Trap 2: Use the 'Path Trace' tool to analyze traffic paths.

Incorrect because Path Trace is used for network path analysis, not device CPU monitoring.

Trap 3: Use the 'Software Image Management' to check for software bugs.

Incorrect because Software Image Management is for firmware updates, not performance analysis.

Study all Cisco DNA Center common traps →

A
Use the 'Trends' feature in Assurance to view CPU utilization over time.
Correct because Trends provides historical data for performance metrics, including CPU utilization.
B
Use the 'Command Runner' to execute 'show process cpu' on the switch.
Why wrong: Incorrect while Command Runner can show real-time CPU, it does not provide historical trends; Trends is the appropriate tool for analysis over time.
C
Use the 'Path Trace' tool to analyze traffic paths.
Why wrong: Incorrect because Path Trace is used for network path analysis, not device CPU monitoring.
D
Use the 'Software Image Management' to check for software bugs.
Why wrong: Incorrect because Software Image Management is for firmware updates, not performance analysis.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full DNA Center explanation →

A network engineer is planning to use Cisco DNA Center to automate the deployment of a new branch office. The engineer has already discovered the devices and added them to Inventory. The engineer wants to use a template to configure the devices consistently. Which tool in DNA Center should the engineer use to create and apply the template?

Trap 1: Use the 'Policy Editor' to create a policy-based configuration.

Incorrect because Policy Editor is for creating network policies (e.g., QoS, security), not CLI templates.

Trap 2: Use the 'Command Runner' to execute commands on multiple devices.

Incorrect because Command Runner is for ad-hoc commands, not for creating reusable templates.

Trap 3: Use the 'Network Profiles' to define the configuration.

Incorrect because Network Profiles are for defining settings like VLANs, but they are not as flexible as templates for custom CLI configurations.

Study all Cisco DNA Center common traps →

A
Use the 'Template Editor' to create a CLI template and apply it during provisioning.
Correct because Template Editor is designed for creating and applying configuration templates in DNA Center.
B
Use the 'Policy Editor' to create a policy-based configuration.
Why wrong: Incorrect because Policy Editor is for creating network policies (e.g., QoS, security), not CLI templates.
C
Use the 'Command Runner' to execute commands on multiple devices.
Why wrong: Incorrect because Command Runner is for ad-hoc commands, not for creating reusable templates.
D
Use the 'Network Profiles' to define the configuration.
Why wrong: Incorrect because Network Profiles are for defining settings like VLANs, but they are not as flexible as templates for custom CLI configurations.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?

Trap 1: Check if the syslog messages are in the correct format.

Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.

Trap 2: Ensure that the switch is in the Inventory and managed by DNA…

Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.

Trap 3: Restart the syslog collector service on DNA Center.

Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

Study all Cisco DNA Center common traps →

A
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Correct because syslog uses UDP 514, and if the port is blocked, messages will not reach DNA Center.
B
Check if the syslog messages are in the correct format.
Why wrong: Incorrect because DNA Center accepts standard syslog formats; format issues would not prevent all messages from being received.
C
Ensure that the switch is in the Inventory and managed by DNA Center.
Why wrong: Incorrect because syslog collection does not require the device to be in Inventory; it is a separate function.
D
Restart the syslog collector service on DNA Center.
Why wrong: Incorrect because the collector is enabled, so restarting it is unlikely to resolve a connectivity issue.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full Python automation breakdown →

A network engineer writes the following Python script to retrieve the list of devices from Cisco DNA Center using the REST API:

import requests
import json

url = "https://dna-center.local/dna/intent/api/v1/network-device" headers = {

"Content-Type": "application/json",
    "X-Auth-Token": "valid-token-here"
}

response = requests.get(url, headers=headers, verify=False)

if response.status_code == 200:

devices = response.json()

for device in devices["response"]:
        print(device["hostname"])

else:

print("Error:", response.status_code)

What is the issue with this code?

Trap 1: The URL is incorrect; it should be…

The URL is correct for listing network devices. The issue is not the URL.

Trap 2: The code does not handle authentication properly; it should use…

The X-Auth-Token header is the correct way to authenticate after obtaining a token. Basic Auth is not used for DNA Center REST API.

Trap 3: The code fails because it does not import the json module correctly.

The import is correct. The json module is used to parse the response.

Study all Cisco DNA Center common traps →

A
The code uses verify=False which is insecure but functional; the main issue is missing pagination handling.
Correct. The API may return multiple pages, but the code only retrieves the first page. It should check for a 'lastIndex' field and loop to fetch all pages.
B
The URL is incorrect; it should be /dna/intent/api/v1/network-device/list.
Why wrong: The URL is correct for listing network devices. The issue is not the URL.
C
The code does not handle authentication properly; it should use Basic Auth.
Why wrong: The X-Auth-Token header is the correct way to authenticate after obtaining a token. Basic Auth is not used for DNA Center REST API.
D
The code fails because it does not import the json module correctly.
Why wrong: The import is correct. The json module is used to parse the response.

Full breakdown with real-world context →

Question 11hardmultiple choice

Open the full VLAN trunking answer →

An Ansible playbook is written to configure a VLAN on a Cisco IOS-XE device via Cisco DNA Center's intent API:

- name: Configure VLAN via DNA Center hosts: localhost gather_facts: no tasks: - name: Create VLAN 100 cisco.dnac.vlan: host: "{{ dnac_host }}"

username: "{{ dnac_username }}"

password: "{{ dnac_password }}" validate_certs: no state: present vlan_name: "Engineering" vlan_id: 100 site_id: "{{ site_id }}" register: result

- debug: var=result

What is a potential issue with this playbook?

Trap 1: The module name is incorrect; it should be cisco.dnac.network_vlan.

The module cisco.dnac.vlan is valid for managing VLANs in DNA Center.

Trap 2: The playbook does not include a task to obtain an authentication…

The cisco.dnac collection modules handle authentication internally if host, username, and password are provided.

Trap 3: The 'state: present' is invalid; it should be 'state: create'.

'state: present' is the correct parameter to ensure the VLAN exists. 'create' is not a valid state.

Study all Cisco DNA Center common traps →

A
The module name is incorrect; it should be cisco.dnac.network_vlan.
Why wrong: The module cisco.dnac.vlan is valid for managing VLANs in DNA Center.
B
The playbook does not include a task to obtain an authentication token, which is required by DNA Center API.
Why wrong: The cisco.dnac collection modules handle authentication internally if host, username, and password are provided.
C
The 'site_id' parameter is mandatory for creating a VLAN in DNA Center; if missing, the task will fail.
Correct. DNA Center requires a site ID to associate the VLAN with a specific site. Without it, the API call will return an error.
D
The 'state: present' is invalid; it should be 'state: create'.
Why wrong: 'state: present' is the correct parameter to ensure the VLAN exists. 'create' is not a valid state.

Full breakdown with real-world context →

Question 12easymultiple choice

Study the full Python automation breakdown →

A network engineer is using the Cisco DNA Center REST API to retrieve the health score of a specific device. The API response is as follows:

{
  "response": [
    {
      "deviceId": "1234567890",
      "hostname": "Core-Switch-1",
      "score": 8,
      "overallHealth": "good",
      "timestamp": 1623456789
    }
  ],
  "version": "1.0"
}

The engineer wants to extract the 'overallHealth' value. Which Python code correctly extracts it?

Trap 1: health = response['overallHealth']

This would fail because 'overallHealth' is not a top-level key.

Trap 2: health = response['response']['overallHealth']

This would fail because 'response' contains a list, not a dictionary.

Trap 3: health = response[0]['overallHealth']

This would fail because the top-level object is a dictionary, not a list.

Study all Cisco DNA Center common traps →

A
health = response['response'][0]['overallHealth']
Correct. This accesses the first element of the list inside 'response' and then retrieves 'overallHealth'.
B
health = response['overallHealth']
Why wrong: This would fail because 'overallHealth' is not a top-level key.
C
health = response['response']['overallHealth']
Why wrong: This would fail because 'response' contains a list, not a dictionary.
D
health = response[0]['overallHealth']
Why wrong: This would fail because the top-level object is a dictionary, not a list.

Full breakdown with real-world context →

Question 13mediummultiple choice

Study the full Python automation breakdown →

A network engineer is using Netmiko to connect to a Cisco IOS-XE device that is managed by Cisco DNA Center. The script is:

from netmiko import ConnectHandler

device = { 'device_type': 'cisco_ios', 'host': '10.10.10.1', 'username': 'admin', 'password': 'cisco123', 'secret': 'enable123'

connection = ConnectHandler(**device) connection.enable() output = connection.send_command('show ip interface brief')

print(output)

connection.disconnect()

What is a potential security concern with this script in the context of DNA Center?

Trap 1: The script does not handle authentication failures gracefully.

While true, the main security concern is plain text credentials.

Trap 2: The device_type should be 'cisco_xe' for IOS-XE.

'cisco_ios' works for IOS-XE devices as well.

Trap 3: The script should use SSH keys instead of passwords.

While SSH keys are more secure, the immediate issue is plain text storage.

Study all Cisco DNA Center common traps →

A
The script does not handle authentication failures gracefully.
Why wrong: While true, the main security concern is plain text credentials.
B
The enable secret is hardcoded in plain text, which is a security risk.
Correct. Hardcoding credentials is insecure. They should be stored in a secure manner.
C
The device_type should be 'cisco_xe' for IOS-XE.
Why wrong: 'cisco_ios' works for IOS-XE devices as well.
D
The script should use SSH keys instead of passwords.
Why wrong: While SSH keys are more secure, the immediate issue is plain text storage.

Full breakdown with real-world context →

Question 14easymultiple choice

Study the full Python automation breakdown →

An engineer is using the Cisco DNA Center GUI to create a new site hierarchy. They add a building under an existing area. After saving, they run a Python script to verify the site via API:

import requests

url = "https://dna-center.local/dna/intent/api/v1/site" headers = {"X-Auth-Token": "token"} response = requests.get(url, headers=headers, verify=False) sites = response.json()['response']

for site in sites:
    if site['name'] == 'Building-A':
        print(site['id'])

What is the output if the building was created successfully?

Trap 1: The script will print 'Building-A'

The script prints site['id'], not site['name'].

Trap 2: The script will print the entire site dictionary

It only prints the id field.

Trap 3: The script will raise an error because the API returns paginated…

The script assumes all sites are returned in one response, which may be true for small hierarchies, but the output would still be the ID if found.

Study all Cisco DNA Center common traps →

A
A UUID string such as '123e4567-e89b-12d3-a456-426614174000'
Correct. The API returns a UUID for each site, and the script prints it.
B
The script will print 'Building-A'
Why wrong: The script prints site['id'], not site['name'].
C
The script will print the entire site dictionary
Why wrong: It only prints the id field.
D
The script will raise an error because the API returns paginated results
Why wrong: The script assumes all sites are returned in one response, which may be true for small hierarchies, but the output would still be the ID if found.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Ansible explanation →

An Ansible playbook uses the cisco.dnac.site module to create a new building site. The playbook is:

- name: Create building site cisco.dnac.site: host: "{{ dnac_host }}"

username: "{{ dnac_username }}"

password: "{{ dnac_password }}" validate_certs: no state: present site: name: Building-B type: building parentName: Area-1 address: "123 Main St" latitude: 37.7749 longitude: -122.4194 register: result

What is the purpose of the 'parentName' parameter?

Trap 1: It defines the DNS domain name for the building.

This is not related to DNS.

Trap 2: It sets the name of the network profile associated with the…

Network profiles are separate from site hierarchy.

Trap 3: It is used to specify the building's primary IP address.

The building itself does not have an IP address.

Study all Cisco DNA Center common traps →

A
It specifies the name of the building's parent in the hierarchy, such as an area or global site.
Correct. The parentName defines where in the site hierarchy the building is placed.
B
It defines the DNS domain name for the building.
Why wrong: This is not related to DNS.
C
It sets the name of the network profile associated with the building.
Why wrong: Network profiles are separate from site hierarchy.
D
It is used to specify the building's primary IP address.
Why wrong: The building itself does not have an IP address.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full REST/YANG explanation →

A network engineer is configuring model-driven telemetry on a Cisco IOS-XE device that is part of a DNA Center managed fabric. The telemetry subscription configuration is:

telemetry ietf subscription 101 encoding encode-kvgpb filter xpath /process-cpu-ios-xe-oper:cpu-usage/cpu-utilization stream yang-push update-policy periodic 500 receiver ip address 10.10.10.10 port 5555 protocol grpc-tcp

What is the purpose of the 'encoding encode-kvgpb' line?

Trap 1: It sets the encoding to JSON format for the telemetry data.

KVGPB is not JSON; it is a binary encoding.

Trap 2: It enables encryption of the telemetry data.

Encoding is not encryption; it is a serialization format.

Trap 3: It defines the compression algorithm for the telemetry stream.

Encoding does not imply compression.

Study all Cisco DNA Center common traps →

A
It sets the encoding to JSON format for the telemetry data.
Why wrong: KVGPB is not JSON; it is a binary encoding.
B
It specifies that the data should be encoded using Google Protocol Buffers (protobuf) with key-value pairs.
Correct. KVGPB is a protobuf-based encoding optimized for telemetry.
C
It enables encryption of the telemetry data.
Why wrong: Encoding is not encryption; it is a serialization format.
D
It defines the compression algorithm for the telemetry stream.
Why wrong: Encoding does not imply compression.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full DNA Center explanation →

A network engineer uses the Cisco DNA Center API to trigger a provisioning workflow for a new device. The API call returns the following JSON response:

{
  "response": {
    "taskId": "task-12345",
    "url": "/api/v1/task/task-12345"
  },
  "version": "1.0"
}

The engineer then polls the task status using the URL. Which HTTP method should be used to retrieve the task status?

Trap 1: POST

POST is used to create resources, not retrieve status.

Trap 2: PUT

PUT is used to update resources.

Trap 3: DELETE

DELETE is used to remove resources.

Study all Cisco DNA Center common traps →

A
GET
Correct. A GET request retrieves the task status.
B
POST
Why wrong: POST is used to create resources, not retrieve status.
C
PUT
Why wrong: PUT is used to update resources.
D
DELETE
Why wrong: DELETE is used to remove resources.

Full breakdown with real-world context →

Question 18hardmultiple choice

Study the full Python automation breakdown →

An engineer is writing a Python script to use the Cisco DNA Center API to assign a device to a site. The code snippet is:

import requests

url = "https://dna-center.local/dna/intent/api/v1/network-device/assign" headers = {

"X-Auth-Token": "token",
    "Content-Type": "application/json"
}

payload = {

"deviceId": "device-uuid",
    "siteId": "site-uuid"
}

response = requests.post(url, headers=headers, json=payload, verify=False)

print(response.status_code)

What is a potential issue with this code?

Trap 1: The payload should include 'deviceId' and 'siteId' as a list.

The payload format is correct as a dictionary.

Trap 2: The URL is missing the version number.

The URL includes /v1/ which is correct.

Study all Cisco DNA Center common traps →

A
The HTTP method should be PUT instead of POST for assigning a device to a site.
Correct. The DNA Center API uses PUT for this operation.
B
The payload should include 'deviceId' and 'siteId' as a list.
Why wrong: The payload format is correct as a dictionary.
C
The URL is missing the version number.
Why wrong: The URL includes /v1/ which is correct.
D
The code should use requests.put instead of requests.post.
This is the same as option A, but both are correct. However, the question expects one answer. Option A is more specific.

Full breakdown with real-world context →

Question 19mediummultiple choice

Open the full VLAN trunking answer →

Examine the following partial Cisco IOS-XE configuration:

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 ip access-group ACL_IN in
 spanning-tree portfast

What is the effect of this configuration?

Trap 1: The port will become a trunk port and participate in VLAN trunking.

The port is configured as an access port, not a trunk.

Trap 2: The port will use Rapid PVST+ and immediately forward after a link…

PortFast does not change the STP mode; it only affects initial convergence.

Trap 3: The port will block all inbound traffic due to the ACL.

The ACL is applied inbound but does not block all traffic; it filters based on the ACL entries.

Study all Cisco DNA Center common traps →

A
The port will immediately transition to forwarding state, reducing STP convergence time for end hosts.
spanning-tree portfast on an access port causes immediate forwarding, as intended for host ports.
B
The port will become a trunk port and participate in VLAN trunking.
Why wrong: The port is configured as an access port, not a trunk.
C
The port will use Rapid PVST+ and immediately forward after a link failure.
Why wrong: PortFast does not change the STP mode; it only affects initial convergence.
D
The port will block all inbound traffic due to the ACL.
Why wrong: The ACL is applied inbound but does not block all traffic; it filters based on the ACL entries.

Full breakdown with real-world context →

Question 20mediummultiple choice

Study the full EIGRP explanation →

Consider the following configuration snippet from a Cisco IOS-XE router:

router eigrp 100
 network 10.0.0.0
 network 192.168.1.0
 passive-interface default
 no passive-interface GigabitEthernet0/0

What is the effect of the passive-interface commands?

Trap 1: EIGRP hellos are sent on all interfaces, but updates are blocked.

Passive-interface blocks hellos, not just updates.

Trap 2: EIGRP adjacency is formed on all interfaces except…

The opposite is true: adjacency is only formed on G0/0.

Trap 3: EIGRP is disabled on all interfaces.

EIGRP is still enabled but only active on G0/0.

Study all Cisco DNA Center common traps →

A
EIGRP hellos are suppressed on all interfaces except GigabitEthernet0/0.
The default passive suppresses hellos on all interfaces, and the no passive allows them on G0/0.
B
EIGRP hellos are sent on all interfaces, but updates are blocked.
Why wrong: Passive-interface blocks hellos, not just updates.
C
EIGRP adjacency is formed on all interfaces except GigabitEthernet0/0.
Why wrong: The opposite is true: adjacency is only formed on G0/0.
D
EIGRP is disabled on all interfaces.
Why wrong: EIGRP is still enabled but only active on G0/0.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Cisco DNA Center sessions

Start a Cisco DNA Center only practice session

Every question in these sessions is drawn from the Cisco DNA Center domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Cisco DNA Center questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about Cisco DNA Center?: Cisco DNA Center questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Cisco DNA Center questions in a focused session?: Yes — the session launcher on this page draws every question from the Cisco DNA Center domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

Cisco DNA Center only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions Cisco DNA Center domain overview 350-401 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Cisco DNA Center practice questions

What to know about Cisco DNA Center

Common Cisco DNA Center exam traps

Cisco DNA Center questions

Track your progress over time

Start a Cisco DNA Center only practice session

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid